diff options
Diffstat (limited to 'sm')
| -rw-r--r-- | sm/call-agent.c | 19 | ||||
| -rw-r--r-- | sm/encrypt.c | 11 | ||||
| -rw-r--r-- | sm/sign.c | 11 |
3 files changed, 41 insertions, 0 deletions
diff --git a/sm/call-agent.c b/sm/call-agent.c index 0e47c1448..ba8fb122b 100644 --- a/sm/call-agent.c +++ b/sm/call-agent.c @@ -171,6 +171,25 @@ start_agent (ctrl_t ctrl) str_pinentry_mode (opt.pinentry_mode), gpg_strerror (rc)); } + + /* In DE_VS mode under Windows we require that the JENT RNG + * is active. */ +#ifdef HAVE_W32_SYSTEM + if (!rc && opt.compliance == CO_DE_VS) + { + if (assuan_transact (agent_ctx, "GETINFO jent_active", + NULL, NULL, NULL, NULL, NULL, NULL)) + { + rc = gpg_error (GPG_ERR_FORBIDDEN); + log_error (_("%s is not compliant with %s mode\n"), + GPG_AGENT_NAME, + gnupg_compliance_option_string (opt.compliance)); + gpgsm_status_with_error (ctrl, STATUS_ERROR, + "random-compliance", rc); + } + } +#endif /*HAVE_W32_SYSTEM*/ + } } diff --git a/sm/encrypt.c b/sm/encrypt.c index 9e3216a79..73519325e 100644 --- a/sm/encrypt.c +++ b/sm/encrypt.c @@ -420,6 +420,17 @@ gpgsm_encrypt (ctrl_t ctrl, certlist_t recplist, int data_fd, estream_t out_fp) goto leave; } + if (!gnupg_rng_is_compliant (opt.compliance)) + { + rc = gpg_error (GPG_ERR_FORBIDDEN); + log_error (_("%s is not compliant with %s mode\n"), + "RNG", + gnupg_compliance_option_string (opt.compliance)); + gpgsm_status_with_error (ctrl, STATUS_ERROR, + "random-compliance", rc); + goto leave; + } + /* Create a session key */ dek = xtrycalloc_secure (1, sizeof *dek); if (!dek) @@ -339,6 +339,17 @@ gpgsm_sign (ctrl_t ctrl, certlist_t signerlist, goto leave; } + if (!gnupg_rng_is_compliant (opt.compliance)) + { + rc = gpg_error (GPG_ERR_FORBIDDEN); + log_error (_("%s is not compliant with %s mode\n"), + "RNG", + gnupg_compliance_option_string (opt.compliance)); + gpgsm_status_with_error (ctrl, STATUS_ERROR, + "random-compliance", rc); + goto leave; + } + ctrl->pem_name = "SIGNED MESSAGE"; rc = gnupg_ksba_create_writer (&b64writer, ((ctrl->create_pem? GNUPG_KSBA_IO_PEM : 0) |