Add expectSigned option to openpgp.decrypt and openpgp.verify (#1275)

If `expectSigned` is set:
- `openpgp.decrypt` throws immediately if public keys or signatures are
  missing, or if the signatures are invalid and streaming is not used.
- `openpgp.verify` throws immediately if signatures are missing, or if the
  signatures are invalid and streaming is not used.
- If the signatures are invalid and streaming is used, reading the returned
  data stream will eventually throw.

README.md

@@ -225,16 +225,17 @@ const openpgp = require('openpgp'); // use as CommonJS, AMD, ES6 module or via w
     const message = await openpgp.readMessage({
         armoredMessage: encrypted // parse armored message
     });
-    const { data: decrypted } = await openpgp.decrypt({
+    const { data: decrypted, signatures } = await openpgp.decrypt({
         message,
         publicKeys: publicKey, // for verification (optional)
         privateKeys: privateKey // for decryption
     });
     console.log(decrypted); // 'Hello, World!'
+    console.log(signatures[0].valid) // signature validity (signed messages only)
 })();
 ```
 
-Encrypt with multiple public keys:
+Encrypt to multiple public keys:
 
 ```js
 (async () => {
@@ -267,6 +268,41 @@ Encrypt with multiple public keys:
 })();
 ```
 
+If you expect an encrypted message to be signed with one of the public keys you have, and do not want to trust the decrypted data otherwise, you can pass the decryption option `expectSigned = true`, so that the decryption operation will fail if no valid signature is found:
+```js
+(async () => {
+    // put keys in backtick (``) to avoid errors caused by spaces or tabs
+    const publicKeyArmored = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+...
+-----END PGP PUBLIC KEY BLOCK-----`;
+    const privateKeyArmored = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+...
+-----END PGP PRIVATE KEY BLOCK-----`; // encrypted private key
+    const passphrase = `yourPassphrase`; // what the private key is encrypted with
+
+    const publicKey = await openpgp.readKey({ armoredKey: publicKeyArmored });
+
+    const privateKey = await openpgp.readKey({ armoredKey: privateKeyArmored });
+    await privateKey.decrypt(passphrase);
+
+    const encryptedAndSignedMessage = `-----BEGIN PGP MESSAGE-----
+...
+-----END PGP MESSAGE-----`;
+
+    const message = await openpgp.readMessage({
+        armoredMessage: encryptedAndSignedMessage // parse armored message
+    });
+    // decryption will fail if all signatures are invalid or missing
+    const { data: decrypted, signatures } = await openpgp.decrypt({
+        message,
+        privateKeys: privateKey // for decryption
+        expectSigned: true,
+        publicKeys: publicKey, // for verification (mandatory with expectSigned=true)
+    });
+    console.log(decrypted); // 'Hello, World!'
+})();
+```
+
 #### Encrypt symmetrically with compression
 
 By default, `encrypt` will not use any compression when encrypting symmetrically only (i.e. when no `publicKeys` are given).

openpgp.d.ts

@@ -543,6 +543,8 @@ interface DecryptOptions {
   sessionKeys?: SessionKey | SessionKey[];
   /** (optional) array of public keys or single key, to verify signatures */
   publicKeys?: Key | Key[];
+  /** (optional) whether data decryption should fail if the message is not signed with the provided publicKeys */
+  expectSigned?: boolean;
   /** (optional) whether to return data as a string(Stream) or Uint8Array(Stream). If 'utf8' (the default), also normalize newlines. */
   format?: 'utf8' | 'binary';
   /** (optional) detached signature for verification */
@@ -564,10 +566,12 @@ interface SignOptions {
 }
 
 interface VerifyOptions {
-  /** array of publicKeys or single key, to verify signatures */
-  publicKeys: Key | Key[];
   /** (cleartext) message object with signatures */
   message: CleartextMessage | Message<MaybeStream<Data>>;
+  /** array of publicKeys or single key, to verify signatures */
+  publicKeys: Key | Key[];
+  /** (optional) whether verification should throw if the message is not signed with the provided publicKeys */
+  expectSigned?: boolean;
   /** (optional) whether to return data as a string(Stream) or Uint8Array(Stream). If 'utf8' (the default), also normalize newlines. */
   format?: 'utf8' | 'binary';
   /** (optional) detached signature for verification */

src/openpgp.js

@@ -276,6 +276,7 @@ export function encrypt({ message, publicKeys, privateKeys, passwords, sessionKe
  * @param {String|Array<String>} [options.passwords] - Passwords to decrypt the message
  * @param {Object|Array<Object>} [options.sessionKeys] - Session keys in the form: { data:Uint8Array, algorithm:String }
  * @param {Key|Array<Key>} [options.publicKeys] - Array of public keys or single key, to verify signatures
+ * @param {Boolean} [options.expectSigned=false] - If true, data decryption fails if the message is not signed with the provided publicKeys
  * @param {'utf8'|'binary'} [options.format='utf8'] - Whether to return data as a string(Stream) or Uint8Array(Stream). If 'utf8' (the default), also normalize newlines.
  * @param {Signature} [options.signature] - Detached signature for verification
  * @param {Date} [options.date=current date] - Use the given date for verification instead of the current time
@@ -297,7 +298,7 @@ export function encrypt({ message, publicKeys, privateKeys, passwords, sessionKe
  * @async
  * @static
  */
-export function decrypt({ message, privateKeys, passwords, sessionKeys, publicKeys, format = 'utf8', signature = null, date = new Date(), config }) {
+export function decrypt({ message, privateKeys, passwords, sessionKeys, publicKeys, expectSigned = false, format = 'utf8', signature = null, date = new Date(), config }) {
   config = { ...defaultConfig, ...config };
   checkMessage(message); publicKeys = toArray(publicKeys); privateKeys = toArray(privateKeys); passwords = toArray(passwords); sessionKeys = toArray(sessionKeys);
 
@@ -311,6 +312,20 @@ export function decrypt({ message, privateKeys, passwords, sessionKeys, publicKe
     result.data = format === 'binary' ? decrypted.getLiteralData() : decrypted.getText();
     result.filename = decrypted.getFilename();
     linkStreams(result, message);
+    if (expectSigned) {
+      if (publicKeys.length === 0) {
+        throw new Error('Public keys are required to verify message signatures');
+      }
+      if (result.signatures.length === 0) {
+        throw new Error('Message is not signed');
+      }
+      result.data = stream.concat([
+        result.data,
+        stream.fromAsync(async () => {
+          await util.anyPromise(result.signatures.map(sig => sig.verified));
+        })
+      ]);
+    }
     result.data = await convertStream(result.data, message.fromStream, format);
     if (!message.fromStream) await prepareSignatures(result.signatures);
     return result;
@@ -370,8 +385,9 @@ export function sign({ message, privateKeys, armor = true, detached = false, sig
 /**
  * Verifies signatures of cleartext signed message
  * @param {Object} options
- * @param {Key|Array<Key>} options.publicKeys - Array of publicKeys or single key, to verify signatures
  * @param {CleartextMessage|Message} options.message - (cleartext) message object with signatures
+ * @param {Key|Array<Key>} options.publicKeys - Array of publicKeys or single key, to verify signatures
+ * @param {Boolean} [options.expectSigned=false] - If true, verification throws if the message is not signed with the provided publicKeys
  * @param {'utf8'|'binary'} [options.format='utf8'] - Whether to return data as a string(Stream) or Uint8Array(Stream). If 'utf8' (the default), also normalize newlines.
  * @param {Signature} [options.signature] - Detached signature for verification
  * @param {Date} [options.date=current date] - Use the given date for verification instead of the current time
@@ -392,7 +408,7 @@ export function sign({ message, privateKeys, armor = true, detached = false, sig
  * @async
  * @static
  */
-export function verify({ message, publicKeys, format = 'utf8', signature = null, date = new Date(), config }) {
+export function verify({ message, publicKeys, expectSigned = false, format = 'utf8', signature = null, date = new Date(), config }) {
   config = { ...defaultConfig, ...config };
   checkCleartextOrMessage(message);
   if (message instanceof CleartextMessage && format === 'binary') throw new Error("Can't return cleartext message data as binary");
@@ -408,6 +424,17 @@ export function verify({ message, publicKeys, format = 'utf8', signature = null,
     }
     result.data = format === 'binary' ? message.getLiteralData() : message.getText();
     if (message.fromStream) linkStreams(result, message);
+    if (expectSigned) {
+      if (result.signatures.length === 0) {
+        throw new Error('Message is not signed');
+      }
+      result.data = stream.concat([
+        result.data,
+        stream.fromAsync(async () => {
+          await util.anyPromise(result.signatures.map(sig => sig.verified));
+        })
+      ]);
+    }
     result.data = await convertStream(result.data, message.fromStream, format);
     if (!message.fromStream) await prepareSignatures(result.signatures);
     return result;

src/util.js

@@ -561,6 +561,28 @@ const util = {
       map[PacketClass.tag] = PacketClass;
     });
     return map;
+  },
+
+  /**
+   * Return a Promise that will resolve as soon as one of the promises in input resolves
+   * or will reject if all input promises all rejected
+   * (similar to Promise.any, but with slightly different error handling)
+   * @param {Array<Promise>} promises
+   * @return {Promise<Any>} Promise resolving to the result of the fastest fulfilled promise
+   *                          or rejected with the Error of the last resolved Promise (if all promises are rejected)
+   */
+  anyPromise: function(promises) {
+    return new Promise(async (resolve, reject) => {
+      let exception;
+      await Promise.all(promises.map(async promise => {
+        try {
+          resolve(await promise);
+        } catch (e) {
+          exception = e;
+        }
+      }));
+      reject(exception);
+    });
   }
 };
 

test/general/openpgp.js

@@ -811,6 +811,430 @@ module.exports = () => describe('OpenPGP.js public api tests', function() {
     });
   });
 
+  describe('decryptKey - unit tests', function() {
+    it('should work for correct passphrase', async function() {
+      const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+      const originalKey = await openpgp.readKey({ armoredKey: privateKey.armor() });
+      return openpgp.decryptKey({
+        privateKey: privateKey,
+        passphrase: passphrase
+      }).then(function(unlocked){
+        expect(unlocked.getKeyID().toHex()).to.equal(privateKey.getKeyID().toHex());
+        expect(unlocked.subKeys[0].getKeyID().toHex()).to.equal(privateKey.subKeys[0].getKeyID().toHex());
+        expect(unlocked.isDecrypted()).to.be.true;
+        expect(unlocked.keyPacket.privateParams).to.not.be.null;
+        // original key should be unchanged
+        expect(privateKey.isDecrypted()).to.be.false;
+        expect(privateKey.keyPacket.privateParams).to.be.null;
+        originalKey.subKeys[0].getKeyID(); // fill in keyID
+        expect(privateKey).to.deep.equal(originalKey);
+      });
+    });
+
+    it('should fail for incorrect passphrase', async function() {
+      const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+      const originalKey = await openpgp.readKey({ armoredKey: privateKey.armor() });
+      return openpgp.decryptKey({
+        privateKey: privateKey,
+        passphrase: 'incorrect'
+      }).then(function() {
+        throw new Error('Should not decrypt with incorrect passphrase');
+      }).catch(function(error){
+        expect(error.message).to.match(/Incorrect key passphrase/);
+        // original key should be unchanged
+        expect(privateKey.isDecrypted()).to.be.false;
+        expect(privateKey.keyPacket.privateParams).to.be.null;
+        expect(privateKey).to.deep.equal(originalKey);
+      });
+    });
+
+    it('should fail for corrupted key', async function() {
+      const privateKeyMismatchingParams = await openpgp.readKey({ armoredKey: mismatchingKeyParams });
+      const originalKey = await openpgp.readKey({ armoredKey: privateKeyMismatchingParams.armor() });
+      return openpgp.decryptKey({
+        privateKey: privateKeyMismatchingParams,
+        passphrase: 'userpass'
+      }).then(function() {
+        throw new Error('Should not decrypt corrupted key');
+      }).catch(function(error) {
+        expect(error.message).to.match(/Key is invalid/);
+        expect(privateKeyMismatchingParams.isDecrypted()).to.be.false;
+        expect(privateKeyMismatchingParams.keyPacket.privateParams).to.be.null;
+        expect(privateKeyMismatchingParams).to.deep.equal(originalKey);
+      });
+    });
+  });
+
+  describe('encryptKey - unit tests', function() {
+    it('should not change original key', async function() {
+      const { privateKeyArmored } = await openpgp.generateKey({ userIDs: [{ name: 'test', email: 'test@test.com' }] });
+      // read both keys from armored data to make sure all fields are exactly the same
+      const key = await openpgp.readKey({ armoredKey: privateKeyArmored });
+      const originalKey = await openpgp.readKey({ armoredKey: privateKeyArmored });
+      return openpgp.encryptKey({
+        privateKey: key,
+        passphrase: passphrase
+      }).then(function(locked){
+        expect(locked.getKeyID().toHex()).to.equal(key.getKeyID().toHex());
+        expect(locked.subKeys[0].getKeyID().toHex()).to.equal(key.subKeys[0].getKeyID().toHex());
+        expect(locked.isDecrypted()).to.be.false;
+        expect(locked.keyPacket.privateParams).to.be.null;
+        // original key should be unchanged
+        expect(key.isDecrypted()).to.be.true;
+        expect(key.keyPacket.privateParams).to.not.be.null;
+        originalKey.subKeys[0].getKeyID(); // fill in keyID
+        expect(key).to.deep.equal(originalKey);
+      });
+    });
+
+    it('encrypted key can be decrypted', async function() {
+      const { key } = await openpgp.generateKey({ userIDs: [{ name: 'test', email: 'test@test.com' }] });
+      const locked = await openpgp.encryptKey({
+        privateKey: key,
+        passphrase: passphrase
+      });
+      expect(locked.isDecrypted()).to.be.false;
+      const unlocked = await openpgp.decryptKey({
+        privateKey: locked,
+        passphrase: passphrase
+      });
+      expect(unlocked.isDecrypted()).to.be.true;
+    });
+
+    it('should support multiple passphrases', async function() {
+      const { key } = await openpgp.generateKey({ userIDs: [{ name: 'test', email: 'test@test.com' }] });
+      const passphrases = ['123', '456'];
+      const locked = await openpgp.encryptKey({
+        privateKey: key,
+        passphrase: passphrases
+      });
+      expect(locked.isDecrypted()).to.be.false;
+      await expect(openpgp.decryptKey({
+        privateKey: locked,
+        passphrase: passphrases[0]
+      })).to.eventually.be.rejectedWith(/Incorrect key passphrase/);
+      const unlocked = await openpgp.decryptKey({
+        privateKey: locked,
+        passphrase: passphrases
+      });
+      expect(unlocked.isDecrypted()).to.be.true;
+    });
+
+    it('should encrypt gnu-dummy key', async function() {
+      const key = await openpgp.readKey({ armoredKey: gnuDummyKeySigningSubkey });
+      const locked = await openpgp.encryptKey({
+        privateKey: key,
+        passphrase: passphrase
+      });
+      expect(key.isDecrypted()).to.be.true;
+      expect(locked.isDecrypted()).to.be.false;
+      expect(locked.primaryKey.isDummy()).to.be.true;
+      const unlocked = await openpgp.decryptKey({
+        privateKey: locked,
+        passphrase: passphrase
+      });
+      expect(key.isDecrypted()).to.be.true;
+      expect(unlocked.isDecrypted()).to.be.true;
+      expect(unlocked.primaryKey.isDummy()).to.be.true;
+    });
+  });
+
+  describe('decrypt - unit tests', function() {
+    let minRSABitsVal;
+
+    beforeEach(async function() {
+      minRSABitsVal = openpgp.config.minRSABits;
+      openpgp.config.minRSABits = 512;
+    });
+
+    afterEach(function() {
+      openpgp.config.minRSABits = minRSABitsVal;
+    });
+
+    it('decrypt/verify should succeed with valid signature  (expectSigned=true)', async function () {
+      const publicKey = await openpgp.readKey({ armoredKey: pub_key });
+      const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+      await privateKey.decrypt(passphrase);
+
+      const encrypted = await openpgp.encrypt({
+        message: await openpgp.createMessage({ text: plaintext }),
+        privateKeys: privateKey,
+        publicKeys: publicKey
+      });
+      const { data, signatures } = await openpgp.decrypt({
+        message: await openpgp.readMessage({ armoredMessage: encrypted }),
+        privateKeys: privateKey,
+        publicKeys: publicKey,
+        expectSigned: true
+      });
+      expect(data).to.equal(plaintext);
+      expect(signatures[0].valid).to.be.true;
+    });
+
+    it('decrypt/verify should throw on missing public keys (expectSigned=true)', async function () {
+      const publicKey = await openpgp.readKey({ armoredKey: pub_key });
+      const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+      await privateKey.decrypt(passphrase);
+
+      const encrypted = await openpgp.encrypt({
+        message: await openpgp.createMessage({ text: plaintext }),
+        publicKeys: publicKey,
+        privateKeys: privateKey
+      });
+      await expect(openpgp.decrypt({
+        message: await openpgp.readMessage({ armoredMessage: encrypted }),
+        privateKeys: privateKey,
+        expectSigned: true
+      })).to.be.eventually.rejectedWith(/Public keys are required/);
+    });
+
+    it('decrypt/verify should throw on missing signature (expectSigned=true)', async function () {
+      const publicKey = await openpgp.readKey({ armoredKey: pub_key });
+      const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+      await privateKey.decrypt(passphrase);
+
+      const encrypted = await openpgp.encrypt({
+        message: await openpgp.createMessage({ text: plaintext }),
+        publicKeys: publicKey
+      });
+      await expect(openpgp.decrypt({
+        message: await openpgp.readMessage({ armoredMessage: encrypted }),
+        privateKeys: privateKey,
+        publicKeys: publicKey,
+        expectSigned: true
+      })).to.be.eventually.rejectedWith(/Message is not signed/);
+    });
+
+    it('decrypt/verify should throw on invalid signature (expectSigned=true)', async function () {
+      const publicKey = await openpgp.readKey({ armoredKey: pub_key });
+      const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+      const wrongPublicKey = (await openpgp.readKey({ armoredKey: priv_key_2000_2008 })).toPublic();
+      await privateKey.decrypt(passphrase);
+
+      const encrypted = await openpgp.encrypt({
+        message: await openpgp.createMessage({ text: plaintext }),
+        publicKeys: publicKey,
+        privateKeys: privateKey
+      });
+      await expect(openpgp.decrypt({
+        message: await openpgp.readMessage({ armoredMessage: encrypted }),
+        privateKeys: privateKey,
+        publicKeys: wrongPublicKey,
+        expectSigned: true
+      })).to.be.eventually.rejectedWith(/Could not find signing key/);
+    });
+
+    it('decrypt/verify should succeed with valid signature (expectSigned=true, with streaming)', async function () {
+      const publicKey = await openpgp.readKey({ armoredKey: pub_key });
+      const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+      await privateKey.decrypt(passphrase);
+
+      const encrypted = await openpgp.encrypt({
+        message: await openpgp.createMessage({ text: plaintext }),
+        privateKeys: privateKey,
+        publicKeys: publicKey
+      });
+      const { data: streamedData, signatures } = await openpgp.decrypt({
+        message: await openpgp.readMessage({ armoredMessage: openpgp.stream.toStream(encrypted) }),
+        privateKeys: privateKey,
+        publicKeys: publicKey,
+        expectSigned: true
+      });
+      const data = await openpgp.stream.readToEnd(streamedData);
+      expect(data).to.equal(plaintext);
+      expect(await signatures[0].verified).to.be.true;
+    });
+
+    it('decrypt/verify should throw on missing public keys (expectSigned=true, with streaming)', async function () {
+      const publicKey = await openpgp.readKey({ armoredKey: pub_key });
+      const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+      await privateKey.decrypt(passphrase);
+
+      const encrypted = await openpgp.encrypt({
+        message: await openpgp.createMessage({ text: plaintext }),
+        publicKeys: publicKey,
+        privateKeys: privateKey
+      });
+      await expect(openpgp.decrypt({
+        message: await openpgp.readMessage({ armoredMessage: openpgp.stream.toStream(encrypted) }),
+        privateKeys: privateKey,
+        expectSigned: true
+      })).to.be.eventually.rejectedWith(/Public keys are required/);
+    });
+
+    it('decrypt/verify should throw on missing signature (expectSigned=true, with streaming)', async function () {
+      const publicKey = await openpgp.readKey({ armoredKey: pub_key });
+      const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+      await privateKey.decrypt(passphrase);
+
+      const encrypted = await openpgp.encrypt({
+        message: await openpgp.createMessage({ text: plaintext }),
+        publicKeys: publicKey
+      });
+      await expect(openpgp.decrypt({
+        message: await openpgp.readMessage({ armoredMessage: openpgp.stream.toStream(encrypted) }),
+        privateKeys: privateKey,
+        publicKeys: publicKey,
+        expectSigned: true
+      })).to.be.eventually.rejectedWith(/Message is not signed/);
+    });
+
+    it('decrypt/verify should throw on invalid signature (expectSigned=true, with streaming)', async function () {
+      const publicKey = await openpgp.readKey({ armoredKey: pub_key });
+      const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+      const wrongPublicKey = (await openpgp.readKey({ armoredKey: priv_key_2000_2008 })).toPublic();
+      await privateKey.decrypt(passphrase);
+
+      const encrypted = await openpgp.encrypt({
+        message: await openpgp.createMessage({ text: plaintext }),
+        publicKeys: publicKey,
+        privateKeys: privateKey
+      });
+      const { data: streamedData } = await openpgp.decrypt({
+        message: await openpgp.readMessage({ armoredMessage: openpgp.stream.toStream(encrypted) }),
+        privateKeys: privateKey,
+        publicKeys: wrongPublicKey,
+        expectSigned: true
+      });
+      await expect(
+        openpgp.stream.readToEnd(streamedData)
+      ).to.be.eventually.rejectedWith(/Could not find signing key/);
+    });
+  });
+
+  describe('verify - unit tests', function() {
+    let minRSABitsVal;
+
+    beforeEach(async function() {
+      minRSABitsVal = openpgp.config.minRSABits;
+      openpgp.config.minRSABits = 512;
+    });
+
+    afterEach(function() {
+      openpgp.config.minRSABits = minRSABitsVal;
+    });
+
+    describe('message', function() {
+      verifyTests(false);
+    });
+
+    describe('cleartext message', function() {
+      verifyTests(true);
+    });
+
+    function verifyTests(useCleartext) {
+      const createMessage = useCleartext ? openpgp.createCleartextMessage : openpgp.createMessage;
+      const readMessage = ({ armoredMessage }) => (
+        useCleartext ?
+          openpgp.readCleartextMessage({ cleartextMessage: armoredMessage }) :
+          openpgp.readMessage({ armoredMessage })
+      );
+      const text = useCleartext ? util.removeTrailingSpaces(plaintext) : plaintext;
+
+      it('verify should succeed with valid signature (expectSigned=true)', async function () {
+        const publicKey = await openpgp.readKey({ armoredKey: pub_key });
+        const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+        await privateKey.decrypt(passphrase);
+
+        const signed = await openpgp.sign({
+          message: await createMessage({ text }),
+          privateKeys: privateKey
+        });
+        const { data, signatures } = await openpgp.verify({
+          message: await readMessage({ armoredMessage: signed }),
+          publicKeys: publicKey,
+          expectSigned: true
+        });
+        expect(data).to.equal(text);
+        expect(signatures[0].valid).to.be.true;
+      });
+
+      it('verify should throw on missing signature (expectSigned=true)', async function () {
+        const publicKey = await openpgp.readKey({ armoredKey: pub_key });
+        const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+        await privateKey.decrypt(passphrase);
+
+        await expect(openpgp.verify({
+          message: await createMessage({ text }),
+          publicKeys: publicKey,
+          expectSigned: true
+        })).to.be.eventually.rejectedWith(/Message is not signed/);
+      });
+
+      it('verify should throw on invalid signature (expectSigned=true)', async function () {
+        const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+        const wrongPublicKey = (await openpgp.readKey({ armoredKey: priv_key_2000_2008 })).toPublic();
+        await privateKey.decrypt(passphrase);
+
+        const signed = await openpgp.sign({
+          message: await createMessage({ text }),
+          privateKeys: privateKey
+        });
+        await expect(openpgp.verify({
+          message: await readMessage({ armoredMessage: signed }),
+          publicKeys: wrongPublicKey,
+          expectSigned: true
+        })).to.be.eventually.rejectedWith(/Could not find signing key/);
+      });
+
+      it('verify should succeed with valid signature (expectSigned=true, with streaming)', async function () {
+        if (useCleartext) this.skip(); // eslint-disable-line no-invalid-this
+
+        const publicKey = await openpgp.readKey({ armoredKey: pub_key });
+        const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+        await privateKey.decrypt(passphrase);
+
+        const signed = await openpgp.sign({
+          message: await createMessage({ text }),
+          privateKeys: privateKey
+        });
+        const { data: streamedData, signatures } = await openpgp.verify({
+          message: await readMessage({ armoredMessage: openpgp.stream.toStream(signed) }),
+          publicKeys: publicKey,
+          expectSigned: true
+        });
+        const data = await openpgp.stream.readToEnd(streamedData);
+        expect(data).to.equal(text);
+        expect(await signatures[0].verified).to.be.true;
+      });
+
+      it('verify should throw on missing signature (expectSigned=true, with streaming)', async function () {
+        if (useCleartext) this.skip(); // eslint-disable-line no-invalid-this
+
+        const publicKey = await openpgp.readKey({ armoredKey: pub_key });
+        const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+        await privateKey.decrypt(passphrase);
+
+        await expect(openpgp.verify({
+          message: await createMessage({ text: openpgp.stream.toStream(text) }),
+          publicKeys: publicKey,
+          expectSigned: true
+        })).to.be.eventually.rejectedWith(/Message is not signed/);
+      });
+
+      it('verify should throw on invalid signature (expectSigned=true, with streaming)', async function () {
+        if (useCleartext) this.skip(); // eslint-disable-line no-invalid-this
+
+        const privateKey = await openpgp.readKey({ armoredKey: priv_key });
+        const wrongPublicKey = (await openpgp.readKey({ armoredKey: priv_key_2000_2008 })).toPublic();
+        await privateKey.decrypt(passphrase);
+
+        const signed = await openpgp.sign({
+          message: await createMessage({ text }),
+          privateKeys: privateKey
+        });
+        const { data: streamedData } = await openpgp.verify({
+          message: await readMessage({ armoredMessage: openpgp.stream.toStream(signed) }),
+          publicKeys: wrongPublicKey,
+          expectSigned: true
+        });
+        await expect(
+          openpgp.stream.readToEnd(streamedData)
+        ).to.be.eventually.rejectedWith(/Could not find signing key/);
+      });
+    }
+  });
+
   describe('encrypt, decrypt, sign, verify - integration tests', function() {
     let privateKey_2000_2008;
     let publicKey_2000_2008;
@@ -821,7 +1245,6 @@ module.exports = () => describe('OpenPGP.js public api tests', function() {
     let privateKey;
     let publicKey;
     let publicKeyNoAEAD;
-    let privateKeyMismatchingParams;
 
     let aeadProtectVal;
     let preferredAEADAlgorithmVal;
@@ -839,7 +1262,6 @@ module.exports = () => describe('OpenPGP.js public api tests', function() {
       publicKey_2038_2045 = privateKey_2038_2045.toPublic();
       privateKey_1337 = await openpgp.readKey({ armoredKey: priv_key_expires_1337 });
       publicKey_1337 = privateKey_1337.toPublic();
-      privateKeyMismatchingParams = await openpgp.readKey({ armoredKey: mismatchingKeyParams });
 
       aeadProtectVal = openpgp.config.aeadProtect;
       preferredAEADAlgorithmVal = openpgp.config.preferredAEADAlgorithm;
@@ -892,131 +1314,6 @@ module.exports = () => describe('OpenPGP.js public api tests', function() {
       expect(privateKey.isDecrypted()).to.be.true;
     });
 
-    describe('decryptKey', function() {
-      it('should work for correct passphrase', async function() {
-        const originalKey = await openpgp.readKey({ armoredKey: privateKey.armor() });
-        return openpgp.decryptKey({
-          privateKey: privateKey,
-          passphrase: passphrase
-        }).then(function(unlocked){
-          expect(unlocked.getKeyID().toHex()).to.equal(privateKey.getKeyID().toHex());
-          expect(unlocked.subKeys[0].getKeyID().toHex()).to.equal(privateKey.subKeys[0].getKeyID().toHex());
-          expect(unlocked.isDecrypted()).to.be.true;
-          expect(unlocked.keyPacket.privateParams).to.not.be.null;
-          // original key should be unchanged
-          expect(privateKey.isDecrypted()).to.be.false;
-          expect(privateKey.keyPacket.privateParams).to.be.null;
-          originalKey.subKeys[0].getKeyID(); // fill in keyID
-          expect(privateKey).to.deep.equal(originalKey);
-        });
-      });
-
-      it('should fail for incorrect passphrase', async function() {
-        const originalKey = await openpgp.readKey({ armoredKey: privateKey.armor() });
-        return openpgp.decryptKey({
-          privateKey: privateKey,
-          passphrase: 'incorrect'
-        }).then(function() {
-          throw new Error('Should not decrypt with incorrect passphrase');
-        }).catch(function(error){
-          expect(error.message).to.match(/Incorrect key passphrase/);
-          // original key should be unchanged
-          expect(privateKey.isDecrypted()).to.be.false;
-          expect(privateKey.keyPacket.privateParams).to.be.null;
-          expect(privateKey).to.deep.equal(originalKey);
-        });
-      });
-
-      it('should fail for corrupted key', async function() {
-        const originalKey = await openpgp.readKey({ armoredKey: privateKeyMismatchingParams.armor() });
-        return openpgp.decryptKey({
-          privateKey: privateKeyMismatchingParams,
-          passphrase: 'userpass'
-        }).then(function() {
-          throw new Error('Should not decrypt corrupted key');
-        }).catch(function(error) {
-          expect(error.message).to.match(/Key is invalid/);
-          expect(privateKeyMismatchingParams.isDecrypted()).to.be.false;
-          expect(privateKeyMismatchingParams.keyPacket.privateParams).to.be.null;
-          expect(privateKeyMismatchingParams).to.deep.equal(originalKey);
-        });
-      });
-    });
-
-    describe('encryptKey', function() {
-      it('should not change original key', async function() {
-        const { privateKeyArmored } = await openpgp.generateKey({ userIDs: [{ name: 'test', email: 'test@test.com' }] });
-        // read both keys from armored data to make sure all fields are exactly the same
-        const key = await openpgp.readKey({ armoredKey: privateKeyArmored });
-        const originalKey = await openpgp.readKey({ armoredKey: privateKeyArmored });
-        return openpgp.encryptKey({
-          privateKey: key,
-          passphrase: passphrase
-        }).then(function(locked){
-          expect(locked.getKeyID().toHex()).to.equal(key.getKeyID().toHex());
-          expect(locked.subKeys[0].getKeyID().toHex()).to.equal(key.subKeys[0].getKeyID().toHex());
-          expect(locked.isDecrypted()).to.be.false;
-          expect(locked.keyPacket.privateParams).to.be.null;
-          // original key should be unchanged
-          expect(key.isDecrypted()).to.be.true;
-          expect(key.keyPacket.privateParams).to.not.be.null;
-          originalKey.subKeys[0].getKeyID(); // fill in keyID
-          expect(key).to.deep.equal(originalKey);
-        });
-      });
-
-      it('encrypted key can be decrypted', async function() {
-        const { key } = await openpgp.generateKey({ userIDs: [{ name: 'test', email: 'test@test.com' }] });
-        const locked = await openpgp.encryptKey({
-          privateKey: key,
-          passphrase: passphrase
-        });
-        expect(locked.isDecrypted()).to.be.false;
-        const unlocked = await openpgp.decryptKey({
-          privateKey: locked,
-          passphrase: passphrase
-        });
-        expect(unlocked.isDecrypted()).to.be.true;
-      });
-
-      it('should support multiple passphrases', async function() {
-        const { key } = await openpgp.generateKey({ userIDs: [{ name: 'test', email: 'test@test.com' }] });
-        const passphrases = ['123', '456'];
-        const locked = await openpgp.encryptKey({
-          privateKey: key,
-          passphrase: passphrases
-        });
-        expect(locked.isDecrypted()).to.be.false;
-        await expect(openpgp.decryptKey({
-          privateKey: locked,
-          passphrase: passphrases[0]
-        })).to.eventually.be.rejectedWith(/Incorrect key passphrase/);
-        const unlocked = await openpgp.decryptKey({
-          privateKey: locked,
-          passphrase: passphrases
-        });
-        expect(unlocked.isDecrypted()).to.be.true;
-      });
-
-      it('should encrypt gnu-dummy key', async function() {
-        const key = await openpgp.readKey({ armoredKey: gnuDummyKeySigningSubkey });
-        const locked = await openpgp.encryptKey({
-          privateKey: key,
-          passphrase: passphrase
-        });
-        expect(key.isDecrypted()).to.be.true;
-        expect(locked.isDecrypted()).to.be.false;
-        expect(locked.primaryKey.isDummy()).to.be.true;
-        const unlocked = await openpgp.decryptKey({
-          privateKey: locked,
-          passphrase: passphrase
-        });
-        expect(key.isDecrypted()).to.be.true;
-        expect(unlocked.isDecrypted()).to.be.true;
-        expect(unlocked.primaryKey.isDummy()).to.be.true;
-      });
-    });
-
     it('Calling decrypt with not decrypted key leads to exception', async function() {
       const encOpt = {
         message: await openpgp.createMessage({ text: plaintext }),
@@ -1421,6 +1718,30 @@ module.exports = () => describe('OpenPGP.js public api tests', function() {
           });
         });
 
+        it('should encrypt/sign and decrypt/verify (expectSigned=true)', async function () {
+          const encOpt = {
+            message: await openpgp.createMessage({ text: plaintext }),
+            publicKeys: publicKey,
+            privateKeys: privateKey
+          };
+          const decOpt = {
+            privateKeys: privateKey,
+            publicKeys: publicKey,
+            expectSigned: true
+          };
+          return openpgp.encrypt(encOpt).then(async function (encrypted) {
+            decOpt.message = await openpgp.readMessage({ armoredMessage: encrypted });
+            expect(!!decOpt.message.packets.findPacket(openpgp.enums.packet.aeadEncryptedData)).to.equal(openpgp.config.aeadProtect);
+            return openpgp.decrypt(decOpt);
+          }).then(async function (decrypted) {
+            expect(decrypted.data).to.equal(plaintext);
+            expect(decrypted.signatures[0].valid).to.be.true;
+            const signingKey = await privateKey.getSigningKey();
+            expect(decrypted.signatures[0].keyID.toHex()).to.equal(signingKey.getKeyID().toHex());
+            expect(decrypted.signatures[0].signature.packets.length).to.equal(1);
+          });
+        });
+
         it('should encrypt/sign and decrypt/verify (no AEAD support)', async function () {
           const encOpt = {
             message: await openpgp.createMessage({ text: plaintext }),