无法使用Golang的openpgp包签署有效的GPG密钥。

huangapple go评论102阅读模式
英文:

Cannot sign a valid gpg key using golang's openpgp packet

问题

我想用Go语言中的私钥对ASCII装甲的公钥进行签名。为此,我开发了以下代码,但问题是当我在gpg --check-sigs中检查签名时,代码生成的签名显示为"bad Signature"。请帮忙,我无法找到任何解决方法。我已经在golang-nuts上发布了。我只是为了我的大学项目学习Go语言,我在这里卡住了,请帮忙。

// signer
package main

import (
	"bytes"
	"code.google.com/p/go.crypto/openpgp"
	"code.google.com/p/go.crypto/openpgp/armor"
	"code.google.com/p/go.crypto/openpgp/packet"
	"fmt"
)

// This function takes asciiarmored private key which will sign the public key
//Public key is also ascii armored,pripwd is password of private key in string
//This function will return ascii armored signed public key i.e. (pubkey+sign by prikey)
func SignPubKeyPKS(asciiPub string, asciiPri string, pripwd string) (asciiSignedKey string) {
	//get Private key from armor
	_, priEnt := getPri(asciiPri, pripwd) //pripwd is the password todecrypt the private key
	_, pubEnt := getPub(asciiPub)         //This will generate signature and add it to pubEnt
	usrIdstring := ""
	for _, uIds := range pubEnt.Identities {
		usrIdstring = uIds.Name

	}
	fmt.Println(usrIdstring)
	errSign := pubEnt.SignIdentity(usrIdstring, &priEnt, nil)
	if errSign != nil {
		fmt.Println("Signing Key ", errSign.Error())
		return
	}
	asciiSignedKey = PubEntToAsciiArmor(pubEnt)
	return
}

//get packet.PublicKey and openpgp.Entity of Public Key from ascii armor
func getPub(asciiPub string) (pubKey packet.PublicKey, retEntity openpgp.Entity) {
	read1 := bytes.NewReader([]byte(asciiPub))
	entityList, errReadArm := openpgp.ReadArmoredKeyRing(read1)
	if errReadArm != nil {
		fmt.Println("Reading Pubkey ", errReadArm.Error())
		return
	}
	for _, pubKeyEntity := range entityList {
		if pubKeyEntity.PrimaryKey != nil {
			pubKey = *pubKeyEntity.PrimaryKey
			retEntity = *pubKeyEntity
		}
	}
	return
}

//get packet.PrivateKEy and openpgp.Entity of Private Key from ascii armor
func getPri(asciiPri string, pripwd string) (priKey packet.PrivateKey, priEnt openpgp.Entity) {
	read1 := bytes.NewReader([]byte(asciiPri))
	entityList, errReadArm := openpgp.ReadArmoredKeyRing(read1)
	if errReadArm != nil {
		fmt.Println("Reading PriKey ", errReadArm.Error())
		return
	}
	for _, can_pri := range entityList {
		smPr := can_pri.PrivateKey
		retEntity := can_pri
		if smPr == nil {
			fmt.Println("No Private Key")
			return
		}

		priKey = *smPr

		errDecr := priKey.Decrypt([]byte(pripwd))
		if errDecr != nil {
			fmt.Println("Decrypting ", errDecr.Error())
			return
		}
		retEntity.PrivateKey = &priKey
		priEnt = *retEntity
	}
	return
}

//Create ASscii Armor from openpgp.Entity
func PubEntToAsciiArmor(pubEnt openpgp.Entity) (asciiEntity string) {
	gotWriter := bytes.NewBuffer(nil)
	wr, errEncode := armor.Encode(gotWriter, openpgp.PublicKeyType, nil)
	if errEncode != nil {
		fmt.Println("Encoding Armor ", errEncode.Error())
		return
	}
	errSerial := pubEnt.Serialize(wr)
	if errSerial != nil {
		fmt.Println("Serializing PubKey ", errSerial.Error())
	}
	errClosing := wr.Close()
	if errClosing != nil {
		fmt.Println("Closing writer ", errClosing.Error())
	}
	asciiEntity = gotWriter.String()
	return
}

希望对你有帮助!

英文:

I want to sign a public key from ascii armor with a private key in go language.For that I developed following code but the problem is when I check the signature in gpg --check-sigs the signature created by code is shown as "bad Signature".Please Help as I cant figure out any way of solving it.I have already postd on golang-nuts.I am just learning golang for my college project and I am stuck here,Please help.

    // signer
package main
import (
"bytes"
"code.google.com/p/go.crypto/openpgp"
"code.google.com/p/go.crypto/openpgp/armor"
"code.google.com/p/go.crypto/openpgp/packet"
"fmt"
)
// This function takes asciiarmored private key which will sign the public key
//Public key is also ascii armored,pripwd is password of private key in string
//This function will return ascii armored signed public key i.e. (pubkey+sign by prikey)
func SignPubKeyPKS(asciiPub string, asciiPri string, pripwd string) (asciiSignedKey string) {
//get Private key from armor
_, priEnt := getPri(asciiPri, pripwd) //pripwd is the password todecrypt the private key
_, pubEnt := getPub(asciiPub)         //This will generate signature and add it to pubEnt
usrIdstring := ""
for _, uIds := range pubEnt.Identities {
usrIdstring = uIds.Name
}
fmt.Println(usrIdstring)
errSign := pubEnt.SignIdentity(usrIdstring, &priEnt, nil)
if errSign != nil {
fmt.Println("Signing Key ", errSign.Error())
return
}
asciiSignedKey = PubEntToAsciiArmor(pubEnt)
return
}
//get packet.PublicKey and openpgp.Entity of Public Key from ascii armor
func getPub(asciiPub string) (pubKey packet.PublicKey, retEntity openpgp.Entity) {
read1 := bytes.NewReader([]byte(asciiPub))
entityList, errReadArm := openpgp.ReadArmoredKeyRing(read1)
if errReadArm != nil {
fmt.Println("Reading Pubkey ", errReadArm.Error())
return
}
for _, pubKeyEntity := range entityList {
if pubKeyEntity.PrimaryKey != nil {
pubKey = *pubKeyEntity.PrimaryKey
retEntity = *pubKeyEntity
}
}
return
}
//get packet.PrivateKEy and openpgp.Entity of Private Key from ascii armor
func getPri(asciiPri string, pripwd string) (priKey packet.PrivateKey, priEnt openpgp.Entity) {
read1 := bytes.NewReader([]byte(asciiPri))
entityList, errReadArm := openpgp.ReadArmoredKeyRing(read1)
if errReadArm != nil {
fmt.Println("Reading PriKey ", errReadArm.Error())
return
}
for _, can_pri := range entityList {
smPr := can_pri.PrivateKey
retEntity := can_pri
if smPr == nil {
fmt.Println("No Private Key")
return
}
priKey = *smPr
errDecr := priKey.Decrypt([]byte(pripwd))
if errDecr != nil {
fmt.Println("Decrypting ", errDecr.Error())
return
}
retEntity.PrivateKey = &priKey
priEnt = *retEntity
}
return
}
//Create ASscii Armor from openpgp.Entity
func PubEntToAsciiArmor(pubEnt openpgp.Entity) (asciiEntity string) {
gotWriter := bytes.NewBuffer(nil)
wr, errEncode := armor.Encode(gotWriter, openpgp.PublicKeyType, nil)
if errEncode != nil {
fmt.Println("Encoding Armor ", errEncode.Error())
return
}
errSerial := pubEnt.Serialize(wr)
if errSerial != nil {
fmt.Println("Serializing PubKey ", errSerial.Error())
}
errClosing := wr.Close()
if errClosing != nil {
fmt.Println("Closing writer ", errClosing.Error())
}
asciiEntity = gotWriter.String()
return
}

答案1

得分: 3

代码看起来大致没问题,但是在错误检查方面应该更加严格。在出现错误时引发 panic 比没有错误检查要好(因为通常会在稍后的某个时候导致段错误)。

问题在于 code.google.com/p/go.crypto/openpgp 中的 Signature.SignUserId() 的实现是错误的。它使用了签署密钥的算法(用于证明子密钥属于主密钥),而不是签署用户 ID 的算法。

此外,在探索过程中,我意识到 PublicKey.VerifyUserIdSignature() 的实现方式只适用于自签名的用户 ID,因为它没有在哈希中使用正确的公钥。

错误报告,附带修补程序:https://code.google.com/p/go/issues/detail?id=7371

英文:

The code looks roughly ok, except that it really should be stricter with error checking. Panicking on error is better then no error checking at all (because it will usually segfault sometimes later).

The problem is that the implementation of Signature.SignUserId() inside code.google.com/p/go.crypto/openpgp is wrong. It is using the algorithm that signs a key (which is use to certify that the subkey belongs to the primary key) instead of the algorithm that signs a user id.

In addition, while exploring this I realized that PublicKey.VerifyUserIdSignature() is implemented in such a way that it only works for self-signed user ids, because it doesn't use the right public key in the hash.

Bug report, with patch https://code.google.com/p/go/issues/detail?id=7371

huangapple
  • 本文由 发表于 2014年2月1日 12:21:52
  • 转载请务必保留本文链接:https://go.coder-hub.com/21494035.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定