v6 inline-signed messages put a different salt into ops and signature packet, messes up v4 signature

[teythoon]

• OpenPGP.js version: OpenPGP.js 5.7.0+crypto-refresh

OpenPGP.js messes up the salt when inline-signing (OPS vs Signature salt mismatch), yet OpenPGP.js (and PGPy) can still verify the signature:

https://tests.sequoia-pgp.org/v6.html#Inline_Sign_with_minimal_key_from_RFC9760_and_key__Alice___verify_with_key_from_RFC9760

And OpenPGP.js messes up the v4 signature: https://tests.sequoia-pgp.org/v6.html#Inline_Sign_with_minimal_key_from_RFC9760_and_key__Alice___verify_with_key__Alice_

[teythoon]

As additional data point, here is what happens if you create two v6 signatures:

% echo huhu | sops/v6/sop-openpgpjs/sop-openpgp inline-sign data/v6/test-vectors/v6-minimal-secret.key data/v6/test-vectors/v6-minimal-secret.key  | sq-v6 packet dump
One-Pass Signature Packet, new CTB, 70 bytes
    Version: 6
    Type: Text
    Pk algo: Ed25519
    Hash algo: SHA512
    Issuer: CB186C4F0609A697E4D52DFA6C722B0C1F1E27C18A56708F6525EC27BAD9ACC9
    Salt: 5E62C418CA43C5EDB8B64A8A6955598125AD61782CAB7553046798461EA5F394
    Last: false
  
One-Pass Signature Packet, new CTB, 70 bytes
    Version: 6
    Type: Text
    Pk algo: Ed25519
    Hash algo: SHA512
    Issuer: CB186C4F0609A697E4D52DFA6C722B0C1F1E27C18A56708F6525EC27BAD9ACC9
    Salt: 517CA5EF5A61720769DCBB3EA61D5A4EA1DB1C6BA5FCC40EE478BDD780F0416A
    Last: true
  
Literal Data Packet, new CTB, 12 bytes
    Format: Text data (UTF-8)
    Timestamp: 2023-08-23 05:58:34 UTC
    Content: "huhu\r\n"
  
Signature Packet, new CTB, 152 bytes
    Version: 6
    Type: Text
    Pk algo: Ed25519
    Hash algo: SHA512
    Hashed area:
      Signature creation time: 2023-08-23 05:58:34 UTC (critical)
      Issuer Fingerprint: CB186C4F0609A697E4D52DFA6C722B0C1F1E27C18A56708F6525EC27BAD9ACC9 (critical)
    Digest prefix: 7A96
    Salt: 5E62C418CA43C5EDB8B64A8A6955598125AD61782CAB7553046798461EA5F394
    Level: 0 (signature over data)
  
Signature Packet, new CTB, 152 bytes
    Version: 6
    Type: Text
    Pk algo: Ed25519
    Hash algo: SHA512
    Hashed area:
      Signature creation time: 2023-08-23 05:58:34 UTC (critical)
      Issuer Fingerprint: CB186C4F0609A697E4D52DFA6C722B0C1F1E27C18A56708F6525EC27BAD9ACC9 (critical)
    Digest prefix: 637A
    Salt: 517CA5EF5A61720769DCBB3EA61D5A4EA1DB1C6BA5FCC40EE478BDD780F0416A
    Level: 0 (signature over data)

Note how the OPS + Sig pairs do not bracket the literal data packet: It is A B Literal A B instead of the correct A B Literal B A. See https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#section-5.4-5

[larabr]

Thanks for the report, I'll move this to a discussion since the crypto-refresh support is under development and unreleased.
I'll have a look, but I think the version of OpenPGP.js you are using for testing is a bit outdated, so hopefully this is fixed already 😁

[teythoon]

I'm using https://github.com/openpgpjs/sop-openpgpjs/tree/crypto-refresh-demo which hasn't been updated since June.

[larabr]

Fix included in #1630 and now published in the crypto-refresh branch too 👍