2021-10-07 15:48:52 +02:00
|
|
|
// SPDX-FileCopyrightText: 2018 Paul Schaub <vanitasvitae@fsfe.org>
|
|
|
|
//
|
|
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
|
2018-07-18 18:23:06 +02:00
|
|
|
package org.pgpainless.decryption_verification;
|
2018-06-02 21:21:35 +02:00
|
|
|
|
2020-08-24 14:55:06 +02:00
|
|
|
import java.util.ArrayList;
|
2018-06-06 18:46:41 +02:00
|
|
|
import java.util.Collections;
|
2021-04-25 00:28:48 +02:00
|
|
|
import java.util.Date;
|
2018-06-06 18:46:41 +02:00
|
|
|
import java.util.HashSet;
|
2020-08-24 14:55:06 +02:00
|
|
|
import java.util.List;
|
2020-01-10 15:12:04 +01:00
|
|
|
import java.util.Map;
|
2018-06-02 21:21:35 +02:00
|
|
|
import java.util.Set;
|
2020-01-10 15:12:04 +01:00
|
|
|
import java.util.concurrent.ConcurrentHashMap;
|
2021-07-15 16:55:13 +02:00
|
|
|
import javax.annotation.Nonnull;
|
2021-08-26 19:53:15 +02:00
|
|
|
import javax.annotation.Nullable;
|
2021-07-15 16:55:13 +02:00
|
|
|
|
2021-04-25 00:28:48 +02:00
|
|
|
import org.bouncycastle.openpgp.PGPLiteralData;
|
2018-06-10 17:12:44 +02:00
|
|
|
import org.bouncycastle.openpgp.PGPPublicKey;
|
|
|
|
import org.bouncycastle.openpgp.PGPPublicKeyRing;
|
2020-01-10 15:12:04 +01:00
|
|
|
import org.bouncycastle.openpgp.PGPSignature;
|
2018-07-18 18:23:06 +02:00
|
|
|
import org.pgpainless.algorithm.CompressionAlgorithm;
|
2021-04-25 00:28:48 +02:00
|
|
|
import org.pgpainless.algorithm.StreamEncoding;
|
2018-07-18 18:23:06 +02:00
|
|
|
import org.pgpainless.algorithm.SymmetricKeyAlgorithm;
|
2021-09-02 18:01:06 +02:00
|
|
|
import org.pgpainless.exception.SignatureValidationException;
|
2021-10-27 17:38:25 +02:00
|
|
|
import org.pgpainless.key.OpenPgpFingerprint;
|
2021-07-04 13:08:24 +02:00
|
|
|
import org.pgpainless.key.SubkeyIdentifier;
|
2021-10-15 14:58:17 +02:00
|
|
|
import org.pgpainless.util.SessionKey;
|
2018-06-06 18:46:41 +02:00
|
|
|
|
2018-07-23 16:23:23 +02:00
|
|
|
public class OpenPgpMetadata {
|
2018-06-06 18:46:41 +02:00
|
|
|
|
|
|
|
private final Set<Long> recipientKeyIds;
|
2021-07-04 13:08:24 +02:00
|
|
|
private final SubkeyIdentifier decryptionKey;
|
2021-09-02 18:01:06 +02:00
|
|
|
private final List<SignatureVerification> verifiedInbandSignatures;
|
|
|
|
private final List<SignatureVerification.Failure> invalidInbandSignatures;
|
|
|
|
private final List<SignatureVerification> verifiedDetachedSignatures;
|
|
|
|
private final List<SignatureVerification.Failure> invalidDetachedSignatures;
|
2021-10-15 14:58:17 +02:00
|
|
|
private final SessionKey sessionKey;
|
2018-06-06 18:46:41 +02:00
|
|
|
private final CompressionAlgorithm compressionAlgorithm;
|
2021-07-15 16:55:13 +02:00
|
|
|
private final String fileName;
|
|
|
|
private final Date modificationDate;
|
|
|
|
private final StreamEncoding fileEncoding;
|
2018-06-06 18:46:41 +02:00
|
|
|
|
2018-07-23 16:23:23 +02:00
|
|
|
public OpenPgpMetadata(Set<Long> recipientKeyIds,
|
2021-07-04 13:08:24 +02:00
|
|
|
SubkeyIdentifier decryptionKey,
|
2021-10-15 14:58:17 +02:00
|
|
|
SessionKey sessionKey,
|
2018-07-23 16:23:23 +02:00
|
|
|
CompressionAlgorithm algorithm,
|
2021-09-02 18:01:06 +02:00
|
|
|
List<SignatureVerification> verifiedInbandSignatures,
|
|
|
|
List<SignatureVerification.Failure> invalidInbandSignatures,
|
|
|
|
List<SignatureVerification> verifiedDetachedSignatures,
|
|
|
|
List<SignatureVerification.Failure> invalidDetachedSignatures,
|
2021-07-15 16:55:13 +02:00
|
|
|
String fileName,
|
|
|
|
Date modificationDate,
|
|
|
|
StreamEncoding fileEncoding) {
|
2018-06-06 18:46:41 +02:00
|
|
|
|
|
|
|
this.recipientKeyIds = Collections.unmodifiableSet(recipientKeyIds);
|
2021-07-04 13:08:24 +02:00
|
|
|
this.decryptionKey = decryptionKey;
|
2021-10-15 14:58:17 +02:00
|
|
|
this.sessionKey = sessionKey;
|
2018-06-06 18:46:41 +02:00
|
|
|
this.compressionAlgorithm = algorithm;
|
2021-09-02 18:01:06 +02:00
|
|
|
this.verifiedInbandSignatures = Collections.unmodifiableList(verifiedInbandSignatures);
|
|
|
|
this.invalidInbandSignatures = Collections.unmodifiableList(invalidInbandSignatures);
|
|
|
|
this.verifiedDetachedSignatures = Collections.unmodifiableList(verifiedDetachedSignatures);
|
|
|
|
this.invalidDetachedSignatures = Collections.unmodifiableList(invalidDetachedSignatures);
|
2021-07-15 16:55:13 +02:00
|
|
|
this.fileName = fileName;
|
|
|
|
this.modificationDate = modificationDate;
|
|
|
|
this.fileEncoding = fileEncoding;
|
2018-06-06 18:46:41 +02:00
|
|
|
}
|
|
|
|
|
2021-08-26 19:53:15 +02:00
|
|
|
/**
|
|
|
|
* Return a set of key-ids the messages was encrypted for.
|
|
|
|
*
|
|
|
|
* @return recipient ids
|
|
|
|
*/
|
|
|
|
public @Nonnull Set<Long> getRecipientKeyIds() {
|
2018-06-06 18:46:41 +02:00
|
|
|
return recipientKeyIds;
|
|
|
|
}
|
|
|
|
|
2021-08-26 19:53:15 +02:00
|
|
|
/**
|
|
|
|
* Return true, if the message was encrypted.
|
|
|
|
*
|
|
|
|
* @return true if encrypted, false otherwise
|
|
|
|
*/
|
2018-06-10 17:12:44 +02:00
|
|
|
public boolean isEncrypted() {
|
2021-10-15 14:58:17 +02:00
|
|
|
return sessionKey != null && sessionKey.getAlgorithm() != SymmetricKeyAlgorithm.NULL && !getRecipientKeyIds().isEmpty();
|
2018-06-10 17:12:44 +02:00
|
|
|
}
|
|
|
|
|
2021-08-26 19:53:15 +02:00
|
|
|
/**
|
|
|
|
* Return the {@link SubkeyIdentifier} of the key that was used to decrypt the message.
|
|
|
|
* This can be null if the message was decrypted using a {@link org.pgpainless.util.Passphrase}, or if it was not
|
|
|
|
* encrypted at all (eg. signed only).
|
|
|
|
*
|
|
|
|
* @return subkey identifier of decryption key
|
|
|
|
*/
|
|
|
|
public @Nullable SubkeyIdentifier getDecryptionKey() {
|
2021-07-04 13:08:24 +02:00
|
|
|
return decryptionKey;
|
2018-06-06 18:46:41 +02:00
|
|
|
}
|
|
|
|
|
2021-08-26 19:53:15 +02:00
|
|
|
/**
|
|
|
|
* Return the algorithm that was used to symmetrically encrypt the message.
|
|
|
|
*
|
|
|
|
* @return encryption algorithm
|
|
|
|
*/
|
|
|
|
public @Nullable SymmetricKeyAlgorithm getSymmetricKeyAlgorithm() {
|
2021-10-15 14:58:17 +02:00
|
|
|
return sessionKey == null ? null : sessionKey.getAlgorithm();
|
|
|
|
}
|
|
|
|
|
|
|
|
public @Nullable SessionKey getSessionKey() {
|
|
|
|
return sessionKey;
|
2018-06-06 18:46:41 +02:00
|
|
|
}
|
|
|
|
|
2021-08-26 19:53:15 +02:00
|
|
|
/**
|
|
|
|
* Return the {@link CompressionAlgorithm} that was used to compress the message.
|
|
|
|
*
|
|
|
|
* @return compression algorithm
|
|
|
|
*/
|
|
|
|
public @Nullable CompressionAlgorithm getCompressionAlgorithm() {
|
2018-06-06 18:46:41 +02:00
|
|
|
return compressionAlgorithm;
|
|
|
|
}
|
|
|
|
|
2021-08-26 19:53:15 +02:00
|
|
|
/**
|
|
|
|
* Return a set of all signatures on the message.
|
|
|
|
* Note: This method returns just the signatures. There is no guarantee that the signatures are verified or even correct.
|
|
|
|
*
|
|
|
|
* Use {@link #getVerifiedSignatures()} instead to get all verified signatures.
|
|
|
|
* @return unverified and verified signatures
|
|
|
|
*/
|
|
|
|
public @Nonnull Set<PGPSignature> getSignatures() {
|
2020-08-24 14:55:06 +02:00
|
|
|
Set<PGPSignature> signatures = new HashSet<>();
|
2021-09-02 18:01:06 +02:00
|
|
|
for (SignatureVerification v : getVerifiedDetachedSignatures()) {
|
|
|
|
signatures.add(v.getSignature());
|
|
|
|
}
|
|
|
|
for (SignatureVerification v : getVerifiedInbandSignatures()) {
|
|
|
|
signatures.add(v.getSignature());
|
2020-08-24 14:55:06 +02:00
|
|
|
}
|
2021-09-02 18:01:06 +02:00
|
|
|
for (SignatureVerification.Failure f : getInvalidDetachedSignatures()) {
|
|
|
|
signatures.add(f.getSignatureVerification().getSignature());
|
|
|
|
}
|
|
|
|
for (SignatureVerification.Failure f : getInvalidInbandSignatures()) {
|
|
|
|
signatures.add(f.getSignatureVerification().getSignature());
|
2020-08-24 14:55:06 +02:00
|
|
|
}
|
2020-01-10 15:12:04 +01:00
|
|
|
return signatures;
|
|
|
|
}
|
|
|
|
|
2021-08-26 19:53:15 +02:00
|
|
|
/**
|
|
|
|
* Return true if the message contained at least one signature.
|
|
|
|
*
|
|
|
|
* Note: This method does not reflect, whether the signature on the message is correct.
|
|
|
|
* Use {@link #isVerified()} instead to determine, if the message carries a verifiable signature.
|
|
|
|
*
|
|
|
|
* @return true if message contains at least one unverified or verified signature, false otherwise.
|
|
|
|
*/
|
2018-06-10 17:12:44 +02:00
|
|
|
public boolean isSigned() {
|
2020-08-24 14:55:06 +02:00
|
|
|
return !getSignatures().isEmpty();
|
2018-06-10 17:12:44 +02:00
|
|
|
}
|
|
|
|
|
2021-08-26 19:53:15 +02:00
|
|
|
/**
|
|
|
|
* Return a map of all verified signatures on the message.
|
|
|
|
* The map contains verified signatures as value, with the {@link SubkeyIdentifier} of the key that was used to verify
|
|
|
|
* the signature as the maps keys.
|
|
|
|
*
|
|
|
|
* @return verified detached and one-pass signatures
|
|
|
|
*/
|
2021-07-04 13:08:24 +02:00
|
|
|
public Map<SubkeyIdentifier, PGPSignature> getVerifiedSignatures() {
|
|
|
|
Map<SubkeyIdentifier, PGPSignature> verifiedSignatures = new ConcurrentHashMap<>();
|
2021-09-02 18:01:06 +02:00
|
|
|
for (SignatureVerification detachedSignature : getVerifiedDetachedSignatures()) {
|
|
|
|
verifiedSignatures.put(detachedSignature.getSigningKey(), detachedSignature.getSignature());
|
2020-08-24 14:55:06 +02:00
|
|
|
}
|
2021-09-02 18:01:06 +02:00
|
|
|
for (SignatureVerification inbandSignatures : verifiedInbandSignatures) {
|
|
|
|
verifiedSignatures.put(inbandSignatures.getSigningKey(), inbandSignatures.getSignature());
|
2020-08-24 14:55:06 +02:00
|
|
|
}
|
|
|
|
|
2020-01-10 15:12:04 +01:00
|
|
|
return verifiedSignatures;
|
|
|
|
}
|
|
|
|
|
2021-09-02 18:01:06 +02:00
|
|
|
public List<SignatureVerification> getVerifiedInbandSignatures() {
|
|
|
|
return verifiedInbandSignatures;
|
|
|
|
}
|
|
|
|
|
|
|
|
public List<SignatureVerification> getVerifiedDetachedSignatures() {
|
|
|
|
return verifiedDetachedSignatures;
|
|
|
|
}
|
|
|
|
|
|
|
|
public List<SignatureVerification.Failure> getInvalidInbandSignatures() {
|
|
|
|
return invalidInbandSignatures;
|
|
|
|
}
|
|
|
|
|
|
|
|
public List<SignatureVerification.Failure> getInvalidDetachedSignatures() {
|
|
|
|
return invalidDetachedSignatures;
|
|
|
|
}
|
|
|
|
|
2021-08-26 19:53:15 +02:00
|
|
|
/**
|
|
|
|
* Return true, if the message is signed and at least one signature on the message was verified successfully.
|
|
|
|
*
|
|
|
|
* @return true if message is verified, false otherwise
|
|
|
|
*/
|
2018-06-10 17:12:44 +02:00
|
|
|
public boolean isVerified() {
|
2020-08-24 14:55:06 +02:00
|
|
|
return !getVerifiedSignatures().isEmpty();
|
2018-06-10 17:12:44 +02:00
|
|
|
}
|
|
|
|
|
2021-08-26 19:53:15 +02:00
|
|
|
/**
|
|
|
|
* Return true, if the message contains at least one verified signature made by a key in the
|
|
|
|
* given certificate.
|
|
|
|
*
|
|
|
|
* @param certificate certificate
|
|
|
|
* @return true if message was signed by the certificate (and the signature is valid), false otherwise
|
|
|
|
*/
|
|
|
|
public boolean containsVerifiedSignatureFrom(PGPPublicKeyRing certificate) {
|
|
|
|
for (PGPPublicKey key : certificate) {
|
2021-10-27 17:38:25 +02:00
|
|
|
OpenPgpFingerprint fingerprint = OpenPgpFingerprint.of(key);
|
2018-07-26 16:40:26 +02:00
|
|
|
if (containsVerifiedSignatureFrom(fingerprint)) {
|
2018-06-10 17:12:44 +02:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2021-08-26 19:53:15 +02:00
|
|
|
/**
|
|
|
|
* Return true, if the message contains at least one valid signature made by the key with the given
|
|
|
|
* fingerprint, false otherwise.
|
|
|
|
*
|
|
|
|
* The fingerprint might be of the signing subkey, or the primary key of the signing certificate.
|
|
|
|
*
|
|
|
|
* @param fingerprint fingerprint of primary key or signing subkey
|
|
|
|
* @return true if validly signed, false otherwise
|
|
|
|
*/
|
2021-10-27 17:38:25 +02:00
|
|
|
public boolean containsVerifiedSignatureFrom(OpenPgpFingerprint fingerprint) {
|
2021-07-04 13:08:24 +02:00
|
|
|
for (SubkeyIdentifier verifiedSigningKey : getVerifiedSignatures().keySet()) {
|
|
|
|
if (verifiedSigningKey.getPrimaryKeyFingerprint().equals(fingerprint) ||
|
|
|
|
verifiedSigningKey.getSubkeyFingerprint().equals(fingerprint)) {
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false;
|
2020-08-24 14:55:06 +02:00
|
|
|
}
|
|
|
|
|
2021-07-15 16:55:13 +02:00
|
|
|
/**
|
|
|
|
* Return the name of the encrypted / signed file.
|
|
|
|
*
|
|
|
|
* @return file name
|
|
|
|
*/
|
|
|
|
public String getFileName() {
|
|
|
|
return fileName;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Return true, if the encrypted data is intended for your eyes only.
|
|
|
|
*
|
|
|
|
* @return true if for-your-eyes-only
|
|
|
|
*/
|
|
|
|
public boolean isForYourEyesOnly() {
|
|
|
|
return PGPLiteralData.CONSOLE.equals(getFileName());
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Return the modification date of the encrypted / signed file.
|
|
|
|
*
|
|
|
|
* @return modification date
|
|
|
|
*/
|
|
|
|
public Date getModificationDate() {
|
|
|
|
return modificationDate;
|
2021-04-25 00:28:48 +02:00
|
|
|
}
|
|
|
|
|
2021-07-15 16:55:13 +02:00
|
|
|
/**
|
|
|
|
* Return the encoding format of the encrypted / signed file.
|
|
|
|
*
|
|
|
|
* @return encoding
|
|
|
|
*/
|
|
|
|
public StreamEncoding getFileEncoding() {
|
|
|
|
return fileEncoding;
|
|
|
|
}
|
|
|
|
|
2020-01-10 15:12:04 +01:00
|
|
|
public static Builder getBuilder() {
|
2018-06-06 18:46:41 +02:00
|
|
|
return new Builder();
|
|
|
|
}
|
|
|
|
|
2020-01-10 15:12:04 +01:00
|
|
|
public static class Builder {
|
2018-06-06 18:46:41 +02:00
|
|
|
|
2018-07-08 19:31:53 +02:00
|
|
|
private final Set<Long> recipientFingerprints = new HashSet<>();
|
2021-10-15 14:58:17 +02:00
|
|
|
private SessionKey sessionKey;
|
2021-07-04 13:08:24 +02:00
|
|
|
private SubkeyIdentifier decryptionKey;
|
2018-06-06 18:46:41 +02:00
|
|
|
private CompressionAlgorithm compressionAlgorithm = CompressionAlgorithm.UNCOMPRESSED;
|
2021-07-15 16:55:13 +02:00
|
|
|
private String fileName;
|
|
|
|
private StreamEncoding fileEncoding;
|
|
|
|
private Date modificationDate;
|
2018-06-06 18:46:41 +02:00
|
|
|
|
2021-09-02 18:01:06 +02:00
|
|
|
private final List<SignatureVerification> verifiedInbandSignatures = new ArrayList<>();
|
|
|
|
private final List<SignatureVerification> verifiedDetachedSignatures = new ArrayList<>();
|
|
|
|
private final List<SignatureVerification.Failure> invalidInbandSignatures = new ArrayList<>();
|
|
|
|
private final List<SignatureVerification.Failure> invalidDetachedSignatures = new ArrayList<>();
|
|
|
|
|
|
|
|
|
2018-07-08 19:31:53 +02:00
|
|
|
public Builder addRecipientKeyId(Long keyId) {
|
|
|
|
this.recipientFingerprints.add(keyId);
|
2018-06-06 18:46:41 +02:00
|
|
|
return this;
|
|
|
|
}
|
|
|
|
|
2021-07-04 13:08:24 +02:00
|
|
|
public Builder setDecryptionKey(SubkeyIdentifier decryptionKey) {
|
|
|
|
this.decryptionKey = decryptionKey;
|
2018-06-06 18:46:41 +02:00
|
|
|
return this;
|
|
|
|
}
|
|
|
|
|
2021-10-15 14:58:17 +02:00
|
|
|
public Builder setSessionKey(SessionKey sessionKey) {
|
|
|
|
this.sessionKey = sessionKey;
|
2018-06-06 18:46:41 +02:00
|
|
|
return this;
|
|
|
|
}
|
|
|
|
|
2021-10-15 14:58:17 +02:00
|
|
|
public Builder setCompressionAlgorithm(CompressionAlgorithm algorithm) {
|
|
|
|
this.compressionAlgorithm = algorithm;
|
2018-06-06 18:46:41 +02:00
|
|
|
return this;
|
|
|
|
}
|
|
|
|
|
2021-07-15 16:55:13 +02:00
|
|
|
public Builder setFileName(@Nonnull String fileName) {
|
|
|
|
this.fileName = fileName;
|
|
|
|
return this;
|
|
|
|
}
|
|
|
|
|
|
|
|
public Builder setModificationDate(Date modificationDate) {
|
|
|
|
this.modificationDate = modificationDate;
|
|
|
|
return this;
|
|
|
|
}
|
|
|
|
|
|
|
|
public Builder setFileEncoding(StreamEncoding encoding) {
|
|
|
|
this.fileEncoding = encoding;
|
|
|
|
return this;
|
|
|
|
}
|
|
|
|
|
2021-09-02 18:01:06 +02:00
|
|
|
public OpenPgpMetadata build() {
|
|
|
|
return new OpenPgpMetadata(
|
|
|
|
recipientFingerprints, decryptionKey,
|
2021-10-15 14:58:17 +02:00
|
|
|
sessionKey, compressionAlgorithm,
|
2021-09-02 18:01:06 +02:00
|
|
|
verifiedInbandSignatures, invalidInbandSignatures,
|
|
|
|
verifiedDetachedSignatures, invalidDetachedSignatures,
|
|
|
|
fileName, modificationDate, fileEncoding);
|
|
|
|
}
|
|
|
|
|
|
|
|
public void addVerifiedInbandSignature(SignatureVerification signatureVerification) {
|
|
|
|
this.verifiedInbandSignatures.add(signatureVerification);
|
2020-08-24 14:55:06 +02:00
|
|
|
}
|
|
|
|
|
2021-09-02 18:01:06 +02:00
|
|
|
public void addVerifiedDetachedSignature(SignatureVerification signatureVerification) {
|
|
|
|
this.verifiedDetachedSignatures.add(signatureVerification);
|
2020-08-24 14:55:06 +02:00
|
|
|
}
|
|
|
|
|
2021-09-02 18:01:06 +02:00
|
|
|
public void addInvalidInbandSignature(SignatureVerification signatureVerification, SignatureValidationException e) {
|
|
|
|
this.invalidInbandSignatures.add(new SignatureVerification.Failure(signatureVerification, e));
|
|
|
|
}
|
|
|
|
|
|
|
|
public void addInvalidDetachedSignature(SignatureVerification signatureVerification, SignatureValidationException e) {
|
|
|
|
this.invalidDetachedSignatures.add(new SignatureVerification.Failure(signatureVerification, e));
|
2018-06-06 18:46:41 +02:00
|
|
|
}
|
|
|
|
}
|
2018-06-02 21:21:35 +02:00
|
|
|
}
|