RIPEMD160 issue

[madtocc]

@jerson hey!

I'm trying to encrypt a message using the flutter package and I'm getting an error due the hash used. The error is due the GO library not directly related to your package... I think some ppl will eventually face this issue as well tho.

The error is:
openpgp: invalid argument: cannot encrypt because no candidate hash functions are compiled in. (Wanted RIPEMD160 in this case.)

I did a little research and apparently golang.org/x/crypto/openpgp package is frozen and deprecated. It is suggested to use a fork instead github.com/ProtonMail/go-crypto.
I have tried here directly in GO using the fork and I am able to encrypt the message. Is it possible to replace golang.org/x/crypto/openpgp package with the ProtonMail fork i.e github.com/ProtonMail/go-crypto/openpgp package?

Thanks

[jerson]

hey @madtocc thanks for report the issue i think that this is the fix for that

import (
	// this is a temporary fix to add missing crypto
	_ "golang.org/x/crypto/ripemd160"
)

btw im using that fix in the go implementation for a flutter library

https://github.com/jerson/flutter-openpgp/blob/master/go/plugin.go

[jerson]

i didn't know about github.com/ProtonMail/go-crypto but im gonna take a look, the reason to freeze our version is to reduce the final binary size, but since its a fork can be a good replacement

[madtocc]

Thanks for the prompt reply :)
I saw the _ "golang.org/x/crypto/ripemd160" but I don't know if it actually fixes it, apparently not...

There's an info here golang/go#44226 regarding the frozen/deprecated x/crypto/openpgp. They suggest ProtonMail fork as an alternative and since it is backwards compatible with x/crypto/openpgp it shouldn't bring any issues (hopefully 😅)

[jerson]

Thanks, im gonna replace and run some test to make sure that everything works as expected. i will let you know when is updated

[madtocc]

Thanks, sure lmk I'll be happy to test here as well.

[jerson]

hey i just release a new version with this commit 943f208
https://github.com/jerson/openpgp-mobile/releases/tag/v1.2.0

there is a small diference in size (left: before, right: after)

but i think is acceptable, can you please help me to test
thanks.

[madtocc]

@jerson sure mate, I will give a go later today and will provide feedback.
Thanks!

edit: regarding the size I don't think it will make much difference :)

[madtocc]

Hey @jerson , awesome. LGTM!

I have updated the flutter repo to use this updated version (https://github.com/madtocc/flutter-openpgp), I just ran the upgrade_bridge_libs and updated the files + the go mod to use v1.2.0. Second time in my life using GO here (first was to check if the Protonmail fork worked before creating the issue 😅), so please let me know if anything else is needed. I have added to the bash script to auto update the files.
Let me know if you will update later or I can create a PR (if you want). I was able to test on Android, iOS, web and MacOS and works perfectly fine for me. Great job and thanks again! :)

PS: I also ran the upgrade flatbuffers but it was throwing errors here so just updated the libs and all good.

[jerson]

hey @madtocc thanks for that.

https://pub.dev/packages/openpgp/versions/3.1.0

version 3.1.0 was released

for now im gonna close this issue but feel free to reopen if you want

have a great day.