bc-java

bc-java copied to clipboard

When verify signature receive java.io.EOFException: Unexpected end of ZIP input stream

2

In verify the signer of a PGP encrypted message I receive the following stacktrace: ``` Exception in thread "main" java.io.EOFException: Unexpected end of ZIP input stream at org.bouncycastle.openpgp.PGPCompressedData$2.fill(PGPCompressedData.java:155) at java.base/java.util.zip.InflaterInputStream.read(InflaterInputStream.java:159)...

brett-walker

BouncyCastle vulnerable to a timing variant of Bleichenbacher called Marvin Attack

34

*(As I've sent to the security mailing list three emails, last one over 2 weeks ago, and haven't received anything but automated reply that the email was received, I'm making...

tomato42

Hello, I prepared an implementation for post-quantum hybrid composite signatures (from now on just "composites") according to the draft RFC https://www.ietf.org/archive/id/draft-ounsworth-pq-composite-sigs-13.html. I noticed that there is already some very experimental...

Honzaik

Add explicit ant targets for build-util and build-pkix. I found myself not needing to build the entire bouncycastle product but there was no way to avoid building everything, and further,...

brownp2k

DTLS 1.2 broken in version 1.77; handshake finished sends hello_request instead of change_cipher_spec and finished

2

There is a bug in `DtlsRecordLayer.send(byte[] buf, int off, int len)` [link](https://github.com/bcgit/bc-java/blob/cc4c67b0689594aabc831ce0122d411830851db8/tls/src/main/java/org/bouncycastle/tls/DTLSRecordLayer.java#L379) when called with a `HandshakeType.finished` does not send `change_cipher_spec` nor `finished` and instead only sends `hello_request`. This prevent...

mondain

Integrating FIPS-Compliant Libraries with OpenSAML

2

Hello Team, I'm currently using spring security 6.2 which internally uses OpenSAML 4.3 Java library to handle the SAML assertion received from the IDP. However, I've encountered an issue where...

sumeetpri

The SExpParser cannot partse GnuPG private keys if they are ed25519. Reason is trivial: this is how GnuPG stores them: https://github.com/gpg/gnupg/blob/40227e42ea0f2f1cf9c9f506375446648df17e8d/common/t-ssh-utils.c#L179-L199 https://github.com/gpg/gnupg/blob/40227e42ea0f2f1cf9c9f506375446648df17e8d/agent/cvt-openpgp.c#L222-L243 And SExprParser always ends up here: https://github.com/bcgit/bc-java/blob/bd6e70c7cad0a35fdcba055de13ef2e36f6a151b/pg/src/main/java/org/bouncycastle/gpg/SExprParser.java#L94 As...

cstamas

The SExpParser cannot partse GnuPG private keys if they are ed25519. Reason is trivial: this is how GnuPG stores them: https://github.com/gpg/gnupg/blob/40227e42ea0f2f1cf9c9f506375446648df17e8d/common/t-ssh-utils.c#L179-L199 https://github.com/gpg/gnupg/blob/40227e42ea0f2f1cf9c9f506375446648df17e8d/agent/cvt-openpgp.c#L222-L243 And SExprParser always ends up here: https://github.com/bcgit/bc-java/blob/bd6e70c7cad0a35fdcba055de13ef2e36f6a151b/pg/src/main/java/org/bouncycastle/gpg/SExprParser.java#L94 As...

cstamas

Support for GnuPG 2.2 + Private Keys Files

9

Hi Apologies in advance for creating a duplicate of the `GNUPG 2.2.X file format support` (https://github.com/bcgit/bc-java/issues/794). But I need a definitive answer, sooner than later, if possible. So I thought...

Patrick-Harms

## Environment * Bouncy Castle build on commit `9279d29588e52d8f0260c2ce5e730c773c247569` * Modules used: * bcpkix; * bcprov; * bcutils. * OpenJDK Runtime Environment (build 17+35-2724) ## Description 1. When generating a...

mugz3m