Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

GopenPGP miscomputes "v5" signatures #261

Open
teythoon opened this issue Nov 27, 2023 · 0 comments
Open

GopenPGP miscomputes "v5" signatures #261

teythoon opened this issue Nov 27, 2023 · 0 comments
Labels
v2 Targeting GopenPGP v2

Comments

@teythoon
Copy link

GopenPGP 2.7.4 miscomputes draft-koch-openpgp-2015-rfc4880bis (aka "v5 OpenPGP") signatures. The signatures roundtrip fine, but are rejected by OpenPGP.js 5.5.0 and GnuPG 2.4.0. Signatures created by OpenPGP.js 5.5.0 and GnuPG 2.4.0 are rejected by GopenPGP 2.7.4.

There may also be some kind of packet corruption, as both Sequoia and OpenPGP.js report a packet truncation.

https://tests.sequoia-pgp.org/#Sign_Encrypt-Decrypt_Verify_roundtrip_with_key__Emma_

Consider dropping support for "v5" signatures (see #260). If no one complained about broken signatures so far, it is likely not used in the wild.
@lubux lubux added the v2 Targeting GopenPGP v2 label Jun 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
v2 Targeting GopenPGP v2
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@teythoon @lubux