github #23 added method for handling signing subkey

6 files changed, 165 insertions, 35 deletions

diff --git a/crypto/src/bcpg/SignaturePacket.cs b/crypto/src/bcpg/SignaturePacket.cs
index 5b91c15a3..70138d584 100644
--- a/crypto/src/bcpg/SignaturePacket.cs
+++ b/crypto/src/bcpg/SignaturePacket.cs
@@ -473,5 +473,11 @@ namespace Org.BouncyCastle.Bcpg
 				}
 			}
 		}
-	}
+        public static SignaturePacket FromByteArray(byte[] data)
+        {
+            BcpgInputStream input = BcpgInputStream.Wrap(new MemoryStream(data));
+
+            return new SignaturePacket(input);
+        }
+    }
 }
diff --git a/crypto/src/openpgp/PgpKeyRingGenerator.cs b/crypto/src/openpgp/PgpKeyRingGenerator.cs
index 4f6a4b12f..352575b0b 100644
--- a/crypto/src/openpgp/PgpKeyRingGenerator.cs
+++ b/crypto/src/openpgp/PgpKeyRingGenerator.cs
@@ -1,6 +1,5 @@
 using System;
 using System.Collections;
-
 using Org.BouncyCastle.Security;
 using Org.BouncyCastle.Utilities;
 
@@ -280,42 +279,70 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp
             this.AddSubKey(keyPair, this.hashedPacketVector, this.unhashedPacketVector, hashAlgorithm);
         }
 
-		/// <summary>
-		/// Add a subkey with specific hashed and unhashed packets associated with it and
-		/// default certification.
-		/// </summary>
-		/// <param name="keyPair">Public/private key pair.</param>
-		/// <param name="hashedPackets">Hashed packet values to be included in certification.</param>
-		/// <param name="unhashedPackets">Unhashed packets values to be included in certification.</param>
-		/// <exception cref="PgpException"></exception>
-		public void AddSubKey(
+        /// <summary>
+        /// Add a signing subkey to the key ring to be generated with default certification and a primary key binding signature.
+        /// </summary>
+        /// <param name="keyPair">The key pair.</param>
+        /// <param name="hashAlgorithm">The hash algorithm.</param>
+        /// <param name="primaryKeyBindingHashAlgorithm">The primary-key binding hash algorithm.</param>
+        public void AddSubKey(PgpKeyPair keyPair, HashAlgorithmTag hashAlgorithm, HashAlgorithmTag primaryKeyBindingHashAlgorithm)
+        {
+            this.AddSubKey(keyPair, this.hashedPacketVector, this.unhashedPacketVector, hashAlgorithm, primaryKeyBindingHashAlgorithm);
+        }
+
+        /// <summary>
+        /// Add a subkey with specific hashed and unhashed packets associated with it and
+        /// default certification using SHA-1.
+        /// </summary>
+        /// <param name="keyPair">Public/private key pair.</param>
+        /// <param name="hashedPackets">Hashed packet values to be included in certification.</param>
+        /// <param name="unhashedPackets">Unhashed packets values to be included in certification.</param>
+        /// <exception cref="PgpException"></exception>
+        public void AddSubKey(
 			PgpKeyPair					keyPair,
 			PgpSignatureSubpacketVector	hashedPackets,
 			PgpSignatureSubpacketVector	unhashedPackets)
 		{
-			try
+            AddSubKey(keyPair, hashedPackets, unhashedPackets, HashAlgorithmTag.Sha1);
+        }
+
+        /// <summary>
+        /// Add a subkey with specific hashed and unhashed packets associated with it and
+        /// default certification.
+        /// </summary>
+        /// <param name="keyPair">Public/private key pair.</param>
+        /// <param name="hashedPackets">Hashed packet values to be included in certification.</param>
+        /// <param name="unhashedPackets">Unhashed packets values to be included in certification.</param>
+        /// <param name="hashAlgorithm">The hash algorithm.</param>
+        /// <exception cref="Org.BouncyCastle.Bcpg.OpenPgp.PgpException">exception adding subkey: </exception>
+        /// <exception cref="PgpException"></exception>
+        public void AddSubKey(
+            PgpKeyPair keyPair,
+            PgpSignatureSubpacketVector hashedPackets,
+            PgpSignatureSubpacketVector unhashedPackets,
+            HashAlgorithmTag hashAlgorithm)
+        {
+            try
             {
-                PgpSignatureGenerator sGen = new PgpSignatureGenerator(
-					masterKey.PublicKey.Algorithm, HashAlgorithmTag.Sha1);
+                PgpSignatureGenerator sGen = new PgpSignatureGenerator(masterKey.PublicKey.Algorithm, hashAlgorithm);
 
-				//
+                //
                 // Generate the certification
                 //
                 sGen.InitSign(PgpSignature.SubkeyBinding, masterKey.PrivateKey);
 
-				sGen.SetHashedSubpackets(hashedPackets);
+                sGen.SetHashedSubpackets(hashedPackets);
                 sGen.SetUnhashedSubpackets(unhashedPackets);
 
-				IList subSigs = Platform.CreateArrayList();
-
-				subSigs.Add(sGen.GenerateCertification(masterKey.PublicKey, keyPair.PublicKey));
+                IList subSigs = Platform.CreateArrayList();
+                subSigs.Add(sGen.GenerateCertification(masterKey.PublicKey, keyPair.PublicKey));
 
-				keys.Add(new PgpSecretKey(keyPair.PrivateKey, new PgpPublicKey(keyPair.PublicKey, null, subSigs), encAlgorithm,
+                keys.Add(new PgpSecretKey(keyPair.PrivateKey, new PgpPublicKey(keyPair.PublicKey, null, subSigs), encAlgorithm,
                     rawPassPhrase, false, useSha1, rand, false));
-			}
-            catch (PgpException e)
+            }
+            catch (PgpException)
             {
-                throw e;
+                throw;
             }
             catch (Exception e)
             {
@@ -324,20 +351,22 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp
         }
 
         /// <summary>
-        /// Add a subkey with specific hashed and unhashed packets associated with it and
-        /// default certification.
+        /// Add a signing subkey with specific hashed and unhashed packets associated with it and
+        /// default certifications, including the primary-key binding signature.
         /// </summary>
         /// <param name="keyPair">Public/private key pair.</param>
         /// <param name="hashedPackets">Hashed packet values to be included in certification.</param>
         /// <param name="unhashedPackets">Unhashed packets values to be included in certification.</param>
         /// <param name="hashAlgorithm">The hash algorithm.</param>
+        /// <param name="primaryKeyBindingHashAlgorithm">The primary-key binding hash algorithm.</param>
         /// <exception cref="Org.BouncyCastle.Bcpg.OpenPgp.PgpException">exception adding subkey: </exception>
         /// <exception cref="PgpException"></exception>
         public void AddSubKey(
             PgpKeyPair keyPair,
             PgpSignatureSubpacketVector hashedPackets,
             PgpSignatureSubpacketVector unhashedPackets,
-            HashAlgorithmTag hashAlgorithm)
+            HashAlgorithmTag hashAlgorithm,
+            HashAlgorithmTag primaryKeyBindingHashAlgorithm)
         {
             try
             {
@@ -348,7 +377,17 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp
                 //
                 sGen.InitSign(PgpSignature.SubkeyBinding, masterKey.PrivateKey);
 
-                sGen.SetHashedSubpackets(hashedPackets);
+                // add primary key binding sub packet
+                PgpSignatureGenerator pGen = new PgpSignatureGenerator(keyPair.PublicKey.Algorithm, primaryKeyBindingHashAlgorithm);
+
+                pGen.InitSign(PgpSignature.PrimaryKeyBinding, keyPair.PrivateKey);
+
+                PgpSignatureSubpacketGenerator spGen = new PgpSignatureSubpacketGenerator(hashedPackets);
+
+                spGen.SetEmbeddedSignature(false,
+                        pGen.GenerateCertification(masterKey.PublicKey, keyPair.PublicKey));
+                
+                sGen.SetHashedSubpackets(spGen.Generate());
                 sGen.SetUnhashedSubpackets(unhashedPackets);
 
                 IList subSigs = Platform.CreateArrayList();
@@ -367,8 +406,7 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp
             }
         }
 
-
-		/// <summary>Return the secret key ring.</summary>
+        /// <summary>Return the secret key ring.</summary>
         public PgpSecretKeyRing GenerateSecretKeyRing()
         {
             return new PgpSecretKeyRing(keys);
diff --git a/crypto/src/openpgp/PgpSignatureGenerator.cs b/crypto/src/openpgp/PgpSignatureGenerator.cs
index c5309689f..74dff2570 100644
--- a/crypto/src/openpgp/PgpSignatureGenerator.cs
+++ b/crypto/src/openpgp/PgpSignatureGenerator.cs
@@ -75,6 +75,12 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp
 			lastb = 0;
 		}
 
+		public void InitSign(
+			int sigType,
+			ISignatureWithDigestFactory signer)
+		{
+		}
+
 		public void Update(
             byte b)
         {
diff --git a/crypto/src/openpgp/PgpSignatureSubpacketGenerator.cs b/crypto/src/openpgp/PgpSignatureSubpacketGenerator.cs
index d2177d09c..3987012ae 100644
--- a/crypto/src/openpgp/PgpSignatureSubpacketGenerator.cs
+++ b/crypto/src/openpgp/PgpSignatureSubpacketGenerator.cs
@@ -11,7 +11,33 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp
     {
         private IList list = Platform.CreateArrayList();
 
-		public void SetRevocable(
+
+        /// <summary>
+        ///Base constructor, creates an empty generator.
+        /// </summary>
+        public PgpSignatureSubpacketGenerator()
+        {
+        }
+
+        ///  <summary>
+        ///  Constructor for pre-initialising the generator from an existing one.
+        ///  </summary>
+        ///  <param name="sigSubV">
+        ///  sigSubV an initial set of subpackets.
+        ///  </param>
+        public PgpSignatureSubpacketGenerator(PgpSignatureSubpacketVector sigSubV)
+        {
+            if (sigSubV != null)
+            {
+                SignatureSubpacket[] subs = sigSubV.ToSubpacketArray();
+                for (int i = 0; i != sigSubV.Count; i++)
+                {
+                    list.Add(subs[i]);
+                }
+            }
+        }
+
+        public void SetRevocable(
             bool	isCritical,
             bool	isRevocable)
         {
diff --git a/crypto/src/openpgp/PgpSignatureSubpacketVector.cs b/crypto/src/openpgp/PgpSignatureSubpacketVector.cs
index 1d3d75941..3dc96ea90 100644
--- a/crypto/src/openpgp/PgpSignatureSubpacketVector.cs
+++ b/crypto/src/openpgp/PgpSignatureSubpacketVector.cs
@@ -1,6 +1,6 @@
 using System;
 using System.Collections;
-
+using System.IO;
 using Org.BouncyCastle.Bcpg.Sig;
 using Org.BouncyCastle.Utilities;
 
@@ -189,6 +189,26 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp
 			return false;
 		}
 
+        public PgpSignatureList GetEmbeddedSignatures()
+        {
+            SignatureSubpacket [] sigs = GetSubpackets(SignatureSubpacketTag.EmbeddedSignature);
+            PgpSignature[] l = new PgpSignature[sigs.Length];
+   
+            for (int i = 0; i < sigs.Length; i++)
+            {
+                try
+                {
+                    l[i] = new PgpSignature(SignaturePacket.FromByteArray(sigs[i].GetData()));
+                }
+                catch (IOException e)
+                {
+                    throw new PgpException("Unable to parse signature packet: " + e.Message, e);
+                }
+            }
+
+            return new PgpSignatureList(l);
+        }
+
 		public SignatureSubpacketTag[] GetCriticalTags()
         {
             int count = 0;
diff --git a/crypto/test/src/openpgp/test/PgpKeyRingTest.cs b/crypto/test/src/openpgp/test/PgpKeyRingTest.cs
index 5f1d83459..aed750318 100644
--- a/crypto/test/src/openpgp/test/PgpKeyRingTest.cs
+++ b/crypto/test/src/openpgp/test/PgpKeyRingTest.cs
@@ -2261,7 +2261,7 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp.Tests
         }
 
         [Test]
-        public void GenerateSha1Test()
+        public void GenerateSha256Test()
         {
             char[] passPhrase = "hello".ToCharArray();
 
@@ -2296,11 +2296,14 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp.Tests
 
             PgpKeyPair dsaKeyPair = new PgpKeyPair(PublicKeyAlgorithmTag.Dsa, dsaKp, DateTime.UtcNow);
             PgpKeyPair elgKeyPair = new PgpKeyPair(PublicKeyAlgorithmTag.ElGamalEncrypt, elgKp, DateTime.UtcNow);
+            PgpKeyPair dsaSubKeyPair = new PgpKeyPair(PublicKeyAlgorithmTag.Dsa, dsaKpg.GenerateKeyPair(), DateTime.UtcNow);
 
             PgpKeyRingGenerator keyRingGen = new PgpKeyRingGenerator(PgpSignature.PositiveCertification, dsaKeyPair,
                 "test", SymmetricKeyAlgorithmTag.Aes256, passPhrase, true, null, null, Random);
 
-            keyRingGen.AddSubKey(elgKeyPair);
+            keyRingGen.AddSubKey(elgKeyPair, HashAlgorithmTag.Sha256);
+
+            keyRingGen.AddSubKey(dsaSubKeyPair, HashAlgorithmTag.Sha256, HashAlgorithmTag.Sha256);
 
             PgpSecretKeyRing keyRing = keyRingGen.GenerateSecretKeyRing();
 
@@ -2310,6 +2313,7 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp.Tests
 
             PgpPublicKey vKey = null;
             PgpPublicKey sKey = null;
+            PgpPublicKey sdKey = null;
 
             foreach (PgpPublicKey pk in pubRing.GetPublicKeys())
             {
@@ -2319,7 +2323,14 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp.Tests
                 }
                 else
                 {
-                    sKey = pk;
+                    if (pk.IsEncryptionKey)
+                    {
+                        sKey = pk;
+                    }
+                    else
+                    {
+                        sdKey = pk;
+                    }
                 }
             }
 
@@ -2336,6 +2347,29 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp.Tests
                     }
                 }
             }
+
+            foreach (PgpSignature sig in sdKey.GetSignatures())
+            {
+                if (sig.KeyId == vKey.KeyId
+                    && sig.SignatureType == PgpSignature.SubkeyBinding)
+                {
+                    sig.InitVerify(vKey);
+
+                    if (!sig.VerifyCertification(vKey, sdKey))
+                    {
+                        Fail("failed to verify dsa sub-key signature.");
+                    }
+
+                    PgpSignature bindSig = sig.GetHashedSubPackets().GetEmbeddedSignatures()[0];
+
+                    bindSig.InitVerify(sdKey);
+
+                    if (!bindSig.VerifyCertification(vKey, sdKey))
+                    {
+                        Fail("failed to verify dsa sub-key primary binding signature.");
+                    }
+                }
+            }
         }
 
         [Test]
@@ -2574,7 +2608,7 @@ namespace Org.BouncyCastle.Bcpg.OpenPgp.Tests
             PerformTest11();
 
             GenerateTest();
-            GenerateSha1Test();
+            GenerateSha256Test();
             RewrapTest();
             PublicKeyRingWithX509Test();
             SecretKeyRingWithPersonalCertificateTest();