Skip to content

OpenPGP: Mister-Zuccherato fix breaks 2-step symmetric message decryption via session key #2459

Description

@vanitasvitae

In PGPainless I've implemented message decryption as a two-step process by first decrypting the session key and second using that session key to decrypt the actual message.
That way, as a library implementation, I can emit the session-key to the user upon successful decryption.

In 688a1a2 however, the PGPEncryptedData class was changed to only perform the session key quick check if decryption is done via PGPSymmetricKeyEncryptedData.
Since in my use-case, I transform the PGPSymmetricKeyEncryptedData into a PGPSessionKeyEncryptedData in step 1, the session key quick check is skipped, resulting in loads of nasty packet parsing failures down the line, which I have no clear idea for how to handle them gracefully.

What would be the best way to restore the previous behavior?

Edit: Ideally, PGPEncryptedDataList.extractSessionKeyEncryptedData() would allow the user to pass in a boolean value indicating whether they would like to retain the quick check.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions