168349Sobrien 268349Sobrien#------------------------------------------------------------------------------ 3362844Sdelphij# $File: pgp,v 1.21 2020/03/20 17:11:05 christos Exp $ 468349Sobrien# pgp: file(1) magic for Pretty Good Privacy 5354939Sdelphij# see https://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 668349Sobrien# 7337827Seadler# Update: Joerg Jenderek 8337827Seadler# Note: verified by `gpg -v --debug 0x02 --list-packets < PUBRING263_10.PGP` 9337827Seadler#0 byte 0x99 MAYBE PGP 0x99 10337827Seadler0 byte 0x99 11337827Seadler# 99h~10;0110;01~2=old packet type;tag 6=Public-Key Packet;1=two-octet length 12337827Seadler# A two-octet body header encodes packet lengths of 192~00C0h - 8383~20BFh 13337827Seadler#>1 ubeshort x \b, body length 0x%.4x 14337827Seadler# skip Basic.Image Beauty.320 Pic.Icons by looking for low version number 15337827Seadler#>3 ubyte x \b, V=%u 16337827Seadler#>3 ubyte <5 VERSION OK 17337827Seadler>3 ubyte <5 18337827Seadler# next packet type often b4h~(tag 13)~User ID Packet, b0h~(tag 12)~Trust packet 19337827Seadler#>>(1.S+3) ubyte x \b, next packet type 0x%x 20337827Seadler# skip 9900-v4.bin 9902-v4.bin by looking for valid second packet type (bit 7=1) 21337827Seadler#>>(1.S+3) ubyte >0x7F TYPE OK, 22337827Seadler>>(1.S+3) ubyte >0x7F 23337827Seadler# old versions 2,3 implies Pretty Good Privacy 24337827Seadler>>>3 ubyte <4 PGP key public ring (v%u) 25337827Seadler!:mime application/pgp-keys 26337827Seadler!:ext pgp/ASD 27337827Seadler>>>>4 beldate x created %s 28337827Seadler# days that this key is valid. If this number is zero, then it does not expire 29337827Seadler>>>>8 ubeshort >0 \b, %u days valid 30337827Seadler>>>>8 ubeshort =0 \b, not expire 31337827Seadler# display key algorithm 1~RSA (Encrypt or Sign) 32337827Seadler>>>>10 use key_algo 33337827Seadler# Multiprecision Integers (MPI) size 34337827Seadler>>>>11 ubeshort x %u bits 35337827Seadler# MPI 36337827Seadler>>>>13 ubequad x MPI=0x%16.16llx... 37337827Seadler# new version implies Pretty Good Privacy (PGP) >= 5.0 or Gnu Privacy Guard (GPG) 38337827Seadler>>>3 ubyte >3 PGP/GPG key public ring (v%u) 39337827Seadler!:mime application/pgp-keys 40337827Seadler!:ext pgp/gpg/pkr/asd 41337827Seadler>>>>4 beldate x created %s 42337827Seadler# display key algorithm 17~DSA 43337827Seadler>>>>8 use key_algo 44337827Seadler# Multiprecision Integers (MPI) size 45337827Seadler>>>>9 ubeshort x %u bits 46337827Seadler>>>>11 ubequad x MPI=0x%16.16llx... 47337827Seadler 4868349Sobrien0 beshort 0x9501 PGP key security ring 49186690Sobrien!:mime application/x-pgp-keyring 5068349Sobrien0 beshort 0x9500 PGP key security ring 51186690Sobrien!:mime application/x-pgp-keyring 5268349Sobrien0 beshort 0xa600 PGP encrypted data 53186690Sobrien#!:mime application/pgp-encrypted 54186690Sobrien#0 string -----BEGIN\040PGP text/PGP armored data 55186690Sobrien!:mime text/PGP # encoding: armored data 56186690Sobrien#>15 string PUBLIC\040KEY\040BLOCK- public key block 57186690Sobrien#>15 string MESSAGE- message 58186690Sobrien#>15 string SIGNED\040MESSAGE- signed message 59186690Sobrien#>15 string PGP\040SIGNATURE- signature 60186690Sobrien 61362844Sdelphij# Update: Joerg Jenderek 62362844Sdelphij# URL: http://en.wikipedia.org/wiki/Pretty_Good_Privacy 63362844Sdelphij# Reference: https://reposcope.com/mimetype/application/pgp-keys 64362844Sdelphij2 string ---BEGIN\040PGP\040PRIVATE\040KEY\040BLOCK- PGP private key block 65362844Sdelphij#!:mime text/PGP 66362844Sdelphij!:mime application/pgp-keys 67362844Sdelphij!:ext asc 68328874Seadler2 string ---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK- PGP public key block 69186690Sobrien!:mime application/pgp-keys 70362844Sdelphij!:ext asc 71275698Sdelphij>10 search/100 \n\n 72275698Sdelphij>>&0 use pgp 73328874Seadler0 string -----BEGIN\040PGP\040MESSAGE- PGP message 74362844Sdelphij# https://reposcope.com/mimetype/application/pgp-encrypted 75362844Sdelphij#!:mime application/pgp 76362844Sdelphij!:mime application/pgp-encrypted 77362844Sdelphij!:ext asc 78362844Sdelphij#!:ext asc/pgp/gpg 79275698Sdelphij>10 search/100 \n\n 80275698Sdelphij>>&0 use pgp 81362844Sdelphij# Reference: https://www.gnupg.org/gph/en/manual/x135.html 82362844Sdelphij0 string -----BEGIN\040PGP\040SIGNED\040MESSAGE- PGP signed message 83362844Sdelphij#!:mime text/plain 84362844Sdelphij!:mime text/PGP 85362844Sdelphij#!:mime application/pgp 86362844Sdelphij!:ext asc 87328874Seadler0 string -----BEGIN\040PGP\040SIGNATURE- PGP signature 88362844Sdelphij# https://reposcope.com/mimetype/application/pgp-signature 89186690Sobrien!:mime application/pgp-signature 90362844Sdelphij!:ext asc 91275698Sdelphij>10 search/100 \n\n 92275698Sdelphij>>&0 use pgp 93275698Sdelphij 94275698Sdelphij# Decode the type of the packet based on it's base64 encoding. 95275698Sdelphij# Idea from Mark Martinec 96275698Sdelphij# The specification is in RFC 4880, section 4.2 and 4.3: 97354939Sdelphij# https://tools.ietf.org/html/rfc4880#section-4.2 98275698Sdelphij 99275698Sdelphij0 name pgp 100275698Sdelphij>0 byte 0x67 Reserved (old) 101275698Sdelphij>0 byte 0x68 Public-Key Encrypted Session Key (old) 102275698Sdelphij>0 byte 0x69 Signature (old) 103275698Sdelphij>0 byte 0x6a Symmetric-Key Encrypted Session Key (old) 104275698Sdelphij>0 byte 0x6b One-Pass Signature (old) 105275698Sdelphij>0 byte 0x6c Secret-Key (old) 106275698Sdelphij>0 byte 0x6d Public-Key (old) 107275698Sdelphij>0 byte 0x6e Secret-Subkey (old) 108275698Sdelphij>0 byte 0x6f Compressed Data (old) 109275698Sdelphij>0 byte 0x70 Symmetrically Encrypted Data (old) 110275698Sdelphij>0 byte 0x71 Marker (old) 111275698Sdelphij>0 byte 0x72 Literal Data (old) 112275698Sdelphij>0 byte 0x73 Trust (old) 113275698Sdelphij>0 byte 0x74 User ID (old) 114275698Sdelphij>0 byte 0x75 Public-Subkey (old) 115275698Sdelphij>0 byte 0x76 Unused (old) 116275698Sdelphij>0 byte 0x77 117275698Sdelphij>>1 byte&0xc0 0x00 Reserved 118275698Sdelphij>>1 byte&0xc0 0x40 Public-Key Encrypted Session Key 119275698Sdelphij>>1 byte&0xc0 0x80 Signature 120275698Sdelphij>>1 byte&0xc0 0xc0 Symmetric-Key Encrypted Session Key 121275698Sdelphij>0 byte 0x78 122275698Sdelphij>>1 byte&0xc0 0x00 One-Pass Signature 123275698Sdelphij>>1 byte&0xc0 0x40 Secret-Key 124275698Sdelphij>>1 byte&0xc0 0x80 Public-Key 125275698Sdelphij>>1 byte&0xc0 0xc0 Secret-Subkey 126275698Sdelphij>0 byte 0x79 127275698Sdelphij>>1 byte&0xc0 0x00 Compressed Data 128275698Sdelphij>>1 byte&0xc0 0x40 Symmetrically Encrypted Data 129275698Sdelphij>>1 byte&0xc0 0x80 Marker 130275698Sdelphij>>1 byte&0xc0 0xc0 Literal Data 131275698Sdelphij>0 byte 0x7a 132275698Sdelphij>>1 byte&0xc0 0x00 Trust 133275698Sdelphij>>1 byte&0xc0 0x40 User ID 134275698Sdelphij>>1 byte&0xc0 0x80 Public-Subkey 135275698Sdelphij>>1 byte&0xc0 0xc0 Unused [z%x] 136275698Sdelphij>0 byte 0x30 137275698Sdelphij>>1 byte&0xc0 0x00 Unused [0%x] 138275698Sdelphij>>1 byte&0xc0 0x40 User Attribute 139328874Seadler>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data 140275698Sdelphij>>1 byte&0xc0 0xc0 Modification Detection Code 141275698Sdelphij 142275698Sdelphij# magic signatures to detect PGP crypto material (from stef) 143275698Sdelphij# detects and extracts metadata from: 144275698Sdelphij# - symmetric encrypted packet header 145275698Sdelphij# - RSA (e=65537) secret (sub-)keys 146275698Sdelphij 147275698Sdelphij# 1024b RSA encrypted data 148275698Sdelphij 149275698Sdelphij0 string \x84\x8c\x03 PGP RSA encrypted session key - 150362844Sdelphij>3 belong x keyid: %08X 151362844Sdelphij>7 belong x %08X 152275698Sdelphij>11 byte 0x01 RSA (Encrypt or Sign) 1024b 153275698Sdelphij>11 byte 0x02 RSA Encrypt-Only 1024b 154275698Sdelphij>12 string \x04\x00 155275698Sdelphij>12 string \x03\xff 156275698Sdelphij>12 string \x03\xfe 157275698Sdelphij>12 string \x03\xfd 158275698Sdelphij>12 string \x03\xfc 159275698Sdelphij>12 string \x03\xfb 160275698Sdelphij>12 string \x03\xfa 161275698Sdelphij>12 string \x03\xf9 162275698Sdelphij>142 byte 0xd2 . 163275698Sdelphij 164275698Sdelphij# 2048b RSA encrypted data 165275698Sdelphij 166275698Sdelphij0 string \x85\x01\x0c\x03 PGP RSA encrypted session key - 167362844Sdelphij>4 belong x keyid: %08X 168362844Sdelphij>8 belong x %08X 169275698Sdelphij>12 byte 0x01 RSA (Encrypt or Sign) 2048b 170275698Sdelphij>12 byte 0x02 RSA Encrypt-Only 2048b 171275698Sdelphij>13 string \x08\x00 172275698Sdelphij>13 string \x07\xff 173275698Sdelphij>13 string \x07\xfe 174275698Sdelphij>13 string \x07\xfd 175275698Sdelphij>13 string \x07\xfc 176275698Sdelphij>13 string \x07\xfb 177275698Sdelphij>13 string \x07\xfa 178275698Sdelphij>13 string \x07\xf9 179275698Sdelphij>271 byte 0xd2 . 180275698Sdelphij 181275698Sdelphij# 3072b RSA encrypted data 182275698Sdelphij 183275698Sdelphij0 string \x85\x01\x8c\x03 PGP RSA encrypted session key - 184362844Sdelphij>4 belong x keyid: %08X 185362844Sdelphij>8 belong x %08X 186275698Sdelphij>12 byte 0x01 RSA (Encrypt or Sign) 3072b 187275698Sdelphij>12 byte 0x02 RSA Encrypt-Only 3072b 188275698Sdelphij>13 string \x0c\x00 189275698Sdelphij>13 string \x0b\xff 190275698Sdelphij>13 string \x0b\xfe 191275698Sdelphij>13 string \x0b\xfd 192275698Sdelphij>13 string \x0b\xfc 193275698Sdelphij>13 string \x0b\xfb 194275698Sdelphij>13 string \x0b\xfa 195275698Sdelphij>13 string \x0b\xf9 196275698Sdelphij>399 byte 0xd2 . 197275698Sdelphij 198362844Sdelphij# 4096b RSA encrypted data 199275698Sdelphij 200275698Sdelphij0 string \x85\x02\x0c\x03 PGP RSA encrypted session key - 201362844Sdelphij>4 belong x keyid: %08X 202362844Sdelphij>8 belong x %08X 203275698Sdelphij>12 byte 0x01 RSA (Encrypt or Sign) 4096b 204275698Sdelphij>12 byte 0x02 RSA Encrypt-Only 4096b 205275698Sdelphij>13 string \x10\x00 206275698Sdelphij>13 string \x0f\xff 207275698Sdelphij>13 string \x0f\xfe 208275698Sdelphij>13 string \x0f\xfd 209275698Sdelphij>13 string \x0f\xfc 210275698Sdelphij>13 string \x0f\xfb 211275698Sdelphij>13 string \x0f\xfa 212275698Sdelphij>13 string \x0f\xf9 213275698Sdelphij>527 byte 0xd2 . 214275698Sdelphij 215362844Sdelphij# 8192b RSA encrypted data 216275698Sdelphij 217275698Sdelphij0 string \x85\x04\x0c\x03 PGP RSA encrypted session key - 218362844Sdelphij>4 belong x keyid: %08X 219362844Sdelphij>8 belong x %08X 220362844Sdelphij>12 byte 0x01 RSA (Encrypt or Sign) 8192b 221362844Sdelphij>12 byte 0x02 RSA Encrypt-Only 8192b 222275698Sdelphij>13 string \x20\x00 223275698Sdelphij>13 string \x1f\xff 224275698Sdelphij>13 string \x1f\xfe 225275698Sdelphij>13 string \x1f\xfd 226275698Sdelphij>13 string \x1f\xfc 227275698Sdelphij>13 string \x1f\xfb 228275698Sdelphij>13 string \x1f\xfa 229275698Sdelphij>13 string \x1f\xf9 230275698Sdelphij>1039 byte 0xd2 . 231275698Sdelphij 232362844Sdelphij# 1024b Elgamal encrypted data 233362844Sdelphij 234362844Sdelphij0 string \x85\x01\x0e\x03 PGP Elgamal encrypted session key - 235362844Sdelphij>4 belong x keyid: %08X 236362844Sdelphij>8 belong x %08X 237362844Sdelphij>12 byte 0x10 Elgamal Encrypt-Only 1024b. 238362844Sdelphij>13 string \x04\x00 239362844Sdelphij>13 string \x03\xff 240362844Sdelphij>13 string \x03\xfe 241362844Sdelphij>13 string \x03\xfd 242362844Sdelphij>13 string \x03\xfc 243362844Sdelphij>13 string \x03\xfb 244362844Sdelphij>13 string \x03\xfa 245362844Sdelphij>13 string \x03\xf9 246362844Sdelphij 247362844Sdelphij# 2048b Elgamal encrypted data 248362844Sdelphij 249362844Sdelphij0 string \x85\x02\x0e\x03 PGP Elgamal encrypted session key - 250362844Sdelphij>4 belong x keyid: %08X 251362844Sdelphij>8 belong x %08X 252362844Sdelphij>12 byte 0x10 Elgamal Encrypt-Only 2048b. 253362844Sdelphij>13 string \x08\x00 254362844Sdelphij>13 string \x07\xff 255362844Sdelphij>13 string \x07\xfe 256362844Sdelphij>13 string \x07\xfd 257362844Sdelphij>13 string \x07\xfc 258362844Sdelphij>13 string \x07\xfb 259362844Sdelphij>13 string \x07\xfa 260362844Sdelphij>13 string \x07\xf9 261362844Sdelphij 262362844Sdelphij# 3072b Elgamal encrypted data 263362844Sdelphij 264362844Sdelphij0 string \x85\x03\x0e\x03 PGP Elgamal encrypted session key - 265362844Sdelphij>4 belong x keyid: %08X 266362844Sdelphij>8 belong x %08X 267362844Sdelphij>12 byte 0x10 Elgamal Encrypt-Only 3072b. 268362844Sdelphij>13 string \x0c\x00 269362844Sdelphij>13 string \x0b\xff 270362844Sdelphij>13 string \x0b\xfe 271362844Sdelphij>13 string \x0b\xfd 272362844Sdelphij>13 string \x0b\xfc 273362844Sdelphij>13 string \x0b\xfb 274362844Sdelphij>13 string \x0b\xfa 275362844Sdelphij>13 string \x0b\xf9 276362844Sdelphij 277275698Sdelphij# crypto algo mapper 278275698Sdelphij 279275698Sdelphij0 name crypto 280275698Sdelphij>0 byte 0x00 Plaintext or unencrypted data 281275698Sdelphij>0 byte 0x01 IDEA 282275698Sdelphij>0 byte 0x02 TripleDES 283275698Sdelphij>0 byte 0x03 CAST5 (128 bit key) 284275698Sdelphij>0 byte 0x04 Blowfish (128 bit key, 16 rounds) 285275698Sdelphij>0 byte 0x07 AES with 128-bit key 286275698Sdelphij>0 byte 0x08 AES with 192-bit key 287275698Sdelphij>0 byte 0x09 AES with 256-bit key 288275698Sdelphij>0 byte 0x0a Twofish with 256-bit key 289275698Sdelphij 290275698Sdelphij# hash algo mapper 291275698Sdelphij 292275698Sdelphij0 name hash 293275698Sdelphij>0 byte 0x01 MD5 294275698Sdelphij>0 byte 0x02 SHA-1 295275698Sdelphij>0 byte 0x03 RIPE-MD/160 296275698Sdelphij>0 byte 0x08 SHA256 297275698Sdelphij>0 byte 0x09 SHA384 298275698Sdelphij>0 byte 0x0a SHA512 299275698Sdelphij>0 byte 0x0b SHA224 300275698Sdelphij 301309847Sdelphij# display public key algorithms as human readable text 302309847Sdelphij0 name key_algo 303309847Sdelphij>0 byte 0x01 RSA (Encrypt or Sign) 304309847Sdelphij# keep old look of version 5.28 without parentheses 305309847Sdelphij>0 byte 0x02 RSA Encrypt-Only 306309847Sdelphij>0 byte 0x03 RSA (Sign-Only) 307309847Sdelphij>0 byte 16 ElGamal (Encrypt-Only) 308309847Sdelphij>0 byte 17 DSA 309309847Sdelphij>0 byte 18 Elliptic Curve 310309847Sdelphij>0 byte 19 ECDSA 311309847Sdelphij>0 byte 20 ElGamal (Encrypt or Sign) 312309847Sdelphij>0 byte 21 Diffie-Hellman 313328874Seadler>0 default x 314309847Sdelphij>>0 ubyte <22 unknown (pub %d) 315309847Sdelphij# this should never happen 316309847Sdelphij>>0 ubyte >21 invalid (%d) 317309847Sdelphij 318275698Sdelphij# pgp symmetric encrypted data 319275698Sdelphij 320275698Sdelphij0 byte 0x8c PGP symmetric key encrypted data - 321275698Sdelphij>1 byte 0x0d 322275698Sdelphij>1 byte 0x0c 323275698Sdelphij>2 byte 0x04 324275698Sdelphij>3 use crypto 325275698Sdelphij>4 byte 0x01 salted - 326275698Sdelphij>>5 use hash 327275698Sdelphij>>14 byte 0xd2 . 328275698Sdelphij>>14 byte 0xc9 . 329275698Sdelphij>4 byte 0x03 salted & iterated - 330275698Sdelphij>>5 use hash 331275698Sdelphij>>15 byte 0xd2 . 332275698Sdelphij>>15 byte 0xc9 . 333275698Sdelphij 334275698Sdelphij# encrypted keymaterial needs s2k & can be checksummed/hashed 335275698Sdelphij 336275698Sdelphij0 name chkcrypto 337275698Sdelphij>0 use crypto 338275698Sdelphij>1 byte 0x00 Simple S2K 339275698Sdelphij>1 byte 0x01 Salted S2K 340275698Sdelphij>1 byte 0x03 Salted&Iterated S2K 341275698Sdelphij>2 use hash 342275698Sdelphij 343275698Sdelphij# all PGP keys start with this prolog 344275698Sdelphij# containing version, creation date, and purpose 345275698Sdelphij 346275698Sdelphij0 name keyprolog 347275698Sdelphij>0 byte 0x04 348275698Sdelphij>1 beldate x created on %s - 349275698Sdelphij>5 byte 0x01 RSA (Encrypt or Sign) 350275698Sdelphij>5 byte 0x02 RSA Encrypt-Only 351275698Sdelphij 352275698Sdelphij# end of secret keys known signature 353275698Sdelphij# contains e=65537 and the prolog to 354275698Sdelphij# the encrypted parameters 355275698Sdelphij 356275698Sdelphij0 name keyend 357275698Sdelphij>0 string \x00\x11\x01\x00\x01 e=65537 358275698Sdelphij>5 use crypto 359275698Sdelphij>5 byte 0xff checksummed 360275698Sdelphij>>6 use chkcrypto 361275698Sdelphij>5 byte 0xfe hashed 362275698Sdelphij>>6 use chkcrypto 363275698Sdelphij 364275698Sdelphij# PGP secret keys contain also the public parts 365275698Sdelphij# these vary by bitsize of the key 366275698Sdelphij 367275698Sdelphij0 name x1024 368275698Sdelphij>0 use keyprolog 369275698Sdelphij>6 string \x03\xfe 370275698Sdelphij>6 string \x03\xff 371275698Sdelphij>6 string \x04\x00 372275698Sdelphij>136 use keyend 373275698Sdelphij 374275698Sdelphij0 name x2048 375275698Sdelphij>0 use keyprolog 376275698Sdelphij>6 string \x80\x00 377275698Sdelphij>6 string \x07\xfe 378275698Sdelphij>6 string \x07\xff 379275698Sdelphij>264 use keyend 380275698Sdelphij 381275698Sdelphij0 name x3072 382275698Sdelphij>0 use keyprolog 383275698Sdelphij>6 string \x0b\xfe 384275698Sdelphij>6 string \x0b\xff 385275698Sdelphij>6 string \x0c\x00 386275698Sdelphij>392 use keyend 387275698Sdelphij 388275698Sdelphij0 name x4096 389275698Sdelphij>0 use keyprolog 390275698Sdelphij>6 string \x10\x00 391275698Sdelphij>6 string \x0f\xfe 392275698Sdelphij>6 string \x0f\xff 393275698Sdelphij>520 use keyend 394275698Sdelphij 395275698Sdelphij# \x00|\x1f[\xfe\xff]).{1024})' 396275698Sdelphij0 name x8192 397275698Sdelphij>0 use keyprolog 398275698Sdelphij>6 string \x20\x00 399275698Sdelphij>6 string \x1f\xfe 400275698Sdelphij>6 string \x1f\xff 401275698Sdelphij>1032 use keyend 402275698Sdelphij 403275698Sdelphij# depending on the size of the pkt 404275698Sdelphij# we branch into the proper key size 405275698Sdelphij# signatures defined as x{keysize} 406275698Sdelphij 407275698Sdelphij>0 name pgpkey 408275698Sdelphij>0 string \x01\xd8 1024b 409275698Sdelphij>>2 use x1024 410275698Sdelphij>0 string \x01\xeb 1024b 411275698Sdelphij>>2 use x1024 412275698Sdelphij>0 string \x01\xfb 1024b 413275698Sdelphij>>2 use x1024 414275698Sdelphij>0 string \x01\xfd 1024b 415275698Sdelphij>>2 use x1024 416275698Sdelphij>0 string \x01\xf3 1024b 417275698Sdelphij>>2 use x1024 418275698Sdelphij>0 string \x01\xee 1024b 419275698Sdelphij>>2 use x1024 420275698Sdelphij>0 string \x01\xfe 1024b 421275698Sdelphij>>2 use x1024 422275698Sdelphij>0 string \x01\xf4 1024b 423275698Sdelphij>>2 use x1024 424275698Sdelphij>0 string \x02\x0d 1024b 425275698Sdelphij>>2 use x1024 426275698Sdelphij>0 string \x02\x03 1024b 427275698Sdelphij>>2 use x1024 428275698Sdelphij>0 string \x02\x05 1024b 429275698Sdelphij>>2 use x1024 430275698Sdelphij>0 string \x02\x15 1024b 431275698Sdelphij>>2 use x1024 432275698Sdelphij>0 string \x02\x00 1024b 433275698Sdelphij>>2 use x1024 434275698Sdelphij>0 string \x02\x10 1024b 435275698Sdelphij>>2 use x1024 436275698Sdelphij>0 string \x02\x04 1024b 437275698Sdelphij>>2 use x1024 438275698Sdelphij>0 string \x02\x06 1024b 439275698Sdelphij>>2 use x1024 440275698Sdelphij>0 string \x02\x16 1024b 441275698Sdelphij>>2 use x1024 442275698Sdelphij>0 string \x03\x98 2048b 443275698Sdelphij>>2 use x2048 444275698Sdelphij>0 string \x03\xab 2048b 445275698Sdelphij>>2 use x2048 446275698Sdelphij>0 string \x03\xbb 2048b 447275698Sdelphij>>2 use x2048 448275698Sdelphij>0 string \x03\xbd 2048b 449275698Sdelphij>>2 use x2048 450275698Sdelphij>0 string \x03\xcd 2048b 451275698Sdelphij>>2 use x2048 452275698Sdelphij>0 string \x03\xb3 2048b 453275698Sdelphij>>2 use x2048 454275698Sdelphij>0 string \x03\xc3 2048b 455275698Sdelphij>>2 use x2048 456275698Sdelphij>0 string \x03\xc5 2048b 457275698Sdelphij>>2 use x2048 458275698Sdelphij>0 string \x03\xd5 2048b 459275698Sdelphij>>2 use x2048 460275698Sdelphij>0 string \x03\xae 2048b 461275698Sdelphij>>2 use x2048 462275698Sdelphij>0 string \x03\xbe 2048b 463275698Sdelphij>>2 use x2048 464275698Sdelphij>0 string \x03\xc0 2048b 465275698Sdelphij>>2 use x2048 466275698Sdelphij>0 string \x03\xd0 2048b 467275698Sdelphij>>2 use x2048 468275698Sdelphij>0 string \x03\xb4 2048b 469275698Sdelphij>>2 use x2048 470275698Sdelphij>0 string \x03\xc4 2048b 471275698Sdelphij>>2 use x2048 472275698Sdelphij>0 string \x03\xc6 2048b 473275698Sdelphij>>2 use x2048 474275698Sdelphij>0 string \x03\xd6 2048b 475275698Sdelphij>>2 use x2048 476275698Sdelphij>0 string \x05X 3072b 477275698Sdelphij>>2 use x3072 478275698Sdelphij>0 string \x05k 3072b 479275698Sdelphij>>2 use x3072 480275698Sdelphij>0 string \x05{ 3072b 481275698Sdelphij>>2 use x3072 482275698Sdelphij>0 string \x05} 3072b 483275698Sdelphij>>2 use x3072 484275698Sdelphij>0 string \x05\x8d 3072b 485275698Sdelphij>>2 use x3072 486275698Sdelphij>0 string \x05s 3072b 487275698Sdelphij>>2 use x3072 488275698Sdelphij>0 string \x05\x83 3072b 489275698Sdelphij>>2 use x3072 490275698Sdelphij>0 string \x05\x85 3072b 491275698Sdelphij>>2 use x3072 492275698Sdelphij>0 string \x05\x95 3072b 493275698Sdelphij>>2 use x3072 494275698Sdelphij>0 string \x05n 3072b 495275698Sdelphij>>2 use x3072 496275698Sdelphij>0 string \x05\x7e 3072b 497275698Sdelphij>>2 use x3072 498275698Sdelphij>0 string \x05\x80 3072b 499275698Sdelphij>>2 use x3072 500275698Sdelphij>0 string \x05\x90 3072b 501275698Sdelphij>>2 use x3072 502275698Sdelphij>0 string \x05t 3072b 503275698Sdelphij>>2 use x3072 504275698Sdelphij>0 string \x05\x84 3072b 505275698Sdelphij>>2 use x3072 506275698Sdelphij>0 string \x05\x86 3072b 507275698Sdelphij>>2 use x3072 508275698Sdelphij>0 string \x05\x96 3072b 509275698Sdelphij>>2 use x3072 510275698Sdelphij>0 string \x07[ 4096b 511275698Sdelphij>>2 use x4096 512275698Sdelphij>0 string \x07\x18 4096b 513275698Sdelphij>>2 use x4096 514275698Sdelphij>0 string \x07+ 4096b 515275698Sdelphij>>2 use x4096 516275698Sdelphij>0 string \x07; 4096b 517275698Sdelphij>>2 use x4096 518275698Sdelphij>0 string \x07= 4096b 519275698Sdelphij>>2 use x4096 520275698Sdelphij>0 string \x07M 4096b 521275698Sdelphij>>2 use x4096 522275698Sdelphij>0 string \x073 4096b 523275698Sdelphij>>2 use x4096 524275698Sdelphij>0 string \x07C 4096b 525275698Sdelphij>>2 use x4096 526275698Sdelphij>0 string \x07E 4096b 527275698Sdelphij>>2 use x4096 528275698Sdelphij>0 string \x07U 4096b 529275698Sdelphij>>2 use x4096 530275698Sdelphij>0 string \x07. 4096b 531275698Sdelphij>>2 use x4096 532275698Sdelphij>0 string \x07> 4096b 533275698Sdelphij>>2 use x4096 534275698Sdelphij>0 string \x07@ 4096b 535275698Sdelphij>>2 use x4096 536275698Sdelphij>0 string \x07P 4096b 537275698Sdelphij>>2 use x4096 538275698Sdelphij>0 string \x074 4096b 539275698Sdelphij>>2 use x4096 540275698Sdelphij>0 string \x07D 4096b 541275698Sdelphij>>2 use x4096 542275698Sdelphij>0 string \x07F 4096b 543275698Sdelphij>>2 use x4096 544275698Sdelphij>0 string \x07V 4096b 545275698Sdelphij>>2 use x4096 546275698Sdelphij>0 string \x0e[ 8192b 547275698Sdelphij>>2 use x8192 548275698Sdelphij>0 string \x0e\x18 8192b 549275698Sdelphij>>2 use x8192 550275698Sdelphij>0 string \x0e+ 8192b 551275698Sdelphij>>2 use x8192 552275698Sdelphij>0 string \x0e; 8192b 553275698Sdelphij>>2 use x8192 554275698Sdelphij>0 string \x0e= 8192b 555275698Sdelphij>>2 use x8192 556275698Sdelphij>0 string \x0eM 8192b 557275698Sdelphij>>2 use x8192 558275698Sdelphij>0 string \x0e3 8192b 559275698Sdelphij>>2 use x8192 560275698Sdelphij>0 string \x0eC 8192b 561275698Sdelphij>>2 use x8192 562275698Sdelphij>0 string \x0eE 8192b 563275698Sdelphij>>2 use x8192 564275698Sdelphij>0 string \x0eU 8192b 565275698Sdelphij>>2 use x8192 566275698Sdelphij>0 string \x0e. 8192b 567275698Sdelphij>>2 use x8192 568275698Sdelphij>0 string \x0e> 8192b 569275698Sdelphij>>2 use x8192 570275698Sdelphij>0 string \x0e@ 8192b 571275698Sdelphij>>2 use x8192 572275698Sdelphij>0 string \x0eP 8192b 573275698Sdelphij>>2 use x8192 574275698Sdelphij>0 string \x0e4 8192b 575275698Sdelphij>>2 use x8192 576275698Sdelphij>0 string \x0eD 8192b 577275698Sdelphij>>2 use x8192 578275698Sdelphij>0 string \x0eF 8192b 579275698Sdelphij>>2 use x8192 580275698Sdelphij>0 string \x0eV 8192b 581275698Sdelphij>>2 use x8192 582275698Sdelphij 583275698Sdelphij# PGP RSA (e=65537) secret (sub-)key header 584275698Sdelphij 585354939Sdelphij0 byte 0x95 PGP Secret Key - 586275698Sdelphij>1 use pgpkey 587354939Sdelphij0 byte 0x97 PGP Secret Sub-key - 588275698Sdelphij>1 use pgpkey 589328874Seadler0 byte 0x9d 590309847Sdelphij# Update: Joerg Jenderek 591309847Sdelphij# secret subkey packet (tag 7) with same structure as secret key packet (tag 5) 592309847Sdelphij# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len 593328874Seadler>1 ubeshort >0 594309847Sdelphij#>1 ubeshort x \b, body length 0x%x 595309847Sdelphij# next packet type often 88h,89h~(tag 2)~Signature Packet 596309847Sdelphij#>>(1.S+3) ubyte x \b, next packet type 0x%x 597309847Sdelphij# skip Dragon.SHR DEMO.INIT by looking for positive version 598328874Seadler>>3 ubyte >0 599309847Sdelphij# skip BUISSON.13 GUITAR1 by looking for low version number 600309847Sdelphij>>>3 ubyte <5 PGP Secret Sub-key 601309847Sdelphij# sub-key are normally part of secret key. So it does not occur as standalone file 602309847Sdelphij#!:ext bin 603309847Sdelphij# version 2,3~old 4~new . Comment following line for version 5.28 look 604309847Sdelphij>>>>3 ubyte x (v%d) 605309847Sdelphij>>>>3 ubyte x - 606309847Sdelphij# old versions 2 or 3 but no real example found 607328874Seadler>>>>3 ubyte <4 608309847Sdelphij# 2 byte for key bits in version 5.28 look 609309847Sdelphij>>>>>11 ubeshort x %db 610309847Sdelphij>>>>>4 beldate x created on %s - 611309847Sdelphij# old versions use 2 additional bytes after time stamp 612309847Sdelphij#>>>>>8 ubeshort x 0x%x 613309847Sdelphij# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman 614309847Sdelphij>>>>>10 use key_algo 615328874Seadler>>>>>(11.S/8) ubequad x 616309847Sdelphij# look after first key 617309847Sdelphij>>>>>>&5 use keyend 618309847Sdelphij# new version 619328874Seadler>>>>3 ubyte >3 620309847Sdelphij>>>>>9 ubeshort x %db 621309847Sdelphij>>>>>4 beldate x created on %s - 622309847Sdelphij# display key algorithm 623309847Sdelphij>>>>>8 use key_algo 624328874Seadler>>>>>(9.S/8) ubequad x 625309847Sdelphij# look after first key for something like s2k 626309847Sdelphij>>>>>>&3 use keyend 627