Question about the adjustment of MPI values on gpg --import

Wiktor Kwapisiewicz via Gnupg-devel <[email protected]> Thu, 14 Nov 2024 09:29:40 +0100
Newsgroups	gmane.comp.encryption.gpg.devel
Organization	Metacode
Message-ID	<[email protected]>
Hello,

I've got a question about handling of certain keys.

I've noticed that GnuPG on import "adjusts" some MPIs but if my reading 
of the spec is correct the adjustments breaks the spec alignment.

I managed to find a key where the last MPI (the S value of the EdDSA 
signature) has a high bit set:

$ gpg --dearmor < ee.asc | xxd | tail -n 4
000006d0: eab4 2954 a0a9 eeaa 19fb 45e4 62b2 78e1  ..)T......E.b.x.
000006e0: ebdd 196f ae00 f8fa 84f1 fdc7 c908 7ddb  ...o..........}.
000006f0: 0419 0dbb a934 ac0b d117 3b77 157c 5279  .....4....;w.|Ry
00000700: 05cc c5db c20f                           ......

Here, the length is "00 f8" and is followed by these bytes:

fa 84f1 fdc7 c908 7ddb 0419 0dbb a934 ac0b d117 3b77 157c 5279 05cc c5db 
c20f

The first byte has a leading non-zero bit:

 > 0xfa.toString(2)
'11111010'

So the length of the entire MPI is (in bits):

 > 'fa 84f1 fdc7 c908 7ddb 0419 0dbb a934 ac0b d117 3b77 157c 5279 05cc 
c5db c20f'.replace(/ +/g, '').length*4
248

That converted to hex gives us 0xf8.

Now, when the key gets imported and then exported the final field gets 
extended with a leading zero byte *and* the MPI length is set to "01 00" 
(256 in decimal).

$ gpg --export 4813CD31D15CC912 | xxd | tail -n 3
00000640: aa19 fb45 e462 b278 e1eb dd19 6fae 0100  ...E.b.x....o...
00000650: 00fa 84f1 fdc7 c908 7ddb 0419 0dbb a934  ........}......4
00000660: ac0b d117 3b77 157c 5279 05cc c5db c20f  ....;w.|Ry......

The rest of the MPI is left as it was. I think the additional zero byte 
is not that problematic (the spec doesn't seem to say in one way or 
another; the additional zero reminds me of the ASN.1 encoding...). But 
the spec is very clear that the length should be counted from the first 
non-zero bit and from my understanding it seems the length erroneously 
included the zero byte:

  > The length field of an MPI describes the length starting from its 
most significant non-zero bit. Thus, the MPI [00 02 01] is not formed 
correctly. It should be [00 01 01].

https://www.ietf.org/archive/id/draft-koch-librepgp-02.html#section-3.2

I'm not sure if I'm holding it wrong but before I submit a but report 
I'd like to hear your input if this looks like a bug or not. The test 
key is attached to this e-mail.

Thanks for your time and have a nice day!

Kind regards,
Wiktor

_______________________________________________
Gnupg-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-devel
ee.asc (text/plain, 2.5 KB)