OpenPGP: a truncated message is now reported rather than read as a clean end of message - the AEAD decryption streams no longer let an EOFException escape to BCPGInputStream.nextPacketTag(), and OpenPGPMessageInputStream.close() now closes its layer's integrity-protected stream so the SEIPDv1 MDC is always verified.

Author: dghgit

docs/releasenotes.md

@@ -158,6 +158,8 @@ Date: 2026, TBD
 - The structural check on decoded ASN.1 UTCTime / GeneralizedTime content introduced in 1.85 gave no way through for the zone-less UTCTime "YYMMDDHHMMSS", so a single such field made the structure carrying it unreadable: a CMS SignedData whose signing-time attribute lacked its trailing "Z" - a shape found in signatures in circulation - failed to load through both CMSSignedData and CMSSignedDataParser.getSignerInfos() with "invalid UTCTime format", and nothing else in the message could be examined. The value is not a legal UTCTime, X.680 sec. 47.3 making the zone mandatory, but ASN1UTCTime.getTime() has always carried an explicit branch reading it as GMT, so it does denote a real instant and re-encodes unchanged. Setting the new system/security property org.bouncycastle.asn1.allow_zoneless_utctime (Properties.ASN1_ALLOW_ZONELESS_UTCTIME) to "true" admits it - and admits nothing else: every other malformed value, the zone-less "YYMMDDHHMM" without seconds included, is still rejected with the property set, and GeneralizedTime, whose zone is optional to begin with, is unaffected. The property has to be set for the value to decode at all, generation is unaffected, and the value is still not DER, so writing it through a DEROutputStream is refused when Properties.ASN1_ALLOW_NON_DER_TIME is "false". Separately, CMSSignedDataParser.getSignerInfos() let a SignerInfo that failed to decode escape as an unchecked IllegalStateException; it now reports it as the CMSException the method declares (github #2411).
 - The BCJSSE key managers could not select an SM2 certificate for TLS 1.3. ProvX509KeyManager registers a TLS 1.3 EC public-key filter per named curve, but only for the NIST and Brainpool curves, so a key store entry on the sm2p256v1 curve was never matched against the "EC/sm2p256v1" key type the sm2sig_sm3 signature scheme asks for, and a server configured for the RFC 8998 cipher suites failed the handshake with "found no selectable cipher suite among the 1 offered: [TLS_SM4_GCM_SM3]" despite the provider supporting both suites and holding a usable credential. The filter is now registered for curveSM2 on both the client and the server side. As before, the RFC 8998 profile requires explicit configuration: the curveSM2 named group and the sm2sig_sm3 signature scheme are not enabled by default (github #2416).
 - The BC "PKIX" CertPathValidator in the chain validity model (PKIXExtendedParameters.CHAIN_VALIDITY_MODEL) could not use the ISIS-MTT dateOfCertGen extension. CertPathValidatorUtilities.getValidCertDateFromValidityModel() passed the raw result of X509Certificate.getExtensionValue(), which is the DER encoding of the extnValue OCTET STRING, straight to ASN1GeneralizedTime.getInstance(), so any end-entity certificate carrying the extension failed validation with "Could not validate time of certificate." rather than having its issuer checked at the recorded generation time. The OCTET STRING is now unwrapped first, and the underlying decoding error is chained on the reported exception.
+- OpenPGP AEAD decryption (SEIPDv2 and the v5 AEAD packet) still accepted a truncated message without reporting an error, by a route the 1.85 final-tag fix did not cover. Truncation that leaves the enclosing packet length untouched raises an EOFException, which BCPGInputStream.nextPacketTag() reads as a clean end of message; when the literal packet ended on an AEAD chunk boundary and the consumer read in increments smaller than one chunk, the final message tag was never reached, so the caller was given the plaintext of the authenticated chunks with every following packet silently dropped and no error raised - where RFC 9580 sec. 13.7 requires a clear error as soon as the truncation is detected. BcAEADUtil and JceAEADUtil now re-throw that EOF as a plain IOException, which nextPacketTag() does not launder; the legacy jdk1.1 operator overlay, which had neither this fix nor the 1.85 one, received both.
+- The high-level OpenPGP API (org.bouncycastle.openpgp.api) performed no integrity check at all on a truncated SEIPDv1 (MDC) message, releasing its plaintext with no error. Same cause as the entry above: IntegrityProtectedInputStream verifies the MDC from close(), and reached close() only by closing itself when a read of it returned -1, which a truncated message never produces - so PGPEncryptedData.verify() never ran and the recipient was handed CFB-decrypted plaintext on which nothing had been checked. OpenPGPMessageInputStream.close() now closes its layer's integrity-protected stream itself, and IntegrityProtectedInputStream.close() was made idempotent as java.io.Closeable requires, which that depends on - the stream is closed twice on the ordinary path and verify() cannot be run twice. The low-level API is unaffected: a caller that invokes PGPEncryptedData.verify() directly gets the check regardless.
 
 ### 2.1.3 Additional Features and Functionality
 

pg/src/main/java/org/bouncycastle/openpgp/IntegrityProtectedInputStream.java

@@ -16,6 +16,8 @@ public class IntegrityProtectedInputStream
 
     private final PGPEncryptedData esk;
 
+    private boolean closed;
+
     public IntegrityProtectedInputStream(InputStream in, PGPEncryptedData dataPacket)
     {
         super(in);
@@ -62,6 +64,13 @@ public int read(byte[] b, int off, int len)
     public void close()
             throws IOException
     {
+        // verify once only: this stream is closed twice on the ordinary path and verify() cannot be repeated
+        if (closed)
+        {
+            return;
+        }
+        closed = true;
+
         super.close();
         if (esk.getEncData() instanceof SymmetricEncIntegrityPacket)
         {

pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPMessageInputStream.java

@@ -48,6 +48,8 @@ public class OpenPGPMessageInputStream
     private final Layer layer; // the packet layer processed by this input stream
 
     private InputStream in;
+    // this layer's IntegrityProtectedInputStream, if it has one - closed by close(), see there
+    private InputStream integrityProtectedIn;
     private final List<PacketHandler> packetHandlers = new ArrayList<PacketHandler>()
     {{
         add(new SignatureListHandler());
@@ -142,6 +144,12 @@ public void close()
             }
         }
 
+        // close it here: a truncated message never returns the -1 that makes it self-close and verify the MDC
+        if (integrityProtectedIn != null)
+        {
+            integrityProtectedIn.close();
+        }
+
         resultBuilder.verifySignatures(processor);
         resultBuilder.closeLayer();
     }
@@ -682,6 +690,7 @@ public void handle(Object packet)
             OpenPGPMessageProcessor.Decrypted decrypted = processor.decrypt(encryptedDataList);
 
             resultBuilder.encrypted(decrypted);
+            integrityProtectedIn = decrypted.inputStream;
             processNestedStream(decrypted.inputStream);
         }
 

pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcAEADUtil.java

@@ -1,5 +1,6 @@
 package org.bouncycastle.openpgp.operator.bc;
 
+import java.io.EOFException;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -327,7 +328,7 @@ public PGPAeadInputStream(boolean isV5StyleAEAD, InputStream in,
             this.aaData = aaData;
 
             // prime with 2 * tag len bytes.
-            Streams.readFully(in, buf, 0, tagLen + tagLen);
+            readAeadFully(buf, 0, tagLen + tagLen);
 
             // load the first block
             this.data = readBlock();
@@ -407,7 +408,7 @@ private byte[] readBlock()
         {
             // we initialise with the first 16 bytes as there is an additional 16 bytes following
             // the last chunk (which may not be the exact chunklength).
-            int dataLen = Streams.readFully(in, buf, tagLen + tagLen, chunkLength);
+            int dataLen = readAeadFully(buf, tagLen + tagLen, chunkLength);
             if (dataLen == 0)
             {
                 if (!aeadComplete)
@@ -454,12 +455,26 @@ private byte[] readBlock()
             }
             else
             {
-                Streams.readFully(in, buf, tagLen, tagLen);   // read the next tag bytes
+                readAeadFully(buf, tagLen, tagLen);   // read the next tag bytes
             }
 
             return decData;
         }
 
+        // truncation must not escape as an EOFException - nextPacketTag() reads one as a clean end of message
+        private int readAeadFully(byte[] b, int off, int len)
+            throws IOException
+        {
+            try
+            {
+                return Streams.readFully(in, b, off, len);
+            }
+            catch (EOFException e)
+            {
+                throw Exceptions.ioException("truncated AEAD data: " + e.getMessage(), e);
+            }
+        }
+
         // Verify the trailing message tag, which is held in buf[0..tagLen). Called both for a short
         // final data chunk and for a chunk-aligned message whose final tag would otherwise be skipped.
         private void verifyFinalTag()

pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JceAEADUtil.java

@@ -1,5 +1,6 @@
 package org.bouncycastle.openpgp.operator.jcajce;
 
+import java.io.EOFException;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -311,7 +312,7 @@ public PGPAeadInputStream(boolean isV5AEAD, InputStream in,
             this.aaData = aaData;
 
             // prime with 2 * tag len bytes.
-            Streams.readFully(in, buf, 0, aeadTagLength + aeadTagLength);
+            readAeadFully(buf, 0, aeadTagLength + aeadTagLength);
 
             // load the first block
             this.data = readBlock();
@@ -391,7 +392,7 @@ private byte[] readBlock()
         {
             // we initialise with the first 16 bytes as there is an additional 16 bytes following
             // the last chunk (which may not be the exact chunklength).
-            int dataLen = Streams.readFully(in, buf, aeadTagLength + aeadTagLength, chunkLength);
+            int dataLen = readAeadFully(buf, aeadTagLength + aeadTagLength, chunkLength);
             if (dataLen == 0)
             {
                 if (!aeadComplete)
@@ -439,12 +440,26 @@ private byte[] readBlock()
             }
             else
             {
-                Streams.readFully(in, buf, aeadTagLength, aeadTagLength);   // read the next tag bytes
+                readAeadFully(buf, aeadTagLength, aeadTagLength);   // read the next tag bytes
             }
 
             return decData;
         }
 
+        // truncation must not escape as an EOFException - nextPacketTag() reads one as a clean end of message
+        private int readAeadFully(byte[] b, int off, int len)
+            throws IOException
+        {
+            try
+            {
+                return Streams.readFully(in, b, off, len);
+            }
+            catch (EOFException e)
+            {
+                throw Exceptions.ioException("truncated AEAD data: " + e.getMessage(), e);
+            }
+        }
+
         // Verify the trailing message tag, which is held in buf[0..aeadTagLength). Called both for a
         // short final data chunk and for a chunk-aligned message whose final tag would otherwise be skipped.
         private void verifyFinalTag()

pg/src/main/jdk1.1/org/bouncycastle/openpgp/operator/jcajce/JceAEADUtil.java

@@ -1,5 +1,6 @@
 package org.bouncycastle.openpgp.operator.jcajce;
 
+import java.io.EOFException;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -292,6 +293,7 @@ static class PGPAeadInputStream
         private int dataOff;
         private long chunkIndex = 0;
         private long totalBytes = 0;
+        private boolean aeadComplete = false; // set once the trailing message tag has been verified
         private boolean v5StyleAEAD;
 
         /**
@@ -329,7 +331,7 @@ public PGPAeadInputStream(boolean isV5AEAD, InputStream in,
             this.aaData = aaData;
 
             // prime with 2 * tag len bytes.
-            Streams.readFully(in, buf, 0, aeadTagLength + aeadTagLength);
+            readAeadFully(buf, 0, aeadTagLength + aeadTagLength);
 
             // load the first block
             this.data = readBlock();
@@ -409,9 +411,20 @@ private byte[] readBlock()
         {
             // we initialise with the first 16 bytes as there is an additional 16 bytes following
             // the last chunk (which may not be the exact chunklength).
-            int dataLen = Streams.readFully(in, buf, aeadTagLength + aeadTagLength, chunkLength);
+            int dataLen = readAeadFully(buf, aeadTagLength + aeadTagLength, chunkLength);
             if (dataLen == 0)
             {
+                if (!aeadComplete)
+                {
+                    // A chunk-aligned message (plaintext an exact multiple of chunkLength) ends after a
+                    // full-size final data chunk, so the trailing message tag was pre-read into the
+                    // look-ahead (buf[0..aeadTagLength)) but the full-size-chunk path below never verified it.
+                    // Verify it now, before signalling EOF, so that truncation at a chunk boundary
+                    // (dropping trailing chunks plus the final tag) is rejected rather than accepted as
+                    // authentic - RFC 9580 5.13.2 relies on the final tag to authenticate the total length.
+                    verifyFinalTag();
+                    aeadComplete = true;
+                }
                 return null;
             }
 
@@ -441,31 +454,55 @@ private byte[] readBlock()
 
             if (dataLen != chunkLength)     // it's our last block
             {
-                adata = PGPAeadOutputStream.getAdata(v5StyleAEAD, aaData, chunkIndex, totalBytes);
-                try
-                {
-                    if (v5StyleAEAD)
-                    {
-                        JceAEADCipherUtil.setUpAeadCipher(c, secretKey, Cipher.DECRYPT_MODE, getNonce(iv, chunkIndex), 128, Arrays.concatenate(adata, Pack.longToBigEndian(totalBytes)));
-                    }
-                    else
-                    {
-                        JceAEADCipherUtil.setUpAeadCipher(c, secretKey, Cipher.DECRYPT_MODE, getNonce(iv, chunkIndex), 128, adata);
-                    }
+                verifyFinalTag();
+                aeadComplete = true;
+            }
+            else
+            {
+                readAeadFully(buf, aeadTagLength, aeadTagLength);   // read the next tag bytes
+            }
+
+            return decData;
+        }
+
+        // Verify the trailing message tag, which is held in buf[0..aeadTagLength). Called both for a short
+        // final data chunk and for a chunk-aligned message whose final tag would otherwise be skipped.
+        private void verifyFinalTag()
+            throws IOException
+        {
+            byte[] adata = PGPAeadOutputStream.getAdata(v5StyleAEAD, aaData, chunkIndex, totalBytes);
 
-                    c.doFinal(buf, 0, aeadTagLength); // check final tag
+            try
+            {
+                if (v5StyleAEAD)
+                {
+                    JceAEADCipherUtil.setUpAeadCipher(c, secretKey, Cipher.DECRYPT_MODE, getNonce(iv, chunkIndex), 128, Arrays.concatenate(adata, Pack.longToBigEndian(totalBytes)));
                 }
-                catch (Exception e)
+                else
                 {
-                    throw new IOException("exception processing final tag: " + e.getMessage());
+                    JceAEADCipherUtil.setUpAeadCipher(c, secretKey, Cipher.DECRYPT_MODE, getNonce(iv, chunkIndex), 128, adata);
                 }
+
+                c.doFinal(buf, 0, aeadTagLength); // check final tag
             }
-            else
+            catch (Exception e)
             {
-                Streams.readFully(in, buf, aeadTagLength, aeadTagLength);   // read the next tag bytes
+                throw new IOException("exception processing final tag: " + e.getMessage());
             }
+        }
 
-            return decData;
+        // truncation must not escape as an EOFException - nextPacketTag() reads one as a clean end of message
+        private int readAeadFully(byte[] b, int off, int len)
+            throws IOException
+        {
+            try
+            {
+                return Streams.readFully(in, b, off, len);
+            }
+            catch (EOFException e)
+            {
+                throw new IOException("truncated AEAD data: " + e.getMessage());
+            }
         }
     }