Re: Difficulty reading DSA/El Gamal key pair from public key ring collection
Andy LoPresto <[email protected]> Fri, 4 Oct 2019 10:48:55 -0700
| Newsgroups | gmane.comp.encryption.bouncy-castle.devel |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_C8909E0C-5CF8-43AD-9181-33D20E579472 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi David,=20 Following up on this to see if you need any additional information from = me or you have any suggestions for where to continue investigating this = issue. Thanks.=20 Andy LoPresto [email protected] [email protected] PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4 BACE 3C6E F65B 2F7D EF69 > On Sep 25, 2019, at 11:36 AM, Andy LoPresto <[email protected]> = wrote: >=20 > Hi David,=20 >=20 > Thanks for your quick reply. There are three sample public keyring = collection files here [1][2][3]. The first (pubring.gpg) contains an RSA = key pair. The second (dsa-pubring.gpg) contains a 2048 bit DSA/El Gamal = key pair. The third (dsa-small-pubring.gpg) contains a 1024 bit DSA/El = Gamal key pair. The third is the same one referenced during the CLI = output I linked to in my previous message. All three work using the gpg = command line tool, but neither of the DSA rings work with the Java code = I posted. The two DSA keyrings actually contain the secret keys as well.=20= >=20 > [1] = https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f483bcac77347= b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/t= est/resources/TestEncryptContent/pubring.gpg = <https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f483bcac7734= 7b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/= test/resources/TestEncryptContent/pubring.gpg> > [2] = https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f483bcac77347= b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/t= est/resources/TestEncryptContent/dsa-pubring.gpg = <https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f483bcac7734= 7b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/= test/resources/TestEncryptContent/dsa-pubring.gpg> > [3] = https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f483bcac77347= b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/t= est/resources/TestEncryptContent/dsa-small-pubring.gpg = <https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f483bcac7734= 7b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/= test/resources/TestEncryptContent/dsa-small-pubring.gpg> >=20 >=20 > Andy LoPresto > [email protected] <mailto:[email protected]> > [email protected] > PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4 BACE 3C6E F65B 2F7D EF69 >=20 >> On Sep 25, 2019, at 1:39 AM, David Hook <dgh-rTAZ0PM/[email protected] = <mailto:dgh-rTAZ0PM/[email protected]>> wrote: >>=20 >>=20 >> Can you send me a copy of the public key ring file that is causing = the problem? >>=20 >> Thanks, >>=20 >> David >>=20 >> On 25/9/19 1:57 pm, Andy LoPresto wrote: >>> Hi,=20 >>>=20 >>> I am encountering a surprising issue when attempting to read a DSA & = El Gamal key pair from a public key ring file. I generated the keys as = per the usual process on the command-line using gpg (GnuPG 2.2.17 on Mac = OS X 10.14.2). I have verified that I can encrypt and decrypt arbitrary = data using those keys and gpg. However, when trying to read the keys via = BC OpenPGP (Java), I either get an IOException (=E2=80=9CUnexpected = object encountered in stream: 0=E2=80=9D) if not using = PGPUtil.getDecoderStream(InputStream), or simply an empty = PGPPublicKeyRingCollection object if using PGPUtil.getDecoderStream() in = the constructor.=20 >>>=20 >>> I have verified that the same code works successfully against a = public keyring file containing RSA keys, and that if I generate a public = key ring collection with a single DSA/El Gamal key pair in Java code and = pass those bytes as an InputStream into the same code, it successfully = parses and returns the key ring collection.=20 >>>=20 >>> I have tried with 2048 bit keys (default), but saw there was a = potential compatibility warning with some OpenPGP implementations so = tried with 1024 bits as well (same result).=20 >>>=20 >>> I have posted the exploratory test code here [1] and selected output = from the command-line demonstrating successful operation with the key = pair here [2]. I did not see any mention of this issue on BC release = notes or the examples, but there is this external post [3] (15 years = old) noting there may be a bug here. Thanks in advance for your = assistance.=20 >>>=20 >>> [1] = https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f483bcac77347= b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/t= est/groovy/org/apache/nifi/security/util/crypto/OpenPGPKeyBasedEncryptorGr= oovyTest.groovy#L141 = <https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f483bcac7734= 7b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/= test/groovy/org/apache/nifi/security/util/crypto/OpenPGPKeyBasedEncryptorG= roovyTest.groovy#L141> >>> [2] = https://gist.github.com/alopresto/b91c731b347584316fa4d3ca37ba256c = <https://gist.github.com/alopresto/b91c731b347584316fa4d3ca37ba256c> >>> [3] = http://cephas.net/blog/2004/04/01/pgp-encryption-using-bouncy-castle/ = <http://cephas.net/blog/2004/04/01/pgp-encryption-using-bouncy-castle/> >>>=20 >>>=20 >>> Andy LoPresto >>> [email protected] <mailto:[email protected]> >>> [email protected] <mailto:[email protected]> >>> PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4 BACE 3C6E F65B 2F7D EF69 >>>=20 >>=20 >=20 --Apple-Mail=_C8909E0C-5CF8-43AD-9181-33D20E579472 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hi = David, <div class=3D""><br class=3D""></div><div class=3D"">Following= up on this to see if you need any additional information from me or you = have any suggestions for where to continue investigating this issue. = Thanks. </div><div class=3D""><br class=3D""><div class=3D""> <div style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = orphans: auto; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: auto; word-spacing: 0px; = -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; = text-decoration: none;">Andy LoPresto<br class=3D""><a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a><br class=3D""><i = class=3D"">[email protected]</i><br class=3D"">PGP Fingerprint: = 70EC B3E5 98A6 5A3F D3C4 BACE 3C6E F65B 2F7D EF69</div> </div> <div><br class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D"">On Sep 25, 2019, at 11:36 AM, Andy LoPresto <<a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><meta = http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8" = class=3D""><div style=3D"word-wrap: break-word; -webkit-nbsp-mode: = space; line-break: after-white-space;" class=3D"">Hi David, <div = class=3D""><br class=3D""></div><div class=3D"">Thanks for your quick = reply. There are three sample public keyring collection files here = [1][2][3]. The first (pubring.gpg) contains an RSA key pair. The second = (dsa-pubring.gpg) contains a 2048 bit DSA/El Gamal key pair. The third = (dsa-small-pubring.gpg) contains a 1024 bit DSA/El Gamal key pair. The = third is the same one referenced during the CLI output I linked to in my = previous message. All three work using the gpg command line tool, but = neither of the DSA rings work with the Java code I posted. The two DSA = keyrings actually contain the secret keys as well. </div><div = class=3D""><br class=3D""></div><div class=3D"">[1] <a = href=3D"https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f483b= cac77347b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processo= rs/src/test/resources/TestEncryptContent/pubring.gpg" = class=3D"">https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f4= 83bcac77347b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-proce= ssors/src/test/resources/TestEncryptContent/pubring.gpg</a></div><div = class=3D"">[2] <a = href=3D"https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f483b= cac77347b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processo= rs/src/test/resources/TestEncryptContent/dsa-pubring.gpg" = class=3D"">https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f4= 83bcac77347b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-proce= ssors/src/test/resources/TestEncryptContent/dsa-pubring.gpg</a></div><div = class=3D"">[3] <a = href=3D"https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f483b= cac77347b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processo= rs/src/test/resources/TestEncryptContent/dsa-small-pubring.gpg" = class=3D"">https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f4= 83bcac77347b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-proce= ssors/src/test/resources/TestEncryptContent/dsa-small-pubring.gpg</a></div= ><div class=3D""><br class=3D""></div><div class=3D""><br class=3D""><div = class=3D""> <div style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D"">Andy LoPresto<br class=3D""><a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a><br class=3D""><i class=3D""><a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a></i><br class=3D"">PGP = Fingerprint: 70EC B3E5 98A6 5A3F D3C4 BACE 3C6E F65B 2F7D = EF69</div> </div> <div class=3D""><br class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D"">On Sep 25, 2019, at 1:39 AM, David Hook <<a = href=3D"mailto:dgh-rTAZ0PM/[email protected]" = class=3D"">dgh-rTAZ0PM/[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""> =20 <meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3DUTF-8" class=3D""> =20 <div text=3D"#000000" bgcolor=3D"#FFFFFF" class=3D""> <div class=3D"moz-cite-prefix"><br class=3D""> </div> <div class=3D"moz-cite-prefix">Can you send me a copy of the public key ring file that is causing the problem?</div> <div class=3D"moz-cite-prefix"><br class=3D""> </div> <div class=3D"moz-cite-prefix">Thanks,</div> <div class=3D"moz-cite-prefix"><br class=3D""> </div> <div class=3D"moz-cite-prefix">David</div> <div class=3D"moz-cite-prefix"><br class=3D""> </div> <div class=3D"moz-cite-prefix">On 25/9/19 1:57 pm, Andy LoPresto wrote:<br class=3D""> </div> <blockquote type=3D"cite" = cite=3D"mid:0B7816FA-3113-4E6F-94BB-268E5A80F8EC-1oDqGaOF3Lkdnm+yROfE0A@public.gmane.org" class=3D""> <meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3DUTF-8" class=3D""> <meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3DUTF-8" class=3D""> <div style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hi, <div class=3D""><br class=3D""> </div> <div class=3D"">I am encountering a surprising issue when attempting to read a DSA & El Gamal key pair from a public key ring file. I generated the keys as per the usual process on the command-line using gpg (GnuPG 2.2.17 on Mac OS X 10.14.2). I have verified that I can encrypt and decrypt arbitrary data using those keys and gpg. However, when trying to read the keys via BC OpenPGP (Java), I either get an IOException (=E2=80=9CUnexpected object encountered in stream: = 0=E2=80=9D) if not using PGPUtil.getDecoderStream(InputStream), or simply an empty PGPPublicKeyRingCollection object if using PGPUtil.getDecoderStream() in the constructor. </div> <div class=3D""><br class=3D""> </div> <div class=3D"">I have verified that the same code works successfully against a public keyring file containing RSA keys, and that if I generate a public key ring collection with a single DSA/El Gamal key pair in Java code and pass those bytes as an InputStream into the same code, it successfully parses and returns the key ring collection. </div> <div class=3D""><br class=3D""> </div> <div class=3D"">I have tried with 2048 bit keys (default), but = saw there was a potential compatibility warning with some OpenPGP implementations so tried with 1024 bits as well (same result). </div> <div class=3D""><br class=3D""> </div> <div class=3D"">I have posted the exploratory test code here [1] and selected output from the command-line demonstrating successful operation with the key pair here [2]. I did not see any mention of this issue on BC release notes or the examples, but there is this external post [3] (15 years old) noting there may be a bug here. Thanks in advance for your assistance. </div> <div class=3D""><br class=3D""> </div> <div class=3D"">[1] <a = href=3D"https://github.com/alopresto/nifi/blob/45375f8cd798750ef9aa45f483b= cac77347b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processo= rs/src/test/groovy/org/apache/nifi/security/util/crypto/OpenPGPKeyBasedEnc= ryptorGroovyTest.groovy#L141" class=3D"" = moz-do-not-send=3D"true">https://github.com/alopresto/nifi/blob/45375f8cd7= 98750ef9aa45f483bcac77347b465c/nifi-nar-bundles/nifi-standard-bundle/nifi-= standard-processors/src/test/groovy/org/apache/nifi/security/util/crypto/O= penPGPKeyBasedEncryptorGroovyTest.groovy#L141</a></div> <div class=3D"">[2] <a = href=3D"https://gist.github.com/alopresto/b91c731b347584316fa4d3ca37ba256c= " class=3D"" = moz-do-not-send=3D"true">https://gist.github.com/alopresto/b91c731b3475843= 16fa4d3ca37ba256c</a></div> <div class=3D"">[3] <a = href=3D"http://cephas.net/blog/2004/04/01/pgp-encryption-using-bouncy-cast= le/" class=3D"" = moz-do-not-send=3D"true">http://cephas.net/blog/2004/04/01/pgp-encryption-= using-bouncy-castle/</a></div> <div class=3D""><br class=3D""> </div> <div class=3D""><br class=3D""> <div class=3D""> <div style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D"">Andy LoPresto<br class=3D""> <a href=3D"mailto:[email protected]" class=3D"" = moz-do-not-send=3D"true">[email protected]</a><br class=3D""> <i class=3D""><a href=3D"mailto:[email protected]" = class=3D"" moz-do-not-send=3D"true">[email protected]</a></i><br = class=3D""> PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4 BACE = 3C6E F65B 2F7D EF69</div> </div> <br class=3D""> </div> </div> </blockquote><p class=3D""><br class=3D""> </p> </div> </div></blockquote></div><br = class=3D""></div></div></div></blockquote></div><br = class=3D""></div></body></html>= --Apple-Mail=_C8909E0C-5CF8-43AD-9181-33D20E579472--