1 // Copyright 2011 The Go Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style
3 // license that can be found in the LICENSE file.
25 "golang.org/x/crypto/openpgp/elgamal"
26 "golang.org/x/crypto/openpgp/errors"
31 oidCurveP256 []byte = []byte{0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07}
33 oidCurveP384 []byte = []byte{0x2B, 0x81, 0x04, 0x00, 0x22}
35 oidCurveP521 []byte = []byte{0x2B, 0x81, 0x04, 0x00, 0x23}
38 const maxOIDLength = 8
40 // ecdsaKey stores the algorithm-specific fields for ECDSA keys.
41 // as defined in RFC 6637, Section 9.
42 type ecdsaKey struct {
43 // oid contains the OID byte sequence identifying the elliptic curve used
45 // p contains the elliptic curve point that represents the public key
49 // parseOID reads the OID for the curve as defined in RFC 6637, Section 9.
50 func parseOID(r io.Reader) (oid []byte, err error) {
51 buf := make([]byte, maxOIDLength)
52 if _, err = readFull(r, buf[:1]); err != nil {
56 if int(oidLen) > len(buf) {
57 err = errors.UnsupportedError("invalid oid length: " + strconv.Itoa(int(oidLen)))
61 _, err = readFull(r, oid)
65 func (f *ecdsaKey) parse(r io.Reader) (err error) {
66 if f.oid, err = parseOID(r); err != nil {
69 f.p.bytes, f.p.bitLength, err = readMPI(r)
73 func (f *ecdsaKey) serialize(w io.Writer) (err error) {
74 buf := make([]byte, maxOIDLength+1)
75 buf[0] = byte(len(f.oid))
77 if _, err = w.Write(buf[:len(f.oid)+1]); err != nil {
80 return writeMPIs(w, f.p)
83 func (f *ecdsaKey) newECDSA() (*ecdsa.PublicKey, error) {
85 if bytes.Equal(f.oid, oidCurveP256) {
87 } else if bytes.Equal(f.oid, oidCurveP384) {
89 } else if bytes.Equal(f.oid, oidCurveP521) {
92 return nil, errors.UnsupportedError(fmt.Sprintf("unsupported oid: %x", f.oid))
94 x, y := elliptic.Unmarshal(c, f.p.bytes)
96 return nil, errors.UnsupportedError("failed to parse EC point")
98 return &ecdsa.PublicKey{Curve: c, X: x, Y: y}, nil
101 func (f *ecdsaKey) byteLen() int {
102 return 1 + len(f.oid) + 2 + len(f.p.bytes)
105 type kdfHashFunction byte
106 type kdfAlgorithm byte
108 // ecdhKdf stores key derivation function parameters
109 // used for ECDH encryption. See RFC 6637, Section 9.
110 type ecdhKdf struct {
111 KdfHash kdfHashFunction
115 func (f *ecdhKdf) parse(r io.Reader) (err error) {
116 buf := make([]byte, 1)
117 if _, err = readFull(r, buf); err != nil {
120 kdfLen := int(buf[0])
122 return errors.UnsupportedError("Unsupported ECDH KDF length: " + strconv.Itoa(kdfLen))
124 buf = make([]byte, kdfLen)
125 if _, err = readFull(r, buf); err != nil {
128 reserved := int(buf[0])
129 f.KdfHash = kdfHashFunction(buf[1])
130 f.KdfAlgo = kdfAlgorithm(buf[2])
131 if reserved != 0x01 {
132 return errors.UnsupportedError("Unsupported KDF reserved field: " + strconv.Itoa(reserved))
137 func (f *ecdhKdf) serialize(w io.Writer) (err error) {
138 buf := make([]byte, 4)
139 // See RFC 6637, Section 9, Algorithm-Specific Fields for ECDH keys.
140 buf[0] = byte(0x03) // Length of the following fields
141 buf[1] = byte(0x01) // Reserved for future extensions, must be 1 for now
142 buf[2] = byte(f.KdfHash)
143 buf[3] = byte(f.KdfAlgo)
144 _, err = w.Write(buf[:])
148 func (f *ecdhKdf) byteLen() int {
152 // PublicKey represents an OpenPGP public key. See RFC 4880, section 5.5.2.
153 type PublicKey struct {
154 CreationTime time.Time
155 PubKeyAlgo PublicKeyAlgorithm
156 PublicKey interface{} // *rsa.PublicKey, *dsa.PublicKey or *ecdsa.PublicKey
161 n, e, p, q, g, y parsedMPI
168 // signingKey provides a convenient abstraction over signature verification
169 // for v3 and v4 public keys.
170 type signingKey interface {
171 SerializeSignaturePrefix(io.Writer)
172 serializeWithoutHeaders(io.Writer) error
175 func fromBig(n *big.Int) parsedMPI {
178 bitLength: uint16(n.BitLen()),
182 // NewRSAPublicKey returns a PublicKey that wraps the given rsa.PublicKey.
183 func NewRSAPublicKey(creationTime time.Time, pub *rsa.PublicKey) *PublicKey {
185 CreationTime: creationTime,
186 PubKeyAlgo: PubKeyAlgoRSA,
189 e: fromBig(big.NewInt(int64(pub.E))),
192 pk.setFingerPrintAndKeyId()
196 // NewDSAPublicKey returns a PublicKey that wraps the given dsa.PublicKey.
197 func NewDSAPublicKey(creationTime time.Time, pub *dsa.PublicKey) *PublicKey {
199 CreationTime: creationTime,
200 PubKeyAlgo: PubKeyAlgoDSA,
208 pk.setFingerPrintAndKeyId()
212 // NewElGamalPublicKey returns a PublicKey that wraps the given elgamal.PublicKey.
213 func NewElGamalPublicKey(creationTime time.Time, pub *elgamal.PublicKey) *PublicKey {
215 CreationTime: creationTime,
216 PubKeyAlgo: PubKeyAlgoElGamal,
223 pk.setFingerPrintAndKeyId()
227 func NewECDSAPublicKey(creationTime time.Time, pub *ecdsa.PublicKey) *PublicKey {
229 CreationTime: creationTime,
230 PubKeyAlgo: PubKeyAlgoECDSA,
236 case elliptic.P256():
237 pk.ec.oid = oidCurveP256
238 case elliptic.P384():
239 pk.ec.oid = oidCurveP384
240 case elliptic.P521():
241 pk.ec.oid = oidCurveP521
243 panic("unknown elliptic curve")
246 pk.ec.p.bytes = elliptic.Marshal(pub.Curve, pub.X, pub.Y)
247 pk.ec.p.bitLength = uint16(8 * len(pk.ec.p.bytes))
249 pk.setFingerPrintAndKeyId()
253 func (pk *PublicKey) parse(r io.Reader) (err error) {
254 // RFC 4880, section 5.5.2
256 _, err = readFull(r, buf[:])
261 return errors.UnsupportedError("public key version")
263 pk.CreationTime = time.Unix(int64(uint32(buf[1])<<24|uint32(buf[2])<<16|uint32(buf[3])<<8|uint32(buf[4])), 0)
264 pk.PubKeyAlgo = PublicKeyAlgorithm(buf[5])
265 switch pk.PubKeyAlgo {
266 case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
270 case PubKeyAlgoElGamal:
271 err = pk.parseElGamal(r)
272 case PubKeyAlgoECDSA:
273 pk.ec = new(ecdsaKey)
274 if err = pk.ec.parse(r); err != nil {
277 pk.PublicKey, err = pk.ec.newECDSA()
279 pk.ec = new(ecdsaKey)
280 if err = pk.ec.parse(r); err != nil {
283 pk.ecdh = new(ecdhKdf)
284 if err = pk.ecdh.parse(r); err != nil {
287 // The ECDH key is stored in an ecdsa.PublicKey for convenience.
288 pk.PublicKey, err = pk.ec.newECDSA()
290 err = errors.UnsupportedError("public key type: " + strconv.Itoa(int(pk.PubKeyAlgo)))
296 pk.setFingerPrintAndKeyId()
300 func (pk *PublicKey) setFingerPrintAndKeyId() {
301 // RFC 4880, section 12.2
302 fingerPrint := sha1.New()
303 pk.SerializeSignaturePrefix(fingerPrint)
304 pk.serializeWithoutHeaders(fingerPrint)
305 copy(pk.Fingerprint[:], fingerPrint.Sum(nil))
306 pk.KeyId = binary.BigEndian.Uint64(pk.Fingerprint[12:20])
309 // parseRSA parses RSA public key material from the given Reader. See RFC 4880,
311 func (pk *PublicKey) parseRSA(r io.Reader) (err error) {
312 pk.n.bytes, pk.n.bitLength, err = readMPI(r)
316 pk.e.bytes, pk.e.bitLength, err = readMPI(r)
321 if len(pk.e.bytes) > 3 {
322 err = errors.UnsupportedError("large public exponent")
325 rsa := &rsa.PublicKey{
326 N: new(big.Int).SetBytes(pk.n.bytes),
329 for i := 0; i < len(pk.e.bytes); i++ {
331 rsa.E |= int(pk.e.bytes[i])
337 // parseDSA parses DSA public key material from the given Reader. See RFC 4880,
339 func (pk *PublicKey) parseDSA(r io.Reader) (err error) {
340 pk.p.bytes, pk.p.bitLength, err = readMPI(r)
344 pk.q.bytes, pk.q.bitLength, err = readMPI(r)
348 pk.g.bytes, pk.g.bitLength, err = readMPI(r)
352 pk.y.bytes, pk.y.bitLength, err = readMPI(r)
357 dsa := new(dsa.PublicKey)
358 dsa.P = new(big.Int).SetBytes(pk.p.bytes)
359 dsa.Q = new(big.Int).SetBytes(pk.q.bytes)
360 dsa.G = new(big.Int).SetBytes(pk.g.bytes)
361 dsa.Y = new(big.Int).SetBytes(pk.y.bytes)
366 // parseElGamal parses ElGamal public key material from the given Reader. See
367 // RFC 4880, section 5.5.2.
368 func (pk *PublicKey) parseElGamal(r io.Reader) (err error) {
369 pk.p.bytes, pk.p.bitLength, err = readMPI(r)
373 pk.g.bytes, pk.g.bitLength, err = readMPI(r)
377 pk.y.bytes, pk.y.bitLength, err = readMPI(r)
382 elgamal := new(elgamal.PublicKey)
383 elgamal.P = new(big.Int).SetBytes(pk.p.bytes)
384 elgamal.G = new(big.Int).SetBytes(pk.g.bytes)
385 elgamal.Y = new(big.Int).SetBytes(pk.y.bytes)
386 pk.PublicKey = elgamal
390 // SerializeSignaturePrefix writes the prefix for this public key to the given Writer.
391 // The prefix is used when calculating a signature over this public key. See
392 // RFC 4880, section 5.2.4.
393 func (pk *PublicKey) SerializeSignaturePrefix(h io.Writer) {
395 switch pk.PubKeyAlgo {
396 case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
397 pLength += 2 + uint16(len(pk.n.bytes))
398 pLength += 2 + uint16(len(pk.e.bytes))
400 pLength += 2 + uint16(len(pk.p.bytes))
401 pLength += 2 + uint16(len(pk.q.bytes))
402 pLength += 2 + uint16(len(pk.g.bytes))
403 pLength += 2 + uint16(len(pk.y.bytes))
404 case PubKeyAlgoElGamal:
405 pLength += 2 + uint16(len(pk.p.bytes))
406 pLength += 2 + uint16(len(pk.g.bytes))
407 pLength += 2 + uint16(len(pk.y.bytes))
408 case PubKeyAlgoECDSA:
409 pLength += uint16(pk.ec.byteLen())
411 pLength += uint16(pk.ec.byteLen())
412 pLength += uint16(pk.ecdh.byteLen())
414 panic("unknown public key algorithm")
417 h.Write([]byte{0x99, byte(pLength >> 8), byte(pLength)})
421 func (pk *PublicKey) Serialize(w io.Writer) (err error) {
422 length := 6 // 6 byte header
424 switch pk.PubKeyAlgo {
425 case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
426 length += 2 + len(pk.n.bytes)
427 length += 2 + len(pk.e.bytes)
429 length += 2 + len(pk.p.bytes)
430 length += 2 + len(pk.q.bytes)
431 length += 2 + len(pk.g.bytes)
432 length += 2 + len(pk.y.bytes)
433 case PubKeyAlgoElGamal:
434 length += 2 + len(pk.p.bytes)
435 length += 2 + len(pk.g.bytes)
436 length += 2 + len(pk.y.bytes)
437 case PubKeyAlgoECDSA:
438 length += pk.ec.byteLen()
440 length += pk.ec.byteLen()
441 length += pk.ecdh.byteLen()
443 panic("unknown public key algorithm")
446 packetType := packetTypePublicKey
448 packetType = packetTypePublicSubkey
450 err = serializeHeader(w, packetType, length)
454 return pk.serializeWithoutHeaders(w)
457 // serializeWithoutHeaders marshals the PublicKey to w in the form of an
458 // OpenPGP public key packet, not including the packet header.
459 func (pk *PublicKey) serializeWithoutHeaders(w io.Writer) (err error) {
462 t := uint32(pk.CreationTime.Unix())
463 buf[1] = byte(t >> 24)
464 buf[2] = byte(t >> 16)
465 buf[3] = byte(t >> 8)
467 buf[5] = byte(pk.PubKeyAlgo)
469 _, err = w.Write(buf[:])
474 switch pk.PubKeyAlgo {
475 case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
476 return writeMPIs(w, pk.n, pk.e)
478 return writeMPIs(w, pk.p, pk.q, pk.g, pk.y)
479 case PubKeyAlgoElGamal:
480 return writeMPIs(w, pk.p, pk.g, pk.y)
481 case PubKeyAlgoECDSA:
482 return pk.ec.serialize(w)
484 if err = pk.ec.serialize(w); err != nil {
487 return pk.ecdh.serialize(w)
489 return errors.InvalidArgumentError("bad public-key algorithm")
492 // CanSign returns true iff this public key can generate signatures
493 func (pk *PublicKey) CanSign() bool {
494 return pk.PubKeyAlgo != PubKeyAlgoRSAEncryptOnly && pk.PubKeyAlgo != PubKeyAlgoElGamal
497 // VerifySignature returns nil iff sig is a valid signature, made by this
498 // public key, of the data hashed into signed. signed is mutated by this call.
499 func (pk *PublicKey) VerifySignature(signed hash.Hash, sig *Signature) (err error) {
501 return errors.InvalidArgumentError("public key cannot generate signatures")
504 signed.Write(sig.HashSuffix)
505 hashBytes := signed.Sum(nil)
507 if hashBytes[0] != sig.HashTag[0] || hashBytes[1] != sig.HashTag[1] {
508 return errors.SignatureError("hash tag doesn't match")
511 if pk.PubKeyAlgo != sig.PubKeyAlgo {
512 return errors.InvalidArgumentError("public key and signature use different algorithms")
515 switch pk.PubKeyAlgo {
516 case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
517 rsaPublicKey, _ := pk.PublicKey.(*rsa.PublicKey)
518 err = rsa.VerifyPKCS1v15(rsaPublicKey, sig.Hash, hashBytes, sig.RSASignature.bytes)
520 return errors.SignatureError("RSA verification failure")
524 dsaPublicKey, _ := pk.PublicKey.(*dsa.PublicKey)
525 // Need to truncate hashBytes to match FIPS 186-3 section 4.6.
526 subgroupSize := (dsaPublicKey.Q.BitLen() + 7) / 8
527 if len(hashBytes) > subgroupSize {
528 hashBytes = hashBytes[:subgroupSize]
530 if !dsa.Verify(dsaPublicKey, hashBytes, new(big.Int).SetBytes(sig.DSASigR.bytes), new(big.Int).SetBytes(sig.DSASigS.bytes)) {
531 return errors.SignatureError("DSA verification failure")
534 case PubKeyAlgoECDSA:
535 ecdsaPublicKey := pk.PublicKey.(*ecdsa.PublicKey)
536 if !ecdsa.Verify(ecdsaPublicKey, hashBytes, new(big.Int).SetBytes(sig.ECDSASigR.bytes), new(big.Int).SetBytes(sig.ECDSASigS.bytes)) {
537 return errors.SignatureError("ECDSA verification failure")
541 return errors.SignatureError("Unsupported public key algorithm used in signature")
545 // VerifySignatureV3 returns nil iff sig is a valid signature, made by this
546 // public key, of the data hashed into signed. signed is mutated by this call.
547 func (pk *PublicKey) VerifySignatureV3(signed hash.Hash, sig *SignatureV3) (err error) {
549 return errors.InvalidArgumentError("public key cannot generate signatures")
552 suffix := make([]byte, 5)
553 suffix[0] = byte(sig.SigType)
554 binary.BigEndian.PutUint32(suffix[1:], uint32(sig.CreationTime.Unix()))
556 hashBytes := signed.Sum(nil)
558 if hashBytes[0] != sig.HashTag[0] || hashBytes[1] != sig.HashTag[1] {
559 return errors.SignatureError("hash tag doesn't match")
562 if pk.PubKeyAlgo != sig.PubKeyAlgo {
563 return errors.InvalidArgumentError("public key and signature use different algorithms")
566 switch pk.PubKeyAlgo {
567 case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
568 rsaPublicKey := pk.PublicKey.(*rsa.PublicKey)
569 if err = rsa.VerifyPKCS1v15(rsaPublicKey, sig.Hash, hashBytes, sig.RSASignature.bytes); err != nil {
570 return errors.SignatureError("RSA verification failure")
574 dsaPublicKey := pk.PublicKey.(*dsa.PublicKey)
575 // Need to truncate hashBytes to match FIPS 186-3 section 4.6.
576 subgroupSize := (dsaPublicKey.Q.BitLen() + 7) / 8
577 if len(hashBytes) > subgroupSize {
578 hashBytes = hashBytes[:subgroupSize]
580 if !dsa.Verify(dsaPublicKey, hashBytes, new(big.Int).SetBytes(sig.DSASigR.bytes), new(big.Int).SetBytes(sig.DSASigS.bytes)) {
581 return errors.SignatureError("DSA verification failure")
585 panic("shouldn't happen")
589 // keySignatureHash returns a Hash of the message that needs to be signed for
590 // pk to assert a subkey relationship to signed.
591 func keySignatureHash(pk, signed signingKey, hashFunc crypto.Hash) (h hash.Hash, err error) {
592 if !hashFunc.Available() {
593 return nil, errors.UnsupportedError("hash function")
597 // RFC 4880, section 5.2.4
598 pk.SerializeSignaturePrefix(h)
599 pk.serializeWithoutHeaders(h)
600 signed.SerializeSignaturePrefix(h)
601 signed.serializeWithoutHeaders(h)
605 // VerifyKeySignature returns nil iff sig is a valid signature, made by this
606 // public key, of signed.
607 func (pk *PublicKey) VerifyKeySignature(signed *PublicKey, sig *Signature) error {
608 h, err := keySignatureHash(pk, signed, sig.Hash)
612 if err = pk.VerifySignature(h, sig); err != nil {
617 // Signing subkeys must be cross-signed. See
618 // https://www.gnupg.org/faq/subkey-cross-certify.html.
619 if sig.EmbeddedSignature == nil {
620 return errors.StructuralError("signing subkey is missing cross-signature")
622 // Verify the cross-signature. This is calculated over the same
623 // data as the main signature, so we cannot just recursively
624 // call signed.VerifyKeySignature(...)
625 if h, err = keySignatureHash(pk, signed, sig.EmbeddedSignature.Hash); err != nil {
626 return errors.StructuralError("error while hashing for cross-signature: " + err.Error())
628 if err := signed.VerifySignature(h, sig.EmbeddedSignature); err != nil {
629 return errors.StructuralError("error while verifying cross-signature: " + err.Error())
636 func keyRevocationHash(pk signingKey, hashFunc crypto.Hash) (h hash.Hash, err error) {
637 if !hashFunc.Available() {
638 return nil, errors.UnsupportedError("hash function")
642 // RFC 4880, section 5.2.4
643 pk.SerializeSignaturePrefix(h)
644 pk.serializeWithoutHeaders(h)
649 // VerifyRevocationSignature returns nil iff sig is a valid signature, made by this
651 func (pk *PublicKey) VerifyRevocationSignature(sig *Signature) (err error) {
652 h, err := keyRevocationHash(pk, sig.Hash)
656 return pk.VerifySignature(h, sig)
659 // userIdSignatureHash returns a Hash of the message that needs to be signed
660 // to assert that pk is a valid key for id.
661 func userIdSignatureHash(id string, pk *PublicKey, hashFunc crypto.Hash) (h hash.Hash, err error) {
662 if !hashFunc.Available() {
663 return nil, errors.UnsupportedError("hash function")
667 // RFC 4880, section 5.2.4
668 pk.SerializeSignaturePrefix(h)
669 pk.serializeWithoutHeaders(h)
673 buf[1] = byte(len(id) >> 24)
674 buf[2] = byte(len(id) >> 16)
675 buf[3] = byte(len(id) >> 8)
676 buf[4] = byte(len(id))
683 // VerifyUserIdSignature returns nil iff sig is a valid signature, made by this
684 // public key, that id is the identity of pub.
685 func (pk *PublicKey) VerifyUserIdSignature(id string, pub *PublicKey, sig *Signature) (err error) {
686 h, err := userIdSignatureHash(id, pub, sig.Hash)
690 return pk.VerifySignature(h, sig)
693 // VerifyUserIdSignatureV3 returns nil iff sig is a valid signature, made by this
694 // public key, that id is the identity of pub.
695 func (pk *PublicKey) VerifyUserIdSignatureV3(id string, pub *PublicKey, sig *SignatureV3) (err error) {
696 h, err := userIdSignatureV3Hash(id, pub, sig.Hash)
700 return pk.VerifySignatureV3(h, sig)
703 // KeyIdString returns the public key's fingerprint in capital hex
704 // (e.g. "6C7EE1B8621CC013").
705 func (pk *PublicKey) KeyIdString() string {
706 return fmt.Sprintf("%X", pk.Fingerprint[12:20])
709 // KeyIdShortString returns the short form of public key's fingerprint
710 // in capital hex, as shown by gpg --list-keys (e.g. "621CC013").
711 func (pk *PublicKey) KeyIdShortString() string {
712 return fmt.Sprintf("%X", pk.Fingerprint[16:20])
715 // A parsedMPI is used to store the contents of a big integer, along with the
716 // bit length that was specified in the original input. This allows the MPI to
717 // be reserialized exactly.
718 type parsedMPI struct {
723 // writeMPIs is a utility function for serializing several big integers to the
725 func writeMPIs(w io.Writer, mpis ...parsedMPI) (err error) {
726 for _, mpi := range mpis {
727 err = writeMPI(w, mpi.bitLength, mpi.bytes)
735 // BitLength returns the bit length for the given public key.
736 func (pk *PublicKey) BitLength() (bitLength uint16, err error) {
737 switch pk.PubKeyAlgo {
738 case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
739 bitLength = pk.n.bitLength
741 bitLength = pk.p.bitLength
742 case PubKeyAlgoElGamal:
743 bitLength = pk.p.bitLength
745 err = errors.InvalidArgumentError("bad public-key algorithm")