fix: produce and handle embedded primary key binding (backsig)

hko-s · hko-s · commit af4fb28c01fd · 2025-05-26T14:17:13.000+02:00
diff --git a/src/composed/key/builder.rs b/src/composed/key/builder.rs
@@ -259,8 +259,8 @@ impl SecretKeyParams {
             self.expiration.map(|v| v.as_secs() as u16),
             public_params,
         )?;
-        let pub_key = crate::packet::PublicKey::from_inner(pub_key)?;
-        let mut primary_key = packet::SecretKey::new(pub_key, secret_params)?;
+        let primary_pub_key = crate::packet::PublicKey::from_inner(pub_key)?;
+        let mut primary_key = packet::SecretKey::new(primary_pub_key.clone(), secret_params)?;
         if let Some(passphrase) = passphrase {
             primary_key.set_password_with_s2k(&passphrase.into(), s2k)?;
         }
@@ -326,11 +326,21 @@ impl SecretKeyParams {
                     let pub_key = packet::PublicSubkey::from_inner(pub_key)?;
                     let mut sub = packet::SecretSubkey::new(pub_key, secret_params)?;
 
+                    // Produce embedded back signature for signing-capable subkeys
+                    let embedded = if subkey.can_sign {
+                        let backsig =
+                            sub.sign_primary_key_binding(&mut rng, &primary_pub_key, &"".into())?;
+
+                        Some(backsig)
+                    } else {
+                        None
+                    };
+
                     if let Some(passphrase) = passphrase {
                         sub.set_password_with_s2k(&passphrase.as_str().into(), s2k)?;
                     }
 
-                    Ok(SecretSubkey::new(sub, keyflags))
+                    Ok(SecretSubkey::new(sub, keyflags, embedded))
                 })
                 .collect::<Result<Vec<_>>>()?,
         ))
diff --git a/src/composed/key/public.rs b/src/composed/key/public.rs
@@ -6,7 +6,7 @@ use crate::{
     composed::{KeyDetails, SignedPublicKey, SignedPublicSubKey},
     crypto::{hash::HashAlgorithm, public_key::PublicKeyAlgorithm},
     errors::Result,
-    packet::{self, KeyFlags},
+    packet::{self, KeyFlags, Signature},
     ser::Serialize,
     types::{
         EskType, Fingerprint, KeyId, Password, PkeskBytes, PublicKeyTrait, PublicParams,
@@ -26,6 +26,11 @@ pub struct PublicKey {
 pub struct PublicSubkey {
     pub key: packet::PublicSubkey,
     pub keyflags: KeyFlags,
+
+    /// Embedded primary key binding signature, required for signing-capable subkeys.
+    ///
+    /// See <https://www.rfc-editor.org/rfc/rfc9580.html#sigtype-primary-binding>
+    pub embedded: Option<Signature>,
 }
 
 impl PublicKey {
@@ -87,8 +92,12 @@ impl Deref for PublicKey {
 }
 
 impl PublicSubkey {
-    pub fn new(key: packet::PublicSubkey, keyflags: KeyFlags) -> Self {
-        PublicSubkey { key, keyflags }
+    pub fn new(key: packet::PublicSubkey, keyflags: KeyFlags, embedded: Option<Signature>) -> Self {
+        PublicSubkey {
+            key,
+            keyflags,
+            embedded,
+        }
     }
 
     /// Produce a Subkey Binding Signature (Type ID 0x18), to bind this subkey to a primary key
@@ -112,6 +121,7 @@ impl PublicSubkey {
             primary_pub_key,
             key_pw,
             self.keyflags,
+            self.embedded,
         )?];
 
         Ok(SignedPublicSubKey { key, signatures })
diff --git a/src/composed/key/secret.rs b/src/composed/key/secret.rs
@@ -4,7 +4,7 @@ use rand::Rng;
 use crate::{
     composed::{KeyDetails, PublicSubkey, SignedSecretKey, SignedSecretSubKey},
     errors::Result,
-    packet::{self, KeyFlags},
+    packet::{self, KeyFlags, Signature},
     ser::Serialize,
     types::{Password, PublicKeyTrait, SecretKeyTrait},
 };
@@ -24,6 +24,11 @@ pub struct SecretKey {
 pub struct SecretSubkey {
     key: packet::SecretSubkey,
     keyflags: KeyFlags,
+
+    /// Embedded primary key binding signature, required for signing-capable subkeys.
+    ///
+    /// See <https://www.rfc-editor.org/rfc/rfc9580.html#sigtype-primary-binding>
+    pub embedded: Option<Signature>,
 }
 
 impl SecretKey {
@@ -70,8 +75,12 @@ impl SecretKey {
 }
 
 impl SecretSubkey {
-    pub fn new(key: packet::SecretSubkey, keyflags: KeyFlags) -> Self {
-        SecretSubkey { key, keyflags }
+    pub fn new(key: packet::SecretSubkey, keyflags: KeyFlags, embedded: Option<Signature>) -> Self {
+        SecretSubkey {
+            key,
+            keyflags,
+            embedded,
+        }
     }
 
     /// Produce a Subkey Binding Signature (Type ID 0x18), to bind this subkey to a primary key
@@ -95,6 +104,7 @@ impl SecretSubkey {
             primary_pub_key,
             key_pw,
             self.keyflags,
+            self.embedded,
         )?];
 
         Ok(SignedSecretSubKey { key, signatures })
diff --git a/src/composed/signed_key/public.rs b/src/composed/signed_key/public.rs
@@ -16,7 +16,7 @@ use crate::{
         public_key::PublicKeyAlgorithm,
     },
     errors::{bail, ensure, Result},
-    packet::{self, Packet, PacketTrait, SignatureType},
+    packet::{self, Packet, PacketTrait, SignatureType, SubpacketData},
     ser::Serialize,
     types::{
         EskType, Fingerprint, Imprint, KeyDetails, KeyId, KeyVersion, PacketLength, PkeskBytes,
@@ -297,13 +297,18 @@ impl SignedPublicSubKey {
     }
 
     pub fn as_unsigned(&self) -> PublicSubkey {
-        let keyflags = self
-            .signatures
-            .first()
-            .expect("missing signatures")
-            .key_flags();
+        let sig = self.signatures.first().expect("missing signatures");
 
-        PublicSubkey::new(self.key.clone(), keyflags)
+        let embedded = sig.config().and_then(|c| {
+            c.hashed_subpackets().find_map(|p| match &p.data {
+                SubpacketData::EmbeddedSignature(backsig) => Some(*backsig.clone()),
+                _ => None,
+            })
+        });
+
+        let keyflags = sig.key_flags();
+
+        PublicSubkey::new(self.key.clone(), keyflags, embedded)
     }
 
     pub fn encrypt<R: Rng + CryptoRng>(
diff --git a/src/composed/signed_key/secret.rs b/src/composed/signed_key/secret.rs
@@ -14,7 +14,7 @@ use crate::{
     },
     crypto::hash::KnownDigest,
     errors::{ensure, Result},
-    packet::{self, Packet, PacketTrait, SignatureType},
+    packet::{self, Packet, PacketTrait, SignatureType, SubpacketData},
     ser::Serialize,
     types::{EskType, Imprint, Password, PkeskBytes, PublicKeyTrait, Tag},
 };
@@ -318,13 +318,18 @@ impl SignedSecretSubKey {
     }
 
     pub fn public_key(&self) -> PublicSubkey {
-        let keyflags = self
-            .signatures
-            .first()
-            .expect("invalid signed subkey")
-            .key_flags();
+        let sig = self.signatures.first().expect("invalid signed subkey");
 
-        PublicSubkey::new(self.key.public_key().clone(), keyflags)
+        let keyflags = sig.key_flags();
+
+        let embedded = sig.config().and_then(|c| {
+            c.hashed_subpackets().find_map(|p| match &p.data {
+                SubpacketData::EmbeddedSignature(backsig) => Some(*backsig.clone()),
+                _ => None,
+            })
+        });
+
+        PublicSubkey::new(self.key.public_key().clone(), keyflags, embedded)
     }
 
     /// Decrypts session key using this key.
diff --git a/src/packet/key/public.rs b/src/packet/key/public.rs
@@ -166,6 +166,7 @@ impl PublicSubkey {
         primary_pub_key: &P,
         key_pw: &Password,
         keyflags: KeyFlags,
+        embedded: Option<Signature>,
     ) -> Result<Signature>
     where
         K: SecretKeyTrait,
@@ -196,6 +197,14 @@ impl PublicSubkey {
             ))?,
         ];
 
+        if let Some(embedded) = embedded {
+            config
+                .hashed_subpackets
+                .push(Subpacket::regular(SubpacketData::EmbeddedSignature(
+                    Box::new(embedded),
+                ))?)
+        }
+
         // If the version of the issuer is greater than 4, this subpacket MUST NOT be included in
         // the signature.
         if primary_sec_key.version() <= KeyVersion::V4 {
diff --git a/src/packet/key/secret.rs b/src/packet/key/secret.rs
@@ -483,13 +483,20 @@ impl SecretSubkey {
         primary_pub_key: &P,
         key_pw: &Password,
         keyflags: KeyFlags,
+        embedded: Option<Signature>,
     ) -> Result<Signature>
     where
         K: SecretKeyTrait,
         P: PublicKeyTrait + Serialize,
     {
-        self.details
-            .sign(&mut rng, primary_sec_key, primary_pub_key, key_pw, keyflags)
+        self.details.sign(
+            &mut rng,
+            primary_sec_key,
+            primary_pub_key,
+            key_pw,
+            keyflags,
+            embedded,
+        )
     }
 
     pub fn encrypt<R: rand::Rng + rand::CryptoRng>(
