Mirroristas/openpgpjs
2
0
Fork 0
mirror of https://github.com/openpgpjs/openpgpjs.git synced 2026-03-13 11:55:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add config option to allow insecure decryption with RSA signing keys (#1148)

Browse Source
This commit is contained in:
larabr
2020-08-28 16:09:56 +02:00
committed by GitHub
parent cc1bdcbae8
commit 2eab8a1ebc
3 changed files with 83 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/config/config.js
View File

@@ -120,6 +120,14 @@ export default {
* @property {Boolean} revocations_expire If true, expired revocation signatures are ignored
*/
revocations_expire: false,
/**
* Allow decryption using RSA keys without `encrypt` flag.
* This setting is potentially insecure, but it is needed to get around an old openpgpjs bug
* where key flags were ignored when selecting a key for encryption.
* @memberof module:config
* @property {Boolean} allow_insecure_decryption_with_signing_keys
*/
allow_insecure_decryption_with_signing_keys: false,
/**
* @memberof module:config

6
src/key/helper.js
View File

@@ -366,6 +366,12 @@ export function isValidDecryptionKeyPacket(signature) {
if (!signature.verified) { // Sanity check
throw new Error('Signature not verified');
}
if (config.allow_insecure_decryption_with_signing_keys) {
// This is only relevant for RSA keys, all other signing ciphers cannot decrypt
return true;
}
return !signature.keyFlags ||
(signature.keyFlags[0] & enums.keyFlags.encrypt_communication) !== 0 ||
(signature.keyFlags[0] & enums.keyFlags.encrypt_storage) !== 0;