使用go.crypto/openpgp验证签名

huangapple
go评论120阅读模式
英文:

Verifying a signature using go.crypto/openpgp

问题

我有一个二进制文件：

  1. foo.bin

这个文件已经使用gpg密钥签名，创建了：

  1. foo.bin.sig

我有一个包含用于签名二进制文件的公钥的文件。

我想做的是使用Go来验证这个签名。

我阅读了go.crypto/openpgp文档，对于这个用例来说并不特别有帮助。

验证将在远程机器上进行。理想情况下，我希望避免在运行此代码的机器上使用密钥环。公钥可以轻松地存储在可执行文件本身中...如果我能弄清楚如何完成这个验证。

我认为我需要做的步骤如下：

  • 创建一个只表示公钥的实体
  • 打开二进制文件和签名，并将其传递给某个验证函数

问题主要是：我如何使用只有公钥的方式编写这个验证函数？

英文:

I have a binary file:

  1. foo.bin

This file has been signed using a gpg key to create:

  1. foo.bin.sig

I have a file containing the public key that was used to sign the binary file.

What I'd like to do is to be able to verify this signature using Go.

I was reading the go.crypto/openpgp docs and they aren't particularly helpful for this use case.

The verification will be done on a remote machine. Ideally I'd like to avoid using the keyring on the machine that will run this code. The public key can trivially be stored in the executable itself... if I can work out how to get this verification done.

The steps that I think I need to do are as follows:

  • Create an Entity that represents only the public key
  • Open both the binary file and the signature and pass it to some verification function

The question primarily is: how do I write this verification function using just a public key?

答案1

得分: 6

openpgp API并不是最直接使用的，但我尝试了一下（用Go语言），下面是我写的代码：

  1. package main
  3. import (
  4. 	"bytes"
  5. 	"code.google.com/p/go.crypto/openpgp/packet"
  6. 	"encoding/hex"
  7. 	"errors"
  8. 	"fmt"
  9. 	"io/ioutil"
  10. 	"os"
  11. )
  13. // gpg --export YOURKEYID --export-options export-minimal,no-export-attributes | hexdump /dev/stdin -v -e '/1 "%02X"'
  14. var publicKeyHex string = "99[非常长的十六进制字符串]B6"
  16. func main() {
  17. 	if len(os.Args) != 3 {
  18. 		fmt.Println("用法: " + os.Args[0] + " <文件> <签名文件>")
  19. 		return
  20. 	}
  22. 	err := checkSig(os.Args[1], os.Args[2])
  24. 	if err != nil {
  25. 		fmt.Println("无效的签名:")
  26. 		fmt.Println(err)
  27. 	} else {
  28. 		fmt.Println("有效的签名")
  29. 	}
  30. }
  32. func checkSig(fileName string, sigFileName string) error {
  33. 	// 首先，获取我们签名的文件的内容
  34. 	fileContent, err := ioutil.ReadFile(fileName)
  35. 	if err != nil {
  36. 		return err
  37. 	}
  39. 	// 获取签名文件的Reader
  40. 	sigFile, err := os.Open(sigFileName)
  41. 	if err != nil {
  42. 		return err
  43. 	}
  45. 	defer func() {
  46. 		if err := sigFile.Close(); err != nil {
  47. 			panic(err)
  48. 		}
  49. 	}()
  51. 	// 读取签名文件
  52. 	pack, err := packet.Read(sigFile)
  53. 	if err != nil {
  54. 		return err
  55. 	}
  57. 	// 它真的是一个签名文件吗？如果是，获取签名
  58. 	signature, ok := pack.(*packet.Signature)
  59. 	if !ok {
  60. 		return errors.New(os.Args[2] + " 不是一个有效的签名文件。")
  61. 	}
  63. 	// 为了方便起见，我们的密钥是十六进制的，将其转换为二进制
  64. 	publicKeyBin, err := hex.DecodeString(publicKeyHex)
  65. 	if err != nil {
  66. 		return err
  67. 	}
  69. 	// 读取密钥
  70. 	pack, err = packet.Read(bytes.NewReader(publicKeyBin))
  71. 	if err != nil {
  72. 		return err
  73. 	}
  75. 	// 它真的是一个公钥文件吗？如果是，获取公钥
  76. 	publicKey, ok := pack.(*packet.PublicKey)
  77. 	if !ok {
  78. 		return errors.New("无效的公钥。")
  79. 	}
  81. 	// 获取用于签名的哈希方法
  82. 	hash := signature.Hash.New()
  84. 	// 对文件的内容进行哈希（如果文件很大，你可能需要改变代码，避免将整个文件加载到内存中，可以通过读取和写入小块来实现）
  85. 	_, err = hash.Write(fileContent)
  86. 	if err != nil {
  87. 		return err
  88. 	}
  90. 	// 验证签名
  91. 	err = publicKey.VerifySignature(hash, signature)
  92. 	if err != nil {
  93. 		return err
  94. 	}
  96. 	return nil
  97. }

根据您的要求，我将公钥放在了代码中。
您可以这样测试它：

  1. $ go run testpgp.go foo.bin foo.bin.sig

如果您签名的文件非常大，您可能需要稍微修改代码，以避免将其加载到内存中。

英文:

The openpgp API is not the most straightforward to use, but I gave it a go (pun intended), and here is what I came up with :

  1. package main
  2. import (
  3. &quot;bytes&quot;
  4. &quot;code.google.com/p/go.crypto/openpgp/packet&quot;
  5. &quot;encoding/hex&quot;
  6. &quot;errors&quot;
  7. &quot;fmt&quot;
  8. &quot;io/ioutil&quot;
  9. &quot;os&quot;
  10. )
  11. // gpg --export YOURKEYID --export-options export-minimal,no-export-attributes | hexdump /dev/stdin -v -e &#39;/1 &quot;%02X&quot;&#39;
  12. var publicKeyHex string = &quot;99[VERY LONG HEX STRING]B6&quot;
  13. func main() {
  14. if len(os.Args) != 3 {
  15. fmt.Println(&quot;Usage: &quot; + os.Args[0] + &quot; &lt;file&gt; &lt;signature file&gt;&quot;)
  16. return
  17. }
  18. err := checkSig(os.Args[1], os.Args[2])
  19. if err != nil {
  20. fmt.Println(&quot;Invalid signature : &quot;)
  21. fmt.Println(err)
  22. } else {
  23. fmt.Println(&quot;Valid signature&quot;)
  24. }
  25. }
  26. func checkSig(fileName string, sigFileName string) error {
  27. // First, get the content of the file we have signed
  28. fileContent, err := ioutil.ReadFile(fileName)
  29. if err != nil {
  30. return err
  31. }
  32. // Get a Reader for the signature file
  33. sigFile, err := os.Open(sigFileName)
  34. if err != nil {
  35. return err
  36. }
  37. defer func() {
  38. if err := sigFile.Close(); err != nil {
  39. panic(err)
  40. }
  41. }()
  42. // Read the signature file
  43. pack, err := packet.Read(sigFile)
  44. if err != nil {
  45. return err
  46. }
  47. // Was it really a signature file ? If yes, get the Signature
  48. signature, ok := pack.(*packet.Signature)
  49. if !ok {
  50. return errors.New(os.Args[2] + &quot; is not a valid signature file.&quot;)
  51. }
  52. // For convenience, we have the key in hexadecimal, convert it to binary
  53. publicKeyBin, err := hex.DecodeString(publicKeyHex)
  54. if err != nil {
  55. return err
  56. }
  57. // Read the key
  58. pack, err = packet.Read(bytes.NewReader(publicKeyBin))
  59. if err != nil {
  60. return err
  61. }
  62. // Was it really a public key file ? If yes, get the PublicKey
  63. publicKey, ok := pack.(*packet.PublicKey)
  64. if !ok {
  65. return errors.New(&quot;Invalid public key.&quot;)
  66. }
  67. // Get the hash method used for the signature
  68. hash := signature.Hash.New()
  69. // Hash the content of the file (if the file is big, that&#39;s where you have to change the code to avoid getting the whole file in memory, by reading and writting in small chunks)
  70. _, err = hash.Write(fileContent)
  71. if err != nil {
  72. return err
  73. }
  74. // Check the signature
  75. err = publicKey.VerifySignature(hash, signature)
  76. if err != nil {
  77. return err
  78. }
  79. return nil
  80. }

As requested, I put the public key in the code.
You can test it like that :

  1. $ go run testpgp.go foo.bin foo.bin.sig

If the file you have signed is very big, you may want to change the code a little bit to avoid loading it in memory.

huangapple
  • 本文由 发表于 2013年4月15日 12:33:41
  • 转载请务必保留本文链接：https://go.coder-hub.com/16007695.html
  • go
  • openpgp
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定