Skip to content

Reserved packet tag 0 accepted — RFC 4880 §4.3 MUST NOT violation #2397

Description

@afldl

RNP's packet parser accepts OpenPGP packets with tag value 0. RFC 4880 §4.3 explicitly says: "0 — Reserved - a packet tag MUST NOT have this value."

What happens:

$ rnp --list-packets tag0_input.gpg
:off 0: packet header 0xc001 (tag 0, len 1)
Skipping Unknown pkt: 0

RNP accepts it (exit code 0). GnuPG correctly rejects it:

$ gpg --list-packets tag0_input.gpg
gpg: no valid OpenPGP data found.

Location: src/librepgp/stream-packet.cppstream_peek_packet_hdr() / stream_dump_packets_raw()

Impact: Informational / RFC compliance. No direct security impact since the packet content is skipped. But accepting reserved values could cause interop issues or problems if tag 0 gets assigned a meaning in future RFCs.

Found through differential fuzzing (PathDiff), comparing RNP, GnuPG, and PGPy.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions