Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: check SHA-1 checksum before parsing #260

Merged
merged 2 commits into from
Jan 27, 2024
Merged

fix: check SHA-1 checksum before parsing #260

merged 2 commits into from
Jan 27, 2024

Conversation

link2xt
Copy link
Contributor

@link2xt link2xt commented Dec 17, 2023

Fixes #46

@link2xt link2xt mentioned this pull request Dec 17, 2023
Closed
link2xt
link2xt commented Dec 17, 2023
View reviewed changes
tests/key_test.rs
pgp::errors::Error::InvalidSha1Hash
));

let _signed_key = unsigned_pubkey.sign(&key, || "123".into()).unwrap();
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also slow, apparently it decrypts everything 3 times at least. :(
.unlock() called internally is not cheap because S2K is slow by design to avoid password bruteforcing.

@dignifiedquire
Copy link
Member

@link2xt can you rebase this so we can get it merged?

@dignifiedquire dignifiedquire merged commit fd36c23 into master Jan 27, 2024
18 checks passed
@dignifiedquire dignifiedquire deleted the link2xt/check-sha1-checksum branch January 27, 2024 12:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dignifiedquire dignifiedquire dignifiedquire approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

SHA-1 checksum of the Secret-Key packet is not checked
2 participants
@link2xt @dignifiedquire