diff options
| author | Werner Koch <[email protected]> | 2022-10-24 15:38:49 +0000 |
|---|---|---|
| committer | Werner Koch <[email protected]> | 2022-10-28 10:17:46 +0000 |
| commit | d770715e15744dc029e19e2c4207ee71c2ddf633 (patch) | |
| tree | 63c64e7a3384e66720e4c7b7035a20d88160ae2b | |
| parent | gpgsm: Use macro constants for cert_usage_p. (diff) | |
| download | gnupg-d770715e15744dc029e19e2c4207ee71c2ddf633.tar.gz gnupg-d770715e15744dc029e19e2c4207ee71c2ddf633.zip | |
gpgsm: Allow ECC encryption keys with just keyAgreement specified.
* sm/certlist.c (cert_usage_p): Allow keyAgreement for ECC.
* sm/fingerprint.c (gpgsm_is_ecc_key): New.
--
For ECC encryption keys keyAgreement is the keyUsage we want.
GnuPG-bug-id: 6253
| -rw-r--r-- | sm/certlist.c | 3 | ||||
| -rw-r--r-- | sm/fingerprint.c | 12 | ||||
| -rw-r--r-- | sm/gpgsm.h | 1 |
3 files changed, 13 insertions, 3 deletions
diff --git a/sm/certlist.c b/sm/certlist.c index fae760b07..94f85d2b2 100644 --- a/sm/certlist.c +++ b/sm/certlist.c @@ -171,7 +171,8 @@ cert_usage_p (ksba_cert_t cert, int mode, int silent) } encr_bits = (KSBA_KEYUSAGE_KEY_ENCIPHERMENT|KSBA_KEYUSAGE_DATA_ENCIPHERMENT); - if ((opt.compat_flags & COMPAT_ALLOW_KA_TO_ENCR)) + if ((opt.compat_flags & COMPAT_ALLOW_KA_TO_ENCR) + || gpgsm_is_ecc_key (cert)) encr_bits |= KSBA_KEYUSAGE_KEY_AGREEMENT; sign_bits = (KSBA_KEYUSAGE_DIGITAL_SIGNATURE|KSBA_KEYUSAGE_NON_REPUDIATION); diff --git a/sm/fingerprint.c b/sm/fingerprint.c index e692049fa..ce0830e29 100644 --- a/sm/fingerprint.c +++ b/sm/fingerprint.c @@ -307,8 +307,16 @@ gpgsm_get_key_algo_info (ksba_cert_t cert, unsigned int *nbits) } -/* This is a wrapper around pubkey_algo_string which takesa KSA - * certitificate instead of a Gcrypt public key. Note that this +/* Return true if CERT is an ECC key. */ +int +gpgsm_is_ecc_key (ksba_cert_t cert) +{ + return GCRY_PK_ECC == gpgsm_get_key_algo_info2 (cert, NULL, NULL); +} + + +/* This is a wrapper around pubkey_algo_string which takes a KSBA + * certificate instead of a Gcrypt public key. Note that this * function may return NULL on error. */ char * gpgsm_pubkey_algo_string (ksba_cert_t cert, int *r_algoid) diff --git a/sm/gpgsm.h b/sm/gpgsm.h index 93fa74a06..bbbd82b54 100644 --- a/sm/gpgsm.h +++ b/sm/gpgsm.h @@ -283,6 +283,7 @@ char *gpgsm_get_keygrip_hexstring (ksba_cert_t cert); int gpgsm_get_key_algo_info (ksba_cert_t cert, unsigned int *nbits); int gpgsm_get_key_algo_info2 (ksba_cert_t cert, unsigned int *nbits, char **r_curve); +int gpgsm_is_ecc_key (ksba_cert_t cert); char *gpgsm_pubkey_algo_string (ksba_cert_t cert, int *r_algoid); char *gpgsm_get_certid (ksba_cert_t cert); |