gpg/pgp packet parsing from Joerg Jenderek

diff --git a/magic/Magdir/gnu b/magic/Magdir/gnu
index 0eccbe9a6f61c3056491982abc2c3165150f6682..f30f8d7d9b8f832e986dda1e68fcad5017268f83 100644 (file)
--- a/magic/Magdir/gnu
+++ b/magic/Magdir/gnu
@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: gnu,v 1.19 2018/01/04 01:21:32 christos Exp $
+# $File: gnu,v 1.20 2018/02/24 16:11:23 christos Exp $
 # gnu:  file(1) magic for various GNU tools
 #
 # GNU nlsutils message catalog file format
@@ -122,13 +122,15 @@
 0      beshort         0x8502                  GPG encrypted data
 !:mime text/PGP # encoding: data
 
+# Update: Joerg Jenderek
+# Note:        PGP and GPG use same data structure.
+#      So recognition is now done by ./pgp with start test for byte 0x99
 # This magic is not particularly good, as the keyrings don't have true
 # magic. Nevertheless, it covers many keyrings.
-0      ubeshort-0x9901 <2
->3     byte            4
->>4    bedate          x               GPG key public ring, created %s
-!:mime application/x-gnupg-keyring
-
+# 0    ubeshort-0x9901 <2
+# >3   byte            4
+# >>4  bedate          x               GPG key public ring, created %s
+# !:mime application/x-gnupg-keyring
 
 # Symmetric encryption
 0      leshort         0x0d8c

diff --git a/magic/Magdir/pgp b/magic/Magdir/pgp
index 585475dbb38c365e057631a7c35c2d2bee173e4a..ecdcf838cc65437ee8ef0f8c69ebdf509dab6883 100644 (file)
--- a/magic/Magdir/pgp
+++ b/magic/Magdir/pgp
@@ -1,11 +1,50 @@
 
 #------------------------------------------------------------------------------
-# $File: pgp,v 1.14 2017/03/17 21:35:28 christos Exp $
+# $File: pgp,v 1.15 2018/02/24 16:11:23 christos Exp $
 # pgp:  file(1) magic for Pretty Good Privacy
 # see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
 #
-0       beshort         0x9900                  PGP key public ring
-!:mime application/x-pgp-keyring
+# Update: Joerg Jenderek
+# Note: verified by `gpg -v --debug 0x02 --list-packets < PUBRING263_10.PGP`
+#0             byte    0x99            MAYBE PGP 0x99
+0              byte    0x99
+# 99h~10;0110;01~2=old packet type;tag 6=Public-Key Packet;1=two-octet length
+# A two-octet body header encodes packet lengths of 192~00C0h - 8383~20BFh
+#>1            ubeshort        x               \b, body length 0x%.4x
+# skip Basic.Image Beauty.320 Pic.Icons by looking for low version number
+#>3            ubyte           x               \b, V=%u
+#>3            ubyte           <5              VERSION OK
+>3             ubyte           <5
+# next packet type often b4h~(tag 13)~User ID Packet, b0h~(tag 12)~Trust packet
+#>>(1.S+3)     ubyte   x               \b, next packet type 0x%x
+# skip 9900-v4.bin 9902-v4.bin by looking for valid second packet type (bit 7=1)
+#>>(1.S+3)     ubyte   >0x7F           TYPE OK,
+>>(1.S+3)      ubyte   >0x7F
+# old versions 2,3 implies Pretty Good Privacy
+>>>3           ubyte           <4              PGP key public ring (v%u)
+!:mime         application/pgp-keys
+!:ext          pgp/ASD
+>>>>4          beldate         x               created %s
+# days that this key is valid. If this number is zero, then it does not expire
+>>>>8          ubeshort        >0              \b, %u days valid
+>>>>8          ubeshort        =0              \b, not expire
+# display key algorithm 1~RSA (Encrypt or Sign)
+>>>>10         use             key_algo
+# Multiprecision Integers (MPI) size
+>>>>11         ubeshort        x               %u bits
+# MPI
+>>>>13         ubequad         x               MPI=0x%16.16llx...
+# new version implies Pretty Good Privacy (PGP) >= 5.0 or Gnu Privacy Guard (GPG)
+>>>3           ubyte           >3              PGP/GPG key public ring (v%u)
+!:mime         application/pgp-keys
+!:ext          pgp/gpg/pkr/asd
+>>>>4          beldate         x               created %s
+# display key algorithm 17~DSA
+>>>>8          use             key_algo
+# Multiprecision Integers (MPI) size
+>>>>9          ubeshort        x               %u bits
+>>>>11         ubequad         x               MPI=0x%16.16llx...
+
 0       beshort         0x9501                  PGP key security ring
 !:mime application/x-pgp-keyring
 0       beshort         0x9500                  PGP key security ring