OpenPGP-Key-Analyzer

An Open Source Python CLI, which can parse keyfiles conforming to the OpenPGP standard and analyze them for vulnerability to known cryptographic weaknesses

Supported Formats

The Analyzer supports OpenPGP Key Files in ASCII-armored or Binary Format.
Both RFC 4880 and RFC 9580 are supported.

⚠️ If no warning is created for a given key this does not automatically make the key secure against any attack. It only indicates, that no weakness to the already implemented vulnerabilities could be detected!

Installation

The OpenPGP Key Analyzer can be installed via pip (it is encouraged to use a virtual environment):
pip install OpenPGPKeyAnalyzer
Alternatively you can execute the OpenPGPKeyAnalyzerApp.py file in the OpenPGPKeyAnalyzer Directory directly from this repository.

Usage

If installed via pip: Enter the command openpgp-analyze in a shell wherever you installed the application to.

⚠️ The first time you use this command a settings.json file will be created in an specified directory, if no settings.json yet exists there. This file will be read and written to by the application and can alter the workflow of evaluations. It therefore poses a potential security risk!

After starting the application, a Python CLI will start. At the moment, the following commands are supportet:

1. ? or help: Displays the allowed commands of the cli as well as their docstring
2. settings: Display the current settings and possibly alter them
3. analyze: Enter an OpenPGP Keyfile and evaluate it for cryptographic vulnerabilities
4. analyzedir: Enter the path to a directory and evaluate all OpenPGP Keyfiles in it. Only Keyfiles on the top level of the directory will be evaluated. No recursive check in subdirectories is currently implemented
5. sources: Prints the sources for implemented vulnerabilities onto the command line.

Implemented Checks

1. Deprecated Key Version: Checks if the version of a given Keyfile is deprecated according to the specified RFC
2. Key lengths: Checks wether a given Keyfile has an key length that is considered insecure according to the NIST and BSI specifications. Additionally, users can specify an effective key length against which Keyfiles should be checked
3. Deprecated algorithm; Checks, wether a given Keyfile uses an deprecated algorithm
4. RSA specific checks:
   1. Fermat Factoring Algorithm: Checks an RSA key for vulnerability to Fermat's Factoring Algorithm
   2. Low private exponent: Checks an RSA secret key for low private exponent
   3. Low public exponent: Checks an RSA key for low public exponent
   4. ROCA: Checks an RSA key for the ROCA vulnerability
5. Elgamal specific checks: No further checks implemented yet
6. DSA specific checks: No further checks implemented yet
7. ECC specific checks: No further checks implemented yet

Settings