moparisthebest/open-keychain
1
0
Fork 0
mirror of https://github.com/moparisthebest/open-keychain synced 2024-11-27 19:22:14 -05:00
Code Issues Releases Wiki Activity

Dont accept signatures by expired or revoked subkeys

Browse Source
This commit is contained in:
Dominik Schürmann 2014-11-22 00:29:14 +01:00
parent fd60d49d26
commit bbbc45e4e9
4 changed files with 13 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
OpenKeychain/src/main/java/org/sufficientlysecure/keychain/pgp/OpenPgpSignatureResultBuilder.java
View File

@ -84,10 +84,6 @@ public class OpenPgpSignatureResultBuilder {
this.mUserIds = userIds; this.mUserIds = userIds;
} }
public boolean isValidSignature() {
return mValidSignature;
}
public void initValid(CanonicalizedPublicKeyRing signingRing, public void initValid(CanonicalizedPublicKeyRing signingRing,
CanonicalizedPublicKey signingKey) { CanonicalizedPublicKey signingKey) {
setSignatureAvailable(true); setSignatureAvailable(true);

15
OpenKeychain/src/main/java/org/sufficientlysecure/keychain/pgp/PgpDecryptVerify.java
View File

@ -22,6 +22,7 @@ import android.content.Context;
import android.webkit.MimeTypeMap; import android.webkit.MimeTypeMap;
import org.openintents.openpgp.OpenPgpMetadata; import org.openintents.openpgp.OpenPgpMetadata;
import org.openintents.openpgp.OpenPgpSignatureResult;
import org.spongycastle.bcpg.ArmoredInputStream; import org.spongycastle.bcpg.ArmoredInputStream;
import org.spongycastle.openpgp.PGPCompressedData; import org.spongycastle.openpgp.PGPCompressedData;
import org.spongycastle.openpgp.PGPEncryptedData; import org.spongycastle.openpgp.PGPEncryptedData;
@ -332,7 +333,10 @@ public class PgpDecryptVerify extends BaseOperation {
} }
signatureResultBuilder.setValidSignature(validSignature); signatureResultBuilder.setValidSignature(validSignature);
if (!signatureResultBuilder.isValidSignature()) { OpenPgpSignatureResult signatureResult = signatureResultBuilder.build();
if (signatureResult.getStatus() != OpenPgpSignatureResult.SIGNATURE_SUCCESS_CERTIFIED
|| signatureResult.getStatus() != OpenPgpSignatureResult.SIGNATURE_SUCCESS_UNCERTIFIED) {
log.add(LogType.MSG_VL_ERROR_INTEGRITY_CHECK, indent); log.add(LogType.MSG_VL_ERROR_INTEGRITY_CHECK, indent);
return new DecryptVerifyResult(DecryptVerifyResult.RESULT_ERROR, log); return new DecryptVerifyResult(DecryptVerifyResult.RESULT_ERROR, log);
} }
@ -344,7 +348,7 @@ public class PgpDecryptVerify extends BaseOperation {
// Return a positive result, with metadata and verification info // Return a positive result, with metadata and verification info
DecryptVerifyResult result = DecryptVerifyResult result =
new DecryptVerifyResult(DecryptVerifyResult.RESULT_OK, log); new DecryptVerifyResult(DecryptVerifyResult.RESULT_OK, log);
result.setSignatureResult(signatureResultBuilder.build()); result.setSignatureResult(signatureResult);
return result; return result;
} }
@ -773,6 +777,8 @@ public class PgpDecryptVerify extends BaseOperation {
metadata = null; metadata = null;
} }
OpenPgpSignatureResult signatureResult = signatureResultBuilder.build();
if (encryptedData.isIntegrityProtected()) { if (encryptedData.isIntegrityProtected()) {
updateProgress(R.string.progress_verifying_integrity, 95, 100); updateProgress(R.string.progress_verifying_integrity, 95, 100);
@ -786,7 +792,8 @@ public class PgpDecryptVerify extends BaseOperation {
// If no valid signature is present: // If no valid signature is present:
// Handle missing integrity protection like failed integrity protection! // Handle missing integrity protection like failed integrity protection!
// The MDC packet can be stripped by an attacker! // The MDC packet can be stripped by an attacker!
if (!signatureResultBuilder.isValidSignature()) { if (signatureResult.getStatus() != OpenPgpSignatureResult.SIGNATURE_SUCCESS_CERTIFIED
|| signatureResult.getStatus() != OpenPgpSignatureResult.SIGNATURE_SUCCESS_UNCERTIFIED) {
log.add(LogType.MSG_DC_ERROR_INTEGRITY_CHECK, indent); log.add(LogType.MSG_DC_ERROR_INTEGRITY_CHECK, indent);
return new DecryptVerifyResult(DecryptVerifyResult.RESULT_ERROR, log); return new DecryptVerifyResult(DecryptVerifyResult.RESULT_ERROR, log);
} }
@ -800,7 +807,7 @@ public class PgpDecryptVerify extends BaseOperation {
DecryptVerifyResult result = DecryptVerifyResult result =
new DecryptVerifyResult(DecryptVerifyResult.RESULT_OK, log); new DecryptVerifyResult(DecryptVerifyResult.RESULT_OK, log);
result.setDecryptMetadata(metadata); result.setDecryptMetadata(metadata);
result.setSignatureResult(signatureResultBuilder.build()); result.setSignatureResult(signatureResult);
return result; return result;
} }

1
OpenKeychain/src/main/java/org/sufficientlysecure/keychain/service/KeychainIntentService.java
View File

@ -30,6 +30,7 @@ import com.textuality.keybase.lib.Proof;
import com.textuality.keybase.lib.prover.Prover; import com.textuality.keybase.lib.prover.Prover;
import org.json.JSONObject; import org.json.JSONObject;
import org.openintents.openpgp.OpenPgpSignatureResult;
import org.spongycastle.openpgp.PGPUtil; import org.spongycastle.openpgp.PGPUtil;
import org.sufficientlysecure.keychain.Constants; import org.sufficientlysecure.keychain.Constants;
import org.sufficientlysecure.keychain.R; import org.sufficientlysecure.keychain.R;

2
OpenKeychain/src/main/java/org/sufficientlysecure/keychain/ui/ViewKeyTrustFragment.java
View File

@ -362,7 +362,7 @@ public class ViewKeyTrustFragment extends LoaderFragment implements
// Create a new Messenger for the communication back after proof work is done // Create a new Messenger for the communication back after proof work is done
// //
KeychainIntentServiceHandler handler = new KeychainIntentServiceHandler(getActivity(), KeychainIntentServiceHandler handler = new KeychainIntentServiceHandler(getActivity(),
getString(R.string.progress_decrypting), ProgressDialog.STYLE_HORIZONTAL) { getString(R.string.progress_verifying_signature), ProgressDialog.STYLE_HORIZONTAL) {
public void handleMessage(Message message) { public void handleMessage(Message message) {
// handle messages by standard KeychainIntentServiceHandler first // handle messages by standard KeychainIntentServiceHandler first
super.handleMessage(message); super.handleMessage(message);