kbpgp Importing an armored private key results in export_public

Importing an armored private key results in export_public_armored exporting private key

Open unusualbob opened this issue 9 years ago • 7 comments

If a pgp private key is imported directly it works correctly, but it appears to be written to publickey areas as well. This results in the private key being exposed when trying to access the publicKey. Here is a simple proof of concept:

var kbpgp = require('kbpgp');

kbpgp.KeyManager.generate_ecc({'userid' : 'test'},  function(err, km1) {
  km1.sign({}, function(err) {
    km1.export_pgp_private({}, function(err, privateArmored) {

      //Will log out private key, as expected
      console.log('privateArmored', privateArmored);

      kbpgp.KeyManager.import_from_armored_pgp({armored: privateArmored}, function(err, km2) {
        km2.sign({}, function(err) {
          km2.export_pgp_public({}, function(err, publicArmored){

            //Also logs out private key, which should not happen
            console.log('publicArmored', publicArmored);

          });
        });
      });
    });
  });
});