diff --git a/pg/src/main/java/org/bouncycastle/openpgp/PGPEncryptedDataList.java b/pg/src/main/java/org/bouncycastle/openpgp/PGPEncryptedDataList.java index 7c2cf62c20..675f83af9b 100644 --- a/pg/src/main/java/org/bouncycastle/openpgp/PGPEncryptedDataList.java +++ b/pg/src/main/java/org/bouncycastle/openpgp/PGPEncryptedDataList.java @@ -202,4 +202,20 @@ public PGPSessionKeyEncryptedData extractSessionKeyEncryptedData() { return new PGPSessionKeyEncryptedData(data); } + + /** + * Create a decryption method using a {@link PGPSessionKey}. + * This method can be used to decrypt messages which do not contain a SKESK or PKESK packet using a session key. + * If
enableQuickCheck
is set to true, upon decryption, the 2-octet quick-check is performed + * to early reject wrong session-keys. + * NOTE: The quick check should only be enabled for symmetrically encrypted data, in order to prevent + * attacks via the Mister-Zuccherato oracle. + * + * @param enableQuickCheck whether to enable the 2-octet SEIPDv1 quick check. + * @return session key encrypted data + */ + public PGPSessionKeyEncryptedData extractSessionKeyEncryptedData(boolean enableQuickCheck) + { + return new PGPSessionKeyEncryptedData(data, enableQuickCheck); + } } diff --git a/pg/src/main/java/org/bouncycastle/openpgp/PGPSessionKeyEncryptedData.java b/pg/src/main/java/org/bouncycastle/openpgp/PGPSessionKeyEncryptedData.java index daefa6e01b..5371198056 100644 --- a/pg/src/main/java/org/bouncycastle/openpgp/PGPSessionKeyEncryptedData.java +++ b/pg/src/main/java/org/bouncycastle/openpgp/PGPSessionKeyEncryptedData.java @@ -13,9 +13,17 @@ public class PGPSessionKeyEncryptedData extends PGPSymmetricKeyEncryptedData { + private final boolean enableQuickCheck; + PGPSessionKeyEncryptedData(InputStreamPacket encData) + { + this(encData, false); + } + + PGPSessionKeyEncryptedData(InputStreamPacket encData, boolean enableQuickCheck) { super(encData); + this.enableQuickCheck = enableQuickCheck; } @Override @@ -69,6 +77,6 @@ public InputStream getDataStream( @Override protected boolean isPublicKeyEncrypted() { - return true; + return !enableQuickCheck; } }