aboutsummaryrefslogtreecommitdiffstats
path: root/g10
diff options
context:
space:
mode:
Diffstat (limited to 'g10')
-rw-r--r--g10/call-agent.c10
-rw-r--r--g10/card-util.c41
-rw-r--r--g10/ecdh.c18
-rw-r--r--g10/encrypt.c4
-rw-r--r--g10/getkey.c15
-rw-r--r--g10/gpg.c6
-rw-r--r--g10/gpg.h13
-rw-r--r--g10/gpgcompose.c2
-rw-r--r--g10/keyedit.c2
-rw-r--r--g10/keygen.c11
-rw-r--r--g10/keyid.c50
-rw-r--r--g10/keylist.c43
-rw-r--r--g10/main.h4
-rw-r--r--g10/misc.c2
-rw-r--r--g10/options.h1
-rw-r--r--g10/pubkey-enc.c4
-rw-r--r--g10/sig-check.c6
-rw-r--r--g10/tdbdump.c14
-rw-r--r--g10/tofu.c20
19 files changed, 191 insertions, 75 deletions
diff --git a/g10/call-agent.c b/g10/call-agent.c
index 545b2448a..61d06c663 100644
--- a/g10/call-agent.c
+++ b/g10/call-agent.c
@@ -195,7 +195,7 @@ warn_version_mismatch (assuan_context_t ctx, const char *servername, int mode)
err = get_assuan_server_version (ctx, mode, &serverversion);
if (err)
log_log (gpg_err_code (err) == GPG_ERR_NOT_SUPPORTED?
- GPGRT_LOG_INFO : GPGRT_LOG_ERROR,
+ GPGRT_LOGLVL_INFO : GPGRT_LOGLVL_ERROR,
_("error getting version from '%s': %s\n"),
servername, gpg_strerror (err));
else if (compare_version_strings (serverversion, myversion) < 0)
@@ -1474,7 +1474,7 @@ agent_probe_any_secret_key (ctrl_t ctrl, kbnode_t keyblock)
char *p;
kbnode_t kbctx, node;
int nkeys;
- unsigned char grip[20];
+ unsigned char grip[KEYGRIP_LEN];
err = start_agent (ctrl, 0);
if (err)
@@ -1854,10 +1854,16 @@ agent_pksign (ctrl_t ctrl, const char *cache_nonce,
snprintf (line, sizeof line, "PKSIGN%s%s",
cache_nonce? " -- ":"",
cache_nonce? cache_nonce:"");
+
+ if (DBG_CLOCK)
+ log_clock ("enter signing");
err = assuan_transact (agent_ctx, line,
put_membuf_cb, &data,
default_inq_cb, &dfltparm,
NULL, NULL);
+ if (DBG_CLOCK)
+ log_clock ("leave signing");
+
if (err)
xfree (get_membuf (&data, NULL));
else
diff --git a/g10/card-util.c b/g10/card-util.c
index a396b7df4..854b94f47 100644
--- a/g10/card-util.c
+++ b/g10/card-util.c
@@ -212,6 +212,7 @@ get_manufacturer (unsigned int no)
case 0x000A: return "Dangerous Things";
case 0x002A: return "Magrathea";
+ case 0x0042: return "GnuPG e.V.";
case 0x1337: return "Warsaw Hackerspace";
case 0x2342: return "warpzone"; /* hackerspace Muenster. */
@@ -530,9 +531,9 @@ current_card_status (ctrl_t ctrl, estream_t fp,
print_isoname (fp, "Name of cardholder: ", "name", info.disp_name);
print_name (fp, "Language prefs ...: ", info.disp_lang);
- tty_fprintf (fp, "Sex ..............: %s\n",
- info.disp_sex == 1? _("male"):
- info.disp_sex == 2? _("female") : _("unspecified"));
+ tty_fprintf (fp, "Salutation .......: %s\n",
+ info.disp_sex == 1? _("Mr."):
+ info.disp_sex == 2? _("Mrs.") : "");
print_name (fp, "URL of public key : ", info.pubkey_url);
print_name (fp, "Login data .......: ", info.login_data);
if (info.private_do[0])
@@ -1087,7 +1088,7 @@ change_sex (void)
int rc;
data = cpr_get ("cardedit.change_sex",
- _("Sex ((M)ale, (F)emale or space): "));
+ _("Salutation (M = Mr., F = Mrs., or space): "));
if (!data)
return -1;
trim_spaces (data);
@@ -1108,7 +1109,7 @@ change_sex (void)
rc = agent_scd_setattr ("DISP-SEX", str, 1, NULL );
if (rc)
- log_error ("error setting sex: %s\n", gpg_strerror (rc));
+ log_error ("error setting salutation: %s\n", gpg_strerror (rc));
xfree (data);
write_sc_op_status (rc);
return rc;
@@ -1121,7 +1122,8 @@ change_cafpr (int fprno)
char *data;
const char *s;
int i, c, rc;
- unsigned char fpr[20];
+ unsigned char fpr[MAX_FINGERPRINT_LEN];
+ int fprlen;
data = cpr_get ("cardedit.change_cafpr", _("CA fingerprint: "));
if (!data)
@@ -1129,7 +1131,7 @@ change_cafpr (int fprno)
trim_spaces (data);
cpr_kill_prompt ();
- for (i=0, s=data; i < 20 && *s; )
+ for (i=0, s=data; i < MAX_FINGERPRINT_LEN && *s; )
{
while (spacep(s))
s++;
@@ -1143,8 +1145,9 @@ change_cafpr (int fprno)
fpr[i++] = c;
s += 2;
}
+ fprlen = i;
xfree (data);
- if (i != 20 || *s)
+ if ((fprlen != 20 && fprlen != 32) || *s)
{
tty_printf (_("Error: invalid formatted fingerprint.\n"));
return -1;
@@ -1152,7 +1155,7 @@ change_cafpr (int fprno)
rc = agent_scd_setattr (fprno==1?"CA-FPR-1":
fprno==2?"CA-FPR-2":
- fprno==3?"CA-FPR-3":"x", fpr, 20, NULL );
+ fprno==3?"CA-FPR-3":"x", fpr, fprlen, NULL );
if (rc)
log_error ("error setting cafpr: %s\n", gpg_strerror (rc));
write_sc_op_status (rc);
@@ -1314,12 +1317,11 @@ show_keysize_warning (void)
return;
shown = 1;
tty_printf
- (_("Note: There is no guarantee that the card "
- "supports the requested size.\n"
- " If the key generation does not succeed, "
- "please check the\n"
- " documentation of your card to see what "
- "sizes are allowed.\n"));
+ (_("Note: There is no guarantee that the card supports the requested\n"
+ " key type or size. If the key generation does not succeed,\n"
+ " please check the documentation of your card to see which\n"
+ " key types and sizes are supported.\n")
+ );
}
@@ -1379,8 +1381,12 @@ ask_card_keyattr (int keyno, unsigned int nbits)
}
else
{
+ char name[30];
+
+ snprintf (name, sizeof name, "rsa%u", req_nbits);
tty_printf (_("The card will now be re-configured"
- " to generate a key of %u bits\n"), req_nbits);
+ " to generate a key of type: %s\n"),
+ name);
show_keysize_warning ();
return req_nbits;
}
@@ -1885,7 +1891,8 @@ static struct
{ "fetch" , cmdFETCH , 0, N_("fetch the key specified in the card URL")},
{ "login" , cmdLOGIN , 1, N_("change the login name")},
{ "lang" , cmdLANG , 1, N_("change the language preferences")},
- { "sex" , cmdSEX , 1, N_("change card holder's sex")},
+ { "salutation",cmdSEX , 1, N_("change card holder's salutation")},
+ { "sex" ,cmdSEX , 1, NULL }, /* Backward compatibility. */
{ "cafpr" , cmdCAFPR , 1, N_("change a CA fingerprint")},
{ "forcesig", cmdFORCESIG, 1, N_("toggle the signature force PIN flag")},
{ "generate", cmdGENERATE, 1, N_("generate new keys")},
diff --git a/g10/ecdh.c b/g10/ecdh.c
index 6c2a56b84..6587cc4b4 100644
--- a/g10/ecdh.c
+++ b/g10/ecdh.c
@@ -76,7 +76,7 @@ pk_ecdh_default_params (unsigned int qbits)
}
log_assert (i < DIM (kek_params_table));
if (DBG_CRYPTO)
- log_printhex ("ECDH KEK params are", kek_params, sizeof(kek_params) );
+ log_printhex (kek_params, sizeof(kek_params), "ECDH KEK params are");
return gcry_mpi_set_opaque (NULL, kek_params, 4 * 8);
}
@@ -159,7 +159,7 @@ pk_ecdh_encrypt_with_shared_point (int is_encrypt, gcry_mpi_t shared_mpi,
memset (secret_x+secret_x_size, 0, nbytes-secret_x_size);
if (DBG_CRYPTO)
- log_printhex ("ECDH shared secret X is:", secret_x, secret_x_size );
+ log_printhex (secret_x, secret_x_size, "ECDH shared secret X is:");
}
/*** We have now the shared secret bytes in secret_x. ***/
@@ -179,7 +179,7 @@ pk_ecdh_encrypt_with_shared_point (int is_encrypt, gcry_mpi_t shared_mpi,
kek_params_size = (nbits+7)/8;
if (DBG_CRYPTO)
- log_printhex ("ecdh KDF params:", kek_params, kek_params_size);
+ log_printhex (kek_params, kek_params_size, "ecdh KDF params:");
/* Expect 4 bytes 03 01 hash_alg symm_alg. */
if (kek_params_size != 4 || kek_params[0] != 3 || kek_params[1] != 1)
@@ -236,7 +236,7 @@ pk_ecdh_encrypt_with_shared_point (int is_encrypt, gcry_mpi_t shared_mpi,
}
if(DBG_CRYPTO)
- log_printhex ("ecdh KDF message params are:", message, message_size);
+ log_printhex (message, message_size, "ecdh KDF message params are:");
}
/* Derive a KEK (key wrapping key) using MESSAGE and SECRET_X. */
@@ -272,7 +272,7 @@ pk_ecdh_encrypt_with_shared_point (int is_encrypt, gcry_mpi_t shared_mpi,
/* We could have allocated more, so clean the tail before returning. */
memset (secret_x+secret_x_size, 0, old_size - secret_x_size);
if (DBG_CRYPTO)
- log_printhex ("ecdh KEK is:", secret_x, secret_x_size );
+ log_printhex (secret_x, secret_x_size, "ecdh KEK is:");
}
/* And, finally, aeswrap with key secret_x. */
@@ -338,7 +338,7 @@ pk_ecdh_encrypt_with_shared_point (int is_encrypt, gcry_mpi_t shared_mpi,
}
if (DBG_CRYPTO)
- log_printhex ("ecdh encrypting :", in, data_buf_size );
+ log_printhex (in, data_buf_size, "ecdh encrypting :");
err = gcry_cipher_encrypt (hd, data_buf+1, data_buf_size+8,
in, data_buf_size);
@@ -354,7 +354,7 @@ pk_ecdh_encrypt_with_shared_point (int is_encrypt, gcry_mpi_t shared_mpi,
data_buf[0] = data_buf_size+8;
if (DBG_CRYPTO)
- log_printhex ("ecdh encrypted to:", data_buf+1, data_buf[0] );
+ log_printhex (data_buf+1, data_buf[0], "ecdh encrypted to:");
result = gcry_mpi_set_opaque (NULL, data_buf, 8 * (1+data_buf[0]));
if (!result)
@@ -391,7 +391,7 @@ pk_ecdh_encrypt_with_shared_point (int is_encrypt, gcry_mpi_t shared_mpi,
data_buf_size = data_buf[0];
if (DBG_CRYPTO)
- log_printhex ("ecdh decrypting :", data_buf+1, data_buf_size);
+ log_printhex (data_buf+1, data_buf_size, "ecdh decrypting :");
err = gcry_cipher_decrypt (hd, in, data_buf_size, data_buf+1,
data_buf_size);
@@ -407,7 +407,7 @@ pk_ecdh_encrypt_with_shared_point (int is_encrypt, gcry_mpi_t shared_mpi,
data_buf_size -= 8;
if (DBG_CRYPTO)
- log_printhex ("ecdh decrypted to :", in, data_buf_size);
+ log_printhex (in, data_buf_size, "ecdh decrypted to :");
/* Padding is removed later. */
/* if (in[data_buf_size-1] > 8 ) */
diff --git a/g10/encrypt.c b/g10/encrypt.c
index c68d6d5d1..263226ad5 100644
--- a/g10/encrypt.c
+++ b/g10/encrypt.c
@@ -697,7 +697,7 @@ encrypt_crypt (ctrl_t ctrl, int filefd, const char *filename,
make_session_key (cfx.dek);
if (DBG_CRYPTO)
- log_printhex ("DEK is: ", cfx.dek->key, cfx.dek->keylen );
+ log_printhex (cfx.dek->key, cfx.dek->keylen, "DEK is: ");
rc = write_pubkey_enc_from_list (ctrl, pk_list, cfx.dek, out);
if (rc)
@@ -891,7 +891,7 @@ encrypt_filter (void *opaque, int control,
make_session_key ( efx->cfx.dek );
if (DBG_CRYPTO)
- log_printhex ("DEK is: ", efx->cfx.dek->key, efx->cfx.dek->keylen);
+ log_printhex (efx->cfx.dek->key, efx->cfx.dek->keylen, "DEK is: ");
rc = write_pubkey_enc_from_list (efx->ctrl,
efx->pk_list, efx->cfx.dek, a);
diff --git a/g10/getkey.c b/g10/getkey.c
index e31e0232e..dabd052e0 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -144,7 +144,7 @@ static int lookup (ctrl_t ctrl, getkey_ctx_t ctx, int want_secret,
kbnode_t *ret_keyblock, kbnode_t *ret_found_key);
static kbnode_t finish_lookup (kbnode_t keyblock,
unsigned int req_usage, int want_exact,
- unsigned int *r_flags);
+ int want_secret, unsigned int *r_flags);
static void print_status_key_considered (kbnode_t keyblock, unsigned int flags);
@@ -1743,7 +1743,7 @@ get_pubkey_fromfile (ctrl_t ctrl, PKT_public_key *pk, const char *fname)
/* Warning: node flag bits 0 and 1 should be preserved by
* merge_selfsigs. FIXME: Check whether this still holds. */
merge_selfsigs (ctrl, keyblock);
- found_key = finish_lookup (keyblock, pk->req_usage, 0, &infoflags);
+ found_key = finish_lookup (keyblock, pk->req_usage, 0, 0, &infoflags);
print_status_key_considered (keyblock, infoflags);
if (found_key)
pk_from_block (pk, keyblock, found_key);
@@ -3494,7 +3494,7 @@ merge_selfsigs (ctrl_t ctrl, kbnode_t keyblock)
*/
static kbnode_t
finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
- unsigned int *r_flags)
+ int want_secret, unsigned int *r_flags)
{
kbnode_t k;
@@ -3636,6 +3636,13 @@ finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
continue;
}
+ if (want_secret && agent_probe_secret_key (NULL, pk))
+ {
+ if (DBG_LOOKUP)
+ log_debug ("\tno secret key\n");
+ continue;
+ }
+
if (DBG_LOOKUP)
log_debug ("\tsubkey might be fine\n");
/* In case a key has a timestamp of 0 set, we make sure
@@ -3823,7 +3830,7 @@ lookup (ctrl_t ctrl, getkey_ctx_t ctx, int want_secret,
* merge_selfsigs. */
merge_selfsigs (ctrl, keyblock);
found_key = finish_lookup (keyblock, ctx->req_usage, ctx->exact,
- &infoflags);
+ want_secret, &infoflags);
print_status_key_considered (keyblock, infoflags);
if (found_key)
{
diff --git a/g10/gpg.c b/g10/gpg.c
index 62d6131ba..61e39b8e4 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -197,6 +197,7 @@ enum cmd_and_opt_values
oWithSubkeyFingerprint,
oWithICAOSpelling,
oWithKeygrip,
+ oWithKeyScreening,
oWithSecret,
oWithWKDHash,
oWithColons,
@@ -785,6 +786,7 @@ static ARGPARSE_OPTS opts[] = {
ARGPARSE_s_n (oWithSubkeyFingerprint, "with-subkey-fingerprints", "@"),
ARGPARSE_s_n (oWithICAOSpelling, "with-icao-spelling", "@"),
ARGPARSE_s_n (oWithKeygrip, "with-keygrip", "@"),
+ ARGPARSE_s_n (oWithKeyScreening,"with-key-screening", "@"),
ARGPARSE_s_n (oWithSecret, "with-secret", "@"),
ARGPARSE_s_n (oWithWKDHash, "with-wkd-hash", "@"),
ARGPARSE_s_n (oWithKeyOrigin, "with-key-origin", "@"),
@@ -2737,6 +2739,10 @@ main (int argc, char **argv)
opt.with_keygrip = 1;
break;
+ case oWithKeyScreening:
+ opt.with_key_screening = 1;
+ break;
+
case oWithSecret:
opt.with_secret = 1;
break;
diff --git a/g10/gpg.h b/g10/gpg.h
index 9b8b77ca0..03fe384aa 100644
--- a/g10/gpg.h
+++ b/g10/gpg.h
@@ -38,14 +38,15 @@
#define MAX_EXTERN_MPI_BITS 16384
/* The maximum length of a binary fingerprints. This is used to
- provide a static buffer and will be increased if we need to support
- longer fingerprints.
- Warning: At some places we still use 20 instead of this macro. */
-#define MAX_FINGERPRINT_LEN 20
+ * provide a static buffer and will be increased if we need to support
+ * longer fingerprints. Warning: At some places we have some
+ * assumption on a 20 byte fingerprint.
+ * Watch out for FIXME(fingerprint) */
+#define MAX_FINGERPRINT_LEN 32
/* The maximum length of a formatted fingerprint as returned by
- format_hexfingerprint(). */
-#define MAX_FORMATTED_FINGERPRINT_LEN 50
+ * format_hexfingerprint(). */
+#define MAX_FORMATTED_FINGERPRINT_LEN 59
/*
diff --git a/g10/gpgcompose.c b/g10/gpgcompose.c
index 2b42bfbf9..8c156d279 100644
--- a/g10/gpgcompose.c
+++ b/g10/gpgcompose.c
@@ -2746,7 +2746,7 @@ literal_name (const char *option, int argc, char *argv[], void *cookie)
{
struct litinfo *li = cookie;
- if (argc <= 1)
+ if (argc <= 0)
log_fatal ("Usage: %s NAME\n", option);
if (strlen (argv[0]) > 255)
diff --git a/g10/keyedit.c b/g10/keyedit.c
index 4acb2de5f..8d8625371 100644
--- a/g10/keyedit.c
+++ b/g10/keyedit.c
@@ -1142,7 +1142,7 @@ change_passphrase (ctrl_t ctrl, kbnode_t keyblock)
if (err)
log_log ((gpg_err_code (err) == GPG_ERR_CANCELED
|| gpg_err_code (err) == GPG_ERR_FULLY_CANCELED)
- ? GPGRT_LOG_INFO : GPGRT_LOG_ERROR,
+ ? GPGRT_LOGLVL_INFO : GPGRT_LOGLVL_ERROR,
_("key %s: error changing passphrase: %s\n"),
keystr_with_sub (keyid, subid),
gpg_strerror (err));
diff --git a/g10/keygen.c b/g10/keygen.c
index b42afa858..912fa390c 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -46,11 +46,10 @@
#include "../common/mbox-util.h"
-/* The default algorithms. If you change them remember to change them
- also in gpg.c:gpgconf_list. You should also check that the value
+/* The default algorithms. If you change them, you should ensure the value
is inside the bounds enforced by ask_keysize and gen_xxx. See also
get_keysize_range which encodes the allowed ranges. */
-#define DEFAULT_STD_KEY_PARAM "rsa2048/cert,sign+rsa2048/encr"
+#define DEFAULT_STD_KEY_PARAM "rsa3072/cert,sign+rsa3072/encr"
#define FUTURE_STD_KEY_PARAM "ed25519/cert,sign+cv25519/encr"
/* When generating keys using the streamlined key generation dialog,
@@ -91,7 +90,7 @@ enum para_name {
pHANDLE,
pKEYSERVER,
pKEYGRIP,
- pSUBKEYGRIP,
+ pSUBKEYGRIP
};
struct para_data_s {
@@ -1641,7 +1640,7 @@ gen_rsa (int algo, unsigned int nbits, KBNODE pub_root,
if (nbits < 1024)
{
- nbits = 2048;
+ nbits = 3072;
log_info (_("keysize invalid; using %u bits\n"), nbits );
}
else if (nbits > maxsize)
@@ -2110,7 +2109,7 @@ get_keysize_range (int algo, unsigned int *min, unsigned int *max)
default:
*min = opt.compliance == CO_DE_VS ? 2048: 1024;
*max = 4096;
- def = 2048;
+ def = 3072;
break;
}
diff --git a/g10/keyid.c b/g10/keyid.c
index ba35ec21f..a9034ee46 100644
--- a/g10/keyid.c
+++ b/g10/keyid.c
@@ -73,7 +73,7 @@ pubkey_letter( int algo )
is copied to the supplied buffer up a length of BUFSIZE-1.
Examples for the output are:
- "rsa2048" - RSA with 2048 bit
+ "rsa3072" - RSA with 3072 bit
"elg1024" - Elgamal with 1024 bit
"ed25519" - ECC using the curve Ed25519.
"E_1.2.3.4" - ECC using the unsupported curve with OID "1.2.3.4".
@@ -83,7 +83,7 @@ pubkey_letter( int algo )
If the option --legacy-list-mode is active, the output use the
legacy format:
- "2048R" - RSA with 2048 bit
+ "3072R" - RSA with 3072 bit
"1024g" - Elgamal with 1024 bit
"256E" - ECDSA using a curve with 256 bit
@@ -839,8 +839,22 @@ format_hexfingerprint (const char *fingerprint, char *buffer, size_t buflen)
/* Half way through we add a second space. */
+ 1);
}
+ else if (hexlen == 64 || hexlen == 50) /* v5 fingerprint */
+ {
+ /* The v5 fingerprint is commonly printed truncated to 25
+ * octets. We accept the truncated as well as the full hex
+ * version here and format it like this:
+ * B2CCB6 838332 5D61BA C50F9F 5E CD21A8 0AC8C5 2565C8 C52565
+ */
+ hexlen = 50;
+ space = 8 * 6 + 2 + 8 + 1;
+ }
else /* Other fingerprint versions - print as is. */
{
+ /* We truncated here so that we do not need to provide a buffer
+ * of a length which is in reality never used. */
+ if (hexlen > MAX_FORMATTED_FINGERPRINT_LEN - 1)
+ hexlen = MAX_FORMATTED_FINGERPRINT_LEN - 1;
space = hexlen + 1;
}
@@ -853,7 +867,7 @@ format_hexfingerprint (const char *fingerprint, char *buffer, size_t buflen)
{
for (i = 0, j = 0; i < 40; i ++)
{
- if (i && i % 4 == 0)
+ if (i && !(i % 4))
buffer[j ++] = ' ';
if (i == 40 / 2)
buffer[j ++] = ' ';
@@ -863,9 +877,29 @@ format_hexfingerprint (const char *fingerprint, char *buffer, size_t buflen)
buffer[j ++] = 0;
log_assert (j == space);
}
+ else if (hexlen == 50) /* v5 fingerprint */
+ {
+ for (i=j=0; i < 24; i++)
+ {
+ if (i && !(i % 6))
+ buffer[j++] = ' ';
+ buffer[j++] = fingerprint[i];
+ }
+ buffer[j++] = ' ';
+ buffer[j++] = fingerprint[i++];
+ buffer[j++] = fingerprint[i++];
+ for (; i < 50; i++)
+ {
+ if (!((i-26) % 6))
+ buffer[j++] = ' ';
+ buffer[j++] = fingerprint[i];
+ }
+ buffer[j++] = 0;
+ log_assert (j == space);
+ }
else
{
- strcpy (buffer, fingerprint);
+ mem2str (buffer, fingerprint, space);
}
return buffer;
@@ -948,7 +982,7 @@ keygrip_from_pk (PKT_public_key *pk, unsigned char *array)
else
{
if (DBG_PACKET)
- log_printhex ("keygrip=", array, 20);
+ log_printhex (array, 20, "keygrip=");
/* FIXME: Save the keygrip in PK. */
}
gcry_sexp_release (s_pkey);
@@ -963,18 +997,18 @@ gpg_error_t
hexkeygrip_from_pk (PKT_public_key *pk, char **r_grip)
{
gpg_error_t err;
- unsigned char grip[20];
+ unsigned char grip[KEYGRIP_LEN];
*r_grip = NULL;
err = keygrip_from_pk (pk, grip);
if (!err)
{
- char * buf = xtrymalloc (20*2+1);
+ char * buf = xtrymalloc (KEYGRIP_LEN * 2 + 1);
if (!buf)
err = gpg_error_from_syserror ();
else
{
- bin2hex (grip, 20, buf);
+ bin2hex (grip, KEYGRIP_LEN, buf);
*r_grip = buf;
}
}
diff --git a/g10/keylist.c b/g10/keylist.c
index 86d1c564f..bcbad450a 100644
--- a/g10/keylist.c
+++ b/g10/keylist.c
@@ -45,6 +45,7 @@
#include "../common/zb32.h"
#include "tofu.h"
#include "../common/compliance.h"
+#include "../common/pkscreening.h"
static void list_all (ctrl_t, int, int);
@@ -696,6 +697,37 @@ print_key_data (PKT_public_key * pk)
}
}
+
+/* Various public key screenings. (Right now just ROCA). With
+ * COLON_MODE set the output is formatted for use in the compliance
+ * field of a colon listing.
+ */
+static void
+print_pk_screening (PKT_public_key *pk, int colon_mode)
+{
+ gpg_error_t err;
+
+ if (is_RSA (pk->pubkey_algo) && pubkey_get_npkey (pk->pubkey_algo))
+ {
+ err = screen_key_for_roca (pk->pkey[0]);
+ if (!err)
+ ;
+ else if (gpg_err_code (err) == GPG_ERR_TRUE)
+ {
+ if (colon_mode)
+ es_fprintf (es_stdout, colon_mode > 1? " %d":"%d", 6001);
+ else
+ es_fprintf (es_stdout,
+ " Screening: ROCA vulnerability detected\n");
+ }
+ else if (!colon_mode)
+ es_fprintf (es_stdout, " Screening: [ROCA check failed: %s]\n",
+ gpg_strerror (err));
+ }
+
+}
+
+
static void
print_capabilities (ctrl_t ctrl, PKT_public_key *pk, KBNODE keyblock)
{
@@ -922,6 +954,9 @@ list_keyblock_print (ctrl_t ctrl, kbnode_t keyblock, int secret, int fpr,
if (opt.with_key_data)
print_key_data (pk);
+ if (opt.with_key_screening)
+ print_pk_screening (pk, 0);
+
if (opt.with_key_origin
&& (pk->keyorg || pk->keyupdate || pk->updateurl))
{
@@ -1063,6 +1098,8 @@ list_keyblock_print (ctrl_t ctrl, kbnode_t keyblock, int secret, int fpr,
es_fprintf (es_stdout, " Keygrip = %s\n", hexgrip);
if (opt.with_key_data)
print_key_data (pk2);
+ if (opt.with_key_screening)
+ print_pk_screening (pk2, 0);
}
else if (opt.list_sigs
&& node->pkt->pkttype == PKT_SIGNATURE && !skip_sigs)
@@ -1227,6 +1264,9 @@ print_compliance_flags (PKT_public_key *pk,
gnupg_status_compliance_flag (CO_DE_VS));
any++;
}
+
+ if (opt.with_key_screening)
+ print_pk_screening (pk, 1+any);
}
@@ -1906,6 +1946,9 @@ print_card_serialno (const char *serialno)
* pub dsa2048 2007-12-31 [SC] [expires: 2018-12-31]
* 80615870F5BAD690333686D0F2AD85AC1E42B367
*
+ * pub rsa2048 2017-12-31 [SC] [expires: 2028-12-31]
+ * 80615870F5BAD690333686D0F2AD85AC1E42B3671122334455
+ *
* Some global options may result in a different output format. If
* SECRET is set, "sec" or "ssb" is used instead of "pub" or "sub" and
* depending on the value a flag character is shown:
diff --git a/g10/main.h b/g10/main.h
index 6c15a2a8d..4a8f8c32a 100644
--- a/g10/main.h
+++ b/g10/main.h
@@ -31,7 +31,9 @@
(i.e. uncompressed) rather than 1 (zip). However, the real world
issues of speed and size come into play here. */
-#if GPG_USE_AES128
+#if GPG_USE_AES256
+# define DEFAULT_CIPHER_ALGO CIPHER_ALGO_AES256
+#elif GPG_USE_AES128
# define DEFAULT_CIPHER_ALGO CIPHER_ALGO_AES
#elif GPG_USE_CAST5
# define DEFAULT_CIPHER_ALGO CIPHER_ALGO_CAST5
diff --git a/g10/misc.c b/g10/misc.c
index 77c8f269c..9016d2770 100644
--- a/g10/misc.c
+++ b/g10/misc.c
@@ -396,7 +396,7 @@ print_further_info (const char *format, ...)
log_info (_("(further info: "));
va_start (arg_ptr, format);
- log_logv (GPGRT_LOG_CONT, format, arg_ptr);
+ log_logv (GPGRT_LOGLVL_CONT, format, arg_ptr);
va_end (arg_ptr);
log_printf (")\n");
}
diff --git a/g10/options.h b/g10/options.h
index 130bec84c..61f7403be 100644
--- a/g10/options.h
+++ b/g10/options.h
@@ -82,6 +82,7 @@ struct
int with_fingerprint; /* Option --with-fingerprint active. */
int with_subkey_fingerprint; /* Option --with-subkey-fingerprint active. */
int with_keygrip; /* Option --with-keygrip active. */
+ int with_key_screening;/* Option --with-key-screening active. */
int with_tofu_info; /* Option --with-tofu_info active. */
int with_secret; /* Option --with-secret active. */
int with_wkd_hash; /* Option --with-wkd-hash. */
diff --git a/g10/pubkey-enc.c b/g10/pubkey-enc.c
index d7ba95391..0185097a4 100644
--- a/g10/pubkey-enc.c
+++ b/g10/pubkey-enc.c
@@ -255,7 +255,7 @@ get_it (ctrl_t ctrl,
* CSUM
*/
if (DBG_CRYPTO)
- log_printhex ("DEK frame:", frame, nframe);
+ log_printhex (frame, nframe, "DEK frame:");
n = 0;
if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
@@ -361,7 +361,7 @@ get_it (ctrl_t ctrl,
if (DBG_CLOCK)
log_clock ("decryption ready");
if (DBG_CRYPTO)
- log_printhex ("DEK is:", dek->key, dek->keylen);
+ log_printhex (dek->key, dek->keylen, "DEK is:");
/* Check that the algo is in the preferences and whether it has
* expired. Also print a status line with the key's fingerprint. */
diff --git a/g10/sig-check.c b/g10/sig-check.c
index 23af12b2e..f8e366b7e 100644
--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -233,7 +233,7 @@ check_signature2 (ctrl_t ctrl,
unsigned char *p, *buffer;
size_t n, nbytes;
int i;
- char hashbuf[20];
+ char hashbuf[20]; /* We use SHA-1 here. */
nbytes = 6;
for (i=0; i < nsig; i++ )
@@ -510,7 +510,11 @@ check_signature_end_simple (PKT_public_key *pk, PKT_signature *sig,
return GPG_ERR_GENERAL;
/* Verify the signature. */
+ if (DBG_CLOCK && sig->sig_class <= 0x01)
+ log_clock ("enter pk_verify");
rc = pk_verify( pk->pubkey_algo, result, sig->data, pk->pkey );
+ if (DBG_CLOCK && sig->sig_class <= 0x01)
+ log_clock ("leave pk_verify");
gcry_mpi_release (result);
if( !rc && sig->flags.unknown_critical )
diff --git a/g10/tdbdump.c b/g10/tdbdump.c
index 5ea903f45..37bf78b80 100644
--- a/g10/tdbdump.c
+++ b/g10/tdbdump.c
@@ -129,7 +129,7 @@ import_ownertrust (ctrl_t ctrl, const char *fname )
char *p;
size_t n, fprlen;
unsigned int otrust;
- byte fpr[20];
+ byte fpr[MAX_FINGERPRINT_LEN];
int any = 0;
int rc;
@@ -171,7 +171,7 @@ import_ownertrust (ctrl_t ctrl, const char *fname )
continue;
}
fprlen = p - line;
- if( fprlen != 32 && fprlen != 40 ) {
+ if( fprlen != 32 && fprlen != 40 && fprlen != 64) {
log_error (_("error in '%s': %s\n"),
fname, _("invalid fingerprint") );
continue;
@@ -183,10 +183,12 @@ import_ownertrust (ctrl_t ctrl, const char *fname )
}
if( !otrust )
continue; /* no otrust defined - no need to update or insert */
- /* convert the ascii fingerprint to binary */
- for(p=line, fprlen=0; fprlen < 20 && *p != ':'; p += 2 )
- fpr[fprlen++] = HEXTOBIN(p[0]) * 16 + HEXTOBIN(p[1]);
- while (fprlen < 20)
+ /* Convert the ascii fingerprint to binary */
+ for(p=line, fprlen=0;
+ fprlen < MAX_FINGERPRINT_LEN && *p != ':';
+ p += 2 )
+ fpr[fprlen++] = HEXTOBIN(p[0]) * 16 + HEXTOBIN(p[1]);
+ while (fprlen < MAX_FINGERPRINT_LEN)
fpr[fprlen++] = 0;
rc = tdbio_search_trust_byfpr (fpr, &rec);
diff --git a/g10/tofu.c b/g10/tofu.c
index 091d5b0d0..762b19b7a 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -2083,13 +2083,16 @@ build_conflict_set (ctrl_t ctrl, tofu_dbs_t dbs,
* policy to ask due to a conflict. */
for (iter = conflict_set; iter; iter = iter->next)
{
+ /* Fixme: Why the check against N+1? */
int l = strlen (iter->d);
- if (!(l == 2 * MAX_FINGERPRINT_LEN
- || l == 2 * MAX_FINGERPRINT_LEN + 1))
+ if (!(l == 2 * 20
+ || l == 2 * 20 + 1
+ || l == 2 * 32
+ || l == 2 * 32 + 1))
{
log_error (_("TOFU db corruption detected.\n"));
- print_further_info ("fingerprint '%s' is not %d characters long",
- iter->d, 2 * MAX_FINGERPRINT_LEN);
+ print_further_info ("fingerprint '%s' is %d characters long",
+ iter->d, l);
}
if (l >= 1 && iter->d[l - 1] == '!')
@@ -2469,10 +2472,11 @@ get_policy (ctrl_t ctrl, tofu_dbs_t dbs, PKT_public_key *pk,
/* See if the key is signed by an ultimately trusted key. */
{
int fingerprint_raw_len = strlen (fingerprint) / 2;
- char fingerprint_raw[20];
+ char fingerprint_raw[MAX_FINGERPRINT_LEN];
int len = 0;
- if (fingerprint_raw_len != sizeof fingerprint_raw
+ /* FIXME(fingerprint) */
+ if (fingerprint_raw_len != 20 /*sizeof fingerprint_raw */
|| ((len = hex2bin (fingerprint,
fingerprint_raw, fingerprint_raw_len))
!= strlen (fingerprint)))
@@ -3210,7 +3214,7 @@ show_statistics (tofu_dbs_t dbs,
*p = ' ';
}
- log_string (GPGRT_LOG_INFO, msg);
+ log_string (GPGRT_LOGLVL_INFO, msg);
xfree (msg);
if (policy == TOFU_POLICY_AUTO)
@@ -3275,7 +3279,7 @@ show_warning (const char *fingerprint, strlist_t user_id_list)
log_fatal ("format failed: %s\n",
gpg_strerror (gpg_error_from_syserror()));
xfree (tmpmsg);
- log_string (GPGRT_LOG_INFO, text);
+ log_string (GPGRT_LOGLVL_INFO, text);
xfree (text);
es_free (set_policy_command);
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-27 03:07:20 +0000