openwall / openwall/john

Extended support for gpg keys

Open
#5,254 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
C
Stars
13.6k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

In Debian 10, by default in GnuPG, the CLI utility: gpg generates a key pair (RSA/DSA) and nothing more.
gpg_debian10

I checked the
$ john/run/gpg2john gpg_key.asc #The hash is retrieved correctly and is subject to password recovery.

But updated versions of GnuPG now generate a key pair (ECC:Curve25519) by default.

spoiler: gpg_cli v2.3.6

gpg_cli

And the routine for extracting the hash is not able to extract the hash of this encryption (maybe john himself does not support this encryption format). The user will always get an error:
$ john/run/gpg2john gpg_ecc_john.asc

File gpg_ecc_john.asc
Unknown public key(pub 19)
Bad parameter: encrypted_Secret_Key(len=-1, sha1=0), len can not be negative.

Although I have Kleopatra/KDE gpg/pgp key management software installed on my Debian 10, when generating keys, it has long been possible to choose a cryptographic algorithm (not RSA/DSA), but cv25519:

spoiler: kleopatra-cv25519/

kleopatra_kde

I generated such key in gpg CLI on Termux under name "gpg_ecc_john.asc" password "johnjohn666" And tested it on Debian 10 it imported successfully and encrypts data.
You can practice on it (note — I’m not sure that in the Russian Federation it’s so easy for citizens to engage in cryptography and removed the link to the key.):

spoiler: kleopatra import gpg_ecc_john.asc/

gpg_ecc

JtR does not fully work with GPG keys, it might be worth considering a request to support this encryption algorithm (in the future / already it will become preferable, judging by its purpose when generating keys by default).

This is a continuation from here:
https://github.com/openwall/john/issues/5252#issuecomment-1467751212

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the gpg2john entry point in john/run and reproduce the reported failure using gpg_ecc_john.asc or an equivalent Curve25519-generated key. Trace how the existing RSA/DSA key format is parsed and determine the required support for public key type 19. Done means the utility extracts a usable hash from the ECC key without the reported errors and covers the behavior with a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
cryptography
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.