gopenpgp icon indicating copy to clipboard operation
gopenpgp copied to clipboard

GopenPGP miscomputes "v5" signatures

Open teythoon opened this issue 1 year ago • 0 comments
trafficstars

GopenPGP 2.7.4 miscomputes draft-koch-openpgp-2015-rfc4880bis (aka "v5 OpenPGP") signatures. The signatures roundtrip fine, but are rejected by OpenPGP.js 5.5.0 and GnuPG 2.4.0. Signatures created by OpenPGP.js 5.5.0 and GnuPG 2.4.0 are rejected by GopenPGP 2.7.4.

There may also be some kind of packet corruption, as both Sequoia and OpenPGP.js report a packet truncation.

https://tests.sequoia-pgp.org/#Sign_Encrypt-Decrypt_Verify_roundtrip_with_key__Emma_

Consider dropping support for "v5" signatures (see #260). If no one complained about broken signatures so far, it is likely not used in the wild.

teythoon avatar Nov 27 '23 10:11 teythoon