Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/crypto/openpgp: cross-certification signatures not verified #10740

Closed
kbsriram opened this issue May 7, 2015 · 1 comment
Closed

x/crypto/openpgp: cross-certification signatures not verified #10740

kbsriram opened this issue May 7, 2015 · 1 comment
Labels
FrozenDueToAge
Milestone
Unreleased

Comments

@kbsriram
Copy link

kbsriram commented May 7, 2015

go version devel +aebd123 Thu May 7 01:24:27 2015 +0000 darwin/amd64

The openpgp code needs additional checks around signatures made on signing subkeys. In particular, verifying embedded signatures (i.e., back or cross signatures made by a signing subkey on the primary key) is a required check for rfc4880, and avoids the problems mentioned at https://www.gnupg.org/faq/subkey-cross-certify.html

(Section 11.1 from the RFC also has the "must" requirements for validating signing subkeys.)
@kbsriram kbsriram changed the title crypto/openpgp: cross-certification signatures not verified x/crypto/openpgp: cross-certification signatures not verified May 7, 2015
@agl agl self-assigned this May 31, 2015
@ianlancetaylor ianlancetaylor added this to the Unreleased milestone Jun 3, 2015
@agl
Copy link
Contributor

agl commented Jun 9, 2015

Fixed by go.crypto c10c31b

@agl agl closed this as completed Jun 9, 2015
@golang golang locked and limited conversation to collaborators Jun 25, 2016
FiloSottile pushed a commit to FiloSottile/go that referenced this issue Nov 24, 2019
@kbsriram @agl
x/crypto/openpgp: cross-signature validation for signing subkeys.
c10c31b 
Section 11.1 of RFC4880 requires that binding signatures on
signing subkeys contain a valid embedded signature that cross-certifies
the primary key. This is to avoid the weakness described at
https://www.gnupg.org/faq/subkey-cross-certify.html

Fixes golang#10740

Change-Id: Ibe039662497832945957b001a83080ba29213703
Reviewed-on: https://go-review.googlesource.com/9799
Reviewed-by: Adam Langley <agl@golang.org>
@rsc rsc unassigned agl Jun 23, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge
Projects
None yet
Milestone
Unreleased
Development

No branches or pull requests
4 participants
@agl @kbsriram @ianlancetaylor @gopherbot