lysann/passforios-gopenpgp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add a 2 day offset for signature creation time checking

Browse source
This commit is contained in:
Kay Lukas 2018-07-31 01:00:45 +02:00
parent dcd96f512c
commit 914fc679a6
4 changed files with 65 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

34
message.go
View file

@ -11,7 +11,9 @@ import (
"golang.org/x/crypto/openpgp"
"golang.org/x/crypto/openpgp/armor"
"golang.org/x/crypto/openpgp/packet"
)
errors2 "golang.org/x/crypto/openpgp/errors"
"math"
)
// DecryptMessage decrypt encrypted message use private key (string )
// encryptedText : string armored encrypted
@ -165,12 +167,9 @@ func (o *OpenPGP) decryptMessageVerifyAllBin(encryptedText string, veriferKey []
return nil, err
}
config := &packet.Config{ Time: o.getTimeGenerator() }
if verifyTime > 0 {
tm := time.Unix(verifyTime, 0)
config.Time = func() time.Time {
return tm
}
config := &packet.Config{}
config.Time = func() time.Time {
return time.Unix(0, 0)
}
md, err := openpgp.ReadMessage(encryptedio.Body, privKeyEntries, nil, config)
@ -184,6 +183,8 @@ func (o *OpenPGP) decryptMessageVerifyAllBin(encryptedText string, veriferKey []
return nil, err
}
processSignatureExpiration(md, verifyTime)
out.Plaintext = string(b)
if md.IsSigned {
if md.SignedBy != nil {
@ -209,6 +210,25 @@ func (o *OpenPGP) decryptMessageVerifyAllBin(encryptedText string, veriferKey []
return out, nil
}
// Handle signature time verification manually, so we can add a margin to the creationTime check.
func processSignatureExpiration(md *openpgp.MessageDetails, verifyTime int64) {
if md.SignatureError == errors2.ErrSignatureExpired {
if verifyTime > 0 {
created := md.Signature.CreationTime.Unix()
expires := int64(math.MaxInt64)
if md.Signature.KeyLifetimeSecs != nil {
expires = int64(*md.Signature.KeyLifetimeSecs) + created
}
if created - creationTimeOffset <= verifyTime && verifyTime <= expires {
md.SignatureError = nil
}
} else {
// verifyTime = 0: time check disabled, everything is okay
md.SignatureError = nil
}
}
}
// EncryptMessage encrypt message with public key, if pass private key and passphrase will also sign the message
// publicKey : string armored public key
// plainText : the input