Open
Conversation
added 21 commits July 28, 2023 11:53
Used for communicating signature verification results
…en decrypting data. The verification object contains added information about the verification of the encrypted/signed data, including the PGPKeyID that was used to sign the encryption or its contents (if encrypted mime structure contains a detached signature.
The -PGPSignaturePacket verifyData:publicKey:... method was validating the data to be hashed, rather than the hashed data. The PGPDSA verify:... method was failing when checking missing MPI values. specifically failing when the MPI R and S values were set rather that not set. This fix also adds a verify:....error: method to allow the pass back of issues with DSA verification, and adds a PGPErrorSignatureVerificationFailure value to the PGPErrorCode enumeration
Distinguishes ad invalid signature from one where the key to validate is not found. also adds NSError user info key: PGPMissingPublicKeyIdUserInfoKey for passing back the Missing Public KeyID
Adds methods -decrypt:(NSData *)data andVerifySignature:(BOOL)verify usingKeys:(nullable NSArray<PGPKey *> *)verificationKeys passphraseForKey:(nullable NSString * _Nullable(^ NS_NOESCAPE)(PGPKey * _Nullable key))passphraseBlock error:(NSError * __autoreleasing _Nullable *)error;
…ored NSData object
uses PGPDataScanner for faster reading of armoredData +convertArmoredMessage2BinaryBlocksWhenNecessary:error now calls +convertArmoredData2BinaryBlocksWhenNecessary:error
added 3 commits March 20, 2026 17:12
(cherry picked from commit 2aab030a18690acf687f3d674267113b4aee4619)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adding the userID builds the UserID packet and PGPUser object and signs it with the keys.privateKey, and adds the signature packet to the selfcertifications to the PGPUser. It does for both the public and private keys. Much of the code was borrowed from the process of generating a new key with a new user.
One of the things I want'ed to do is display information about who actually signed the content (see screenshot) but this was not readily available.
So I had devise something that would pull out the signing PGPKeyID of the encryption and signature packets.
This took a little bit of retooling of some of the decryption/verification methods inside ObjectivePGPObject
I did not modified any public methods declarations but there implementations may have been modifered to relay the int * verified param and NSError **verification error params to read from a verification object once decrypted.
internal methods were modified to use the PGPVerification object by ref.
On thing to note in detail is the loop towards the end of the method +verifyPackets:usingKeys:certifyWithRootKey:passphraseForKey:].
i retooled it to have early returns with verificationResult rather than repeated checks for isValid. I think I preserved the logic and intent of the loop but it was more than a nominal change.
Also in +recipientsKeyIDForMessage::error: I added a case for signature packets from the PGP MESSAGE object to beable to pass back the keyID used to sign an encryption.
3). separates out in the key arguments when decrypting to be able to pass different keys for decryption and for verification. I ran into a situation (though I cannot remember the details at the moment) where this was necessary My commit in maven that correlates reads "PGP issue where internal pgp error presented message is encrypted to secret key but keychain only has public key." something about receiving a message encrypted to user X (not me) and I have only the public key for X but an unexpect error message was happening. This change allows maven to better report that the key to decyrpt is missing. when I have the chance I will review the reason.
4). Replaced the guts method
+[PGPArmor convertArmoredMessage2BinaryBlocksWhenNecessary:error:]to call a new method+convertArmoredData2BinaryBlocksWhenNecessary:error:the reason is that the original method was doing a lot of string manipulation on the armored data and it was excessively slow on larger email messages.
the new method processes the armoured method at the data level and removes much of the string manipulation. (Eg, it seemed that the older implementation was processing the lines of the method to convert line feeds in the radix encoded message to expeced \n. wherease the decoding of the base64 will ignore linefeeds in general(so this conversion is not necessary).