1 2#------------------------------------------------------------------------------ 3# $File: pgp,v 1.27 2025/12/18 18:33:33 christos Exp $ 4# pgp: file(1) magic for Pretty Good Privacy 5 6# Reference: https://www.iana.org/assignments/openpgp/openpgp.xhtml 7 8# PGP compressed data packet (RFC 4880, section 5.6) 90 beshort 0xa301 PGP compressed data (ZIP) 100 beshort 0xa302 PGP compressed data (ZLIB) 110 beshort 0xa303 PGP compressed data (BZIP2) 12 13# Handling of binary PGP keys is in pgp-binary-keys. 14# see https://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 15# 160 beshort 0xa600 PGP encrypted data 17#!:mime application/pgp-encrypted 18#0 string -----BEGIN\040PGP text/PGP armored data 19!:mime text/PGP # encoding: armored data 20#>15 string PUBLIC\040KEY\040BLOCK- public key block 21#>15 string MESSAGE- message 22#>15 string SIGNED\040MESSAGE- signed message 23#>15 string PGP\040SIGNATURE- signature 24 25# Update: Joerg Jenderek 26# URL: http://en.wikipedia.org/wiki/Pretty_Good_Privacy 27# Reference: https://reposcope.com/mimetype/application/pgp-keys 282 string ---BEGIN\040PGP\040PRIVATE\040KEY\040BLOCK- PGP private key block 29#!:mime text/PGP 30!:mime application/pgp-keys 31!:ext asc 322 string ---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK- PGP public key block 33!:mime application/pgp-keys 34!:ext asc 35>10 search/100 \n\n 36>>&0 use pgp 370 string -----BEGIN\040PGP\040MESSAGE- PGP message 38# https://reposcope.com/mimetype/application/pgp-encrypted 39#!:mime application/pgp 40!:mime application/pgp-encrypted 41!:ext asc 42#!:ext asc/pgp/gpg 43>10 search/100 \n\n 44>>&0 use pgp 45# Reference: https://www.gnupg.org/gph/en/manual/x135.html 460 string -----BEGIN\040PGP\040SIGNED\040MESSAGE- PGP signed message 47#!:mime text/plain 48!:mime text/PGP 49#!:mime application/pgp 50!:ext asc 510 string -----BEGIN\040PGP\040SIGNATURE- PGP signature 52# https://reposcope.com/mimetype/application/pgp-signature 53!:mime application/pgp-signature 54!:ext asc 55>10 search/100 \n\n 56>>&0 use pgp 57 58# Decode the type of the packet based on it's base64 encoding. 59# Idea from Mark Martinec 60# The specification is in RFC 4880, section 4.2 and 4.3: 61# https://tools.ietf.org/html/rfc4880#section-4.2 62 630 name pgp 64>0 byte 0x67 Reserved (old) 65>0 byte 0x68 Public-Key Encrypted Session Key (old) 66>0 byte 0x69 Signature (old) 67>0 byte 0x6a Symmetric-Key Encrypted Session Key (old) 68>0 byte 0x6b One-Pass Signature (old) 69>0 byte 0x6c Secret-Key (old) 70>0 byte 0x6d Public-Key (old) 71>0 byte 0x6e Secret-Subkey (old) 72>0 byte 0x6f Compressed Data (old) 73>0 byte 0x70 Symmetrically Encrypted Data (old) 74>0 byte 0x71 Marker (old) 75>0 byte 0x72 Literal Data (old) 76>0 byte 0x73 Trust (old) 77>0 byte 0x74 User ID (old) 78>0 byte 0x75 Public-Subkey (old) 79>0 byte 0x76 Unused (old) 80>0 byte 0x77 81>>1 byte&0xc0 0x00 Reserved 82>>1 byte&0xc0 0x40 Public-Key Encrypted Session Key 83>>1 byte&0xc0 0x80 Signature 84>>1 byte&0xc0 0xc0 Symmetric-Key Encrypted Session Key 85>0 byte 0x78 86>>1 byte&0xc0 0x00 One-Pass Signature 87>>1 byte&0xc0 0x40 Secret-Key 88>>1 byte&0xc0 0x80 Public-Key 89>>1 byte&0xc0 0xc0 Secret-Subkey 90>0 byte 0x79 91>>1 byte&0xc0 0x00 Compressed Data 92>>1 byte&0xc0 0x40 Symmetrically Encrypted Data 93>>1 byte&0xc0 0x80 Marker 94>>1 byte&0xc0 0xc0 Literal Data 95>0 byte 0x7a 96>>1 byte&0xc0 0x00 Trust 97>>1 byte&0xc0 0x40 User ID 98>>1 byte&0xc0 0x80 Public-Subkey 99>>1 byte&0xc0 0xc0 Unused [z%x] 100>0 byte 0x30 101>>1 byte&0xc0 0x00 Unused [0%x] 102>>1 byte&0xc0 0x40 User Attribute 103>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data 104>>1 byte&0xc0 0xc0 Modification Detection Code 105 106# magic signatures to detect PGP crypto material (from stef) 107# detects and extracts metadata from: 108# - symmetric encrypted packet header 109# - RSA (e=65537) secret (sub-)keys 110 111# PGP ECC encrypted data 1120 byte 0x84 113>2 byte 3 114>>11 byte 18 PGP ECDH Public-Key Encrypted Session Key - 115>>>3 belong x keyid: %08X 116>>>7 belong x %08X 117>>11 byte 19 PGP ECDSA Public-Key Encrypted Session Key - 118>>>3 belong x keyid: %08X 119>>>7 belong x %08X 120>>11 byte 22 PGP EdDSALegacy Public-Key Encrypted Session Key - 121>>>3 belong x keyid: %08X 122>>>7 belong x %08X 123>>11 byte 25 PGP X25519 Public-Key Encrypted Session Key - 124>>>3 belong x keyid: %08X 125>>>7 belong x %08X 126>>11 byte 26 PGP X448 Public-Key Encrypted Session Key - 127>>>3 belong x keyid: %08X 128>>>7 belong x %08X 129>>11 byte 27 PGP Ed25519 Public-Key Encrypted Session Key - 130>>>3 belong x keyid: %08X 131>>>7 belong x %08X 132>>11 byte 28 PGP Ed448 Public-Key Encrypted Session Key - 133>>>3 belong x keyid: %08X 134>>>7 belong x %08X 1350 byte 0x85 136>3 byte 3 137>>12 byte 18 PGP ECDH Public-Key Encrypted Session Key - 138>>>4 belong x keyid: %08X 139>>>8 belong x %08X 140>>12 byte 19 PGP ECDSA Public-Key Encrypted Session Key - 141>>>4 belong x keyid: %08X 142>>>8 belong x %08X 143>>12 byte 22 PGP EdDSALegacy Public-Key Encrypted Session Key - 144>>>4 belong x keyid: %08X 145>>>8 belong x %08X 146>>12 byte 25 PGP X25519 Public-Key Encrypted Session Key - 147>>>4 belong x keyid: %08X 148>>>8 belong x %08X 149>>12 byte 26 PGP X448 Public-Key Encrypted Session Key - 150>>>4 belong x keyid: %08X 151>>>8 belong x %08X 152>>12 byte 27 PGP Ed25519 Public-Key Encrypted Session Key - 153>>>4 belong x keyid: %08X 154>>>8 belong x %08X 155>>12 byte 28 PGP Ed448 Public-Key Encrypted Session Key - 156>>>4 belong x keyid: %08X 157>>>8 belong x %08X 158 159# 1024b RSA encrypted data 160 1610 string \x84\x8c\x03 PGP RSA encrypted session key - 162>3 belong x keyid: %08X 163>7 belong x %08X 164>11 byte 0x01 RSA (Encrypt or Sign) 1024b 165>11 byte 0x02 RSA Encrypt-Only 1024b 166#>12 string \x04\x00 167#>12 string \x03\xff 168#>12 string \x03\xfe 169#>12 string \x03\xfd 170#>12 string \x03\xfc 171#>12 string \x03\xfb 172#>12 string \x03\xfa 173#>12 string \x03\xf9 174#>142 byte 0xd2 . 175 176# 2048b RSA encrypted data 177 1780 string \x85\x01\x0c\x03 PGP RSA encrypted session key - 179>4 belong x keyid: %08X 180>8 belong x %08X 181>12 byte 0x01 RSA (Encrypt or Sign) 2048b 182>12 byte 0x02 RSA Encrypt-Only 2048b 183#>13 string \x08\x00 184#>13 string \x07\xff 185#>13 string \x07\xfe 186#>13 string \x07\xfd 187#>13 string \x07\xfc 188#>13 string \x07\xfb 189#>13 string \x07\xfa 190#>13 string \x07\xf9 191#>271 byte 0xd2 . 192 193# 3072b RSA encrypted data 194 1950 string \x85\x01\x8c\x03 PGP RSA encrypted session key - 196>4 belong x keyid: %08X 197>8 belong x %08X 198>12 byte 0x01 RSA (Encrypt or Sign) 3072b 199>12 byte 0x02 RSA Encrypt-Only 3072b 200#>13 string \x0c\x00 201#>13 string \x0b\xff 202#>13 string \x0b\xfe 203#>13 string \x0b\xfd 204#>13 string \x0b\xfc 205#>13 string \x0b\xfb 206#>13 string \x0b\xfa 207#>13 string \x0b\xf9 208#>399 byte 0xd2 . 209 210# 4096b RSA encrypted data 211 2120 string \x85\x02\x0c\x03 PGP RSA encrypted session key - 213>4 belong x keyid: %08X 214>8 belong x %08X 215>12 byte 0x01 RSA (Encrypt or Sign) 4096b 216>12 byte 0x02 RSA Encrypt-Only 4096b 217#>13 string \x10\x00 218#>13 string \x0f\xff 219#>13 string \x0f\xfe 220#>13 string \x0f\xfd 221#>13 string \x0f\xfc 222#>13 string \x0f\xfb 223#>13 string \x0f\xfa 224#>13 string \x0f\xf9 225#>527 byte 0xd2 . 226 227# 8192b RSA encrypted data 228 2290 string \x85\x04\x0c\x03 PGP RSA encrypted session key - 230>4 belong x keyid: %08X 231>8 belong x %08X 232>12 byte 0x01 RSA (Encrypt or Sign) 8192b 233>12 byte 0x02 RSA Encrypt-Only 8192b 234#>13 string \x20\x00 235#>13 string \x1f\xff 236#>13 string \x1f\xfe 237#>13 string \x1f\xfd 238#>13 string \x1f\xfc 239#>13 string \x1f\xfb 240#>13 string \x1f\xfa 241#>13 string \x1f\xf9 242#>1039 byte 0xd2 . 243 244# 1024b Elgamal encrypted data 245 2460 string \x85\x01\x0e\x03 PGP Elgamal encrypted session key - 247>4 belong x keyid: %08X 248>8 belong x %08X 249>12 byte 0x10 Elgamal Encrypt-Only 1024b. 250#>13 string \x04\x00 251#>13 string \x03\xff 252#>13 string \x03\xfe 253#>13 string \x03\xfd 254#>13 string \x03\xfc 255#>13 string \x03\xfb 256#>13 string \x03\xfa 257#>13 string \x03\xf9 258 259# 2048b Elgamal encrypted data 260 2610 string \x85\x02\x0e\x03 PGP Elgamal encrypted session key - 262>4 belong x keyid: %08X 263>8 belong x %08X 264>12 byte 0x10 Elgamal Encrypt-Only 2048b. 265#>13 string \x08\x00 266#>13 string \x07\xff 267#>13 string \x07\xfe 268#>13 string \x07\xfd 269#>13 string \x07\xfc 270#>13 string \x07\xfb 271#>13 string \x07\xfa 272#>13 string \x07\xf9 273 274# 3072b Elgamal encrypted data 275 2760 string \x85\x03\x0e\x03 PGP Elgamal encrypted session key - 277>4 belong x keyid: %08X 278>8 belong x %08X 279>12 byte 0x10 Elgamal Encrypt-Only 3072b. 280#>13 string \x0c\x00 281#>13 string \x0b\xff 282#>13 string \x0b\xfe 283#>13 string \x0b\xfd 284#>13 string \x0b\xfc 285#>13 string \x0b\xfb 286#>13 string \x0b\xfa 287#>13 string \x0b\xf9 288 289# crypto algo mapper 290 2910 name crypto 292>0 byte 0x00 Plaintext or unencrypted data 293>0 byte 0x01 IDEA 294>0 byte 0x02 TripleDES 295>0 byte 0x03 CAST5 (128 bit key) 296>0 byte 0x04 Blowfish (128 bit key, 16 rounds) 297>0 byte 0x07 AES with 128-bit key 298>0 byte 0x08 AES with 192-bit key 299>0 byte 0x09 AES with 256-bit key 300>0 byte 0x0a Twofish with 256-bit key 301>0 byte 0x0b Camellia with 128-bit key 302>0 byte 0x0c Camellia with 192-bit key 303>0 byte 0x0d Camellia with 256-bit key 304 305# hash algo mapper 306 3070 name hash 308>0 byte 0x01 MD5 309>0 byte 0x02 SHA-1 310>0 byte 0x03 RIPE-MD/160 311>0 byte 0x08 SHA256 312>0 byte 0x09 SHA384 313>0 byte 0x0a SHA512 314>0 byte 0x0b SHA224 315>0 byte 0x0c SHA3-256 316>0 byte 0x0e SHA3-512 317 318# display public key algorithms as human readable text 3190 name key_algo 320>0 byte 0x01 RSA (Encrypt or Sign) 321# keep old look of version 5.28 without parentheses 322>0 byte 0x02 RSA Encrypt-Only 323>0 byte 0x03 RSA (Sign-Only) 324>0 byte 16 ElGamal (Encrypt-Only) 325>0 byte 17 DSA 326>0 byte 18 ECDH 327>0 byte 19 ECDSA 328>0 byte 20 ElGamal (Encrypt or Sign) 329>0 byte 21 Diffie-Hellman 330>0 byte 22 EdDSALegacy 331>0 byte 25 X25519 332>0 byte 26 X448 333>0 byte 27 Ed25519 334>0 byte 28 Ed448 335>0 default x 336>>0 ubyte <29 unknown (pub %d) 337# this should never happen 338>>0 ubyte >28 invalid (%d) 339 340# pgp symmetric encrypted data 341 3420 byte 0x8c PGP symmetric key encrypted data - 343>1 byte 0x0d 344>1 byte 0x0c 345>2 byte 0x04 346>3 use crypto 347>4 byte 0x01 salted - 348>>5 use hash 349>>14 byte 0xd2 . 350>>14 byte 0xc9 . 351>4 byte 0x03 salted & iterated - 352>>5 use hash 353>>15 byte 0xd2 . 354>>15 byte 0xc9 . 355 356# encrypted keymaterial needs s2k & can be checksummed/hashed 357 3580 name chkcrypto 359>0 use crypto 360>1 byte 0x00 Simple S2K 361>1 byte 0x01 Salted S2K 362>1 byte 0x03 Salted&Iterated S2K 363>2 use hash 364 365# all PGP keys start with this prolog 366# containing version, creation date, and purpose 367 3680 name keyprolog 369>0 byte 0x04 370>1 beldate x created on %s - 371>5 byte 0x01 RSA (Encrypt or Sign) 372>5 byte 0x02 RSA Encrypt-Only 373 374# end of secret keys known signature 375# contains e=65537 and the prolog to 376# the encrypted parameters 377 3780 name keyend 379>0 string \x00\x11\x01\x00\x01 e=65537 380>5 use crypto 381>5 byte 0xff checksummed 382>>6 use chkcrypto 383>5 byte 0xfe hashed 384>>6 use chkcrypto 385 386# PGP secret keys contain also the public parts 387# these vary by bitsize of the key 388 3890 name x1024 390>0 use keyprolog 391>6 string \x03\xfe 392>6 string \x03\xff 393>6 string \x04\x00 394>136 use keyend 395 3960 name x2048 397>0 use keyprolog 398>6 string \x80\x00 399>6 string \x07\xfe 400>6 string \x07\xff 401>264 use keyend 402 4030 name x3072 404>0 use keyprolog 405>6 string \x0b\xfe 406>6 string \x0b\xff 407>6 string \x0c\x00 408>392 use keyend 409 4100 name x4096 411>0 use keyprolog 412>6 string \x10\x00 413>6 string \x0f\xfe 414>6 string \x0f\xff 415>520 use keyend 416 417# \x00|\x1f[\xfe\xff]).{1024})' 4180 name x8192 419>0 use keyprolog 420>6 string \x20\x00 421>6 string \x1f\xfe 422>6 string \x1f\xff 423>1032 use keyend 424 425# depending on the size of the pkt 426# we branch into the proper key size 427# signatures defined as x{keysize} 428 4290 name pgpkey 430>0 string \x01\xd8 1024b 431>>2 use x1024 432>0 string \x01\xeb 1024b 433>>2 use x1024 434>0 string \x01\xfb 1024b 435>>2 use x1024 436>0 string \x01\xfd 1024b 437>>2 use x1024 438>0 string \x01\xf3 1024b 439>>2 use x1024 440>0 string \x01\xee 1024b 441>>2 use x1024 442>0 string \x01\xfe 1024b 443>>2 use x1024 444>0 string \x01\xf4 1024b 445>>2 use x1024 446>0 string \x02\x0d 1024b 447>>2 use x1024 448>0 string \x02\x03 1024b 449>>2 use x1024 450>0 string \x02\x05 1024b 451>>2 use x1024 452>0 string \x02\x15 1024b 453>>2 use x1024 454>0 string \x02\x00 1024b 455>>2 use x1024 456>0 string \x02\x10 1024b 457>>2 use x1024 458>0 string \x02\x04 1024b 459>>2 use x1024 460>0 string \x02\x06 1024b 461>>2 use x1024 462>0 string \x02\x16 1024b 463>>2 use x1024 464>0 string \x03\x98 2048b 465>>2 use x2048 466>0 string \x03\xab 2048b 467>>2 use x2048 468>0 string \x03\xbb 2048b 469>>2 use x2048 470>0 string \x03\xbd 2048b 471>>2 use x2048 472>0 string \x03\xcd 2048b 473>>2 use x2048 474>0 string \x03\xb3 2048b 475>>2 use x2048 476>0 string \x03\xc3 2048b 477>>2 use x2048 478>0 string \x03\xc5 2048b 479>>2 use x2048 480>0 string \x03\xd5 2048b 481>>2 use x2048 482>0 string \x03\xae 2048b 483>>2 use x2048 484>0 string \x03\xbe 2048b 485>>2 use x2048 486>0 string \x03\xc0 2048b 487>>2 use x2048 488>0 string \x03\xd0 2048b 489>>2 use x2048 490>0 string \x03\xb4 2048b 491>>2 use x2048 492>0 string \x03\xc4 2048b 493>>2 use x2048 494>0 string \x03\xc6 2048b 495>>2 use x2048 496>0 string \x03\xd6 2048b 497>>2 use x2048 498>0 string \x05X 3072b 499>>2 use x3072 500>0 string \x05k 3072b 501>>2 use x3072 502>0 string \x05{ 3072b 503>>2 use x3072 504>0 string \x05} 3072b 505>>2 use x3072 506>0 string \x05\x8d 3072b 507>>2 use x3072 508>0 string \x05s 3072b 509>>2 use x3072 510>0 string \x05\x83 3072b 511>>2 use x3072 512>0 string \x05\x85 3072b 513>>2 use x3072 514>0 string \x05\x95 3072b 515>>2 use x3072 516>0 string \x05n 3072b 517>>2 use x3072 518>0 string \x05\x7e 3072b 519>>2 use x3072 520>0 string \x05\x80 3072b 521>>2 use x3072 522>0 string \x05\x90 3072b 523>>2 use x3072 524>0 string \x05t 3072b 525>>2 use x3072 526>0 string \x05\x84 3072b 527>>2 use x3072 528>0 string \x05\x86 3072b 529>>2 use x3072 530>0 string \x05\x96 3072b 531>>2 use x3072 532>0 string \x07[ 4096b 533>>2 use x4096 534>0 string \x07\x18 4096b 535>>2 use x4096 536>0 string \x07+ 4096b 537>>2 use x4096 538>0 string \x07; 4096b 539>>2 use x4096 540>0 string \x07= 4096b 541>>2 use x4096 542>0 string \x07M 4096b 543>>2 use x4096 544>0 string \x073 4096b 545>>2 use x4096 546>0 string \x07C 4096b 547>>2 use x4096 548>0 string \x07E 4096b 549>>2 use x4096 550>0 string \x07U 4096b 551>>2 use x4096 552>0 string \x07. 4096b 553>>2 use x4096 554>0 string \x07> 4096b 555>>2 use x4096 556>0 string \x07@ 4096b 557>>2 use x4096 558>0 string \x07P 4096b 559>>2 use x4096 560>0 string \x074 4096b 561>>2 use x4096 562>0 string \x07D 4096b 563>>2 use x4096 564>0 string \x07F 4096b 565>>2 use x4096 566>0 string \x07V 4096b 567>>2 use x4096 568>0 string \x0e[ 8192b 569>>2 use x8192 570>0 string \x0e\x18 8192b 571>>2 use x8192 572>0 string \x0e+ 8192b 573>>2 use x8192 574>0 string \x0e; 8192b 575>>2 use x8192 576>0 string \x0e= 8192b 577>>2 use x8192 578>0 string \x0eM 8192b 579>>2 use x8192 580>0 string \x0e3 8192b 581>>2 use x8192 582>0 string \x0eC 8192b 583>>2 use x8192 584>0 string \x0eE 8192b 585>>2 use x8192 586>0 string \x0eU 8192b 587>>2 use x8192 588>0 string \x0e. 8192b 589>>2 use x8192 590>0 string \x0e> 8192b 591>>2 use x8192 592>0 string \x0e@ 8192b 593>>2 use x8192 594>0 string \x0eP 8192b 595>>2 use x8192 596>0 string \x0e4 8192b 597>>2 use x8192 598>0 string \x0eD 8192b 599>>2 use x8192 600>0 string \x0eF 8192b 601>>2 use x8192 602>0 string \x0eV 8192b 603>>2 use x8192 604 605# PGP RSA (e=65537) secret (sub-)key header 606 6070 byte 0x97 PGP Secret Sub-key - 608>1 use pgpkey 6090 byte 0x9d 610# Update: Joerg Jenderek 611# secret subkey packet (tag 7) with same structure as secret key packet (tag 5) 612# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len 613>1 ubeshort >0 614#>1 ubeshort x \b, body length %#x 615# next packet type often 88h,89h~(tag 2)~Signature Packet 616#>>(1.S+3) ubyte x \b, next packet type %#x 617# skip Dragon.SHR DEMO.INIT by looking for positive version 618>>3 ubyte >0 619# skip BUISSON.13 GUITAR1 by looking for low version number 620>>>3 ubyte <5 PGP Secret Sub-key 621# sub-key are normally part of secret key. So it does not occur as standalone file 622#!:ext bin 623# version 2,3~old 4~new . Comment following line for version 5.28 look 624>>>>3 ubyte x (v%d) 625>>>>3 ubyte x - 626# old versions 2 or 3 but no real example found 627>>>>3 ubyte <4 628# 2 byte for key bits in version 5.28 look 629>>>>>11 ubeshort x %db 630>>>>>4 beldate x created on %s - 631# old versions use 2 additional bytes after time stamp 632#>>>>>8 ubeshort x %#x 633# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman 634>>>>>10 use key_algo 635>>>>>(11.S/8) ubequad x 636# look after first key 637>>>>>>&5 use keyend 638# new version 639>>>>3 ubyte >3 640>>>>>9 ubeshort x %db 641>>>>>4 beldate x created on %s - 642# display key algorithm 643>>>>>8 use key_algo 644>>>>>(9.S/8) ubequad x 645# look after first key for something like s2k 646>>>>>>&3 use keyend 647