search

toofishes / python-pgpdump

PGP packet parser library
Other
56 stars 26 forks source link

V4 Secret key id and fingerprint not calculated correctly #23

Open arwyersfs opened 5 years ago

arwyersfs commented 5 years ago

Don't think this is actively maintained, but figured I could spare someone some pain if they need to use this in the future. The fingerprint(and subsequently key_id) for version 4 key packets is calculated incorrectly. According to the RFC 4880 only the public key packets are supposed to be used in SHA1 to get the fingerprint, but the code uses the entire packet content(including the secret key material).

arwyersfs commented 5 years ago

Adding this segment of code after line 481 should do the trick public_len = offset if self.pubkey_version == 4: sha1 = hashlib.sha1() seed_bytes = (0x99, (public_len >> 8) & 0xff, public_len & 0xff) sha1.update(pack_data(bytearray(seed_bytes))) sha1.update(pack_data(self.data[:public_len])) self.fingerprint = sha1.hexdigest().upper().encode('ascii') self.key_id = self.fingerprint[24:]