minipgp6 0.0.4

minipgp6
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133

//! Generate a test key for `msop update-key`, which has an expired primary key
//!
//! Usage, e.g.:
//!
//! `$ cargo run --example testkey_generate | cargo run --bin msop update-key
//!    | cargo run --example status`

use std::io::stdout;

use minipgp6_armor::{DataType, write::Armorer};
use minipgp6_packet::{
    Serialize,
    body::{
        secret_key::{SecretKey, SecretKeyMaterial},
        signature::{
            SignatureType,
            Subpacket,
            subpacket_data::{
                Features,
                IssuerFingerprint,
                KeyExpirationTime,
                KeyFlags,
                PreferredAeadCiphersuites,
                SignatureCreationTime,
            },
        },
    },
    transferable::{SignedComponent, Tsk},
    types::{
        KeyRole,
        algorithm::PublicKeyAlgorithm,
        time::{Duration, Timestamp},
    },
    unlocked::UnlockedSoftwareKey,
};
use minipgp6_sign::component::{sign_direct_key, sign_key_binding};
use rand::thread_rng;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut rng = thread_rng();

    let create = Timestamp(1722466800); // July 2024

    // -- Primary
    let primary = minipgp6_sign::generate_key(
        &mut rng,
        PublicKeyAlgorithm::Ed25519,
        KeyRole::Primary,
        create,
    )?;

    let hashed_area = vec![
        Subpacket::regular(SignatureCreationTime(create))?,
        Subpacket::regular(KeyExpirationTime(Duration(365 * 24 * 60 * 60)))?,
        Subpacket::regular(IssuerFingerprint(primary.public().fingerprint()))?,
        // CS (FIXME: don't hardcode literal)
        Subpacket::regular(KeyFlags(Box::new([0x03])))?,
        // SEIPD v2 only (FIXME: don't hardcode literal)
        Subpacket::regular(Features(Box::new([0x08])))?,
        // AES128, Ocb
        Subpacket::regular(PreferredAeadCiphersuites(Box::new([0x07, 0x02])))?,
    ];

    let config = minipgp6_sign::new_signature(
        &mut rng,
        SignatureType::DirectKey,
        PublicKeyAlgorithm::Ed25519,
        PublicKeyAlgorithm::Ed25519.hash_algorithm()?,
        hashed_area,
        Vec::new(),
    )?;

    // -- Signer from primary
    let SecretKeyMaterial::Unprotected(plain) = &primary.secret_key_material else {
        unreachable!();
    };

    let signer = UnlockedSoftwareKey::new(plain.clone(), primary.public());

    let dks = sign_direct_key(config, &signer, primary.public())?;

    // -- Subkey
    let subkey = minipgp6_encrypt::generate_key(
        &mut rng,
        PublicKeyAlgorithm::X25519,
        create,
        KeyRole::Subkey,
    )?;

    let hashed_area = vec![
        Subpacket::regular(SignatureCreationTime(create))?,
        Subpacket::regular(KeyExpirationTime(Duration(365 * 24 * 60 * 60)))?,
        Subpacket::regular(IssuerFingerprint(primary.public().fingerprint()))?,
        Subpacket::regular(KeyFlags(Box::new([0x04 | 0x08])))?, // E
    ];

    let primary_pk = primary.public().public_key_algorithm();

    let config = minipgp6_sign::new_signature(
        &mut rng,
        SignatureType::SubkeyBinding,
        primary_pk,
        primary_pk.hash_algorithm()?,
        hashed_area,
        Vec::new(),
    )?;

    let binding = sign_key_binding(config, &signer, primary.public(), subkey.public())?;

    let sk = SignedComponent::<SecretKey> {
        component: subkey,
        revocations: Vec::new(),
        signatures: vec![binding],
    };

    // -- Assemble
    let tsk = Tsk {
        primary: SignedComponent::<SecretKey> {
            component: primary,
            revocations: Vec::new(),
            signatures: vec![dks],
        },
        subkeys: vec![sk],
        user_ids: Vec::new(),
    };

    // -- Print to stdout
    let mut out = Armorer::new(stdout(), DataType::Private)?;
    tsk.to_writer(&mut out)?;
    out.finalize()?;

    Ok(())
}