PGPainless/pgpainless
PGPainless/pgpainless
1
0
Fork 0
mirror of https://github.com/pgpainless/pgpainless.git synced 2024-11-23 04:42:06 +01:00
Code Issues Releases Wiki Activity

More rigurous testing of key re-encryption

Browse source
This commit is contained in:
Paul Schaub 2020-10-30 13:30:21 +01:00
parent 7c102334ed
commit 47b1ccc071
Signed by: vanitasvitae
GPG key ID: 62BEE9264BF17311
1 changed files with 138 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

142
pgpainless-core/src/test/java/org/pgpainless/key/modification/ChangeSecretKeyRingPassphraseTest.java
View file

@ -15,6 +15,7 @@
*/ */
package org.pgpainless.key.modification; package org.pgpainless.key.modification;
import static junit.framework.TestCase.assertEquals;
import static org.junit.Assert.fail; import static org.junit.Assert.fail;
import java.io.ByteArrayInputStream; import java.io.ByteArrayInputStream;
@ -22,44 +23,177 @@ import java.io.ByteArrayOutputStream;
import java.io.IOException; import java.io.IOException;
import java.security.InvalidAlgorithmParameterException; import java.security.InvalidAlgorithmParameterException;
import java.security.NoSuchAlgorithmException; import java.security.NoSuchAlgorithmException;
import java.util.Iterator;
import org.bouncycastle.openpgp.PGPException; import org.bouncycastle.openpgp.PGPException;
import org.bouncycastle.openpgp.PGPSecretKey;
import org.bouncycastle.openpgp.PGPSecretKeyRing; import org.bouncycastle.openpgp.PGPSecretKeyRing;
import org.bouncycastle.openpgp.operator.PBESecretKeyDecryptor;
import org.bouncycastle.openpgp.operator.PGPDigestCalculatorProvider;
import org.bouncycastle.openpgp.operator.bc.BcPBESecretKeyDecryptorBuilder;
import org.bouncycastle.openpgp.operator.bc.BcPGPDigestCalculatorProvider;
import org.bouncycastle.util.io.Streams; import org.bouncycastle.util.io.Streams;
import org.junit.Test; import org.junit.Test;
import org.pgpainless.PGPainless; import org.pgpainless.PGPainless;
import org.pgpainless.algorithm.SymmetricKeyAlgorithm;
import org.pgpainless.encryption_signing.EncryptionStream; import org.pgpainless.encryption_signing.EncryptionStream;
import org.pgpainless.key.collection.PGPKeyRing; import org.pgpainless.key.collection.PGPKeyRing;
import org.pgpainless.key.protection.KeyRingProtectionSettings;
import org.pgpainless.key.protection.PasswordBasedSecretKeyRingProtector; import org.pgpainless.key.protection.PasswordBasedSecretKeyRingProtector;
import org.pgpainless.util.Passphrase; import org.pgpainless.util.Passphrase;
public class ChangeSecretKeyRingPassphraseTest { public class ChangeSecretKeyRingPassphraseTest {
private final PGPKeyRing keyRing = PGPainless.generateKeyRing().simpleEcKeyRing("password@encryp.ted", "weakPassphrase");
public ChangeSecretKeyRingPassphraseTest() throws InvalidAlgorithmParameterException, NoSuchAlgorithmException, PGPException {
}
@Test @Test
public void changePassphraseOfWholeKeyRingTest() throws InvalidAlgorithmParameterException, NoSuchAlgorithmException, PGPException, IOException { public void changePassphraseOfWholeKeyRingTest() throws InvalidAlgorithmParameterException, NoSuchAlgorithmException, PGPException, IOException {
PGPKeyRing keyRing = PGPainless.generateKeyRing().simpleEcKeyRing("password@encryp.ted", "weakPassphrase");
PGPSecretKeyRing secretKeys = PGPainless.modifyKeyRing(keyRing.getSecretKeys()) PGPSecretKeyRing secretKeys = PGPainless.modifyKeyRing(keyRing.getSecretKeys())
.changePassphraseFromOldPassphrase(Passphrase.fromPassword("weakPassphrase")) .changePassphraseFromOldPassphrase(Passphrase.fromPassword("weakPassphrase"))
.withSecureDefaultSettings() .withSecureDefaultSettings()
.toNewPassphrase(Passphrase.fromPassword("1337p455phr453")) .toNewPassphrase(Passphrase.fromPassword("1337p455phr453"))
.done(); .done();
keyRing = new PGPKeyRing(secretKeys); PGPKeyRing changedPassphraseKeyRing = new PGPKeyRing(secretKeys);
assertEquals(KeyRingProtectionSettings.secureDefaultSettings().getEncryptionAlgorithm().getAlgorithmId(),
changedPassphraseKeyRing.getSecretKeys().getSecretKey().getKeyEncryptionAlgorithm());
try { try {
signDummyMessageWithKeysAndPassphrase(keyRing, Passphrase.fromPassword("weakPassphrase")); signDummyMessageWithKeysAndPassphrase(changedPassphraseKeyRing, Passphrase.emptyPassphrase());
fail("Unlocking secret key ring with empty passphrase MUST fail.");
} catch (PGPException e) {
// yay
}
try {
signDummyMessageWithKeysAndPassphrase(changedPassphraseKeyRing, Passphrase.fromPassword("weakPassphrase"));
fail("Unlocking secret key ring with old passphrase MUST fail."); fail("Unlocking secret key ring with old passphrase MUST fail.");
} catch (PGPException e) { } catch (PGPException e) {
// yay // yay
} }
try { try {
signDummyMessageWithKeysAndPassphrase(keyRing, Passphrase.fromPassword("1337p455phr453")); signDummyMessageWithKeysAndPassphrase(changedPassphraseKeyRing, Passphrase.fromPassword("1337p455phr453"));
} catch (PGPException e) { } catch (PGPException e) {
fail("Unlocking the secret key ring with the new passphrase MUST succeed."); fail("Unlocking the secret key ring with the new passphrase MUST succeed.");
} }
} }
@Test
public void changePassphraseOfWholeKeyRingToEmptyPassphrase() throws PGPException, IOException {
PGPSecretKeyRing secretKeys = PGPainless.modifyKeyRing(keyRing.getSecretKeys())
.changePassphraseFromOldPassphrase(Passphrase.fromPassword("weakPassphrase"))
.withSecureDefaultSettings()
.toNoPassphrase()
.done();
PGPKeyRing changedPassphraseKeyRing = new PGPKeyRing(secretKeys);
assertEquals(SymmetricKeyAlgorithm.NULL.getAlgorithmId(),
changedPassphraseKeyRing.getSecretKeys().getSecretKey().getKeyEncryptionAlgorithm());
signDummyMessageWithKeysAndPassphrase(changedPassphraseKeyRing, Passphrase.emptyPassphrase());
}
@Test
public void changePassphraseOfSingleSubkeyToNewPassphrase() throws PGPException {
Iterator<PGPSecretKey> keys = keyRing.getSecretKeys().getSecretKeys();
PGPSecretKey primaryKey = keys.next();
PGPSecretKey subKey = keys.next();
extractPrivateKey(primaryKey, Passphrase.fromPassword("weakPassphrase"));
extractPrivateKey(subKey, Passphrase.fromPassword("weakPassphrase"));
PGPSecretKeyRing secretKeys = PGPainless.modifyKeyRing(keyRing.getSecretKeys())
.changeSubKeyPassphraseFromOldPassphrase(subKey.getPublicKey().getKeyID(),
Passphrase.fromPassword("weakPassphrase"))
.withSecureDefaultSettings()
.toNewPassphrase(Passphrase.fromPassword("subKeyPassphrase"))
.done();
keys = secretKeys.getSecretKeys();
primaryKey = keys.next();
subKey = keys.next();
extractPrivateKey(primaryKey, Passphrase.fromPassword("weakPassphrase"));
extractPrivateKey(subKey, Passphrase.fromPassword("subKeyPassphrase"));
try {
extractPrivateKey(primaryKey, Passphrase.fromPassword("subKeyPassphrase"));
fail("Unlocking the primary key with the subkey passphrase must fail.");
} catch (PGPException e) {
// yay
}
try {
extractPrivateKey(subKey, Passphrase.fromPassword("weakPassphrase"));
fail("Unlocking the subkey with the primary key passphrase must fail.");
} catch (PGPException e) {
// yay
}
}
@Test
public void changePassphraseOfSingleSubkeyToEmptyPassphrase() throws PGPException {
Iterator<PGPSecretKey> keys = keyRing.getSecretKeys().getSecretKeys();
PGPSecretKey primaryKey = keys.next();
PGPSecretKey subKey = keys.next();
PGPSecretKeyRing secretKeys = PGPainless.modifyKeyRing(keyRing.getSecretKeys())
.changeSubKeyPassphraseFromOldPassphrase(primaryKey.getKeyID(), Passphrase.fromPassword("weakPassphrase"))
.withSecureDefaultSettings()
.toNoPassphrase()
.done();
keys = secretKeys.getSecretKeys();
primaryKey = keys.next();
subKey = keys.next();
extractPrivateKey(primaryKey, Passphrase.emptyPassphrase());
extractPrivateKey(subKey, Passphrase.fromPassword("weakPassphrase"));
try {
extractPrivateKey(primaryKey, Passphrase.fromPassword("weakPassphrase"));
fail("Unlocking the unprotected primary key with the old passphrase must fail.");
} catch (PGPException e) {
// yay
}
try {
extractPrivateKey(subKey, Passphrase.emptyPassphrase());
fail("Unlocking the still protected subkey with an empty passphrase must fail.");
} catch (PGPException e) {
// yay
}
}
/**
* This method throws an PGPException if the provided passphrase cannot unlock the secret key.
*
* @param secretKey secret key
* @param passphrase passphrase
* @throws PGPException if passphrase is wrong
*/
private void extractPrivateKey(PGPSecretKey secretKey, Passphrase passphrase) throws PGPException {
PGPDigestCalculatorProvider digestCalculatorProvider = new BcPGPDigestCalculatorProvider();
if (passphrase.isEmpty() && secretKey.getKeyEncryptionAlgorithm() != SymmetricKeyAlgorithm.NULL.getAlgorithmId()) {
throw new PGPException("Cannot unlock encrypted private key with empty passphrase.");
} else if (!passphrase.isEmpty() && secretKey.getKeyEncryptionAlgorithm() == SymmetricKeyAlgorithm.NULL.getAlgorithmId()) {
throw new PGPException("Cannot unlock unprotected private key with non-empty passphrase.");
}
PBESecretKeyDecryptor decryptor = passphrase.isEmpty() ? null : new BcPBESecretKeyDecryptorBuilder(digestCalculatorProvider)
.build(passphrase.getChars());
secretKey.extractPrivateKey(decryptor);
}
private void signDummyMessageWithKeysAndPassphrase(PGPKeyRing keyRing, Passphrase passphrase) throws IOException, PGPException { private void signDummyMessageWithKeysAndPassphrase(PGPKeyRing keyRing, Passphrase passphrase) throws IOException, PGPException {
String dummyMessage = "dummy"; String dummyMessage = "dummy";
ByteArrayOutputStream dummy = new ByteArrayOutputStream(); ByteArrayOutputStream dummy = new ByteArrayOutputStream();