Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade to OpenPGP.js v6 #190

Draft
wants to merge 22 commits into
base: main
Choose a base branch
from
Draft

Upgrade to OpenPGP.js v6 #190

wants to merge 22 commits into from

Conversation

larabr
Copy link
Collaborator

@larabr larabr commented Nov 23, 2023

As OpenPGP.js is now declared as "module", we also switch pmcrypto to be one. This causes the majority of changes in this PR.

Non-breaking changes:

  • added support for reading and generating v6 packet versions
  • added support for processing and generating Curve448 keys, and Curve25519 in new format
  • ...

Breaking changes:

  • for downstream TS compiler, using the new "node16" or "Bundler" module resolution is required, as e.g. the noble-hashes lib uses exports only (if this is too problematic, we could temporarily add legacy entrypoints to that dependency, since we currently use a fork).
  • limited support for (legacy, non-standardized) AEAD-encrypted v4 keys as per draft4880bis
  • enum name changes related to legacy curve25519 and eddsa
  • ...

TODO:

  • rebase on top of TS fix for lightweight build (to be released in next openpgpjs v6 pre-release)
  • release protontech/v6 and point to it
  • test integration with web-clients, esp. TS config
  • post-canary:
    • we currently reject keys in new eddsa/xecdh format (in checkKeyStrength)
    • accept sha3 in generated key prefs
    • make explicit date inputs mandatory?
  • ...

lib/key/forwarding.ts Outdated Show resolved Hide resolved
@larabr larabr force-pushed the openpgpjs-v6 branch 2 times, most recently from 0571f71 to af77e43 Compare March 4, 2024 12:34
@larabr larabr force-pushed the openpgpjs-v6 branch 4 times, most recently from 7d94613 to 02e3c15 Compare March 13, 2024 14:32
@larabr larabr force-pushed the openpgpjs-v6 branch 3 times, most recently from 3445257 to eb8e9f6 Compare April 18, 2024 08:29
@larabr larabr force-pushed the openpgpjs-v6 branch 2 times, most recently from 53e68ef to 0d033a1 Compare May 17, 2024 15:33
This commit only points to the new version, making sure the module and test compiles,
but makes no logic changes to e.g. add support to new key algos/formats.
OpenPGP.js v6 drops support for platforms without native BigInts
Adding support for TS v5.
…erated key prefs

OpenPGP.js v5 does not support sha3, so we should not include it in the key prefs
until the full v6 integration in the webapps and mobile.
…ions

Also, rename `MaybeStream` to `MaybeWebStream` to help differentiate it from
`openpgpjs.MaybeStream`, which can also be a NodeStream.
…lic keys (default to `config.ignoreSEIPDv2FeatureFlag: true`)

We want to avoid generating SEIPDv2 messages until support is rolled out to other platforms,
in case e.g. some users have already imported v4 keys with SEIPDv2 feature flags.

This change affects `encryptMessage` and `generateSessionKeys` when `encryptionKeys` are given
(rather than `passwords`).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant