Struct sequoia_openpgp::policy::StandardPolicy

source ·

pub struct StandardPolicy<'a> { /* private fields */ }

Expand description

The standard policy.

The standard policy stores when each algorithm in a family of algorithms is no longer considered safe. Attempts to use an algorithm after its cutoff time should fail.

A StandardPolicy can be configured using Rust. Sometimes it is useful to configure it via a configuration file. This can be done using the sequoia-policy-config crate.

It is recommended to support using a configuration file when the program should respect the system’s crypto policy. This is required on Fedora, for instance. See the [Fedora Crypto Policies] project for more information.

When validating a signature, we normally want to know whether the algorithms used are safe now. That is, we don’t use the signature’s alleged creation time when considering whether an algorithm is safe, because if an algorithm is discovered to be compromised at time X, then an attacker could forge a message after time X with a signature creation time that is prior to X, which would be incorrectly accepted.

Occasionally, we know that a signature has not been tampered with since some time in the past. We might know this if the signature was stored on some tamper-proof medium. In those cases, it is reasonable to use the time that the signature was saved, since an attacker could not have taken advantage of any weaknesses found after that time.

§Examples

A StandardPolicy object can be used to build specialized policies. For example the following policy filters out Persona certifications mimicking what GnuPG does when calculating the Web of Trust.

use sequoia_openpgp as openpgp;
use std::io::{Cursor, Read};
use openpgp::Result;
use openpgp::packet::{Packet, Signature, key::PublicParts};
use openpgp::cert::prelude::*;
use openpgp::parse::Parse;
use openpgp::armor::{Reader, ReaderMode, Kind};
use openpgp::policy::{HashAlgoSecurity, Policy, StandardPolicy};
use openpgp::types::{
   SymmetricAlgorithm,
   AEADAlgorithm,
   SignatureType
};

#[derive(Debug)]
struct RejectPersonaCertificationsPolicy<'a>(StandardPolicy<'a>);

impl Policy for RejectPersonaCertificationsPolicy<'_> {
    fn key(&self, ka: &ValidErasedKeyAmalgamation<PublicParts>)
           -> Result<()>
    {
        self.0.key(ka)
    }

    fn signature(&self, sig: &Signature, sec: HashAlgoSecurity) -> Result<()> {
        if sig.typ() == SignatureType::PersonaCertification {
            Err(anyhow::anyhow!("Persona certifications are ignored."))
        } else {
            self.0.signature(sig, sec)
        }
    }

    fn symmetric_algorithm(&self, algo: SymmetricAlgorithm) -> Result<()> {
        self.0.symmetric_algorithm(algo)
    }

    fn aead_algorithm(&self, algo: AEADAlgorithm) -> Result<()> {
        self.0.aead_algorithm(algo)
    }

    fn packet(&self, packet: &Packet) -> Result<()> {
        self.0.packet(packet)
    }
}

impl RejectPersonaCertificationsPolicy<'_> {
    fn new() -> Self {
        Self(StandardPolicy::new())
    }
}

// this key has one persona certification
let data = r#"
-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEX7JGrxYJKwYBBAHaRw8BAQdASKGcnowaZBDc2Z3rZZlWb6jEjne9sK76afbJ
trd5Uw+0BlRlc3QgMoiQBBMWCAA4FiEEyZ6oBYFia3z+ooCBqR9BqiGp8AQFAl+y
Rq8CGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQqR9BqiGp8ASfxwEAvEb0
bFr7ZgFZSDOITNptm+FEynib8mmLACsvHAmCjvIA+gOaSNyxMW6N59q7/j0sDjp1
aYNgpNFLbYBZpkXXVL0GiHUEERYIAB0WIQTE4QfdkkisIbWVOcHmlsuS3dbWEwUC
X7JG4gAKCRDmlsuS3dbWExEwAQCpqfiVMhjDwVFMsMpwd5r0N/8rAx8/nmgpCsK3
M9TUrAD7BhTYVPRbkJqTZYd9DlLtBcbF3yNPTHlB+F2sFjI+cgo=
=ZfYu
-----END PGP PUBLIC KEY BLOCK-----
"#;

let mut cursor = Cursor::new(&data);
let mut reader = Reader::from_reader(&mut cursor, ReaderMode::Tolerant(Some(Kind::PublicKey)));

let mut buf = Vec::new();
reader.read_to_end(&mut buf)?;
let cert = Cert::from_bytes(&buf)?;

let ref sp = StandardPolicy::new();
let u = cert.with_policy(sp, None)?.userids().nth(0).unwrap();

// Under the standard policy the persona certification is visible.
assert_eq!(u.certifications().count(), 1);

// Under our custom policy the persona certification is not available.
let ref p = RejectPersonaCertificationsPolicy::new();
assert_eq!(u.with_policy(p, None)?.certifications().count(), 0);

Struct sequoia_openpgp::policy::StandardPolicyCopy item path

§Examples

Implementations§

impl<'a> StandardPolicy<'a>

pub const fn new() -> Self

pub fn at<T>(time: T) -> Selfwhere T: Into<SystemTime>,

pub fn time(&self) -> Option<SystemTime>

pub fn accept_hash(&mut self, h: HashAlgorithm)

pub fn accept_hash_property(&mut self, h: HashAlgorithm, sec: HashAlgoSecurity)

pub fn reject_hash(&mut self, h: HashAlgorithm)

pub fn reject_all_hashes(&mut self)

pub fn reject_hash_at<T>(&mut self, h: HashAlgorithm, t: T)where T: Into<Option<SystemTime>>,

pub fn reject_hash_property_at<T>( &mut self, h: HashAlgorithm, sec: HashAlgoSecurity, t: T )where T: Into<Option<SystemTime>>,

pub fn hash_cutoff( &self, h: HashAlgorithm, sec: HashAlgoSecurity ) -> Option<SystemTime>

pub fn hash_revocation_tolerance<D>(&mut self, d: D)where D: Into<Duration>,

pub fn get_hash_revocation_tolerance(&self) -> Duration

pub fn accept_critical_subpacket(&mut self, s: SubpacketTag)

pub fn reject_critical_subpacket(&mut self, s: SubpacketTag)

pub fn reject_all_critical_subpackets(&mut self)

pub fn reject_critical_subpacket_at<C>(&mut self, s: SubpacketTag, cutoff: C)where C: Into<Option<SystemTime>>,

pub fn critical_subpacket_cutoff(&self, s: SubpacketTag) -> Option<SystemTime>

pub fn good_critical_notations(&mut self, good_list: &'a [&'a str])

pub fn accept_asymmetric_algo(&mut self, a: AsymmetricAlgorithm)

pub fn reject_asymmetric_algo(&mut self, a: AsymmetricAlgorithm)

pub fn reject_all_asymmetric_algos(&mut self)

pub fn reject_asymmetric_algo_at<C>( &mut self, a: AsymmetricAlgorithm, cutoff: C )where C: Into<Option<SystemTime>>,

pub fn asymmetric_algo_cutoff( &self, a: AsymmetricAlgorithm ) -> Option<SystemTime>

pub fn accept_symmetric_algo(&mut self, s: SymmetricAlgorithm)

pub fn reject_symmetric_algo(&mut self, s: SymmetricAlgorithm)

pub fn reject_all_symmetric_algos(&mut self)

pub fn reject_symmetric_algo_at<C>(&mut self, s: SymmetricAlgorithm, cutoff: C)where C: Into<Option<SystemTime>>,

pub fn symmetric_algo_cutoff(&self, s: SymmetricAlgorithm) -> Option<SystemTime>

pub fn accept_aead_algo(&mut self, a: AEADAlgorithm)

pub fn reject_aead_algo(&mut self, a: AEADAlgorithm)

pub fn reject_all_aead_algos(&mut self)

pub fn reject_aead_algo_at<C>(&mut self, a: AEADAlgorithm, cutoff: C)where C: Into<Option<SystemTime>>,

pub fn aead_algo_cutoff(&self, a: AEADAlgorithm) -> Option<SystemTime>

pub fn accept_packet_tag_version(&mut self, tag: Tag, version: u8)

pub fn accept_packet_tag(&mut self, tag: Tag)

pub fn reject_packet_tag_version(&mut self, tag: Tag, version: u8)

pub fn reject_packet_tag(&mut self, tag: Tag)

pub fn reject_all_packet_tags(&mut self)

pub fn reject_packet_tag_version_at<C>( &mut self, tag: Tag, version: u8, cutoff: C )where C: Into<Option<SystemTime>>,

pub fn reject_packet_tag_at<C>(&mut self, tag: Tag, cutoff: C)where C: Into<Option<SystemTime>>,

pub fn packet_tag_version_cutoff( &self, tag: Tag, version: u8 ) -> Option<SystemTime>

pub fn packet_tag_cutoff(&self, tag: Tag) -> Option<SystemTime>

Trait Implementations§

impl<'a> Clone for StandardPolicy<'a>

fn clone(&self) -> StandardPolicy<'a>

fn clone_from(&mut self, source: &Self)

impl<'a> Debug for StandardPolicy<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

impl<'a> Default for StandardPolicy<'a>

fn default() -> Self

impl<'a> From<&'a StandardPolicy<'a>> for Option<&'a dyn Policy>

fn from(p: &'a StandardPolicy<'a>) -> Self

impl<'a> Policy for StandardPolicy<'a>

fn signature(&self, sig: &Signature, sec: HashAlgoSecurity) -> Result<()>

fn key(&self, ka: &ValidErasedKeyAmalgamation<'_, PublicParts>) -> Result<()>

fn packet(&self, packet: &Packet) -> Result<()>

fn symmetric_algorithm(&self, algo: SymmetricAlgorithm) -> Result<()>

fn aead_algorithm(&self, algo: AEADAlgorithm) -> Result<()>

Auto Trait Implementations§

impl<'a> Freeze for StandardPolicy<'a>

impl<'a> RefUnwindSafe for StandardPolicy<'a>

impl<'a> Send for StandardPolicy<'a>

impl<'a> Sync for StandardPolicy<'a>

impl<'a> Unpin for StandardPolicy<'a>

impl<'a> UnwindSafe for StandardPolicy<'a>

Blanket Implementations§

impl<T> Any for Twhere T: 'static + ?Sized,

fn type_id(&self) -> TypeId

impl<T> Borrow<T> for Twhere T: ?Sized,

fn borrow(&self) -> &T

impl<T> BorrowMut<T> for Twhere T: ?Sized,

fn borrow_mut(&mut self) -> &mut T

impl<T> DynClone for Twhere T: Clone,

fn __clone_box(&self, _: Private) -> *mut ()

impl<T> From<T> for T

fn from(t: T) -> T

Struct sequoia_openpgp::policy::StandardPolicy

pub fn at<T>(time: T) -> Self
where T: Into<SystemTime>,

pub fn reject_hash_at<T>(&mut self, h: HashAlgorithm, t: T)
where T: Into<Option<SystemTime>>,

pub fn reject_hash_property_at<T>( &mut self, h: HashAlgorithm, sec: HashAlgoSecurity, t: T )
where T: Into<Option<SystemTime>>,

pub fn hash_revocation_tolerance<D>(&mut self, d: D)
where D: Into<Duration>,

pub fn reject_critical_subpacket_at<C>(&mut self, s: SubpacketTag, cutoff: C)
where C: Into<Option<SystemTime>>,

pub fn reject_asymmetric_algo_at<C>( &mut self, a: AsymmetricAlgorithm, cutoff: C )
where C: Into<Option<SystemTime>>,

pub fn reject_symmetric_algo_at<C>(&mut self, s: SymmetricAlgorithm, cutoff: C)
where C: Into<Option<SystemTime>>,

pub fn reject_aead_algo_at<C>(&mut self, a: AEADAlgorithm, cutoff: C)
where C: Into<Option<SystemTime>>,

pub fn reject_packet_tag_version_at<C>( &mut self, tag: Tag, version: u8, cutoff: C )
where C: Into<Option<SystemTime>>,

pub fn reject_packet_tag_at<C>(&mut self, tag: Tag, cutoff: C)
where C: Into<Option<SystemTime>>,

impl<T> Any for T
where T: 'static + ?Sized,

impl<T> Borrow<T> for T
where T: ?Sized,

impl<T> BorrowMut<T> for T
where T: ?Sized,

impl<T> DynClone for T
where T: Clone,

impl<T, U> Into<U> for T
where U: From<T>,

impl<T> ToOwned for T
where T: Clone,

impl<T, U> TryFrom<U> for T
where U: Into<T>,

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,