openpgpjs

mirror of https://github.com/openpgpjs/openpgpjs.git synced 2026-03-06 09:01:29 +00:00

Files

Daniel Huigens 857b794e13 Disallow using forbidden S2K modes (#1777 )

RFC9580 says that:

    Argon2 is only used with AEAD (S2K usage octet 253).  An
    implementation MUST NOT create and MUST reject as malformed any
    secret key packet where the S2K usage octet is not AEAD (253) and
    the S2K specifier type is Argon2.

Therefore, we disallow reading and writing Argon2 keys without AEAD.

And:

    [The Simple and Salted S2K methods] are used only for reading in
    backwards compatibility mode.
    
Since v6 keys don't need backwards compatibility, we also disallow
reading Simple S2K there. We still allow reading Salted S2K since the
spec says it may be used "when [the password] is high entropy".

2024-07-05 13:52:45 +02:00

benchmarks

Drop support for native Node Readable stream: require passing Node Web Streams (#1716 )

2024-01-26 17:52:29 +01:00

crypto

Detect invalid ECDSA, EdDSA and ECDH public key point encodings on usage

2024-06-18 17:09:23 +02:00

general

Disallow using forbidden S2K modes (#1777 )

2024-07-05 13:52:45 +02:00

security

Randomise v4 and v5 signatures via custom notation, add config.nonDeterministicSignaturesViaNotation to disable feature (#1737 )