You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
104 lines
4.3 KiB
Python
104 lines
4.3 KiB
Python
"""Create GPG ECDSA signatures and public keys using TREZOR device."""
|
|
import io
|
|
import logging
|
|
|
|
from . import decode, keyring, protocol
|
|
from .. import util
|
|
|
|
log = logging.getLogger(__name__)
|
|
|
|
|
|
def create_primary(user_id, pubkey, signer_func, secret_bytes=b''):
|
|
"""Export new primary GPG public key, ready for "gpg2 --import"."""
|
|
pubkey_packet = protocol.packet(tag=(5 if secret_bytes else 6),
|
|
blob=(pubkey.data() + secret_bytes))
|
|
user_id_bytes = user_id.encode('utf-8')
|
|
user_id_packet = protocol.packet(tag=13, blob=user_id_bytes)
|
|
data_to_sign = (pubkey.data_to_hash() + user_id_packet[:1] +
|
|
util.prefix_len('>L', user_id_bytes))
|
|
hashed_subpackets = [
|
|
protocol.subpacket_time(pubkey.created), # signature time
|
|
# https://tools.ietf.org/html/rfc4880#section-5.2.3.7
|
|
protocol.subpacket_byte(0x0B, 9), # preferred symmetric algo (AES-256)
|
|
# https://tools.ietf.org/html/rfc4880#section-5.2.3.4
|
|
protocol.subpacket_byte(0x1B, 1 | 2), # key flags (certify & sign)
|
|
# https://tools.ietf.org/html/rfc4880#section-5.2.3.21
|
|
protocol.subpacket_bytes(0x15, [8, 9, 10]), # preferred hash
|
|
# https://tools.ietf.org/html/rfc4880#section-5.2.3.8
|
|
protocol.subpacket_bytes(0x16, [2, 3, 1]), # preferred compression
|
|
# https://tools.ietf.org/html/rfc4880#section-5.2.3.9
|
|
protocol.subpacket_byte(0x17, 0x80), # key server prefs (no-modify)
|
|
# https://tools.ietf.org/html/rfc4880#section-5.2.3.17
|
|
protocol.subpacket_byte(0x1E, 0x01), # advanced features (MDC)
|
|
# https://tools.ietf.org/html/rfc4880#section-5.2.3.24
|
|
]
|
|
unhashed_subpackets = [
|
|
protocol.subpacket(16, pubkey.key_id()), # issuer key id
|
|
protocol.CUSTOM_SUBPACKET]
|
|
|
|
signature = protocol.make_signature(
|
|
signer_func=signer_func,
|
|
public_algo=pubkey.algo_id,
|
|
data_to_sign=data_to_sign,
|
|
sig_type=0x13, # user id & public key
|
|
hashed_subpackets=hashed_subpackets,
|
|
unhashed_subpackets=unhashed_subpackets)
|
|
|
|
sign_packet = protocol.packet(tag=2, blob=signature)
|
|
return pubkey_packet + user_id_packet + sign_packet
|
|
|
|
|
|
def create_subkey(primary_bytes, subkey, signer_func, secret_bytes=b''):
|
|
"""Export new subkey to GPG primary key."""
|
|
subkey_packet = protocol.packet(tag=(7 if secret_bytes else 14),
|
|
blob=(subkey.data() + secret_bytes))
|
|
packets = list(decode.parse_packets(io.BytesIO(primary_bytes)))
|
|
primary, user_id, signature = packets[:3]
|
|
|
|
data_to_sign = primary['_to_hash'] + subkey.data_to_hash()
|
|
|
|
if subkey.ecdh:
|
|
embedded_sig = None
|
|
else:
|
|
# Primary Key Binding Signature
|
|
hashed_subpackets = [
|
|
protocol.subpacket_time(subkey.created)] # signature time
|
|
unhashed_subpackets = [
|
|
protocol.subpacket(16, subkey.key_id())] # issuer key id
|
|
embedded_sig = protocol.make_signature(
|
|
signer_func=signer_func,
|
|
data_to_sign=data_to_sign,
|
|
public_algo=subkey.algo_id,
|
|
sig_type=0x19,
|
|
hashed_subpackets=hashed_subpackets,
|
|
unhashed_subpackets=unhashed_subpackets)
|
|
|
|
# Subkey Binding Signature
|
|
|
|
# Key flags: https://tools.ietf.org/html/rfc4880#section-5.2.3.21
|
|
# (certify & sign) (encrypt)
|
|
flags = (2) if (not subkey.ecdh) else (4 | 8)
|
|
|
|
hashed_subpackets = [
|
|
protocol.subpacket_time(subkey.created), # signature time
|
|
protocol.subpacket_byte(0x1B, flags)]
|
|
|
|
unhashed_subpackets = []
|
|
unhashed_subpackets.append(protocol.subpacket(16, primary['key_id']))
|
|
if embedded_sig is not None:
|
|
unhashed_subpackets.append(protocol.subpacket(32, embedded_sig))
|
|
unhashed_subpackets.append(protocol.CUSTOM_SUBPACKET)
|
|
|
|
if not decode.has_custom_subpacket(signature):
|
|
signer_func = keyring.create_agent_signer(user_id['value'])
|
|
|
|
signature = protocol.make_signature(
|
|
signer_func=signer_func,
|
|
data_to_sign=data_to_sign,
|
|
public_algo=primary['algo'],
|
|
sig_type=0x18,
|
|
hashed_subpackets=hashed_subpackets,
|
|
unhashed_subpackets=unhashed_subpackets)
|
|
sign_packet = protocol.packet(tag=2, blob=signature)
|
|
return primary_bytes + subkey_packet + sign_packet
|