1 // Copyright 2011 The Go Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style
3 // license that can be found in the LICENSE file.
14 "golang.org/x/crypto/openpgp/elgamal"
15 "golang.org/x/crypto/openpgp/errors"
18 const encryptedKeyVersion = 3
20 // EncryptedKey represents a public-key encrypted session key. See RFC 4880,
22 type EncryptedKey struct {
24 Algo PublicKeyAlgorithm
25 CipherFunc CipherFunction // only valid after a successful Decrypt
26 Key []byte // only valid after a successful Decrypt
28 encryptedMPI1, encryptedMPI2 parsedMPI
31 func (e *EncryptedKey) parse(r io.Reader) (err error) {
33 _, err = readFull(r, buf[:])
37 if buf[0] != encryptedKeyVersion {
38 return errors.UnsupportedError("unknown EncryptedKey version " + strconv.Itoa(int(buf[0])))
40 e.KeyId = binary.BigEndian.Uint64(buf[1:9])
41 e.Algo = PublicKeyAlgorithm(buf[9])
43 case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
44 e.encryptedMPI1.bytes, e.encryptedMPI1.bitLength, err = readMPI(r)
48 case PubKeyAlgoElGamal:
49 e.encryptedMPI1.bytes, e.encryptedMPI1.bitLength, err = readMPI(r)
53 e.encryptedMPI2.bytes, e.encryptedMPI2.bitLength, err = readMPI(r)
58 _, err = consumeAll(r)
62 func checksumKeyMaterial(key []byte) uint16 {
64 for _, v := range key {
70 // Decrypt decrypts an encrypted session key with the given private key. The
71 // private key must have been decrypted first.
72 // If config is nil, sensible defaults will be used.
73 func (e *EncryptedKey) Decrypt(priv *PrivateKey, config *Config) error {
77 // TODO(agl): use session key decryption routines here to avoid
78 // padding oracle attacks.
79 switch priv.PubKeyAlgo {
80 case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
81 k := priv.PrivateKey.(*rsa.PrivateKey)
82 b, err = rsa.DecryptPKCS1v15(config.Random(), k, padToKeySize(&k.PublicKey, e.encryptedMPI1.bytes))
83 case PubKeyAlgoElGamal:
84 c1 := new(big.Int).SetBytes(e.encryptedMPI1.bytes)
85 c2 := new(big.Int).SetBytes(e.encryptedMPI2.bytes)
86 b, err = elgamal.Decrypt(priv.PrivateKey.(*elgamal.PrivateKey), c1, c2)
88 err = errors.InvalidArgumentError("cannot decrypted encrypted session key with private key of type " + strconv.Itoa(int(priv.PubKeyAlgo)))
95 e.CipherFunc = CipherFunction(b[0])
96 e.Key = b[1 : len(b)-2]
97 expectedChecksum := uint16(b[len(b)-2])<<8 | uint16(b[len(b)-1])
98 checksum := checksumKeyMaterial(e.Key)
99 if checksum != expectedChecksum {
100 return errors.StructuralError("EncryptedKey checksum incorrect")
106 // Serialize writes the encrypted key packet, e, to w.
107 func (e *EncryptedKey) Serialize(w io.Writer) error {
110 case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
111 mpiLen = 2 + len(e.encryptedMPI1.bytes)
112 case PubKeyAlgoElGamal:
113 mpiLen = 2 + len(e.encryptedMPI1.bytes) + 2 + len(e.encryptedMPI2.bytes)
115 return errors.InvalidArgumentError("don't know how to serialize encrypted key type " + strconv.Itoa(int(e.Algo)))
118 serializeHeader(w, packetTypeEncryptedKey, 1 /* version */ +8 /* key id */ +1 /* algo */ +mpiLen)
120 w.Write([]byte{encryptedKeyVersion})
121 binary.Write(w, binary.BigEndian, e.KeyId)
122 w.Write([]byte{byte(e.Algo)})
125 case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
126 writeMPIs(w, e.encryptedMPI1)
127 case PubKeyAlgoElGamal:
128 writeMPIs(w, e.encryptedMPI1, e.encryptedMPI2)
130 panic("internal error")
136 // SerializeEncryptedKey serializes an encrypted key packet to w that contains
137 // key, encrypted to pub.
138 // If config is nil, sensible defaults will be used.
139 func SerializeEncryptedKey(w io.Writer, pub *PublicKey, cipherFunc CipherFunction, key []byte, config *Config) error {
141 buf[0] = encryptedKeyVersion
142 binary.BigEndian.PutUint64(buf[1:9], pub.KeyId)
143 buf[9] = byte(pub.PubKeyAlgo)
145 keyBlock := make([]byte, 1 /* cipher type */ +len(key)+2 /* checksum */)
146 keyBlock[0] = byte(cipherFunc)
147 copy(keyBlock[1:], key)
148 checksum := checksumKeyMaterial(key)
149 keyBlock[1+len(key)] = byte(checksum >> 8)
150 keyBlock[1+len(key)+1] = byte(checksum)
152 switch pub.PubKeyAlgo {
153 case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
154 return serializeEncryptedKeyRSA(w, config.Random(), buf, pub.PublicKey.(*rsa.PublicKey), keyBlock)
155 case PubKeyAlgoElGamal:
156 return serializeEncryptedKeyElGamal(w, config.Random(), buf, pub.PublicKey.(*elgamal.PublicKey), keyBlock)
157 case PubKeyAlgoDSA, PubKeyAlgoRSASignOnly:
158 return errors.InvalidArgumentError("cannot encrypt to public key of type " + strconv.Itoa(int(pub.PubKeyAlgo)))
161 return errors.UnsupportedError("encrypting a key to public key of type " + strconv.Itoa(int(pub.PubKeyAlgo)))
164 func serializeEncryptedKeyRSA(w io.Writer, rand io.Reader, header [10]byte, pub *rsa.PublicKey, keyBlock []byte) error {
165 cipherText, err := rsa.EncryptPKCS1v15(rand, pub, keyBlock)
167 return errors.InvalidArgumentError("RSA encryption failed: " + err.Error())
170 packetLen := 10 /* header length */ + 2 /* mpi size */ + len(cipherText)
172 err = serializeHeader(w, packetTypeEncryptedKey, packetLen)
176 _, err = w.Write(header[:])
180 return writeMPI(w, 8*uint16(len(cipherText)), cipherText)
183 func serializeEncryptedKeyElGamal(w io.Writer, rand io.Reader, header [10]byte, pub *elgamal.PublicKey, keyBlock []byte) error {
184 c1, c2, err := elgamal.Encrypt(rand, pub, keyBlock)
186 return errors.InvalidArgumentError("ElGamal encryption failed: " + err.Error())
189 packetLen := 10 /* header length */
190 packetLen += 2 /* mpi size */ + (c1.BitLen()+7)/8
191 packetLen += 2 /* mpi size */ + (c2.BitLen()+7)/8
193 err = serializeHeader(w, packetTypeEncryptedKey, packetLen)
197 _, err = w.Write(header[:])
201 err = writeBig(w, c1)
205 return writeBig(w, c2)