openpgpjs/openpgpjs — pull request #116 by jaekwon (2013-10-17 07:05:26+00:00)
Title: Fixed #108, decryptAndVerifySignature() vuln.

This fixes a terrible vulnerability where an attacker can force a message that appears to have a valid signature for a given text, when in fact the signature is for something else.

The function signature changed because, well, it needs to change. The old function signature makes no sense at all.

I did manage to finangle a bit to keep the signature the same for the decrypt() function.

Also added new function decryptWithoutVerification.

I have not generated the docs.