v1.1.0-alpha.3-proton

This pre-release is v1.1.0-alpha.3 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.

v1.1.0-alpha.3

What's Changed

• New functions to verify signature hash tags
• Allow parsing certifications explicitly marked as exportable
• Sorting signature sub-packets by their ID when serializing
• Mark creation time, issuer key ID, and key flag signature sub-packets as critical
• When AEAD is in use, the session key length is now determined by the cipher specified in the AEAD preference.

Full Changelog: v1.1.0-alpha.2...v1.1.0-alpha.3

v1.1.0-alpha.1-proton

This pre-release is v1.1.0-alpha.1 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.

v1.1.0-alpha.1

What's Changed

Removes the openpgp.VerifyDetachedSignatureAndSaltedHash function and the packet.SaltedHashSpecifier as they are no longer required. They were introduced for verifying the headers in cleartext messages. However, in the latest crypto-refresh specification, cleartext message headers were dropped.

Full Changelog: v1.1.0-alpha.0...v1.1.0-alpha.1

v1.1.0-alpha.0-proton

This pre-release is v1.1.0-alpha.0 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.

v1.1.0-alpha.0

What's Changed

This major pre-release adds full support for the OpenPGP crypto refresh. In addition, the pre-release introduces an improved non-backwards compatible v2 API. The API in the openpgp package remains fully backwards compatible while the new v2 API is located in a separate v2 package in openpgp.

Full Changelog: v1.0.0...v1.1.0-alpha.0

V2 API

Import

The v2 API can be imported as:

openpgp ProtonMail/go-crypto/openpgp/v2

V2 API Breaking Changes

openpgp.v2.Entity struct fields have changed:

• SelfSignature *packet.Signature removed
• Signatures []*packet.Signature removed
• DirectSignatures []*packet.VerifiableSignature added
• Revocations []*packet.VerifiableSignature changed type

Methods of openpgp.v2.Entity that changed:

• PrimaryIdentity(date time.Time) now requires a time argument.
• EncryptionKey(date time.Time, config *packet.Config) now requires a new config argument.
• CertificationKey(date time.Time, config *packet.Config) now requires a new config argument.
• CertificationKeyById(date time.Time, id uint64, config *packet.Config) now requires a new config argument.
• SigningKey(date time.Time, config *packet.Config) now requires a new config argument.
• SigningKeyById(date time.Time, id uint64, config *packet.Config) now requires a new config argument.
• Revoke(reason packet.ReasonForRevocation, reasonText string, config *packet.Config) is renamed to RevokeKey.

Removed methods of openpgp.v2.Entity:

• RevokeSubkey(...) is replaced by (Subkey).Revoke(...)

openpgp.v2.Subkey struct fields have changed:

• Sig *packet.Signature removed
• Bindings []*packet.VerifiableSignature added
• Primary *Entity added, pointing to the primary key.
• Revocations []*packet.VerifiableSignature changed type

Methods of openpgp.v2.Subkey that changed:

• Revoked(selfCertification *packet.Signature, date time.Time) now requires a selfCertification argument.

openpgp.v2.Identity struct fields have changed:

• SelfSignature *packet.Signature removed
• Signatures []*packet.Signature removed
• SelfCertifications []*packet.VerifiableSignature added
• OtherCertifications []*packet.VerifiableSignature added
• Primary *Entity added, pointing to the primary key.
• Revocations []*packet.VerifiableSignature changed type

Methods of openpgp.v2.Identity that changed:

• Revoked(selfCertification *packet.Signature, date time.Time) now requires a selfCertification argument.

openpgp.v2.Key struct fields have changed:

• PrimarySelfSignature *packet.Signature added, pointing to the selected self signature of the primary key.
• Revocations []*packet.VerifiableSignature changed type

Interface openpgp.v2.KeyRing has changed:

• KeysByIdUsage(...) removed
• DecryptionKeys(...) removed
• EntitiesById(id uint64) []*Entity added. This is the main internal method to access keys from the keyring now.

openpgp.v2.FileHints struct field has changed:

• IsBinary removed and IsUTF8 added

API changes in openpgp.v2 for reading messages:

• VerifyDetachedSignatureAndHash(...) removed; headers in clearsigned messages are no longer checked.
• VerifyDetachedSignatureAndSaltedHash(...) removed
• CheckDetachedSignature(...) removed; call VerifyDetachedSignature(...) instead
• CheckDetachedSignatureAndSaltedHash(...) removed
• CheckDetachedSignatureAndHash(...) removed
• CheckArmoredDetachedSignature removed; call VerifyArmoredDetachedSignature instead

API changes in openpgp.v2 for writing messages:

• DetachSign(..., signers []*Entity,...) now requires a slice of entities instead of a single entity as an argument.
• ArmoredDetachSign(..., signers []*Entity,..., , params *SignParams) now requires a slice of entities instead of a single entity as an argument and replaces arguments with a SignParams object.
• DetachSignText(..., signers []*Entity,...) now requires a slice of entities instead of a single entity as an argument.
• ArmoredDetachSignText(..., signers []*Entity,...) now requires a slice of entities instead of a single entity as an argument.
• EncryptText(...) removed; call EncryptWithParams(...) instead
• EncryptSplit(...) removed; call EncryptWithParams(...) instead
• EncryptTextSplit(...) removed; call EncryptWithParams(...) instead
• Encrypt(..., toHidden []*Entity, signers []*Entity) now takes an additional toHidden recipients argument and requires a slice of signer entities instead of a single entity as an argument.
• Sign(..., signers []*Entity,...) now requires a slice of entities instead of a single entity as an argument.

Features

Intended Recipients

Version 2 of the ProtonMail/go-crypto library introduces a feature for including the recipients' key fingerprints in signatures during message encryption. When encrypting and signing a message, the intended recipients are automatically included in the signature unless specifically hidden (i.e., hidden recipients). During the decryption process, if the signature contains intended recipients and the appropriate configuration flag is set, the library verifies whether the primary ID of the decryption key is present in the recipient list. This check can be disabled in the config when a hidden recipient decrypts the message.

Multi-signature Support

In previous iterations of ProtonMail/go-crypto, only a single signature creation and verification were supported in a PGP message. However, in Version 2, the library introduces the ability to sign messages with multiple signatures using different keys, such as a v4 and a v6 key. The encryption and signing methods now accept multiple signing keys as arguments, with each key designated for a specific signature. When reading PGP messages with Version 2, the library maintains an internal state for each known signature and verifies all of them within the message. To facilitate this functionality, the message details struct includes a new field that stores the verification state for each signature. A message is considered valid if at least one of the signatures successfully validates without any errors. For callers, the process of checking for signature errors remains similar to previous versions. However, if the caller requires the verification state of all signatures, they can utilize the new field in the message details struct.

Rework of How Signatures in Keys and Signatures

are Verified

In previous iterations of ProtonMail/go-crypto, key verification occurred during import based on the current time, while signature verification did not involve further key checks. However, this approach had limitations, as invalid keys could have been valid at the time of signature creation and mistakenly considered invalid. Version 2 changes how and when signatures are verified in keys (i.e., direct-signatures, self-signatures of userids, binding signatures in subkeys, revocations, etc). Unlike before, key signature verification no longer takes place during parsing. Instead, keys are now validated when they are utilized, following a similar approach to key handling in OpenPGP.js. Additionally, all signatures and expirations are validated to adhere to the key lifecycle outlined in the RFC. The validity of keys can now be checked at different points in time, leading to the following specific modifications:

• During entity parsing, key validity is not checked.
• When used for encryption or signing, keys are verified using the current time during the writing process.
• During reading, the library verifies that each verification key was valid at the time of signature creation.
• A clear separation is maintained between Entity, Subkey, Identity, and their respective validation methods.
• Signature verification results are cached and reused to optimize computation. Further, version 2 includes various small improvements to increase the robustness of the key parsing functions.

Weak Algorithm Rejection

Version 2 introduces the option to specify weak algorithms for signatures in the config. Signatures that use weak algorithms are considered invalid.

Optional Packet Sequence Checker

Version 2 introduces a new feature that enables the validation of packet sequences in PGP messages. This functionality can be enabled in the config struct. In particular, it implements the pushdown automata (PDA) from PGPainless, developed by Paul Schaub. By leveraging this feature, users can ensure that the packet sequences in their PGP messages are valid and comply with the required structure. This addition further enhances the overall reliability and security of PGP message handling in Version 2.

Session Key Encryption and Decryption

Version 2 allows advanced users to retrieve the session key while encrypting a message by setting the respective flag in the config. In decryption, a caller can provide a session key that should be used for decryption.

Unify Write/Read API

Version 2 improves the compatibility between different APIs to allow combinations. The DetachSign function requires the caller to provide a Reader for the message, while encrypt returns a WriteCloser to which the message is written. The new version adds a function DetachSignWriter, which returns a WriteCloser similar to the encryption API. On the reading side, the verify detached signature API now relies on the same signature verification logic as the other read functions. Additionally, a new VerifyDetachedSignatureReader method similar to the ReadMessage API is introduced. It returns a message details struct that once read verifies the signature. Allows chaining different readers from the API, f...

Initial release Proton

This release is 1.0.0 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.

Initial release

First tagged release.