Skip to content

Improvements#235

Open
krzyzanowskim wants to merge 24 commits intokrzyzanowskim:mainfrom
Smallcubed:main
Open

Improvements#235
krzyzanowskim wants to merge 24 commits intokrzyzanowskim:mainfrom
Smallcubed:main

Conversation

@krzyzanowskim
Copy link
Owner

@krzyzanowskim krzyzanowskim commented Apr 14, 2025

  1. added methods to PGPKey to add and remove a userID (NSString*).

Adding the userID builds the UserID packet and PGPUser object and signs it with the keys.privateKey, and adds the signature packet to the selfcertifications to the PGPUser. It does for both the public and private keys. Much of the code was borrowed from the process of generating a new key with a new user.

  1. Adds a public PGPVerification Class -- this allows the verification to be more than a code and error (passed as two separate by ref parameters) or a returned boolean.
    One of the things I want'ed to do is display information about who actually signed the content (see screenshot) but this was not readily available.

So I had devise something that would pull out the signing PGPKeyID of the encryption and signature packets.

This took a little bit of retooling of some of the decryption/verification methods inside ObjectivePGPObject
I did not modified any public methods declarations but there implementations may have been modifered to relay the int * verified param and NSError **verification error params to read from a verification object once decrypted.

internal methods were modified to use the PGPVerification object by ref.

On thing to note in detail is the loop towards the end of the method +verifyPackets:usingKeys:certifyWithRootKey:passphraseForKey:].

i retooled it to have early returns with verificationResult rather than repeated checks for isValid. I think I preserved the logic and intent of the loop but it was more than a nominal change.

Also in +recipientsKeyIDForMessage::error: I added a case for signature packets from the PGP MESSAGE object to beable to pass back the keyID used to sign an encryption.

3). separates out in the key arguments when decrypting to be able to pass different keys for decryption and for verification. I ran into a situation (though I cannot remember the details at the moment) where this was necessary My commit in maven that correlates reads "PGP issue where internal pgp error presented message is encrypted to secret key but keychain only has public key." something about receiving a message encrypted to user X (not me) and I have only the public key for X but an unexpect error message was happening. This change allows maven to better report that the key to decyrpt is missing. when I have the chance I will review the reason.

4). Replaced the guts method +[PGPArmor convertArmoredMessage2BinaryBlocksWhenNecessary:error:] to call a new method +convertArmoredData2BinaryBlocksWhenNecessary:error:

the reason is that the original method was doing a lot of string manipulation on the armored data and it was excessively slow on larger email messages.
the new method processes the armoured method at the data level and removes much of the string manipulation. (Eg, it seemed that the older implementation was processing the lines of the method to convert line feeds in the radix encoded message to expeced \n. wherease the decoding of the base64 will ignore linefeeds in general(so this conversion is not necessary).

Scott Morrison added 21 commits July 28, 2023 11:53
Used for communicating signature verification results
…en decrypting data. The verification object contains added information about the verification of the encrypted/signed data, including the PGPKeyID that was used to sign the encryption or its contents (if encrypted mime structure contains a detached signature.
The -PGPSignaturePacket verifyData:publicKey:... method was validating the data to be hashed, rather than the hashed data. The PGPDSA verify:... method was failing when checking missing MPI values. specifically failing when the MPI R and S values were set rather that not set. This fix also adds a verify:....error: method to allow the pass back of issues with DSA verification, and adds a PGPErrorSignatureVerificationFailure value to the PGPErrorCode enumeration
Distinguishes ad invalid signature from one where the key to validate is not found. also adds NSError user info key: PGPMissingPublicKeyIdUserInfoKey for passing back the Missing Public KeyID
Adds methods -decrypt:(NSData *)data andVerifySignature:(BOOL)verify usingKeys:(nullable NSArray<PGPKey *> *)verificationKeys passphraseForKey:(nullable NSString * _Nullable(^ NS_NOESCAPE)(PGPKey * _Nullable key))passphraseBlock error:(NSError * __autoreleasing _Nullable *)error;
uses PGPDataScanner for faster reading of armoredData +convertArmoredMessage2BinaryBlocksWhenNecessary:error now calls +convertArmoredData2BinaryBlocksWhenNecessary:error
@krzyzanowskim krzyzanowskim marked this pull request as ready for review January 7, 2026 21:53
Scott Morrison added 3 commits March 20, 2026 17:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant