search

aead / minisign

A dead simple tool to sign files and verify digital signatures.
https://jedisct1.github.io/minisign/
MIT License
115 stars 15 forks source link

C-minikey passwordless keys (-W) are not usable #24

Closed xxxserxxx closed 3 months ago

xxxserxxx commented 1 year ago

The C implementation of minisign can create, and use, passwordless keys. For compatability, this project should also be able to read and use passwordless keys. In particular, to use all minisign keys, it should support the -W option:

5027» minisign -v
minisign 0.11
5028» minisign -h | grep -- -W
minisign -G [-f] [-p pubkey_file] [-s seckey_file] [-W]
minisign -C [-s seckey_file] [-W]
-W                do not encrypt/decrypt the secret key with a password

eg:

5029» minisign -v
5030» minisign -S -m LICENSE -s ~/.minisign/minisign.key
5031» file LICENSE.minisig
LICENSE.minisig: ASCII text

Go-minisign's key reading algorithm can not understand passwordless keys:

5033» go run ./cmd/minisign -v
minisign v0.0.0-dev on linux-amd64
5034» go run ./cmd/minisign -S -m LICENSE -s ~/.minisign/minisign.key
Enter password:
Deriving a key from the password in order to decrypt the secret key...
Error: invalid password: minisign: decryption failed
exit status 1
aead commented 3 months ago

This is now supported with v0.3.0