python - 如何防止基于 gpgme 的 Python 脚本中的密码缓存？

Question

以下简短的 Python 脚本采用三个命令行参数:密码、输入路径和输出路径。然后使用密码解密输入路径的内容，并将解密后的内容放入输出路径。

from gpg import Context
import sys

pp = sys.argv[1]    # passphrase
enc = sys.argv[2]   # input file (assumed to be encrypted)
dec = sys.argv[3]   # output file

with open(enc, 'rb') as reader, open(dec, 'wb') as writer, Context() as ctx:

    try:

        ctx.decrypt(reader, sink=writer, passphrase=pp)

    except Exception as e:
        print(str(e), file=sys.stderr)

只要提供正确的密码短语，此解密就可以正常工作，但显然会导致缓存此类正确的密码短语，因此无论提供的密码短语如何，任何后续解密尝试都会成功。 (我在本文末尾更完整地说明了我的意思，以及版本详细信息。)

显然，正在进行一些密码缓存，但我不太了解细节。

我想知道的是:如何修改 Python 脚本以使其禁用密码缓存？请注意，我对如何在脚本外禁用密码缓存不感兴趣!我希望脚本自动禁用密码缓存。这可能吗？

---

下面是我上面提到的内容的详细示例。脚本 ./demo.py 就是我在上面列出的来源。重要提示:下面给出的代码仅在我从命令行执行时才表现得如此。如果我将它放在一个文件中并将其作为脚本执行(或获取)，那么所有使用错误密码的解密都会失败，无论之前使用正确密码进行的任何成功解密都是如此。

# Prologue: preparation

# First, define some variables

% ORIGINAL=/tmp/original.txt
% ENCRYPTED=/tmp/encrypted.gpg
% DECRYPTED=/tmp/decrypted.txt
% PASSPHRASE=yowzayowzayowza

# Next, create a cleartext original:

% echo 'Cool story, bro!' > "$ORIGINAL"

# Next, encrypt the original using /usr/bin/gpg

% rm -f "$ENCRYPTED"
% /usr/bin/gpg --batch --symmetric --cipher-algo=AES256 --compress-algo=zlib --passphrase="$PASSPHRASE" --output="$ENCRYPTED" "$ORIGINAL"

# Confirm encryption

% od -c "$ENCRYPTED"
0000000 214  \r 004  \t 003 002 304 006 020   %   q 353 335 212 361 322
0000020   U 001   w 350 335   K 347 320 260 224 227 025 275 274 033   X
0000040 020 352 002 006 254 331 374 300 221 265 021 376 254   9   $   <
0000060 233 275 361 226 340 177 330   !   c 372 017   & 300 352   $   k
0000100 252 205 244 336 222   N 027 200   | 211 371   r   Z   ] 353   6
0000120 261 177   b 336 026 023 367 220 354 210 265 002   :   r 262 037
0000140 367   L   H 262 370    
0000146


# Now, the demonstration proper.

# Initially, decryption with the wrong passphrase fails:

% rm -f "$DECRYPTED"
% python ./demo.py "certainly the wrong $PASSPHRASE" "$ENCRYPTED" "$DECRYPTED"
gpgme_op_decrypt_verify: GPGME: Decryption failed


# Decryption with the right passphrase succeeds:

% rm -f "$DECRYPTED"
% python ./demo.py "$PASSPHRASE" "$ENCRYPTED" "$DECRYPTED"
% od -c "$DECRYPTED"
0000000   C   o   o   l       s   t   o   r   y   ,       b   r   o   !
0000020  \n
0000021


# After the first successful decryption with the right
# passphrase, decryption with the wrong passphrase always
# succeeds:

% rm -f "$DECRYPTED"
% python ./demo.py "certainly the wrong $PASSPHRASE" "$ENCRYPTED" "$DECRYPTED"
% od -c "$DECRYPTED"
0000000   C   o   o   l       s   t   o   r   y   ,       b   r   o   !
0000020  \n
0000021


# Some relevant version info

% python -c 'import gpg; print((gpg.version.versionstr, gpg.version.gpgme_versionstr))'
('1.10.0', '1.8.0')

% gpg --version
gpg (GnuPG) 2.1.18
libgcrypt 1.7.6-beta
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/kj146/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

% python --version
Python 3.5.3

% uname -ar
Linux parakeet 3.16.0-4-amd64 #1 SMP Debian 3.16.43-2 (2017-04-30) x86_64 GNU/Linux

Answer 1

深入挖掘 C gpgme 库(这是您使用的 Python 库正在包装的内容)，有:

https://www.gnupg.org/documentation/manuals/gpgme/Context-Flags.html#Context-Flags

"no-symkey-cache"
For OpenPGP disable the passphrase cache used for symmetrical en- and decryption.
This cache is based on the message specific salt value. Requires at least GnuPG
2.2.7 to have an effect.

我不确定上下文如何与文件系统或 GPG 代理交互，但您的第一次尝试应该是将此标志设置为 true。