Possibility of ignoring time?

[danhab99]

So I tried deploying my project Cryptochan to Vercel at cryptochan.vercel.app and I've encountered a big fat problem with them. It turns out that the clocks on their cloud functions are running behind, in my experimentation it fluctuates between 100ms to 5000 ms but always behind. This is messing with OpenPGP's ability to validate signatures, it keeps thinking a signature was signed in the future and throwing this error:

2021-06-16T02:30:54.028Z 127.0.0.1 | POST /api/regkey: [RegKey] Busboy field signature -----BEGIN PGP SIGNATURE-----
wnUEARYKAAYFAmDJYpgAIQkQzcEftU7gV+4WIQQs0KRxj+DVD/Q1jMjNwR+1
TuBX7jYWAQCWojHBVMmmnjw2SYbNRZOECT7zgLEaB5jNZnTWUwcQHQEA6xAP
cs3ZmgXWX0aGwcPiwc5swvfP5SepMZroL3AK4QE=
=ngfQ
-----END PGP SIGNATURE-----
2021-06-16T02:30:54.041Z 127.0.0.1 | POST /api/regkey: [RegKey] Busboy field newkey -----BEGIN PGP PUBLIC KEY BLOCK-----
xjMEYMlimBYJKwYBBAHaRw8BAQdAUs5h1q4JDqKVKA4cVrad9ix3Ztnf1F+E
rH+OlMEzQpjNFHo1dGk4YiA8Zm05ZzRAYy5jY2M+wowEEBYKAB0FAmDJYpgE
CwkHCAMVCAoEFgACAQIZAQIbAwIeAQAhCRDtr0YXExE9vRYhBC5tJD5ARs3p
sgFbju2vRhcTET29Bu8A/jLzgkKUslSen6s/rJADBtS4Q2j7vuLPQPUuI4nf
KbZqAP904MhmfrHdoMpnxYLzpWf2mcQ5blVFnFTyyA32F1N0CM44BGDJYpgS
CisGAQQBl1UBBQEBB0DOaEJ3mNJ694437n6eq8q7zuXcJoiaUHTqqKkgBRr0
KAMBCAfCeAQYFggACQUCYMlimAIbDAAhCRDtr0YXExE9vRYhBC5tJD5ARs3p
sgFbju2vRhcTET29MO0BAMgDCg+onYjU7D+zcz+AFWHYM724NdSry4lXaWAh
pf+5AQCPLdsPn2TZ0DAphofozmyy317ZdNgYW19EMmuO3QboBQ==
=9jQ5
-----END PGP PUBLIC KEY BLOCK-----
2021-06-16T02:30:54.050Z 127.0.0.1 | POST /api/regkey: [RegKey] Busboy finished
START SYNC
SYNC ATTEMPT 1
2021-06-16T02:30:54.068Z 127.0.0.1 | POST /api/regkey: [RegKey] Signature included [ 'cdc11fb54ee057ee' ]
2021-06-16T02:30:54.113Z 127.0.0.1 | POST /api/regkey: [RegKey] Found public keys [ 'cdc11fb54ee057ee' ]
START SYNC
SYNC ATTEMPT 1
START SYNC
SYNC ATTEMPT 1
2021-06-16T02:30:54.214Z	85b3b31b-3947-4a6f-a8f0-f7cdea236e50	ERROR	Unhandled Promise Rejection 	{"errorType":"Runtime.UnhandledPromiseRejection","errorMessage":"Error: Signature creation time is in the future","reason":{"errorType":"Error","errorMessage":"Signature creation time is in the future","stack":["Error: Signature creation time is in the future","    at ro.verify (/var/task/node_modules/openpgp/dist/node/openpgp.min.js:2:273782)","    at processTicksAndRejections (internal/process/task_queues.js:95:5)","    at async /var/task/node_modules/openpgp/dist/node/openpgp.min.js:2:343466"]},"promise":{},"stack":["Runtime.UnhandledPromiseRejection: Error: Signature creation time is in the future","    at process.<anonymous> (/var/runtime/index.js:35:15)","    at process.emit (events.js:388:22)","    at processPromiseRejections (internal/process/promises.js:245:33)","    at processTicksAndRejections (internal/process/task_queues.js:96:32)"]}
Unknown application error occurred

I tried fixing this on the OpenPGP level by signing signatures 30s ago (by manually setting the date) but that doesn't help with validating public keys. I also tried writing code to automatically delay the next procedure in the event that error was thrown, but I couldn't catch it with a try catch or Promise.catch.

I've looked at this every way I can. I can't figure out what's going on. I already open a support case with Vercel, it's gonna take them forever to get back to me. I just wanted to try asking here if there's any way I can make OpenPGP ignore time?

And before anybody says this; yes I know I shouldn't be doing cryptography on a cloud function. It's a prototype, I'll get to it later.

[twiss]

Hey 👋 Yes, you can pass date: null to ignore expiry when validating keys and signatures. (Or you could pass a date slightly in the future, of course, to compensate for their clocks running late.)

[danhab99]

It worked!! Bruv this project has been an absolute trip up to now. I had an ordeal where my phones browser wasn't showing colors the same way as my desktop, then having this bug come up outta no where... I'm ded.

I solved my bug by adding a field to the global config object that disables that "Future" check in the #SignaturePacket.verify object. I thought about doing it awhile ago but I wasn't sure it was safe.

Thank you for confirming that it is. <3

[twiss]

Eh, I didn't say that it was safe 😅 Just that it's possible. Ignoring key and signature expiry obviously has security risks. Passing a date in the future is better, if possible.

[danhab99]

I wasn't sure it was safe

I wasn't sure if it would break the validating algorithm.

Any potential security flaw isn't really all that big of a deal for me RN.