aboutsummaryrefslogtreecommitdiffstats
path: root/agent/command-ssh.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* agent: Put Token lines into the key files.Werner Koch2019-05-031-1/+1
| | | | | | | | | | | | | | | * agent/findkey.c (write_extended_private_key): Add args serialno and keyref. Write a Token line if that does not yet exist. (agent_write_private_key): Add args serialno and keyref and change all callers. (agent_write_shadow_key): Skip leading spaces. * agent/keyformat.txt: Improve extended key format docs. -- Noet that the extended key forma is the defaqult in 2.3. This patch is a first step to better handle tokens which carray the same key. Signed-off-by: Werner Koch <[email protected]>
* ssh: Simplify the curve name lookup.Werner Koch2019-01-171-84/+54
| | | | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (struct ssh_key_type_spec): Add field alt_curve_name. (ssh_key_types): Add some alternate curve names. (ssh_identifier_from_curve_name): Lookup also bey alternative names and return the canonical name. (ssh_key_to_blob): Simplify the ECDSA case by using gcry_pk_get_curve instead of the explicit mapping. (ssh_receive_key): Likewise. Use ssh_identifier_from_curve_name to validate the curve name. Remove the reverse mapping because since GnuPG-2.2 Libgcrypt 1.7 is required. (ssh_handler_request_identities): Log an error message. -- This change will make it easier to support other curves, in particular those from tokens. Libgcrypt has a large list of alias names which we now use to to make the mapping more flexible. Signed-off-by: Werner Koch <[email protected]>
* all: fix spelling and typosDaniel Kahn Gillmor2018-10-241-1/+1
| | | | Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* ssh: Fix possible infinite loop in case of an read error.Werner Koch2018-10-241-3/+4
| | | | | | | | | * agent/command-ssh.c (ssh_handler_add_identity): Handle other errors than EOF. -- GnuPG-bug-id: 4221 Signed-off-by: Werner Koch <[email protected]>
* agent: Fix build regression for Windows.Werner Koch2018-10-221-8/+10
| | | | | | | | | | | | | * agent/command-ssh.c (get_client_info): Turn client_uid into an int. Fix setting of it in case of a failed getsocketopt. * agent/command.c (start_command_handler): Fix setting of the pid and uid for Windows. -- Fixes-commit: 28aa6890588cc108639951bb4bef03ac17743046 which obviously was only added to master. Signed-off-by: Werner Koch <[email protected]>
* Merge branch 'STABLE-BRANCH-2-2' into masterWerner Koch2018-04-101-7/+39
|\ | | | | | | | | | | | | | | | | -- Fixed conflicts: NEWS - keep master configure.ac - merge g10/card-util.c - mostly 2.2 g10/sig-check.c - 2.2
| * agent: Improve the unknown ssh flag detection.Werner Koch2018-04-101-24/+31
| | | | | | | | | | | | | | | | * agent/command-ssh.c (ssh_handler_sign_request): Simplify detection of flags. -- Signed-off-by: Werner Koch <[email protected]>
| * agent: unknown flags on ssh signing requests cause an error.T3880-fixT3880Daniel Kahn Gillmor2018-04-091-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (ssh_handler_sign_request): if a flag is passed during an signature request that we do not know how to apply, return GPG_ERR_UNKNOWN_OPTION. -- https://tools.ietf.org/html/draft-miller-ssh-agent-02#section-4.5 says: If the agent does not support the requested flags, or is otherwise unable or unwilling to generate the signature (e.g. because it doesn't have the specified key, or the user refused confirmation of a constrained key), it must reply with a SSH_AGENT_FAILURE message. Signed-off-by: Daniel Kahn Gillmor <[email protected]> GnuPG-bug-id: 3880
| * agent: change documentation reference for ssh-agent protocol.Daniel Kahn Gillmor2018-04-091-2/+4
| | | | | | | | | | | | | | | | | | | | * agent/command-ssh.c: repoint documentation reference. -- Damien Miller is now documenting the ssh-agent protocol via the IETF. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
| * agent: Support SSH signature flags.NIIBE Yutaka2018-04-061-1/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (SSH_AGENT_RSA_SHA2_256): New. (SSH_AGENT_RSA_SHA2_512): New. (ssh_handler_sign_request): Override SPEC when FLAGS is specified. -- GnuPG-bug-id: 3880 Reported-by: Daniel Kahn Gillmor <[email protected]> Signed-off-by: NIIBE Yutaka <[email protected]>
* | Merge branch 'STABLE-BRANCH-2-2' into masterWerner Koch2018-03-271-1/+1
|\|
| * agent: Make the request origin a part of the cache items.Werner Koch2018-03-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/cache.c (agent_put_cache): Add arg 'ctrl' and change all callers to pass it. (agent_get_cache): Ditto. * agent/cache.c (struct cache_items_s): Add field 'restricted'. (housekeeping): Adjust debug output. (agent_flush_cache): Ditto. (agent_put_cache): Ditto. Take RESTRICTED into account. (agent_get_cache): Ditto. -- If requests are coming from different sources they should not share the same cache. This way we make sure that a Pinentry pops up for a remote request to a key we have already used locally. GnuPG-bug-id: 3858 Signed-off-by: Werner Koch <[email protected]>
* | agent: Fix sending connecting process uid to pinentry.NIIBE Yutaka2018-01-261-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (get_client_info): Use LOCAL_PEERCRED. -- LOCAL_PEERUID was wrong (while there is LOCAL_PEERUUID). For FreeBSD and macOS, we can use LOCAL_PEERCRED to get uid. GnuPG-bug-id: 3757 Fixes-commit: 28aa6890588cc108639951bb4bef03ac17743046 Signed-off-by: NIIBE Yutaka <[email protected]>
* | Merge branch 'STABLE-BRANCH-2-2' into masterNIIBE Yutaka2018-01-261-0/+3
|\| | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
| * agent: Fix last commit.NIIBE Yutaka2018-01-261-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | * configure.ac: Check ucred.h as well as sys/ucred.h. * agent/command-ssh.c: Add inclusion of ucred.h. -- It was T2981, adding ucred.h for Solaris. We also need sys/ucred.h for FreeBSD and macOS. Signed-off-by: NIIBE Yutaka <[email protected]>
| * agent: More fix for get_client_pid for portability.NIIBE Yutaka2018-01-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | * configure.ac: Check sys/ucred.h instead of ucred.h. * agent/command-ssh.c: Include sys/ucred.h. -- It's *BSD and macOS thing. Fixes-commit: f7f806afa5083617f4aba02fc3b285b06a7d73d4 Signed-off-by: NIIBE Yutaka <[email protected]>
* | agent: Send pinentry the uid of connecting process where possible.Daniel Kahn Gillmor2017-10-191-6/+21
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/agent.h (server_control_s): Add field 'client_uid'. * agent/call-pinentry.c (start_pinentry): Add uid field to assuan option "owner" sent to pinentry. * agent/command-ssh.c (peer_info_s): New static struct. (get_client_pid): Rename to... (get_client_info): Here, and extract uid in addition to pid. (start_command_handler_ssh): Use get_client_info() instead of get_client_pid(). * agent/command.c (start_command_handler): Try assuan_get_peercred, and only fall back to assuan_get_pid when assuan_get_peercred fails. -- This also requires an update to pinentry to handle the new uid field. Distributing the uid as well as the pid makes it harder for a different user on the same machine to take advantage of any race conditions between when a requesting process might ask for something that needs pinentry, and when pinentry gets around to inspecting the state of that process. We put the uid before the nodename because the uid is guaranteed to be a integer (represented in decimal), which makes it much simpler to parse past than the potentially arbitrarily structured nodename. Use a / instead of whitespace to delimit pid/uid at Werner's request. If we were willing to depend on the nodename being whitespace-delimited (as the current, unreleased pinentry code does), then we could add the uid after the nodename. But since no released pinentry depends on this option anyway, i think we should make the more conservative, easily-parseable choice and put the user ID first. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* agent: Minor fix for Windows.NIIBE Yutaka2017-07-241-1/+1
| | | | | | | * agent/command-ssh.c (serve_mmapped_ssh_request): Add const qualifier. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Support unprotected ssh keys.Justus Winter2017-06-261-1/+12
| | | | | | | | * agent/command-ssh.c (ssh_key_to_protected_buffer): If the empty passphrase is supplied, do not protect the key. GnuPG-bug-id: 2856 Signed-off-by: Justus Winter <[email protected]>
* agent: Make digest algorithms for ssh fingerprints configurable.Justus Winter2017-05-241-2/+2
| | | | | | | | | | | | | | | | | | | | | * agent/agent.h (opt): New field 'ssh_fingerprint_digest'. * agent/command-ssh.c (data_sign, ssh_identity_register): Honor the option for strings used to communicate with the user. * agent/findkey.c (agent_modify_description): Likewise. * agent/gpg-agent.c (cmd_and_opt_values): New value. (opts): New option '--ssh-fingerprint-digest'. (parse_rereadable_options): Set the default to MD5 for now. (main): Handle the new option. * doc/gpg-agent.texi: Document the new option. -- OpenSSH has transitioned from using MD5 to compute key fingerprints to SHA256. This patch makes the digest used when communicating key fingerprints to the user (e.g. in pinentry dialogs) configurable. For now this patch conservatively defaults to MD5. GnuPG-bug-id: 2106 Signed-off-by: Justus Winter <[email protected]>
* agent: Write both ssh fingerprints to 'sshcontrol' file.Justus Winter2017-05-241-4/+18
| | | | | | | | | | * agent/command-ssh.c (add_control_entry): Hand in the key, write both the MD5- and the SHA256-based fingerprint to the 'sshcontrol' file when adding ssh keys. (ssh_identity_register): Adapt callsite. GnuPG-bug-id: 2106 Signed-off-by: Justus Winter <[email protected]>
* common: Support different digest algorithms for ssh fingerprints.Justus Winter2017-05-241-2/+2
| | | | | | | | | | | | | | | | * common/ssh-utils.c (get_fingerprint): Add and honor 'algo' parameter. (ssh_get_fingerprint{,_string}): Likewise. * common/ssh-utils.h (ssh_get_fingerprint{,_string}): Update prototypes. * common/t-ssh-utils.c (main): Adapt accordingly. * agent/command-ssh.c (agent_raw_key_from_file): Likewise. (ssh_identity_register): Likewise. * agent/command.c (do_one_keyinfo): Likewise. * agent/findkey.c (modify_description): Likewise. -- This lays the foundation to support other algorithms. GnuPG-bug-id: 2106 Signed-off-by: Justus Winter <[email protected]>
* agent: Add const qualifier for read-only table.NIIBE Yutaka2017-05-221-5/+5
| | | | | | | | | | | | | | * agent/call-pinentry.c (start_pinentry): Add const to tbl. * agent/command-ssh.c (request_specs): Add const. (ssh_key_types): Likewise. (request_spec_lookup): Add const to the return value and SPEC. (ssh_request_process): Likewise. * agent/protect.c (protect_info): Add const. (agent_unprotect): Add const to algotable. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* Spelling fixes in docs and comments.NIIBE Yutaka2017-04-281-2/+2
| | | | | | | | | | -- In addition, fix trailing spaces in tests/inittests. GnuPG-bug-id: 3121 Reported-by: ka7 (klemens) Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Minor cleanup.NIIBE Yutaka2017-04-171-1/+0
| | | | | | | * agent/command-ssh.c (ssh_key_to_protected_buffer): Not touch ERR. * agent/command.c (cmd_genkey, cmd_import_key): Clean up. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Clean up error initialize/return.NIIBE Yutaka2017-04-141-1/+0
| | | | | | | | | | * agent/call-pinentry.c (start_pinentry): Return RC. * agent/command-ssh.c (ssh_handler_request_identities): Don't set ERR. * agent/findkey.c (try_unprotect_cb): Return ERR. (unprotect): Don't set RC. * agent/gpg-agent.c (handle_connections): Don't set fd. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Simplify stream_read_cstring.NIIBE Yutaka2017-04-121-7/+1
| | | | | | | * agent/command-ssh.c (stream_read_cstring): Just call stream_read_string. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Minor fix for get_client_pid.NIIBE Yutaka2017-04-041-4/+6
| | | | | | * agent/command-ssh.c (get_client_pid): Use 0 to initialize. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Resolve conflict of util.h.NIIBE Yutaka2017-03-071-3/+3
| | | | | | | | | | | | | | | | | * agent/Makefile.am (AM_CPPFLAGS): Remove -I$(top_srcdir)/common. * agent/call-pinentry.c, agent/call-scd.c: Follow the change. * agent/command-ssh.c, agent/command.c, agent/cvt-openpgp.c: Ditto. * agent/divert-scd.c, agent/findkey.c, agent/genkey.c: Ditto. * agent/gpg-agent.c, agent/pksign.c, agent/preset-passphrase.c: Ditto. * agent/protect-tool.c, agent/protect.c, agent/trustlist.c: Ditto. * agent/w32main.c: Ditto. -- For openpty function, we need to include util.h on some OS. We also have util.h in common/, so this change is needed. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Add include files.NIIBE Yutaka2017-03-071-0/+4
| | | | | | * agent/command-ssh.c: Add sys/socket.h and sys/un.h. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Fix get_client_pid for portability.NIIBE Yutaka2017-03-071-11/+32
| | | | | | | | | | | | | | | | | | | * configure.ac: Simply check getpeerucred and ucred.h, and structure members. * agent/command-ssh.c: Include ucred.h. (get_client_pid) [HAVE_STRUCT_SOCKPEERCRED_PID]: Use sockpeercred structure for OpenBSD. [LOCAL_PEERPID]: Use LOCAL_PEERPID for macOS. [LOCAL_PEEREID]: Use LOCAL_PEEREID for NetBSD. [HAVE_GETPEERUCRED]: Use getpeerucred for OpenSolaris. -- This change also addresses following bug. GnuPG-bug-id: 2981. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: For SSH, robustly handling scdaemon's errors.NIIBE Yutaka2017-03-061-10/+9
| | | | | | | | | | | | * agent/command-ssh.c (card_key_list): Return 0 when agent_card_serialno returns an error. (ssh_handler_request_identities): Handle errors for card listing and proceed to other cases. -- GnuPG-bug-id: 2980 Signed-off-by: NIIBE Yutaka <[email protected]>
* Clean up word replication.Yuri Chornoivan2017-02-211-3/+3
| | | | | | | | | -- This fixes extra word repetitions (like "the the" or "is is") in the code and docs. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* agent: No cards is not an error.NIIBE Yutaka2017-02-171-0/+6
| | | | | | * agent/command-ssh.c (card_key_list): Care the case of no cards. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Send back all public keys for available cards.NIIBE Yutaka2017-02-171-8/+68
| | | | | | | | | * agent/call-scd.c (card_cardlist_cb, agent_card_cardlist): New. * agent/command-ssh.c (card_key_list): New. (ssh_handler_request_identities): Call card_key_list and loop for the list to send public keys for all available cards. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Tell the Pinentry the client's pid.Werner Koch2017-02-031-0/+40
| | | | | | | | | | | * configure.ac: Check for SO_PEERCRED et al. * agent/agent.h (server_control_s): Add field 'client_pid'. * agent/command.c (start_command_handler): Set CLIENT_PID. * agent/command-ssh.c (get_client_pid): New. (start_command_handler_ssh): Set CLIENT_PID. * agent/call-pinentry.c (start_pinentry): Tell Pinentry the client-pid. Signed-off-by: Werner Koch <[email protected]>
* Update copyright notices for 2017.Werner Koch2017-01-231-2/+2
| | | | | | | | -- Also some http:// -> https:// fixes. Signed-off-by: Werner Koch <[email protected]>
* agent: Ask specific SERIALNO for pksign/pkdecrypt.NIIBE Yutaka2017-01-161-1/+1
| | | | | | | | | * agent/call-scd.c (agent_card_serialno): Add DEMAND argument. * agent/command-ssh.c (card_key_available): Follow the change. * agent/learncard.c (agent_handle_learn): Likewise. * agent/divert-scd.c (ask_for_card): Use DEMAND argument. Signed-off-by: NIIBE Yutaka <[email protected]>
* Change all http://www.gnu.org in license notices to https://Werner Koch2016-11-051-1/+1
| | | | --
* Fix typos.Justus Winter2016-10-271-1/+1
| | | | | -- Signed-off-by: Justus Winter <[email protected]>
* agent: Add --card option for READKEY.NIIBE Yutaka2016-10-201-31/+1
| | | | | | | | | | * agent/findkey.c (agent_write_shadow_key): New. * agent/command-ssh.c (card_key_available): Use agent_write_shadow_key. * agent/learncard.c (agent_handle_learn): Likewise. * agent/command.c (cmd_readkey): Add --card option. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* Fix more spellingDaniel Kahn Gillmor2016-09-171-1/+1
| | | | | | | | | | | | | | | | | | | * NEWS, acinclude.m4, agent/command-ssh.c, agent/command.c, agent/gpg-agent.c, agent/keyformat.txt, agent/protect-tool.c, common/asshelp.c, common/b64enc.c, common/recsel.c, doc/DETAILS, doc/HACKING, doc/Notes, doc/TRANSLATE, doc/dirmngr.texi, doc/faq.org, doc/gpg-agent.texi, doc/gpg.texi, doc/gpgsm.texi, doc/instguide.texi, g10/armor.c, g10/gpg.c, g10/keyedit.c, g10/mainproc.c, g10/pkclist.c, g10/tofu.c, g13/sh-cmd.c, g13/sh-dmcrypt.c, kbx/keybox-init.c, m4/pkg.m4, sm/call-dirmngr.c, sm/gpgsm.c, tests/Makefile.am, tests/gpgscm/Manual.txt, tests/gpgscm/scheme.c, tests/openpgp/gpgv-forged-keyring.scm, tests/openpgp/multisig.test, tests/openpgp/verify.scm, tests/pkits/README, tools/applygnupgdefaults, tools/gpg-connect-agent.c, tools/mime-maker.c, tools/mime-parser.c: minor spelling cleanup. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* agent: SSH support fix.NIIBE Yutaka2016-08-101-1/+3
| | | | | | | | | * agent/command-ssh.c (ssh_handler_request_identities): Keep error message same. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Fix regression in recent ssh changes.Werner Koch2016-08-091-3/+9
| | | | | | | | | | | | * agent/command-ssh.c (sexp_key_construct): Lowercase the algo name. -- We need to use a lowercase version of the algo in S-expression. Unfortunately Libgcrypt has no function for this, thus we need to malloc and first. Fixes-commit: ebf24e3 Signed-off-by: Werner Koch <[email protected]>
* agent: SSH support improvement.NIIBE Yutaka2016-08-091-1/+1
| | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (ssh_handler_request_identities): Skip a key with error, not giving up to handle the request itself. * agent/cvt-openpgp.c (extract_private_key): Support "ecdsa" key. -- Note that "ecdsa" key is still in use by old versions of gpg-agent through its SSH handling (until 2.1.14). With old versions of gpg-agent, adding ECDSA key by ssh-add command, "ecdsa" key will be created. So, "ecdsa" key should be supported. For g10/gpg, "ecdsa" and "ecdh" was only used in some experimental versions of libgcrypt, with parameters. We now use "ecc" for all cases in released versions. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: More clean up of SSH support.NIIBE Yutaka2016-08-081-94/+29
| | | | | | | | | | | | | | | | | | | | | * common/util.h (get_pk_algo_from_key): New. * common/sexputil.c (get_pk_algo_from_key): The implementation. * agent/gpg-agent.c: Remove include of openpgpdefs.h. * agent/command-ssh.c (struct ssh_key_type_spec): Use integer ALGO. (ssh_key_types): Update with GCRY_PK_*. (make_cstring, sexp_extract_identifier): Remove. (sexp_key_construct): Use gcry_pk_algo_name to get ALGO string. (ssh_key_to_blob): Use cadr to get value list. (ssh_key_type_lookup): Lookup with integer ALGO. (ssh_receive_key): Follow the change of ssh_key_type_lookup. (ssh_send_key_public): Likewise. Use get_pk_algo_from_key to get ALGO. -- This fixes the regresson introduced by the commit 894789c3299dc47a8c1ccaaa7070382f0fae0262. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Clean up SSH support.NIIBE Yutaka2016-08-061-127/+11
| | | | | | | | | * agent/command-ssh.c (file_to_buffer): Remove. (ssh_handler_request_identities): Use agent_public_key_from_file. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Add known keys to sshcontrol.Justus Winter2016-07-191-7/+9
| | | | | | | | | * agent/command-ssh.c (ssh_identity_register): Add a key to sshcontrol even if it is already in the private key store. * tests/openpgp/ssh.scm: Test this. GnuPG-bug-id: 2316 Signed-off-by: Justus Winter <[email protected]>
* Replace use of opt.homedir by accessor functions.Werner Koch2016-06-071-2/+2
| | | | | | | | | | | | | | | | | | | * common/homedir.c (the_gnupg_homedir): New var. (gnupg_set_homedir): New. (gnupg_homedir): New. * g10/options.h (struct opt): Remove 'homedir' and replace all users by the new accessor functions. * g13/g13-common.h (struct opt): Ditto. * scd/scdaemon.h (struct opt): Ditto. * sm/gpgsm.h (struct opt): Ditto. * dirmngr/dirmngr.h (struct opt): Ditto. * agent/preset-passphrase.c (opt_homedir): Ditto. * agent/protect-tool.c (opt_homedir): Ditto. -- This will make detection of a non-default homedir easier. Signed-off-by: Werner Koch <[email protected]>
* agent: Implement new protection mode openpgp-s2k3-ocb-aes.Werner Koch2016-04-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/protect.c (agent_protect): Add arg use_ocb. Change all caller to pass -1 for default. * agent/protect-tool.c: New option --debug-use-ocb. (oDebugUseOCB): New. (opt_debug_use_ocb): New. (main): Set option. (read_and_protect): Implement option. * agent/protect.c (OCB_MODE_SUPPORTED): New macro. (PROT_DEFAULT_TO_OCB): New macro. (do_encryption): Add args use_ocb, hashbegin, hashlen, timestamp_exp, and timestamp_exp_len. Implement OCB. (agent_protect): Change to support OCB. (do_decryption): Add new args is_ocb, aadhole_begin, and aadhole_len. Implement OCB. (merge_lists): Allow NULL for sha1hash. (agent_unprotect): Change to support OCB. (agent_private_key_type): Remove debug output. -- Instead of using the old OpenPGP way of appending a hash of the plaintext and encrypt that along with the plaintext, the new scheme uses a proper authenticated encryption mode. See keyformat.txt for a description. Libgcrypt 1.7 is required. This mode is not yet enabled because there would be no way to return to an older GnuPG version. To test the new scheme use gpg-protect-tool: ./gpg-protect-tool -av -P abc -p --debug-use-ocb <plain.key >prot.key ./gpg-protect-tool -av -P abc -u <prot.key Any key from the private key storage should work. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-15 21:57:01 +0000