寻找一个模型来解释 PGP 签名的内部结构加密文件
我正在尝试调试&使用 BouncyCastle 扩展现有的 Java 代码来解密和验证安全附件。
我已经查看了 BouncyCastle 示例，但更难从中提取受 PGP 保护的附件的模型。从代码和各种错误中我可以推断有一些由 PGPMarker 表示的东西，然后你可以找到一个 PGPCompressedData ，里面有一个 PGPOnePassSignatureList 等等。这并没有澄清诸如何时期望一个与另一个以及单独执行签名和加密时是否存在一次性签名等问题（这些是我遇到的示例，但不是问题的主题）。 BC 的 javadoc 没有解释太多（例如 PGPOnePassSignature 是“一次性签名对象”）。
通过反复试验对模型进行逆向工程非常耗时，而且由于我还没有成功地在谷歌上搜索到这方面的好资源，我希望也许其他人知道一个。
提前致谢。
I'm trying to debug & extend an existing piece of Java code using BouncyCastle to decrypt and verify secured attachments.
I've looked through the BouncyCastle samples but what it's harder to extract from there is a model of what a PGP-secured attachments looks like. From the code and various errors I can infer there is something represented by a PGPMarker, then you can find a PGPCompressedData which inside has a PGPOnePassSignatureList and so on. This doesn't clarify issues such as when to expect one versus another and whether a one-pass signature is present when signing and encryption were performed separately (these were examples I faced but are not the topic of the question). BC's javadoc doesn't explain much (eg. PGPOnePassSignature is "A one pass signature object").
It's time-consume to reverse engineer the model by trial and error and, as I haven't successfully googled a good resource on this, I hope perhaps someone else knows one.
Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我发现的最好的资源是 OpenPGP RFC。 我已经使用 BouncyCastle 进行 PGP 和S/MIME，我觉得 S/MIME 更直接，尽管这两个标准本质上做的是相同的事情。幸运的是，就我而言，我正在签名和加密，因此我的代码不必准备好处理某些 PGP 实现可能想象的任何疯狂结构。
The best resource I found was the OpenPGP RFC. I've used BouncyCastle for PGP and S/MIME, and I felt S/MIME was a lot more straight-forward, even though both standards are doing essentially the same thing. Luckily, in my case, I was signing and encrypting, so my code didn't have to be prepared to handle any crazy structure some PGP implementation could dream up.