Example usage for org.bouncycastle.openpgp PGPSignatureSubpacketGenerator setEmbeddedSignature

Introduction

In this page you can find the example usage for org.bouncycastle.openpgp PGPSignatureSubpacketGenerator setEmbeddedSignature.

Prototype

public void setEmbeddedSignature(boolean isCritical, PGPSignature pgpSignature) throws IOException 

Source Link

Usage

From source file:org.sufficientlysecure.keychain.pgp.PgpKeyOperation.java

License:Open Source License

static PGPSignature generateSubkeyBindingSignature(PGPSignatureGenerator sGen, Date creationTime,
        PGPPublicKey masterPublicKey, PGPPrivateKey masterPrivateKey, PGPSignatureGenerator subSigGen,
        PGPPrivateKey subPrivateKey, PGPPublicKey pKey, int flags, long expiry)
        throws IOException, PGPException, SignatureException {

    PGPSignatureSubpacketGenerator unhashedPacketsGen = new PGPSignatureSubpacketGenerator();

    // If this key can sign, we need a primary key binding signature
    if ((flags & KeyFlags.SIGN_DATA) > 0) {
        // cross-certify signing keys
        PGPSignatureSubpacketGenerator subHashedPacketsGen = new PGPSignatureSubpacketGenerator();
        subHashedPacketsGen.setSignatureCreationTime(false, creationTime);
        subSigGen.init(PGPSignature.PRIMARYKEY_BINDING, subPrivateKey);
        subSigGen.setHashedSubpackets(subHashedPacketsGen.generate());
        PGPSignature certification = subSigGen.generateCertification(masterPublicKey, pKey);
        unhashedPacketsGen.setEmbeddedSignature(true, certification);
    }/*from w w w .jav  a  2  s .  c  o  m*/

    PGPSignatureSubpacketGenerator hashedPacketsGen;
    {
        hashedPacketsGen = new PGPSignatureSubpacketGenerator();
        hashedPacketsGen.setSignatureCreationTime(true, creationTime);
        hashedPacketsGen.setKeyFlags(true, flags);
        if (expiry > 0) {
            hashedPacketsGen.setKeyExpirationTime(true, expiry - pKey.getCreationTime().getTime() / 1000);
        }
    }

    sGen.init(PGPSignature.SUBKEY_BINDING, masterPrivateKey);
    sGen.setHashedSubpackets(hashedPacketsGen.generate());
    sGen.setUnhashedSubpackets(unhashedPacketsGen.generate());

    return sGen.generateCertification(masterPublicKey, pKey);

}

---

From source file:org.sufficientlysecure.keychain.pgp.UncachedKeyringCanonicalizeTest.java

License:Open Source License

@Test
public void testSubkeyBindingNoPKB() throws Exception {

    UncachedPublicKey pKey = KeyringTestingHelper.getNth(ring.getPublicKeys(), 1);
    PGPSignature sig;/*from   ww  w . ja v a 2 s .  c  om*/

    subHashedPacketsGen.setKeyFlags(false, KeyFlags.SIGN_DATA);

    {
        // forge a (newer) signature, which has the sign flag but no primary key binding sig
        PGPSignatureSubpacketGenerator unhashedSubs = new PGPSignatureSubpacketGenerator();

        // just add any random signature, because why not
        unhashedSubs.setEmbeddedSignature(false, forgeSignature(secretKey, PGPSignature.POSITIVE_CERTIFICATION,
                subHashedPacketsGen, secretKey.getPublicKey()));

        sig = forgeSignature(secretKey, PGPSignature.SUBKEY_BINDING, subHashedPacketsGen, unhashedSubs,
                secretKey.getPublicKey(), pKey.getPublicKey());

        // inject in the right position
        UncachedKeyRing modified = KeyringTestingHelper.injectPacket(ring, sig.getEncoded(), 8);

        // canonicalize, and check if we lose the bad signature
        CanonicalizedKeyRing canonicalized = modified.canonicalize(log, 0);
        Assert.assertFalse("subkey binding signature should be gone after canonicalization",
                KeyringTestingHelper.diffKeyrings(ring.getEncoded(), canonicalized.getEncoded(), onlyA, onlyB));
    }

    { // now try one with a /bad/ primary key binding signature

        PGPSignatureSubpacketGenerator unhashedSubs = new PGPSignatureSubpacketGenerator();
        // this one is signed by the primary key itself, not the subkey - but it IS primary binding
        unhashedSubs.setEmbeddedSignature(false, forgeSignature(secretKey, PGPSignature.PRIMARYKEY_BINDING,
                subHashedPacketsGen, secretKey.getPublicKey(), pKey.getPublicKey()));

        sig = forgeSignature(secretKey, PGPSignature.SUBKEY_BINDING, subHashedPacketsGen, unhashedSubs,
                secretKey.getPublicKey(), pKey.getPublicKey());

        // inject in the right position
        UncachedKeyRing modified = KeyringTestingHelper.injectPacket(ring, sig.getEncoded(), 8);

        // canonicalize, and check if we lose the bad signature
        CanonicalizedKeyRing canonicalized = modified.canonicalize(log, 0);
        Assert.assertFalse("subkey binding signature should be gone after canonicalization",
                KeyringTestingHelper.diffKeyrings(ring.getEncoded(), canonicalized.getEncoded(), onlyA, onlyB));
    }

}

---