Bump github.com/go-git/go-git/v5 from 5.4.2 to 5.11.0

Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.4.2 to 5.11.0.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.4.2...v5.11.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

vendor/github.com/ProtonMail/go-crypto/bitcurves/bitcurve.go

@@ -191,7 +191,7 @@ func (bitCurve *BitCurve) doubleJacobian(x, y, z *big.Int) (*big.Int, *big.Int,
 	return x3, y3, z3
 }
 
-//TODO: double check if it is okay
+// TODO: double check if it is okay
 // ScalarMult returns k*(Bx,By) where k is a number in big-endian form.
 func (bitCurve *BitCurve) ScalarMult(Bx, By *big.Int, k []byte) (*big.Int, *big.Int) {
 	// We have a slight problem in that the identity of the group (the
@@ -239,7 +239,7 @@ func (bitCurve *BitCurve) ScalarBaseMult(k []byte) (*big.Int, *big.Int) {
 
 var mask = []byte{0xff, 0x1, 0x3, 0x7, 0xf, 0x1f, 0x3f, 0x7f}
 
-//TODO: double check if it is okay
+// TODO: double check if it is okay
 // GenerateKey returns a public/private key pair. The private key is generated
 // using the given reader, which must return random data.
 func (bitCurve *BitCurve) GenerateKey(rand io.Reader) (priv []byte, x, y *big.Int, err error) {

vendor/github.com/ProtonMail/go-crypto/brainpool/brainpool.go

@@ -1,7 +1,7 @@
 // Package brainpool implements Brainpool elliptic curves.
 // Implementation of rcurves is from github.com/ebfe/brainpool
 // Note that these curves are implemented with naive, non-constant time operations
-// and are likely not suitable for enviroments where timing attacks are a concern.
+// and are likely not suitable for environments where timing attacks are a concern.
 package brainpool
 
 import (

vendor/github.com/ProtonMail/go-crypto/brainpool/rcurve.go

@@ -80,4 +80,4 @@ func (curve *rcurve) ScalarMult(x1, y1 *big.Int, scalar []byte) (x, y *big.Int)
 
 func (curve *rcurve) ScalarBaseMult(scalar []byte) (x, y *big.Int) {
 	return curve.fromTwisted(curve.twisted.ScalarBaseMult(scalar))
-}
+}

vendor/github.com/ProtonMail/go-crypto/eax/eax.go

@@ -67,7 +67,7 @@ func (e *eax) Seal(dst, nonce, plaintext, adata []byte) []byte {
 	if len(nonce) > e.nonceSize {
 		panic("crypto/eax: Nonce too long for this instance")
 	}
-	ret, out := byteutil.SliceForAppend(dst, len(plaintext) + e.tagSize)
+	ret, out := byteutil.SliceForAppend(dst, len(plaintext)+e.tagSize)
 	omacNonce := e.omacT(0, nonce)
 	omacAdata := e.omacT(1, adata)
 
@@ -85,7 +85,7 @@ func (e *eax) Seal(dst, nonce, plaintext, adata []byte) []byte {
 	return ret
 }
 
-func (e* eax) Open(dst, nonce, ciphertext, adata []byte) ([]byte, error) {
+func (e *eax) Open(dst, nonce, ciphertext, adata []byte) ([]byte, error) {
 	if len(nonce) > e.nonceSize {
 		panic("crypto/eax: Nonce too long for this instance")
 	}

vendor/github.com/ProtonMail/go-crypto/internal/byteutil/byteutil.go

@@ -41,7 +41,7 @@ func ShiftNBytesLeft(dst, x []byte, n int) {
 	bits := uint(n % 8)
 	l := len(dst)
 	for i := 0; i < l-1; i++ {
-		dst[i] = (dst[i] << bits) | (dst[i+1] >> uint(8 - bits))
+		dst[i] = (dst[i] << bits) | (dst[i+1] >> uint(8-bits))
 	}
 	dst[l-1] = dst[l-1] << bits
 
@@ -56,7 +56,6 @@ func XorBytesMut(X, Y []byte) {
 	}
 }
 
-
 // XorBytes assumes equal input length, puts X XOR Y into Z
 func XorBytes(Z, X, Y []byte) {
 	for i := 0; i < len(X); i++ {
@@ -67,10 +66,10 @@ func XorBytes(Z, X, Y []byte) {
 // RightXor XORs smaller input (assumed Y) at the right of the larger input (assumed X)
 func RightXor(X, Y []byte) []byte {
 	offset := len(X) - len(Y)
-	xored := make([]byte, len(X));
+	xored := make([]byte, len(X))
 	copy(xored, X)
 	for i := 0; i < len(Y); i++ {
-		xored[offset + i] ^= Y[i]
+		xored[offset+i] ^= Y[i]
 	}
 	return xored
 }
@@ -89,4 +88,3 @@ func SliceForAppend(in []byte, n int) (head, tail []byte) {
 	tail = head[len(in):]
 	return
 }
-

vendor/github.com/ProtonMail/go-crypto/ocb/ocb.go

@@ -93,13 +93,13 @@ func NewOCBWithNonceAndTagSize(
 		return nil, ocbError("Custom tag length exceeds blocksize")
 	}
 	return &ocb{
-		block:        block,
-		tagSize:      tagSize,
-		nonceSize:    nonceSize,
-		mask:         initializeMaskTable(block),
+		block:     block,
+		tagSize:   tagSize,
+		nonceSize: nonceSize,
+		mask:      initializeMaskTable(block),
 		reusableKtop: reusableKtop{
 			noncePrefix: nil,
-			Ktop: nil,
+			Ktop:        nil,
 		},
 	}, nil
 }

vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_a.go

@@ -5,7 +5,7 @@ import (
 )
 
 // Test vectors from https://tools.ietf.org/html/rfc7253. Note that key is
-// shared accross tests.
+// shared across tests.
 var testKey, _ = hex.DecodeString("000102030405060708090A0B0C0D0E0F")
 
 var rfc7253testVectors = []struct {

vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_b.go

@@ -4,21 +4,22 @@ package ocb
 var rfc7253TestVectorTaglen96 = struct {
 	key, nonce, header, plaintext, ciphertext string
 }{"0F0E0D0C0B0A09080706050403020100",
-		"BBAA9988776655443322110D",
-		"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627",
-		"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627",
-		"1792A4E31E0755FB03E31B22116E6C2DDF9EFD6E33D536F1A0124B0A55BAE884ED93481529C76B6AD0C515F4D1CDD4FDAC4F02AA"}
+	"BBAA9988776655443322110D",
+	"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627",
+	"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627",
+	"1792A4E31E0755FB03E31B22116E6C2DDF9EFD6E33D536F1A0124B0A55BAE884ED93481529C76B6AD0C515F4D1CDD4FDAC4F02AA"}
 
 var rfc7253AlgorithmTest = []struct {
 	KEYLEN, TAGLEN int
-	OUTPUT string }{
-		{128, 128, "67E944D23256C5E0B6C61FA22FDF1EA2"},
-		{192, 128, "F673F2C3E7174AAE7BAE986CA9F29E17"},
-		{256, 128, "D90EB8E9C977C88B79DD793D7FFA161C"},
-		{128, 96, "77A3D8E73589158D25D01209"},
-		{192, 96, "05D56EAD2752C86BE6932C5E"},
-		{256, 96, "5458359AC23B0CBA9E6330DD"},
-		{128, 64, "192C9B7BD90BA06A"},
-		{192, 64, "0066BC6E0EF34E24"},
-		{256, 64, "7D4EA5D445501CBE"},
-	}
+	OUTPUT         string
+}{
+	{128, 128, "67E944D23256C5E0B6C61FA22FDF1EA2"},
+	{192, 128, "F673F2C3E7174AAE7BAE986CA9F29E17"},
+	{256, 128, "D90EB8E9C977C88B79DD793D7FFA161C"},
+	{128, 96, "77A3D8E73589158D25D01209"},
+	{192, 96, "05D56EAD2752C86BE6932C5E"},
+	{256, 96, "5458359AC23B0CBA9E6330DD"},
+	{128, 64, "192C9B7BD90BA06A"},
+	{192, 64, "0066BC6E0EF34E24"},
+	{256, 64, "7D4EA5D445501CBE"},
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/armor/armor.go

@@ -10,19 +10,22 @@ import (
 	"bufio"
 	"bytes"
 	"encoding/base64"
-	"github.com/ProtonMail/go-crypto/openpgp/errors"
 	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
 )
 
 // A Block represents an OpenPGP armored structure.
 //
 // The encoded form is:
-//    -----BEGIN Type-----
-//    Headers
 //
-//    base64-encoded Bytes
-//    '=' base64 encoded checksum
-//    -----END Type-----
+//	-----BEGIN Type-----
+//	Headers
+//
+//	base64-encoded Bytes
+//	'=' base64 encoded checksum
+//	-----END Type-----
+//
 // where Headers is a possibly empty sequence of Key: Value lines.
 //
 // Since the armored data can be very large, this package presents a streaming
@@ -206,12 +209,16 @@ TryNextBlock:
 			break
 		}
 
-		i := bytes.Index(line, []byte(": "))
+		i := bytes.Index(line, []byte(":"))
 		if i == -1 {
 			goto TryNextBlock
 		}
 		lastKey = string(line[:i])
-		p.Header[lastKey] = string(line[i+2:])
+		var value string
+		if len(line) > i+2 {
+			value = string(line[i+2:])
+		}
+		p.Header[lastKey] = value
 	}
 
 	p.lReader.in = r

vendor/github.com/ProtonMail/go-crypto/openpgp/armor/encode.go

@@ -96,7 +96,8 @@ func (l *lineBreaker) Close() (err error) {
 // trailer.
 //
 // It's built into a stack of io.Writers:
-//    encoding -> base64 encoder -> lineBreaker -> out
+//
+//	encoding -> base64 encoder -> lineBreaker -> out
 type encoding struct {
 	out       io.Writer
 	breaker   *lineBreaker

vendor/github.com/ProtonMail/go-crypto/openpgp/ecdh/ecdh.go

@@ -8,10 +8,8 @@ package ecdh
 
 import (
 	"bytes"
-	"crypto/elliptic"
 	"errors"
 	"io"
-	"math/big"
 
 	"github.com/ProtonMail/go-crypto/openpgp/aes/keywrap"
 	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
@@ -24,9 +22,8 @@ type KDF struct {
 }
 
 type PublicKey struct {
-	ecc.CurveType
-	elliptic.Curve
-	X, Y *big.Int
+	curve ecc.ECDHCurve
+	Point []byte
 	KDF
 }
 
@@ -35,11 +32,56 @@ type PrivateKey struct {
 	D []byte
 }
 
-func GenerateKey(c elliptic.Curve, kdf KDF, rand io.Reader) (priv *PrivateKey, err error) {
+func NewPublicKey(curve ecc.ECDHCurve, kdfHash algorithm.Hash, kdfCipher algorithm.Cipher) *PublicKey {
+	return &PublicKey{
+		curve: curve,
+		KDF: KDF{
+			Hash:   kdfHash,
+			Cipher: kdfCipher,
+		},
+	}
+}
+
+func NewPrivateKey(key PublicKey) *PrivateKey {
+	return &PrivateKey{
+		PublicKey: key,
+	}
+}
+
+func (pk *PublicKey) GetCurve() ecc.ECDHCurve {
+	return pk.curve
+}
+
+func (pk *PublicKey) MarshalPoint() []byte {
+	return pk.curve.MarshalBytePoint(pk.Point)
+}
+
+func (pk *PublicKey) UnmarshalPoint(p []byte) error {
+	pk.Point = pk.curve.UnmarshalBytePoint(p)
+	if pk.Point == nil {
+		return errors.New("ecdh: failed to parse EC point")
+	}
+	return nil
+}
+
+func (sk *PrivateKey) MarshalByteSecret() []byte {
+	return sk.curve.MarshalByteSecret(sk.D)
+}
+
+func (sk *PrivateKey) UnmarshalByteSecret(d []byte) error {
+	sk.D = sk.curve.UnmarshalByteSecret(d)
+
+	if sk.D == nil {
+		return errors.New("ecdh: failed to parse scalar")
+	}
+	return nil
+}
+
+func GenerateKey(rand io.Reader, c ecc.ECDHCurve, kdf KDF) (priv *PrivateKey, err error) {
 	priv = new(PrivateKey)
-	priv.PublicKey.Curve = c
+	priv.PublicKey.curve = c
 	priv.PublicKey.KDF = kdf
-	priv.D, priv.PublicKey.X, priv.PublicKey.Y, err = elliptic.GenerateKey(c, rand)
+	priv.PublicKey.Point, priv.D, err = c.GenerateECDH(rand)
 	return
 }
 
@@ -56,22 +98,12 @@ func Encrypt(random io.Reader, pub *PublicKey, msg, curveOID, fingerprint []byte
 	}
 	m := append(msg, padding...)
 
-	if pub.CurveType == ecc.Curve25519 {
-		return X25519Encrypt(random, pub, m, curveOID, fingerprint)
-	}
-
-	d, x, y, err := elliptic.GenerateKey(pub.Curve, random)
+	ephemeral, zb, err := pub.curve.Encaps(random, pub.Point)
 	if err != nil {
 		return nil, nil, err
 	}
 
-	vsG = elliptic.Marshal(pub.Curve, x, y)
-	zbBig, _ := pub.Curve.ScalarMult(pub.X, pub.Y, d)
-
-	byteLen := (pub.Curve.Params().BitSize + 7) >> 3
-	zb := make([]byte, byteLen)
-	zbBytes := zbBig.Bytes()
-	copy(zb[byteLen-len(zbBytes):], zbBytes)
+	vsG = pub.curve.MarshalBytePoint(ephemeral)
 
 	z, err := buildKey(pub, zb, curveOID, fingerprint, false, false)
 	if err != nil {
@@ -86,29 +118,34 @@ func Encrypt(random io.Reader, pub *PublicKey, msg, curveOID, fingerprint []byte
 
 }
 
-func Decrypt(priv *PrivateKey, vsG, m, curveOID, fingerprint []byte) (msg []byte, err error) {
-	if priv.PublicKey.CurveType == ecc.Curve25519 {
-		return X25519Decrypt(priv, vsG, m, curveOID, fingerprint)
+func Decrypt(priv *PrivateKey, vsG, c, curveOID, fingerprint []byte) (msg []byte, err error) {
+	var m []byte
+	zb, err := priv.PublicKey.curve.Decaps(priv.curve.UnmarshalBytePoint(vsG), priv.D)
+
+	// Try buildKey three times to workaround an old bug, see comments in buildKey.
+	for i := 0; i < 3; i++ {
+		var z []byte
+		// RFC6637 §8: "Compute Z = KDF( S, Z_len, Param );"
+		z, err = buildKey(&priv.PublicKey, zb, curveOID, fingerprint, i == 1, i == 2)
+		if err != nil {
+			return nil, err
+		}
+
+		// RFC6637 §8: "Compute C = AESKeyWrap( Z, c ) as per [RFC3394]"
+		m, err = keywrap.Unwrap(z, c)
+		if err == nil {
+			break
+		}
 	}
-	x, y := elliptic.Unmarshal(priv.Curve, vsG)
-	zbBig, _ := priv.Curve.ScalarMult(x, y, priv.D)
 
-	byteLen := (priv.Curve.Params().BitSize + 7) >> 3
-	zb := make([]byte, byteLen)
-	zbBytes := zbBig.Bytes()
-	copy(zb[byteLen-len(zbBytes):], zbBytes)
-
-	z, err := buildKey(&priv.PublicKey, zb, curveOID, fingerprint, false, false)
+	// Only return an error after we've tried all (required) variants of buildKey.
 	if err != nil {
 		return nil, err
 	}
 
-	c, err := keywrap.Unwrap(z, m)
-	if err != nil {
-		return nil, err
-	}
-
-	return c[:len(c)-int(c[len(c)-1])], nil
+	// RFC6637 §8: "m = symm_alg_ID || session key || checksum || pkcs5_padding"
+	// The last byte should be the length of the padding, as per PKCS5; strip it off.
+	return m[:len(m)-int(m[len(m)-1])], nil
 }
 
 func buildKey(pub *PublicKey, zb []byte, curveOID, fingerprint []byte, stripLeading, stripTrailing bool) ([]byte, error) {
@@ -130,7 +167,7 @@ func buildKey(pub *PublicKey, zb []byte, curveOID, fingerprint []byte, stripLead
 	if _, err := param.Write(fingerprint[:20]); err != nil {
 		return nil, err
 	}
-	if param.Len() - len(curveOID) != 45 {
+	if param.Len()-len(curveOID) != 45 {
 		return nil, errors.New("ecdh: malformed KDF Param")
 	}
 
@@ -144,15 +181,19 @@ func buildKey(pub *PublicKey, zb []byte, curveOID, fingerprint []byte, stripLead
 	j := zbLen - 1
 	if stripLeading {
 		// Work around old go crypto bug where the leading zeros are missing.
-		for ; i < zbLen && zb[i] == 0; i++ {}
+		for i < zbLen && zb[i] == 0 {
+			i++
+		}
 	}
 	if stripTrailing {
 		// Work around old OpenPGP.js bug where insignificant trailing zeros in
 		// this little-endian number are missing.
 		// (See https://github.com/openpgpjs/openpgpjs/pull/853.)
-		for ; j >= 0 && zb[j] == 0; j-- {}
+		for j >= 0 && zb[j] == 0 {
+			j--
+		}
 	}
-	if _, err := h.Write(zb[i:j+1]); err != nil {
+	if _, err := h.Write(zb[i : j+1]); err != nil {
 		return nil, err
 	}
 	if _, err := h.Write(param.Bytes()); err != nil {
@@ -163,3 +204,7 @@ func buildKey(pub *PublicKey, zb []byte, curveOID, fingerprint []byte, stripLead
 	return mb[:pub.KDF.Cipher.KeySize()], nil // return oBits leftmost bits of MB.
 
 }
+
+func Validate(priv *PrivateKey) error {
+	return priv.curve.ValidateECDH(priv.Point, priv.D)
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/ecdh/x25519.go

@@ -1,157 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package ecdh implements ECDH encryption, suitable for OpenPGP,
-// as specified in RFC 6637, section 8.
-package ecdh
-
-import (
-	"errors"
-	"io"
-	"math/big"
-
-	"github.com/ProtonMail/go-crypto/openpgp/aes/keywrap"
-	"github.com/ProtonMail/go-crypto/openpgp/internal/ecc"
-	"golang.org/x/crypto/curve25519"
-)
-
-// Generates a private-public key-pair.
-// 'priv' is a private key; a scalar belonging to the set
-// 2^{254} + 8 * [0, 2^{251}), in order to avoid the small subgroup of the
-// curve. 'pub' is simply 'priv' * G where G is the base point.
-// See https://cr.yp.to/ecdh.html and RFC7748, sec 5.
-func x25519GenerateKeyPairBytes(rand io.Reader) (priv [32]byte, pub [32]byte, err error) {
-	var n, helper = new(big.Int), new(big.Int)
-	n.SetUint64(1)
-	n.Lsh(n, 252)
-	helper.SetString("27742317777372353535851937790883648493", 10)
-	n.Add(n, helper)
-
-	for true {
-		_, err = io.ReadFull(rand, priv[:])
-		if err != nil {
-			return
-		}
-		// The following ensures that the private key is a number of the form
-		// 2^{254} + 8 * [0, 2^{251}), in order to avoid the small subgroup of
-		// of the curve.
-		priv[0] &= 248
-		priv[31] &= 127
-		priv[31] |= 64
-
-		// If the scalar is out of range, sample another random number.
-		if new(big.Int).SetBytes(priv[:]).Cmp(n) >= 0 {
-			continue
-		}
-
-		curve25519.ScalarBaseMult(&pub, &priv)
-		return
-	}
-	return
-}
-
-// X25519GenerateKey samples the key pair according to the correct distribution.
-// It also sets the given key-derivation function and returns the *PrivateKey
-// object along with an error.
-func X25519GenerateKey(rand io.Reader, kdf KDF) (priv *PrivateKey, err error) {
-	ci := ecc.FindByName("Curve25519")
-	priv = new(PrivateKey)
-	priv.PublicKey.Curve = ci.Curve
-	d, pubKey, err := x25519GenerateKeyPairBytes(rand)
-	if err != nil {
-		return nil, err
-	}
-	priv.PublicKey.KDF = kdf
-	priv.D = make([]byte, 32)
-	copyReversed(priv.D, d[:])
-	priv.PublicKey.CurveType = ci.CurveType
-	priv.PublicKey.Curve = ci.Curve
-	/*
-	 * Note that ECPoint.point differs from the definition of public keys in
-	 * [Curve25519] in two ways: (1) the byte-ordering is big-endian, which is
-	 * more uniform with how big integers are represented in TLS, and (2) there
-	 * is an additional length byte (so ECpoint.point is actually 33 bytes),
-	 * again for uniformity (and extensibility).
-	 */
-	var encodedKey = make([]byte, 33)
-	encodedKey[0] = 0x40
-	copy(encodedKey[1:], pubKey[:])
-	priv.PublicKey.X = new(big.Int).SetBytes(encodedKey[:])
-	priv.PublicKey.Y = new(big.Int)
-	return priv, nil
-}
-
-func X25519Encrypt(random io.Reader, pub *PublicKey, msg, curveOID, fingerprint []byte) (vsG, c []byte, err error) {
-	d, ephemeralKey, err := x25519GenerateKeyPairBytes(random)
-	if err != nil {
-		return nil, nil, err
-	}
-	var pubKey [32]byte
-
-	if pub.X.BitLen() > 33*264 {
-		return nil, nil, errors.New("ecdh: invalid key")
-	}
-	copy(pubKey[:], pub.X.Bytes()[1:])
-
-	var zb [32]byte
-	curve25519.ScalarBaseMult(&zb, &d)
-	curve25519.ScalarMult(&zb, &d, &pubKey)
-	z, err := buildKey(pub, zb[:], curveOID, fingerprint, false, false)
-
-	if err != nil {
-		return nil, nil, err
-	}
-
-	if c, err = keywrap.Wrap(z, msg); err != nil {
-		return nil, nil, err
-	}
-
-	var vsg [33]byte
-	vsg[0] = 0x40
-	copy(vsg[1:], ephemeralKey[:])
-
-	return vsg[:], c, nil
-}
-
-func X25519Decrypt(priv *PrivateKey, vsG, m, curveOID, fingerprint []byte) (msg []byte, err error) {
-	var zb, d, ephemeralKey [32]byte
-	if len(vsG) != 33 || vsG[0] != 0x40 {
-		return nil, errors.New("ecdh: invalid key")
-	}
-	copy(ephemeralKey[:], vsG[1:33])
-
-	copyReversed(d[:], priv.D)
-	curve25519.ScalarBaseMult(&zb, &d)
-	curve25519.ScalarMult(&zb, &d, &ephemeralKey)
-
-	var c []byte
-
-	for i := 0; i < 3; i++ {
-		// Try buildKey three times for compat, see comments in buildKey.
-		z, err := buildKey(&priv.PublicKey, zb[:], curveOID, fingerprint, i == 1, i == 2)
-		if err != nil {
-			return nil, err
-		}
-
-		res, err := keywrap.Unwrap(z, m)
-		if i == 2 && err != nil {
-			// Only return an error after we've tried all variants of buildKey.
-			return nil, err
-		}
-
-		c = res
-		if err == nil {
-			break
-		}
-	}
-
-	return c[:len(c)-int(c[len(c)-1])], nil
-}
-
-func copyReversed(out []byte, in []byte) {
-	l := len(in)
-	for i := 0; i < l; i++ {
-		out[i] = in[l-i-1]
-	}
-}

vendor/github.com/ProtonMail/go-crypto/openpgp/ecdsa/ecdsa.go

@@ -0,0 +1,80 @@
+// Package ecdsa implements ECDSA signature, suitable for OpenPGP,
+// as specified in RFC 6637, section 5.
+package ecdsa
+
+import (
+	"errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/ecc"
+	"io"
+	"math/big"
+)
+
+type PublicKey struct {
+	X, Y  *big.Int
+	curve ecc.ECDSACurve
+}
+
+type PrivateKey struct {
+	PublicKey
+	D *big.Int
+}
+
+func NewPublicKey(curve ecc.ECDSACurve) *PublicKey {
+	return &PublicKey{
+		curve: curve,
+	}
+}
+
+func NewPrivateKey(key PublicKey) *PrivateKey {
+	return &PrivateKey{
+		PublicKey: key,
+	}
+}
+
+func (pk *PublicKey) GetCurve() ecc.ECDSACurve {
+	return pk.curve
+}
+
+func (pk *PublicKey) MarshalPoint() []byte {
+	return pk.curve.MarshalIntegerPoint(pk.X, pk.Y)
+}
+
+func (pk *PublicKey) UnmarshalPoint(p []byte) error {
+	pk.X, pk.Y = pk.curve.UnmarshalIntegerPoint(p)
+	if pk.X == nil {
+		return errors.New("ecdsa: failed to parse EC point")
+	}
+	return nil
+}
+
+func (sk *PrivateKey) MarshalIntegerSecret() []byte {
+	return sk.curve.MarshalIntegerSecret(sk.D)
+}
+
+func (sk *PrivateKey) UnmarshalIntegerSecret(d []byte) error {
+	sk.D = sk.curve.UnmarshalIntegerSecret(d)
+
+	if sk.D == nil {
+		return errors.New("ecdsa: failed to parse scalar")
+	}
+	return nil
+}
+
+func GenerateKey(rand io.Reader, c ecc.ECDSACurve) (priv *PrivateKey, err error) {
+	priv = new(PrivateKey)
+	priv.PublicKey.curve = c
+	priv.PublicKey.X, priv.PublicKey.Y, priv.D, err = c.GenerateECDSA(rand)
+	return
+}
+
+func Sign(rand io.Reader, priv *PrivateKey, hash []byte) (r, s *big.Int, err error) {
+	return priv.PublicKey.curve.Sign(rand, priv.X, priv.Y, priv.D, hash)
+}
+
+func Verify(pub *PublicKey, hash []byte, r, s *big.Int) bool {
+	return pub.curve.Verify(pub.X, pub.Y, hash, r, s)
+}
+
+func Validate(priv *PrivateKey) error {
+	return priv.curve.ValidateECDSA(priv.X, priv.Y, priv.D.Bytes())
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/eddsa/eddsa.go

@@ -0,0 +1,91 @@
+// Package eddsa implements EdDSA signature, suitable for OpenPGP, as specified in
+// https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-13.7
+package eddsa
+
+import (
+	"errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/ecc"
+	"io"
+)
+
+type PublicKey struct {
+	X     []byte
+	curve ecc.EdDSACurve
+}
+
+type PrivateKey struct {
+	PublicKey
+	D []byte
+}
+
+func NewPublicKey(curve ecc.EdDSACurve) *PublicKey {
+	return &PublicKey{
+		curve: curve,
+	}
+}
+
+func NewPrivateKey(key PublicKey) *PrivateKey {
+	return &PrivateKey{
+		PublicKey: key,
+	}
+}
+
+func (pk *PublicKey) GetCurve() ecc.EdDSACurve {
+	return pk.curve
+}
+
+func (pk *PublicKey) MarshalPoint() []byte {
+	return pk.curve.MarshalBytePoint(pk.X)
+}
+
+func (pk *PublicKey) UnmarshalPoint(x []byte) error {
+	pk.X = pk.curve.UnmarshalBytePoint(x)
+
+	if pk.X == nil {
+		return errors.New("eddsa: failed to parse EC point")
+	}
+	return nil
+}
+
+func (sk *PrivateKey) MarshalByteSecret() []byte {
+	return sk.curve.MarshalByteSecret(sk.D)
+}
+
+func (sk *PrivateKey) UnmarshalByteSecret(d []byte) error {
+	sk.D = sk.curve.UnmarshalByteSecret(d)
+
+	if sk.D == nil {
+		return errors.New("eddsa: failed to parse scalar")
+	}
+	return nil
+}
+
+func GenerateKey(rand io.Reader, c ecc.EdDSACurve) (priv *PrivateKey, err error) {
+	priv = new(PrivateKey)
+	priv.PublicKey.curve = c
+	priv.PublicKey.X, priv.D, err = c.GenerateEdDSA(rand)
+	return
+}
+
+func Sign(priv *PrivateKey, message []byte) (r, s []byte, err error) {
+	sig, err := priv.PublicKey.curve.Sign(priv.PublicKey.X, priv.D, message)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	r, s = priv.PublicKey.curve.MarshalSignature(sig)
+	return
+}
+
+func Verify(pub *PublicKey, message, r, s []byte) bool {
+	sig := pub.curve.UnmarshalSignature(r, s)
+	if sig == nil {
+		return false
+	}
+
+	return pub.curve.Verify(pub.X, message, sig)
+}
+
+func Validate(priv *PrivateKey) error {
+	return priv.curve.ValidateEdDSA(priv.PublicKey.X, priv.D)
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/elgamal/elgamal.go

@@ -71,8 +71,8 @@ func Encrypt(random io.Reader, pub *PublicKey, msg []byte) (c1, c2 *big.Int, err
 // returns the plaintext of the message. An error can result only if the
 // ciphertext is invalid. Users should keep in mind that this is a padding
 // oracle and thus, if exposed to an adaptive chosen ciphertext attack, can
-// be used to break the cryptosystem.  See ``Chosen Ciphertext Attacks
-// Against Protocols Based on the RSA Encryption Standard PKCS #1'', Daniel
+// be used to break the cryptosystem.  See “Chosen Ciphertext Attacks
+// Against Protocols Based on the RSA Encryption Standard PKCS #1”, Daniel
 // Bleichenbacher, Advances in Cryptology (Crypto '98),
 func Decrypt(priv *PrivateKey, c1, c2 *big.Int) (msg []byte, err error) {
 	s := new(big.Int).Exp(c1, priv.X, priv.P)

vendor/github.com/ProtonMail/go-crypto/openpgp/hash.go

@@ -0,0 +1,24 @@
+package openpgp
+
+import (
+	"crypto"
+
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+)
+
+// HashIdToHash returns a crypto.Hash which corresponds to the given OpenPGP
+// hash id.
+func HashIdToHash(id byte) (h crypto.Hash, ok bool) {
+	return algorithm.HashIdToHash(id)
+}
+
+// HashIdToString returns the name of the hash function corresponding to the
+// given OpenPGP hash id.
+func HashIdToString(id byte) (name string, ok bool) {
+	return algorithm.HashIdToString(id)
+}
+
+// HashToHashId returns an OpenPGP hash id which corresponds the given Hash.
+func HashToHashId(h crypto.Hash) (id byte, ok bool) {
+	return algorithm.HashToHashId(h)
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/aead.go

@@ -16,7 +16,7 @@ type AEADMode uint8
 const (
 	AEADModeEAX = AEADMode(1)
 	AEADModeOCB = AEADMode(2)
-	AEADModeGCM = AEADMode(100)
+	AEADModeGCM = AEADMode(3)
 )
 
 // TagLength returns the length in bytes of authentication tags.

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/hash.go

@@ -32,26 +32,25 @@ type Hash interface {
 
 // The following vars mirror the crypto/Hash supported hash functions.
 var (
-	MD5       Hash = cryptoHash{1, crypto.MD5}
-	SHA1      Hash = cryptoHash{2, crypto.SHA1}
-	RIPEMD160 Hash = cryptoHash{3, crypto.RIPEMD160}
-	SHA256    Hash = cryptoHash{8, crypto.SHA256}
-	SHA384    Hash = cryptoHash{9, crypto.SHA384}
-	SHA512    Hash = cryptoHash{10, crypto.SHA512}
-	SHA224    Hash = cryptoHash{11, crypto.SHA224}
+	SHA1     Hash = cryptoHash{2, crypto.SHA1}
+	SHA256   Hash = cryptoHash{8, crypto.SHA256}
+	SHA384   Hash = cryptoHash{9, crypto.SHA384}
+	SHA512   Hash = cryptoHash{10, crypto.SHA512}
+	SHA224   Hash = cryptoHash{11, crypto.SHA224}
+	SHA3_256 Hash = cryptoHash{12, crypto.SHA3_256}
+	SHA3_512 Hash = cryptoHash{14, crypto.SHA3_512}
 )
 
 // HashById represents the different hash functions specified for OpenPGP. See
 // http://www.iana.org/assignments/pgp-parameters/pgp-parameters.xhtml#pgp-parameters-14
 var (
 	HashById = map[uint8]Hash{
-		MD5.Id():       MD5,
-		SHA1.Id():      SHA1,
-		RIPEMD160.Id(): RIPEMD160,
-		SHA256.Id():    SHA256,
-		SHA384.Id():    SHA384,
-		SHA512.Id():    SHA512,
-		SHA224.Id():    SHA224,
+		SHA256.Id():   SHA256,
+		SHA384.Id():   SHA384,
+		SHA512.Id():   SHA512,
+		SHA224.Id():   SHA224,
+		SHA3_256.Id(): SHA3_256,
+		SHA3_512.Id(): SHA3_512,
 	}
 )
 
@@ -68,13 +67,12 @@ func (h cryptoHash) Id() uint8 {
 }
 
 var hashNames = map[uint8]string{
-	MD5.Id():       "MD5",
-	SHA1.Id():      "SHA1",
-	RIPEMD160.Id(): "RIPEMD160",
-	SHA256.Id():    "SHA256",
-	SHA384.Id():    "SHA384",
-	SHA512.Id():    "SHA512",
-	SHA224.Id():    "SHA224",
+	SHA256.Id():   "SHA256",
+	SHA384.Id():   "SHA384",
+	SHA512.Id():   "SHA512",
+	SHA224.Id():   "SHA224",
+	SHA3_256.Id(): "SHA3-256",
+	SHA3_512.Id(): "SHA3-512",
 }
 
 func (h cryptoHash) String() string {
@@ -84,3 +82,62 @@ func (h cryptoHash) String() string {
 	}
 	return s
 }
+
+// HashIdToHash returns a crypto.Hash which corresponds to the given OpenPGP
+// hash id.
+func HashIdToHash(id byte) (h crypto.Hash, ok bool) {
+	if hash, ok := HashById[id]; ok {
+		return hash.HashFunc(), true
+	}
+	return 0, false
+}
+
+// HashIdToHashWithSha1 returns a crypto.Hash which corresponds to the given OpenPGP
+// hash id, allowing sha1.
+func HashIdToHashWithSha1(id byte) (h crypto.Hash, ok bool) {
+	if hash, ok := HashById[id]; ok {
+		return hash.HashFunc(), true
+	}
+
+	if id == SHA1.Id() {
+		return SHA1.HashFunc(), true
+	}
+
+	return 0, false
+}
+
+// HashIdToString returns the name of the hash function corresponding to the
+// given OpenPGP hash id.
+func HashIdToString(id byte) (name string, ok bool) {
+	if hash, ok := HashById[id]; ok {
+		return hash.String(), true
+	}
+	return "", false
+}
+
+// HashToHashId returns an OpenPGP hash id which corresponds the given Hash.
+func HashToHashId(h crypto.Hash) (id byte, ok bool) {
+	for id, hash := range HashById {
+		if hash.HashFunc() == h {
+			return id, true
+		}
+	}
+
+	return 0, false
+}
+
+// HashToHashIdWithSha1 returns an OpenPGP hash id which corresponds the given Hash,
+// allowing instances of SHA1
+func HashToHashIdWithSha1(h crypto.Hash) (id byte, ok bool) {
+	for id, hash := range HashById {
+		if hash.HashFunc() == h {
+			return id, true
+		}
+	}
+
+	if h == SHA1.HashFunc() {
+		return SHA1.Id(), true
+	}
+
+	return 0, false
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve25519.go

@@ -0,0 +1,171 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"crypto/subtle"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	x25519lib "github.com/cloudflare/circl/dh/x25519"
+)
+
+type curve25519 struct{}
+
+func NewCurve25519() *curve25519 {
+	return &curve25519{}
+}
+
+func (c *curve25519) GetCurveName() string {
+	return "curve25519"
+}
+
+// MarshalBytePoint encodes the public point from native format, adding the prefix.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6
+func (c *curve25519) MarshalBytePoint(point []byte) []byte {
+	return append([]byte{0x40}, point...)
+}
+
+// UnmarshalBytePoint decodes the public point to native format, removing the prefix.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6
+func (c *curve25519) UnmarshalBytePoint(point []byte) []byte {
+	if len(point) != x25519lib.Size+1 {
+		return nil
+	}
+
+	// Remove prefix
+	return point[1:]
+}
+
+// MarshalByteSecret encodes the secret scalar from native format.
+// Note that the EC secret scalar differs from the definition of public keys in
+// [Curve25519] in two ways: (1) the byte-ordering is big-endian, which is
+// more uniform with how big integers are represented in OpenPGP, and (2) the
+// leading zeros are truncated.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6.1.1
+// Note that leading zero bytes are stripped later when encoding as an MPI.
+func (c *curve25519) MarshalByteSecret(secret []byte) []byte {
+	d := make([]byte, x25519lib.Size)
+	copyReversed(d, secret)
+
+	// The following ensures that the private key is a number of the form
+	// 2^{254} + 8 * [0, 2^{251}), in order to avoid the small subgroup of
+	// the curve.
+	//
+	// This masking is done internally in the underlying lib and so is unnecessary
+	// for security, but OpenPGP implementations require that private keys be
+	// pre-masked.
+	d[0] &= 127
+	d[0] |= 64
+	d[31] &= 248
+
+	return d
+}
+
+// UnmarshalByteSecret decodes the secret scalar from native format.
+// Note that the EC secret scalar differs from the definition of public keys in
+// [Curve25519] in two ways: (1) the byte-ordering is big-endian, which is
+// more uniform with how big integers are represented in OpenPGP, and (2) the
+// leading zeros are truncated.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6.1.1
+func (c *curve25519) UnmarshalByteSecret(d []byte) []byte {
+	if len(d) > x25519lib.Size {
+		return nil
+	}
+
+	// Ensure truncated leading bytes are re-added
+	secret := make([]byte, x25519lib.Size)
+	copyReversed(secret, d)
+
+	return secret
+}
+
+// generateKeyPairBytes Generates a private-public key-pair.
+// 'priv' is a private key; a little-endian scalar belonging to the set
+// 2^{254} + 8 * [0, 2^{251}), in order to avoid the small subgroup of the
+// curve. 'pub' is simply 'priv' * G where G is the base point.
+// See https://cr.yp.to/ecdh.html and RFC7748, sec 5.
+func (c *curve25519) generateKeyPairBytes(rand io.Reader) (priv, pub x25519lib.Key, err error) {
+	_, err = io.ReadFull(rand, priv[:])
+	if err != nil {
+		return
+	}
+
+	x25519lib.KeyGen(&pub, &priv)
+	return
+}
+
+func (c *curve25519) GenerateECDH(rand io.Reader) (point []byte, secret []byte, err error) {
+	priv, pub, err := c.generateKeyPairBytes(rand)
+	if err != nil {
+		return
+	}
+
+	return pub[:], priv[:], nil
+}
+
+func (c *genericCurve) MaskSecret(secret []byte) []byte {
+	return secret
+}
+
+func (c *curve25519) Encaps(rand io.Reader, point []byte) (ephemeral, sharedSecret []byte, err error) {
+	// RFC6637 §8: "Generate an ephemeral key pair {v, V=vG}"
+	// ephemeralPrivate corresponds to `v`.
+	// ephemeralPublic corresponds to `V`.
+	ephemeralPrivate, ephemeralPublic, err := c.generateKeyPairBytes(rand)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// RFC6637 §8: "Obtain the authenticated recipient public key R"
+	// pubKey corresponds to `R`.
+	var pubKey x25519lib.Key
+	copy(pubKey[:], point)
+
+	// RFC6637 §8: "Compute the shared point S = vR"
+	//	"VB = convert point V to the octet string"
+	// sharedPoint corresponds to `VB`.
+	var sharedPoint x25519lib.Key
+	x25519lib.Shared(&sharedPoint, &ephemeralPrivate, &pubKey)
+
+	return ephemeralPublic[:], sharedPoint[:], nil
+}
+
+func (c *curve25519) Decaps(vsG, secret []byte) (sharedSecret []byte, err error) {
+	var ephemeralPublic, decodedPrivate, sharedPoint x25519lib.Key
+	// RFC6637 §8: "The decryption is the inverse of the method given."
+	// All quoted descriptions in comments below describe encryption, and
+	// the reverse is performed.
+	// vsG corresponds to `VB` in RFC6637 §8 .
+
+	// RFC6637 §8: "VB = convert point V to the octet string"
+	copy(ephemeralPublic[:], vsG)
+
+	// decodedPrivate corresponds to `r` in RFC6637 §8 .
+	copy(decodedPrivate[:], secret)
+
+	// RFC6637 §8: "Note that the recipient obtains the shared secret by calculating
+	//   S = rV = rvG, where (r,R) is the recipient's key pair."
+	// sharedPoint corresponds to `S`.
+	x25519lib.Shared(&sharedPoint, &decodedPrivate, &ephemeralPublic)
+
+	return sharedPoint[:], nil
+}
+
+func (c *curve25519) ValidateECDH(point []byte, secret []byte) (err error) {
+	var pk, sk x25519lib.Key
+	copy(sk[:], secret)
+	x25519lib.KeyGen(&pk, &sk)
+
+	if subtle.ConstantTimeCompare(point, pk[:]) == 0 {
+		return errors.KeyInvalidError("ecc: invalid curve25519 public point")
+	}
+
+	return nil
+}
+
+func copyReversed(out []byte, in []byte) {
+	l := len(in)
+	for i := 0; i < l; i++ {
+		out[i] = in[l-i-1]
+	}
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curveInfo.go

@@ -1,118 +0,0 @@
-package ecc
-
-import (
-	"github.com/ProtonMail/go-crypto/openpgp/internal/encoding"
-	"crypto/elliptic"
-	"bytes"
-	"github.com/ProtonMail/go-crypto/bitcurves"
-	"github.com/ProtonMail/go-crypto/brainpool"
-)
-
-type SignatureAlgorithm uint8
-
-const (
-	ECDSA SignatureAlgorithm = 1
-	EdDSA SignatureAlgorithm = 2
-)
-
-type CurveInfo struct {
-	Name string
-	Oid *encoding.OID
-	Curve elliptic.Curve
-	SigAlgorithm SignatureAlgorithm
-	CurveType CurveType
-}
-
-var curves = []CurveInfo{
-	{
-		Name: "NIST curve P-256",
-		Oid: encoding.NewOID([]byte{0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07}),
-		Curve: elliptic.P256(),
-		CurveType: NISTCurve,
-		SigAlgorithm: ECDSA,
-	},
-	{
-		Name: "NIST curve P-384",
-		Oid: encoding.NewOID([]byte{0x2B, 0x81, 0x04, 0x00, 0x22}),
-		Curve: elliptic.P384(),
-		CurveType: NISTCurve,
-		SigAlgorithm: ECDSA,
-	},
-	{
-		Name: "NIST curve P-521",
-		Oid: encoding.NewOID([]byte{0x2B, 0x81, 0x04, 0x00, 0x23}),
-		Curve: elliptic.P521(),
-		CurveType: NISTCurve,
-		SigAlgorithm: ECDSA,
-	},
-	{
-		Name: "SecP256k1",
-		Oid: encoding.NewOID([]byte{0x2B, 0x81, 0x04, 0x00, 0x0A}),
-		Curve: bitcurves.S256(),
-		CurveType: BitCurve,
-		SigAlgorithm: ECDSA,
-	},
-	{
-		Name: "Curve25519",
-		Oid: encoding.NewOID([]byte{0x2B, 0x06, 0x01, 0x04, 0x01, 0x97, 0x55, 0x01, 0x05, 0x01}),
-		Curve: elliptic.P256(),// filler
-		CurveType: Curve25519,
-		SigAlgorithm: ECDSA,
-	},
-	{
-		Name: "Ed25519",
-		Oid: encoding.NewOID([]byte{0x2B, 0x06, 0x01, 0x04, 0x01, 0xDA, 0x47, 0x0F, 0x01}),
-		Curve: elliptic.P256(), // filler
-		CurveType: NISTCurve,
-		SigAlgorithm: EdDSA,
-	},
-	{
-		Name: "Brainpool P256r1",
-		Oid: encoding.NewOID([]byte{0x2B, 0x24, 0x03, 0x03, 0x02, 0x08, 0x01, 0x01, 0x07}),
-		Curve: brainpool.P256r1(),
-		CurveType: BrainpoolCurve,
-		SigAlgorithm: ECDSA,
-	},
-	{
-		Name: "BrainpoolP384r1",
-		Oid: encoding.NewOID([]byte{0x2B, 0x24, 0x03, 0x03, 0x02, 0x08, 0x01, 0x01, 0x0B}),
-		Curve: brainpool.P384r1(),
-		CurveType: BrainpoolCurve,
-		SigAlgorithm: ECDSA,
-	},
-	{
-		Name: "BrainpoolP512r1",
-		Oid: encoding.NewOID([]byte{0x2B, 0x24, 0x03, 0x03, 0x02, 0x08, 0x01, 0x01, 0x0D}),
-		Curve: brainpool.P512r1(),
-		CurveType: BrainpoolCurve,
-		SigAlgorithm: ECDSA,
-	},
-}
-
-func FindByCurve(curve elliptic.Curve) *CurveInfo {
-	for _, curveInfo := range curves {
-		if curveInfo.Curve == curve {
-			return &curveInfo
-		}
-	}
-	return nil
-}
-
-func FindByOid(oid encoding.Field) *CurveInfo {
-	var rawBytes = oid.Bytes()
-	for _, curveInfo := range curves {
-		if bytes.Equal(curveInfo.Oid.Bytes(), rawBytes) {
-			return &curveInfo
-		}
-	}
-	return nil
-}
-
-func FindByName(name string) *CurveInfo {
-	for _, curveInfo := range curves {
-		if curveInfo.Name == name {
-			return &curveInfo
-		}
-	}
-	return nil
-}

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curveType.go

@@ -1,10 +0,0 @@
-package ecc
-
-type CurveType uint8
-
-const (
-    NISTCurve CurveType = 1
-	Curve25519 CurveType = 2
-	BitCurve CurveType = 3
-	BrainpoolCurve CurveType = 4
-)

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve_info.go

@@ -0,0 +1,140 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"bytes"
+	"crypto/elliptic"
+	"github.com/ProtonMail/go-crypto/bitcurves"
+	"github.com/ProtonMail/go-crypto/brainpool"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/encoding"
+)
+
+type CurveInfo struct {
+	GenName string
+	Oid     *encoding.OID
+	Curve   Curve
+}
+
+var Curves = []CurveInfo{
+	{
+		// NIST P-256
+		GenName: "P256",
+		Oid:     encoding.NewOID([]byte{0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07}),
+		Curve:   NewGenericCurve(elliptic.P256()),
+	},
+	{
+		// NIST P-384
+		GenName: "P384",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x81, 0x04, 0x00, 0x22}),
+		Curve:   NewGenericCurve(elliptic.P384()),
+	},
+	{
+		// NIST P-521
+		GenName: "P521",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x81, 0x04, 0x00, 0x23}),
+		Curve:   NewGenericCurve(elliptic.P521()),
+	},
+	{
+		// SecP256k1
+		GenName: "SecP256k1",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x81, 0x04, 0x00, 0x0A}),
+		Curve:   NewGenericCurve(bitcurves.S256()),
+	},
+	{
+		// Curve25519
+		GenName: "Curve25519",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x06, 0x01, 0x04, 0x01, 0x97, 0x55, 0x01, 0x05, 0x01}),
+		Curve:   NewCurve25519(),
+	},
+	{
+		// X448
+		GenName: "Curve448",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x65, 0x6F}),
+		Curve:   NewX448(),
+	},
+	{
+		// Ed25519
+		GenName: "Curve25519",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x06, 0x01, 0x04, 0x01, 0xDA, 0x47, 0x0F, 0x01}),
+		Curve:   NewEd25519(),
+	},
+	{
+		// Ed448
+		GenName: "Curve448",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x65, 0x71}),
+		Curve:   NewEd448(),
+	},
+	{
+		// BrainpoolP256r1
+		GenName: "BrainpoolP256",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x24, 0x03, 0x03, 0x02, 0x08, 0x01, 0x01, 0x07}),
+		Curve:   NewGenericCurve(brainpool.P256r1()),
+	},
+	{
+		// BrainpoolP384r1
+		GenName: "BrainpoolP384",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x24, 0x03, 0x03, 0x02, 0x08, 0x01, 0x01, 0x0B}),
+		Curve:   NewGenericCurve(brainpool.P384r1()),
+	},
+	{
+		// BrainpoolP512r1
+		GenName: "BrainpoolP512",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x24, 0x03, 0x03, 0x02, 0x08, 0x01, 0x01, 0x0D}),
+		Curve:   NewGenericCurve(brainpool.P512r1()),
+	},
+}
+
+func FindByCurve(curve Curve) *CurveInfo {
+	for _, curveInfo := range Curves {
+		if curveInfo.Curve.GetCurveName() == curve.GetCurveName() {
+			return &curveInfo
+		}
+	}
+	return nil
+}
+
+func FindByOid(oid encoding.Field) *CurveInfo {
+	var rawBytes = oid.Bytes()
+	for _, curveInfo := range Curves {
+		if bytes.Equal(curveInfo.Oid.Bytes(), rawBytes) {
+			return &curveInfo
+		}
+	}
+	return nil
+}
+
+func FindEdDSAByGenName(curveGenName string) EdDSACurve {
+	for _, curveInfo := range Curves {
+		if curveInfo.GenName == curveGenName {
+			curve, ok := curveInfo.Curve.(EdDSACurve)
+			if ok {
+				return curve
+			}
+		}
+	}
+	return nil
+}
+
+func FindECDSAByGenName(curveGenName string) ECDSACurve {
+	for _, curveInfo := range Curves {
+		if curveInfo.GenName == curveGenName {
+			curve, ok := curveInfo.Curve.(ECDSACurve)
+			if ok {
+				return curve
+			}
+		}
+	}
+	return nil
+}
+
+func FindECDHByGenName(curveGenName string) ECDHCurve {
+	for _, curveInfo := range Curves {
+		if curveInfo.GenName == curveGenName {
+			curve, ok := curveInfo.Curve.(ECDHCurve)
+			if ok {
+				return curve
+			}
+		}
+	}
+	return nil
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curves.go

@@ -0,0 +1,48 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"io"
+	"math/big"
+)
+
+type Curve interface {
+	GetCurveName() string
+}
+
+type ECDSACurve interface {
+	Curve
+	MarshalIntegerPoint(x, y *big.Int) []byte
+	UnmarshalIntegerPoint([]byte) (x, y *big.Int)
+	MarshalIntegerSecret(d *big.Int) []byte
+	UnmarshalIntegerSecret(d []byte) *big.Int
+	GenerateECDSA(rand io.Reader) (x, y, secret *big.Int, err error)
+	Sign(rand io.Reader, x, y, d *big.Int, hash []byte) (r, s *big.Int, err error)
+	Verify(x, y *big.Int, hash []byte, r, s *big.Int) bool
+	ValidateECDSA(x, y *big.Int, secret []byte) error
+}
+
+type EdDSACurve interface {
+	Curve
+	MarshalBytePoint(x []byte) []byte
+	UnmarshalBytePoint([]byte) (x []byte)
+	MarshalByteSecret(d []byte) []byte
+	UnmarshalByteSecret(d []byte) []byte
+	MarshalSignature(sig []byte) (r, s []byte)
+	UnmarshalSignature(r, s []byte) (sig []byte)
+	GenerateEdDSA(rand io.Reader) (pub, priv []byte, err error)
+	Sign(publicKey, privateKey, message []byte) (sig []byte, err error)
+	Verify(publicKey, message, sig []byte) bool
+	ValidateEdDSA(publicKey, privateKey []byte) (err error)
+}
+type ECDHCurve interface {
+	Curve
+	MarshalBytePoint([]byte) (encoded []byte)
+	UnmarshalBytePoint(encoded []byte) []byte
+	MarshalByteSecret(d []byte) []byte
+	UnmarshalByteSecret(d []byte) []byte
+	GenerateECDH(rand io.Reader) (point []byte, secret []byte, err error)
+	Encaps(rand io.Reader, point []byte) (ephemeral, sharedSecret []byte, err error)
+	Decaps(ephemeral, secret []byte) (sharedSecret []byte, err error)
+	ValidateECDH(public []byte, secret []byte) error
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed25519.go

@@ -0,0 +1,112 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"crypto/subtle"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	ed25519lib "github.com/cloudflare/circl/sign/ed25519"
+)
+
+const ed25519Size = 32
+
+type ed25519 struct{}
+
+func NewEd25519() *ed25519 {
+	return &ed25519{}
+}
+
+func (c *ed25519) GetCurveName() string {
+	return "ed25519"
+}
+
+// MarshalBytePoint encodes the public point from native format, adding the prefix.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed25519) MarshalBytePoint(x []byte) []byte {
+	return append([]byte{0x40}, x...)
+}
+
+// UnmarshalBytePoint decodes a point from prefixed format to native.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed25519) UnmarshalBytePoint(point []byte) (x []byte) {
+	if len(point) != ed25519lib.PublicKeySize+1 {
+		return nil
+	}
+
+	// Return unprefixed
+	return point[1:]
+}
+
+// MarshalByteSecret encodes a scalar in native format.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed25519) MarshalByteSecret(d []byte) []byte {
+	return d
+}
+
+// UnmarshalByteSecret decodes a scalar in native format and re-adds the stripped leading zeroes
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed25519) UnmarshalByteSecret(s []byte) (d []byte) {
+	if len(s) > ed25519lib.SeedSize {
+		return nil
+	}
+
+	// Handle stripped leading zeroes
+	d = make([]byte, ed25519lib.SeedSize)
+	copy(d[ed25519lib.SeedSize-len(s):], s)
+	return
+}
+
+// MarshalSignature splits a signature in R and S.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.2.3.3.1
+func (c *ed25519) MarshalSignature(sig []byte) (r, s []byte) {
+	return sig[:ed25519Size], sig[ed25519Size:]
+}
+
+// UnmarshalSignature decodes R and S in the native format, re-adding the stripped leading zeroes
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.2.3.3.1
+func (c *ed25519) UnmarshalSignature(r, s []byte) (sig []byte) {
+	// Check size
+	if len(r) > 32 || len(s) > 32 {
+		return nil
+	}
+
+	sig = make([]byte, ed25519lib.SignatureSize)
+
+	// Handle stripped leading zeroes
+	copy(sig[ed25519Size-len(r):ed25519Size], r)
+	copy(sig[ed25519lib.SignatureSize-len(s):], s)
+	return sig
+}
+
+func (c *ed25519) GenerateEdDSA(rand io.Reader) (pub, priv []byte, err error) {
+	pk, sk, err := ed25519lib.GenerateKey(rand)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return pk, sk[:ed25519lib.SeedSize], nil
+}
+
+func getEd25519Sk(publicKey, privateKey []byte) ed25519lib.PrivateKey {
+	return append(privateKey, publicKey...)
+}
+
+func (c *ed25519) Sign(publicKey, privateKey, message []byte) (sig []byte, err error) {
+	sig = ed25519lib.Sign(getEd25519Sk(publicKey, privateKey), message)
+	return sig, nil
+}
+
+func (c *ed25519) Verify(publicKey, message, sig []byte) bool {
+	return ed25519lib.Verify(publicKey, message, sig)
+}
+
+func (c *ed25519) ValidateEdDSA(publicKey, privateKey []byte) (err error) {
+	priv := getEd25519Sk(publicKey, privateKey)
+	expectedPriv := ed25519lib.NewKeyFromSeed(priv.Seed())
+	if subtle.ConstantTimeCompare(priv, expectedPriv) == 0 {
+		return errors.KeyInvalidError("ecc: invalid ed25519 secret")
+	}
+	return nil
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed448.go

@@ -0,0 +1,111 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"crypto/subtle"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	ed448lib "github.com/cloudflare/circl/sign/ed448"
+)
+
+type ed448 struct{}
+
+func NewEd448() *ed448 {
+	return &ed448{}
+}
+
+func (c *ed448) GetCurveName() string {
+	return "ed448"
+}
+
+// MarshalBytePoint encodes the public point from native format, adding the prefix.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed448) MarshalBytePoint(x []byte) []byte {
+	// Return prefixed
+	return append([]byte{0x40}, x...)
+}
+
+// UnmarshalBytePoint decodes a point from prefixed format to native.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed448) UnmarshalBytePoint(point []byte) (x []byte) {
+	if len(point) != ed448lib.PublicKeySize+1 {
+		return nil
+	}
+
+	// Strip prefix
+	return point[1:]
+}
+
+// MarshalByteSecret encoded a scalar from native format to prefixed.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed448) MarshalByteSecret(d []byte) []byte {
+	// Return prefixed
+	return append([]byte{0x40}, d...)
+}
+
+// UnmarshalByteSecret decodes a scalar from prefixed format to native.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed448) UnmarshalByteSecret(s []byte) (d []byte) {
+	// Check prefixed size
+	if len(s) != ed448lib.SeedSize+1 {
+		return nil
+	}
+
+	// Strip prefix
+	return s[1:]
+}
+
+// MarshalSignature splits a signature in R and S, where R is in prefixed native format and
+// S is an MPI with value zero.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.2.3.3.2
+func (c *ed448) MarshalSignature(sig []byte) (r, s []byte) {
+	return append([]byte{0x40}, sig...), []byte{}
+}
+
+// UnmarshalSignature decodes R and S in the native format. Only R is used, in prefixed native format.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.2.3.3.2
+func (c *ed448) UnmarshalSignature(r, s []byte) (sig []byte) {
+	if len(r) != ed448lib.SignatureSize+1 {
+		return nil
+	}
+
+	return r[1:]
+}
+
+func (c *ed448) GenerateEdDSA(rand io.Reader) (pub, priv []byte, err error) {
+	pk, sk, err := ed448lib.GenerateKey(rand)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return pk, sk[:ed448lib.SeedSize], nil
+}
+
+func getEd448Sk(publicKey, privateKey []byte) ed448lib.PrivateKey {
+	return append(privateKey, publicKey...)
+}
+
+func (c *ed448) Sign(publicKey, privateKey, message []byte) (sig []byte, err error) {
+	// Ed448 is used with the empty string as a context string.
+	// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-13.7
+	sig = ed448lib.Sign(getEd448Sk(publicKey, privateKey), message, "")
+
+	return sig, nil
+}
+
+func (c *ed448) Verify(publicKey, message, sig []byte) bool {
+	// Ed448 is used with the empty string as a context string.
+	// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-13.7
+	return ed448lib.Verify(publicKey, message, sig, "")
+}
+
+func (c *ed448) ValidateEdDSA(publicKey, privateKey []byte) (err error) {
+	priv := getEd448Sk(publicKey, privateKey)
+	expectedPriv := ed448lib.NewKeyFromSeed(priv.Seed())
+	if subtle.ConstantTimeCompare(priv, expectedPriv) == 0 {
+		return errors.KeyInvalidError("ecc: invalid ed448 secret")
+	}
+	return nil
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/generic.go

@@ -0,0 +1,149 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"fmt"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"io"
+	"math/big"
+)
+
+type genericCurve struct {
+	Curve elliptic.Curve
+}
+
+func NewGenericCurve(c elliptic.Curve) *genericCurve {
+	return &genericCurve{
+		Curve: c,
+	}
+}
+
+func (c *genericCurve) GetCurveName() string {
+	return c.Curve.Params().Name
+}
+
+func (c *genericCurve) MarshalBytePoint(point []byte) []byte {
+	return point
+}
+
+func (c *genericCurve) UnmarshalBytePoint(point []byte) []byte {
+	return point
+}
+
+func (c *genericCurve) MarshalIntegerPoint(x, y *big.Int) []byte {
+	return elliptic.Marshal(c.Curve, x, y)
+}
+
+func (c *genericCurve) UnmarshalIntegerPoint(point []byte) (x, y *big.Int) {
+	return elliptic.Unmarshal(c.Curve, point)
+}
+
+func (c *genericCurve) MarshalByteSecret(d []byte) []byte {
+	return d
+}
+
+func (c *genericCurve) UnmarshalByteSecret(d []byte) []byte {
+	return d
+}
+
+func (c *genericCurve) MarshalIntegerSecret(d *big.Int) []byte {
+	return d.Bytes()
+}
+
+func (c *genericCurve) UnmarshalIntegerSecret(d []byte) *big.Int {
+	return new(big.Int).SetBytes(d)
+}
+
+func (c *genericCurve) GenerateECDH(rand io.Reader) (point, secret []byte, err error) {
+	secret, x, y, err := elliptic.GenerateKey(c.Curve, rand)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	point = elliptic.Marshal(c.Curve, x, y)
+	return point, secret, nil
+}
+
+func (c *genericCurve) GenerateECDSA(rand io.Reader) (x, y, secret *big.Int, err error) {
+	priv, err := ecdsa.GenerateKey(c.Curve, rand)
+	if err != nil {
+		return
+	}
+
+	return priv.X, priv.Y, priv.D, nil
+}
+
+func (c *genericCurve) Encaps(rand io.Reader, point []byte) (ephemeral, sharedSecret []byte, err error) {
+	xP, yP := elliptic.Unmarshal(c.Curve, point)
+	if xP == nil {
+		panic("invalid point")
+	}
+
+	d, x, y, err := elliptic.GenerateKey(c.Curve, rand)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	vsG := elliptic.Marshal(c.Curve, x, y)
+	zbBig, _ := c.Curve.ScalarMult(xP, yP, d)
+
+	byteLen := (c.Curve.Params().BitSize + 7) >> 3
+	zb := make([]byte, byteLen)
+	zbBytes := zbBig.Bytes()
+	copy(zb[byteLen-len(zbBytes):], zbBytes)
+
+	return vsG, zb, nil
+}
+
+func (c *genericCurve) Decaps(ephemeral, secret []byte) (sharedSecret []byte, err error) {
+	x, y := elliptic.Unmarshal(c.Curve, ephemeral)
+	zbBig, _ := c.Curve.ScalarMult(x, y, secret)
+	byteLen := (c.Curve.Params().BitSize + 7) >> 3
+	zb := make([]byte, byteLen)
+	zbBytes := zbBig.Bytes()
+	copy(zb[byteLen-len(zbBytes):], zbBytes)
+
+	return zb, nil
+}
+
+func (c *genericCurve) Sign(rand io.Reader, x, y, d *big.Int, hash []byte) (r, s *big.Int, err error) {
+	priv := &ecdsa.PrivateKey{D: d, PublicKey: ecdsa.PublicKey{X: x, Y: y, Curve: c.Curve}}
+	return ecdsa.Sign(rand, priv, hash)
+}
+
+func (c *genericCurve) Verify(x, y *big.Int, hash []byte, r, s *big.Int) bool {
+	pub := &ecdsa.PublicKey{X: x, Y: y, Curve: c.Curve}
+	return ecdsa.Verify(pub, hash, r, s)
+}
+
+func (c *genericCurve) validate(xP, yP *big.Int, secret []byte) error {
+	// the public point should not be at infinity (0,0)
+	zero := new(big.Int)
+	if xP.Cmp(zero) == 0 && yP.Cmp(zero) == 0 {
+		return errors.KeyInvalidError(fmt.Sprintf("ecc (%s): infinity point", c.Curve.Params().Name))
+	}
+
+	// re-derive the public point Q' = (X,Y) = dG
+	// to compare to declared Q in public key
+	expectedX, expectedY := c.Curve.ScalarBaseMult(secret)
+	if xP.Cmp(expectedX) != 0 || yP.Cmp(expectedY) != 0 {
+		return errors.KeyInvalidError(fmt.Sprintf("ecc (%s): invalid point", c.Curve.Params().Name))
+	}
+
+	return nil
+}
+
+func (c *genericCurve) ValidateECDSA(xP, yP *big.Int, secret []byte) error {
+	return c.validate(xP, yP, secret)
+}
+
+func (c *genericCurve) ValidateECDH(point []byte, secret []byte) error {
+	xP, yP := elliptic.Unmarshal(c.Curve, point)
+	if xP == nil {
+		return errors.KeyInvalidError(fmt.Sprintf("ecc (%s): invalid point", c.Curve.Params().Name))
+	}
+
+	return c.validate(xP, yP, secret)
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/x448.go

@@ -0,0 +1,105 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"crypto/subtle"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	x448lib "github.com/cloudflare/circl/dh/x448"
+)
+
+type x448 struct{}
+
+func NewX448() *x448 {
+	return &x448{}
+}
+
+func (c *x448) GetCurveName() string {
+	return "x448"
+}
+
+// MarshalBytePoint encodes the public point from native format, adding the prefix.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6
+func (c *x448) MarshalBytePoint(point []byte) []byte {
+	return append([]byte{0x40}, point...)
+}
+
+// UnmarshalBytePoint decodes a point from prefixed format to native.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6
+func (c *x448) UnmarshalBytePoint(point []byte) []byte {
+	if len(point) != x448lib.Size+1 {
+		return nil
+	}
+
+	return point[1:]
+}
+
+// MarshalByteSecret encoded a scalar from native format to prefixed.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6.1.2
+func (c *x448) MarshalByteSecret(d []byte) []byte {
+	return append([]byte{0x40}, d...)
+}
+
+// UnmarshalByteSecret decodes a scalar from prefixed format to native.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6.1.2
+func (c *x448) UnmarshalByteSecret(d []byte) []byte {
+	if len(d) != x448lib.Size+1 {
+		return nil
+	}
+
+	// Store without prefix
+	return d[1:]
+}
+
+func (c *x448) generateKeyPairBytes(rand io.Reader) (sk, pk x448lib.Key, err error) {
+	if _, err = rand.Read(sk[:]); err != nil {
+		return
+	}
+
+	x448lib.KeyGen(&pk, &sk)
+	return
+}
+
+func (c *x448) GenerateECDH(rand io.Reader) (point []byte, secret []byte, err error) {
+	priv, pub, err := c.generateKeyPairBytes(rand)
+	if err != nil {
+		return
+	}
+
+	return pub[:], priv[:], nil
+}
+
+func (c *x448) Encaps(rand io.Reader, point []byte) (ephemeral, sharedSecret []byte, err error) {
+	var pk, ss x448lib.Key
+	seed, e, err := c.generateKeyPairBytes(rand)
+
+	copy(pk[:], point)
+	x448lib.Shared(&ss, &seed, &pk)
+
+	return e[:], ss[:], nil
+}
+
+func (c *x448) Decaps(ephemeral, secret []byte) (sharedSecret []byte, err error) {
+	var ss, sk, e x448lib.Key
+
+	copy(sk[:], secret)
+	copy(e[:], ephemeral)
+	x448lib.Shared(&ss, &sk, &e)
+
+	return ss[:], nil
+}
+
+func (c *x448) ValidateECDH(point []byte, secret []byte) error {
+	var sk, pk, expectedPk x448lib.Key
+
+	copy(pk[:], point)
+	copy(sk[:], secret)
+	x448lib.KeyGen(&expectedPk, &sk)
+
+	if subtle.ConstantTimeCompare(expectedPk[:], pk[:]) == 0 {
+		return errors.KeyInvalidError("ecc: invalid curve25519 public point")
+	}
+
+	return nil
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/oid.go

@@ -32,7 +32,7 @@ func NewOID(bytes []byte) *OID {
 		panic("encoding: NewOID argument length is reserved")
 	default:
 		if len(bytes) > maxOID {
-			panic("encoding: NewOID argment too large")
+			panic("encoding: NewOID argument too large")
 		}
 	}
 

vendor/github.com/ProtonMail/go-crypto/openpgp/key_generation.go

@@ -11,12 +11,15 @@ import (
 	goerrors "errors"
 	"io"
 	"math/big"
+	"time"
 
 	"github.com/ProtonMail/go-crypto/openpgp/ecdh"
+	"github.com/ProtonMail/go-crypto/openpgp/ecdsa"
+	"github.com/ProtonMail/go-crypto/openpgp/eddsa"
 	"github.com/ProtonMail/go-crypto/openpgp/errors"
 	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/ecc"
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
-	"golang.org/x/crypto/ed25519"
 )
 
 // NewEntity returns an Entity that contains a fresh RSA/RSA keypair with a
@@ -27,11 +30,6 @@ func NewEntity(name, comment, email string, config *packet.Config) (*Entity, err
 	creationTime := config.Now()
 	keyLifetimeSecs := config.KeyLifetime()
 
-	uid := packet.NewUserId(name, comment, email)
-	if uid == nil {
-		return nil, errors.InvalidArgumentError("user id field contained invalid characters")
-	}
-
 	// Generate a primary signing key
 	primaryPrivRaw, err := newSigner(config)
 	if err != nil {
@@ -42,28 +40,66 @@ func NewEntity(name, comment, email string, config *packet.Config) (*Entity, err
 		primary.UpgradeToV5()
 	}
 
-	isPrimaryId := true
-	selfSignature := &packet.Signature{
-		Version:           primary.PublicKey.Version,
-		SigType:           packet.SigTypePositiveCert,
-		PubKeyAlgo:        primary.PublicKey.PubKeyAlgo,
-		Hash:              config.Hash(),
-		CreationTime:      creationTime,
-		KeyLifetimeSecs:   &keyLifetimeSecs,
-		IssuerKeyId:       &primary.PublicKey.KeyId,
-		IssuerFingerprint: primary.PublicKey.Fingerprint,
-		IsPrimaryId:       &isPrimaryId,
-		FlagsValid:        true,
-		FlagSign:          true,
-		FlagCertify:       true,
-		MDC:               true, // true by default, see 5.8 vs. 5.14
-		AEAD:              config.AEAD() != nil,
-		V5Keys:            config != nil && config.V5Keys,
+	e := &Entity{
+		PrimaryKey: &primary.PublicKey,
+		PrivateKey: primary,
+		Identities: make(map[string]*Identity),
+		Subkeys:    []Subkey{},
 	}
 
+	err = e.addUserId(name, comment, email, config, creationTime, keyLifetimeSecs)
+	if err != nil {
+		return nil, err
+	}
+
+	// NOTE: No key expiry here, but we will not return this subkey in EncryptionKey()
+	// if the primary/master key has expired.
+	err = e.addEncryptionSubkey(config, creationTime, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	return e, nil
+}
+
+func (t *Entity) AddUserId(name, comment, email string, config *packet.Config) error {
+	creationTime := config.Now()
+	keyLifetimeSecs := config.KeyLifetime()
+	return t.addUserId(name, comment, email, config, creationTime, keyLifetimeSecs)
+}
+
+func (t *Entity) addUserId(name, comment, email string, config *packet.Config, creationTime time.Time, keyLifetimeSecs uint32) error {
+	uid := packet.NewUserId(name, comment, email)
+	if uid == nil {
+		return errors.InvalidArgumentError("user id field contained invalid characters")
+	}
+
+	if _, ok := t.Identities[uid.Id]; ok {
+		return errors.InvalidArgumentError("user id exist")
+	}
+
+	primary := t.PrivateKey
+
+	isPrimaryId := len(t.Identities) == 0
+
+	selfSignature := createSignaturePacket(&primary.PublicKey, packet.SigTypePositiveCert, config)
+	selfSignature.CreationTime = creationTime
+	selfSignature.KeyLifetimeSecs = &keyLifetimeSecs
+	selfSignature.IsPrimaryId = &isPrimaryId
+	selfSignature.FlagsValid = true
+	selfSignature.FlagSign = true
+	selfSignature.FlagCertify = true
+	selfSignature.SEIPDv1 = true // true by default, see 5.8 vs. 5.14
+	selfSignature.SEIPDv2 = config.AEAD() != nil
+
 	// Set the PreferredHash for the SelfSignature from the packet.Config.
 	// If it is not the must-implement algorithm from rfc4880bis, append that.
-	selfSignature.PreferredHash = []uint8{hashToHashId(config.Hash())}
+	hash, ok := algorithm.HashToHashId(config.Hash())
+	if !ok {
+		return errors.UnsupportedError("unsupported preferred hash function")
+	}
+
+	selfSignature.PreferredHash = []uint8{hash}
 	if config.Hash() != crypto.SHA256 {
 		selfSignature.PreferredHash = append(selfSignature.PreferredHash, hashToHashId(crypto.SHA256))
 	}
@@ -84,66 +120,30 @@ func NewEntity(name, comment, email string, config *packet.Config) (*Entity, err
 	}
 
 	// And for DefaultMode.
-	selfSignature.PreferredAEAD = []uint8{uint8(config.AEAD().Mode())}
-	if config.AEAD().Mode() != packet.AEADModeEAX {
-		selfSignature.PreferredAEAD = append(selfSignature.PreferredAEAD, uint8(packet.AEADModeEAX))
+	modes := []uint8{uint8(config.AEAD().Mode())}
+	if config.AEAD().Mode() != packet.AEADModeOCB {
+		modes = append(modes, uint8(packet.AEADModeOCB))
+	}
+
+	// For preferred (AES256, GCM), we'll generate (AES256, GCM), (AES256, OCB), (AES128, GCM), (AES128, OCB)
+	for _, cipher := range selfSignature.PreferredSymmetric {
+		for _, mode := range modes {
+			selfSignature.PreferredCipherSuites = append(selfSignature.PreferredCipherSuites, [2]uint8{cipher, mode})
+		}
 	}
 
 	// User ID binding signature
-	err = selfSignature.SignUserId(uid.Id, &primary.PublicKey, primary, config)
+	err := selfSignature.SignUserId(uid.Id, &primary.PublicKey, primary, config)
 	if err != nil {
-		return nil, err
+		return err
 	}
-
-	// Generate an encryption subkey
-	subPrivRaw, err := newDecrypter(config)
-	if err != nil {
-		return nil, err
+	t.Identities[uid.Id] = &Identity{
+		Name:          uid.Id,
+		UserId:        uid,
+		SelfSignature: selfSignature,
+		Signatures:    []*packet.Signature{selfSignature},
 	}
-	sub := packet.NewDecrypterPrivateKey(creationTime, subPrivRaw)
-	sub.IsSubkey = true
-	sub.PublicKey.IsSubkey = true
-	if config != nil && config.V5Keys {
-		sub.UpgradeToV5()
-	}
-
-	// NOTE: No KeyLifetimeSecs here, but we will not return this subkey in EncryptionKey()
-	// if the primary/master key has expired.
-	subKey := Subkey{
-		PublicKey:  &sub.PublicKey,
-		PrivateKey: sub,
-		Sig: &packet.Signature{
-			Version:                   primary.PublicKey.Version,
-			CreationTime:              creationTime,
-			SigType:                   packet.SigTypeSubkeyBinding,
-			PubKeyAlgo:                primary.PublicKey.PubKeyAlgo,
-			Hash:                      config.Hash(),
-			FlagsValid:                true,
-			FlagEncryptStorage:        true,
-			FlagEncryptCommunications: true,
-			IssuerKeyId:               &primary.PublicKey.KeyId,
-		},
-	}
-
-	// Subkey binding signature
-	err = subKey.Sig.SignKey(subKey.PublicKey, primary, config)
-	if err != nil {
-		return nil, err
-	}
-
-	return &Entity{
-		PrimaryKey: &primary.PublicKey,
-		PrivateKey: primary,
-		Identities: map[string]*Identity{
-			uid.Id: &Identity{
-				Name:          uid.Id,
-				UserId:        uid,
-				SelfSignature: selfSignature,
-				Signatures:    []*packet.Signature{selfSignature},
-			},
-		},
-		Subkeys: []Subkey{subKey},
-	}, nil
+	return nil
 }
 
 // AddSigningSubkey adds a signing keypair as a subkey to the Entity.
@@ -157,42 +157,30 @@ func (e *Entity) AddSigningSubkey(config *packet.Config) error {
 		return err
 	}
 	sub := packet.NewSignerPrivateKey(creationTime, subPrivRaw)
+	sub.IsSubkey = true
+	if config != nil && config.V5Keys {
+		sub.UpgradeToV5()
+	}
 
 	subkey := Subkey{
 		PublicKey:  &sub.PublicKey,
 		PrivateKey: sub,
-		Sig: &packet.Signature{
-			Version:         e.PrimaryKey.Version,
-			CreationTime:    creationTime,
-			KeyLifetimeSecs: &keyLifetimeSecs,
-			SigType:         packet.SigTypeSubkeyBinding,
-			PubKeyAlgo:      e.PrimaryKey.PubKeyAlgo,
-			Hash:            config.Hash(),
-			FlagsValid:      true,
-			FlagSign:        true,
-			IssuerKeyId:     &e.PrimaryKey.KeyId,
-			EmbeddedSignature: &packet.Signature{
-				Version:      e.PrimaryKey.Version,
-				CreationTime: creationTime,
-				SigType:      packet.SigTypePrimaryKeyBinding,
-				PubKeyAlgo:   sub.PublicKey.PubKeyAlgo,
-				Hash:         config.Hash(),
-				IssuerKeyId:  &e.PrimaryKey.KeyId,
-			},
-		},
-	}
-	if config != nil && config.V5Keys {
-		subkey.PublicKey.UpgradeToV5()
 	}
+	subkey.Sig = createSignaturePacket(e.PrimaryKey, packet.SigTypeSubkeyBinding, config)
+	subkey.Sig.CreationTime = creationTime
+	subkey.Sig.KeyLifetimeSecs = &keyLifetimeSecs
+	subkey.Sig.FlagsValid = true
+	subkey.Sig.FlagSign = true
+	subkey.Sig.EmbeddedSignature = createSignaturePacket(subkey.PublicKey, packet.SigTypePrimaryKeyBinding, config)
+	subkey.Sig.EmbeddedSignature.CreationTime = creationTime
 
 	err = subkey.Sig.EmbeddedSignature.CrossSignKey(subkey.PublicKey, e.PrimaryKey, subkey.PrivateKey, config)
 	if err != nil {
 		return err
 	}
 
-	subkey.PublicKey.IsSubkey = true
-	subkey.PrivateKey.IsSubkey = true
-	if err = subkey.Sig.SignKey(subkey.PublicKey, e.PrivateKey, config); err != nil {
+	err = subkey.Sig.SignKey(subkey.PublicKey, e.PrivateKey, config)
+	if err != nil {
 		return err
 	}
 
@@ -205,36 +193,33 @@ func (e *Entity) AddSigningSubkey(config *packet.Config) error {
 func (e *Entity) AddEncryptionSubkey(config *packet.Config) error {
 	creationTime := config.Now()
 	keyLifetimeSecs := config.KeyLifetime()
+	return e.addEncryptionSubkey(config, creationTime, keyLifetimeSecs)
+}
 
+func (e *Entity) addEncryptionSubkey(config *packet.Config, creationTime time.Time, keyLifetimeSecs uint32) error {
 	subPrivRaw, err := newDecrypter(config)
 	if err != nil {
 		return err
 	}
 	sub := packet.NewDecrypterPrivateKey(creationTime, subPrivRaw)
+	sub.IsSubkey = true
+	if config != nil && config.V5Keys {
+		sub.UpgradeToV5()
+	}
 
 	subkey := Subkey{
 		PublicKey:  &sub.PublicKey,
 		PrivateKey: sub,
-		Sig: &packet.Signature{
-			Version:                   e.PrimaryKey.Version,
-			CreationTime:              creationTime,
-			KeyLifetimeSecs:           &keyLifetimeSecs,
-			SigType:                   packet.SigTypeSubkeyBinding,
-			PubKeyAlgo:                e.PrimaryKey.PubKeyAlgo,
-			Hash:                      config.Hash(),
-			FlagsValid:                true,
-			FlagEncryptStorage:        true,
-			FlagEncryptCommunications: true,
-			IssuerKeyId:               &e.PrimaryKey.KeyId,
-		},
-	}
-	if config != nil && config.V5Keys {
-		subkey.PublicKey.UpgradeToV5()
 	}
+	subkey.Sig = createSignaturePacket(e.PrimaryKey, packet.SigTypeSubkeyBinding, config)
+	subkey.Sig.CreationTime = creationTime
+	subkey.Sig.KeyLifetimeSecs = &keyLifetimeSecs
+	subkey.Sig.FlagsValid = true
+	subkey.Sig.FlagEncryptStorage = true
+	subkey.Sig.FlagEncryptCommunications = true
 
-	subkey.PublicKey.IsSubkey = true
-	subkey.PrivateKey.IsSubkey = true
-	if err = subkey.Sig.SignKey(subkey.PublicKey, e.PrivateKey, config); err != nil {
+	err = subkey.Sig.SignKey(subkey.PublicKey, e.PrivateKey, config)
+	if err != nil {
 		return err
 	}
 
@@ -243,7 +228,7 @@ func (e *Entity) AddEncryptionSubkey(config *packet.Config) error {
 }
 
 // Generates a signing key
-func newSigner(config *packet.Config) (signer crypto.Signer, err error) {
+func newSigner(config *packet.Config) (signer interface{}, err error) {
 	switch config.PublicKeyAlgorithm() {
 	case packet.PubKeyAlgoRSA:
 		bits := config.RSAModulusBits()
@@ -257,11 +242,27 @@ func newSigner(config *packet.Config) (signer crypto.Signer, err error) {
 		}
 		return rsa.GenerateKey(config.Random(), bits)
 	case packet.PubKeyAlgoEdDSA:
-		_, priv, err := ed25519.GenerateKey(config.Random())
+		curve := ecc.FindEdDSAByGenName(string(config.CurveName()))
+		if curve == nil {
+			return nil, errors.InvalidArgumentError("unsupported curve")
+		}
+
+		priv, err := eddsa.GenerateKey(config.Random(), curve)
 		if err != nil {
 			return nil, err
 		}
-		return &priv, nil
+		return priv, nil
+	case packet.PubKeyAlgoECDSA:
+		curve := ecc.FindECDSAByGenName(string(config.CurveName()))
+		if curve == nil {
+			return nil, errors.InvalidArgumentError("unsupported curve")
+		}
+
+		priv, err := ecdsa.GenerateKey(config.Random(), curve)
+		if err != nil {
+			return nil, err
+		}
+		return priv, nil
 	default:
 		return nil, errors.InvalidArgumentError("unsupported public key algorithm")
 	}
@@ -281,14 +282,18 @@ func newDecrypter(config *packet.Config) (decrypter interface{}, err error) {
 			return generateRSAKeyWithPrimes(config.Random(), 2, bits, primes)
 		}
 		return rsa.GenerateKey(config.Random(), bits)
-	case packet.PubKeyAlgoEdDSA:
-		fallthrough // When passing EdDSA, we generate an ECDH subkey
+	case packet.PubKeyAlgoEdDSA, packet.PubKeyAlgoECDSA:
+		fallthrough // When passing EdDSA or ECDSA, we generate an ECDH subkey
 	case packet.PubKeyAlgoECDH:
 		var kdf = ecdh.KDF{
 			Hash:   algorithm.SHA512,
 			Cipher: algorithm.AES256,
 		}
-		return ecdh.X25519GenerateKey(config.Random(), kdf)
+		curve := ecc.FindECDHByGenName(string(config.CurveName()))
+		if curve == nil {
+			return nil, errors.InvalidArgumentError("unsupported curve")
+		}
+		return ecdh.GenerateKey(config.Random(), curve, kdf)
 	default:
 		return nil, errors.InvalidArgumentError("unsupported public key algorithm")
 	}

vendor/github.com/ProtonMail/go-crypto/openpgp/keys.go

@@ -87,15 +87,15 @@ func (e *Entity) PrimaryIdentity() *Identity {
 }
 
 func shouldPreferIdentity(existingId, potentialNewId *Identity) bool {
-	if (existingId == nil) {
+	if existingId == nil {
 		return true
 	}
 
-	if (len(existingId.Revocations) > len(potentialNewId.Revocations)) {
+	if len(existingId.Revocations) > len(potentialNewId.Revocations) {
 		return true
 	}
 
-	if (len(existingId.Revocations) < len(potentialNewId.Revocations)) {
+	if len(existingId.Revocations) < len(potentialNewId.Revocations) {
 		return false
 	}
 
@@ -103,13 +103,13 @@ func shouldPreferIdentity(existingId, potentialNewId *Identity) bool {
 		return true
 	}
 
-	if (existingId.SelfSignature.IsPrimaryId != nil && *existingId.SelfSignature.IsPrimaryId &&
-		!(potentialNewId.SelfSignature.IsPrimaryId != nil && *potentialNewId.SelfSignature.IsPrimaryId)) {
+	if existingId.SelfSignature.IsPrimaryId != nil && *existingId.SelfSignature.IsPrimaryId &&
+		!(potentialNewId.SelfSignature.IsPrimaryId != nil && *potentialNewId.SelfSignature.IsPrimaryId) {
 		return false
 	}
 
-	if (!(existingId.SelfSignature.IsPrimaryId != nil && *existingId.SelfSignature.IsPrimaryId) &&
-		potentialNewId.SelfSignature.IsPrimaryId != nil && *potentialNewId.SelfSignature.IsPrimaryId) {
+	if !(existingId.SelfSignature.IsPrimaryId != nil && *existingId.SelfSignature.IsPrimaryId) &&
+		potentialNewId.SelfSignature.IsPrimaryId != nil && *potentialNewId.SelfSignature.IsPrimaryId {
 		return true
 	}
 
@@ -150,11 +150,9 @@ func (e *Entity) EncryptionKey(now time.Time) (Key, bool) {
 		return Key{e, subkey.PublicKey, subkey.PrivateKey, subkey.Sig, subkey.Revocations}, true
 	}
 
-	// If we don't have any candidate subkeys for encryption and
-	// the primary key doesn't have any usage metadata then we
-	// assume that the primary key is ok. Or, if the primary key is
-	// marked as ok to encrypt with, then we can obviously use it.
-	if !i.SelfSignature.FlagsValid || i.SelfSignature.FlagEncryptCommunications &&
+	// If we don't have any subkeys for encryption and the primary key
+	// is marked as OK to encrypt with, then we can use it.
+	if i.SelfSignature.FlagsValid && i.SelfSignature.FlagEncryptCommunications &&
 		e.PrimaryKey.PubKeyAlgo.CanEncrypt() {
 		return Key{e, e.PrimaryKey, e.PrivateKey, i.SelfSignature, e.Revocations}, true
 	}
@@ -162,6 +160,18 @@ func (e *Entity) EncryptionKey(now time.Time) (Key, bool) {
 	return Key{}, false
 }
 
+// CertificationKey return the best candidate Key for certifying a key with this
+// Entity.
+func (e *Entity) CertificationKey(now time.Time) (Key, bool) {
+	return e.CertificationKeyById(now, 0)
+}
+
+// CertificationKeyById return the Key for key certification with this
+// Entity and keyID.
+func (e *Entity) CertificationKeyById(now time.Time, id uint64) (Key, bool) {
+	return e.signingKeyByIdUsage(now, id, packet.KeyFlagCertify)
+}
+
 // SigningKey return the best candidate Key for signing a message with this
 // Entity.
 func (e *Entity) SigningKey(now time.Time) (Key, bool) {
@@ -171,6 +181,10 @@ func (e *Entity) SigningKey(now time.Time) (Key, bool) {
 // SigningKeyById return the Key for signing a message with this
 // Entity and keyID.
 func (e *Entity) SigningKeyById(now time.Time, id uint64) (Key, bool) {
+	return e.signingKeyByIdUsage(now, id, packet.KeyFlagSign)
+}
+
+func (e *Entity) signingKeyByIdUsage(now time.Time, id uint64, flags int) (Key, bool) {
 	// Fail to find any signing key if the...
 	i := e.PrimaryIdentity()
 	if e.PrimaryKey.KeyExpired(i.SelfSignature, now) || // primary key has expired
@@ -186,7 +200,8 @@ func (e *Entity) SigningKeyById(now time.Time, id uint64) (Key, bool) {
 	var maxTime time.Time
 	for idx, subkey := range e.Subkeys {
 		if subkey.Sig.FlagsValid &&
-			subkey.Sig.FlagSign &&
+			(flags&packet.KeyFlagCertify == 0 || subkey.Sig.FlagCertify) &&
+			(flags&packet.KeyFlagSign == 0 || subkey.Sig.FlagSign) &&
 			subkey.PublicKey.PubKeyAlgo.CanSign() &&
 			!subkey.PublicKey.KeyExpired(subkey.Sig, now) &&
 			!subkey.Sig.SigExpired(now) &&
@@ -203,10 +218,11 @@ func (e *Entity) SigningKeyById(now time.Time, id uint64) (Key, bool) {
 		return Key{e, subkey.PublicKey, subkey.PrivateKey, subkey.Sig, subkey.Revocations}, true
 	}
 
-	// If we have no candidate subkey then we assume that it's ok to sign
-	// with the primary key.  Or, if the primary key is marked as ok to
-	// sign with, then we can use it.
-	if !i.SelfSignature.FlagsValid || i.SelfSignature.FlagSign &&
+	// If we don't have any subkeys for signing and the primary key
+	// is marked as OK to sign with, then we can use it.
+	if i.SelfSignature.FlagsValid &&
+		(flags&packet.KeyFlagCertify == 0 || i.SelfSignature.FlagCertify) &&
+		(flags&packet.KeyFlagSign == 0 || i.SelfSignature.FlagSign) &&
 		e.PrimaryKey.PubKeyAlgo.CanSign() &&
 		(id == 0 || e.PrimaryKey.KeyId == id) {
 		return Key{e, e.PrimaryKey, e.PrivateKey, i.SelfSignature, e.Revocations}, true
@@ -236,6 +252,44 @@ func (e *Entity) Revoked(now time.Time) bool {
 	return revoked(e.Revocations, now)
 }
 
+// EncryptPrivateKeys encrypts all non-encrypted keys in the entity with the same key
+// derived from the provided passphrase. Public keys and dummy keys are ignored,
+// and don't cause an error to be returned.
+func (e *Entity) EncryptPrivateKeys(passphrase []byte, config *packet.Config) error {
+	var keysToEncrypt []*packet.PrivateKey
+	// Add entity private key to encrypt.
+	if e.PrivateKey != nil && !e.PrivateKey.Dummy() && !e.PrivateKey.Encrypted {
+		keysToEncrypt = append(keysToEncrypt,  e.PrivateKey)
+	}
+
+	// Add subkeys to encrypt.
+	for _, sub := range e.Subkeys {
+		if sub.PrivateKey != nil && !sub.PrivateKey.Dummy() && !sub.PrivateKey.Encrypted {
+			keysToEncrypt = append(keysToEncrypt, sub.PrivateKey)
+		}
+	}
+	return packet.EncryptPrivateKeys(keysToEncrypt, passphrase, config)
+}
+
+// DecryptPrivateKeys decrypts all encrypted keys in the entitiy with the given passphrase.
+// Avoids recomputation of similar s2k key derivations. Public keys and dummy keys are ignored,
+// and don't cause an error to be returned.
+func (e *Entity) DecryptPrivateKeys(passphrase []byte) error {
+	var keysToDecrypt []*packet.PrivateKey
+	// Add entity private key to decrypt.
+	if e.PrivateKey != nil && !e.PrivateKey.Dummy() && e.PrivateKey.Encrypted {
+		keysToDecrypt = append(keysToDecrypt, e.PrivateKey)
+	}
+
+	// Add subkeys to decrypt.
+	for _, sub := range e.Subkeys {
+		if sub.PrivateKey != nil && !sub.PrivateKey.Dummy() && sub.PrivateKey.Encrypted {
+			keysToDecrypt = append(keysToDecrypt,  sub.PrivateKey)
+		}
+	}
+	return packet.DecryptPrivateKeys(keysToDecrypt, passphrase)
+}
+
 // Revoked returns whether the identity has been revoked by a self-signature.
 // Note that third-party revocation signatures are not supported.
 func (i *Identity) Revoked(now time.Time) bool {
@@ -283,7 +337,11 @@ func (el EntityList) KeysById(id uint64) (keys []Key) {
 // the bitwise-OR of packet.KeyFlag* values.
 func (el EntityList) KeysByIdUsage(id uint64, requiredUsage byte) (keys []Key) {
 	for _, key := range el.KeysById(id) {
-		if key.SelfSignature != nil && key.SelfSignature.FlagsValid && requiredUsage != 0 {
+		if requiredUsage != 0 {
+			if key.SelfSignature == nil || !key.SelfSignature.FlagsValid {
+				continue
+			}
+
 			var usage byte
 			if key.SelfSignature.FlagCertify {
 				usage |= packet.KeyFlagCertify
@@ -311,7 +369,7 @@ func (el EntityList) KeysByIdUsage(id uint64, requiredUsage byte) (keys []Key) {
 func (el EntityList) DecryptionKeys() (keys []Key) {
 	for _, e := range el {
 		for _, subKey := range e.Subkeys {
-			if subKey.PrivateKey != nil && (!subKey.Sig.FlagsValid || subKey.Sig.FlagEncryptStorage || subKey.Sig.FlagEncryptCommunications) {
+			if subKey.PrivateKey != nil && subKey.Sig.FlagsValid && (subKey.Sig.FlagEncryptStorage || subKey.Sig.FlagEncryptCommunications) {
 				keys = append(keys, Key{e, subKey.PublicKey, subKey.PrivateKey, subKey.Sig, subKey.Revocations})
 			}
 		}
@@ -446,7 +504,7 @@ EachPacket:
 			// Else, ignoring the signature as it does not follow anything
 			// we would know to attach it to.
 		case *packet.PrivateKey:
-			if pkt.IsSubkey == false {
+			if !pkt.IsSubkey {
 				packets.Unread(p)
 				break EachPacket
 			}
@@ -455,7 +513,7 @@ EachPacket:
 				return nil, err
 			}
 		case *packet.PublicKey:
-			if pkt.IsSubkey == false {
+			if !pkt.IsSubkey {
 				packets.Unread(p)
 				break EachPacket
 			}
@@ -515,7 +573,6 @@ func addUserID(e *Entity, packets *packet.Reader, pkt *packet.UserId) error {
 			return errors.StructuralError("user ID signature with wrong type")
 		}
 
-
 		if sig.CheckKeyIdOrFingerprint(e.PrimaryKey) {
 			if err = e.PrimaryKey.VerifyUserIdSignature(pkt.Id, e.PrimaryKey, sig); err != nil {
 				return errors.StructuralError("user ID self-signature invalid: " + err.Error())
@@ -629,18 +686,12 @@ func (e *Entity) serializePrivate(w io.Writer, config *packet.Config, reSign boo
 				return
 			}
 		}
-		for _, revocation := range ident.Revocations {
-			err := revocation.Serialize(w)
+		for _, sig := range ident.Signatures {
+			err = sig.Serialize(w)
 			if err != nil {
 				return err
 			}
 		}
-		if ident.SelfSignature != nil {
-			err = ident.SelfSignature.Serialize(w)
-			if err != nil {
-				return
-			}
-		}
 	}
 	for _, subkey := range e.Subkeys {
 		err = subkey.PrivateKey.Serialize(w)
@@ -724,26 +775,31 @@ func (e *Entity) Serialize(w io.Writer) error {
 // necessary.
 // If config is nil, sensible defaults will be used.
 func (e *Entity) SignIdentity(identity string, signer *Entity, config *packet.Config) error {
-	if signer.PrivateKey == nil {
-		return errors.InvalidArgumentError("signing Entity must have a private key")
+	certificationKey, ok := signer.CertificationKey(config.Now())
+	if !ok {
+		return errors.InvalidArgumentError("no valid certification key found")
 	}
-	if signer.PrivateKey.Encrypted {
+
+	if certificationKey.PrivateKey.Encrypted {
 		return errors.InvalidArgumentError("signing Entity's private key must be decrypted")
 	}
+
 	ident, ok := e.Identities[identity]
 	if !ok {
 		return errors.InvalidArgumentError("given identity string not found in Entity")
 	}
 
-	sig := &packet.Signature{
-		Version:      signer.PrivateKey.Version,
-		SigType:      packet.SigTypeGenericCert,
-		PubKeyAlgo:   signer.PrivateKey.PubKeyAlgo,
-		Hash:         config.Hash(),
-		CreationTime: config.Now(),
-		IssuerKeyId:  &signer.PrivateKey.KeyId,
+	sig := createSignaturePacket(certificationKey.PublicKey, packet.SigTypeGenericCert, config)
+
+	signingUserID := config.SigningUserId()
+	if signingUserID != "" {
+		if _, ok := signer.Identities[signingUserID]; !ok {
+			return errors.InvalidArgumentError("signer identity string not found in signer Entity")
+		}
+		sig.SignerUserId = &signingUserID
 	}
-	if err := sig.SignUserId(identity, e.PrimaryKey, signer.PrivateKey, config); err != nil {
+
+	if err := sig.SignUserId(identity, e.PrimaryKey, certificationKey.PrivateKey, config); err != nil {
 		return err
 	}
 	ident.Signatures = append(ident.Signatures, sig)
@@ -754,16 +810,9 @@ func (e *Entity) SignIdentity(identity string, signer *Entity, config *packet.Co
 // specified reason code and text (RFC4880 section-5.2.3.23).
 // If config is nil, sensible defaults will be used.
 func (e *Entity) RevokeKey(reason packet.ReasonForRevocation, reasonText string, config *packet.Config) error {
-	revSig := &packet.Signature{
-		Version:              e.PrimaryKey.Version,
-		CreationTime:         config.Now(),
-		SigType:              packet.SigTypeKeyRevocation,
-		PubKeyAlgo:           e.PrimaryKey.PubKeyAlgo,
-		Hash:                 config.Hash(),
-		RevocationReason:     &reason,
-		RevocationReasonText: reasonText,
-		IssuerKeyId:          &e.PrimaryKey.KeyId,
-	}
+	revSig := createSignaturePacket(e.PrimaryKey, packet.SigTypeKeyRevocation, config)
+	revSig.RevocationReason = &reason
+	revSig.RevocationReasonText = reasonText
 
 	if err := revSig.RevokeKey(e.PrimaryKey, e.PrivateKey, config); err != nil {
 		return err
@@ -780,16 +829,9 @@ func (e *Entity) RevokeSubkey(sk *Subkey, reason packet.ReasonForRevocation, rea
 		return errors.InvalidArgumentError("given subkey is not associated with this key")
 	}
 
-	revSig := &packet.Signature{
-		Version:              e.PrimaryKey.Version,
-		CreationTime:         config.Now(),
-		SigType:              packet.SigTypeSubkeyRevocation,
-		PubKeyAlgo:           e.PrimaryKey.PubKeyAlgo,
-		Hash:                 config.Hash(),
-		RevocationReason:     &reason,
-		RevocationReasonText: reasonText,
-		IssuerKeyId:          &e.PrimaryKey.KeyId,
-	}
+	revSig := createSignaturePacket(e.PrimaryKey, packet.SigTypeSubkeyRevocation, config)
+	revSig.RevocationReason = &reason
+	revSig.RevocationReasonText = reasonText
 
 	if err := revSig.RevokeSubkey(sk.PublicKey, e.PrivateKey, config); err != nil {
 		return err

vendor/github.com/ProtonMail/go-crypto/openpgp/keys_test_data.go

@@ -398,3 +398,141 @@ sr92MA2+k901WeISR7qEzcI0Fdg8AyFAExaEK6VyjP7SXGLwvfisw34OxuZr3qmx
 I+KgLycyeDvGoBj0HCLO3gVaBe4ubVrj5KjhX2PVNEJd3XZRzaXZE2aAMQ==
 =AmgT
 -----END PGP PUBLIC KEY BLOCK-----`
+
+const rsa2048PrivateKey = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+Comment: gpg (GnuPG) 2.2.27 with libgcrypt 1.9.4
+
+lQPGBGL07P0BCADL0etN8efyAXA6sL2WfQvHe5wEKYXPWeN2+jiqSppfeRZAOlzP
+kZ3U+cloeJriplYvVJwI3ID2aw52Z/TRn8iKRP5eOUFrEgcgl06lazLtOndK7o7p
+oBV5mLtHEirFHm6W61fNt10jzM0jx0PV6nseLhFB2J42F1cmU/aBgFo41wjLSZYr
+owR+v+O9S5sUXblQF6sEDcY01sBEu09zrIgT49VFwQ1Cvdh9XZEOTQBfdiugoj5a
+DS3fAqAka3r1VoQK4eR7/upnYSgSACGeaQ4pUelKku5rpm50gdWTY8ppq0k9e1eT
+y2x0OQcW3hWE+j4os1ca0ZEADMdqr/99MOxrABEBAAH+BwMCJWxU4VOZOJ7/I6vX
+FxdfBhIBEXlJ52FM3S/oYtXqLhkGyrtmZOeEazVvUtuCe3M3ScHI8xCthcmE8E0j
+bi+ZEHPS2NiBZtgHFF27BLn7zZuTc+oD5WKduZdK3463egnyThTqIIMl25WZBuab
+k5ycwYrWwBH0jfA4gwJ13ai4pufKC2RM8qIu6YAVPglYBKFLKGvvJHa5vI+LuA0E
+K+k35hIic7yVUcQneNnAF2598X5yWiieYnOZpmHlRw1zfbMwOJr3ZNj2v94u7b+L
+sTa/1Uv9887Vb6sJp0c2Sh4cwEccoPYkvMqFn3ZrJUr3UdDu1K2vWohPtswzhrYV
++RdPZE5RLoCQufKvlPezk0Pzhzb3bBU7XjUbdGY1nH/EyQeBNp+Gw6qldKvzcBaB
+cyOK1c6hPSszpJX93m5UxCN55IeifmcNjmbDh8vGCCdajy6d56qV2n4F3k7vt1J1
+0UlxIGhqijJoaTCX66xjLMC6VXkSz6aHQ35rnXosm/cqPcQshsZTdlfSyWkorfdr
+4Hj8viBER26mjYurTMLBKDtUN724ZrR0Ev5jorX9uoKlgl87bDZHty2Ku2S+vR68
+VAvnj6Fi1BYNclnDoqxdRB2z5T9JbWE52HuG83/QsplhEqXxESDxriTyTHMbNxEe
+88soVCDh4tgflZFa2ucUr6gEKJKij7jgahARnyaXfPZlQBUAS1YUeILYmN+VR+M/
+sHENpwDWc7TInn8VN638nJV+ScZGMih3AwWZTIoiLju3MMt1K0YZ3NuiqwGH4Jwg
+/BbEdTWeCci9y3NEQHQ3uZZ5p6j2CwFVlK11idemCMvAiTVxF+gKdaLMkeCwKxru
+J3YzhKEo+iDVYbPYBYizx/EHBn2U5kITQ5SBXzjTaaFMNZJEf9JYsL1ybPB6HOFY
+VNVB2KT8CGVwtCJHb2xhbmcgR29waGVyIDxnb2xhbmdAZXhhbXBsZS5vcmc+iQFO
+BBMBCgA4FiEEC6K7U7f4qesybTnqSkra7gHusm0FAmL07P0CGwMFCwkIBwIGFQoJ
+CAsCBBYCAwECHgECF4AACgkQSkra7gHusm1MvwgAxpClWkeSqIhMQfbiuz0+lOkE
+89y1DCFw8bHjZoUf4/4K8hFA3dGkk+q72XFgiyaCpfXxMt6Gi+dN47t+tTv9NIqC
+sukbaoJBmJDhN6+djmJOgOYy+FWsW2LAk2LOwKYulpnBZdcA5rlMAhBg7gevQpF+
+ruSU69P7UUaFJl/DC7hDmaIcj+4cjBE/HO26SnVQjoTfjZT82rDh1Wsuf8LnkJUk
+b3wezBLpXKjDvdHikdv4gdlR4AputVM38aZntYYglh/EASo5TneyZ7ZscdLNRdcF
+r5O2fKqrOJLOdaoYRFZZWOvP5GtEVFDU7WGivOSVfiszBE0wZR3dgZRJipHCXJ0D
+xgRi9Oz9AQgAtMJcJqLLVANJHl90tWuoizDkm+Imcwq2ubQAjpclnNrODnDK+7o4
+pBsWmXbZSdkC4gY+LhOQA6bPDD0JEHM58DOnrm49BddxXAyK0HPsk4sGGt2SS86B
+OawWNdfJVyqw4bAiHWDmQg4PcjBbt3ocOIxAR6I5kBSiQVxuGQs9T+Zvg3G1r3Or
+fS6DzlgY3HFUML5YsGH4lOxNSOoKAP68GIH/WNdUZ+feiRg9knIib6I3Hgtf5eO8
+JRH7aWE/TD7eNu36bLLjT5TZPq5r6xaD2plbtPOyXbNPWs9qI1yG+VnErfaLY0w8
+Qo0aqzbgID+CTZVomXSOpOcQseaFKw8ZfQARAQAB/gcDArha6+/+d4OY/w9N32K9
+hFNYt4LufTETMQ+k/sBeaMuAVzmT47DlAXzkrZhGW4dZOtXMu1rXaUwHlqkhEyzL
+L4MYEWVXfD+LbZNEK3MEFss6RK+UAMeT/PTV9aA8cXQVPcSJYzfBXHQ1U1hnOgrO
+apn92MN8RmkhX8wJLyeWTMMuP4lXByJMmmGo8WvifeRD2kFY4y0WVBDAXJAV4Ljf
+Di/bBiwoc5a+gxHuZT2W9ZSxBQJNXdt4Un2IlyZuo58s5MLx2N0EaNJ8PwRUE6fM
+RZYO8aZCEPUtINE4njbvsWOMCtrblsMPwZ1B0SiIaWmLaNyGdCNKea+fCIW7kasC
+JYMhnLumpUTXg5HNexkCsl7ABWj0PYBflOE61h8EjWpnQ7JBBVKS2ua4lMjwHRX7
+5o5yxym9k5UZNFdGoXVL7xpizCcdGawxTJvwhs3vBqu1ZWYCegOAZWDrOkCyhUpq
+8uKMROZFbn+FwE+7tjt+v2ed62FVEvD6g4V3ThCA6mQqeOARfJWN8GZY8BDm8lht
+crOXriUkrx+FlrgGtm2CkwjW5/9Xd7AhFpHnQdFeozOHyq1asNSgJF9sNi9Lz94W
+skQSVRi0IExxSXYGI3Y0nnAZUe2BAQflYPJdEveSr3sKlUqXiETTA1VXsTPK3kOC
+92CbLzj/Hz199jZvywwyu53I+GKMpF42rMq7zxr2oa61YWY4YE/GDezwwys/wLx/
+QpCW4X3ppI7wJjCSSqEV0baYZSSli1ayheS6dxi8QnSpX1Bmpz6gU7m/M9Sns+hl
+J7ZvgpjCAiV7KJTjtclr5/S02zP78LTVkoTWoz/6MOTROwaP63VBUXX8pbJhf/vu
+DLmNnDk8joMJxoDXWeNU0EnNl4hP7Z/jExRBOEO4oAnUf/Sf6gCWQhL5qcajtg6w
+tGv7vx3f2IkBNgQYAQoAIBYhBAuiu1O3+KnrMm056kpK2u4B7rJtBQJi9Oz9AhsM
+AAoJEEpK2u4B7rJt6lgIAMBWqP4BCOGnQXBbgJ0+ACVghpkFUXZTb/tXJc8UUvTM
+8uov6k/RsqDGZrvhhufD7Wwt7j9v7dD7VPp7bPyjVWyimglQzWguTUUqLDGlstYH
+5uYv1pzma0ZsAGNqFeGlTLsKOSGKFMH4rB2KfN2n51L8POvtp1y7GKZQbWIWneaB
+cZr3BINU5GMvYYU7pAYcoR+mJPdJx5Up3Ocn+bn8Tu1sy9C/ArtCQucazGnoE9u1
+HhNLrh0CdzzX7TNH6TQ8LwPOvq0K5l/WqbN9lE0WBBhMv2HydxhluO8AhU+A5GqC
+C+wET7nVDnhoOm/fstIeb7/LN7OYejKPeHdFBJEL9GA=
+=u442
+-----END PGP PRIVATE KEY BLOCK-----`
+
+const curve25519PrivateKey = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+Comment: gpg (GnuPG) 2.2.27 with libgcrypt 1.9.4
+
+lFgEYvTtQBYJKwYBBAHaRw8BAQdAxsNXLbrk5xOjpO24VhOMvQ0/F+JcyIkckMDH
+X3FIGxcAAQDFOlunZWYuPsCx5JLp78vKqUTfgef9TGG4oD6I/Sa0zBMstCJHb2xh
+bmcgR29waGVyIDxnb2xhbmdAZXhhbXBsZS5vcmc+iJAEExYIADgWIQSFQHEOazmo
+h1ldII4MvfnLQ4JBNwUCYvTtQAIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAK
+CRAMvfnLQ4JBN5yeAQCKdry8B5ScCPrev2+UByMCss7Sdu5RhomCFsHdNPLcKAEA
+8ugei+1owHsV+3cGwWWzKk6sLa8ZN87i3SKuOGp9DQycXQRi9O1AEgorBgEEAZdV
+AQUBAQdA5CubPp8l7lrVQ25h7Hx5XN2C8xanRnnpcjzEooCaEA0DAQgHAAD/Rpc+
+sOZUXrFk9HOWB1XU41LoWbDBoG8sP8RWAVYwD5AQRYh4BBgWCAAgFiEEhUBxDms5
+qIdZXSCODL35y0OCQTcFAmL07UACGwwACgkQDL35y0OCQTcvdwEA7lb5g/YisrEf
+iq660uwMGoepLUfvtqKzuQ6heYe83y0BAN65Ffg5HYOJzUEi0kZQRf7OhdtuL2kJ
+SRXn8DmCTfEB
+=cELM
+-----END PGP PRIVATE KEY BLOCK-----`
+
+const curve448PrivateKey = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+Comment: C1DB 65D5 80D7 B922 7254  4B1E A699 9895 FABA CE52
+
+xYUEYV2UmRYDK2VxAc9AFyxgh5xnSbyt50TWl558mw9xdMN+/UBLr5+UMP8IsrvV
+MdXuTIE8CyaUQKSotHtH2RkYEXj5nsMAAAHPQIbTMSzjIWug8UFECzAex5FHgAgH
+gYF3RK+TS8D24wX8kOu2C/NoVxwGY+p+i0JHaB+7yljriSKAGxs6wsBEBB8WCgCD
+BYJhXZSZBYkFpI+9AwsJBwkQppmYlfq6zlJHFAAAAAAAHgAgc2FsdEBub3RhdGlv
+bnMuc2VxdW9pYS1wZ3Aub3Jn5wSpIutJ5HncJWk4ruUV8GzQF390rR5+qWEAnAoY
+akcDFQoIApsBAh4BFiEEwdtl1YDXuSJyVEseppmYlfq6zlIAALzdA5dA/fsgYg/J
+qaQriYKaPUkyHL7EB3BXhV2d1h/gk+qJLvXQuU2WEJ/XSs3GrsBRiiZwvPH4o+7b
+mleAxjy5wpS523vqrrBR2YZ5FwIku7WS4litSdn4AtVam/TlLdMNIf41CtFeZKBe
+c5R5VNdQy8y7qy8AAADNEUN1cnZlNDQ4IE9wdGlvbiA4wsBHBBMWCgCGBYJhXZSZ
+BYkFpI+9AwsJBwkQppmYlfq6zlJHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2Vx
+dW9pYS1wZ3Aub3JnD55UsYMzE6OACP+mgw5zvT+BBgol8/uFQjHg4krjUCMDFQoI
+ApkBApsBAh4BFiEEwdtl1YDXuSJyVEseppmYlfq6zlIAAPQJA5dA0Xqwzn/0uwCq
+RlsOVCB3f5NOj1exKnlBvRw0xT1VBee1yxvlUt5eIAoCxWoRlWBJob3TTkhm9AEA
+8dyhwPmyGfWHzPw5NFG3xsXrZdNXNvit9WMVAPcmsyR7teXuDlJItxRAdJJc/qfJ
+YVbBFoaNrhYAAADHhQRhXZSZFgMrZXEBz0BL7THZ9MnCLfSPJ1FMLim9eGkQ3Bfn
+M3he5rOwO3t14QI1LjI96OjkeJipMgcFAmEP1Bq/ZHGO7oAAAc9AFnE8iNBaT3OU
+EFtxkmWHXtdaYMmGGRdopw9JPXr/UxuunDln5o9dxPxf7q7z26zXrZen+qed/Isa
+HsDCwSwEGBYKAWsFgmFdlJkFiQWkj70JEKaZmJX6us5SRxQAAAAAAB4AIHNhbHRA
+bm90YXRpb25zLnNlcXVvaWEtcGdwLm9yZxREUizdTcepBzgSMOv2VWQCWbl++3CZ
+EbgAWDryvSsyApsCwDGgBBkWCgBvBYJhXZSZCRBKo3SL4S5djkcUAAAAAAAeACBz
+YWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmemoGTDjmNQiIzw6HOEddvS0OB7
+UZ/P07jM/EVmnYxTlBYhBAxsnkGpx1UCiH6gUUqjdIvhLl2OAAALYQOXQAMB1oKq
+OWxSFmvmgCKNcbAAyA3piF5ERIqs4z07oJvqDYrOWt75UsEIH/04gU/vHc4EmfG2
+JDLJgOLlyTUPkL/08f0ydGZPofFQBhn8HkuFFjnNtJ5oz3GIP4cdWMQFaUw0uvjb
+PM9Tm3ptENGd6Ts1AAAAFiEEwdtl1YDXuSJyVEseppmYlfq6zlIAAGpTA5dATR6i
+U2GrpUcQgpG+JqfAsGmF4yAOhgFxc1UfidFk3nTup3fLgjipkYY170WLRNbyKkVO
+Sodx93GAs58rizO1acDAWiLq3cyEPBFXbyFThbcNPcLl+/77Uk/mgkYrPQFAQWdK
+1kSRm4SizDBK37K8ChAAAADHhwRhXZSZEgMrZW8Bx0DMhzvhQo+OsXeqQ6QVw4sF
+CaexHh6rLohh7TzL3hQSjoJ27fV6JBkIWdn0LfrMlJIDbSv2SLdlgQMBCgkAAcdA
+MO7Dc1myF6Co1fAH+EuP+OxhxP/7V6ljuSCZENDfA49tQkzTta+PniG+pOVB2LHb
+huyaKBkqiaogo8LAOQQYFgoAeAWCYV2UmQWJBaSPvQkQppmYlfq6zlJHFAAAAAAA
+HgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnEjBMQAmc/2u45u5FQGmB
+QAytjSG2LM3JQN+PPVl5vEkCmwwWIQTB22XVgNe5InJUSx6mmZiV+rrOUgAASdYD
+l0DXEHQ9ykNP2rZP35ET1dmiFagFtTj/hLQcWlg16LqvJNGqOgYXuqTerbiOOt02
+XLCBln+wdewpU4ChEffMUDRBfqfQco/YsMqWV7bHJHAO0eC/DMKCjyU90xdH7R/d
+QgqsfguR1PqPuJxpXV4bSr6CGAAAAA==
+=MSvh
+-----END PGP PRIVATE KEY BLOCK-----`
+
+const keyWithNotation = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+
+xVgEY9gIshYJKwYBBAHaRw8BAQdAF25fSM8OpFlXZhop4Qpqo5ywGZ4jgWlR
+ppjhIKDthREAAQC+LFpzFcMJYcjxGKzBGHN0Px2jU4d04YSRnFAik+lVVQ6u
+zRdUZXN0IDx0ZXN0QGV4YW1wbGUuY29tPsLACgQQFgoAfAUCY9gIsgQLCQcI
+CRD/utJOCym8pR0UgAAAAAAQAAR0ZXh0QGV4YW1wbGUuY29tdGVzdB8UAAAA
+AAASAARiaW5hcnlAZXhhbXBsZS5jb20AAQIDAxUICgQWAAIBAhkBAhsDAh4B
+FiEEEMCQTUVGKgCX5rDQ/7rSTgspvKUAAPl5AP9Npz90LxzrB97Qr2DrGwfG
+wuYn4FSYwtuPfZHHeoIabwD/QEbvpQJ/NBb9EAZuow4Rirlt1yv19mmnF+j5
+8yUzhQjHXQRj2AiyEgorBgEEAZdVAQUBAQdARXAo30DmKcyUg6co7OUm0RNT
+z9iqFbDBzA8A47JEt1MDAQgHAAD/XKK3lBm0SqMR558HLWdBrNG6NqKuqb5X
+joCML987ZNgRD8J4BBgWCAAqBQJj2AiyCRD/utJOCym8pQIbDBYhBBDAkE1F
+RioAl+aw0P+60k4LKbylAADRxgEAg7UfBDiDPp5LHcW9D+SgFHk6+GyEU4ev
+VppQxdtxPvAA/34snHBX7Twnip1nMt7P4e2hDiw/hwQ7oqioOvc6jMkP
+=Z8YJ
+-----END PGP PRIVATE KEY BLOCK-----
+`

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_config.go

@@ -4,6 +4,14 @@ package packet
 
 import "math/bits"
 
+// CipherSuite contains a combination of Cipher and Mode
+type CipherSuite struct {
+	// The cipher function
+	Cipher CipherFunction
+	// The AEAD mode of operation.
+	Mode AEADMode
+}
+
 // AEADConfig collects a number of AEAD parameters along with sensible defaults.
 // A nil AEADConfig is valid and results in all default values.
 type AEADConfig struct {
@@ -15,12 +23,13 @@ type AEADConfig struct {
 
 // Mode returns the AEAD mode of operation.
 func (conf *AEADConfig) Mode() AEADMode {
+	// If no preference is specified, OCB is used (which is mandatory to implement).
 	if conf == nil || conf.DefaultMode == 0 {
-		return AEADModeEAX
+		return AEADModeOCB
 	}
+
 	mode := conf.DefaultMode
-	if mode != AEADModeEAX && mode != AEADModeOCB &&
-		mode != AEADModeExperimentalGCM {
+	if mode != AEADModeEAX && mode != AEADModeOCB && mode != AEADModeGCM {
 		panic("AEAD mode unsupported")
 	}
 	return mode
@@ -28,6 +37,8 @@ func (conf *AEADConfig) Mode() AEADMode {
 
 // ChunkSizeByte returns the byte indicating the chunk size. The effective
 // chunk size is computed with the formula uint64(1) << (chunkSizeByte + 6)
+// limit to 16 = 4 MiB
+// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-5.13.2
 func (conf *AEADConfig) ChunkSizeByte() byte {
 	if conf == nil || conf.ChunkSize == 0 {
 		return 12 // 1 << (12 + 6) == 262144 bytes
@@ -38,8 +49,8 @@ func (conf *AEADConfig) ChunkSizeByte() byte {
 	switch {
 	case exponent < 6:
 		exponent = 6
-	case exponent > 27:
-		exponent = 27
+	case exponent > 16:
+		exponent = 16
 	}
 
 	return byte(exponent - 6)

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_crypter.go

@@ -0,0 +1,264 @@
+// Copyright (C) 2019 ProtonTech AG
+
+package packet
+
+import (
+	"bytes"
+	"crypto/cipher"
+	"encoding/binary"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+)
+
+// aeadCrypter is an AEAD opener/sealer, its configuration, and data for en/decryption.
+type aeadCrypter struct {
+	aead           cipher.AEAD
+	chunkSize      int
+	initialNonce   []byte
+	associatedData []byte       // Chunk-independent associated data
+	chunkIndex     []byte       // Chunk counter
+	packetTag      packetType   // SEIP packet (v2) or AEAD Encrypted Data packet
+	bytesProcessed int          // Amount of plaintext bytes encrypted/decrypted
+	buffer         bytes.Buffer // Buffered bytes across chunks
+}
+
+// computeNonce takes the incremental index and computes an eXclusive OR with
+// the least significant 8 bytes of the receivers' initial nonce (see sec.
+// 5.16.1 and 5.16.2). It returns the resulting nonce.
+func (wo *aeadCrypter) computeNextNonce() (nonce []byte) {
+	if wo.packetTag == packetTypeSymmetricallyEncryptedIntegrityProtected {
+		return append(wo.initialNonce, wo.chunkIndex...)
+	}
+
+	nonce = make([]byte, len(wo.initialNonce))
+	copy(nonce, wo.initialNonce)
+	offset := len(wo.initialNonce) - 8
+	for i := 0; i < 8; i++ {
+		nonce[i+offset] ^= wo.chunkIndex[i]
+	}
+	return
+}
+
+// incrementIndex performs an integer increment by 1 of the integer represented by the
+// slice, modifying it accordingly.
+func (wo *aeadCrypter) incrementIndex() error {
+	index := wo.chunkIndex
+	if len(index) == 0 {
+		return errors.AEADError("Index has length 0")
+	}
+	for i := len(index) - 1; i >= 0; i-- {
+		if index[i] < 255 {
+			index[i]++
+			return nil
+		}
+		index[i] = 0
+	}
+	return errors.AEADError("cannot further increment index")
+}
+
+// aeadDecrypter reads and decrypts bytes. It buffers extra decrypted bytes when
+// necessary, similar to aeadEncrypter.
+type aeadDecrypter struct {
+	aeadCrypter           // Embedded ciphertext opener
+	reader      io.Reader // 'reader' is a partialLengthReader
+	peekedBytes []byte    // Used to detect last chunk
+	eof         bool
+}
+
+// Read decrypts bytes and reads them into dst. It decrypts when necessary and
+// buffers extra decrypted bytes. It returns the number of bytes copied into dst
+// and an error.
+func (ar *aeadDecrypter) Read(dst []byte) (n int, err error) {
+	// Return buffered plaintext bytes from previous calls
+	if ar.buffer.Len() > 0 {
+		return ar.buffer.Read(dst)
+	}
+
+	// Return EOF if we've previously validated the final tag
+	if ar.eof {
+		return 0, io.EOF
+	}
+
+	// Read a chunk
+	tagLen := ar.aead.Overhead()
+	cipherChunkBuf := new(bytes.Buffer)
+	_, errRead := io.CopyN(cipherChunkBuf, ar.reader, int64(ar.chunkSize+tagLen))
+	cipherChunk := cipherChunkBuf.Bytes()
+	if errRead != nil && errRead != io.EOF {
+		return 0, errRead
+	}
+	decrypted, errChunk := ar.openChunk(cipherChunk)
+	if errChunk != nil {
+		return 0, errChunk
+	}
+
+	// Return decrypted bytes, buffering if necessary
+	if len(dst) < len(decrypted) {
+		n = copy(dst, decrypted[:len(dst)])
+		ar.buffer.Write(decrypted[len(dst):])
+	} else {
+		n = copy(dst, decrypted)
+	}
+
+	// Check final authentication tag
+	if errRead == io.EOF {
+		errChunk := ar.validateFinalTag(ar.peekedBytes)
+		if errChunk != nil {
+			return n, errChunk
+		}
+		ar.eof = true // Mark EOF for when we've returned all buffered data
+	}
+	return
+}
+
+// Close is noOp. The final authentication tag of the stream was already
+// checked in the last Read call. In the future, this function could be used to
+// wipe the reader and peeked, decrypted bytes, if necessary.
+func (ar *aeadDecrypter) Close() (err error) {
+	return nil
+}
+
+// openChunk decrypts and checks integrity of an encrypted chunk, returning
+// the underlying plaintext and an error. It accesses peeked bytes from next
+// chunk, to identify the last chunk and decrypt/validate accordingly.
+func (ar *aeadDecrypter) openChunk(data []byte) ([]byte, error) {
+	tagLen := ar.aead.Overhead()
+	// Restore carried bytes from last call
+	chunkExtra := append(ar.peekedBytes, data...)
+	// 'chunk' contains encrypted bytes, followed by an authentication tag.
+	chunk := chunkExtra[:len(chunkExtra)-tagLen]
+	ar.peekedBytes = chunkExtra[len(chunkExtra)-tagLen:]
+
+	adata := ar.associatedData
+	if ar.aeadCrypter.packetTag == packetTypeAEADEncrypted {
+		adata = append(ar.associatedData, ar.chunkIndex...)
+	}
+
+	nonce := ar.computeNextNonce()
+	plainChunk, err := ar.aead.Open(nil, nonce, chunk, adata)
+	if err != nil {
+		return nil, err
+	}
+	ar.bytesProcessed += len(plainChunk)
+	if err = ar.aeadCrypter.incrementIndex(); err != nil {
+		return nil, err
+	}
+	return plainChunk, nil
+}
+
+// Checks the summary tag. It takes into account the total decrypted bytes into
+// the associated data. It returns an error, or nil if the tag is valid.
+func (ar *aeadDecrypter) validateFinalTag(tag []byte) error {
+	// Associated: tag, version, cipher, aead, chunk size, ...
+	amountBytes := make([]byte, 8)
+	binary.BigEndian.PutUint64(amountBytes, uint64(ar.bytesProcessed))
+
+	adata := ar.associatedData
+	if ar.aeadCrypter.packetTag == packetTypeAEADEncrypted {
+		// ... index ...
+		adata = append(ar.associatedData, ar.chunkIndex...)
+	}
+
+	// ... and total number of encrypted octets
+	adata = append(adata, amountBytes...)
+	nonce := ar.computeNextNonce()
+	_, err := ar.aead.Open(nil, nonce, tag, adata)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// aeadEncrypter encrypts and writes bytes. It encrypts when necessary according
+// to the AEAD block size, and buffers the extra encrypted bytes for next write.
+type aeadEncrypter struct {
+	aeadCrypter                // Embedded plaintext sealer
+	writer      io.WriteCloser // 'writer' is a partialLengthWriter
+}
+
+// Write encrypts and writes bytes. It encrypts when necessary and buffers extra
+// plaintext bytes for next call. When the stream is finished, Close() MUST be
+// called to append the final tag.
+func (aw *aeadEncrypter) Write(plaintextBytes []byte) (n int, err error) {
+	// Append plaintextBytes to existing buffered bytes
+	n, err = aw.buffer.Write(plaintextBytes)
+	if err != nil {
+		return n, err
+	}
+	// Encrypt and write chunks
+	for aw.buffer.Len() >= aw.chunkSize {
+		plainChunk := aw.buffer.Next(aw.chunkSize)
+		encryptedChunk, err := aw.sealChunk(plainChunk)
+		if err != nil {
+			return n, err
+		}
+		_, err = aw.writer.Write(encryptedChunk)
+		if err != nil {
+			return n, err
+		}
+	}
+	return
+}
+
+// Close encrypts and writes the remaining buffered plaintext if any, appends
+// the final authentication tag, and closes the embedded writer. This function
+// MUST be called at the end of a stream.
+func (aw *aeadEncrypter) Close() (err error) {
+	// Encrypt and write a chunk if there's buffered data left, or if we haven't
+	// written any chunks yet.
+	if aw.buffer.Len() > 0 || aw.bytesProcessed == 0 {
+		plainChunk := aw.buffer.Bytes()
+		lastEncryptedChunk, err := aw.sealChunk(plainChunk)
+		if err != nil {
+			return err
+		}
+		_, err = aw.writer.Write(lastEncryptedChunk)
+		if err != nil {
+			return err
+		}
+	}
+	// Compute final tag (associated data: packet tag, version, cipher, aead,
+	// chunk size...
+	adata := aw.associatedData
+
+	if aw.aeadCrypter.packetTag == packetTypeAEADEncrypted {
+		// ... index ...
+		adata = append(aw.associatedData, aw.chunkIndex...)
+	}
+
+	// ... and total number of encrypted octets
+	amountBytes := make([]byte, 8)
+	binary.BigEndian.PutUint64(amountBytes, uint64(aw.bytesProcessed))
+	adata = append(adata, amountBytes...)
+
+	nonce := aw.computeNextNonce()
+	finalTag := aw.aead.Seal(nil, nonce, nil, adata)
+	_, err = aw.writer.Write(finalTag)
+	if err != nil {
+		return err
+	}
+	return aw.writer.Close()
+}
+
+// sealChunk Encrypts and authenticates the given chunk.
+func (aw *aeadEncrypter) sealChunk(data []byte) ([]byte, error) {
+	if len(data) > aw.chunkSize {
+		return nil, errors.AEADError("chunk exceeds maximum length")
+	}
+	if aw.associatedData == nil {
+		return nil, errors.AEADError("can't seal without headers")
+	}
+	adata := aw.associatedData
+	if aw.aeadCrypter.packetTag == packetTypeAEADEncrypted {
+		adata = append(aw.associatedData, aw.chunkIndex...)
+	}
+
+	nonce := aw.computeNextNonce()
+	encrypted := aw.aead.Seal(nil, nonce, data, adata)
+	aw.bytesProcessed += len(data)
+	if err := aw.aeadCrypter.incrementIndex(); err != nil {
+		return nil, err
+	}
+	return encrypted, nil
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_encrypted.go

@@ -3,17 +3,14 @@
 package packet
 
 import (
-	"bytes"
-	"crypto/cipher"
-	"crypto/rand"
-	"encoding/binary"
 	"io"
 
 	"github.com/ProtonMail/go-crypto/openpgp/errors"
 	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
 )
 
-// AEADEncrypted represents an AEAD Encrypted Packet (tag 20, RFC4880bis-5.16).
+// AEADEncrypted represents an AEAD Encrypted Packet.
+// See https://www.ietf.org/archive/id/draft-koch-openpgp-2015-rfc4880bis-00.html#name-aead-encrypted-data-packet-t
 type AEADEncrypted struct {
 	cipher        CipherFunction
 	mode          AEADMode
@@ -25,33 +22,6 @@ type AEADEncrypted struct {
 // Only currently defined version
 const aeadEncryptedVersion = 1
 
-// An AEAD opener/sealer, its configuration, and data for en/decryption.
-type aeadCrypter struct {
-	aead           cipher.AEAD
-	chunkSize      int
-	initialNonce   []byte
-	associatedData []byte       // Chunk-independent associated data
-	chunkIndex     []byte       // Chunk counter
-	bytesProcessed int          // Amount of plaintext bytes encrypted/decrypted
-	buffer         bytes.Buffer // Buffered bytes accross chunks
-}
-
-// aeadEncrypter encrypts and writes bytes. It encrypts when necessary according
-// to the AEAD block size, and buffers the extra encrypted bytes for next write.
-type aeadEncrypter struct {
-	aeadCrypter                // Embedded plaintext sealer
-	writer      io.WriteCloser // 'writer' is a partialLengthWriter
-}
-
-// aeadDecrypter reads and decrypts bytes. It buffers extra decrypted bytes when
-// necessary, similar to aeadEncrypter.
-type aeadDecrypter struct {
-	aeadCrypter           // Embedded ciphertext opener
-	reader      io.Reader // 'reader' is a partialLengthReader
-	peekedBytes []byte    // Used to detect last chunk
-	eof         bool
-}
-
 func (ae *AEADEncrypted) parse(buf io.Reader) error {
 	headerData := make([]byte, 4)
 	if n, err := io.ReadFull(buf, headerData); n < 4 {
@@ -59,10 +29,14 @@ func (ae *AEADEncrypted) parse(buf io.Reader) error {
 	}
 	// Read initial nonce
 	mode := AEADMode(headerData[2])
-	nonceLen := mode.NonceLength()
-	if nonceLen == 0 {
+	nonceLen := mode.IvLength()
+
+	// This packet supports only EAX and OCB
+	// https://www.ietf.org/archive/id/draft-koch-openpgp-2015-rfc4880bis-00.html#name-aead-encrypted-data-packet-t
+	if nonceLen == 0 || mode > AEADModeOCB {
 		return errors.AEADError("unknown mode")
 	}
+
 	initialNonce := make([]byte, nonceLen)
 	if n, err := io.ReadFull(buf, initialNonce); n < nonceLen {
 		return errors.AEADError("could not read aead nonce:" + err.Error())
@@ -75,7 +49,7 @@ func (ae *AEADEncrypted) parse(buf io.Reader) error {
 	}
 	ae.cipher = CipherFunction(c)
 	ae.mode = mode
-	ae.chunkSizeByte = byte(headerData[3])
+	ae.chunkSizeByte = headerData[3]
 	return nil
 }
 
@@ -105,225 +79,13 @@ func (ae *AEADEncrypted) decrypt(key []byte) (io.ReadCloser, error) {
 			initialNonce:   ae.initialNonce,
 			associatedData: ae.associatedData(),
 			chunkIndex:     make([]byte, 8),
+			packetTag:      packetTypeAEADEncrypted,
 		},
 		reader:      ae.Contents,
 		peekedBytes: peekedBytes}, nil
 }
 
-// Read decrypts bytes and reads them into dst. It decrypts when necessary and
-// buffers extra decrypted bytes. It returns the number of bytes copied into dst
-// and an error.
-func (ar *aeadDecrypter) Read(dst []byte) (n int, err error) {
-	// Return buffered plaintext bytes from previous calls
-	if ar.buffer.Len() > 0 {
-		return ar.buffer.Read(dst)
-	}
-
-	// Return EOF if we've previously validated the final tag
-	if ar.eof {
-		return 0, io.EOF
-	}
-
-	// Read a chunk
-	tagLen := ar.aead.Overhead()
-	cipherChunkBuf := new(bytes.Buffer)
-	_, errRead := io.CopyN(cipherChunkBuf, ar.reader, int64(ar.chunkSize + tagLen))
-	cipherChunk := cipherChunkBuf.Bytes()
-	if errRead != nil && errRead != io.EOF {
-		return 0, errRead
-	}
-	decrypted, errChunk := ar.openChunk(cipherChunk)
-	if errChunk != nil {
-		return 0, errChunk
-	}
-
-	// Return decrypted bytes, buffering if necessary
-	if len(dst) < len(decrypted) {
-		n = copy(dst, decrypted[:len(dst)])
-		ar.buffer.Write(decrypted[len(dst):])
-	} else {
-		n = copy(dst, decrypted)
-	}
-
-	// Check final authentication tag
-	if errRead == io.EOF {
-		errChunk := ar.validateFinalTag(ar.peekedBytes)
-		if errChunk != nil {
-			return n, errChunk
-		}
-		ar.eof = true // Mark EOF for when we've returned all buffered data
-	}
-	return
-}
-
-// Close is noOp. The final authentication tag of the stream was already
-// checked in the last Read call. In the future, this function could be used to
-// wipe the reader and peeked, decrypted bytes, if necessary.
-func (ar *aeadDecrypter) Close() (err error) {
-	return nil
-}
-
-// SerializeAEADEncrypted initializes the aeadCrypter and returns a writer.
-// This writer encrypts and writes bytes (see aeadEncrypter.Write()).
-func SerializeAEADEncrypted(w io.Writer, key []byte, cipher CipherFunction, mode AEADMode, config *Config) (io.WriteCloser, error) {
-	writeCloser := noOpCloser{w}
-	writer, err := serializeStreamHeader(writeCloser, packetTypeAEADEncrypted)
-	if err != nil {
-		return nil, err
-	}
-
-	// Data for en/decryption: tag, version, cipher, aead mode, chunk size
-	aeadConf := config.AEAD()
-	prefix := []byte{
-		0xD4,
-		aeadEncryptedVersion,
-		byte(config.Cipher()),
-		byte(aeadConf.Mode()),
-		aeadConf.ChunkSizeByte(),
-	}
-	n, err := writer.Write(prefix[1:])
-	if err != nil || n < 4 {
-		return nil, errors.AEADError("could not write AEAD headers")
-	}
-	// Sample nonce
-	nonceLen := aeadConf.Mode().NonceLength()
-	nonce := make([]byte, nonceLen)
-	n, err = rand.Read(nonce)
-	if err != nil {
-		panic("Could not sample random nonce")
-	}
-	_, err = writer.Write(nonce)
-	if err != nil {
-		return nil, err
-	}
-	blockCipher := CipherFunction(config.Cipher()).new(key)
-	alg := AEADMode(aeadConf.Mode()).new(blockCipher)
-
-	chunkSize := decodeAEADChunkSize(aeadConf.ChunkSizeByte())
-	return &aeadEncrypter{
-		aeadCrypter: aeadCrypter{
-			aead:           alg,
-			chunkSize:      chunkSize,
-			associatedData: prefix,
-			chunkIndex:     make([]byte, 8),
-			initialNonce:   nonce,
-		},
-		writer: writer}, nil
-}
-
-// Write encrypts and writes bytes. It encrypts when necessary and buffers extra
-// plaintext bytes for next call. When the stream is finished, Close() MUST be
-// called to append the final tag.
-func (aw *aeadEncrypter) Write(plaintextBytes []byte) (n int, err error) {
-	// Append plaintextBytes to existing buffered bytes
-	n, err = aw.buffer.Write(plaintextBytes)
-	if err != nil {
-		return n, err
-	}
-	// Encrypt and write chunks
-	for aw.buffer.Len() >= aw.chunkSize {
-		plainChunk := aw.buffer.Next(aw.chunkSize)
-		encryptedChunk, err := aw.sealChunk(plainChunk)
-		if err != nil {
-			return n, err
-		}
-		_, err = aw.writer.Write(encryptedChunk)
-		if err != nil {
-			return n, err
-		}
-	}
-	return
-}
-
-// Close encrypts and writes the remaining buffered plaintext if any, appends
-// the final authentication tag, and closes the embedded writer. This function
-// MUST be called at the end of a stream.
-func (aw *aeadEncrypter) Close() (err error) {
-	// Encrypt and write a chunk if there's buffered data left, or if we haven't
-	// written any chunks yet.
-	if aw.buffer.Len() > 0 || aw.bytesProcessed == 0 {
-		plainChunk := aw.buffer.Bytes()
-		lastEncryptedChunk, err := aw.sealChunk(plainChunk)
-		if err != nil {
-			return err
-		}
-		_, err = aw.writer.Write(lastEncryptedChunk)
-		if err != nil {
-			return err
-		}
-	}
-	// Compute final tag (associated data: packet tag, version, cipher, aead,
-	// chunk size, index, total number of encrypted octets).
-	adata := append(aw.associatedData[:], aw.chunkIndex[:]...)
-	adata = append(adata, make([]byte, 8)...)
-	binary.BigEndian.PutUint64(adata[13:], uint64(aw.bytesProcessed))
-	nonce := aw.computeNextNonce()
-	finalTag := aw.aead.Seal(nil, nonce, nil, adata)
-	_, err = aw.writer.Write(finalTag)
-	if err != nil {
-		return err
-	}
-	return aw.writer.Close()
-}
-
-// sealChunk Encrypts and authenticates the given chunk.
-func (aw *aeadEncrypter) sealChunk(data []byte) ([]byte, error) {
-	if len(data) > aw.chunkSize {
-		return nil, errors.AEADError("chunk exceeds maximum length")
-	}
-	if aw.associatedData == nil {
-		return nil, errors.AEADError("can't seal without headers")
-	}
-	adata := append(aw.associatedData, aw.chunkIndex...)
-	nonce := aw.computeNextNonce()
-	encrypted := aw.aead.Seal(nil, nonce, data, adata)
-	aw.bytesProcessed += len(data)
-	if err := aw.aeadCrypter.incrementIndex(); err != nil {
-		return nil, err
-	}
-	return encrypted, nil
-}
-
-// openChunk decrypts and checks integrity of an encrypted chunk, returning
-// the underlying plaintext and an error. It access peeked bytes from next
-// chunk, to identify the last chunk and decrypt/validate accordingly.
-func (ar *aeadDecrypter) openChunk(data []byte) ([]byte, error) {
-	tagLen := ar.aead.Overhead()
-	// Restore carried bytes from last call
-	chunkExtra := append(ar.peekedBytes, data...)
-	// 'chunk' contains encrypted bytes, followed by an authentication tag.
-	chunk := chunkExtra[:len(chunkExtra)-tagLen]
-	ar.peekedBytes = chunkExtra[len(chunkExtra)-tagLen:]
-	adata := append(ar.associatedData, ar.chunkIndex...)
-	nonce := ar.computeNextNonce()
-	plainChunk, err := ar.aead.Open(nil, nonce, chunk, adata)
-	if err != nil {
-		return nil, err
-	}
-	ar.bytesProcessed += len(plainChunk)
-	if err = ar.aeadCrypter.incrementIndex(); err != nil {
-		return nil, err
-	}
-	return plainChunk, nil
-}
-
-// Checks the summary tag. It takes into account the total decrypted bytes into
-// the associated data. It returns an error, or nil if the tag is valid.
-func (ar *aeadDecrypter) validateFinalTag(tag []byte) error {
-	// Associated: tag, version, cipher, aead, chunk size, index, and octets
-	amountBytes := make([]byte, 8)
-	binary.BigEndian.PutUint64(amountBytes, uint64(ar.bytesProcessed))
-	adata := append(ar.associatedData, ar.chunkIndex...)
-	adata = append(adata, amountBytes...)
-	nonce := ar.computeNextNonce()
-	_, err := ar.aead.Open(nil, nonce, tag, adata)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-// Associated data for chunks: tag, version, cipher, mode, chunk size byte
+// associatedData for chunks: tag, version, cipher, mode, chunk size byte
 func (ae *AEADEncrypted) associatedData() []byte {
 	return []byte{
 		0xD4,
@@ -332,33 +94,3 @@ func (ae *AEADEncrypted) associatedData() []byte {
 		byte(ae.mode),
 		ae.chunkSizeByte}
 }
-
-// computeNonce takes the incremental index and computes an eXclusive OR with
-// the least significant 8 bytes of the receivers' initial nonce (see sec.
-// 5.16.1 and 5.16.2). It returns the resulting nonce.
-func (wo *aeadCrypter) computeNextNonce() (nonce []byte) {
-	nonce = make([]byte, len(wo.initialNonce))
-	copy(nonce, wo.initialNonce)
-	offset := len(wo.initialNonce) - 8
-	for i := 0; i < 8; i++ {
-		nonce[i+offset] ^= wo.chunkIndex[i]
-	}
-	return
-}
-
-// incrementIndex perfoms an integer increment by 1 of the integer represented by the
-// slice, modifying it accordingly.
-func (wo *aeadCrypter) incrementIndex() error {
-	index := wo.chunkIndex
-	if len(index) == 0 {
-		return errors.AEADError("Index has length 0")
-	}
-	for i := len(index) - 1; i >= 0; i-- {
-		if index[i] < 255 {
-			index[i]++
-			return nil
-		}
-		index[i] = 0
-	}
-	return errors.AEADError("cannot further increment index")
-}

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/compressed.go

@@ -47,6 +47,8 @@ func (c *Compressed) parse(r io.Reader) error {
 	}
 
 	switch buf[0] {
+	case 0:
+		c.Body = r
 	case 1:
 		c.Body = flate.NewReader(r)
 	case 2:

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.go

@@ -10,6 +10,8 @@ import (
 	"io"
 	"math/big"
 	"time"
+
+	"github.com/ProtonMail/go-crypto/openpgp/s2k"
 )
 
 // Config collects a number of parameters along with sensible defaults.
@@ -33,16 +35,24 @@ type Config struct {
 	DefaultCompressionAlgo CompressionAlgo
 	// CompressionConfig configures the compression settings.
 	CompressionConfig *CompressionConfig
-	// S2KCount is only used for symmetric encryption. It
-	// determines the strength of the passphrase stretching when
+	// S2K (String to Key) config, used for key derivation in the context of secret key encryption
+	// and password-encrypted data.
+	// If nil, the default configuration is used
+	S2KConfig *s2k.Config
+	// Iteration count for Iterated S2K (String to Key).
+	// Only used if sk2.Mode is nil.
+	// This value is duplicated here from s2k.Config for backwards compatibility.
+	// It determines the strength of the passphrase stretching when
 	// the said passphrase is hashed to produce a key. S2KCount
-	// should be between 1024 and 65011712, inclusive. If Config
-	// is nil or S2KCount is 0, the value 65536 used. Not all
+	// should be between 65536 and 65011712, inclusive. If Config
+	// is nil or S2KCount is 0, the value 16777216 used. Not all
 	// values in the above range can be represented. S2KCount will
 	// be rounded up to the next representable value if it cannot
 	// be encoded exactly. When set, it is strongly encrouraged to
 	// use a value that is at least 65536. See RFC 4880 Section
 	// 3.7.1.3.
+	//
+	// Deprecated: SK2Count should be configured in S2KConfig instead.
 	S2KCount int
 	// RSABits is the number of bits in new RSA keys made with NewEntity.
 	// If zero, then 2048 bit keys are created.
@@ -52,6 +62,9 @@ type Config struct {
 	Algorithm PublicKeyAlgorithm
 	// Some known primes that are optionally prepopulated by the caller
 	RSAPrimes []*big.Int
+	// Curve configures the desired packet.Curve if the Algorithm is PubKeyAlgoECDSA,
+	// PubKeyAlgoEdDSA, or PubKeyAlgoECDH. If empty Curve25519 is used.
+	Curve Curve
 	// AEADConfig configures the use of the new AEAD Encrypted Data Packet,
 	// defined in the draft of the next version of the OpenPGP specification.
 	// If a non-nil AEADConfig is passed, usage of this packet is enabled. By
@@ -78,6 +91,25 @@ type Config struct {
 	// By default, the signing key is selected automatically, preferring
 	// signing subkeys if available.
 	SigningKeyId uint64
+	// SigningIdentity is used to specify a user ID (packet Signer's User ID, type 28)
+	// when producing a generic certification signature onto an existing user ID.
+	// The identity must be present in the signer Entity.
+	SigningIdentity string
+	// InsecureAllowUnauthenticatedMessages controls, whether it is tolerated to read
+	// encrypted messages without Modification Detection Code (MDC).
+	// MDC is mandated by the IETF OpenPGP Crypto Refresh draft and has long been implemented
+	// in most OpenPGP implementations. Messages without MDC are considered unnecessarily
+	// insecure and should be prevented whenever possible.
+	// In case one needs to deal with messages from very old OpenPGP implementations, there
+	// might be no other way than to tolerate the missing MDC. Setting this flag, allows this
+	// mode of operation. It should be considered a measure of last resort.
+	InsecureAllowUnauthenticatedMessages bool
+	// KnownNotations is a map of Notation Data names to bools, which controls
+	// the notation names that are allowed to be present in critical Notation Data
+	// signature subpackets.
+	KnownNotations map[string]bool
+	// SignatureNotations is a list of Notations to be added to any signatures.
+	SignatureNotations []*Notation
 }
 
 func (c *Config) Random() io.Reader {
@@ -103,9 +135,9 @@ func (c *Config) Cipher() CipherFunction {
 
 func (c *Config) Now() time.Time {
 	if c == nil || c.Time == nil {
-		return time.Now()
+		return time.Now().Truncate(time.Second)
 	}
-	return c.Time()
+	return c.Time().Truncate(time.Second)
 }
 
 // KeyLifetime returns the validity period of the key.
@@ -131,13 +163,6 @@ func (c *Config) Compression() CompressionAlgo {
 	return c.DefaultCompressionAlgo
 }
 
-func (c *Config) PasswordHashIterations() int {
-	if c == nil || c.S2KCount == 0 {
-		return 0
-	}
-	return c.S2KCount
-}
-
 func (c *Config) RSAModulusBits() int {
 	if c == nil || c.RSABits == 0 {
 		return 2048
@@ -152,6 +177,34 @@ func (c *Config) PublicKeyAlgorithm() PublicKeyAlgorithm {
 	return c.Algorithm
 }
 
+func (c *Config) CurveName() Curve {
+	if c == nil || c.Curve == "" {
+		return Curve25519
+	}
+	return c.Curve
+}
+
+// Deprecated: The hash iterations should now be queried via the S2K() method.
+func (c *Config) PasswordHashIterations() int {
+	if c == nil || c.S2KCount == 0 {
+		return 0
+	}
+	return c.S2KCount
+}
+
+func (c *Config) S2K() *s2k.Config {
+	if c == nil {
+		return nil
+	}
+	// for backwards compatibility
+	if c != nil && c.S2KCount > 0 && c.S2KConfig == nil {
+		return &s2k.Config{
+			S2KCount: c.S2KCount,
+		}
+	}
+	return c.S2KConfig
+}
+
 func (c *Config) AEAD() *AEADConfig {
 	if c == nil {
 		return nil
@@ -165,3 +218,31 @@ func (c *Config) SigningKey() uint64 {
 	}
 	return c.SigningKeyId
 }
+
+func (c *Config) SigningUserId() string {
+	if c == nil {
+		return ""
+	}
+	return c.SigningIdentity
+}
+
+func (c *Config) AllowUnauthenticatedMessages() bool {
+	if c == nil {
+		return false
+	}
+	return c.InsecureAllowUnauthenticatedMessages
+}
+
+func (c *Config) KnownNotation(notationName string) bool {
+	if c == nil {
+		return false
+	}
+	return c.KnownNotations[notationName]
+}
+
+func (c *Config) Notations() []*Notation {
+	if c == nil {
+		return nil
+	}
+	return c.SignatureNotations
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/encrypted_key.go

@@ -25,7 +25,7 @@ const encryptedKeyVersion = 3
 type EncryptedKey struct {
 	KeyId      uint64
 	Algo       PublicKeyAlgorithm
-	CipherFunc CipherFunction // only valid after a successful Decrypt
+	CipherFunc CipherFunction // only valid after a successful Decrypt for a v3 packet
 	Key        []byte         // only valid after a successful Decrypt
 
 	encryptedMPI1, encryptedMPI2 encoding.Field
@@ -123,6 +123,10 @@ func (e *EncryptedKey) Decrypt(priv *PrivateKey, config *Config) error {
 	}
 
 	e.CipherFunc = CipherFunction(b[0])
+	if !e.CipherFunc.IsSupported() {
+		return errors.UnsupportedError("unsupported encryption function")
+	}
+
 	e.Key = b[1 : len(b)-2]
 	expectedChecksum := uint16(b[len(b)-2])<<8 | uint16(b[len(b)-1])
 	checksum := checksumKeyMaterial(e.Key)

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/notation.go

@@ -0,0 +1,29 @@
+package packet
+
+// Notation type represents a Notation Data subpacket
+// see https://tools.ietf.org/html/rfc4880#section-5.2.3.16
+type Notation struct {
+	Name            string
+	Value           []byte
+	IsCritical      bool
+	IsHumanReadable bool
+}
+
+func (notation *Notation) getData() []byte {
+	nameData := []byte(notation.Name)
+	nameLen := len(nameData)
+	valueLen := len(notation.Value)
+
+	data := make([]byte, 8+nameLen+valueLen)
+	if notation.IsHumanReadable {
+		data[0] = 0x80
+	}
+
+	data[4] = byte(nameLen >> 8)
+	data[5] = byte(nameLen)
+	data[6] = byte(valueLen >> 8)
+	data[7] = byte(valueLen)
+	copy(data[8:8+nameLen], nameData)
+	copy(data[8+nameLen:], notation.Value)
+	return data
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/one_pass_signature.go

@@ -8,7 +8,7 @@ import (
 	"crypto"
 	"encoding/binary"
 	"github.com/ProtonMail/go-crypto/openpgp/errors"
-	"github.com/ProtonMail/go-crypto/openpgp/s2k"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
 	"io"
 	"strconv"
 )
@@ -37,7 +37,7 @@ func (ops *OnePassSignature) parse(r io.Reader) (err error) {
 	}
 
 	var ok bool
-	ops.Hash, ok = s2k.HashIdToHash(buf[2])
+	ops.Hash, ok = algorithm.HashIdToHashWithSha1(buf[2])
 	if !ok {
 		return errors.UnsupportedError("hash function: " + strconv.Itoa(int(buf[2])))
 	}
@@ -55,7 +55,7 @@ func (ops *OnePassSignature) Serialize(w io.Writer) error {
 	buf[0] = onePassSignatureVersion
 	buf[1] = uint8(ops.SigType)
 	var ok bool
-	buf[2], ok = s2k.HashToHashId(ops.Hash)
+	buf[2], ok = algorithm.HashToHashIdWithSha1(ops.Hash)
 	if !ok {
 		return errors.UnsupportedError("hash type: " + strconv.Itoa(int(ops.Hash)))
 	}

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/opaque.go

@@ -84,8 +84,9 @@ func (or *OpaqueReader) Next() (op *OpaquePacket, err error) {
 // OpaqueSubpacket represents an unparsed OpenPGP subpacket,
 // as found in signature and user attribute packets.
 type OpaqueSubpacket struct {
-	SubType  uint8
-	Contents []byte
+	SubType       uint8
+	EncodedLength []byte // Store the original encoded length for signature verifications.
+	Contents      []byte
 }
 
 // OpaqueSubpackets extracts opaque, unparsed OpenPGP subpackets from
@@ -109,6 +110,7 @@ func OpaqueSubpackets(contents []byte) (result []*OpaqueSubpacket, err error) {
 func nextSubpacket(contents []byte) (subHeaderLen int, subPacket *OpaqueSubpacket, err error) {
 	// RFC 4880, section 5.2.3.1
 	var subLen uint32
+	var encodedLength []byte
 	if len(contents) < 1 {
 		goto Truncated
 	}
@@ -119,6 +121,7 @@ func nextSubpacket(contents []byte) (subHeaderLen int, subPacket *OpaqueSubpacke
 		if len(contents) < subHeaderLen {
 			goto Truncated
 		}
+		encodedLength = contents[0:1]
 		subLen = uint32(contents[0])
 		contents = contents[1:]
 	case contents[0] < 255:
@@ -126,6 +129,7 @@ func nextSubpacket(contents []byte) (subHeaderLen int, subPacket *OpaqueSubpacke
 		if len(contents) < subHeaderLen {
 			goto Truncated
 		}
+		encodedLength = contents[0:2]
 		subLen = uint32(contents[0]-192)<<8 + uint32(contents[1]) + 192
 		contents = contents[2:]
 	default:
@@ -133,16 +137,19 @@ func nextSubpacket(contents []byte) (subHeaderLen int, subPacket *OpaqueSubpacke
 		if len(contents) < subHeaderLen {
 			goto Truncated
 		}
+		encodedLength = contents[0:5]
 		subLen = uint32(contents[1])<<24 |
 			uint32(contents[2])<<16 |
 			uint32(contents[3])<<8 |
 			uint32(contents[4])
 		contents = contents[5:]
+
 	}
 	if subLen > uint32(len(contents)) || subLen == 0 {
 		goto Truncated
 	}
 	subPacket.SubType = contents[0]
+	subPacket.EncodedLength = encodedLength
 	subPacket.Contents = contents[1:subLen]
 	return
 Truncated:
@@ -152,7 +159,9 @@ Truncated:
 
 func (osp *OpaqueSubpacket) Serialize(w io.Writer) (err error) {
 	buf := make([]byte, 6)
-	n := serializeSubpacketLength(buf, len(osp.Contents)+1)
+	copy(buf, osp.EncodedLength)
+	n := len(osp.EncodedLength)
+
 	buf[n] = osp.SubType
 	if _, err = w.Write(buf[:n+1]); err != nil {
 		return

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/packet.go

@@ -302,21 +302,21 @@ func consumeAll(r io.Reader) (n int64, err error) {
 type packetType uint8
 
 const (
-	packetTypeEncryptedKey              packetType = 1
-	packetTypeSignature                 packetType = 2
-	packetTypeSymmetricKeyEncrypted     packetType = 3
-	packetTypeOnePassSignature          packetType = 4
-	packetTypePrivateKey                packetType = 5
-	packetTypePublicKey                 packetType = 6
-	packetTypePrivateSubkey             packetType = 7
-	packetTypeCompressed                packetType = 8
-	packetTypeSymmetricallyEncrypted    packetType = 9
-	packetTypeLiteralData               packetType = 11
-	packetTypeUserId                    packetType = 13
-	packetTypePublicSubkey              packetType = 14
-	packetTypeUserAttribute             packetType = 17
-	packetTypeSymmetricallyEncryptedMDC packetType = 18
-	packetTypeAEADEncrypted             packetType = 20
+	packetTypeEncryptedKey                             packetType = 1
+	packetTypeSignature                                packetType = 2
+	packetTypeSymmetricKeyEncrypted                    packetType = 3
+	packetTypeOnePassSignature                         packetType = 4
+	packetTypePrivateKey                               packetType = 5
+	packetTypePublicKey                                packetType = 6
+	packetTypePrivateSubkey                            packetType = 7
+	packetTypeCompressed                               packetType = 8
+	packetTypeSymmetricallyEncrypted                   packetType = 9
+	packetTypeLiteralData                              packetType = 11
+	packetTypeUserId                                   packetType = 13
+	packetTypePublicSubkey                             packetType = 14
+	packetTypeUserAttribute                            packetType = 17
+	packetTypeSymmetricallyEncryptedIntegrityProtected packetType = 18
+	packetTypeAEADEncrypted                            packetType = 20
 )
 
 // EncryptedDataPacket holds encrypted data. It is currently implemented by
@@ -354,16 +354,16 @@ func Read(r io.Reader) (p Packet, err error) {
 	case packetTypeCompressed:
 		p = new(Compressed)
 	case packetTypeSymmetricallyEncrypted:
-		err = errors.UnsupportedError("Symmetrically encrypted packets without MDC are not supported")
+		p = new(SymmetricallyEncrypted)
 	case packetTypeLiteralData:
 		p = new(LiteralData)
 	case packetTypeUserId:
 		p = new(UserId)
 	case packetTypeUserAttribute:
 		p = new(UserAttribute)
-	case packetTypeSymmetricallyEncryptedMDC:
+	case packetTypeSymmetricallyEncryptedIntegrityProtected:
 		se := new(SymmetricallyEncrypted)
-		se.MDC = true
+		se.IntegrityProtected = true
 		p = se
 	case packetTypeAEADEncrypted:
 		p = new(AEADEncrypted)
@@ -384,18 +384,18 @@ func Read(r io.Reader) (p Packet, err error) {
 type SignatureType uint8
 
 const (
-	SigTypeBinary            SignatureType = 0x00
-	SigTypeText                            = 0x01
-	SigTypeGenericCert                     = 0x10
-	SigTypePersonaCert                     = 0x11
-	SigTypeCasualCert                      = 0x12
-	SigTypePositiveCert                    = 0x13
-	SigTypeSubkeyBinding                   = 0x18
-	SigTypePrimaryKeyBinding               = 0x19
-	SigTypeDirectSignature                 = 0x1F
-	SigTypeKeyRevocation                   = 0x20
-	SigTypeSubkeyRevocation                = 0x28
-	SigTypeCertificationRevocation         = 0x30
+	SigTypeBinary                  SignatureType = 0x00
+	SigTypeText                                  = 0x01
+	SigTypeGenericCert                           = 0x10
+	SigTypePersonaCert                           = 0x11
+	SigTypeCasualCert                            = 0x12
+	SigTypePositiveCert                          = 0x13
+	SigTypeSubkeyBinding                         = 0x18
+	SigTypePrimaryKeyBinding                     = 0x19
+	SigTypeDirectSignature                       = 0x1F
+	SigTypeKeyRevocation                         = 0x20
+	SigTypeSubkeyRevocation                      = 0x28
+	SigTypeCertificationRevocation               = 0x30
 )
 
 // PublicKeyAlgorithm represents the different public key system specified for
@@ -455,6 +455,11 @@ func (cipher CipherFunction) KeySize() int {
 	return algorithm.CipherFunction(cipher).KeySize()
 }
 
+// IsSupported returns true if the cipher is supported from the library
+func (cipher CipherFunction) IsSupported() bool {
+	return algorithm.CipherFunction(cipher).KeySize() > 0
+}
+
 // blockSize returns the block size, in bytes, of cipher.
 func (cipher CipherFunction) blockSize() int {
 	return algorithm.CipherFunction(cipher).BlockSize()
@@ -490,15 +495,16 @@ const (
 
 // AEADMode represents the different Authenticated Encryption with Associated
 // Data specified for OpenPGP.
+// See https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-9.6
 type AEADMode algorithm.AEADMode
 
 const (
-	AEADModeEAX             AEADMode = 1
-	AEADModeOCB             AEADMode = 2
-	AEADModeExperimentalGCM AEADMode = 100
+	AEADModeEAX AEADMode = 1
+	AEADModeOCB AEADMode = 2
+	AEADModeGCM AEADMode = 3
 )
 
-func (mode AEADMode) NonceLength() int {
+func (mode AEADMode) IvLength() int {
 	return algorithm.AEADMode(mode).NonceLength()
 }
 
@@ -521,3 +527,25 @@ const (
 	KeyCompromised ReasonForRevocation = 2
 	KeyRetired     ReasonForRevocation = 3
 )
+
+// Curve is a mapping to supported ECC curves for key generation.
+// See https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-06.html#name-curve-specific-wire-formats
+type Curve string
+
+const (
+	Curve25519         Curve = "Curve25519"
+	Curve448           Curve = "Curve448"
+	CurveNistP256      Curve = "P256"
+	CurveNistP384      Curve = "P384"
+	CurveNistP521      Curve = "P521"
+	CurveSecP256k1     Curve = "SecP256k1"
+	CurveBrainpoolP256 Curve = "BrainpoolP256"
+	CurveBrainpoolP384 Curve = "BrainpoolP384"
+	CurveBrainpoolP512 Curve = "BrainpoolP512"
+)
+
+// TrustLevel represents a trust level per RFC4880 5.2.3.13
+type TrustLevel uint8
+
+// TrustAmount represents a trust amount per RFC4880 5.2.3.13
+type TrustAmount uint8

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key.go

@@ -9,27 +9,22 @@ import (
 	"crypto"
 	"crypto/cipher"
 	"crypto/dsa"
-	"crypto/ecdsa"
-	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/sha1"
-	"fmt"
 	"io"
 	"io/ioutil"
 	"math/big"
 	"strconv"
 	"time"
 
-	"github.com/ProtonMail/go-crypto/openpgp/internal/ecc"
-	"golang.org/x/crypto/curve25519"
-
 	"github.com/ProtonMail/go-crypto/openpgp/ecdh"
+	"github.com/ProtonMail/go-crypto/openpgp/ecdsa"
+	"github.com/ProtonMail/go-crypto/openpgp/eddsa"
 	"github.com/ProtonMail/go-crypto/openpgp/elgamal"
 	"github.com/ProtonMail/go-crypto/openpgp/errors"
 	"github.com/ProtonMail/go-crypto/openpgp/internal/encoding"
 	"github.com/ProtonMail/go-crypto/openpgp/s2k"
-	"golang.org/x/crypto/ed25519"
 )
 
 // PrivateKey represents a possibly encrypted private key. See RFC 4880,
@@ -54,7 +49,7 @@ type PrivateKey struct {
 	s2kParams *s2k.Params
 }
 
-//S2KType s2k packet type
+// S2KType s2k packet type
 type S2KType uint8
 
 const (
@@ -94,10 +89,9 @@ func NewECDSAPrivateKey(creationTime time.Time, priv *ecdsa.PrivateKey) *Private
 	return pk
 }
 
-func NewEdDSAPrivateKey(creationTime time.Time, priv *ed25519.PrivateKey) *PrivateKey {
+func NewEdDSAPrivateKey(creationTime time.Time, priv *eddsa.PrivateKey) *PrivateKey {
 	pk := new(PrivateKey)
-	pub := priv.Public().(ed25519.PublicKey)
-	pk.PublicKey = *NewEdDSAPublicKey(creationTime, &pub)
+	pk.PublicKey = *NewEdDSAPublicKey(creationTime, &priv.PublicKey)
 	pk.PrivateKey = priv
 	return pk
 }
@@ -111,25 +105,25 @@ func NewECDHPrivateKey(creationTime time.Time, priv *ecdh.PrivateKey) *PrivateKe
 
 // NewSignerPrivateKey creates a PrivateKey from a crypto.Signer that
 // implements RSA, ECDSA or EdDSA.
-func NewSignerPrivateKey(creationTime time.Time, signer crypto.Signer) *PrivateKey {
+func NewSignerPrivateKey(creationTime time.Time, signer interface{}) *PrivateKey {
 	pk := new(PrivateKey)
 	// In general, the public Keys should be used as pointers. We still
 	// type-switch on the values, for backwards-compatibility.
-	switch pubkey := signer.Public().(type) {
-	case *rsa.PublicKey:
-		pk.PublicKey = *NewRSAPublicKey(creationTime, pubkey)
-	case rsa.PublicKey:
-		pk.PublicKey = *NewRSAPublicKey(creationTime, &pubkey)
-	case *ecdsa.PublicKey:
-		pk.PublicKey = *NewECDSAPublicKey(creationTime, pubkey)
-	case ecdsa.PublicKey:
-		pk.PublicKey = *NewECDSAPublicKey(creationTime, &pubkey)
-	case *ed25519.PublicKey:
-		pk.PublicKey = *NewEdDSAPublicKey(creationTime, pubkey)
-	case ed25519.PublicKey:
-		pk.PublicKey = *NewEdDSAPublicKey(creationTime, &pubkey)
+	switch pubkey := signer.(type) {
+	case *rsa.PrivateKey:
+		pk.PublicKey = *NewRSAPublicKey(creationTime, &pubkey.PublicKey)
+	case rsa.PrivateKey:
+		pk.PublicKey = *NewRSAPublicKey(creationTime, &pubkey.PublicKey)
+	case *ecdsa.PrivateKey:
+		pk.PublicKey = *NewECDSAPublicKey(creationTime, &pubkey.PublicKey)
+	case ecdsa.PrivateKey:
+		pk.PublicKey = *NewECDSAPublicKey(creationTime, &pubkey.PublicKey)
+	case *eddsa.PrivateKey:
+		pk.PublicKey = *NewEdDSAPublicKey(creationTime, &pubkey.PublicKey)
+	case eddsa.PrivateKey:
+		pk.PublicKey = *NewEdDSAPublicKey(creationTime, &pubkey.PublicKey)
 	default:
-		panic("openpgp: unknown crypto.Signer type in NewSignerPrivateKey")
+		panic("openpgp: unknown signer type in NewSignerPrivateKey")
 	}
 	pk.PrivateKey = signer
 	return pk
@@ -185,6 +179,9 @@ func (pk *PrivateKey) parse(r io.Reader) (err error) {
 			return
 		}
 		pk.cipher = CipherFunction(buf[0])
+		if pk.cipher != 0 && !pk.cipher.IsSupported() {
+			return errors.UnsupportedError("unsupported cipher function in private key")
+		}
 		pk.s2kParams, err = s2k.ParseIntoParams(r)
 		if err != nil {
 			return
@@ -239,6 +236,18 @@ func (pk *PrivateKey) parse(r io.Reader) (err error) {
 		}
 	}
 	if !pk.Encrypted {
+		if len(privateKeyData) < 2 {
+			return errors.StructuralError("truncated private key data")
+		}
+		var sum uint16
+		for i := 0; i < len(privateKeyData)-2; i++ {
+			sum += uint16(privateKeyData[i])
+		}
+		if privateKeyData[len(privateKeyData)-2] != uint8(sum>>8) ||
+			privateKeyData[len(privateKeyData)-1] != uint8(sum) {
+			return errors.StructuralError("private key checksum failure")
+		}
+		privateKeyData = privateKeyData[:len(privateKeyData)-2]
 		return pk.parsePrivateKey(privateKeyData)
 	}
 
@@ -294,14 +303,8 @@ func (pk *PrivateKey) Serialize(w io.Writer) (err error) {
 				return err
 			}
 			l = buf.Len()
-			if pk.sha1Checksum {
-				h := sha1.New()
-				h.Write(buf.Bytes())
-				buf.Write(h.Sum(nil))
-			} else {
-				checksum := mod64kHash(buf.Bytes())
-				buf.Write([]byte{byte(checksum >> 8), byte(checksum)})
-			}
+			checksum := mod64kHash(buf.Bytes())
+			buf.Write([]byte{byte(checksum >> 8), byte(checksum)})
 			priv = buf.Bytes()
 		} else {
 			priv, l = pk.encryptedData, len(pk.encryptedData)
@@ -353,23 +356,22 @@ func serializeElGamalPrivateKey(w io.Writer, priv *elgamal.PrivateKey) error {
 }
 
 func serializeECDSAPrivateKey(w io.Writer, priv *ecdsa.PrivateKey) error {
-	_, err := w.Write(new(encoding.MPI).SetBig(priv.D).EncodedBytes())
+	_, err := w.Write(encoding.NewMPI(priv.MarshalIntegerSecret()).EncodedBytes())
 	return err
 }
 
-func serializeEdDSAPrivateKey(w io.Writer, priv *ed25519.PrivateKey) error {
-	keySize := ed25519.PrivateKeySize - ed25519.PublicKeySize
-	_, err := w.Write(encoding.NewMPI((*priv)[:keySize]).EncodedBytes())
+func serializeEdDSAPrivateKey(w io.Writer, priv *eddsa.PrivateKey) error {
+	_, err := w.Write(encoding.NewMPI(priv.MarshalByteSecret()).EncodedBytes())
 	return err
 }
 
 func serializeECDHPrivateKey(w io.Writer, priv *ecdh.PrivateKey) error {
-	_, err := w.Write(encoding.NewMPI(priv.D).EncodedBytes())
+	_, err := w.Write(encoding.NewMPI(priv.MarshalByteSecret()).EncodedBytes())
 	return err
 }
 
-// Decrypt decrypts an encrypted private key using a passphrase.
-func (pk *PrivateKey) Decrypt(passphrase []byte) error {
+// decrypt decrypts an encrypted private key using a decryption key.
+func (pk *PrivateKey) decrypt(decryptionKey []byte) error {
 	if pk.Dummy() {
 		return errors.ErrDummyPrivateKey("dummy key found")
 	}
@@ -377,9 +379,7 @@ func (pk *PrivateKey) Decrypt(passphrase []byte) error {
 		return nil
 	}
 
-	key := make([]byte, pk.cipher.KeySize())
-	pk.s2k(key, passphrase)
-	block := pk.cipher.new(key)
+	block := pk.cipher.new(decryptionKey)
 	cfb := cipher.NewCFBDecrypter(block, pk.iv)
 
 	data := make([]byte, len(pk.encryptedData))
@@ -428,35 +428,79 @@ func (pk *PrivateKey) Decrypt(passphrase []byte) error {
 	return nil
 }
 
-// Encrypt encrypts an unencrypted private key using a passphrase.
-func (pk *PrivateKey) Encrypt(passphrase []byte) error {
+func (pk *PrivateKey) decryptWithCache(passphrase []byte, keyCache *s2k.Cache) error {
+	if pk.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy key found")
+	}
+	if !pk.Encrypted {
+		return nil
+	}
+
+	key, err := keyCache.GetOrComputeDerivedKey(passphrase, pk.s2kParams, pk.cipher.KeySize())
+	if err != nil {
+		return err
+	}
+	return pk.decrypt(key)
+}
+
+// Decrypt decrypts an encrypted private key using a passphrase.
+func (pk *PrivateKey) Decrypt(passphrase []byte) error {
+	if pk.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy key found")
+	}
+	if !pk.Encrypted {
+		return nil
+	}
+
+	key := make([]byte, pk.cipher.KeySize())
+	pk.s2k(key, passphrase)
+	return pk.decrypt(key)
+}
+
+// DecryptPrivateKeys decrypts all encrypted keys with the given config and passphrase.
+// Avoids recomputation of similar s2k key derivations. 
+func DecryptPrivateKeys(keys []*PrivateKey, passphrase []byte) error {
+	// Create a cache to avoid recomputation of key derviations for the same passphrase.
+	s2kCache := &s2k.Cache{}
+	for _, key := range keys {
+		if key != nil && !key.Dummy() && key.Encrypted {
+			err := key.decryptWithCache(passphrase, s2kCache)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// encrypt encrypts an unencrypted private key.
+func (pk *PrivateKey) encrypt(key []byte, params *s2k.Params, cipherFunction CipherFunction) error {
+	if pk.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy key found")
+	}
+	if pk.Encrypted {
+		return nil
+	}
+	// check if encryptionKey has the correct size
+	if len(key) != cipherFunction.KeySize() {
+		return errors.InvalidArgumentError("supplied encryption key has the wrong size")
+	}
+	
 	priv := bytes.NewBuffer(nil)
 	err := pk.serializePrivateKey(priv)
 	if err != nil {
 		return err
 	}
 
-	//Default config of private key encryption
-	pk.cipher = CipherAES256
-	s2kConfig := &s2k.Config{
-		S2KMode:  3, //Iterated
-		S2KCount: 65536,
-		Hash:     crypto.SHA256,
-	}
-
-	pk.s2kParams, err = s2k.Generate(rand.Reader, s2kConfig)
-	if err != nil {
-		return err
-	}
-	privateKeyBytes := priv.Bytes()
-	key := make([]byte, pk.cipher.KeySize())
-
-	pk.sha1Checksum = true
+	pk.cipher = cipherFunction
+	pk.s2kParams = params
 	pk.s2k, err = pk.s2kParams.Function()
 	if err != nil {
 		return err
-	}
-	pk.s2k(key, passphrase)
+	} 
+
+	privateKeyBytes := priv.Bytes()
+	pk.sha1Checksum = true
 	block := pk.cipher.new(key)
 	pk.iv = make([]byte, pk.cipher.blockSize())
 	_, err = rand.Read(pk.iv)
@@ -487,6 +531,62 @@ func (pk *PrivateKey) Encrypt(passphrase []byte) error {
 	return err
 }
 
+// EncryptWithConfig encrypts an unencrypted private key using the passphrase and the config.
+func (pk *PrivateKey) EncryptWithConfig(passphrase []byte, config *Config) error {
+	params, err := s2k.Generate(config.Random(), config.S2K())
+	if err != nil {
+		return err
+	}
+	// Derive an encryption key with the configured s2k function.
+	key := make([]byte, config.Cipher().KeySize())
+	s2k, err := params.Function()
+	if err != nil {
+		return err
+	}
+	s2k(key, passphrase)
+	// Encrypt the private key with the derived encryption key.
+	return pk.encrypt(key, params, config.Cipher())
+}
+
+// EncryptPrivateKeys encrypts all unencrypted keys with the given config and passphrase.
+// Only derives one key from the passphrase, which is then used to encrypt each key.
+func EncryptPrivateKeys(keys []*PrivateKey, passphrase []byte, config *Config) error {
+	params, err := s2k.Generate(config.Random(), config.S2K())
+	if err != nil {
+		return err
+	}
+	// Derive an encryption key with the configured s2k function.
+	encryptionKey := make([]byte, config.Cipher().KeySize())
+	s2k, err := params.Function()
+	if err != nil {
+		return err
+	}
+	s2k(encryptionKey, passphrase)
+	for _, key := range keys {
+		if key != nil && !key.Dummy() && !key.Encrypted {
+			err = key.encrypt(encryptionKey, params, config.Cipher())
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// Encrypt encrypts an unencrypted private key using a passphrase.
+func (pk *PrivateKey) Encrypt(passphrase []byte) error {
+	// Default config of private key encryption
+	config := &Config{
+		S2KConfig: &s2k.Config{
+			S2KMode:  s2k.IteratedSaltedS2K,
+			S2KCount: 65536,
+			Hash:     crypto.SHA256,
+		} ,
+		DefaultCipher: CipherAES256,
+	}
+	return pk.EncryptWithConfig(passphrase, config)
+}
+
 func (pk *PrivateKey) serializePrivateKey(w io.Writer) (err error) {
 	switch priv := pk.PrivateKey.(type) {
 	case *rsa.PrivateKey:
@@ -497,7 +597,7 @@ func (pk *PrivateKey) serializePrivateKey(w io.Writer) (err error) {
 		err = serializeElGamalPrivateKey(w, priv)
 	case *ecdsa.PrivateKey:
 		err = serializeECDSAPrivateKey(w, priv)
-	case *ed25519.PrivateKey:
+	case *eddsa.PrivateKey:
 		err = serializeEdDSAPrivateKey(w, priv)
 	case *ecdh.PrivateKey:
 		err = serializeECDHPrivateKey(w, priv)
@@ -601,8 +701,7 @@ func (pk *PrivateKey) parseElGamalPrivateKey(data []byte) (err error) {
 
 func (pk *PrivateKey) parseECDSAPrivateKey(data []byte) (err error) {
 	ecdsaPub := pk.PublicKey.PublicKey.(*ecdsa.PublicKey)
-	ecdsaPriv := new(ecdsa.PrivateKey)
-	ecdsaPriv.PublicKey = *ecdsaPub
+	ecdsaPriv := ecdsa.NewPrivateKey(*ecdsaPub)
 
 	buf := bytes.NewBuffer(data)
 	d := new(encoding.MPI)
@@ -610,8 +709,10 @@ func (pk *PrivateKey) parseECDSAPrivateKey(data []byte) (err error) {
 		return err
 	}
 
-	ecdsaPriv.D = new(big.Int).SetBytes(d.Bytes())
-	if err := validateECDSAParameters(ecdsaPriv); err != nil {
+	if err := ecdsaPriv.UnmarshalIntegerSecret(d.Bytes()); err != nil {
+		return err
+	}
+	if err := ecdsa.Validate(ecdsaPriv); err != nil {
 		return err
 	}
 	pk.PrivateKey = ecdsaPriv
@@ -621,8 +722,7 @@ func (pk *PrivateKey) parseECDSAPrivateKey(data []byte) (err error) {
 
 func (pk *PrivateKey) parseECDHPrivateKey(data []byte) (err error) {
 	ecdhPub := pk.PublicKey.PublicKey.(*ecdh.PublicKey)
-	ecdhPriv := new(ecdh.PrivateKey)
-	ecdhPriv.PublicKey = *ecdhPub
+	ecdhPriv := ecdh.NewPrivateKey(*ecdhPub)
 
 	buf := bytes.NewBuffer(data)
 	d := new(encoding.MPI)
@@ -630,18 +730,23 @@ func (pk *PrivateKey) parseECDHPrivateKey(data []byte) (err error) {
 		return err
 	}
 
-	ecdhPriv.D = d.Bytes()
-	if err := validateECDHParameters(ecdhPriv); err != nil {
+	if err := ecdhPriv.UnmarshalByteSecret(d.Bytes()); err != nil {
 		return err
 	}
+
+	if err := ecdh.Validate(ecdhPriv); err != nil {
+		return err
+	}
+
 	pk.PrivateKey = ecdhPriv
 
 	return nil
 }
 
 func (pk *PrivateKey) parseEdDSAPrivateKey(data []byte) (err error) {
-	eddsaPub := pk.PublicKey.PublicKey.(*ed25519.PublicKey)
-	eddsaPriv := make(ed25519.PrivateKey, ed25519.PrivateKeySize)
+	eddsaPub := pk.PublicKey.PublicKey.(*eddsa.PublicKey)
+	eddsaPriv := eddsa.NewPrivateKey(*eddsaPub)
+	eddsaPriv.PublicKey = *eddsaPub
 
 	buf := bytes.NewBuffer(data)
 	d := new(encoding.MPI)
@@ -649,64 +754,16 @@ func (pk *PrivateKey) parseEdDSAPrivateKey(data []byte) (err error) {
 		return err
 	}
 
-	priv := d.Bytes()
-	copy(eddsaPriv[32-len(priv):32], priv)
-	copy(eddsaPriv[32:], (*eddsaPub)[:])
-	if err := validateEdDSAParameters(&eddsaPriv); err != nil {
+	if err = eddsaPriv.UnmarshalByteSecret(d.Bytes()); err != nil {
 		return err
 	}
-	pk.PrivateKey = &eddsaPriv
 
-	return nil
-}
+	if err := eddsa.Validate(eddsaPriv); err != nil {
+		return err
+	}
 
-func validateECDSAParameters(priv *ecdsa.PrivateKey) error {
-	return validateCommonECC(priv.Curve, priv.D.Bytes(), priv.X, priv.Y)
-}
+	pk.PrivateKey = eddsaPriv
 
-func validateECDHParameters(priv *ecdh.PrivateKey) error {
-	if priv.CurveType != ecc.Curve25519 {
-		return validateCommonECC(priv.Curve, priv.D, priv.X, priv.Y)
-	}
-	// Handle Curve25519
-	Q := priv.X.Bytes()[1:]
-	var d [32]byte
-	// Copy reversed d
-	l := len(priv.D)
-	for i := 0; i < l; i++ {
-		d[i] = priv.D[l-i-1]
-	}
-	var expectedQ [32]byte
-	curve25519.ScalarBaseMult(&expectedQ, &d)
-	if !bytes.Equal(Q, expectedQ[:]) {
-		return errors.KeyInvalidError("ECDH curve25519: invalid point")
-	}
-	return nil
-}
-
-func validateCommonECC(curve elliptic.Curve, d []byte, X, Y *big.Int) error {
-	// the public point should not be at infinity (0,0)
-	zero := new(big.Int)
-	if X.Cmp(zero) == 0 && Y.Cmp(zero) == 0 {
-		return errors.KeyInvalidError(fmt.Sprintf("ecc (%s): infinity point", curve.Params().Name))
-	}
-	// re-derive the public point Q' = (X,Y) = dG
-	// to compare to declared Q in public key
-	expectedX, expectedY := curve.ScalarBaseMult(d)
-	if X.Cmp(expectedX) != 0 || Y.Cmp(expectedY) != 0 {
-		return errors.KeyInvalidError(fmt.Sprintf("ecc (%s): invalid point", curve.Params().Name))
-	}
-	return nil
-}
-
-func validateEdDSAParameters(priv *ed25519.PrivateKey) error {
-	// In EdDSA, the serialized public point is stored as part of private key (together with the seed),
-	// hence we can re-derive the key from the seed
-	seed := priv.Seed()
-	expectedPriv := ed25519.NewKeyFromSeed(seed)
-	if !bytes.Equal(*priv, expectedPriv) {
-		return errors.KeyInvalidError("eddsa: invalid point")
-	}
 	return nil
 }
 

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key.go

@@ -7,8 +7,6 @@ package packet
 import (
 	"crypto"
 	"crypto/dsa"
-	"crypto/ecdsa"
-	"crypto/elliptic"
 	"crypto/rsa"
 	"crypto/sha1"
 	"crypto/sha256"
@@ -22,12 +20,13 @@ import (
 	"time"
 
 	"github.com/ProtonMail/go-crypto/openpgp/ecdh"
+	"github.com/ProtonMail/go-crypto/openpgp/ecdsa"
+	"github.com/ProtonMail/go-crypto/openpgp/eddsa"
 	"github.com/ProtonMail/go-crypto/openpgp/elgamal"
 	"github.com/ProtonMail/go-crypto/openpgp/errors"
 	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
 	"github.com/ProtonMail/go-crypto/openpgp/internal/ecc"
 	"github.com/ProtonMail/go-crypto/openpgp/internal/encoding"
-	"golang.org/x/crypto/ed25519"
 )
 
 type kdfHashFunction byte
@@ -124,10 +123,10 @@ func NewECDSAPublicKey(creationTime time.Time, pub *ecdsa.PublicKey) *PublicKey
 		CreationTime: creationTime,
 		PubKeyAlgo:   PubKeyAlgoECDSA,
 		PublicKey:    pub,
-		p:            encoding.NewMPI(elliptic.Marshal(pub.Curve, pub.X, pub.Y)),
+		p:            encoding.NewMPI(pub.MarshalPoint()),
 	}
 
-	curveInfo := ecc.FindByCurve(pub.Curve)
+	curveInfo := ecc.FindByCurve(pub.GetCurve())
 	if curveInfo == nil {
 		panic("unknown elliptic curve")
 	}
@@ -138,39 +137,29 @@ func NewECDSAPublicKey(creationTime time.Time, pub *ecdsa.PublicKey) *PublicKey
 
 func NewECDHPublicKey(creationTime time.Time, pub *ecdh.PublicKey) *PublicKey {
 	var pk *PublicKey
-	var curveInfo *ecc.CurveInfo
 	var kdf = encoding.NewOID([]byte{0x1, pub.Hash.Id(), pub.Cipher.Id()})
-	if pub.CurveType == ecc.Curve25519 {
-		pk = &PublicKey{
-			Version:      4,
-			CreationTime: creationTime,
-			PubKeyAlgo:   PubKeyAlgoECDH,
-			PublicKey:    pub,
-			p:            encoding.NewMPI(pub.X.Bytes()),
-			kdf:          kdf,
-		}
-		curveInfo = ecc.FindByName("Curve25519")
-	} else {
-		pk = &PublicKey{
-			Version:      4,
-			CreationTime: creationTime,
-			PubKeyAlgo:   PubKeyAlgoECDH,
-			PublicKey:    pub,
-			p:            encoding.NewMPI(elliptic.Marshal(pub.Curve, pub.X, pub.Y)),
-			kdf:          kdf,
-		}
-		curveInfo = ecc.FindByCurve(pub.Curve)
+	pk = &PublicKey{
+		Version:      4,
+		CreationTime: creationTime,
+		PubKeyAlgo:   PubKeyAlgoECDH,
+		PublicKey:    pub,
+		p:            encoding.NewMPI(pub.MarshalPoint()),
+		kdf:          kdf,
 	}
+
+	curveInfo := ecc.FindByCurve(pub.GetCurve())
+
 	if curveInfo == nil {
 		panic("unknown elliptic curve")
 	}
+
 	pk.oid = curveInfo.Oid
 	pk.setFingerprintAndKeyId()
 	return pk
 }
 
-func NewEdDSAPublicKey(creationTime time.Time, pub *ed25519.PublicKey) *PublicKey {
-	curveInfo := ecc.FindByName("Ed25519")
+func NewEdDSAPublicKey(creationTime time.Time, pub *eddsa.PublicKey) *PublicKey {
+	curveInfo := ecc.FindByCurve(pub.GetCurve())
 	pk := &PublicKey{
 		Version:      4,
 		CreationTime: creationTime,
@@ -178,7 +167,7 @@ func NewEdDSAPublicKey(creationTime time.Time, pub *ed25519.PublicKey) *PublicKe
 		PublicKey:    pub,
 		oid:          curveInfo.Oid,
 		// Native point format, see draft-koch-eddsa-for-openpgp-04, Appendix B
-		p: encoding.NewMPI(append([]byte{0x40}, *pub...)),
+		p: encoding.NewMPI(pub.MarshalPoint()),
 	}
 
 	pk.setFingerprintAndKeyId()
@@ -340,17 +329,20 @@ func (pk *PublicKey) parseECDSA(r io.Reader) (err error) {
 		return
 	}
 
-	var c elliptic.Curve
 	curveInfo := ecc.FindByOid(pk.oid)
-	if curveInfo == nil || curveInfo.SigAlgorithm != ecc.ECDSA {
+	if curveInfo == nil {
+		return errors.UnsupportedError(fmt.Sprintf("unknown oid: %x", pk.oid))
+	}
+
+	c, ok := curveInfo.Curve.(ecc.ECDSACurve)
+	if !ok {
 		return errors.UnsupportedError(fmt.Sprintf("unsupported oid: %x", pk.oid))
 	}
-	c = curveInfo.Curve
-	x, y := elliptic.Unmarshal(c, pk.p.Bytes())
-	if x == nil {
-		return errors.UnsupportedError("failed to parse EC point")
-	}
-	pk.PublicKey = &ecdsa.PublicKey{Curve: c, X: x, Y: y}
+
+	ecdsaKey := ecdsa.NewPublicKey(c)
+	err = ecdsaKey.UnmarshalPoint(pk.p.Bytes())
+	pk.PublicKey = ecdsaKey
+
 	return
 }
 
@@ -371,24 +363,16 @@ func (pk *PublicKey) parseECDH(r io.Reader) (err error) {
 	}
 
 	curveInfo := ecc.FindByOid(pk.oid)
+
 	if curveInfo == nil {
+		return errors.UnsupportedError(fmt.Sprintf("unknown oid: %x", pk.oid))
+	}
+
+	c, ok := curveInfo.Curve.(ecc.ECDHCurve)
+	if !ok {
 		return errors.UnsupportedError(fmt.Sprintf("unsupported oid: %x", pk.oid))
 	}
 
-	c := curveInfo.Curve
-	cType := curveInfo.CurveType
-
-	var x, y *big.Int
-	if cType == ecc.Curve25519 {
-		x = new(big.Int)
-		x.SetBytes(pk.p.Bytes())
-	} else {
-		x, y = elliptic.Unmarshal(c, pk.p.Bytes())
-	}
-	if x == nil {
-		return errors.UnsupportedError("failed to parse EC point")
-	}
-
 	if kdfLen := len(pk.kdf.Bytes()); kdfLen < 3 {
 		return errors.UnsupportedError("unsupported ECDH KDF length: " + strconv.Itoa(kdfLen))
 	}
@@ -404,16 +388,10 @@ func (pk *PublicKey) parseECDH(r io.Reader) (err error) {
 		return errors.UnsupportedError("unsupported ECDH KDF cipher: " + strconv.Itoa(int(pk.kdf.Bytes()[2])))
 	}
 
-	pk.PublicKey = &ecdh.PublicKey{
-		CurveType: cType,
-		Curve:     c,
-		X:         x,
-		Y:         y,
-		KDF: ecdh.KDF{
-			Hash:   kdfHash,
-			Cipher: kdfCipher,
-		},
-	}
+	ecdhKey := ecdh.NewPublicKey(c, kdfHash, kdfCipher)
+	err = ecdhKey.UnmarshalPoint(pk.p.Bytes())
+	pk.PublicKey = ecdhKey
+
 	return
 }
 
@@ -423,26 +401,37 @@ func (pk *PublicKey) parseEdDSA(r io.Reader) (err error) {
 		return
 	}
 	curveInfo := ecc.FindByOid(pk.oid)
-	if curveInfo == nil || curveInfo.SigAlgorithm != ecc.EdDSA {
+	if curveInfo == nil {
+		return errors.UnsupportedError(fmt.Sprintf("unknown oid: %x", pk.oid))
+	}
+
+	c, ok := curveInfo.Curve.(ecc.EdDSACurve)
+	if !ok {
 		return errors.UnsupportedError(fmt.Sprintf("unsupported oid: %x", pk.oid))
 	}
+
 	pk.p = new(encoding.MPI)
 	if _, err = pk.p.ReadFrom(r); err != nil {
 		return
 	}
 
-	eddsa := make(ed25519.PublicKey, ed25519.PublicKeySize)
+	if len(pk.p.Bytes()) == 0 {
+		return errors.StructuralError("empty EdDSA public key")
+	}
+
+	pub := eddsa.NewPublicKey(c)
+
 	switch flag := pk.p.Bytes()[0]; flag {
 	case 0x04:
 		// TODO: see _grcy_ecc_eddsa_ensure_compact in grcypt
 		return errors.UnsupportedError("unsupported EdDSA compression: " + strconv.Itoa(int(flag)))
 	case 0x40:
-		copy(eddsa[:], pk.p.Bytes()[1:])
+		err = pub.UnmarshalPoint(pk.p.Bytes())
 	default:
 		return errors.UnsupportedError("unsupported EdDSA compression: " + strconv.Itoa(int(flag)))
 	}
 
-	pk.PublicKey = &eddsa
+	pk.PublicKey = pub
 	return
 }
 
@@ -611,7 +600,7 @@ func (pk *PublicKey) VerifySignature(signed hash.Hash, sig *Signature) (err erro
 	}
 	signed.Write(sig.HashSuffix)
 	hashBytes := signed.Sum(nil)
-	if hashBytes[0] != sig.HashTag[0] || hashBytes[1] != sig.HashTag[1] {
+	if sig.Version == 5 && (hashBytes[0] != sig.HashTag[0] || hashBytes[1] != sig.HashTag[1]) {
 		return errors.SignatureError("hash tag doesn't match")
 	}
 
@@ -645,16 +634,8 @@ func (pk *PublicKey) VerifySignature(signed hash.Hash, sig *Signature) (err erro
 		}
 		return nil
 	case PubKeyAlgoEdDSA:
-		eddsaPublicKey := pk.PublicKey.(*ed25519.PublicKey)
-
-		sigR := sig.EdDSASigR.Bytes()
-		sigS := sig.EdDSASigS.Bytes()
-
-		eddsaSig := make([]byte, ed25519.SignatureSize)
-		copy(eddsaSig[32-len(sigR):32], sigR)
-		copy(eddsaSig[64-len(sigS):], sigS)
-
-		if !ed25519.Verify(*eddsaPublicKey, hashBytes, eddsaSig) {
+		eddsaPublicKey := pk.PublicKey.(*eddsa.PublicKey)
+		if !eddsa.Verify(eddsaPublicKey, hashBytes, sig.EdDSASigR.Bytes(), sig.EdDSASigS.Bytes()) {
 			return errors.SignatureError("EdDSA verification failure")
 		}
 		return nil

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/reader.go

@@ -44,9 +44,17 @@ func (r *Reader) Next() (p Packet, err error) {
 			continue
 		}
 		// TODO: Add strict mode that rejects unknown packets, instead of ignoring them.
-		if _, ok := err.(errors.UnknownPacketTypeError); !ok {
-			return nil, err
+		if _, ok := err.(errors.UnknownPacketTypeError); ok {
+			continue
 		}
+		if _, ok := err.(errors.UnsupportedError); ok {
+			switch p.(type) {
+			case *SymmetricallyEncrypted, *AEADEncrypted, *Compressed, *LiteralData:
+				return nil, err
+			}
+			continue
+		}
+		return nil, err
 	}
 
 	return nil, io.EOF

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/signature.go

@@ -8,18 +8,17 @@ import (
 	"bytes"
 	"crypto"
 	"crypto/dsa"
-	"crypto/ecdsa"
-	"encoding/asn1"
 	"encoding/binary"
 	"hash"
 	"io"
-	"math/big"
 	"strconv"
 	"time"
 
+	"github.com/ProtonMail/go-crypto/openpgp/ecdsa"
+	"github.com/ProtonMail/go-crypto/openpgp/eddsa"
 	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
 	"github.com/ProtonMail/go-crypto/openpgp/internal/encoding"
-	"github.com/ProtonMail/go-crypto/openpgp/s2k"
 )
 
 const (
@@ -67,10 +66,24 @@ type Signature struct {
 
 	SigLifetimeSecs, KeyLifetimeSecs                        *uint32
 	PreferredSymmetric, PreferredHash, PreferredCompression []uint8
-	PreferredAEAD                                           []uint8
+	PreferredCipherSuites                                   [][2]uint8
 	IssuerKeyId                                             *uint64
 	IssuerFingerprint                                       []byte
+	SignerUserId                                            *string
 	IsPrimaryId                                             *bool
+	Notations                                               []*Notation
+
+	// TrustLevel and TrustAmount can be set by the signer to assert that
+	// the key is not only valid but also trustworthy at the specified
+	// level.
+	// See RFC 4880, section 5.2.3.13 for details.
+	TrustLevel  TrustLevel
+	TrustAmount TrustAmount
+
+	// TrustRegularExpression can be used in conjunction with trust Signature
+	// packets to limit the scope of the trust that is extended.
+	// See RFC 4880, section 5.2.3.14 for details.
+	TrustRegularExpression *string
 
 	// PolicyURI can be set to the URI of a document that describes the
 	// policy under which the signature was issued. See RFC 4880, section
@@ -89,8 +102,8 @@ type Signature struct {
 
 	// In a self-signature, these flags are set there is a features subpacket
 	// indicating that the issuer implementation supports these features
-	// (section 5.2.5.25).
-	MDC, AEAD, V5Keys bool
+	// see https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh#features-subpacket
+	SEIPDv1, SEIPDv2 bool
 
 	// EmbeddedSignature, if non-nil, is a signature of the parent key, by
 	// this key. This prevents an attacker from claiming another's signing
@@ -126,7 +139,13 @@ func (sig *Signature) parse(r io.Reader) (err error) {
 	}
 
 	var ok bool
-	sig.Hash, ok = s2k.HashIdToHash(buf[2])
+
+	if sig.Version < 5 {
+		sig.Hash, ok = algorithm.HashIdToHashWithSha1(buf[2])
+	} else {
+		sig.Hash, ok = algorithm.HashIdToHash(buf[2])
+	}
+
 	if !ok {
 		return errors.UnsupportedError("hash function " + strconv.Itoa(int(buf[2])))
 	}
@@ -137,7 +156,11 @@ func (sig *Signature) parse(r io.Reader) (err error) {
 	if err != nil {
 		return
 	}
-	sig.buildHashSuffix(hashedSubpackets)
+	err = sig.buildHashSuffix(hashedSubpackets)
+	if err != nil {
+		return
+	}
+
 	err = parseSignatureSubpackets(sig, hashedSubpackets, true)
 	if err != nil {
 		return
@@ -221,19 +244,23 @@ type signatureSubpacketType uint8
 const (
 	creationTimeSubpacket        signatureSubpacketType = 2
 	signatureExpirationSubpacket signatureSubpacketType = 3
+	trustSubpacket               signatureSubpacketType = 5
+	regularExpressionSubpacket   signatureSubpacketType = 6
 	keyExpirationSubpacket       signatureSubpacketType = 9
 	prefSymmetricAlgosSubpacket  signatureSubpacketType = 11
 	issuerSubpacket              signatureSubpacketType = 16
+	notationDataSubpacket        signatureSubpacketType = 20
 	prefHashAlgosSubpacket       signatureSubpacketType = 21
 	prefCompressionSubpacket     signatureSubpacketType = 22
 	primaryUserIdSubpacket       signatureSubpacketType = 25
 	policyUriSubpacket           signatureSubpacketType = 26
 	keyFlagsSubpacket            signatureSubpacketType = 27
+	signerUserIdSubpacket        signatureSubpacketType = 28
 	reasonForRevocationSubpacket signatureSubpacketType = 29
 	featuresSubpacket            signatureSubpacketType = 30
 	embeddedSignatureSubpacket   signatureSubpacketType = 32
 	issuerFingerprintSubpacket   signatureSubpacketType = 33
-	prefAeadAlgosSubpacket       signatureSubpacketType = 34
+	prefCipherSuitesSubpacket    signatureSubpacketType = 39
 )
 
 // parseSignatureSubpacket parses a single subpacket. len(subpacket) is >= 1.
@@ -244,6 +271,10 @@ func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (r
 		packetType signatureSubpacketType
 		isCritical bool
 	)
+	if len(subpacket) == 0 {
+		err = errors.StructuralError("zero length signature subpacket")
+		return
+	}
 	switch {
 	case subpacket[0] < 192:
 		length = uint32(subpacket[0])
@@ -277,12 +308,14 @@ func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (r
 	isCritical = subpacket[0]&0x80 == 0x80
 	subpacket = subpacket[1:]
 	sig.rawSubpackets = append(sig.rawSubpackets, outputSubpacket{isHashed, packetType, isCritical, subpacket})
+	if !isHashed &&
+		packetType != issuerSubpacket &&
+		packetType != issuerFingerprintSubpacket &&
+		packetType != embeddedSignatureSubpacket {
+		return
+	}
 	switch packetType {
 	case creationTimeSubpacket:
-		if !isHashed {
-			err = errors.StructuralError("signature creation time in non-hashed area")
-			return
-		}
 		if len(subpacket) != 4 {
 			err = errors.StructuralError("signature creation time not four bytes")
 			return
@@ -291,20 +324,35 @@ func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (r
 		sig.CreationTime = time.Unix(int64(t), 0)
 	case signatureExpirationSubpacket:
 		// Signature expiration time, section 5.2.3.10
-		if !isHashed {
-			return
-		}
 		if len(subpacket) != 4 {
 			err = errors.StructuralError("expiration subpacket with bad length")
 			return
 		}
 		sig.SigLifetimeSecs = new(uint32)
 		*sig.SigLifetimeSecs = binary.BigEndian.Uint32(subpacket)
-	case keyExpirationSubpacket:
-		// Key expiration time, section 5.2.3.6
-		if !isHashed {
+	case trustSubpacket:
+		if len(subpacket) != 2 {
+			err = errors.StructuralError("trust subpacket with bad length")
 			return
 		}
+		// Trust level and amount, section 5.2.3.13
+		sig.TrustLevel = TrustLevel(subpacket[0])
+		sig.TrustAmount = TrustAmount(subpacket[1])
+	case regularExpressionSubpacket:
+		if len(subpacket) == 0 {
+			err = errors.StructuralError("regexp subpacket with bad length")
+			return
+		}
+		// Trust regular expression, section 5.2.3.14
+		// RFC specifies the string should be null-terminated; remove a null byte from the end
+		if subpacket[len(subpacket)-1] != 0x00 {
+			err = errors.StructuralError("expected regular expression to be null-terminated")
+			return
+		}
+		trustRegularExpression := string(subpacket[:len(subpacket)-1])
+		sig.TrustRegularExpression = &trustRegularExpression
+	case keyExpirationSubpacket:
+		// Key expiration time, section 5.2.3.6
 		if len(subpacket) != 4 {
 			err = errors.StructuralError("key expiration subpacket with bad length")
 			return
@@ -313,41 +361,52 @@ func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (r
 		*sig.KeyLifetimeSecs = binary.BigEndian.Uint32(subpacket)
 	case prefSymmetricAlgosSubpacket:
 		// Preferred symmetric algorithms, section 5.2.3.7
-		if !isHashed {
-			return
-		}
 		sig.PreferredSymmetric = make([]byte, len(subpacket))
 		copy(sig.PreferredSymmetric, subpacket)
 	case issuerSubpacket:
+		// Issuer, section 5.2.3.5
 		if sig.Version > 4 {
 			err = errors.StructuralError("issuer subpacket found in v5 key")
+			return
 		}
-		// Issuer, section 5.2.3.5
 		if len(subpacket) != 8 {
 			err = errors.StructuralError("issuer subpacket with bad length")
 			return
 		}
 		sig.IssuerKeyId = new(uint64)
 		*sig.IssuerKeyId = binary.BigEndian.Uint64(subpacket)
-	case prefHashAlgosSubpacket:
-		// Preferred hash algorithms, section 5.2.3.8
-		if !isHashed {
+	case notationDataSubpacket:
+		// Notation data, section 5.2.3.16
+		if len(subpacket) < 8 {
+			err = errors.StructuralError("notation data subpacket with bad length")
 			return
 		}
+
+		nameLength := uint32(subpacket[4])<<8 | uint32(subpacket[5])
+		valueLength := uint32(subpacket[6])<<8 | uint32(subpacket[7])
+		if len(subpacket) != int(nameLength)+int(valueLength)+8 {
+			err = errors.StructuralError("notation data subpacket with bad length")
+			return
+		}
+
+		notation := Notation{
+			IsHumanReadable: (subpacket[0] & 0x80) == 0x80,
+			Name:            string(subpacket[8:(nameLength + 8)]),
+			Value:           subpacket[(nameLength + 8):(valueLength + nameLength + 8)],
+			IsCritical:      isCritical,
+		}
+
+		sig.Notations = append(sig.Notations, &notation)
+	case prefHashAlgosSubpacket:
+		// Preferred hash algorithms, section 5.2.3.8
 		sig.PreferredHash = make([]byte, len(subpacket))
 		copy(sig.PreferredHash, subpacket)
 	case prefCompressionSubpacket:
 		// Preferred compression algorithms, section 5.2.3.9
-		if !isHashed {
-			return
-		}
 		sig.PreferredCompression = make([]byte, len(subpacket))
 		copy(sig.PreferredCompression, subpacket)
 	case primaryUserIdSubpacket:
 		// Primary User ID, section 5.2.3.19
-		if !isHashed {
-			return
-		}
 		if len(subpacket) != 1 {
 			err = errors.StructuralError("primary user id subpacket with bad length")
 			return
@@ -358,9 +417,6 @@ func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (r
 		}
 	case keyFlagsSubpacket:
 		// Key flags, section 5.2.3.21
-		if !isHashed {
-			return
-		}
 		if len(subpacket) == 0 {
 			err = errors.StructuralError("empty key flags subpacket")
 			return
@@ -387,11 +443,11 @@ func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (r
 		if subpacket[0]&KeyFlagGroupKey != 0 {
 			sig.FlagGroupKey = true
 		}
+	case signerUserIdSubpacket:
+		userId := string(subpacket)
+		sig.SignerUserId = &userId
 	case reasonForRevocationSubpacket:
 		// Reason For Revocation, section 5.2.3.23
-		if !isHashed {
-			return
-		}
 		if len(subpacket) == 0 {
 			err = errors.StructuralError("empty revocation reason subpacket")
 			return
@@ -403,18 +459,13 @@ func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (r
 		// Features subpacket, section 5.2.3.24 specifies a very general
 		// mechanism for OpenPGP implementations to signal support for new
 		// features.
-		if !isHashed {
-			return
-		}
 		if len(subpacket) > 0 {
 			if subpacket[0]&0x01 != 0 {
-				sig.MDC = true
+				sig.SEIPDv1 = true
 			}
-			if subpacket[0]&0x02 != 0 {
-				sig.AEAD = true
-			}
-			if subpacket[0]&0x04 != 0 {
-				sig.V5Keys = true
+			// 0x02 and 0x04 are reserved
+			if subpacket[0]&0x08 != 0 {
+				sig.SEIPDv2 = true
 			}
 		}
 	case embeddedSignatureSubpacket:
@@ -437,11 +488,12 @@ func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (r
 		}
 	case policyUriSubpacket:
 		// Policy URI, section 5.2.3.20
-		if !isHashed {
-			return
-		}
 		sig.PolicyURI = string(subpacket)
 	case issuerFingerprintSubpacket:
+		if len(subpacket) == 0 {
+			err = errors.StructuralError("empty issuer fingerprint subpacket")
+			return
+		}
 		v, l := subpacket[0], len(subpacket[1:])
 		if v == 5 && l != 32 || v != 5 && l != 20 {
 			return nil, errors.StructuralError("bad fingerprint length")
@@ -454,13 +506,19 @@ func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (r
 		} else {
 			*sig.IssuerKeyId = binary.BigEndian.Uint64(subpacket[13:21])
 		}
-	case prefAeadAlgosSubpacket:
-		// Preferred symmetric algorithms, section 5.2.3.8
-		if !isHashed {
+	case prefCipherSuitesSubpacket:
+		// Preferred AEAD cipher suites
+		// See https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#name-preferred-aead-ciphersuites
+		if len(subpacket)%2 != 0 {
+			err = errors.StructuralError("invalid aead cipher suite length")
 			return
 		}
-		sig.PreferredAEAD = make([]byte, len(subpacket))
-		copy(sig.PreferredAEAD, subpacket)
+
+		sig.PreferredCipherSuites = make([][2]byte, len(subpacket)/2)
+
+		for i := 0; i < len(subpacket)/2; i++ {
+			sig.PreferredCipherSuites[i] = [2]uint8{subpacket[2*i], subpacket[2*i+1]}
+		}
 	default:
 		if isCritical {
 			err = errors.UnsupportedError("unknown critical signature subpacket type " + strconv.Itoa(int(packetType)))
@@ -558,7 +616,15 @@ func (sig *Signature) SigExpired(currentTime time.Time) bool {
 
 // buildHashSuffix constructs the HashSuffix member of sig in preparation for signing.
 func (sig *Signature) buildHashSuffix(hashedSubpackets []byte) (err error) {
-	hash, ok := s2k.HashToHashId(sig.Hash)
+	var hashId byte
+	var ok bool
+
+	if sig.Version < 5 {
+		hashId, ok = algorithm.HashToHashIdWithSha1(sig.Hash)
+	} else {
+		hashId, ok = algorithm.HashToHashId(sig.Hash)
+	}
+
 	if !ok {
 		sig.HashSuffix = nil
 		return errors.InvalidArgumentError("hash cannot be represented in OpenPGP: " + strconv.Itoa(int(sig.Hash)))
@@ -568,7 +634,7 @@ func (sig *Signature) buildHashSuffix(hashedSubpackets []byte) (err error) {
 		uint8(sig.Version),
 		uint8(sig.SigType),
 		uint8(sig.PubKeyAlgo),
-		uint8(hash),
+		uint8(hashId),
 		uint8(len(hashedSubpackets) >> 8),
 		uint8(len(hashedSubpackets)),
 	})
@@ -649,26 +715,19 @@ func (sig *Signature) Sign(h hash.Hash, priv *PrivateKey, config *Config) (err e
 			sig.DSASigS = new(encoding.MPI).SetBig(s)
 		}
 	case PubKeyAlgoECDSA:
-		var r, s *big.Int
-		if pk, ok := priv.PrivateKey.(*ecdsa.PrivateKey); ok {
-			// direct support, avoid asn1 wrapping/unwrapping
-			r, s, err = ecdsa.Sign(config.Random(), pk, digest)
-		} else {
-			var b []byte
-			b, err = priv.PrivateKey.(crypto.Signer).Sign(config.Random(), digest, sig.Hash)
-			if err == nil {
-				r, s, err = unwrapECDSASig(b)
-			}
-		}
+		sk := priv.PrivateKey.(*ecdsa.PrivateKey)
+		r, s, err := ecdsa.Sign(config.Random(), sk, digest)
+
 		if err == nil {
 			sig.ECDSASigR = new(encoding.MPI).SetBig(r)
 			sig.ECDSASigS = new(encoding.MPI).SetBig(s)
 		}
 	case PubKeyAlgoEdDSA:
-		sigdata, err := priv.PrivateKey.(crypto.Signer).Sign(config.Random(), digest, crypto.Hash(0))
+		sk := priv.PrivateKey.(*eddsa.PrivateKey)
+		r, s, err := eddsa.Sign(sk, digest)
 		if err == nil {
-			sig.EdDSASigR = encoding.NewMPI(sigdata[:32])
-			sig.EdDSASigS = encoding.NewMPI(sigdata[32:])
+			sig.EdDSASigR = encoding.NewMPI(r)
+			sig.EdDSASigS = encoding.NewMPI(s)
 		}
 	default:
 		err = errors.UnsupportedError("public key algorithm: " + strconv.Itoa(int(sig.PubKeyAlgo)))
@@ -677,19 +736,6 @@ func (sig *Signature) Sign(h hash.Hash, priv *PrivateKey, config *Config) (err e
 	return
 }
 
-// unwrapECDSASig parses the two integer components of an ASN.1-encoded ECDSA
-// signature.
-func unwrapECDSASig(b []byte) (r, s *big.Int, err error) {
-	var ecsdaSig struct {
-		R, S *big.Int
-	}
-	_, err = asn1.Unmarshal(b, &ecsdaSig)
-	if err != nil {
-		return
-	}
-	return ecsdaSig.R, ecsdaSig.S, nil
-}
-
 // SignUserId computes a signature from priv, asserting that pub is a valid
 // key for the identity id.  On success, the signature is stored in sig. Call
 // Serialize to write it out.
@@ -858,12 +904,15 @@ func (sig *Signature) buildSubpackets(issuer PublicKey) (subpackets []outputSubp
 	if sig.IssuerKeyId != nil && sig.Version == 4 {
 		keyId := make([]byte, 8)
 		binary.BigEndian.PutUint64(keyId, *sig.IssuerKeyId)
-		subpackets = append(subpackets, outputSubpacket{true, issuerSubpacket, true, keyId})
+		subpackets = append(subpackets, outputSubpacket{true, issuerSubpacket, false, keyId})
 	}
 	if sig.IssuerFingerprint != nil {
 		contents := append([]uint8{uint8(issuer.Version)}, sig.IssuerFingerprint...)
 		subpackets = append(subpackets, outputSubpacket{true, issuerFingerprintSubpacket, sig.Version == 5, contents})
 	}
+	if sig.SignerUserId != nil {
+		subpackets = append(subpackets, outputSubpacket{true, signerUserIdSubpacket, false, []byte(*sig.SignerUserId)})
+	}
 	if sig.SigLifetimeSecs != nil && *sig.SigLifetimeSecs != 0 {
 		sigLifetime := make([]byte, 4)
 		binary.BigEndian.PutUint32(sigLifetime, *sig.SigLifetimeSecs)
@@ -898,23 +947,40 @@ func (sig *Signature) buildSubpackets(issuer PublicKey) (subpackets []outputSubp
 		subpackets = append(subpackets, outputSubpacket{true, keyFlagsSubpacket, false, []byte{flags}})
 	}
 
+	for _, notation := range sig.Notations {
+		subpackets = append(
+			subpackets,
+			outputSubpacket{
+				true,
+				notationDataSubpacket,
+				notation.IsCritical,
+				notation.getData(),
+			})
+	}
+
 	// The following subpackets may only appear in self-signatures.
 
 	var features = byte(0x00)
-	if sig.MDC {
+	if sig.SEIPDv1 {
 		features |= 0x01
 	}
-	if sig.AEAD {
-		features |= 0x02
-	}
-	if sig.V5Keys {
-		features |= 0x04
+	if sig.SEIPDv2 {
+		features |= 0x08
 	}
 
 	if features != 0x00 {
 		subpackets = append(subpackets, outputSubpacket{true, featuresSubpacket, false, []byte{features}})
 	}
 
+	if sig.TrustLevel != 0 {
+		subpackets = append(subpackets, outputSubpacket{true, trustSubpacket, true, []byte{byte(sig.TrustLevel), byte(sig.TrustAmount)}})
+	}
+
+	if sig.TrustRegularExpression != nil {
+		// RFC specifies the string should be null-terminated; add a null byte to the end
+		subpackets = append(subpackets, outputSubpacket{true, regularExpressionSubpacket, true, []byte(*sig.TrustRegularExpression + "\000")})
+	}
+
 	if sig.KeyLifetimeSecs != nil && *sig.KeyLifetimeSecs != 0 {
 		keyLifetime := make([]byte, 4)
 		binary.BigEndian.PutUint32(keyLifetime, *sig.KeyLifetimeSecs)
@@ -941,8 +1007,13 @@ func (sig *Signature) buildSubpackets(issuer PublicKey) (subpackets []outputSubp
 		subpackets = append(subpackets, outputSubpacket{true, policyUriSubpacket, false, []uint8(sig.PolicyURI)})
 	}
 
-	if len(sig.PreferredAEAD) > 0 {
-		subpackets = append(subpackets, outputSubpacket{true, prefAeadAlgosSubpacket, false, sig.PreferredAEAD})
+	if len(sig.PreferredCipherSuites) > 0 {
+		serialized := make([]byte, len(sig.PreferredCipherSuites)*2)
+		for i, cipherSuite := range sig.PreferredCipherSuites {
+			serialized[2*i] = cipherSuite[0]
+			serialized[2*i+1] = cipherSuite[1]
+		}
+		subpackets = append(subpackets, outputSubpacket{true, prefCipherSuitesSubpacket, false, serialized})
 	}
 
 	// Revocation reason appears only in revocation signatures and is serialized as per section 5.2.3.23.
@@ -984,7 +1055,7 @@ func (sig *Signature) AddMetadataToHashSuffix() {
 	n := sig.HashSuffix[len(sig.HashSuffix)-8:]
 	l := uint64(
 		uint64(n[0])<<56 | uint64(n[1])<<48 | uint64(n[2])<<40 | uint64(n[3])<<32 |
-		uint64(n[4])<<24 | uint64(n[5])<<16 | uint64(n[6])<<8  | uint64(n[7]))
+			uint64(n[4])<<24 | uint64(n[5])<<16 | uint64(n[6])<<8 | uint64(n[7]))
 
 	suffix := bytes.NewBuffer(nil)
 	suffix.Write(sig.HashSuffix[:l])

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetric_key_encrypted.go

@@ -14,8 +14,8 @@ import (
 	"github.com/ProtonMail/go-crypto/openpgp/s2k"
 )
 
-// This is the largest session key that we'll support. Since no 512-bit cipher
-// has even been seriously used, this is comfortably large.
+// This is the largest session key that we'll support. Since at most 256-bit cipher
+// is supported in OpenPGP, this is large enough to contain also the auth tag.
 const maxSessionKeySizeInBytes = 64
 
 // SymmetricKeyEncrypted represents a passphrase protected session key. See RFC
@@ -25,13 +25,16 @@ type SymmetricKeyEncrypted struct {
 	CipherFunc   CipherFunction
 	Mode         AEADMode
 	s2k          func(out, in []byte)
-	aeadNonce    []byte
-	encryptedKey []byte
+	iv           []byte
+	encryptedKey []byte // Contains also the authentication tag for AEAD
 }
 
+// parse parses an SymmetricKeyEncrypted packet as specified in
+// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#name-symmetric-key-encrypted-ses
 func (ske *SymmetricKeyEncrypted) parse(r io.Reader) error {
-	// RFC 4880, section 5.3.
-	var buf [2]byte
+	var buf [1]byte
+
+	// Version
 	if _, err := readFull(r, buf[:]); err != nil {
 		return err
 	}
@@ -39,17 +42,22 @@ func (ske *SymmetricKeyEncrypted) parse(r io.Reader) error {
 	if ske.Version != 4 && ske.Version != 5 {
 		return errors.UnsupportedError("unknown SymmetricKeyEncrypted version")
 	}
-	ske.CipherFunc = CipherFunction(buf[1])
-	if ske.CipherFunc.KeySize() == 0 {
-		return errors.UnsupportedError("unknown cipher: " + strconv.Itoa(int(buf[1])))
+
+	// Cipher function
+	if _, err := readFull(r, buf[:]); err != nil {
+		return err
+	}
+	ske.CipherFunc = CipherFunction(buf[0])
+	if !ske.CipherFunc.IsSupported() {
+		return errors.UnsupportedError("unknown cipher: " + strconv.Itoa(int(buf[0])))
 	}
 
 	if ske.Version == 5 {
-		mode := make([]byte, 1)
-		if _, err := r.Read(mode); err != nil {
-			return errors.StructuralError("cannot read AEAD octect from packet")
+		// AEAD mode
+		if _, err := readFull(r, buf[:]); err != nil {
+			return errors.StructuralError("cannot read AEAD octet from packet")
 		}
-		ske.Mode = AEADMode(mode[0])
+		ske.Mode = AEADMode(buf[0])
 	}
 
 	var err error
@@ -61,13 +69,14 @@ func (ske *SymmetricKeyEncrypted) parse(r io.Reader) error {
 	}
 
 	if ske.Version == 5 {
-		// AEAD nonce
-		nonce := make([]byte, ske.Mode.NonceLength())
-		_, err := readFull(r, nonce)
-		if err != nil && err != io.ErrUnexpectedEOF {
-			return err
+		// AEAD IV
+		iv := make([]byte, ske.Mode.IvLength())
+		_, err := readFull(r, iv)
+		if err != nil {
+			return errors.StructuralError("cannot read AEAD IV")
 		}
-		ske.aeadNonce = nonce
+
+		ske.iv = iv
 	}
 
 	encryptedKey := make([]byte, maxSessionKeySizeInBytes)
@@ -128,11 +137,10 @@ func (ske *SymmetricKeyEncrypted) decryptV4(key []byte) ([]byte, CipherFunction,
 }
 
 func (ske *SymmetricKeyEncrypted) decryptV5(key []byte) ([]byte, error) {
-	blockCipher := CipherFunction(ske.CipherFunc).new(key)
-	aead := ske.Mode.new(blockCipher)
-
 	adata := []byte{0xc3, byte(5), byte(ske.CipherFunc), byte(ske.Mode)}
-	plaintextKey, err := aead.Open(nil, ske.aeadNonce, ske.encryptedKey, adata)
+	aead := getEncryptedKeyAeadInstance(ske.CipherFunc, ske.Mode, key, adata)
+
+	plaintextKey, err := aead.Open(nil, ske.iv, ske.encryptedKey, adata)
 	if err != nil {
 		return nil, err
 	}
@@ -142,17 +150,12 @@ func (ske *SymmetricKeyEncrypted) decryptV5(key []byte) ([]byte, error) {
 // SerializeSymmetricKeyEncrypted serializes a symmetric key packet to w.
 // The packet contains a random session key, encrypted by a key derived from
 // the given passphrase. The session key is returned and must be passed to
-// SerializeSymmetricallyEncrypted or SerializeAEADEncrypted, depending on
-// whether config.AEADConfig != nil.
+// SerializeSymmetricallyEncrypted.
 // If config is nil, sensible defaults will be used.
 func SerializeSymmetricKeyEncrypted(w io.Writer, passphrase []byte, config *Config) (key []byte, err error) {
 	cipherFunc := config.Cipher()
-	keySize := cipherFunc.KeySize()
-	if keySize == 0 {
-		return nil, errors.UnsupportedError("unknown cipher: " + strconv.Itoa(int(cipherFunc)))
-	}
 
-	sessionKey := make([]byte, keySize)
+	sessionKey := make([]byte, cipherFunc.KeySize())
 	_, err = io.ReadFull(config.Random(), sessionKey)
 	if err != nil {
 		return
@@ -169,9 +172,8 @@ func SerializeSymmetricKeyEncrypted(w io.Writer, passphrase []byte, config *Conf
 
 // SerializeSymmetricKeyEncryptedReuseKey serializes a symmetric key packet to w.
 // The packet contains the given session key, encrypted by a key derived from
-// the given passphrase. The session key must be passed to
-// SerializeSymmetricallyEncrypted or SerializeAEADEncrypted, depending on
-// whether config.AEADConfig != nil.
+// the given passphrase. The returned session key must be passed to
+// SerializeSymmetricallyEncrypted.
 // If config is nil, sensible defaults will be used.
 func SerializeSymmetricKeyEncryptedReuseKey(w io.Writer, sessionKey []byte, passphrase []byte, config *Config) (err error) {
 	var version int
@@ -181,16 +183,17 @@ func SerializeSymmetricKeyEncryptedReuseKey(w io.Writer, sessionKey []byte, pass
 		version = 4
 	}
 	cipherFunc := config.Cipher()
-	keySize := cipherFunc.KeySize()
-	if keySize == 0 {
-		return errors.UnsupportedError("unknown cipher: " + strconv.Itoa(int(cipherFunc)))
+	// cipherFunc must be AES
+	if !cipherFunc.IsSupported() || cipherFunc < CipherAES128 || cipherFunc > CipherAES256 {
+		return errors.UnsupportedError("unsupported cipher: " + strconv.Itoa(int(cipherFunc)))
 	}
 
+	keySize := cipherFunc.KeySize()
 	s2kBuf := new(bytes.Buffer)
 	keyEncryptingKey := make([]byte, keySize)
 	// s2k.Serialize salts and stretches the passphrase, and writes the
 	// resulting key to keyEncryptingKey and the s2k descriptor to s2kBuf.
-	err = s2k.Serialize(s2kBuf, keyEncryptingKey, config.Random(), passphrase, &s2k.Config{Hash: config.Hash(), S2KCount: config.PasswordHashIterations()})
+	err = s2k.Serialize(s2kBuf, keyEncryptingKey, config.Random(), passphrase, config.S2K())
 	if err != nil {
 		return
 	}
@@ -201,20 +204,20 @@ func SerializeSymmetricKeyEncryptedReuseKey(w io.Writer, sessionKey []byte, pass
 	case 4:
 		packetLength = 2 /* header */ + len(s2kBytes) + 1 /* cipher type */ + keySize
 	case 5:
-		nonceLen := config.AEAD().Mode().NonceLength()
+		ivLen := config.AEAD().Mode().IvLength()
 		tagLen := config.AEAD().Mode().TagLength()
-		packetLength = 3 + len(s2kBytes) + nonceLen + keySize + tagLen
+		packetLength = 3 + len(s2kBytes) + ivLen + keySize + tagLen
 	}
 	err = serializeHeader(w, packetTypeSymmetricKeyEncrypted, packetLength)
 	if err != nil {
 		return
 	}
 
-	buf := make([]byte, 2)
 	// Symmetric Key Encrypted Version
-	buf[0] = byte(version)
+	buf := []byte{byte(version)}
+
 	// Cipher function
-	buf[1] = byte(cipherFunc)
+	buf = append(buf, byte(cipherFunc))
 
 	if version == 5 {
 		// AEAD mode
@@ -241,19 +244,20 @@ func SerializeSymmetricKeyEncryptedReuseKey(w io.Writer, sessionKey []byte, pass
 			return
 		}
 	case 5:
-		blockCipher := cipherFunc.new(keyEncryptingKey)
 		mode := config.AEAD().Mode()
-		aead := mode.new(blockCipher)
-		// Sample nonce using random reader
-		nonce := make([]byte, config.AEAD().Mode().NonceLength())
-		_, err = io.ReadFull(config.Random(), nonce)
+		adata := []byte{0xc3, byte(5), byte(cipherFunc), byte(mode)}
+		aead := getEncryptedKeyAeadInstance(cipherFunc, mode, keyEncryptingKey, adata)
+
+		// Sample iv using random reader
+		iv := make([]byte, config.AEAD().Mode().IvLength())
+		_, err = io.ReadFull(config.Random(), iv)
 		if err != nil {
 			return
 		}
 		// Seal and write (encryptedData includes auth. tag)
-		adata := []byte{0xc3, byte(5), byte(cipherFunc), byte(mode)}
-		encryptedData := aead.Seal(nil, nonce, sessionKey, adata)
-		_, err = w.Write(nonce)
+
+		encryptedData := aead.Seal(nil, iv, sessionKey, adata)
+		_, err = w.Write(iv)
 		if err != nil {
 			return
 		}
@@ -265,3 +269,8 @@ func SerializeSymmetricKeyEncryptedReuseKey(w io.Writer, sessionKey []byte, pass
 
 	return
 }
+
+func getEncryptedKeyAeadInstance(c CipherFunction, mode AEADMode, inputKey, associatedData []byte) (aead cipher.AEAD) {
+	blockCipher := c.new(inputKey)
+	return mode.new(blockCipher)
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted.go

@@ -5,36 +5,54 @@
 package packet
 
 import (
-	"crypto/cipher"
-	"crypto/sha1"
-	"crypto/subtle"
-	"hash"
 	"io"
-	"strconv"
 
 	"github.com/ProtonMail/go-crypto/openpgp/errors"
 )
 
+const aeadSaltSize = 32
+
 // SymmetricallyEncrypted represents a symmetrically encrypted byte string. The
 // encrypted Contents will consist of more OpenPGP packets. See RFC 4880,
 // sections 5.7 and 5.13.
 type SymmetricallyEncrypted struct {
-	MDC      bool // true iff this is a type 18 packet and thus has an embedded MAC.
-	Contents io.Reader
-	prefix   []byte
+	Version            int
+	Contents           io.Reader // contains tag for version 2
+	IntegrityProtected bool      // If true it is type 18 (with MDC or AEAD). False is packet type 9
+
+	// Specific to version 1
+	prefix []byte
+
+	// Specific to version 2
+	Cipher        CipherFunction
+	Mode          AEADMode
+	ChunkSizeByte byte
+	Salt          [aeadSaltSize]byte
 }
 
-const symmetricallyEncryptedVersion = 1
+const (
+	symmetricallyEncryptedVersionMdc  = 1
+	symmetricallyEncryptedVersionAead = 2
+)
 
 func (se *SymmetricallyEncrypted) parse(r io.Reader) error {
-	if se.MDC {
+	if se.IntegrityProtected {
 		// See RFC 4880, section 5.13.
 		var buf [1]byte
 		_, err := readFull(r, buf[:])
 		if err != nil {
 			return err
 		}
-		if buf[0] != symmetricallyEncryptedVersion {
+
+		switch buf[0] {
+		case symmetricallyEncryptedVersionMdc:
+			se.Version = symmetricallyEncryptedVersionMdc
+		case symmetricallyEncryptedVersionAead:
+			se.Version = symmetricallyEncryptedVersionAead
+			if err := se.parseAead(r); err != nil {
+				return err
+			}
+		default:
 			return errors.UnsupportedError("unknown SymmetricallyEncrypted version")
 		}
 	}
@@ -46,245 +64,27 @@ func (se *SymmetricallyEncrypted) parse(r io.Reader) error {
 // packet can be read. An incorrect key will only be detected after trying
 // to decrypt the entire data.
 func (se *SymmetricallyEncrypted) Decrypt(c CipherFunction, key []byte) (io.ReadCloser, error) {
-	keySize := c.KeySize()
-	if keySize == 0 {
-		return nil, errors.UnsupportedError("unknown cipher: " + strconv.Itoa(int(c)))
-	}
-	if len(key) != keySize {
-		return nil, errors.InvalidArgumentError("SymmetricallyEncrypted: incorrect key length")
+	if se.Version == symmetricallyEncryptedVersionAead {
+		return se.decryptAead(key)
 	}
 
-	if se.prefix == nil {
-		se.prefix = make([]byte, c.blockSize()+2)
-		_, err := readFull(se.Contents, se.prefix)
-		if err != nil {
-			return nil, err
-		}
-	} else if len(se.prefix) != c.blockSize()+2 {
-		return nil, errors.InvalidArgumentError("can't try ciphers with different block lengths")
-	}
-
-	ocfbResync := OCFBResync
-	if se.MDC {
-		// MDC packets use a different form of OCFB mode.
-		ocfbResync = OCFBNoResync
-	}
-
-	s := NewOCFBDecrypter(c.new(key), se.prefix, ocfbResync)
-
-	plaintext := cipher.StreamReader{S: s, R: se.Contents}
-
-	if se.MDC {
-		// MDC packets have an embedded hash that we need to check.
-		h := sha1.New()
-		h.Write(se.prefix)
-		return &seMDCReader{in: plaintext, h: h}, nil
-	}
-
-	// Otherwise, we just need to wrap plaintext so that it's a valid ReadCloser.
-	return seReader{plaintext}, nil
-}
-
-// seReader wraps an io.Reader with a no-op Close method.
-type seReader struct {
-	in io.Reader
-}
-
-func (ser seReader) Read(buf []byte) (int, error) {
-	return ser.in.Read(buf)
-}
-
-func (ser seReader) Close() error {
-	return nil
-}
-
-const mdcTrailerSize = 1 /* tag byte */ + 1 /* length byte */ + sha1.Size
-
-// An seMDCReader wraps an io.Reader, maintains a running hash and keeps hold
-// of the most recent 22 bytes (mdcTrailerSize). Upon EOF, those bytes form an
-// MDC packet containing a hash of the previous Contents which is checked
-// against the running hash. See RFC 4880, section 5.13.
-type seMDCReader struct {
-	in          io.Reader
-	h           hash.Hash
-	trailer     [mdcTrailerSize]byte
-	scratch     [mdcTrailerSize]byte
-	trailerUsed int
-	error       bool
-	eof         bool
-}
-
-func (ser *seMDCReader) Read(buf []byte) (n int, err error) {
-	if ser.error {
-		err = io.ErrUnexpectedEOF
-		return
-	}
-	if ser.eof {
-		err = io.EOF
-		return
-	}
-
-	// If we haven't yet filled the trailer buffer then we must do that
-	// first.
-	for ser.trailerUsed < mdcTrailerSize {
-		n, err = ser.in.Read(ser.trailer[ser.trailerUsed:])
-		ser.trailerUsed += n
-		if err == io.EOF {
-			if ser.trailerUsed != mdcTrailerSize {
-				n = 0
-				err = io.ErrUnexpectedEOF
-				ser.error = true
-				return
-			}
-			ser.eof = true
-			n = 0
-			return
-		}
-
-		if err != nil {
-			n = 0
-			return
-		}
-	}
-
-	// If it's a short read then we read into a temporary buffer and shift
-	// the data into the caller's buffer.
-	if len(buf) <= mdcTrailerSize {
-		n, err = readFull(ser.in, ser.scratch[:len(buf)])
-		copy(buf, ser.trailer[:n])
-		ser.h.Write(buf[:n])
-		copy(ser.trailer[:], ser.trailer[n:])
-		copy(ser.trailer[mdcTrailerSize-n:], ser.scratch[:])
-		if n < len(buf) {
-			ser.eof = true
-			err = io.EOF
-		}
-		return
-	}
-
-	n, err = ser.in.Read(buf[mdcTrailerSize:])
-	copy(buf, ser.trailer[:])
-	ser.h.Write(buf[:n])
-	copy(ser.trailer[:], buf[n:])
-
-	if err == io.EOF {
-		ser.eof = true
-	}
-	return
-}
-
-// This is a new-format packet tag byte for a type 19 (MDC) packet.
-const mdcPacketTagByte = byte(0x80) | 0x40 | 19
-
-func (ser *seMDCReader) Close() error {
-	if ser.error {
-		return errors.ErrMDCMissing
-	}
-
-	for !ser.eof {
-		// We haven't seen EOF so we need to read to the end
-		var buf [1024]byte
-		_, err := ser.Read(buf[:])
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return errors.ErrMDCMissing
-		}
-	}
-
-	ser.h.Write(ser.trailer[:2])
-
-	final := ser.h.Sum(nil)
-	if subtle.ConstantTimeCompare(final, ser.trailer[2:]) != 1 {
-		return errors.ErrMDCHashMismatch
-	}
-	// The hash already includes the MDC header, but we still check its value
-	// to confirm encryption correctness
-	if ser.trailer[0] != mdcPacketTagByte || ser.trailer[1] != sha1.Size {
-		return errors.ErrMDCMissing
-	}
-	return nil
-}
-
-// An seMDCWriter writes through to an io.WriteCloser while maintains a running
-// hash of the data written. On close, it emits an MDC packet containing the
-// running hash.
-type seMDCWriter struct {
-	w io.WriteCloser
-	h hash.Hash
-}
-
-func (w *seMDCWriter) Write(buf []byte) (n int, err error) {
-	w.h.Write(buf)
-	return w.w.Write(buf)
-}
-
-func (w *seMDCWriter) Close() (err error) {
-	var buf [mdcTrailerSize]byte
-
-	buf[0] = mdcPacketTagByte
-	buf[1] = sha1.Size
-	w.h.Write(buf[:2])
-	digest := w.h.Sum(nil)
-	copy(buf[2:], digest)
-
-	_, err = w.w.Write(buf[:])
-	if err != nil {
-		return
-	}
-	return w.w.Close()
-}
-
-// noOpCloser is like an ioutil.NopCloser, but for an io.Writer.
-type noOpCloser struct {
-	w io.Writer
-}
-
-func (c noOpCloser) Write(data []byte) (n int, err error) {
-	return c.w.Write(data)
-}
-
-func (c noOpCloser) Close() error {
-	return nil
+	return se.decryptMdc(c, key)
 }
 
 // SerializeSymmetricallyEncrypted serializes a symmetrically encrypted packet
 // to w and returns a WriteCloser to which the to-be-encrypted packets can be
 // written.
 // If config is nil, sensible defaults will be used.
-func SerializeSymmetricallyEncrypted(w io.Writer, c CipherFunction, key []byte, config *Config) (Contents io.WriteCloser, err error) {
-	if c.KeySize() != len(key) {
-		return nil, errors.InvalidArgumentError("SymmetricallyEncrypted.Serialize: bad key length")
-	}
+func SerializeSymmetricallyEncrypted(w io.Writer, c CipherFunction, aeadSupported bool, cipherSuite CipherSuite, key []byte, config *Config) (Contents io.WriteCloser, err error) {
 	writeCloser := noOpCloser{w}
-	ciphertext, err := serializeStreamHeader(writeCloser, packetTypeSymmetricallyEncryptedMDC)
+	ciphertext, err := serializeStreamHeader(writeCloser, packetTypeSymmetricallyEncryptedIntegrityProtected)
 	if err != nil {
 		return
 	}
 
-	_, err = ciphertext.Write([]byte{symmetricallyEncryptedVersion})
-	if err != nil {
-		return
+	if aeadSupported {
+		return serializeSymmetricallyEncryptedAead(ciphertext, cipherSuite, config.AEADConfig.ChunkSizeByte(), config.Random(), key)
 	}
 
-	block := c.new(key)
-	blockSize := block.BlockSize()
-	iv := make([]byte, blockSize)
-	_, err = config.Random().Read(iv)
-	if err != nil {
-		return
-	}
-	s, prefix := NewOCFBEncrypter(block, iv, OCFBNoResync)
-	_, err = ciphertext.Write(prefix)
-	if err != nil {
-		return
-	}
-	plaintext := cipher.StreamWriter{S: s, W: ciphertext}
-
-	h := sha1.New()
-	h.Write(iv)
-	h.Write(iv[blockSize-2:])
-	Contents = &seMDCWriter{w: plaintext, h: h}
-	return
+	return serializeSymmetricallyEncryptedMdc(ciphertext, c, key, config)
 }

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_aead.go

@@ -0,0 +1,156 @@
+// Copyright 2023 Proton AG. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package packet
+
+import (
+	"crypto/cipher"
+	"crypto/sha256"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"golang.org/x/crypto/hkdf"
+)
+
+// parseAead parses a V2 SEIPD packet (AEAD) as specified in
+// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-5.13.2
+func (se *SymmetricallyEncrypted) parseAead(r io.Reader) error {
+	headerData := make([]byte, 3)
+	if n, err := io.ReadFull(r, headerData); n < 3 {
+		return errors.StructuralError("could not read aead header: " + err.Error())
+	}
+
+	// Cipher
+	se.Cipher = CipherFunction(headerData[0])
+	// cipherFunc must have block size 16 to use AEAD
+	if se.Cipher.blockSize() != 16 {
+		return errors.UnsupportedError("invalid aead cipher: " + string(se.Cipher))
+	}
+
+	// Mode
+	se.Mode = AEADMode(headerData[1])
+	if se.Mode.TagLength() == 0 {
+		return errors.UnsupportedError("unknown aead mode: " + string(se.Mode))
+	}
+
+	// Chunk size
+	se.ChunkSizeByte = headerData[2]
+	if se.ChunkSizeByte > 16 {
+		return errors.UnsupportedError("invalid aead chunk size byte: " + string(se.ChunkSizeByte))
+	}
+
+	// Salt
+	if n, err := io.ReadFull(r, se.Salt[:]); n < aeadSaltSize {
+		return errors.StructuralError("could not read aead salt: " + err.Error())
+	}
+
+	return nil
+}
+
+// associatedData for chunks: tag, version, cipher, mode, chunk size byte
+func (se *SymmetricallyEncrypted) associatedData() []byte {
+	return []byte{
+		0xD2,
+		symmetricallyEncryptedVersionAead,
+		byte(se.Cipher),
+		byte(se.Mode),
+		se.ChunkSizeByte,
+	}
+}
+
+// decryptAead decrypts a V2 SEIPD packet (AEAD) as specified in
+// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-5.13.2
+func (se *SymmetricallyEncrypted) decryptAead(inputKey []byte) (io.ReadCloser, error) {
+	aead, nonce := getSymmetricallyEncryptedAeadInstance(se.Cipher, se.Mode, inputKey, se.Salt[:], se.associatedData())
+
+	// Carry the first tagLen bytes
+	tagLen := se.Mode.TagLength()
+	peekedBytes := make([]byte, tagLen)
+	n, err := io.ReadFull(se.Contents, peekedBytes)
+	if n < tagLen || (err != nil && err != io.EOF) {
+		return nil, errors.StructuralError("not enough data to decrypt:" + err.Error())
+	}
+
+	return &aeadDecrypter{
+		aeadCrypter: aeadCrypter{
+			aead:           aead,
+			chunkSize:      decodeAEADChunkSize(se.ChunkSizeByte),
+			initialNonce:   nonce,
+			associatedData: se.associatedData(),
+			chunkIndex:     make([]byte, 8),
+			packetTag:      packetTypeSymmetricallyEncryptedIntegrityProtected,
+		},
+		reader:      se.Contents,
+		peekedBytes: peekedBytes,
+	}, nil
+}
+
+// serializeSymmetricallyEncryptedAead encrypts to a writer a V2 SEIPD packet (AEAD) as specified in
+// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-5.13.2
+func serializeSymmetricallyEncryptedAead(ciphertext io.WriteCloser, cipherSuite CipherSuite, chunkSizeByte byte, rand io.Reader, inputKey []byte) (Contents io.WriteCloser, err error) {
+	// cipherFunc must have block size 16 to use AEAD
+	if cipherSuite.Cipher.blockSize() != 16 {
+		return nil, errors.InvalidArgumentError("invalid aead cipher function")
+	}
+
+	if cipherSuite.Cipher.KeySize() != len(inputKey) {
+		return nil, errors.InvalidArgumentError("error in aead serialization: bad key length")
+	}
+
+	// Data for en/decryption: tag, version, cipher, aead mode, chunk size
+	prefix := []byte{
+		0xD2,
+		symmetricallyEncryptedVersionAead,
+		byte(cipherSuite.Cipher),
+		byte(cipherSuite.Mode),
+		chunkSizeByte,
+	}
+
+	// Write header (that correspond to prefix except first byte)
+	n, err := ciphertext.Write(prefix[1:])
+	if err != nil || n < 4 {
+		return nil, err
+	}
+
+	// Random salt
+	salt := make([]byte, aeadSaltSize)
+	if _, err := rand.Read(salt); err != nil {
+		return nil, err
+	}
+
+	if _, err := ciphertext.Write(salt); err != nil {
+		return nil, err
+	}
+
+	aead, nonce := getSymmetricallyEncryptedAeadInstance(cipherSuite.Cipher, cipherSuite.Mode, inputKey, salt, prefix)
+
+	return &aeadEncrypter{
+		aeadCrypter: aeadCrypter{
+			aead:           aead,
+			chunkSize:      decodeAEADChunkSize(chunkSizeByte),
+			associatedData: prefix,
+			chunkIndex:     make([]byte, 8),
+			initialNonce:   nonce,
+			packetTag:      packetTypeSymmetricallyEncryptedIntegrityProtected,
+		},
+		writer: ciphertext,
+	}, nil
+}
+
+func getSymmetricallyEncryptedAeadInstance(c CipherFunction, mode AEADMode, inputKey, salt, associatedData []byte) (aead cipher.AEAD, nonce []byte) {
+	hkdfReader := hkdf.New(sha256.New, inputKey, salt, associatedData)
+
+	encryptionKey := make([]byte, c.KeySize())
+	_, _ = readFull(hkdfReader, encryptionKey)
+
+	// Last 64 bits of nonce are the counter
+	nonce = make([]byte, mode.IvLength()-8)
+
+	_, _ = readFull(hkdfReader, nonce)
+
+	blockCipher := c.new(encryptionKey)
+	aead = mode.new(blockCipher)
+
+	return
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_mdc.go

@@ -0,0 +1,256 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package packet
+
+import (
+	"crypto/cipher"
+	"crypto/sha1"
+	"crypto/subtle"
+	"hash"
+	"io"
+	"strconv"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+)
+
+// seMdcReader wraps an io.Reader with a no-op Close method.
+type seMdcReader struct {
+	in io.Reader
+}
+
+func (ser seMdcReader) Read(buf []byte) (int, error) {
+	return ser.in.Read(buf)
+}
+
+func (ser seMdcReader) Close() error {
+	return nil
+}
+
+func (se *SymmetricallyEncrypted) decryptMdc(c CipherFunction, key []byte) (io.ReadCloser, error) {
+	if !c.IsSupported() {
+		return nil, errors.UnsupportedError("unsupported cipher: " + strconv.Itoa(int(c)))
+	}
+
+	if len(key) != c.KeySize() {
+		return nil, errors.InvalidArgumentError("SymmetricallyEncrypted: incorrect key length")
+	}
+
+	if se.prefix == nil {
+		se.prefix = make([]byte, c.blockSize()+2)
+		_, err := readFull(se.Contents, se.prefix)
+		if err != nil {
+			return nil, err
+		}
+	} else if len(se.prefix) != c.blockSize()+2 {
+		return nil, errors.InvalidArgumentError("can't try ciphers with different block lengths")
+	}
+
+	ocfbResync := OCFBResync
+	if se.IntegrityProtected {
+		// MDC packets use a different form of OCFB mode.
+		ocfbResync = OCFBNoResync
+	}
+
+	s := NewOCFBDecrypter(c.new(key), se.prefix, ocfbResync)
+
+	plaintext := cipher.StreamReader{S: s, R: se.Contents}
+
+	if se.IntegrityProtected {
+		// IntegrityProtected packets have an embedded hash that we need to check.
+		h := sha1.New()
+		h.Write(se.prefix)
+		return &seMDCReader{in: plaintext, h: h}, nil
+	}
+
+	// Otherwise, we just need to wrap plaintext so that it's a valid ReadCloser.
+	return seMdcReader{plaintext}, nil
+}
+
+const mdcTrailerSize = 1 /* tag byte */ + 1 /* length byte */ + sha1.Size
+
+// An seMDCReader wraps an io.Reader, maintains a running hash and keeps hold
+// of the most recent 22 bytes (mdcTrailerSize). Upon EOF, those bytes form an
+// MDC packet containing a hash of the previous Contents which is checked
+// against the running hash. See RFC 4880, section 5.13.
+type seMDCReader struct {
+	in          io.Reader
+	h           hash.Hash
+	trailer     [mdcTrailerSize]byte
+	scratch     [mdcTrailerSize]byte
+	trailerUsed int
+	error       bool
+	eof         bool
+}
+
+func (ser *seMDCReader) Read(buf []byte) (n int, err error) {
+	if ser.error {
+		err = io.ErrUnexpectedEOF
+		return
+	}
+	if ser.eof {
+		err = io.EOF
+		return
+	}
+
+	// If we haven't yet filled the trailer buffer then we must do that
+	// first.
+	for ser.trailerUsed < mdcTrailerSize {
+		n, err = ser.in.Read(ser.trailer[ser.trailerUsed:])
+		ser.trailerUsed += n
+		if err == io.EOF {
+			if ser.trailerUsed != mdcTrailerSize {
+				n = 0
+				err = io.ErrUnexpectedEOF
+				ser.error = true
+				return
+			}
+			ser.eof = true
+			n = 0
+			return
+		}
+
+		if err != nil {
+			n = 0
+			return
+		}
+	}
+
+	// If it's a short read then we read into a temporary buffer and shift
+	// the data into the caller's buffer.
+	if len(buf) <= mdcTrailerSize {
+		n, err = readFull(ser.in, ser.scratch[:len(buf)])
+		copy(buf, ser.trailer[:n])
+		ser.h.Write(buf[:n])
+		copy(ser.trailer[:], ser.trailer[n:])
+		copy(ser.trailer[mdcTrailerSize-n:], ser.scratch[:])
+		if n < len(buf) {
+			ser.eof = true
+			err = io.EOF
+		}
+		return
+	}
+
+	n, err = ser.in.Read(buf[mdcTrailerSize:])
+	copy(buf, ser.trailer[:])
+	ser.h.Write(buf[:n])
+	copy(ser.trailer[:], buf[n:])
+
+	if err == io.EOF {
+		ser.eof = true
+	}
+	return
+}
+
+// This is a new-format packet tag byte for a type 19 (Integrity Protected) packet.
+const mdcPacketTagByte = byte(0x80) | 0x40 | 19
+
+func (ser *seMDCReader) Close() error {
+	if ser.error {
+		return errors.ErrMDCMissing
+	}
+
+	for !ser.eof {
+		// We haven't seen EOF so we need to read to the end
+		var buf [1024]byte
+		_, err := ser.Read(buf[:])
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return errors.ErrMDCMissing
+		}
+	}
+
+	ser.h.Write(ser.trailer[:2])
+
+	final := ser.h.Sum(nil)
+	if subtle.ConstantTimeCompare(final, ser.trailer[2:]) != 1 {
+		return errors.ErrMDCHashMismatch
+	}
+	// The hash already includes the MDC header, but we still check its value
+	// to confirm encryption correctness
+	if ser.trailer[0] != mdcPacketTagByte || ser.trailer[1] != sha1.Size {
+		return errors.ErrMDCMissing
+	}
+	return nil
+}
+
+// An seMDCWriter writes through to an io.WriteCloser while maintains a running
+// hash of the data written. On close, it emits an MDC packet containing the
+// running hash.
+type seMDCWriter struct {
+	w io.WriteCloser
+	h hash.Hash
+}
+
+func (w *seMDCWriter) Write(buf []byte) (n int, err error) {
+	w.h.Write(buf)
+	return w.w.Write(buf)
+}
+
+func (w *seMDCWriter) Close() (err error) {
+	var buf [mdcTrailerSize]byte
+
+	buf[0] = mdcPacketTagByte
+	buf[1] = sha1.Size
+	w.h.Write(buf[:2])
+	digest := w.h.Sum(nil)
+	copy(buf[2:], digest)
+
+	_, err = w.w.Write(buf[:])
+	if err != nil {
+		return
+	}
+	return w.w.Close()
+}
+
+// noOpCloser is like an ioutil.NopCloser, but for an io.Writer.
+type noOpCloser struct {
+	w io.Writer
+}
+
+func (c noOpCloser) Write(data []byte) (n int, err error) {
+	return c.w.Write(data)
+}
+
+func (c noOpCloser) Close() error {
+	return nil
+}
+
+func serializeSymmetricallyEncryptedMdc(ciphertext io.WriteCloser, c CipherFunction, key []byte, config *Config) (Contents io.WriteCloser, err error) {
+	// Disallow old cipher suites
+	if !c.IsSupported() || c < CipherAES128 {
+		return nil, errors.InvalidArgumentError("invalid mdc cipher function")
+	}
+
+	if c.KeySize() != len(key) {
+		return nil, errors.InvalidArgumentError("error in mdc serialization: bad key length")
+	}
+
+	_, err = ciphertext.Write([]byte{symmetricallyEncryptedVersionMdc})
+	if err != nil {
+		return
+	}
+
+	block := c.new(key)
+	blockSize := block.BlockSize()
+	iv := make([]byte, blockSize)
+	_, err = config.Random().Read(iv)
+	if err != nil {
+		return
+	}
+	s, prefix := NewOCFBEncrypter(block, iv, OCFBNoResync)
+	_, err = ciphertext.Write(prefix)
+	if err != nil {
+		return
+	}
+	plaintext := cipher.StreamWriter{S: s, W: ciphertext}
+
+	h := sha1.New()
+	h.Write(iv)
+	h.Write(iv[blockSize-2:])
+	Contents = &seMDCWriter{w: plaintext, h: h}
+	return
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userattribute.go

@@ -42,9 +42,16 @@ func NewUserAttributePhoto(photos ...image.Image) (uat *UserAttribute, err error
 		if err = jpeg.Encode(&buf, photo, nil); err != nil {
 			return
 		}
+
+		lengthBuf := make([]byte, 5)
+		n := serializeSubpacketLength(lengthBuf, len(buf.Bytes())+1)
+		lengthBuf = lengthBuf[:n]
+
 		uat.Contents = append(uat.Contents, &OpaqueSubpacket{
-			SubType:  UserAttrImageSubpacket,
-			Contents: buf.Bytes()})
+			SubType:       UserAttrImageSubpacket,
+			EncodedLength: lengthBuf,
+			Contents:      buf.Bytes(),
+		})
 	}
 	return
 }

vendor/github.com/ProtonMail/go-crypto/openpgp/read.go

@@ -8,13 +8,16 @@ package openpgp // import "github.com/ProtonMail/go-crypto/openpgp"
 import (
 	"crypto"
 	_ "crypto/sha256"
+	_ "crypto/sha512"
 	"hash"
 	"io"
 	"strconv"
 
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
 	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
+	_ "golang.org/x/crypto/sha3"
 )
 
 // SignatureType is the armor type for a PGP signature.
@@ -119,17 +122,25 @@ ParsePackets:
 			default:
 				continue
 			}
-			var keys []Key
-			if p.KeyId == 0 {
-				keys = keyring.DecryptionKeys()
-			} else {
-				keys = keyring.KeysById(p.KeyId)
+			if keyring != nil {
+				var keys []Key
+				if p.KeyId == 0 {
+					keys = keyring.DecryptionKeys()
+				} else {
+					keys = keyring.KeysById(p.KeyId)
+				}
+				for _, k := range keys {
+					pubKeys = append(pubKeys, keyEnvelopePair{k, p})
+				}
 			}
-			for _, k := range keys {
-				pubKeys = append(pubKeys, keyEnvelopePair{k, p})
+		case *packet.SymmetricallyEncrypted:
+			if !p.IntegrityProtected && !config.AllowUnauthenticatedMessages() {
+				return nil, errors.UnsupportedError("message is not integrity protected")
 			}
-		case *packet.SymmetricallyEncrypted, *packet.AEADEncrypted:
-			edp = p.(packet.EncryptedDataPacket)
+			edp = p
+			break ParsePackets
+		case *packet.AEADEncrypted:
+			edp = p
 			break ParsePackets
 		case *packet.Compressed, *packet.LiteralData, *packet.OnePassSignature:
 			// This message isn't encrypted.
@@ -200,13 +211,11 @@ FindKey:
 		if len(symKeys) != 0 && passphrase != nil {
 			for _, s := range symKeys {
 				key, cipherFunc, err := s.Decrypt(passphrase)
-				// On wrong passphrase, session key decryption is very likely to result in an invalid cipherFunc:
+				// In v4, on wrong passphrase, session key decryption is very likely to result in an invalid cipherFunc:
 				// only for < 5% of cases we will proceed to decrypt the data
 				if err == nil {
 					decrypted, err = edp.Decrypt(cipherFunc, key)
-					// TODO: ErrKeyIncorrect is no longer thrown on SEIP decryption,
-					// but it might still be relevant for when we implement AEAD decryption (otherwise, remove?)
-					if err != nil && err != errors.ErrKeyIncorrect {
+					if err != nil {
 						return nil, err
 					}
 					if decrypted != nil {
@@ -268,9 +277,11 @@ FindLiteralData:
 
 			md.IsSigned = true
 			md.SignedByKeyId = p.KeyId
-			keys := keyring.KeysByIdUsage(p.KeyId, packet.KeyFlagSign)
-			if len(keys) > 0 {
-				md.SignedBy = &keys[0]
+			if keyring != nil {
+				keys := keyring.KeysByIdUsage(p.KeyId, packet.KeyFlagSign)
+				if len(keys) > 0 {
+					md.SignedBy = &keys[0]
+				}
 			}
 		case *packet.LiteralData:
 			md.LiteralData = p
@@ -294,14 +305,14 @@ FindLiteralData:
 // should be preprocessed (i.e. to normalize line endings). Thus this function
 // returns two hashes. The second should be used to hash the message itself and
 // performs any needed preprocessing.
-func hashForSignature(hashId crypto.Hash, sigType packet.SignatureType) (hash.Hash, hash.Hash, error) {
-	if hashId == crypto.MD5 {
-		return nil, nil, errors.UnsupportedError("insecure hash algorithm: MD5")
+func hashForSignature(hashFunc crypto.Hash, sigType packet.SignatureType) (hash.Hash, hash.Hash, error) {
+	if _, ok := algorithm.HashToHashIdWithSha1(hashFunc); !ok {
+		return nil, nil, errors.UnsupportedError("unsupported hash function")
 	}
-	if !hashId.Available() {
-		return nil, nil, errors.UnsupportedError("hash not available: " + strconv.Itoa(int(hashId)))
+	if !hashFunc.Available() {
+		return nil, nil, errors.UnsupportedError("hash not available: " + strconv.Itoa(int(hashFunc)))
 	}
-	h := hashId.New()
+	h := hashFunc.New()
 
 	switch sigType {
 	case packet.SigTypeBinary:
@@ -373,19 +384,7 @@ func (scr *signatureCheckReader) Read(buf []byte) (int, error) {
 					key := scr.md.SignedBy
 					signatureError := key.PublicKey.VerifySignature(scr.h, sig)
 					if signatureError == nil {
-						now := scr.config.Now()
-						if key.Revoked(now) ||
-							key.Entity.Revoked(now) || // primary key is revoked (redundant if key is the primary key)
-							key.Entity.PrimaryIdentity().Revoked(now) {
-							signatureError = errors.ErrKeyRevoked
-						}
-						if sig.SigExpired(now) {
-							signatureError = errors.ErrSignatureExpired
-						}
-						if key.PublicKey.KeyExpired(key.SelfSignature, now) ||
-							key.SelfSignature.SigExpired(now) {
-							signatureError = errors.ErrKeyExpired
-						}
+						signatureError = checkSignatureDetails(key, sig, scr.config)
 					}
 					scr.md.Signature = sig
 					scr.md.SignatureError = signatureError
@@ -424,8 +423,24 @@ func (scr *signatureCheckReader) Read(buf []byte) (int, error) {
 	return n, nil
 }
 
+// VerifyDetachedSignature takes a signed file and a detached signature and
+// returns the signature packet and the entity the signature was signed by,
+// if any, and a possible signature verification error.
+// If the signer isn't known, ErrUnknownIssuer is returned.
+func VerifyDetachedSignature(keyring KeyRing, signed, signature io.Reader, config *packet.Config) (sig *packet.Signature, signer *Entity, err error) {
+	var expectedHashes []crypto.Hash
+	return verifyDetachedSignature(keyring, signed, signature, expectedHashes, config)
+}
+
+// VerifyDetachedSignatureAndHash performs the same actions as
+// VerifyDetachedSignature and checks that the expected hash functions were used.
+func VerifyDetachedSignatureAndHash(keyring KeyRing, signed, signature io.Reader, expectedHashes []crypto.Hash, config *packet.Config) (sig *packet.Signature, signer *Entity, err error) {
+	return verifyDetachedSignature(keyring, signed, signature, expectedHashes, config)
+}
+
 // CheckDetachedSignature takes a signed file and a detached signature and
-// returns the signer if the signature is valid. If the signer isn't known,
+// returns the entity the signature was signed by, if any, and a possible
+// signature verification error. If the signer isn't known,
 // ErrUnknownIssuer is returned.
 func CheckDetachedSignature(keyring KeyRing, signed, signature io.Reader, config *packet.Config) (signer *Entity, err error) {
 	var expectedHashes []crypto.Hash
@@ -435,6 +450,11 @@ func CheckDetachedSignature(keyring KeyRing, signed, signature io.Reader, config
 // CheckDetachedSignatureAndHash performs the same actions as
 // CheckDetachedSignature and checks that the expected hash functions were used.
 func CheckDetachedSignatureAndHash(keyring KeyRing, signed, signature io.Reader, expectedHashes []crypto.Hash, config *packet.Config) (signer *Entity, err error) {
+	_, signer, err = verifyDetachedSignature(keyring, signed, signature, expectedHashes, config)
+	return
+}
+
+func verifyDetachedSignature(keyring KeyRing, signed, signature io.Reader, expectedHashes []crypto.Hash, config *packet.Config) (sig *packet.Signature, signer *Entity, err error) {
 	var issuerKeyId uint64
 	var hashFunc crypto.Hash
 	var sigType packet.SignatureType
@@ -443,23 +463,22 @@ func CheckDetachedSignatureAndHash(keyring KeyRing, signed, signature io.Reader,
 
 	expectedHashesLen := len(expectedHashes)
 	packets := packet.NewReader(signature)
-	var sig *packet.Signature
 	for {
 		p, err = packets.Next()
 		if err == io.EOF {
-			return nil, errors.ErrUnknownIssuer
+			return nil, nil, errors.ErrUnknownIssuer
 		}
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 
 		var ok bool
 		sig, ok = p.(*packet.Signature)
 		if !ok {
-			return nil, errors.StructuralError("non signature packet found")
+			return nil, nil, errors.StructuralError("non signature packet found")
 		}
 		if sig.IssuerKeyId == nil {
-			return nil, errors.StructuralError("signature doesn't have an issuer")
+			return nil, nil, errors.StructuralError("signature doesn't have an issuer")
 		}
 		issuerKeyId = *sig.IssuerKeyId
 		hashFunc = sig.Hash
@@ -470,7 +489,7 @@ func CheckDetachedSignatureAndHash(keyring KeyRing, signed, signature io.Reader,
 				break
 			}
 			if i+1 == expectedHashesLen {
-				return nil, errors.StructuralError("hash algorithm mismatch with cleartext message headers")
+				return nil, nil, errors.StructuralError("hash algorithm mismatch with cleartext message headers")
 			}
 		}
 
@@ -486,34 +505,21 @@ func CheckDetachedSignatureAndHash(keyring KeyRing, signed, signature io.Reader,
 
 	h, wrappedHash, err := hashForSignature(hashFunc, sigType)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
 	if _, err := io.Copy(wrappedHash, signed); err != nil && err != io.EOF {
-		return nil, err
+		return nil, nil, err
 	}
 
 	for _, key := range keys {
 		err = key.PublicKey.VerifySignature(h, sig)
 		if err == nil {
-			now := config.Now()
-			if key.Revoked(now) ||
-				key.Entity.Revoked(now) || // primary key is revoked (redundant if key is the primary key)
-				key.Entity.PrimaryIdentity().Revoked(now) {
-				return key.Entity, errors.ErrKeyRevoked
-			}
-			if sig.SigExpired(now) {
-				return key.Entity, errors.ErrSignatureExpired
-			}
-			if key.PublicKey.KeyExpired(key.SelfSignature, now) ||
-				key.SelfSignature.SigExpired(now) {
-				return key.Entity, errors.ErrKeyExpired
-			}
-			return key.Entity, nil
+			return sig, key.Entity, checkSignatureDetails(&key, sig, config)
 		}
 	}
 
-	return nil, err
+	return nil, nil, err
 }
 
 // CheckArmoredDetachedSignature performs the same actions as
@@ -526,3 +532,61 @@ func CheckArmoredDetachedSignature(keyring KeyRing, signed, signature io.Reader,
 
 	return CheckDetachedSignature(keyring, signed, body, config)
 }
+
+// checkSignatureDetails returns an error if:
+//   - The signature (or one of the binding signatures mentioned below)
+//     has a unknown critical notation data subpacket
+//   - The primary key of the signing entity is revoked
+//   - The primary identity is revoked
+//   - The signature is expired
+//   - The primary key of the signing entity is expired according to the
+//     primary identity binding signature
+//
+// ... or, if the signature was signed by a subkey and:
+//   - The signing subkey is revoked
+//   - The signing subkey is expired according to the subkey binding signature
+//   - The signing subkey binding signature is expired
+//   - The signing subkey cross-signature is expired
+//
+// NOTE: The order of these checks is important, as the caller may choose to
+// ignore ErrSignatureExpired or ErrKeyExpired errors, but should never
+// ignore any other errors.
+//
+// TODO: Also return an error if:
+// - The primary key is expired according to a direct-key signature
+// - (For V5 keys only:) The direct-key signature (exists and) is expired
+func checkSignatureDetails(key *Key, signature *packet.Signature, config *packet.Config) error {
+	now := config.Now()
+	primaryIdentity := key.Entity.PrimaryIdentity()
+	signedBySubKey := key.PublicKey != key.Entity.PrimaryKey
+	sigsToCheck := []*packet.Signature{signature, primaryIdentity.SelfSignature}
+	if signedBySubKey {
+		sigsToCheck = append(sigsToCheck, key.SelfSignature, key.SelfSignature.EmbeddedSignature)
+	}
+	for _, sig := range sigsToCheck {
+		for _, notation := range sig.Notations {
+			if notation.IsCritical && !config.KnownNotation(notation.Name) {
+				return errors.SignatureError("unknown critical notation: " + notation.Name)
+			}
+		}
+	}
+	if key.Entity.Revoked(now) || // primary key is revoked
+		(signedBySubKey && key.Revoked(now)) || // subkey is revoked
+		primaryIdentity.Revoked(now) { // primary identity is revoked
+		return errors.ErrKeyRevoked
+	}
+	if key.Entity.PrimaryKey.KeyExpired(primaryIdentity.SelfSignature, now) { // primary key is expired
+		return errors.ErrKeyExpired
+	}
+	if signedBySubKey {
+		if key.PublicKey.KeyExpired(key.SelfSignature, now) { // subkey is expired
+			return errors.ErrKeyExpired
+		}
+	}
+	for _, sig := range sigsToCheck {
+		if sig.SigExpired(now) { // any of the relevant signatures are expired
+			return errors.ErrSignatureExpired
+		}
+	}
+	return nil
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/read_write_test_data.go

@@ -1,8 +1,8 @@
 package openpgp
 
-const testKey1KeyId = 0xA34D7E18C20C31BB
-const testKey3KeyId = 0x338934250CCC0360
-const testKeyP256KeyId = 0xd44a2c495918513e
+const testKey1KeyId uint64 = 0xA34D7E18C20C31BB
+const testKey3KeyId uint64 = 0x338934250CCC0360
+const testKeyP256KeyId uint64 = 0xd44a2c495918513e
 
 const signedInput = "Signed message\nline 2\nline 3\n"
 const signedTextInput = "Signed message\r\nline 2\r\nline 3\r\n"
@@ -102,11 +102,11 @@ ex7En5r7rHR5xwX82Msc+Rq9dSyO
 
 const dsaKeyWithSHA512 = `9901a2044f04b07f110400db244efecc7316553ee08d179972aab87bb1214de7692593fcf5b6feb1c80fba268722dd464748539b85b81d574cd2d7ad0ca2444de4d849b8756bad7768c486c83a824f9bba4af773d11742bdfb4ac3b89ef8cc9452d4aad31a37e4b630d33927bff68e879284a1672659b8b298222fc68f370f3e24dccacc4a862442b9438b00a0ea444a24088dc23e26df7daf8f43cba3bffc4fe703fe3d6cd7fdca199d54ed8ae501c30e3ec7871ea9cdd4cf63cfe6fc82281d70a5b8bb493f922cd99fba5f088935596af087c8d818d5ec4d0b9afa7f070b3d7c1dd32a84fca08d8280b4890c8da1dde334de8e3cad8450eed2a4a4fcc2db7b8e5528b869a74a7f0189e11ef097ef1253582348de072bb07a9fa8ab838e993cef0ee203ff49298723e2d1f549b00559f886cd417a41692ce58d0ac1307dc71d85a8af21b0cf6eaa14baf2922d3a70389bedf17cc514ba0febbd107675a372fe84b90162a9e88b14d4b1c6be855b96b33fb198c46f058568817780435b6936167ebb3724b680f32bf27382ada2e37a879b3d9de2abe0c3f399350afd1ad438883f4791e2e3b4184453412068617368207472756e636174696f6e207465737488620413110a002205024f04b07f021b03060b090807030206150802090a0b0416020301021e01021780000a0910ef20e0cefca131581318009e2bf3bf047a44d75a9bacd00161ee04d435522397009a03a60d51bd8a568c6c021c8d7cf1be8d990d6417b0020003`
 
-const unknownHashFunctionHex = `8a00000040040001990006050253863c24000a09103b4fe6acc0b21f32ffff01010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101`
+const unknownHashFunctionHex = `8a00000040040001990006050253863c24000a09103b4fe6acc0b21f32ffff0101010101010101010101010101010101010101010101010101010101010101010101010101`
 
 const rsaSignatureBadMPIlength = `8a00000040040001030006050253863c24000a09103b4fe6acc0b21f32ffff0101010101010101010101010101010101010101010101010101010101010101010101010101`
 
-const missingHashFunctionHex = `8a00000040040001030006050253863c24000a09103b4fe6acc0b21f32ffff0101010101010101010101010101010101010101010101010101010101010101010101`
+const missingHashFunctionHex = `8a00000040040001030006050253863c24000a09103b4fe6acc0b21f32ffff0101010101010101010101010101010101010101010101010101010101010101010101010101`
 
 const campbellQuine = `a0b001000300fcffa0b001000d00f2ff000300fcffa0b001000d00f2ff8270a01c00000500faff8270a01c00000500faff000500faff001400ebff8270a01c00000500faff000500faff001400ebff428821c400001400ebff428821c400001400ebff428821c400001400ebff428821c400001400ebff428821c400000000ffff000000ffff000b00f4ff428821c400000000ffff000000ffff000b00f4ff0233214c40000100feff000233214c40000100feff0000`
 
@@ -171,3 +171,104 @@ y29VPonFXqi2zKkpZrvyvZxg+n5e8Nt9wNbuxeCd3QD/TtO2s+JvjrE4Siwv
 UQdl5MlBka1QSNbMq2Bz7XwNPg4=
 =6lbM
 -----END PGP MESSAGE-----`
+
+const keyWithExpiredCrossSig = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+xsDNBF2lnPIBDAC5cL9PQoQLTMuhjbYvb4Ncuuo0bfmgPRFywX53jPhoFf4Zg6mv
+/seOXpgecTdOcVttfzC8ycIKrt3aQTiwOG/ctaR4Bk/t6ayNFfdUNxHWk4WCKzdz
+/56fW2O0F23qIRd8UUJp5IIlN4RDdRCtdhVQIAuzvp2oVy/LaS2kxQoKvph/5pQ/
+5whqsyroEWDJoSV0yOb25B/iwk/pLUFoyhDG9bj0kIzDxrEqW+7Ba8nocQlecMF3
+X5KMN5kp2zraLv9dlBBpWW43XktjcCZgMy20SouraVma8Je/ECwUWYUiAZxLIlMv
+9CurEOtxUw6N3RdOtLmYZS9uEnn5y1UkF88o8Nku890uk6BrewFzJyLAx5wRZ4F0
+qV/yq36UWQ0JB/AUGhHVPdFf6pl6eaxBwT5GXvbBUibtf8YI2og5RsgTWtXfU7eb
+SGXrl5ZMpbA6mbfhd0R8aPxWfmDWiIOhBufhMCvUHh1sApMKVZnvIff9/0Dca3wb
+vLIwa3T4CyshfT0AEQEAAc0hQm9iIEJhYmJhZ2UgPGJvYkBvcGVucGdwLmV4YW1w
+bGU+wsEABBMBCgATBYJeO2eVAgsJAxUICgKbAQIeAQAhCRD7/MgqAV5zMBYhBNGm
+bhojsYLJmA94jPv8yCoBXnMwKWUMAJ3FKZfJ2mXvh+GFqgymvK4NoKkDRPB0CbUN
+aDdG7ZOizQrWXo7Da2MYIZ6eZUDqBKLdhZ5gZfVnisDfu/yeCgpENaKib1MPHpA8
+nZQjnPejbBDomNqY8HRzr5jvXNlwywBpjWGtegCKUY9xbSynjbfzIlMrWL4S+Rfl
++bOOQKRyYJWXmECmVyqY8cz2VUYmETjNcwC8VCDUxQnhtcCJ7Aej22hfYwVEPb/J
+BsJBPq8WECCiGfJ9Y2y6TF+62KzG9Kfs5hqUeHhQy8V4TSi479ewwL7DH86XmIIK
+chSANBS+7iyMtctjNZfmF9zYdGJFvjI/mbBR/lK66E515Inuf75XnL8hqlXuwqvG
+ni+i03Aet1DzULZEIio4uIU6ioc1lGO9h7K2Xn4S7QQH1QoISNMWqXibUR0RCGjw
+FsEDTt2QwJl8XXxoJCooM7BCcCQo+rMNVUHDjIwrdoQjPld3YZsUQQRcqH6bLuln
+cfn5ufl8zTGWKydoj/iTz8KcjZ7w187AzQRdpZzyAQwA1jC/XGxjK6ddgrRfW9j+
+s/U00++EvIsgTs2kr3Rg0GP7FLWV0YNtR1mpl55/bEl7yAxCDTkOgPUMXcaKlnQh
+6zrlt6H53mF6Bvs3inOHQvOsGtU0dqvb1vkTF0juLiJgPlM7pWv+pNQ6IA39vKoQ
+sTMBv4v5vYNXP9GgKbg8inUNT17BxzZYHfw5+q63ectgDm2on1e8CIRCZ76oBVwz
+dkVxoy3gjh1eENlk2D4P0uJNZzF1Q8GV67yLANGMCDICE/OkWn6daipYDzW4iJQt
+YPUWP4hWhjdm+CK+hg6IQUEn2Vtvi16D2blRP8BpUNNa4fNuylWVuJV76rIHvsLZ
+1pbM3LHpRgE8s6jivS3Rz3WRs0TmWCNnvHPqWizQ3VTy+r3UQVJ5AmhJDrZdZq9i
+aUIuZ01PoE1+CHiJwuxPtWvVAxf2POcm1M/F1fK1J0e+lKlQuyonTXqXR22Y41wr
+fP2aPk3nPSTW2DUAf3vRMZg57ZpRxLEhEMxcM4/LMR+PABEBAAHCwrIEGAEKAAkF
+gl8sAVYCmwIB3QkQ+/zIKgFeczDA+qAEGQEKAAwFgl47Z5UFgwB4TOAAIQkQfC+q
+Tfk8N7IWIQQd3OFfCSF87i87N2B8L6pN+Tw3st58C/0exp0X2U4LqicSHEOSqHZj
+jiysdqIELHGyo5DSPv92UFPp36aqjF9OFgtNNwSa56fmAVCD4+hor/fKARRIeIjF
+qdIC5Y/9a4B10NQFJa5lsvB38x/d39LI2kEoglZnqWgdJskROo3vNQF4KlIcm6FH
+dn4WI8UkC5oUUcrpZVMSKoacIaxLwqnXT42nIVgYYuqrd/ZagZZjG5WlrTOd5+NI
+zi/l0fWProcPHGLjmAh4Thu8i7omtVw1nQaMnq9I77ffg3cPDgXknYrLL+q8xXh/
+0mEJyIhnmPwllWCSZuLv9DrD5pOexFfdlwXhf6cLzNpW6QhXD/Tf5KrqIPr9aOv8
+9xaEEXWh0vEby2kIsI2++ft+vfdIyxYw/wKqx0awTSnuBV1rG3z1dswX4BfoY66x
+Bz3KOVqlz9+mG/FTRQwrgPvR+qgLCHbuotxoGN7fzW+PI75hQG5JQAqhsC9sHjQH
+UrI21/VUNwzfw3v5pYsWuFb5bdQ3ASJetICQiMy7IW8WIQTRpm4aI7GCyZgPeIz7
+/MgqAV5zMG6/C/wLpPl/9e6Hf5wmXIUwpZNQbNZvpiCcyx9sXsHXaycOQVxn3McZ
+nYOUP9/mobl1tIeDQyTNbkxWjU0zzJl8XQsDZerb5098pg+x7oGIL7M1vn5s5JMl
+owROourqF88JEtOBxLMxlAM7X4hB48xKQ3Hu9hS1GdnqLKki4MqRGl4l5FUwyGOM
+GjyS3TzkfiDJNwQxybQiC9n57ij20ieNyLfuWCMLcNNnZUgZtnF6wCctoq/0ZIWu
+a7nvuA/XC2WW9YjEJJiWdy5109pqac+qWiY11HWy/nms4gpMdxVpT0RhrKGWq4o0
+M5q3ZElOoeN70UO3OSbU5EVrG7gB1GuwF9mTHUVlV0veSTw0axkta3FGT//XfSpD
+lRrCkyLzwq0M+UUHQAuYpAfobDlDdnxxOD2jm5GyTzak3GSVFfjW09QFVO6HlGp5
+01/jtzkUiS6nwoHHkfnyn0beZuR8X6KlcrzLB0VFgQFLmkSM9cSOgYhD0PTu9aHb
+hW1Hj9AO8lzggBQ=
+=Nt+N
+-----END PGP PUBLIC KEY BLOCK-----
+`
+
+const sigFromKeyWithExpiredCrossSig = `-----BEGIN PGP SIGNATURE-----
+
+wsDzBAABCgAGBYJfLAFsACEJEHwvqk35PDeyFiEEHdzhXwkhfO4vOzdgfC+qTfk8
+N7KiqwwAts4QGB7v9bABCC2qkTxJhmStC0wQMcHRcjL/qAiVnmasQWmvE9KVsdm3
+AaXd8mIx4a37/RRvr9dYrY2eE4uw72cMqPxNja2tvVXkHQvk1oEUqfkvbXs4ypKI
+NyeTWjXNOTZEbg0hbm3nMy+Wv7zgB1CEvAsEboLDJlhGqPcD+X8a6CJGrBGUBUrv
+KVmZr3U6vEzClz3DBLpoddCQseJRhT4YM1nKmBlZ5quh2LFgTSpajv5OsZheqt9y
+EZAPbqmLhDmWRQwGzkWHKceKS7nZ/ox2WK6OS7Ob8ZGZkM64iPo6/EGj5Yc19vQN
+AGiIaPEGszBBWlOpHTPhNm0LB0nMWqqaT87oNYwP8CQuuxDb6rKJ2lffCmZH27Lb
+UbQZcH8J+0UhpeaiadPZxH5ATJAcenmVtVVMLVOFnm+eIlxzov9ntpgGYt8hLdXB
+ITEG9mMgp3TGS9ZzSifMZ8UGtHdp9QdBg8NEVPFzDOMGxpc/Bftav7RRRuPiAER+
+7A5CBid5
+=aQkm
+-----END PGP SIGNATURE-----
+`
+
+const signedMessageWithCriticalNotation = `-----BEGIN PGP MESSAGE-----
+
+owGbwMvMwMH4oOW7S46CznTG09xJDDE3Wl1KUotLuDousDAwcjBYiSmyXL+48d6x
+U1PSGUxcj8IUszKBVMpMaWAAAgEGZpAeh9SKxNyCnFS95PzcytRiBi5OAZjyXXzM
+f8WYLqv7TXP61Sa4rqT12CI3xaN73YS2pt089f96odCKaEPnWJ3iSGmzJaW/ug10
+2Zo8Wj2k4s7t8wt4H3HtTu+y5UZfV3VOO+l//sdE/o+Lsub8FZH7/eOq7OnbNp4n
+vwjE8mqJXetNMfj8r2SCyvkEnlVRYR+/mnge+ib56FdJ8uKtqSxyvgA=
+=fRXs
+-----END PGP MESSAGE-----`
+
+const criticalNotationSigner = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mI0EUmEvTgEEANyWtQQMOybQ9JltDqmaX0WnNPJeLILIM36sw6zL0nfTQ5zXSS3+
+fIF6P29lJFxpblWk02PSID5zX/DYU9/zjM2xPO8Oa4xo0cVTOTLj++Ri5mtr//f5
+GLsIXxFrBJhD/ghFsL3Op0GXOeLJ9A5bsOn8th7x6JucNKuaRB6bQbSPABEBAAG0
+JFRlc3QgTWNUZXN0aW5ndG9uIDx0ZXN0QGV4YW1wbGUuY29tPoi5BBMBAgAjBQJS
+YS9OAhsvBwsJCAcDAgEGFQgCCQoLBBYCAwECHgECF4AACgkQSmNhOk1uQJQwDAP6
+AgrTyqkRlJVqz2pb46TfbDM2TDF7o9CBnBzIGoxBhlRwpqALz7z2kxBDmwpQa+ki
+Bq3jZN/UosY9y8bhwMAlnrDY9jP1gdCo+H0sD48CdXybblNwaYpwqC8VSpDdTndf
+9j2wE/weihGp/DAdy/2kyBCaiOY1sjhUfJ1GogF49rC4jQRSYS9OAQQA6R/PtBFa
+JaT4jq10yqASk4sqwVMsc6HcifM5lSdxzExFP74naUMMyEsKHP53QxTF0Grqusag
+Qg/ZtgT0CN1HUM152y7ACOdp1giKjpMzOTQClqCoclyvWOFB+L/SwGEIJf7LSCEr
+woBuJifJc8xAVr0XX0JthoW+uP91eTQ3XpsAEQEAAYkBPQQYAQIACQUCUmEvTgIb
+LgCoCRBKY2E6TW5AlJ0gBBkBAgAGBQJSYS9OAAoJEOCE90RsICyXuqIEANmmiRCA
+SF7YK7PvFkieJNwzeK0V3F2lGX+uu6Y3Q/Zxdtwc4xR+me/CSBmsURyXTO29OWhP
+GLszPH9zSJU9BdDi6v0yNprmFPX/1Ng0Abn/sCkwetvjxC1YIvTLFwtUL/7v6NS2
+bZpsUxRTg9+cSrMWWSNjiY9qUKajm1tuzPDZXAUEAMNmAN3xXN/Kjyvj2OK2ck0X
+W748sl/tc3qiKPMJ+0AkMF7Pjhmh9nxqE9+QCEl7qinFqqBLjuzgUhBU4QlwX1GD
+AtNTq6ihLMD5v1d82ZC7tNatdlDMGWnIdvEMCv2GZcuIqDQ9rXWs49e7tq1NncLY
+hz3tYjKhoFTKEIq3y3Pp
+=h/aX
+-----END PGP PUBLIC KEY BLOCK-----`

vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k.go

@@ -3,7 +3,8 @@
 // license that can be found in the LICENSE file.
 
 // Package s2k implements the various OpenPGP string-to-key transforms as
-// specified in RFC 4800 section 3.7.1.
+// specified in RFC 4800 section 3.7.1, and Argon2 specified in
+// draft-ietf-openpgp-crypto-refresh-08 section 3.7.1.4.
 package s2k // import "github.com/ProtonMail/go-crypto/openpgp/s2k"
 
 import (
@@ -14,70 +15,47 @@ import (
 
 	"github.com/ProtonMail/go-crypto/openpgp/errors"
 	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+	"golang.org/x/crypto/argon2"
 )
 
-// Config collects configuration parameters for s2k key-stretching
-// transformations. A nil *Config is valid and results in all default
-// values. Currently, Config is used only by the Serialize function in
-// this package.
-type Config struct {
-	// S2KMode is the mode of s2k function.
-	// It can be 0 (simple), 1(salted), 3(iterated)
-	// 2(reserved) 100-110(private/experimental).
-	S2KMode uint8
-	// Hash is the default hash function to be used. If
-	// nil, SHA256 is used.
-	Hash crypto.Hash
-	// S2KCount is only used for symmetric encryption. It
-	// determines the strength of the passphrase stretching when
-	// the said passphrase is hashed to produce a key. S2KCount
-	// should be between 65536 and 65011712, inclusive. If Config
-	// is nil or S2KCount is 0, the value 16777216 used. Not all
-	// values in the above range can be represented. S2KCount will
-	// be rounded up to the next representable value if it cannot
-	// be encoded exactly. See RFC 4880 Section 3.7.1.3.
-	S2KCount int
-}
+type Mode uint8
+
+// Defines the default S2KMode constants
+//
+//	0 (simple), 1(salted), 3(iterated), 4(argon2)
+const (
+	SimpleS2K         Mode = 0
+	SaltedS2K         Mode = 1
+	IteratedSaltedS2K Mode = 3
+	Argon2S2K         Mode = 4
+	GnuS2K            Mode = 101
+)
+
+const Argon2SaltSize int = 16
 
 // Params contains all the parameters of the s2k packet
 type Params struct {
 	// mode is the mode of s2k function.
 	// It can be 0 (simple), 1(salted), 3(iterated)
 	// 2(reserved) 100-110(private/experimental).
-	mode uint8
+	mode Mode
 	// hashId is the ID of the hash function used in any of the modes
 	hashId byte
-	// salt is a byte array to use as a salt in hashing process
-	salt []byte
+	// salt is a byte array to use as a salt in hashing process or argon2
+	saltBytes [Argon2SaltSize]byte
 	// countByte is used to determine how many rounds of hashing are to
 	// be performed in s2k mode 3. See RFC 4880 Section 3.7.1.3.
 	countByte byte
-}
-
-func (c *Config) hash() crypto.Hash {
-	if c == nil || uint(c.Hash) == 0 {
-		return crypto.SHA256
-	}
-
-	return c.Hash
-}
-
-// EncodedCount get encoded count
-func (c *Config) EncodedCount() uint8 {
-	if c == nil || c.S2KCount == 0 {
-		return 224 // The common case. Corresponding to 16777216
-	}
-
-	i := c.S2KCount
-
-	switch {
-	case i < 65536:
-		i = 65536
-	case i > 65011712:
-		i = 65011712
-	}
-
-	return encodeCount(i)
+	// passes is a parameter in Argon2 to determine the number of iterations
+	// See RFC the crypto refresh Section 3.7.1.4.
+	passes byte
+	// parallelism is a parameter in Argon2 to determine the degree of paralellism
+	// See RFC the crypto refresh Section 3.7.1.4.
+	parallelism byte
+	// memoryExp is a parameter in Argon2 to determine the memory usage
+	// i.e., 2 ** memoryExp kibibytes
+	// See RFC the crypto refresh Section 3.7.1.4.
+	memoryExp byte
 }
 
 // encodeCount converts an iterative "count" in the range 1024 to
@@ -106,6 +84,31 @@ func decodeCount(c uint8) int {
 	return (16 + int(c&15)) << (uint32(c>>4) + 6)
 }
 
+// encodeMemory converts the Argon2 "memory" in the range parallelism*8 to
+// 2**31, inclusive, to an encoded memory. The return value is the
+// octet that is actually stored in the GPG file. encodeMemory panics
+// if is not in the above range 
+// See OpenPGP crypto refresh Section 3.7.1.4.
+func encodeMemory(memory uint32, parallelism uint8) uint8 {
+	if memory < (8 * uint32(parallelism)) || memory > uint32(2147483648) {
+		panic("Memory argument memory is outside the required range")
+	}
+
+	for exp := 3; exp < 31; exp++ {
+		compare := decodeMemory(uint8(exp))
+		if compare >= memory {
+			return uint8(exp)
+		}
+	}
+
+	return 31
+}
+
+// decodeMemory computes the decoded memory in kibibytes as 2**memoryExponent
+func decodeMemory(memoryExponent uint8) uint32 {
+	return uint32(1) << memoryExponent
+}
+
 // Simple writes to out the result of computing the Simple S2K function (RFC
 // 4880, section 3.7.1.1) using the given hash and input passphrase.
 func Simple(out []byte, h hash.Hash, in []byte) {
@@ -169,25 +172,53 @@ func Iterated(out []byte, h hash.Hash, in []byte, salt []byte, count int) {
 	}
 }
 
+// Argon2 writes to out the key derived from the password (in) with the Argon2
+// function (the crypto refresh, section 3.7.1.4)
+func Argon2(out []byte, in []byte, salt []byte, passes uint8, paralellism uint8, memoryExp uint8) {
+	key := argon2.IDKey(in, salt, uint32(passes), decodeMemory(memoryExp), paralellism, uint32(len(out)))
+	copy(out[:], key)
+}
+
 // Generate generates valid parameters from given configuration.
-// It will enforce salted + hashed s2k method
+// It will enforce the Iterated and Salted or Argon2 S2K method.
 func Generate(rand io.Reader, c *Config) (*Params, error) {
-	hashId, ok := HashToHashId(c.Hash)
-	if !ok {
-		return nil, errors.UnsupportedError("no such hash")
-	}
+	var params *Params
+	if c != nil && c.Mode() == Argon2S2K {
+		// handle Argon2 case
+		argonConfig := c.Argon2()
+		params = &Params{
+			mode:        Argon2S2K,
+			passes:      argonConfig.Passes(),
+			parallelism: argonConfig.Parallelism(),
+			memoryExp:   argonConfig.EncodedMemory(),
+		}
+	} else if c != nil && c.PassphraseIsHighEntropy && c.Mode() == SaltedS2K { // Allow SaltedS2K if PassphraseIsHighEntropy
+		hashId, ok := algorithm.HashToHashId(c.hash())
+		if !ok {
+			return nil, errors.UnsupportedError("no such hash")
+		}
 
-	params := &Params{
-		mode:      3, // Enforce iterared + salted method
-		hashId:    hashId,
-		salt:      make([]byte, 8),
-		countByte: c.EncodedCount(),
+		params = &Params{
+			mode:      SaltedS2K,
+			hashId:    hashId,
+		}
+	} else { // Enforce IteratedSaltedS2K method otherwise
+		hashId, ok := algorithm.HashToHashId(c.hash())
+		if !ok {
+			return nil, errors.UnsupportedError("no such hash")
+		}
+		if c != nil {
+			c.S2KMode = IteratedSaltedS2K
+		}
+		params = &Params{
+			mode:      IteratedSaltedS2K, 
+			hashId:    hashId,
+			countByte: c.EncodedCount(),
+		}
 	}
-
-	if _, err := io.ReadFull(rand, params.salt); err != nil {
+	if _, err := io.ReadFull(rand, params.salt()); err != nil {
 		return nil, err
 	}
-
 	return params, nil
 }
 
@@ -207,45 +238,60 @@ func Parse(r io.Reader) (f func(out, in []byte), err error) {
 // ParseIntoParams reads a binary specification for a string-to-key
 // transformation from r and returns a struct describing the s2k parameters.
 func ParseIntoParams(r io.Reader) (params *Params, err error) {
-	var buf [9]byte
+	var buf [Argon2SaltSize + 3]byte
 
-	_, err = io.ReadFull(r, buf[:2])
+	_, err = io.ReadFull(r, buf[:1])
 	if err != nil {
 		return
 	}
 
 	params = &Params{
-		mode:   buf[0],
-		hashId: buf[1],
+		mode: Mode(buf[0]),
 	}
 
 	switch params.mode {
-	case 0:
-		return params, nil
-	case 1:
-		_, err = io.ReadFull(r, buf[:8])
+	case SimpleS2K:
+		_, err = io.ReadFull(r, buf[:1])
 		if err != nil {
 			return nil, err
 		}
-
-		params.salt = buf[:8]
+		params.hashId = buf[0]
 		return params, nil
-	case 3:
+	case SaltedS2K:
 		_, err = io.ReadFull(r, buf[:9])
 		if err != nil {
 			return nil, err
 		}
-
-		params.salt = buf[:8]
-		params.countByte = buf[8]
+		params.hashId = buf[0]
+		copy(params.salt(), buf[1:9])
 		return params, nil
-	case 101:
-		// This is a GNU extension. See
-		// https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=doc/DETAILS;h=fe55ae16ab4e26d8356dc574c9e8bc935e71aef1;hb=23191d7851eae2217ecdac6484349849a24fd94a#l1109
-		if _, err = io.ReadFull(r, buf[:4]); err != nil {
+	case IteratedSaltedS2K:
+		_, err = io.ReadFull(r, buf[:10])
+		if err != nil {
 			return nil, err
 		}
-		if buf[0] == 'G' && buf[1] == 'N' && buf[2] == 'U' && buf[3] == 1 {
+		params.hashId = buf[0]
+		copy(params.salt(), buf[1:9])
+		params.countByte = buf[9]
+		return params, nil
+	case Argon2S2K:
+		_, err = io.ReadFull(r, buf[:Argon2SaltSize+3])
+		if err != nil {
+			return nil, err
+		}
+		copy(params.salt(), buf[:Argon2SaltSize])
+		params.passes = buf[Argon2SaltSize]
+		params.parallelism = buf[Argon2SaltSize+1]
+		params.memoryExp = buf[Argon2SaltSize+2]
+		return params, nil
+	case GnuS2K:
+		// This is a GNU extension. See
+		// https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=doc/DETAILS;h=fe55ae16ab4e26d8356dc574c9e8bc935e71aef1;hb=23191d7851eae2217ecdac6484349849a24fd94a#l1109
+		if _, err = io.ReadFull(r, buf[:5]); err != nil {
+			return nil, err
+		}
+		params.hashId = buf[0]
+		if buf[1] == 'G' && buf[2] == 'N' && buf[3] == 'U' && buf[4] == 1 {
 			return params, nil
 		}
 		return nil, errors.UnsupportedError("GNU S2K extension")
@@ -255,39 +301,56 @@ func ParseIntoParams(r io.Reader) (params *Params, err error) {
 }
 
 func (params *Params) Dummy() bool {
-	return params != nil && params.mode == 101
+	return params != nil && params.mode == GnuS2K
+}
+
+func (params *Params) salt() []byte {
+	switch params.mode {
+		case SaltedS2K, IteratedSaltedS2K: return params.saltBytes[:8]
+		case Argon2S2K: return params.saltBytes[:Argon2SaltSize]
+		default: return nil
+	}
 }
 
 func (params *Params) Function() (f func(out, in []byte), err error) {
 	if params.Dummy() {
 		return nil, errors.ErrDummyPrivateKey("dummy key found")
 	}
-	hashObj, ok := HashIdToHash(params.hashId)
-	if !ok {
-		return nil, errors.UnsupportedError("hash for S2K function: " + strconv.Itoa(int(params.hashId)))
-	}
-	if !hashObj.Available() {
-		return nil, errors.UnsupportedError("hash not available: " + strconv.Itoa(int(hashObj)))
+	var hashObj crypto.Hash
+	if params.mode != Argon2S2K {
+		var ok bool
+		hashObj, ok = algorithm.HashIdToHashWithSha1(params.hashId)
+		if !ok {
+			return nil, errors.UnsupportedError("hash for S2K function: " + strconv.Itoa(int(params.hashId)))
+		}
+		if !hashObj.Available() {
+			return nil, errors.UnsupportedError("hash not available: " + strconv.Itoa(int(hashObj)))
+		}
 	}
 
 	switch params.mode {
-	case 0:
+	case SimpleS2K:
 		f := func(out, in []byte) {
 			Simple(out, hashObj.New(), in)
 		}
 
 		return f, nil
-	case 1:
+	case SaltedS2K:
 		f := func(out, in []byte) {
-			Salted(out, hashObj.New(), in, params.salt)
+			Salted(out, hashObj.New(), in, params.salt())
 		}
 
 		return f, nil
-	case 3:
+	case IteratedSaltedS2K:
 		f := func(out, in []byte) {
-			Iterated(out, hashObj.New(), in, params.salt, decodeCount(params.countByte))
+			Iterated(out, hashObj.New(), in, params.salt(), decodeCount(params.countByte))
 		}
 
+		return f, nil
+	case Argon2S2K:
+		f := func(out, in []byte) {
+			Argon2(out, in, params.salt(), params.passes, params.parallelism, params.memoryExp)
+		}
 		return f, nil
 	}
 
@@ -295,23 +358,28 @@ func (params *Params) Function() (f func(out, in []byte), err error) {
 }
 
 func (params *Params) Serialize(w io.Writer) (err error) {
-	if _, err = w.Write([]byte{params.mode}); err != nil {
+	if _, err = w.Write([]byte{uint8(params.mode)}); err != nil {
 		return
 	}
-	if _, err = w.Write([]byte{params.hashId}); err != nil {
-		return
+	if params.mode != Argon2S2K {
+		if _, err = w.Write([]byte{params.hashId}); err != nil {
+			return
+		}
 	}
 	if params.Dummy() {
 		_, err = w.Write(append([]byte("GNU"), 1))
 		return
 	}
 	if params.mode > 0 {
-		if _, err = w.Write(params.salt); err != nil {
+		if _, err = w.Write(params.salt()); err != nil {
 			return
 		}
-		if params.mode == 3 {
+		if params.mode == IteratedSaltedS2K {
 			_, err = w.Write([]byte{params.countByte})
 		}
+		if params.mode == Argon2S2K {
+			_, err = w.Write([]byte{params.passes, params.parallelism, params.memoryExp})
+		}
 	}
 	return
 }
@@ -337,31 +405,3 @@ func Serialize(w io.Writer, key []byte, rand io.Reader, passphrase []byte, c *Co
 	f(key, passphrase)
 	return nil
 }
-
-// HashIdToHash returns a crypto.Hash which corresponds to the given OpenPGP
-// hash id.
-func HashIdToHash(id byte) (h crypto.Hash, ok bool) {
-	if hash, ok := algorithm.HashById[id]; ok {
-		return hash.HashFunc(), true
-	}
-	return 0, false
-}
-
-// HashIdToString returns the name of the hash function corresponding to the
-// given OpenPGP hash id.
-func HashIdToString(id byte) (name string, ok bool) {
-	if hash, ok := algorithm.HashById[id]; ok {
-		return hash.String(), true
-	}
-	return "", false
-}
-
-// HashIdToHash returns an OpenPGP hash id which corresponds the given Hash.
-func HashToHashId(h crypto.Hash) (id byte, ok bool) {
-	for id, hash := range algorithm.HashById {
-		if hash.HashFunc() == h {
-			return id, true
-		}
-	}
-	return 0, false
-}

vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k_cache.go

@@ -0,0 +1,26 @@
+package s2k
+
+// Cache stores keys derived with s2k functions from one passphrase
+// to avoid recomputation if multiple items are encrypted with
+// the same parameters.
+type Cache map[Params][]byte
+
+// GetOrComputeDerivedKey tries to retrieve the key 
+// for the given s2k parameters from the cache.
+// If there is no hit, it derives the key with the s2k function from the passphrase,
+// updates the cache, and returns the key.
+func (c *Cache) GetOrComputeDerivedKey(passphrase []byte, params *Params, expectedKeySize int) ([]byte, error) {
+	key, found := (*c)[*params]
+	if !found || len(key) != expectedKeySize {
+		var err error
+		derivedKey := make([]byte, expectedKeySize)
+		s2k, err := params.Function()
+		if err != nil {
+			return nil, err
+		}
+		s2k(derivedKey, passphrase)
+		(*c)[*params] = key
+		return derivedKey, nil
+	}
+	return key, nil
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k_config.go

@@ -0,0 +1,129 @@
+package s2k
+
+import "crypto"
+
+// Config collects configuration parameters for s2k key-stretching
+// transformations. A nil *Config is valid and results in all default
+// values.
+type Config struct {
+	// S2K (String to Key) mode, used for key derivation in the context of secret key encryption
+	// and passphrase-encrypted data. Either s2k.Argon2S2K or s2k.IteratedSaltedS2K may be used.
+	// If the passphrase is a high-entropy key, indicated by setting PassphraseIsHighEntropy to true,
+	// s2k.SaltedS2K can also be used.
+	// Note: Argon2 is the strongest option but not all OpenPGP implementations are compatible with it
+	//(pending standardisation).
+	// 0 (simple), 1(salted), 3(iterated), 4(argon2)
+	// 2(reserved) 100-110(private/experimental).
+	S2KMode Mode
+	// Only relevant if S2KMode is not set to s2k.Argon2S2K.
+	// Hash is the default hash function to be used. If
+	// nil, SHA256 is used.
+	Hash crypto.Hash
+	// Argon2 parameters for S2K (String to Key).
+	// Only relevant if S2KMode is set to s2k.Argon2S2K.
+	// If nil, default parameters are used.
+	// For more details on the choice of parameters, see https://tools.ietf.org/html/rfc9106#section-4.
+	Argon2Config *Argon2Config
+	// Only relevant if S2KMode is set to s2k.IteratedSaltedS2K.
+	// Iteration count for Iterated S2K (String to Key). It
+	// determines the strength of the passphrase stretching when
+	// the said passphrase is hashed to produce a key. S2KCount
+	// should be between 65536 and 65011712, inclusive. If Config
+	// is nil or S2KCount is 0, the value 16777216 used. Not all
+	// values in the above range can be represented. S2KCount will
+	// be rounded up to the next representable value if it cannot
+	// be encoded exactly. When set, it is strongly encrouraged to
+	// use a value that is at least 65536. See RFC 4880 Section
+	// 3.7.1.3.
+	S2KCount int
+	// Indicates whether the passphrase passed by the application is a
+	// high-entropy key (e.g. it's randomly generated or derived from
+	// another passphrase using a strong key derivation function).
+	// When true, allows the S2KMode to be s2k.SaltedS2K.
+	// When the passphrase is not a high-entropy key, using SaltedS2K is
+	// insecure, and not allowed by draft-ietf-openpgp-crypto-refresh-08.
+	PassphraseIsHighEntropy bool
+}
+
+// Argon2Config stores the Argon2 parameters
+// A nil *Argon2Config is valid and results in all default
+type Argon2Config struct {
+	NumberOfPasses      uint8
+	DegreeOfParallelism uint8
+	// The memory parameter for Argon2 specifies desired memory usage in kibibytes. 
+	// For example memory=64*1024 sets the memory cost to ~64 MB.
+	Memory      	    uint32 
+}
+
+func (c *Config) Mode() Mode {
+	if c == nil {
+		return IteratedSaltedS2K
+	}
+	return c.S2KMode
+}
+
+func (c *Config) hash() crypto.Hash {
+	if c == nil || uint(c.Hash) == 0 {
+		return crypto.SHA256
+	}
+
+	return c.Hash
+}
+
+func (c *Config) Argon2() *Argon2Config {
+	if c == nil || c.Argon2Config == nil {
+		return nil
+	}
+	return c.Argon2Config
+}
+
+// EncodedCount get encoded count
+func (c *Config) EncodedCount() uint8 {
+	if c == nil || c.S2KCount == 0 {
+		return 224 // The common case. Corresponding to 16777216
+	}
+
+	i := c.S2KCount
+
+	switch {
+	case i < 65536:
+		i = 65536
+	case i > 65011712:
+		i = 65011712
+	}
+
+	return encodeCount(i)
+}
+
+func (c *Argon2Config) Passes() uint8 {
+	if c == nil || c.NumberOfPasses == 0 {
+		return 3
+	}
+	return c.NumberOfPasses
+}
+
+func (c *Argon2Config) Parallelism() uint8 {
+	if c == nil || c.DegreeOfParallelism == 0 {
+		return 4
+	}
+	return c.DegreeOfParallelism
+}
+
+func (c *Argon2Config) EncodedMemory() uint8 {
+	if c == nil || c.Memory == 0 {
+		return 16 // 64 MiB of RAM
+	}
+
+	memory := c.Memory
+	lowerBound := uint32(c.Parallelism())*8
+	upperBound := uint32(2147483648)
+
+	switch {
+	case memory < lowerBound:
+		memory = lowerBound
+	case memory > upperBound:
+		memory = upperBound
+	}
+
+	return encodeMemory(memory, c.Parallelism())
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/write.go

@@ -13,8 +13,8 @@ import (
 
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
 	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
-	"github.com/ProtonMail/go-crypto/openpgp/s2k"
 )
 
 // DetachSign signs message with the private key from signer (which must
@@ -70,15 +70,11 @@ func detachSign(w io.Writer, signer *Entity, message io.Reader, sigType packet.S
 	if signingKey.PrivateKey.Encrypted {
 		return errors.InvalidArgumentError("signing key is encrypted")
 	}
+	if _, ok := algorithm.HashToHashId(config.Hash()); !ok {
+		return errors.InvalidArgumentError("invalid hash function")
+	}
 
-	sig := new(packet.Signature)
-	sig.SigType = sigType
-	sig.PubKeyAlgo = signingKey.PrivateKey.PubKeyAlgo
-	sig.Hash = config.Hash()
-	sig.CreationTime = config.Now()
-	sigLifetimeSecs := config.SigLifetime()
-	sig.SigLifetimeSecs = &sigLifetimeSecs
-	sig.IssuerKeyId = &signingKey.PrivateKey.KeyId
+	sig := createSignaturePacket(signingKey.PublicKey, sigType, config)
 
 	h, wrappedHash, err := hashForSignature(sig.Hash, sig.SigType)
 	if err != nil {
@@ -125,16 +121,13 @@ func SymmetricallyEncrypt(ciphertext io.Writer, passphrase []byte, hints *FileHi
 	}
 
 	var w io.WriteCloser
-	if config.AEAD() != nil {
-		w, err = packet.SerializeAEADEncrypted(ciphertext, key, config.Cipher(), config.AEAD().Mode(), config)
-		if err != nil {
-			return
-		}
-	} else {
-		w, err = packet.SerializeSymmetricallyEncrypted(ciphertext, config.Cipher(), key, config)
-		if err != nil {
-			return
-		}
+	cipherSuite := packet.CipherSuite{
+		Cipher: config.Cipher(),
+		Mode:   config.AEAD().Mode(),
+	}
+	w, err = packet.SerializeSymmetricallyEncrypted(ciphertext, config.Cipher(), config.AEAD() != nil, cipherSuite, key, config)
+	if err != nil {
+		return
 	}
 
 	literalData := w
@@ -173,8 +166,25 @@ func intersectPreferences(a []uint8, b []uint8) (intersection []uint8) {
 	return a[:j]
 }
 
+// intersectPreferences mutates and returns a prefix of a that contains only
+// the values in the intersection of a and b. The order of a is preserved.
+func intersectCipherSuites(a [][2]uint8, b [][2]uint8) (intersection [][2]uint8) {
+	var j int
+	for _, v := range a {
+		for _, v2 := range b {
+			if v[0] == v2[0] && v[1] == v2[1] {
+				a[j] = v
+				j++
+				break
+			}
+		}
+	}
+
+	return a[:j]
+}
+
 func hashToHashId(h crypto.Hash) uint8 {
-	v, ok := s2k.HashToHashId(h)
+	v, ok := algorithm.HashToHashId(h)
 	if !ok {
 		panic("tried to convert unknown hash")
 	}
@@ -240,7 +250,7 @@ func writeAndSign(payload io.WriteCloser, candidateHashes []uint8, signed *Entit
 
 	var hash crypto.Hash
 	for _, hashId := range candidateHashes {
-		if h, ok := s2k.HashIdToHash(hashId); ok && h.Available() {
+		if h, ok := algorithm.HashIdToHash(hashId); ok && h.Available() {
 			hash = h
 			break
 		}
@@ -249,7 +259,7 @@ func writeAndSign(payload io.WriteCloser, candidateHashes []uint8, signed *Entit
 	// If the hash specified by config is a candidate, we'll use that.
 	if configuredHash := config.Hash(); configuredHash.Available() {
 		for _, hashId := range candidateHashes {
-			if h, ok := s2k.HashIdToHash(hashId); ok && h == configuredHash {
+			if h, ok := algorithm.HashIdToHash(hashId); ok && h == configuredHash {
 				hash = h
 				break
 			}
@@ -258,7 +268,7 @@ func writeAndSign(payload io.WriteCloser, candidateHashes []uint8, signed *Entit
 
 	if hash == 0 {
 		hashId := candidateHashes[0]
-		name, ok := s2k.HashIdToString(hashId)
+		name, ok := algorithm.HashIdToString(hashId)
 		if !ok {
 			name = "#" + strconv.Itoa(int(hashId))
 		}
@@ -329,39 +339,39 @@ func encrypt(keyWriter io.Writer, dataWriter io.Writer, to []*Entity, signed *En
 
 	// These are the possible ciphers that we'll use for the message.
 	candidateCiphers := []uint8{
-		uint8(packet.CipherAES128),
 		uint8(packet.CipherAES256),
-		uint8(packet.CipherCAST5),
+		uint8(packet.CipherAES128),
 	}
+
 	// These are the possible hash functions that we'll use for the signature.
 	candidateHashes := []uint8{
 		hashToHashId(crypto.SHA256),
 		hashToHashId(crypto.SHA384),
 		hashToHashId(crypto.SHA512),
-		hashToHashId(crypto.SHA1),
-		hashToHashId(crypto.RIPEMD160),
+		hashToHashId(crypto.SHA3_256),
+		hashToHashId(crypto.SHA3_512),
 	}
-	candidateAeadModes := []uint8{
-		uint8(packet.AEADModeEAX),
-		uint8(packet.AEADModeOCB),
-		uint8(packet.AEADModeExperimentalGCM),
+
+	// Prefer GCM if everyone supports it
+	candidateCipherSuites := [][2]uint8{
+		{uint8(packet.CipherAES256), uint8(packet.AEADModeGCM)},
+		{uint8(packet.CipherAES256), uint8(packet.AEADModeEAX)},
+		{uint8(packet.CipherAES256), uint8(packet.AEADModeOCB)},
+		{uint8(packet.CipherAES128), uint8(packet.AEADModeGCM)},
+		{uint8(packet.CipherAES128), uint8(packet.AEADModeEAX)},
+		{uint8(packet.CipherAES128), uint8(packet.AEADModeOCB)},
 	}
+
 	candidateCompression := []uint8{
 		uint8(packet.CompressionNone),
 		uint8(packet.CompressionZIP),
 		uint8(packet.CompressionZLIB),
 	}
-	// In the event that a recipient doesn't specify any supported ciphers
-	// or hash functions, these are the ones that we assume that every
-	// implementation supports.
-	defaultCiphers := candidateCiphers[0:1]
-	defaultHashes := candidateHashes[0:1]
-	defaultAeadModes := candidateAeadModes[0:1]
-	defaultCompression := candidateCompression[0:1]
 
 	encryptKeys := make([]Key, len(to))
-	// AEAD is used only if every key supports it.
-	aeadSupported := true
+
+	// AEAD is used only if config enables it and every key supports it
+	aeadSupported := config.AEAD() != nil
 
 	for i := range to {
 		var ok bool
@@ -371,38 +381,37 @@ func encrypt(keyWriter io.Writer, dataWriter io.Writer, to []*Entity, signed *En
 		}
 
 		sig := to[i].PrimaryIdentity().SelfSignature
-		if sig.AEAD == false {
+		if !sig.SEIPDv2 {
 			aeadSupported = false
 		}
 
-		preferredSymmetric := sig.PreferredSymmetric
-		if len(preferredSymmetric) == 0 {
-			preferredSymmetric = defaultCiphers
-		}
-		preferredHashes := sig.PreferredHash
-		if len(preferredHashes) == 0 {
-			preferredHashes = defaultHashes
-		}
-		preferredAeadModes := sig.PreferredAEAD
-		if len(preferredAeadModes) == 0 {
-			preferredAeadModes = defaultAeadModes
-		}
-		preferredCompression := sig.PreferredCompression
-		if len(preferredCompression) == 0 {
-			preferredCompression = defaultCompression
-		}
-		candidateCiphers = intersectPreferences(candidateCiphers, preferredSymmetric)
-		candidateHashes = intersectPreferences(candidateHashes, preferredHashes)
-		candidateAeadModes = intersectPreferences(candidateAeadModes, preferredAeadModes)
-		candidateCompression = intersectPreferences(candidateCompression, preferredCompression)
+		candidateCiphers = intersectPreferences(candidateCiphers, sig.PreferredSymmetric)
+		candidateHashes = intersectPreferences(candidateHashes, sig.PreferredHash)
+		candidateCipherSuites = intersectCipherSuites(candidateCipherSuites, sig.PreferredCipherSuites)
+		candidateCompression = intersectPreferences(candidateCompression, sig.PreferredCompression)
 	}
 
-	if len(candidateCiphers) == 0 || len(candidateHashes) == 0 || len(candidateAeadModes) == 0 {
-		return nil, errors.InvalidArgumentError("cannot encrypt because recipient set shares no common algorithms")
+	// In the event that the intersection of supported algorithms is empty we use the ones
+	// labelled as MUST that every implementation supports.
+	if len(candidateCiphers) == 0 {
+		// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-9.3
+		candidateCiphers = []uint8{uint8(packet.CipherAES128)}
+	}
+	if len(candidateHashes) == 0 {
+		// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#hash-algos
+		candidateHashes = []uint8{hashToHashId(crypto.SHA256)}
+	}
+	if len(candidateCipherSuites) == 0 {
+		// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-9.6
+		candidateCipherSuites = [][2]uint8{{uint8(packet.CipherAES128), uint8(packet.AEADModeOCB)}}
 	}
 
 	cipher := packet.CipherFunction(candidateCiphers[0])
-	mode := packet.AEADMode(candidateAeadModes[0])
+	aeadCipherSuite := packet.CipherSuite{
+		Cipher: packet.CipherFunction(candidateCipherSuites[0][0]),
+		Mode:   packet.AEADMode(candidateCipherSuites[0][1]),
+	}
+
 	// If the cipher specified by config is a candidate, we'll use that.
 	configuredCipher := config.Cipher()
 	for _, c := range candidateCiphers {
@@ -425,17 +434,11 @@ func encrypt(keyWriter io.Writer, dataWriter io.Writer, to []*Entity, signed *En
 	}
 
 	var payload io.WriteCloser
-	if config.AEAD() != nil && aeadSupported {
-		payload, err = packet.SerializeAEADEncrypted(dataWriter, symKey, cipher, mode, config)
-		if err != nil {
-			return
-		}
-	} else {
-		payload, err = packet.SerializeSymmetricallyEncrypted(dataWriter, cipher, symKey, config)
-		if err != nil {
-			return
-		}
+	payload, err = packet.SerializeSymmetricallyEncrypted(dataWriter, cipher, aeadSupported, aeadCipherSuite, symKey, config)
+	if err != nil {
+		return
 	}
+
 	payload, err = handleCompression(payload, candidateCompression, config)
 	if err != nil {
 		return nil, err
@@ -458,8 +461,8 @@ func Sign(output io.Writer, signed *Entity, hints *FileHints, config *packet.Con
 		hashToHashId(crypto.SHA256),
 		hashToHashId(crypto.SHA384),
 		hashToHashId(crypto.SHA512),
-		hashToHashId(crypto.SHA1),
-		hashToHashId(crypto.RIPEMD160),
+		hashToHashId(crypto.SHA3_256),
+		hashToHashId(crypto.SHA3_512),
 	}
 	defaultHashes := candidateHashes[0:1]
 	preferredHashes := signed.PrimaryIdentity().SelfSignature.PreferredHash
@@ -502,15 +505,9 @@ func (s signatureWriter) Write(data []byte) (int, error) {
 }
 
 func (s signatureWriter) Close() error {
-	sig := &packet.Signature{
-		Version:      s.signer.Version,
-		SigType:      s.sigType,
-		PubKeyAlgo:   s.signer.PubKeyAlgo,
-		Hash:         s.hashType,
-		CreationTime: s.config.Now(),
-		IssuerKeyId:  &s.signer.KeyId,
-		Metadata:     s.metadata,
-	}
+	sig := createSignaturePacket(&s.signer.PublicKey, s.sigType, s.config)
+	sig.Hash = s.hashType
+	sig.Metadata = s.metadata
 
 	if err := sig.Sign(s.h, s.signer, s.config); err != nil {
 		return err
@@ -524,6 +521,21 @@ func (s signatureWriter) Close() error {
 	return s.encryptedData.Close()
 }
 
+func createSignaturePacket(signer *packet.PublicKey, sigType packet.SignatureType, config *packet.Config) *packet.Signature {
+	sigLifetimeSecs := config.SigLifetime()
+	return &packet.Signature{
+		Version:           signer.Version,
+		SigType:           sigType,
+		PubKeyAlgo:        signer.PubKeyAlgo,
+		Hash:              config.Hash(),
+		CreationTime:      config.Now(),
+		IssuerKeyId:       &signer.KeyId,
+		IssuerFingerprint: signer.Fingerprint,
+		Notations:         config.Notations(),
+		SigLifetimeSecs:   &sigLifetimeSecs,
+	}
+}
+
 // noOpCloser is like an ioutil.NopCloser, but for an io.Writer.
 // TODO: we have two of these in OpenPGP packages alone. This probably needs
 // to be promoted somewhere more common.
@@ -545,6 +557,9 @@ func handleCompression(compressed io.WriteCloser, candidateCompression []uint8,
 	if confAlgo == packet.CompressionNone {
 		return
 	}
+
+	// Set algorithm labelled as MUST as fallback
+	// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-9.4
 	finalAlgo := packet.CompressionNone
 	// if compression specified by config available we will use it
 	for _, c := range candidateCompression {