php GnuPG解密超时

Question

我正在尝试使用 php GnuPG 函数使用私钥解密 gpg 文件。但是，当尝试解密时，它看起来像 php 只是挂起或永远完成。我正在尝试解密一个包含一句话的简单测试文件。

我可以离线解密文件(例如使用 GNU Privacy Assistant)。

我想我已经设置好了权限-

-bash-4.1$ gpgconf --list-dirs

/home/jdoe/.gnupg/gpg.conf, perms: 0770
/home/jdoe/.gnupg/pubring.gpg~, perms: 0770
/home/jdoe/.gnupg/secring.gpg, perms: 0660
/home/jdoe/.gnupg/private-keys-v1.d, perms: 0700
/home/jdoe/.gnupg/random_seed, perms: 0600
/home/jdoe/.gnupg/pubring.gpg, perms: 0770
/home/jdoe/.gnupg/trustdb.gpg, perms: 0770

但是，如果我将一个新文件写入“/home/jdoe/.gnupg/”，它会提供 644 权限(不确定这是否重要)。

/home/jdoe/.gnupg/xxxtest.txt.gpg, perms: 0644

我(认为)我已经成功导入了私钥。 KeyInfo 如下。相关 key 的指纹和 key ID 为 888(我已将其实际值替换为 888)。我包括了所有相关的 key (我已将不相关的指纹/ key 信息替换为 777)。

$info = $gpg->keyinfo(''); echo 'Key info:' . print_r($info, true);

Array ( [0] => Array ( [disabled] => [expired] => [revoked] => [is_secret] => [can_sign] => 1 [can_encrypt] => 1 [uids] => Array ( [0] => Array ( [name] => ApacheTest [comment] => Testing [email] => apache@localhost [uid] => ApacheTest (Testing) [revoked] => [invalid] => ) ) [subkeys] => Array ( [0] => Array ( [fingerprint] => 777 [keyid] => 777 [timestamp] => 1203433839 [expires] => 0 [is_secret] => [invalid] => [can_encrypt] => [can_sign] => 1 [disabled] => [expired] => [revoked] => ) [1] => Array ( [fingerprint] => 777 [keyid] => 777 [timestamp] => 1203433840 [expires] => 0 [is_secret] => [invalid] => [can_encrypt] => 1 [can_sign] => [disabled] => [expired] => [revoked] => ) ) ) [1] => Array ( [disabled] => [expired] => [revoked] => [is_secret] => [can_sign] => 1 [can_encrypt] => 1 [uids] => Array ( [0] => Array ( [name] => John Doe [comment] => [email] => john.doe@example.com [uid] => John Doe [revoked] => [invalid] => ) ) [subkeys] => Array ( [0] => Array ( [fingerprint] => 888 [keyid] => 888 [timestamp] => 1224013510 [expires] => 0 [is_secret] => [invalid] => [can_encrypt] => [can_sign] => 1 [disabled] => [expired] => [revoked] => ) [1] => Array ( [fingerprint] => 777 [keyid] => 777 [timestamp] => 1224013510 [expires] => 0 [is_secret] => [invalid] => [can_encrypt] => 1 [can_sign] => [disabled] => [expired] => [revoked] => ) ) ) )

我的问题是，当尝试使用下面的代码解密时，它看起来像 php 只是挂起或永远完成(实际上超过了 max_execution_time，但没有显示有关它的错误消息)。

$gpg = new gnupg();
$gpg->seterrormode(gnupg::ERROR_EXCEPTION); 
putenv("GNUPGHOME=/home/jdoe/.gnupg");

$encryptedContent = file_get_contents($filePathAndName);

$pw = [];
$fingerprint = [];
if($gpg->adddecryptkey($recipient, $pw)) {
    echo "Add decrypt key returned true.";
} else {
    echo "Could not add decrypt key. GPG error: " . $gpg -> geterror();
}

//I know we get to this spot
try {
    $plaintext = $gpg->decrypt($encryptedContent);
    echo '<pre>' . $plaintext . '</pre>';
} catch (Exception $e) {
    die('ERROR: ' . $e->getMessage());
}

关于为什么这不起作用的任何想法？非常感谢。

==============ls -la/home/jdoe/.gnupg 的输出

drwxrwx--- 3 jdoe apache 4096 Mar 31 23:45 .
drwxr-xr-x 19 jdoe root 12288 Apr 1 09:39 ..
-rwxrwx--- 1 jdoe apache 9188 Mar 28 15:36 gpg.conf
drwx------ 2 apache apache 4096 Mar 31 21:26 private-keys-v1.d
-rwxrwx--- 1 apache apache 2479 Mar 31 21:26 pubring.gpg
-rwxrwx--- 1 apache apache 913 Mar 31 20:28 pubring.gpg~
-rw------- 1 apache apache 600 Mar 31 20:32 random_seed
-rw-rw---- 1 jdoe apache 1978 Mar 28 21:05 secring.gpg
-rwxrwx--- 1 apache apache 10 Mar 31 20:28 test.txt
-rwxrwx--- 1 jdoe apache 1200 Mar 31 20:28 trustdb.gpg
-rw-r--r-- 1 apache apache 347 Mar 31 23:30 xxxtest.txt.gpg

能否从命令行解密文件，需要多长时间？

Will get back to you with this information (working with an SA on this, I only have ftp access to the machine).

试试增加PHP的错误报告？

Already done... it just spins (which I assume means it times out, out exit_on_timeout is off). I've tried it with a 10 minute and 30 second timeout. Result is the same. The test file we are decrypting is less than 100 characters.

您可能想尝试不设置主目录，而是使用 import($keydata) 导入 key

Same result

尝试设置不同的主目录？

I created /home/jdoe/.gnupg/temp, chmod permissions to 777. I set this as a home directory for gpg. I attempted to import the private key. But, $gpg->keyinfo('') returns nothing. This time when trying to $gpg->adddecryptkey, it fails with this error - "Uncaught exception 'Exception' with message 'get_key failed'".

谢谢

Answer 1

如果有人仍然面临这个问题(就像我一样)，请阅读:

As of gnupg version 2, it is not possible to pass a plain password any more. The parameter is simply ignored. Instead, a pinentry application will be launched in case of php running in cli mode. In cgi or apache mode, opening the key will fail. The simplest solution is to use keys without passwords.

来自:http://php.net/manual/en/function.gnupg-decrypt.php

我通过 cron 运行的 php 脚本总是无法解密，直到我删除密码。我尝试使用不带密码的 key ，它对我来说效果很好。

干杯!