From 635733fe337ef25d592744813b6d68005ea4cf19 Mon Sep 17 00:00:00 2001 From: Lukas Burkhalter Date: Tue, 26 Sep 2023 15:03:48 +0200 Subject: [PATCH] fix(v2): Do not allow encrpytion with a forwarding key --- openpgp/v2/keys.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/openpgp/v2/keys.go b/openpgp/v2/keys.go index b4924793..40832ed6 100644 --- a/openpgp/v2/keys.go +++ b/openpgp/v2/keys.go @@ -163,12 +163,12 @@ func (e *Entity) DecryptionKeys(id uint64, date time.Time, config *packet.Config for _, subkey := range e.Subkeys { subkeySelfSig, err := subkey.LatestValidBindingSignature(date, config) if err == nil && - isValidEncryptionKey(subkeySelfSig, subkey.PublicKey.PubKeyAlgo) && + isValidDecryptionKey(subkeySelfSig, subkey.PublicKey.PubKeyAlgo) && (id == 0 || subkey.PublicKey.KeyId == id) { keys = append(keys, Key{subkey.Primary, primarySelfSignature, subkey.PublicKey, subkey.PrivateKey, subkeySelfSig}) } } - if isValidEncryptionKey(primarySelfSignature, e.PrimaryKey.PubKeyAlgo) { + if isValidDecryptionKey(primarySelfSignature, e.PrimaryKey.PubKeyAlgo) { keys = append(keys, Key{e, primarySelfSignature, e.PrimaryKey, e.PrivateKey, primarySelfSignature}) } return @@ -796,6 +796,12 @@ func isValidCertificationKey(signature *packet.Signature, algo packet.PublicKeyA } func isValidEncryptionKey(signature *packet.Signature, algo packet.PublicKeyAlgorithm) bool { + return algo.CanEncrypt() && + signature.FlagsValid && + (signature.FlagEncryptCommunications || signature.FlagEncryptStorage) +} + +func isValidDecryptionKey(signature *packet.Signature, algo packet.PublicKeyAlgorithm) bool { return algo.CanEncrypt() && signature.FlagsValid && (signature.FlagEncryptCommunications || signature.FlagForward || signature.FlagEncryptStorage)