From 809deee3a6efbd815c1891f670c5b35256f161a0 Mon Sep 17 00:00:00 2001 From: Daniel Huigens Date: Wed, 15 Feb 2023 18:51:00 +0100 Subject: [PATCH] Add `signatureNotations` option to `sign` and `encrypt` This allows adding Notation Data signature subpackets when signing or encrypting a message. --- src/cleartext.js | 5 +++-- src/key/factory.js | 2 +- src/key/helper.js | 6 ++++-- src/key/private_key.js | 2 +- src/key/subkey.js | 2 +- src/key/user.js | 4 ++-- src/message.js | 15 +++++++++------ src/openpgp.js | 16 +++++++++------- test/general/signature.js | 33 +++++++++++++++++++++++++++++++++ 9 files changed, 63 insertions(+), 22 deletions(-) diff --git a/src/cleartext.js b/src/cleartext.js index e3fe3878..10b65db6 100644 --- a/src/cleartext.js +++ b/src/cleartext.js @@ -64,14 +64,15 @@ export class CleartextMessage { * @param {Array} [signingKeyIDs] - Array of key IDs to use for signing. Each signingKeyIDs[i] corresponds to privateKeys[i] * @param {Date} [date] - The creation time of the signature that should be created * @param {Array} [userIDs] - User IDs to sign with, e.g. [{ name:'Steve Sender', email:'steve@openpgp.org' }] + * @param {Array} [notations] - Notation Data to add to the signatures, e.g. [{ name: 'test@example.org', value: new TextEncoder().encode('test'), humanReadable: true }] * @param {Object} [config] - Full configuration, defaults to openpgp.config * @returns {Promise} New cleartext message with signed content. * @async */ - async sign(privateKeys, signature = null, signingKeyIDs = [], date = new Date(), userIDs = [], config = defaultConfig) { + async sign(privateKeys, signature = null, signingKeyIDs = [], date = new Date(), userIDs = [], notations = [], config = defaultConfig) { const literalDataPacket = new LiteralDataPacket(); literalDataPacket.setText(this.text); - const newSignature = new Signature(await createSignaturePackets(literalDataPacket, privateKeys, signature, signingKeyIDs, date, userIDs, true, config)); + const newSignature = new Signature(await createSignaturePackets(literalDataPacket, privateKeys, signature, signingKeyIDs, date, userIDs, notations, true, config)); return new CleartextMessage(this.text, newSignature); } diff --git a/src/key/factory.js b/src/key/factory.js index b30bbd14..a4705b9d 100644 --- a/src/key/factory.js +++ b/src/key/factory.js @@ -249,7 +249,7 @@ async function wrapKeyObject(secretKeyPacket, secretSubkeyPackets, options, conf signatureType: enums.signature.keyRevocation, reasonForRevocationFlag: enums.reasonForRevocation.noReason, reasonForRevocationString: '' - }, options.date, undefined, undefined, config)); + }, options.date, undefined, undefined, undefined, config)); if (options.passphrase) { secretKeyPacket.clearPrivateParams(); diff --git a/src/key/helper.js b/src/key/helper.js index df618b1b..282dff26 100644 --- a/src/key/helper.js +++ b/src/key/helper.js @@ -96,7 +96,7 @@ export async function createBindingSignature(subkey, primaryKey, options, config subkeySignaturePacket.keyFlags = [enums.keyFlags.signData]; subkeySignaturePacket.embeddedSignature = await createSignaturePacket(dataToSign, null, subkey, { signatureType: enums.signature.keyBinding - }, options.date, undefined, undefined, config); + }, options.date, undefined, undefined, undefined, config); } else { subkeySignaturePacket.keyFlags = [enums.keyFlags.encryptCommunication | enums.keyFlags.encryptStorage]; } @@ -192,11 +192,12 @@ export async function getPreferredAlgo(type, keys = [], date = new Date(), userI * @param {Object} [signatureProperties] - Properties to write on the signature packet before signing * @param {Date} [date] - Override the creationtime of the signature * @param {Object} [userID] - User ID + * @param {Array} [notations] - Notation Data to add to the signature, e.g. [{ name: 'test@example.org', value: new TextEncoder().encode('test'), humanReadable: true }] * @param {Object} [detached] - Whether to create a detached signature packet * @param {Object} config - full configuration * @returns {Promise} Signature packet. */ -export async function createSignaturePacket(dataToSign, privateKey, signingKeyPacket, signatureProperties, date, userID, detached = false, config) { +export async function createSignaturePacket(dataToSign, privateKey, signingKeyPacket, signatureProperties, date, userID, notations = [], detached = false, config) { if (signingKeyPacket.isDummy()) { throw new Error('Cannot sign with a gnu-dummy key.'); } @@ -207,6 +208,7 @@ export async function createSignaturePacket(dataToSign, privateKey, signingKeyPa Object.assign(signaturePacket, signatureProperties); signaturePacket.publicKeyAlgorithm = signingKeyPacket.algorithm; signaturePacket.hashAlgorithm = await getPreferredHashAlgo(privateKey, signingKeyPacket, date, userID, config); + signaturePacket.rawNotations = notations; await signaturePacket.sign(signingKeyPacket, dataToSign, date, detached); return signaturePacket; } diff --git a/src/key/private_key.js b/src/key/private_key.js index b0b22ac1..384a94ec 100644 --- a/src/key/private_key.js +++ b/src/key/private_key.js @@ -191,7 +191,7 @@ class PrivateKey extends PublicKey { signatureType: enums.signature.keyRevocation, reasonForRevocationFlag: enums.write(enums.reasonForRevocation, reasonForRevocationFlag), reasonForRevocationString - }, date, undefined, undefined, config)); + }, date, undefined, undefined, undefined, config)); return key; } diff --git a/src/key/subkey.js b/src/key/subkey.js index 8ddf2e9b..57e34a0b 100644 --- a/src/key/subkey.js +++ b/src/key/subkey.js @@ -190,7 +190,7 @@ class Subkey { signatureType: enums.signature.subkeyRevocation, reasonForRevocationFlag: enums.write(enums.reasonForRevocation, reasonForRevocationFlag), reasonForRevocationString - }, date, undefined, false, config)); + }, date, undefined, undefined, false, config)); await subkey.update(this); return subkey; } diff --git a/src/key/user.js b/src/key/user.js index 738f31cb..c1e22eb0 100644 --- a/src/key/user.js +++ b/src/key/user.js @@ -77,7 +77,7 @@ class User { // Most OpenPGP implementations use generic certification (0x10) signatureType: enums.signature.certGeneric, keyFlags: [enums.keyFlags.certifyKeys | enums.keyFlags.signData] - }, date, undefined, undefined, config); + }, date, undefined, undefined, undefined, config); })); await user.update(this, date, config); return user; @@ -265,7 +265,7 @@ class User { signatureType: enums.signature.certRevocation, reasonForRevocationFlag: enums.write(enums.reasonForRevocation, reasonForRevocationFlag), reasonForRevocationString - }, date, undefined, false, config)); + }, date, undefined, undefined, false, config)); await user.update(this); return user; } diff --git a/src/message.js b/src/message.js index 6ce002b4..4a65d5aa 100644 --- a/src/message.js +++ b/src/message.js @@ -476,11 +476,12 @@ export class Message { * @param {Array} [signingKeyIDs] - Array of key IDs to use for signing. Each signingKeyIDs[i] corresponds to signingKeys[i] * @param {Date} [date] - Override the creation time of the signature * @param {Array} [userIDs] - User IDs to sign with, e.g. [{ name:'Steve Sender', email:'steve@openpgp.org' }] + * @param {Array} [notations] - Notation Data to add to the signatures, e.g. [{ name: 'test@example.org', value: new TextEncoder().encode('test'), humanReadable: true }] * @param {Object} [config] - Full configuration, defaults to openpgp.config * @returns {Promise} New message with signed content. * @async */ - async sign(signingKeys = [], signature = null, signingKeyIDs = [], date = new Date(), userIDs = [], config = defaultConfig) { + async sign(signingKeys = [], signature = null, signingKeyIDs = [], date = new Date(), userIDs = [], notations = [], config = defaultConfig) { const packetlist = new PacketList(); const literalDataPacket = this.packets.findPacket(enums.packet.literalData); @@ -530,7 +531,7 @@ export class Message { }); packetlist.push(literalDataPacket); - packetlist.push(...(await createSignaturePackets(literalDataPacket, signingKeys, signature, signingKeyIDs, date, userIDs, false, config))); + packetlist.push(...(await createSignaturePackets(literalDataPacket, signingKeys, signature, signingKeyIDs, date, userIDs, notations, false, config))); return new Message(packetlist); } @@ -563,16 +564,17 @@ export class Message { * @param {Array} [signingKeyIDs] - Array of key IDs to use for signing. Each signingKeyIDs[i] corresponds to signingKeys[i] * @param {Date} [date] - Override the creation time of the signature * @param {Array} [userIDs] - User IDs to sign with, e.g. [{ name:'Steve Sender', email:'steve@openpgp.org' }] + * @param {Array} [notations] - Notation Data to add to the signatures, e.g. [{ name: 'test@example.org', value: new TextEncoder().encode('test'), humanReadable: true }] * @param {Object} [config] - Full configuration, defaults to openpgp.config * @returns {Promise} New detached signature of message content. * @async */ - async signDetached(signingKeys = [], signature = null, signingKeyIDs = [], date = new Date(), userIDs = [], config = defaultConfig) { + async signDetached(signingKeys = [], signature = null, signingKeyIDs = [], date = new Date(), userIDs = [], notations = [], config = defaultConfig) { const literalDataPacket = this.packets.findPacket(enums.packet.literalData); if (!literalDataPacket) { throw new Error('No literal data packet to sign.'); } - return new Signature(await createSignaturePackets(literalDataPacket, signingKeys, signature, signingKeyIDs, date, userIDs, true, config)); + return new Signature(await createSignaturePackets(literalDataPacket, signingKeys, signature, signingKeyIDs, date, userIDs, notations, true, config)); } /** @@ -705,13 +707,14 @@ export class Message { * @param {Array} [signingKeyIDs] - Array of key IDs to use for signing. Each signingKeyIDs[i] corresponds to signingKeys[i] * @param {Date} [date] - Override the creationtime of the signature * @param {Array} [userIDs] - User IDs to sign with, e.g. [{ name:'Steve Sender', email:'steve@openpgp.org' }] + * @param {Array} [notations] - Notation Data to add to the signatures, e.g. [{ name: 'test@example.org', value: new TextEncoder().encode('test'), humanReadable: true }] * @param {Boolean} [detached] - Whether to create detached signature packets * @param {Object} [config] - Full configuration, defaults to openpgp.config * @returns {Promise} List of signature packets. * @async * @private */ -export async function createSignaturePackets(literalDataPacket, signingKeys, signature = null, signingKeyIDs = [], date = new Date(), userIDs = [], detached = false, config = defaultConfig) { +export async function createSignaturePackets(literalDataPacket, signingKeys, signature = null, signingKeyIDs = [], date = new Date(), userIDs = [], notations = [], detached = false, config = defaultConfig) { const packetlist = new PacketList(); // If data packet was created from Uint8Array, use binary, otherwise use text @@ -724,7 +727,7 @@ export async function createSignaturePackets(literalDataPacket, signingKeys, sig throw new Error('Need private key for signing'); } const signingKey = await primaryKey.getSigningKey(signingKeyIDs[i], date, userID, config); - return createSignaturePacket(literalDataPacket, primaryKey, signingKey.keyPacket, { signatureType }, date, userID, detached, config); + return createSignaturePacket(literalDataPacket, primaryKey, signingKey.keyPacket, { signatureType }, date, userID, notations, detached, config); })).then(signatureList => { packetlist.push(...signatureList); }); diff --git a/src/openpgp.js b/src/openpgp.js index 6e8d0b91..ba20164d 100644 --- a/src/openpgp.js +++ b/src/openpgp.js @@ -256,16 +256,17 @@ export async function encryptKey({ privateKey, passphrase, config, ...rest }) { * @param {Date} [options.date=current date] - Override the creation date of the message signature * @param {Object|Object[]} [options.signingUserIDs=primary user IDs] - Array of user IDs to sign with, one per key in `signingKeys`, e.g. `[{ name: 'Steve Sender', email: 'steve@openpgp.org' }]` * @param {Object|Object[]} [options.encryptionUserIDs=primary user IDs] - Array of user IDs to encrypt for, one per key in `encryptionKeys`, e.g. `[{ name: 'Robert Receiver', email: 'robert@openpgp.org' }]` + * @param {Object|Object[]} [options.signatureNotations=[]] - Array of notations to add to the signatures, e.g. `[{ name: 'test@example.org', value: new TextEncoder().encode('test'), humanReadable: true }]` * @param {Object} [options.config] - Custom configuration settings to overwrite those in [config]{@link module:config} * @returns {Promise|MaybeStream>} Encrypted message (string if `armor` was true, the default; Uint8Array if `armor` was false). * @async * @static */ -export async function encrypt({ message, encryptionKeys, signingKeys, passwords, sessionKey, format = 'armored', signature = null, wildcard = false, signingKeyIDs = [], encryptionKeyIDs = [], date = new Date(), signingUserIDs = [], encryptionUserIDs = [], config, ...rest }) { +export async function encrypt({ message, encryptionKeys, signingKeys, passwords, sessionKey, format = 'armored', signature = null, wildcard = false, signingKeyIDs = [], encryptionKeyIDs = [], date = new Date(), signingUserIDs = [], encryptionUserIDs = [], signatureNotations = [], config, ...rest }) { config = { ...defaultConfig, ...config }; checkConfig(config); checkMessage(message); checkOutputMessageFormat(format); encryptionKeys = toArray(encryptionKeys); signingKeys = toArray(signingKeys); passwords = toArray(passwords); - signingKeyIDs = toArray(signingKeyIDs); encryptionKeyIDs = toArray(encryptionKeyIDs); signingUserIDs = toArray(signingUserIDs); encryptionUserIDs = toArray(encryptionUserIDs); + signingKeyIDs = toArray(signingKeyIDs); encryptionKeyIDs = toArray(encryptionKeyIDs); signingUserIDs = toArray(signingUserIDs); encryptionUserIDs = toArray(encryptionUserIDs); signatureNotations = toArray(signatureNotations); if (rest.detached) { throw new Error("The `detached` option has been removed from openpgp.encrypt, separately call openpgp.sign instead. Don't forget to remove the `privateKeys` option as well."); } @@ -280,7 +281,7 @@ export async function encrypt({ message, encryptionKeys, signingKeys, passwords, const streaming = message.fromStream; try { if (signingKeys.length || signature) { // sign the message only if signing keys or signature is specified - message = await message.sign(signingKeys, signature, signingKeyIDs, date, signingUserIDs, config); + message = await message.sign(signingKeys, signature, signingKeyIDs, date, signingUserIDs, signatureNotations, config); } message = message.compress( await getPreferredAlgo('compression', encryptionKeys, date, encryptionUserIDs, config), @@ -387,15 +388,16 @@ export async function decrypt({ message, decryptionKeys, passwords, sessionKeys, * @param {KeyID|KeyID[]} [options.signingKeyIDs=latest-created valid signing (sub)keys] - Array of key IDs to use for signing. Each signingKeyIDs[i] corresponds to signingKeys[i] * @param {Date} [options.date=current date] - Override the creation date of the signature * @param {Object|Object[]} [options.signingUserIDs=primary user IDs] - Array of user IDs to sign with, one per key in `signingKeys`, e.g. `[{ name: 'Steve Sender', email: 'steve@openpgp.org' }]` + * @param {Object|Object[]} [options.signatureNotations=[]] - Array of notations to add to the signatures, e.g. `[{ name: 'test@example.org', value: new TextEncoder().encode('test'), humanReadable: true }]` * @param {Object} [options.config] - Custom configuration settings to overwrite those in [config]{@link module:config} * @returns {Promise>} Signed message (string if `armor` was true, the default; Uint8Array if `armor` was false). * @async * @static */ -export async function sign({ message, signingKeys, format = 'armored', detached = false, signingKeyIDs = [], date = new Date(), signingUserIDs = [], config, ...rest }) { +export async function sign({ message, signingKeys, format = 'armored', detached = false, signingKeyIDs = [], date = new Date(), signingUserIDs = [], signatureNotations = [], config, ...rest }) { config = { ...defaultConfig, ...config }; checkConfig(config); checkCleartextOrMessage(message); checkOutputMessageFormat(format); - signingKeys = toArray(signingKeys); signingKeyIDs = toArray(signingKeyIDs); signingUserIDs = toArray(signingUserIDs); + signingKeys = toArray(signingKeys); signingKeyIDs = toArray(signingKeyIDs); signingUserIDs = toArray(signingUserIDs); signatureNotations = toArray(signatureNotations); if (rest.privateKeys) throw new Error('The `privateKeys` option has been removed from openpgp.sign, pass `signingKeys` instead'); if (rest.armor !== undefined) throw new Error('The `armor` option has been removed from openpgp.sign, pass `format` instead.'); @@ -411,9 +413,9 @@ export async function sign({ message, signingKeys, format = 'armored', detached try { let signature; if (detached) { - signature = await message.signDetached(signingKeys, undefined, signingKeyIDs, date, signingUserIDs, config); + signature = await message.signDetached(signingKeys, undefined, signingKeyIDs, date, signingUserIDs, signatureNotations, config); } else { - signature = await message.sign(signingKeys, undefined, signingKeyIDs, date, signingUserIDs, config); + signature = await message.sign(signingKeys, undefined, signingKeyIDs, date, signingUserIDs, signatureNotations, config); } if (format === 'object') return signature; diff --git a/test/general/signature.js b/test/general/signature.js index 9a03fce0..6cdf58cb 100644 --- a/test/general/signature.js +++ b/test/general/signature.js @@ -1138,6 +1138,39 @@ eSvSZutLuKKbidSYMLhWROPlwKc2GU2ws6PrLZAyCAel/lU= expect(await sig.verified).to.be.true; }); + it('Can create notations', async function() { + const privKey = await openpgp.decryptKey({ + privateKey: await openpgp.readKey({ armoredKey: priv_key_arm2 }), + passphrase: 'hello world' + }); + + const config = { minRSABits: 1024 }; + const message_with_notation = await openpgp.encrypt({ + message: await openpgp.createMessage({ text: 'test' }), + encryptionKeys: privKey, + signingKeys: privKey, + signatureNotations: [ + { + name: 'test@example.com', + value: new TextEncoder().encode('test'), + humanReadable: true + } + ], + config + }); + const { signatures: [sig] } = await openpgp.decrypt({ + message: await openpgp.readMessage({ armoredMessage: message_with_notation }), + decryptionKeys: privKey, + verificationKeys: privKey + }); + const { packets: [{ rawNotations: notations }] } = await sig.signature; + expect(notations).to.have.length(1); + expect(notations[0].name).to.equal('test@example.com'); + expect(notations[0].value).to.deep.equal(new Uint8Array([116, 101, 115, 116])); + expect(notations[0].humanReadable).to.be.true; + expect(notations[0].critical).to.be.false; + }); + it('Verify cleartext signed message with two signatures with openpgp.verify', async function() { const cleartextMessage = ['-----BEGIN PGP SIGNED MESSAGE-----',