rustpgp

sequoia rust how to check if a encrypted message was signed by a CA


Im having some trouble with using sequoia crate to check if a encrypted message was signed by a CA. their documentation dosnt talk about anything like this.


Solution

  • Unlike TLS, CMS, and other protocols designed around X.509, OpenPGP doesn't have any intrinsic idea of certificate authorities. Any primary key can sign subkeys, and any key with the appropriate key flags can sign data.

    You can, of course, create and use certificate authorities, and there have even been publicly trusted ones in the past (although I'm not aware of any operating now). However, a signature from a certificate authority will look just like a signature from any other key, and you'll have to trace the signing key back to some root of trust provided independently.

    Assuming you have such a root of trust, you can parse the signature by iterating over the packets to see if there's a signature. Usually there's a one-pass signature packet that allows the data to be parsed in one pass. Once you've extracted the fingerprint and other data from that packet and found the key, you can then call verify_message to verify the data. The data you'll want to pass there is the LiteralData packet.