bugDistributed Privacy Guard - Bugs: bug #58776, Verification fails with "key...

 
 

bug #58776: Verification fails with "key was not intended for signing" though it is

Submitter:  Justus Winter <teythoon>
Submitted:  Fri 17 Jul 2020 09:58:17 AM UTC
   
 
Category:  LibTMCG Severity:  2 - Minor
Item Group:  Bug Status:  In Progress
Privacy:  Public Assigned to:  stamer
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 10 Aug 2020 09:21:17 AM UTC, comment #5: 

Actually, RFC4880 recommends last-subpacket wins: https://tools.ietf.org/html/rfc4880#section-5.2.4.1

Seeing commit d38ae781bab97dc215751e7a11fa182fe17571cf I guess the larger problem was not considering embedded signatures in the unhashed subpacket area?

 Justus Winter <teythoon>
Tue 04 Aug 2020 11:55:34 AM UTC, comment #4: 

Here is the test exploring how key flags subpackets are combined:

https://tests.sequoia-pgp.org/#Key_Flags_Composition

Note that this might also uncover bugs, for example in GnuPG, where this happens for the "p[C][CS] u[C] s" case:


% gpg -k bob
pub   rsa3072 2019-10-15 [C]
      D1A66E1A23B182C9980F788CFBFCC82A015E7330
uid           [ unknown] Bob Babbage <bob@openpgp.example>
sub   rsa3072 2019-10-15 [SCEA]


Because of a prior investigation, I believe what happens is that GnuPG initializes the key flags to SCEA and does not update it for some reason.

Apart from that you can see us doing "last packet wins", modern GnuPG seems to do "first packet wins".

 Justus Winter <teythoon>
Fri 31 Jul 2020 04:20:13 PM UTC, comment #3: 

Relevant section of the RFC:

https://tools.ietf.org/html/rfc4880#section-5.2.3.3

Our interpretation is that a missing subpacket on a userid does not "shadow" the subpacket on a direct key signature.

Our implementation first consults the primary userid binding signature, then falls back to the direct key signature.  In this model, one could clear, say the key flags, by including an empty key flag set on the userid binding.

I should write a test exploring this further.

Regarding libTMCG's behavior, it disagrees with every other implementation, and that is at least a difficult spot to be in.  If this is not something very dear to your heart, I believe aligning the behavior is best (whatever that behavior may be exactly...).

 Justus Winter <teythoon>
Fri 31 Jul 2020 03:21:20 PM UTC, comment #2: 

I am not sure how to resolve this issue. As far as I see, RFC 4880 does not make any clear statement on updating key flags w.r.t. subpackets from different self-signatures. I this example the last self-signature does not contain such a subpacket -- so it's maybe the wish of key owner that all flags have been cleared. On the other hand, a missing subpacket can mean 'no change, please'.

@teythoon What is your suggestion?

 Heiko Stamer <stamer>
Group administrator
Fri 31 Jul 2020 02:56:42 PM UTC, comment #1: 

I guess this is a bug in LibTMCG key data update function, because the keyflags set by the two direct key sigs (0x1f) are overwritten by the userid sig (0x13).

INFO: sig type = 0x1f pkalgo = 1 hashalgo = 10 revocable = true exportable = true version = 4 creationtime = 1514764800 expirationtime = 0 keyexpirationtime = 0 revcode = 0 packet.size() = 319 hspd.size() = 15 issuer = 68 4f ad 62 dc 3 8f bb  issuerfpr = f2 d1 50 a4 fe 98 92 5d 51 e9 15 39 68 4f ad 62 dc 3 8f bb  keyflags = 3  revkeys.size() = 0 embeddedsigs.size() = 0 recipientfprs.size() = 0 attestedcerts.size() = 0 left = aa d
INFO: left = aa d
INFO: hash = aa d 14 d0 5b e6 1d fb bd e9 f1 c3 d4 36 db 2a 3 35 8d 3 da 12 5e d 90 26 1e 86 d6 e0 84 10 aa 58 aa 49 da f9 ee d6 43 1b 6d 5c 2d 22 af 2b 5c f 7a e4 9b cc a8 9 2d ac f4 98 83 dc 66 41
INFO: primary key update expirationtime to 0
INFO: primary key update flags to 3
INFO: primary key update features to 1
INFO: primary key update psa to
INFO: primary key update pha to 10
INFO: primary key update pca to
INFO: primary key update paa to
INFO: primary key update revkeys with added
INFO: sig type = 0x1f pkalgo = 1 hashalgo = 10 revocable = true exportable = true version = 4 creationtime = 1577836800 expirationtime = 0 keyexpirationtime = 0 revcode = 0 packet.size() = 319 hspd.size() = 15 issuer = 68 4f ad 62 dc 3 8f bb  issuerfpr = f2 d1 50 a4 fe 98 92 5d 51 e9 15 39 68 4f ad 62 dc 3 8f bb  keyflags = 3  revkeys.size() = 0 embeddedsigs.size() = 0 recipientfprs.size() = 0 attestedcerts.size() = 0 left = c7 df
INFO: left = c7 df
INFO: hash = c7 df 6d 84 7e 85 57 80 ad 1b 3d 9b d a9 85 47 95 72 ed 7d 40 93 f2 be 78 9a c0 7b a3 9c b 57 7f 79 53 3d 9 c2 e9 5 8c ef 74 50 6b 50 6f 4c 96 10 3d b6 e5 7d 78 47 f4 a7 3c 31 1f 59 3e 72
INFO: primary key update expirationtime to 0
INFO: primary key update flags to 3
INFO: primary key update features to 1
INFO: primary key update psa to
INFO: primary key update pha to 10
INFO: primary key update pca to
INFO: primary key update paa to
INFO: primary key update revkeys with added
INFO: userid = "juliet@example.org"
INFO: number of selfsigs = 1
INFO: number of revsigs = 0
INFO: number of certsigs = 0
INFO: number of attestsigs = 0
INFO: sig type = 0x13 pkalgo = 1 hashalgo = 10 revocable = true exportable = true version = 4 creationtime = 1514764800 expirationtime = 0 keyexpirationtime = 0 revcode = 0 packet.size() = 310 hspd.size() = 6 issuer = 68 4f ad 62 dc 3 8f bb  issuerfpr = f2 d1 50 a4 fe 98 92 5d 51 e9 15 39 68 4f ad 62 dc 3 8f bb  keyflags =  revkeys.size() = 0 embeddedsigs.size() = 0 recipientfprs.size() = 0 attestedcerts.size() = 0 left = 43 7d
INFO: left = 43 7d
INFO: hash = 43 7d 2d af e3 c8 37 b5 d7 3 6 b7 ed e7 79 28 aa af 4d 4b aa 86 6b f4 c8 c d2 f9 48 af 93 82 f8 32 74 b9 44 56 e6 94 1 c1 f2 20 0 ec 8a cc cf 3f 13 5f f9 68 aa 5b 8d 2e 26 c0 12 d2 9e 90
INFO: user ID is valid
INFO: primary key update expirationtime to 0
INFO: primary key update flags to
INFO: primary key update features to
INFO: primary key update psa to
INFO: primary key update pha to
INFO: primary key update pca to
INFO: primary key update paa to
INFO: primary key update revkeys with added
INFO: key flags on primary key are

Heiko Stamer <stamer>
Group administrator
Fri 17 Jul 2020 09:58:17 AM UTC, original submission:  

Consider:


% sq inspect cert.pgp
cert.pgp: OpenPGP Certificate.

    Fingerprint: F2D1 50A4 FE98 925D 51E9  1539 684F AD62 DC03 8FBB
Public-key algo: RSA (Encrypt or Sign)
Public-key size: 2048 bits
  Creation time: 2018-01-01 00:00:00 UTC
      Key flags: certification, signing

         Subkey: 5179 2C0E 48E2 FDA9 4E93  B911 4A72 34A3 A121 3A65
Public-key algo: RSA (Encrypt or Sign)
Public-key size: 2048 bits
  Creation time: 2018-01-02 00:00:00 UTC
      Key flags: signing

         UserID: juliet@example.org

% cat cert.pgp
-----BEGIN PGP PUBLIC KEY BLOCK-----

xsBNBFpJegABCAC1ePFquP0135m8DYhcybhv7l+ecojitFOd/jRM7hCczIqKgalD
1Ro1gNr3VmH6FjRIKIvGT+sOzCKne1v3KyAAPoxtwxjkATTKdOGo15I6v5ZjmO1d
rLQOLSt1TF7XbQSt+ns6PUZWJL907DvECUU5b9FkNUqfQ14QqY+gi7MOyAQez3b7
Pg5Cyz/kVWQ6TSMW/myDEDEertQ4rDBsptEDFHCC2+iF4hO2LqfiCriu5qyLcKCQ
pd6dEuwJQ/jjT0D9A9Fwf+i04x6ZPKSU9oNAWqn8OSAq3/0B/hu9V+0U0iHPnJxe
quykvJk7maxhiGhxBWYXTvDJmoon0NOles7LABEBAAHCwHwEHwEKAA8Fgl4L4QAC
FQoCmwMCHgEAIQkQaE+tYtwDj7sWIQTy0VCk/piSXVHpFTloT61i3AOPu8ffB/9Q
60dg60qhA2rPnd/1dCL2B+c8RWnq44PpijE3gA1RQvcRQE5jNzMSo/MnG0mSL5wH
eTsjSd/DRI3nHP06rs6Qub11NoKhNuya3maz9gyzeZMc/jNib83/BzFCrxsSQm+9
WHurxXeWXOPMLZs3xS/jG0EDtCJ2Fm4UF19fcIydwN/ssF4NGpfCY82+wTSx4joI
3cRKObCFJaaBgG5nl+eFr7cfjEIuqCJCaQsXiqBe7d6V3KqN18t+CgSaybMZXcys
Q/USxEkLhIB2pOZwcz4E3TTFgxRAxcr4cs4Bd2PRz3Z5FKTzo0ma/Ft0UfFJR+fC
cs55+n6kC9K0y/E7BY2hwsB8BB8BCgAPBYJaSXoAAhUKApsDAh4BACEJEGhPrWLc
A4+7FiEE8tFQpP6Ykl1R6RU5aE+tYtwDj7uqDQf7BqTD6GNTwXPOt/0kHQPYmbdI
tX+pWP+o3jaB6VTHDXcn27bttA5M82EXZfae4+bC1dMB+1uLal4ciVgO9ImJC9Nw
s5fc3JH4R5uuSvpjzjudkJsGu3cAKE3hwiT93Mi6t6ENpLCDSxqxzAmfoOQbVJYW
Y7gP7Z4Cj0IAP29aprEc0JWoMjHKpKgYF6u0sWgHWBuEXk/6o6GYb2HZYK4ycpY2
WXKgVhy7/iQDYO1FOfcWQXHVGLn8OzILjobKohNenTT20ZhAASi3LUDSDMTQfxSS
Vt0nhzWuXJJ4R8PzUVeRJ0A0oMyjZVHivHC6GwMsiQuSUTx8e/GnOByOqfGne80S
anVsaWV0QGV4YW1wbGUub3JnwsBzBBMBCgAGBYJaSXoAACEJEGhPrWLcA4+7FiEE
8tFQpP6Ykl1R6RU5aE+tYtwDj7tDfQf+PnxsIFu/0juKBUjjtAYfRzkrrYtMepPj
taTvGfo1SzUkX/6F/GjdSeVg5Iq6YcBrj8c+cB3EoZpHnScTgWQHwceWQLd9Hhbg
TrUNvW1eg2CVzN0RBuYMtWu9JM4pH7ssJW1NmN+/N9B67qb2y+JfBwH/la508NzC
rl3xWTxjT5wNy+FGkNZg23s/0qlO2uxCjc+mRAuAlp5EmTOVWOIBbM0xttjBOx39
ZmWWQKJZ0nrFjK1jppHqazwWWNX7RHkK81tlbSUtOPoTIJDz38NaiyMcZH3p9okN
3DU4XtF+oE18M+Z/E0xUQmumbkajFzcUjmd7enozP5BnGESzdNS5Xc7ATQRaSsuA
AQgAykb8tqlWXtqHGGkBqAq3EnpmvBqrKvqejjtZKAXqEszJ9NlibCGUuLwnNOVO
R/hcOUlOGH+cyMcApBWJB+7d/83K1eCCdv88nDFVav7hKLKlEBbZJNHgHpJ313pl
etzCR4x3STEISrEtO71l2HBdrKSYXaxGgILxYwcSi3i2EjzxRDy+0zyy8s7d+OD5
ShFYexgSrKH3Xx1cxQAJzGGJVx75HHU9GVh3xHwJ7nDm26KzHegG2XPIBXJ2z8vm
sSVTWyj0AjT4kVVapN0f84AKKjyQ7fguCzXGHFV9jmxDx+YH+9HhjIrHSzbDx6+4
wyRsxj7Su+hu/bogJ28nnbTzQwARAQABwsGsBBgBCgAJBYJeC+EAApsCAVcJEGhP
rWLcA4+7wHSgBBkBCgAGBYJeC+EAACEJEEpyNKOhITplFiEEUXksDkji/alOk7kR
SnI0o6EhOmWnSQgAiu/zdEmHf6Wbwfbs/c6FObfPxGuzLkQr4fZKcqK81MtR1mh1
WVLJRgXW4u8cHtZyH5pThngMcUiyzWsa0g6Jaz8w6sr/Wv3e1qdTCITskMrWCDao
DhD2teAjmWuk9u8ZBPJ7xhme+Q/UQ90xomQ/NdCJafirk2Ds92p7N7RKSES1KywB
hfONJbPw1TdZ9Mts+DGjkucYbe+ZzPxrLpWXur1BSGEqBtTAGW3dS/xpwBYNlhas
XHjYMr4HeIYYYOx+oR5JgDYoVfp2k0DwK/QXogbja+/Vjv+LrXdNY0t1bA35FNnl
637M8iCNrXvIoRFARbNyge8c/jSWGPLB/tIyNhYhBPLRUKT+mJJdUekVOWhPrWLc
A4+7FLwIAK1GngNMnruxWM4EoghKTSmKNrd6p/d3Wsd+y2019A7Nz+4OydkEDvmN
VVhlUcfgOf2L6Bf63wdN0ho+ODhCuNSqHe6NL1NhdITbMGnDdKb57IIB9CuJFpIL
n9LZ1Ei6JPEpmpiSEaL+VJt1fMnfc8jtF8N3WcRVfJsq1aslXe8Npg709YVgm2OX
sNWgktl9fciu4ENTybQGjpN9WTa1aU1nkko6NUoIfjtM+PO4VU7x00M+dTJsYGhn
c96EtT8EfSAIFBKZRAkMBFhEcdkxa8hCKI3+nyI3gTq0TcFST3wy05AmoV7wlgzU
AMsW7MV2NpG7fJul2Q7puKw+udBUc0TCwawEGAEKAAkFglro/4ACmwIBVwkQaE+t
YtwDj7vAdKAEGQEKAAYFglro/4AAIQkQSnI0o6EhOmUWIQRReSwOSOL9qU6TuRFK
cjSjoSE6ZeFHB/92jhUTXrEgho6DYhmVFuXa3NGhAjIyZo3yYHMoL9aZ3DUyjxhA
yRDpI2CrahQ4JsPhej2m+3fHWa34/tb5mpHYFWEahQvdWSFCcU7p2NUKcq2zNA6i
xO2+fQQhmbrYR+TFxYmhLjCGUNt14E/XaIL1VxPQOA5KbiRPpa8BsUNlNik9ASPW
yn0ZA0rjJ1ZV7nJarXVbuZDEcUDuDm3cA5tup7juB8fTz2BDcg3Ka+OcPEz0GgZf
q9K40di3r9IHLBhNPHieFVIj9j/JyMnTvVOceM3J/Rb0MCWJVbXNBKpRMDibCQh+
7fbqyQEM/zIpmk0TgBpTZZqMP0gxYdWImT1IFiEE8tFQpP6Ykl1R6RU5aE+tYtwD
j7tOtggAhgAqvOB142L2SkS3ZIdwuhAtWLPHCtEwBOqGtP8Z204rqAmbnJymzo77
+OT+SScnDTrwzOUJnCi0qPUxfuxhvHxnBxBIjaoMcF++iKsqF1vf6WuXOjbJ1N8I
08pB2niht5MxIZ9rMGDeASj79X7I9Jjzsd30OVGfTZyy3VyYPxcJ6n/sZocNmaTv
0/F8K3TirSH6JDXdY5zirRi99GJ3R+AL6OzxrChuvLFSEtIRJrW5XVfg3whc0XD+
5J9RsHoL33ub9ZhQHFKsjrf0nGYbEFwMhSdysfTYYMbwKi0CcQeQtPP0Y87zSrya
jDMFXQS0exdvhN4AXDlPlB3Rrkj7CQ==
=+VTZ
-----END PGP PUBLIC KEY BLOCK-----
% sq packet dump sig.pgp
Signature Packet, new CTB, 307 bytes
    Version: 4
    Type: Binary
    Pk algo: RSA (Encrypt or Sign)
    Hash algo: SHA512
    Hashed area:
      Signature creation time: 2018-05-01 00:00:00 UTC (critical)
    Unhashed area:
      Issuer: 684F AD62 DC03 8FBB
      Issuer Fingerprint: F2D1 50A4 FE98 925D 51E9  1539 684F AD62 DC03 8FBB
    Digest prefix: 9F46
    Level: 0 (signature over data)

% cat sig.pgp
-----BEGIN PGP SIGNATURE-----

wsBzBAABCgAGBYJa564AACEJEGhPrWLcA4+7FiEE8tFQpP6Ykl1R6RU5aE+tYtwD
j7ufRgf/QOsaJZgQaQ5daQrfBItOEcW+5acgY1TCwMVmc/nzBqC32TOvMaM3dypf
wJbqzxHQIes+ivKDF872VWlMA2BErifpdsogbS0pdik/qU+AjMhr188xKpZKG/IY
6BtuUPeSpsimx3UeEN3kt79fMtewBo0EXo3ujCyPpIF/9Vpd7L9jlJSvRBuM0/aR
gbRsclEw4JZ98B3t7F3rLmx+F57Zre0ctzT4tHE6IaCYpEClr6Tepj/UxExYOt2l
hKgVN8Wsuug7XYdOFmxqrV967m3CTnF8AspmxwgKK6NXjVLplfqij7Rp2URPWrWn
Pp3CQRGUWJdMeMY9P1MpFq6XiXtftw==
=Ld1q
-----END PGP SIGNATURE-----
% echo -n 'Hello, World' > data
% sqv --keyring cert.pgp sig.pgp data
F2D150A4FE98925D51E91539684FAD62DC038FBB
% dkg-verify --verbose -i data -s sig.pgp cert.pgp
INFO: using LibTMCG version 1.4.0
INFO: sig type = 0x0 pkalgo = 1 hashalgo = 10 revocable = true exportable = true version = 4 creationtime = 1525132800 expirationtime = 0 keyexpirationtime = 0 revcode = 0 packet.size() = 310 hspd.size() = 6 issuer = 68 4f ad 62 dc 3 8f bb  issuerfpr = f2 d1 50 a4 fe 98 92 5d 51 e9 15 39 68 4f ad 62 dc 3 8f bb  keyflags =  revkeys.size() = 0 embeddedsigs.size() = 0 recipientfprs.size() = 0 attestedcerts.size() = 0 left = 9f 46
ERROR: corresponding key was not intented for signing


(Taken from https://tests.sequoia-pgp.org/#Key_revocation_test__primary_key_signs_and_is_not_revoked__base_case_ )

 Justus Winter <teythoon>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by teythoon (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-07-31 stamer Severity3 - Normal 2 - Minor
    2020-07-31 stamer CategoryNone LibTMCG
        Item GroupNone Bug
    2020-07-26 stamer StatusNone In Progress
        Assigned toNone stamer

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-5190.
    Corresponding source code