Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/crypto/openpgp: compression options are not used in Encrypt function #41213

Closed
bytegaurav opened this issue Sep 3, 2020 · 3 comments
Closed

x/crypto/openpgp: compression options are not used in Encrypt function #41213

bytegaurav opened this issue Sep 3, 2020 · 3 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Unreleased

Comments

@bytegaurav
Copy link

bytegaurav commented Sep 3, 2020 •
edited

installed Golang version and architecture details :

$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/Gaurav.k/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/Gaurav.k/Projects/GoProjects/"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/Cellar/go/1.12.4/libexec"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.12.4/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/4_/703g62812t39dfmzfx4l7w3r0000gp/T/go-build267975514=/tmp/go-build -gno-record-gcc-switches -fno-common"

$ go version
go version go1.12.4 darwin/amd64

What did you do?

I'm trying to replicate following gpg command with crypto/openpgp package.

gpg --armor --output <outputfile > --cipher aes256 --compress-algo zip --s2k-digest-algo SHA256 --encrypt --recipient <userkey> --sign -u <privatekeyid>  <inputfile>

I'm using crypto/openpgp package to encrypt message with a public key and sign it with my private key. I'm using the openpgp.Encrypt method and passed following config as parameter:

packetConfig := &packet.Config{
		DefaultCipher:          packet.CipherAES256,
		DefaultCompressionAlgo: packet.CompressionZIP,
		CompressionConfig: &packet.CompressionConfig{
			Level: flate.BestCompression,
		},
	}

What did you expect to see?

I'm expected to see my plain text input message to be PGP encrypted and must have ZIP compression.

What did you see instead?

Message I get from openpgp.Encrypt method, is properly signed and encrypted but not compressed.

Resolution

Upon inspecting the Encrypt function and debugging the code, found out that it's not making use of compression config passed as argument anywhere in the flow. Made a change in write.go and added compression. After this change, the messages are properly encrypted and compressed.

A PR is already raised in golang/crypto repository. golang/crypto#103. This PR and debug info is from last year when i raised it in crypto repo. Posting it here due to inactivity there.
@dmitshur dmitshur changed the title crypto/openpgp: Compression options are not used in Encrypt function x/crypto/openpgp: compression options are not used in Encrypt function Sep 4, 2020
@gopherbot gopherbot added this to the Unreleased milestone Sep 4, 2020
@dmitshur dmitshur added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Sep 4, 2020
@dmitshur
Copy link
Contributor

dmitshur commented Sep 4, 2020

/cc @FiloSottile per owners.

@bytegaurav
Copy link
Author

@FiloSottile @dmitshur
any update on this issue?

@FiloSottile
Copy link
Contributor

Per the accepted #44226 proposal and due to lack of maintenance, the golang.org/x/crypto/openpgp package is now frozen and deprecated. No new changes will be accepted except for security fixes. The package will not be removed.

If this is a security issue, please email security@golang.org and we will assess it and provide a fix.

If you're looking for alternatives, consider the crypto/ed25519 package for simple signatures, golang.org/x/mod/sumdb/note for inline signatures, or filippo.io/age for encryption. You can read a summary of OpenPGP issues and alternatives here.

If you are required to interoperate with OpenPGP systems and need a maintained package, we suggest considering one of multiple community forks of golang.org/x/crypto/openpgp. We don't endorse any specific one.

@tmthrgd tmthrgd mentioned this issue Jun 30, 2021
Closed
@golang golang locked and limited conversation to collaborators Mar 29, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Unreleased
Development

No branches or pull requests
4 participants
@FiloSottile @dmitshur @bytegaurav @gopherbot