PGPainless/pgpainless
PGPainless/pgpainless
1
0
Fork 0
mirror of https://github.com/pgpainless/pgpainless.git synced 2025-09-09 10:19:39 +02:00
Code Issues Releases Wiki Activity

Use relaxed PBE parameters

Browse source
This commit is contained in:
Paul Schaub 2025-03-13 15:31:44 +01:00
parent 18cdf6bbc7
commit d92ae054d9
Signed by: vanitasvitae
GPG key ID: 62BEE9264BF17311
4 changed files with 21 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
pgpainless-core/src/main/kotlin/org/pgpainless/key/generation/KeyRingBuilder.kt
View file

@ -19,6 +19,7 @@ import org.pgpainless.algorithm.KeyFlag
import org.pgpainless.algorithm.OpenPGPKeyVersion
import org.pgpainless.algorithm.SignatureType
import org.pgpainless.bouncycastle.extensions.unlock
import org.pgpainless.key.protection.KeyRingProtectionSettings
import org.pgpainless.policy.Policy
import org.pgpainless.signature.subpackets.SelfSignatureSubpackets
import org.pgpainless.signature.subpackets.SignatureSubpackets
@ -231,10 +232,14 @@ class KeyRingBuilder(
aead: Boolean
): PBESecretKeyEncryptor? {
check(passphrase.isValid) { "Passphrase was cleared." }
val protectionSettings = KeyRingProtectionSettings.secureDefaultSettings()
return if (passphrase.isEmpty) null
else
OpenPGPImplementation.getInstance()
.pbeSecretKeyEncryptorFactory(aead)
.pbeSecretKeyEncryptorFactory(
aead,
protectionSettings.encryptionAlgorithm.algorithmId,
protectionSettings.s2kCount)
.build(passphrase.getChars(), publicKey.publicKeyPacket)
}

5
pgpainless-core/src/main/kotlin/org/pgpainless/key/protection/BaseSecretKeyRingProtector.kt
View file

@ -47,7 +47,10 @@ open class BaseSecretKeyRingProtector(
if (it.isEmpty) null
else
OpenPGPImplementation.getInstance()
.pbeSecretKeyEncryptorFactory(false)
.pbeSecretKeyEncryptorFactory(
false,
protectionSettings.encryptionAlgorithm.algorithmId,
protectionSettings.s2kCount)
.build(it.getChars(), key.publicKeyPacket)
}
}

13
pgpainless-core/src/main/kotlin/org/pgpainless/key/protection/KeyRingProtectionSettings.kt
View file

@ -19,7 +19,8 @@ import org.pgpainless.algorithm.SymmetricKeyAlgorithm
data class KeyRingProtectionSettings(
val encryptionAlgorithm: SymmetricKeyAlgorithm,
val hashAlgorithm: HashAlgorithm,
val s2kCount: Int
val s2kCount: Int,
val aead: Boolean
) {
/**
@ -31,7 +32,7 @@ data class KeyRingProtectionSettings(
*/
constructor(
encryptionAlgorithm: SymmetricKeyAlgorithm
) : this(encryptionAlgorithm, HashAlgorithm.SHA1, 0x60)
) : this(encryptionAlgorithm, HashAlgorithm.SHA1, 0x60, false)
init {
require(encryptionAlgorithm != SymmetricKeyAlgorithm.NULL) {
@ -50,6 +51,12 @@ data class KeyRingProtectionSettings(
*/
@JvmStatic
fun secureDefaultSettings() =
KeyRingProtectionSettings(SymmetricKeyAlgorithm.AES_256, HashAlgorithm.SHA256, 0x60)
KeyRingProtectionSettings(
SymmetricKeyAlgorithm.AES_256, HashAlgorithm.SHA256, 0x60, false)
@JvmStatic
fun aead() =
KeyRingProtectionSettings(
SymmetricKeyAlgorithm.AES_256, HashAlgorithm.SHA256, 0xff, true)
}
}

2
pgpainless-core/src/test/java/org/pgpainless/key/protection/InvalidProtectionSettingsTest.java
View file

@ -15,6 +15,6 @@ public class InvalidProtectionSettingsTest {
@Test
public void unencryptedKeyRingProtectionSettingsThrows() {
assertThrows(IllegalArgumentException.class, () ->
new KeyRingProtectionSettings(SymmetricKeyAlgorithm.NULL, HashAlgorithm.SHA256, 0x60));
new KeyRingProtectionSettings(SymmetricKeyAlgorithm.NULL, HashAlgorithm.SHA256, 0x60, false));
}
}