Add APIs to get the creation time of verified detached signatures #157
Conversation
crypto/keyring_message.go
Outdated
| // with a PGPMessage containing an encrypted detached signature | ||
| // returns the creation time of the signature if it succeeds | ||
| // and returns a SignatureVerificationError if fails. | ||
| func (keyRing *KeyRing) GetVerifiedEncryptedSignatureTimestamp(message *PlainMessage, encryptedSignature *PGPMessage, decryptionKeyRing *KeyRing, verifyTime int64) (int64, error) { |
There was a problem hiding this comment.
Do we have a use-case in mind for this? It's not needed by my side
There was a problem hiding this comment.
I don't think so, it's more for consistency but we can ditch it
crypto/keyring_message.go
Outdated
| // returns the creation time of the signature if it succeeds | ||
| // and returns a SignatureVerificationError if fails. | ||
| func (keyRing *KeyRing) GetVerifiedSignatureTimestamp(message *PlainMessage, signature *PGPSignature, verifyTime int64) (int64, error) { | ||
| err := keyRing.VerifyDetached(message, signature, verifyTime) |
There was a problem hiding this comment.
Here it verifies all the signatures, but then later we return the timestamp of the first one if any of them succeeds. We should return the timestamp of the succeeding one
There was a problem hiding this comment.
Can you have several sigs in a detached signature ?
If yes, how would I find out which one succeeded ?
There was a problem hiding this comment.
Yeah, it can happen. A simple solution here is to accept just one, since the crypto API CheckDetachedSignatureAndHash returns only the signer entity, and not the signature packet.
So basically instead of using signature.getCreationTime() you can just check if the first packet is a signature, then serialise just that one and verify it with verifySignature
There was a problem hiding this comment.
Wouldn't this lead to inconsistency between VerifyDetached and GetVerifiedSignatureTimestamp ?
Some sigs would be accepted by the first but not the other one
There was a problem hiding this comment.
Indeed. The other solution I see is to do the same but manually iterating over the signature packets, verifying one by one and returning the verifying one's timestamp
There was a problem hiding this comment.
Ok I tried going over each packet in a loop and return the time stamp for the first packet that verifies
marinthiercelin
force-pushed
the
feat/signature_creation_time
branch
from
763c7b9
to
09b2c70
Compare
marinthiercelin
force-pushed
the
feat/signature_creation_time
branch
from
bf01d91
to
9f0612d
Compare
Add a function to verify a detached signature and access its creation time.
marinthiercelin
force-pushed
the
feat/signature_creation_time
branch
from
9f0612d
to
d08315a
Compare
No description provided.