Use public key fingerprint as S/MIME Certificate id #3570

extension/chrome/dev/ci_unit_test.ts

@@ -15,6 +15,7 @@ import { Ui } from '../../js/common/browser/ui.js';
 import { ContactStore } from '../../js/common/platform/store/contact-store.js';
 import { Debug } from '../../js/common/platform/debug.js';
 import { Catch } from '../../js/common/platform/catch.js';
+import * as forge from 'node-forge';
 
 /**
  * importing all libs that are tested in ci tests
@@ -40,3 +41,4 @@ const libs: any[] = [
 for (const lib of libs) {
  (window as any)[(lib as any).name] = lib;
 }
+(window as any).forge = forge;

extension/js/background_page/background_page.ts

@@ -9,7 +9,7 @@ import { Catch } from '../common/platform/catch.js';
 import { GoogleAuth } from '../common/api/email-provider/gmail/google-auth.js';
 import { VERSION } from '../common/core/const.js';
 import { injectFcIntoWebmail } from './inject.js';
-import { migrateGlobal, moveContactsToEmailsAndPubkeys } from './migrations.js';
+import { migrateGlobal, moveContactsToEmailsAndPubkeys, updateX509FingerprintsAndLongids } from './migrations.js';
 import { opgp } from '../common/core/crypto/pgp/openpgpjs-custom.js';
 import { GlobalStoreDict, GlobalStore } from '../common/platform/store/global-store.js';
 import { ContactStore } from '../common/platform/store/contact-store.js';
@@ -41,6 +41,7 @@ opgp.initWorker({ path: '/lib/openpgp.worker.js' });
 
  try {
  db = await ContactStore.dbOpen(); // takes 4-10 ms first time
+ await updateX509FingerprintsAndLongids(db);
  await moveContactsToEmailsAndPubkeys(db);
  } catch (e) {
  await BgUtils.handleStoreErr(e);

extension/js/background_page/migrations.ts

@@ -3,7 +3,8 @@
 'use strict';
 
 import { Key, KeyInfo, KeyUtil } from '../common/core/crypto/key.js';
-import { ContactStore, ContactUpdate } from '../common/platform/store/contact-store.js';
+import { SmimeKey } from '../common/core/crypto/smime/smime-key.js';
+import { ContactStore, ContactUpdate, Email, Pubkey } from '../common/platform/store/contact-store.js';
 import { GlobalStore } from '../common/platform/store/global-store.js';
 import { KeyStore } from '../common/platform/store/key-store.js';
 
@@ -19,6 +20,12 @@ type ContactV3 = {
  expiresOn: number | null;
 };
 
+type PubkeyMigrationData = {
+ emailsToUpdate: { [email: string]: Email };
+ pubkeysToDelete: string[];
+ pubkeysToSave: Pubkey[];
+};
+
 const addKeyInfoFingerprints = async () => {
  for (const acctEmail of await GlobalStore.acctEmailsGet()) {
  const originalKis = await KeyStore.get(acctEmail);
@@ -40,6 +47,69 @@ export const migrateGlobal = async () => {
  }
 };
 
+const processSmimeKey = (pubkey: Pubkey, tx: IDBTransaction, data: PubkeyMigrationData, next: () => void) => {
+ if (KeyUtil.getKeyType(pubkey.armoredKey) !== 'x509') {
+ next();
+ return;
+ }
+ const key = SmimeKey.parse(pubkey.armoredKey);
+ const newPubkeyEntity = ContactStore.pubkeyObj(key, pubkey.lastCheck);
+ data.pubkeysToDelete.push(pubkey.fingerprint);
+ const req = tx.objectStore('emails').index('index_fingerprints').getAll(pubkey.fingerprint!);
+ ContactStore.setReqPipe(req,
+ (emailEntities: Email[]) => {
+ if (emailEntities.length) {
+ data.pubkeysToSave.push(newPubkeyEntity);
+ }
+ for (const emailEntity of emailEntities) {
+ const cachedEmail = data.emailsToUpdate[emailEntity.email];
+ if (!cachedEmail) {
+ data.emailsToUpdate[emailEntity.email] = emailEntity;
+ }
+ const entityToUpdate = cachedEmail ?? emailEntity;
+ entityToUpdate.fingerprints = entityToUpdate.fingerprints.filter(fp => fp !== pubkey.fingerprint && fp !== newPubkeyEntity.fingerprint);
+ entityToUpdate.fingerprints.push(newPubkeyEntity.fingerprint);
+ }
+ next();
+ });
+};
+
+export const updateX509FingerprintsAndLongids = async (db: IDBDatabase): Promise<void> => {
+ const globalStore = await GlobalStore.get(['contact_store_x509_fingerprints_and_longids_updated']);
+ if (globalStore.contact_store_x509_fingerprints_and_longids_updated) {
+ return;
+ }
+ console.info('updating ContactStorage to correct longids and fingerprints of X.509 certificates...');
+ const tx = db.transaction(['emails', 'pubkeys'], 'readwrite');
+ await new Promise((resolve, reject) => {
+ ContactStore.setTxHandlers(tx, resolve, reject);
+ const data: PubkeyMigrationData = { emailsToUpdate: {}, pubkeysToDelete: [], pubkeysToSave: [] };
+ const search = tx.objectStore('pubkeys').openCursor();
+ ContactStore.setReqPipe(search,
+ (cursor: IDBCursorWithValue) => {
+ if (!cursor) {
+ // do updates
+ for (const fp of data.pubkeysToDelete.filter(fp => !data.pubkeysToSave.some(x => x.fingerprint === fp))) {
+ // console.log(`Deleting pubkey ${fp}`);
+ tx.objectStore('pubkeys').delete(fp);
+ }
+ for (const pubkey of data.pubkeysToSave) {
+ // console.log(`Updating pubkey ${pubkey.fingerprint}`);
+ tx.objectStore('pubkeys').put(pubkey);
+ }
+ for (const email of Object.values(data.emailsToUpdate)) {
+ // console.log(`Updating email ${email.email}`);
+ tx.objectStore('emails').put(email);
+ }
+ } else {
+ processSmimeKey(cursor.value as Pubkey, tx, data, () => cursor.continue());
+ }
+ });
+ });
+ await GlobalStore.set({ contact_store_x509_fingerprints_and_longids_updated: true });
+ console.info('done updating');
+};
+
 export const moveContactsToEmailsAndPubkeys = async (db: IDBDatabase): Promise<void> => {
  if (!db.objectStoreNames.contains('contacts')) {
  return;

extension/js/common/core/crypto/key.ts

@@ -20,8 +20,8 @@ import { MsgBlock } from '../msg-block.js';
  */
 export interface Key {
  type: 'openpgp' | 'x509';
- id: string; // This is a fingerprint for OpenPGP keys and Serial Number for X.509 keys.
- allIds: string[]; // a list of fingerprints for OpenPGP key or a Serial Number for X.509 keys.
+ id: string; // a fingerprint of the primary key in OpenPGP, and similarly a fingerprint of the actual cryptographic key (eg RSA fingerprint) in S/MIME
+ allIds: string[]; // a list of fingerprints, including those for subkeys
  created: number;
  lastModified: number | undefined; // date of last signature, or undefined if never had valid signature
  expiration: number | undefined; // number of millis of expiration or undefined if never expires
@@ -43,6 +43,7 @@ export interface Key {
  bits?: number,
  algorithmId: number
  };
+ issuerAndSerialNumber?: string | undefined; // DER-encoded IssuerAndSerialNumber of X.509 Certificate as raw string
 }
 
 export type PubkeyResult = { pubkey: Key, email: string, isMine: boolean };
@@ -66,8 +67,9 @@ export interface KeyInfo {
  emails?: string[]; // todo - used to be missing - but migration was supposed to add it? setting back to optional for now
 }
 
-export interface KeyInfoWithOptionalPp extends KeyInfo {
+export interface ExtendedKeyInfo extends KeyInfo {
  passphrase?: string;
+ type: 'openpgp' | 'x509'
 }
 
 export type KeyAlgo = 'curve25519' | 'rsa2048' | 'rsa4096';
@@ -130,7 +132,7 @@ export class KeyUtil {
  return await OpenPGPKey.parseMany(text);
  } else if (keyType === 'x509') {
  // TODO: No support for parsing multiple S/MIME keys for now
- return [await SmimeKey.parse(text)];
+ return [SmimeKey.parse(text)];
  }
  throw new UnexpectedKeyTypeError(`Key type is ${keyType}, expecting OpenPGP or x509 S/MIME`);
  }
@@ -160,7 +162,7 @@ export class KeyUtil {
  }
  if (!allKeys.length) {
  try {
- allKeys.push(await SmimeKey.parseDecryptBinary(key, passPhrase ?? ''));
+ allKeys.push(SmimeKey.parseDecryptBinary(key, passPhrase ?? ''));
  return { keys: allKeys, err: [] };
  } catch (e) {
  allErr.push(e as Error);
@@ -339,13 +341,38 @@ export class KeyUtil {
  if (!prv.isPrivate) {
  throw new Error('Key passed into KeyUtil.keyInfoObj must be a Private Key');
  }
+ const pubkey = await KeyUtil.asPublicKey(prv);
  return {
  private: KeyUtil.armor(prv),
- public: KeyUtil.armor(await KeyUtil.asPublicKey(prv)),
- longid: OpenPGPKey.fingerprintToLongid(prv.id),
+ public: KeyUtil.armor(pubkey),
+ longid: KeyUtil.getPrimaryLongid(pubkey),
  emails: prv.emails,
  fingerprints: prv.allIds,
  };
  }
 
+ public static getPubkeyLongids = (pubkey: Key): string[] => {
+ if (pubkey.type !== 'x509') {
+ return pubkey.allIds.map(id => OpenPGPKey.fingerprintToLongid(id));
+ }
+ return [KeyUtil.getPrimaryLongid(pubkey)];
+ }
+
+ public static getPrimaryLongid = (pubkey: Key): string => {
+ if (pubkey.type !== 'x509') {
+ return OpenPGPKey.fingerprintToLongid(pubkey.id);
+ }
+ const encodedIssuerAndSerialNumber = 'X509-' + Buf.fromRawBytesStr(pubkey.issuerAndSerialNumber!).toBase64Str();
+ if (!encodedIssuerAndSerialNumber) {
+ throw new Error(`Cannot extract IssuerAndSerialNumber from the certificate for: ${pubkey.id}`);
+ }
+ return encodedIssuerAndSerialNumber;
+ }
+
+ public static getKeyInfoLongids = (ki: ExtendedKeyInfo): string[] => {
+ if (ki.type !== 'x509') {
+ return ki.fingerprints.map(fp => OpenPGPKey.fingerprintToLongid(fp));
+ }
+ return [ki.longid];
+ }
 }

extension/js/common/core/crypto/pgp/msg-util.ts

@@ -1,7 +1,7 @@
 /* ©️ 2016 - present FlowCrypt a.s. Limitations apply. Contact human@flowcrypt.com */
 
 'use strict';
-import { Contact, Key, KeyInfo, KeyInfoWithOptionalPp, KeyUtil } from '../key.js';
+import { Contact, Key, KeyInfo, ExtendedKeyInfo, KeyUtil } from '../key.js';
 import { MsgBlockType, ReplaceableMsgBlockType } from '../../msg-block.js';
 import { Value } from '../../common.js';
 import { Buf } from '../../buf.js';
@@ -26,7 +26,7 @@ export namespace PgpMsgMethod {
  export namespace Arg {
  export type Encrypt = { pubkeys: Key[], signingPrv?: Key, pwd?: string, data: Uint8Array, filename?: string, armor: boolean, date?: Date };
  export type Type = { data: Uint8Array | string };
- export type Decrypt = { kisWithPp: KeyInfoWithOptionalPp[], encryptedData: Uint8Array, msgPwd?: string };
+ export type Decrypt = { kisWithPp: ExtendedKeyInfo[], encryptedData: Uint8Array, msgPwd?: string };
  export type DiagnosePubkeys = { armoredPubs: string[], message: Uint8Array };
  export type VerifyDetached = { plaintext: Uint8Array, sigText: Uint8Array };
  }
@@ -53,9 +53,9 @@ type SortedKeysForDecrypt = {
  forVerification: OpenPGP.key.Key[];
  encryptedFor: string[];
  signedBy: string[];
- prvMatching: KeyInfoWithOptionalPp[];
- prvForDecrypt: KeyInfoWithOptionalPp[];
- prvForDecryptDecrypted: { ki: KeyInfoWithOptionalPp, decrypted: Key }[];
+ prvMatching: ExtendedKeyInfo[];
+ prvForDecrypt: ExtendedKeyInfo[];
+ prvForDecryptDecrypted: { ki: ExtendedKeyInfo, decrypted: Key }[];
  prvForDecryptWithoutPassphrases: KeyInfo[];
 };
 
@@ -269,7 +269,7 @@ export class MsgUtil {
  const msgKeyIds = m.getEncryptionKeyIds ? m.getEncryptionKeyIds() : [];
  const localKeyIds: string[] = [];
  for (const k of await Promise.all(armoredPubs.map(pub => KeyUtil.parse(pub)))) {
- localKeyIds.push(...k.allIds.map(id => OpenPGPKey.fingerprintToLongid(id)));
+ localKeyIds.push(...KeyUtil.getPubkeyLongids(k));
  }
  const diagnosis = { found_match: false, receivers: msgKeyIds.length };
  for (const msgKeyId of msgKeyIds) {
@@ -296,7 +296,7 @@ export class MsgUtil {
  }
  }
 
- private static getSortedKeys = async (kiWithPp: KeyInfoWithOptionalPp[], msg: OpenpgpMsgOrCleartext): Promise<SortedKeysForDecrypt> => {
+ private static getSortedKeys = async (kiWithPp: ExtendedKeyInfo[], msg: OpenpgpMsgOrCleartext): Promise<SortedKeysForDecrypt> => {
  const keys: SortedKeysForDecrypt = {
  verificationContacts: [],
  forVerification: [],
@@ -311,14 +311,14 @@ export class MsgUtil {
  keys.encryptedFor = encryptionKeyids.map(kid => OpenPGPKey.bytesToLongid(kid.bytes));
  await MsgUtil.cryptoMsgGetSignedBy(msg, keys);
  if (keys.encryptedFor.length) {
- keys.prvMatching = kiWithPp.filter(ki => ki.fingerprints.some(
-fp => keys.encryptedFor.includes(OpenPGPKey.fingerprintToLongid(fp))));
+ keys.prvMatching = kiWithPp.filter(ki => KeyUtil.getKeyInfoLongids(ki).some(
+longid => keys.encryptedFor.includes(longid)));
  keys.prvForDecrypt = keys.prvMatching.length ? keys.prvMatching : kiWithPp;
  } else { // prvs not needed for signed msgs
  keys.prvForDecrypt = [];
  }
  for (const ki of keys.prvForDecrypt) {
- const matchingKeyids = MsgUtil.matchingKeyids(ki.fingerprints, encryptionKeyids);
+ const matchingKeyids = MsgUtil.matchingKeyids(KeyUtil.getKeyInfoLongids(ki), encryptionKeyids);
  const cachedKey = KeyCache.getDecrypted(ki.longid);
  if (cachedKey && MsgUtil.isKeyDecryptedFor(cachedKey, matchingKeyids)) {
  keys.prvForDecryptDecrypted.push({ ki, decrypted: cachedKey });
@@ -338,9 +338,8 @@ export class MsgUtil {
  return keys;
  }
 
- private static matchingKeyids = (fingerprints: string[], encryptedForKeyids: OpenPGP.Keyid[]): OpenPGP.Keyid[] => {
- const allKeyLongids = fingerprints.map(fp => OpenPGPKey.fingerprintToLongid(fp));
- return encryptedForKeyids.filter(kid => allKeyLongids.includes(OpenPGPKey.bytesToLongid(kid.bytes)));
+ private static matchingKeyids = (longids: string[], encryptedForKeyids: OpenPGP.Keyid[]): OpenPGP.Keyid[] => {
+ return encryptedForKeyids.filter(kid => longids.includes(OpenPGPKey.bytesToLongid(kid.bytes)));
  }
 
  private static decryptKeyFor = async (prv: Key, passphrase: string, matchingKeyIds: OpenPGP.Keyid[]): Promise<boolean> => {

extension/js/common/core/crypto/pgp/openpgp-key.ts

@@ -391,9 +391,6 @@ export class OpenPGPKey {
  }
 
  public static fingerprintToLongid = (fingerprint: string) => {
- if (fingerprint.length === 32) { // s/mime keys
- return fingerprint; // leave as is - s/mime has no concept of longids
- }
  if (fingerprint.length === 40) { // pgp keys
  return fingerprint.substr(-16).toUpperCase();
  }

extension/js/common/core/crypto/smime/smime-key.ts

@@ -8,19 +8,19 @@ import { Buf } from '../../buf.js';
 
 export class SmimeKey {
 
- public static parse = async (text: string): Promise<Key> => {
+ public static parse = (text: string): Key => {
  if (text.includes(PgpArmor.headers('certificate').begin)) {
  return SmimeKey.parsePemCertificate(text);
  } else if (text.includes(PgpArmor.headers('pkcs12').begin)) {
  const armoredBytes = text.replace(PgpArmor.headers('pkcs12').begin, '').replace(PgpArmor.headers('pkcs12').end, '').trim();
  const emptyPassPhrase = '';
- return await SmimeKey.parseDecryptBinary(Buf.fromBase64Str(armoredBytes), emptyPassPhrase);
+ return SmimeKey.parseDecryptBinary(Buf.fromBase64Str(armoredBytes), emptyPassPhrase);
  } else {
  throw new Error('Could not parse S/MIME key without known headers');
  }
  }
 
- public static parseDecryptBinary = async (buffer: Uint8Array, password: string): Promise<Key> => {
+ public static parseDecryptBinary = (buffer: Uint8Array, password: string): Key => {
  const bytes = String.fromCharCode.apply(undefined, new Uint8Array(buffer) as unknown as number[]) as string;
  const asn1 = forge.asn1.fromDer(bytes);
  let certificate: forge.pki.Certificate | undefined;
@@ -46,29 +46,8 @@ export class SmimeKey {
  if (!certificate) {
  throw new Error('No user certificate found.');
  }
- SmimeKey.removeWeakKeys(certificate);
- const emails = SmimeKey.getNormalizedEmailsFromCertificate(certificate);
- const key = {
- type: 'x509',
- id: certificate.serialNumber.toUpperCase(),
- allIds: [certificate.serialNumber.toUpperCase()],
- usableForEncryption: SmimeKey.isEmailCertificate(certificate),
- usableForSigning: SmimeKey.isEmailCertificate(certificate),
- usableForEncryptionButExpired: false,
- usableForSigningButExpired: false,
- emails,
- identities: emails,
- created: SmimeKey.dateToNumber(certificate.validity.notBefore),
- lastModified: SmimeKey.dateToNumber(certificate.validity.notBefore),
- expiration: SmimeKey.dateToNumber(certificate.validity.notAfter),
- fullyDecrypted: true,
- fullyEncrypted: false,
- isPublic: certificate.publicKey && !certificate.privateKey,
- isPrivate: !!certificate.privateKey,
- } as Key;
  const headers = PgpArmor.headers('pkcs12');
- (key as unknown as { raw: string }).raw = `${headers.begin}\n${forge.util.encode64(bytes)}\n${headers.end}`;
- return key;
+ return SmimeKey.getKeyFromCertificate(certificate, `${headers.begin}\n${forge.util.encode64(bytes)}\n${headers.end}`);
  }
 
  /**
@@ -109,25 +88,38 @@ export class SmimeKey {
  }
 
  private static getKeyFromCertificate = (certificate: forge.pki.Certificate, pem: string): Key => {
+ if (!certificate.publicKey) {
+ throw new UnreportableError(`This S/MIME x.509 certificate doesn't have a public key`);
+ }
+ const fingerprint = forge.pki.getPublicKeyFingerprint(certificate.publicKey, { encoding: 'hex' }).toUpperCase();
  SmimeKey.removeWeakKeys(certificate);
  const emails = SmimeKey.getNormalizedEmailsFromCertificate(certificate);
+ const issuerAndSerialNumberAsn1 =
+ forge.asn1.create(forge.asn1.Class.UNIVERSAL, forge.asn1.Type.SEQUENCE, true, [
+ // Name
+ forge.pki.distinguishedNameToAsn1(certificate.issuer),
+ // Serial
+ forge.asn1.create(forge.asn1.Class.UNIVERSAL, forge.asn1.Type.INTEGER, false,
+ forge.util.hexToBytes(certificate.serialNumber))
+ ]);
  const key = {
  type: 'x509',
- id: certificate.serialNumber.toUpperCase(),
- allIds: [certificate.serialNumber.toUpperCase()],
- usableForEncryption: certificate.publicKey && SmimeKey.isEmailCertificate(certificate),
- usableForSigning: certificate.publicKey && SmimeKey.isEmailCertificate(certificate),
+ id: fingerprint,
+ allIds: [fingerprint],
+ usableForEncryption: SmimeKey.isEmailCertificate(certificate),
+ usableForSigning: SmimeKey.isEmailCertificate(certificate),
  usableForEncryptionButExpired: false,
  usableForSigningButExpired: false,
  emails,
  identities: emails,
  created: SmimeKey.dateToNumber(certificate.validity.notBefore),
  lastModified: SmimeKey.dateToNumber(certificate.validity.notBefore),
  expiration: SmimeKey.dateToNumber(certificate.validity.notAfter),
- fullyDecrypted: false,
+ fullyDecrypted: !!certificate.privateKey,
  fullyEncrypted: false,
- isPublic: certificate.publicKey && !certificate.privateKey,
+ isPublic: !certificate.privateKey,
  isPrivate: !!certificate.privateKey,
+ issuerAndSerialNumber: forge.asn1.toDer(issuerAndSerialNumberAsn1).getBytes()
  } as Key;
  (key as unknown as { rawArmored: string }).rawArmored = pem;
  return key;