Openpgpjs: readArmored regression: does not care about checksum

Created on 4 Jul 2019 · 7Comments · Source: openpgpjs/openpgpjs

OpenPGP.js no longer throws / rejects on failed armor checksum.

Notice I manually edited the checksum in the armored text to =aaaa.

OpenPGP.js v2:

OpenPGP.js v4:

Source

tomholub

Most helpful comment

On a general note, I really like the attention this library is getting lately, thanks for the ongoing work! :muscle:

tomholub on 12 Jul 2019

👍2 😄1

All 7 comments

Since streaming support, OpenPGP.js no longer reads the entire message until you start reading the decrypted message. When not streaming, this should result in openpgp.decrypt throwing. Is this happening for you?

If you need to know about this error in advance for some reason, you could probably do something like

  const input = await openpgp.armor.decode(armoredText);
  const data = await openpgp.stream.readToEnd(input.data); // Should throw on checksum mismatch
  const message = await openpgp.message.read(data);

twiss on 8 Jul 2019

I use message.decrypt(...) which doesn't throw, without streaming. I can try to make a small repro if message.decrypt is expected to throw.

tomholub on 9 Jul 2019

Hmm, weird. Yes, please do!

twiss on 9 Jul 2019

Here, didn't throw:

(async () => {
  const { privateKeyArmored } = await openpgp.generateKey({ curve: 'curve25519', userIds: [{ email: '[email protected]' }] });
  const { keys: [key] } = await openpgp.key.readArmored(privateKeyArmored);
  const { data } = await openpgp.encrypt({ message: openpgp.message.fromText('msg'), publicKeys: [key.toPublic()] });
  console.log('\n\noriginal msg:\n', data);
  const badSumData = data.replace(/\n=[a-zA-Z0-9/+]{4}/, '\n=aaaa');
  console.log('\n\nbadSumData msg:\n', badSumData);
  const m = await openpgp.message.readArmored(badSumData);
  const decrypted = await m.decrypt([key]);
  const content = await openpgp.stream.readToEnd(decrypted.getLiteralData());
  console.log(`\n\ndecrypted content:\n${openpgp.util.Uint8Array_to_str(content)}`);
})().catch(console.error);

tomholub on 11 Jul 2019

I could reproduce.

chesnokovilya on 12 Jul 2019

👍1

Oof, right. Even the high-level API doesn't throw when not streaming. This was broken in 5dcaf85 (src/packet/packet.js), I think. It's unfortunate that we didn't even have tests for this. I can look at this more when I get back from 🌴.

twiss on 12 Jul 2019

On a general note, I really like the attention this library is getting lately, thanks for the ongoing work! :muscle:

tomholub on 12 Jul 2019

👍2 😄1

Was this page helpful?

0 / 5 - 0 ratings