diff options
Diffstat (limited to 'g10')
| -rw-r--r-- | g10/ChangeLog | 15 | ||||
| -rw-r--r-- | g10/encode.c | 21 | ||||
| -rw-r--r-- | g10/gpg.c | 1 | ||||
| -rw-r--r-- | g10/keydb.h | 2 | ||||
| -rw-r--r-- | g10/options.skel | 28 | ||||
| -rw-r--r-- | g10/pkclist.c | 80 |
6 files changed, 110 insertions, 37 deletions
diff --git a/g10/ChangeLog b/g10/ChangeLog index c6c1373aa..bf414fbd8 100644 --- a/g10/ChangeLog +++ b/g10/ChangeLog @@ -1,3 +1,18 @@ +2006-11-05 Werner Koch <[email protected]> + + * gpg.c (main): Remove the default --require-cross-certification. + * options.skel: Enable require-cross-certification. + +2006-10-31 Werner Koch <[email protected]> + + * pkclist.c (warn_missing_aes_from_pklist): New. + * encode.c (encrypt_filter, encode_crypt): Use it here. + +2006-10-27 Werner Koch <[email protected]> + + * pkclist.c (warn_missing_mdc_from_pklist): New. + * encode.c (use_mdc): Use it here. + 2006-10-24 Marcus Brinkmann <[email protected]> * Makefile.am (AM_CFLAGS): Add $(LIBASSUAN_CFLAGS). diff --git a/g10/encode.c b/g10/encode.c index b5045ac15..f55f4732c 100644 --- a/g10/encode.c +++ b/g10/encode.c @@ -147,6 +147,9 @@ use_mdc(PK_LIST pk_list,int algo) if (gcry_cipher_get_algo_blklen (algo) != 8) return 1; + if (opt.verbose) + warn_missing_mdc_from_pklist (pk_list); + return 0; /* No MDC */ } @@ -521,6 +524,14 @@ encode_crypt( const char *filename, strlist_t remusr, int use_symkey ) compliance_failure(); } } + + /* In case 3DES has been selected, print a warning if + any key does not have a preference for AES. This + should help to indentify why encrypting to several + recipients falls back to 3DES. */ + if (opt.verbose + && cfx.dek->algo == CIPHER_ALGO_3DES) + warn_missing_aes_from_pklist (pk_list); } else { if(!opt.expert && @@ -533,7 +544,7 @@ encode_crypt( const char *filename, strlist_t remusr, int use_symkey ) cfx.dek->algo = opt.def_cipher_algo; } - + cfx.dek->use_mdc=use_mdc(pk_list,cfx.dek->algo); /* Only do the is-file-already-compressed check if we are using a @@ -716,6 +727,14 @@ encrypt_filter( void *opaque, int control, * happen if we do not have any public keys in the list */ efx->cfx.dek->algo = DEFAULT_CIPHER_ALGO; } + + /* In case 3DES has been selected, print a warning if + any key does not have a preference for AES. This + should help to indentify why encrypting to several + recipients falls back to 3DES. */ + if (opt.verbose + && efx->cfx.dek->algo == CIPHER_ALGO_3DES) + warn_missing_aes_from_pklist (efx->pk_list); } else { if(!opt.expert && @@ -1857,7 +1857,6 @@ main (int argc, char **argv ) opt.rfc2440_text=1; opt.def_sig_expire="0"; opt.def_cert_expire="0"; - opt.flags.require_cross_cert = 1; set_homedir ( default_homedir () ); /* Check whether we have a config file on the command line. */ diff --git a/g10/keydb.h b/g10/keydb.h index 30f91255f..5cf1dd2ac 100644 --- a/g10/keydb.h +++ b/g10/keydb.h @@ -188,6 +188,8 @@ int algo_available( preftype_t preftype, int algo, int select_algo_from_prefs( PK_LIST pk_list, int preftype, int request, const union pref_hint *hint); int select_mdc_from_pklist (PK_LIST pk_list); +void warn_missing_mdc_from_pklist (PK_LIST pk_list); +void warn_missing_aes_from_pklist (PK_LIST pk_list); /*-- skclist.c --*/ int random_is_faked (void); diff --git a/g10/options.skel b/g10/options.skel index 3d15f811c..117804813 100644 --- a/g10/options.skel +++ b/g10/options.skel @@ -53,6 +53,15 @@ #no-escape-from-lines +# When verifying a signature made from a subkey, ensure that the cross +# certification "back signature" on the subkey is present and valid. +# This protects against a subtle attack against subkeys that can sign. +# Defaults to --no-require-cross-certification. However for new +# installations it should be enabled. + +require-cross-certification + + # If you do not use the Latin-1 (ISO-8859-1) charset, you should tell # GnuPG which is the native character set. Please check the man page # for supported character sets. This character set is only used for @@ -191,22 +200,3 @@ keyserver hkp://subkeys.pgp.net # Use your MIME handler to view photos: # photo-viewer "metamail -q -d -b -c %T -s 'KeyID 0x%k' -f GnuPG" -# Passphrase agent -# -# We support the old experimental passphrase agent protocol as well as -# the new Assuan based one (currently available in the "newpg" package -# at ftp.gnupg.org/gcrypt/alpha/aegypten/). To make use of the agent, -# you have to run an agent as daemon and use the option -# -# use-agent -# -# which tries to use the agent but will fallback to the regular mode -# if there is a problem connecting to the agent. The normal way to -# locate the agent is by looking at the environment variable -# GPG_AGENT_INFO which should have been set during gpg-agent startup. -# In certain situations the use of this variable is not possible, thus -# the option -# -# --gpg-agent-info=<path>:<pid>:1 -# -# may be used to override it. diff --git a/g10/pkclist.c b/g10/pkclist.c index 354e27023..6588802ad 100644 --- a/g10/pkclist.c +++ b/g10/pkclist.c @@ -1328,9 +1328,10 @@ select_algo_from_prefs(PK_LIST pk_list, int preftype, int request, } #if 0 - log_debug("pref mask=%08lX%08lX%08lX%08lX%08lX%08lX%08lX%08lX\n", + log_debug("pref mask=%08lX%08lX%08lX%08lX%08lX%08lX%08lX%08lX (%s)\n", (ulong)mask[7], (ulong)mask[6], (ulong)mask[5], (ulong)mask[4], - (ulong)mask[3], (ulong)mask[2], (ulong)mask[1], (ulong)mask[0]); + (ulong)mask[3], (ulong)mask[2], (ulong)mask[1], (ulong)mask[0], + keystr_from_pk (pkr->pk)); #endif for(i=0; i < 8; i++ ) bits[i] &= mask[i]; @@ -1423,26 +1424,73 @@ select_algo_from_prefs(PK_LIST pk_list, int preftype, int request, } /* - * Select the MDC flag from the pk_list. We can only use MDC if all recipients - * support this feature + * Select the MDC flag from the pk_list. We can only use MDC if all + * recipients support this feature. */ int select_mdc_from_pklist (PK_LIST pk_list) { - PK_LIST pkr; + PK_LIST pkr; - if( !pk_list ) - return 0; + if ( !pk_list ) + return 0; + + for (pkr = pk_list; pkr; pkr = pkr->next) + { + int mdc; + + if (pkr->pk->user_id) /* selected by user ID */ + mdc = pkr->pk->user_id->flags.mdc; + else + mdc = pkr->pk->mdc_feature; + if (!mdc) + return 0; /* At least one recipient does not support it. */ + } + return 1; /* Can be used. */ +} - for (pkr = pk_list; pkr; pkr = pkr->next) { - int mdc; - if (pkr->pk->user_id) /* selected by user ID */ - mdc = pkr->pk->user_id->flags.mdc; - else - mdc = pkr->pk->mdc_feature; - if (!mdc) - return 0; /* at least one recipient does not support it */ +/* Print a warning for all keys in PK_LIST missing the MDC feature. */ +void +warn_missing_mdc_from_pklist (PK_LIST pk_list) +{ + PK_LIST pkr; + + for (pkr = pk_list; pkr; pkr = pkr->next) + { + int mdc; + + if (pkr->pk->user_id) /* selected by user ID */ + mdc = pkr->pk->user_id->flags.mdc; + else + mdc = pkr->pk->mdc_feature; + if (!mdc) + log_info (_("Note: key %s has no %s feature\n"), + keystr_from_pk (pkr->pk), "MDC"); + } +} + +void +warn_missing_aes_from_pklist (PK_LIST pk_list) +{ + PK_LIST pkr; + + for (pkr = pk_list; pkr; pkr = pkr->next) + { + const prefitem_t *prefs; + int i; + int gotit = 0; + + prefs = pkr->pk->user_id? pkr->pk->user_id->prefs : pkr->pk->prefs; + if (prefs) + { + for (i=0; !gotit && prefs[i].type; i++ ) + if (prefs[i].type == PREFTYPE_SYM + && prefs[i].value == CIPHER_ALGO_AES) + gotit++; + } + if (!gotit) + log_info (_("Note: key %s has no preference for %s\n"), + keystr_from_pk (pkr->pk), "AES"); } - return 1; /* can be used */ } |