aboutsummaryrefslogtreecommitdiffstats
path: root/g10/call-agent.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2025-05-22gpg: Use ECC KEM interface for decryption.NIIBE Yutaka1-2/+8
* g10/call-agent.c (agent_pkdecrypt): Use --kem=PGP for PUBKEY_ALGO_ECDH. * g10/pubkey-enc.c (ecdh_sexp_build): New. (get_it): Use ecdh_sexp_build for PUBKEY_ALGO_ECDH. And don't use pk_ecdh_decrypt since it's done by agent. -- GnuPG-bug-id: 7649 Signed-off-by: NIIBE Yutaka <[email protected]>
2025-02-07gpg: Store Link attributes for composite keys.Werner Koch1-0/+24
* g10/call-agent.c (agent_crosslink_keys): New. * g10/keygen.c (common_gen): Store the Link attribute. -- The Link attribute may be useful to quickly find the other part of a composite private key. GnuPG-bug-id: 6638
2024-07-10gpg: Fix agent_probe_any_secret_key.NIIBE Yutaka1-3/+8
* g10/call-agent.c (agent_probe_any_secret_key): No second keygrip is not an error. -- GnuPG-bug-id: 7195 Signed-off-by: NIIBE Yutaka <[email protected]>
2024-05-31indent: Fix spellingDaniel Kahn Gillmor1-3/+3
-- These are non-substantive corrections for minor spelling mistakes within the GnuPG codebase. With something like this applied to the codebase, and a judiciously tuned spellchecker integrated as part of a standard test suite, it should be possible to keep a uniform orthography within the project. GnuPG-bug-id: 7116
2024-04-09gpg: Some support to allow Kyber decryption.Werner Koch1-4/+27
* g10/call-agent.c (agent_pkdecrypt): Support dual keygrips and switch to KEM mode. * g10/ecdh.c (pk_ecdh_decrypt): Add an extra length check. * g10/keyid.c (do_hash_public_key): Fix Kyber fingerprint computation. * g10/mainproc.c (release_list): Free all 4 data elements. (proc_pubkey_enc): Copy all 4 data elements. * g10/misc.c (openpgp_pk_test_algo2): Map Kyber to KEM. * g10/parse-packet.c (parse_pubkeyenc): Fix Kyber parser. * g10/pubkey-enc.c (get_session_key): Allow Kyber. (get_it): Support Kyber. -- GnuPG-bug-id: 6815
2024-04-05gpg: Allow to create a Kyber key from keygrips.Werner Koch1-1/+1
* agent/cvt-openpgp.c (extract_private_key): Support Kyber algorithms. * common/openpgp-oid.c (map_gcry_pk_to_openpgp): Map KEM to Kyber. * common/sexputil.c (get_pk_algo_from_key): Increase buffer for use with "kyber1024". * g10/call-agent.c (agent_get_keyinfo): Fix warning. * g10/keygen.c (do_create_from_keygrip): Support Kyber. (ask_algo): Ditto. -- To test create a standard key and the use --edit-key and "addkey" with selection 13 and use the comma delimited keygrips. GnuPG-bug-id: 7014
2024-04-05gpg: Support dual keygrips.Werner Koch1-18/+101
* g10/keyid.c (keygrip_from_pk): Add arg get_second to support dual algos. Implement for Kyber. (hexkeygrip_from_pk): Extend for dual algos. * g10/call-agent.c (agent_keytotpm): Bail out for dual algos. (agent_keytocard): Ditto. (agent_probe_secret_key): Handle dual algos. (agent_probe_any_secret_key): Ditto. (agent_get_keyinfo): Allow for dual algos but take only the first key. * g10/export.c (do_export_one_keyblock): Bail out for dual algos. -- This also adds some fixmes which we eventually need to address. GnuPG-bug-id: 6815
2024-04-05gpg: Don't show the "fast path listing" diagnostic with --quiet.Werner Koch1-2/+3
* g10/call-agent.c (agent_probe_any_secret_key): Act on --quiet. -- When using the extra-socket this disagnostic will be printed because a listing of all secret keys is not allowed by a remote gpg.
2024-01-22gpg: Use ephemeral mode for generating card keys.Werner Koch1-0/+39
* g10/call-agent.c (agent_set_ephemeral_mode): New. * g10/keyedit.c (keyedit_menu) <bkuptocard>: Switch to ephemeral mode. * g10/keygen.c (do_generate_keypair): Switch to ephemeral mode for card keys with backup. -- GnuPG-bug-id: 6944
2024-01-02gpg: Choose key from inserted card over a non-inserted cardWerner Koch1-3/+10
* g10/call-agent.c (agent_probe_secret_key): Do not return an error but 0. * g10/getkey.c (finish_lookup): Improve the selection of secret keys. -- GnuPG-bug-id: 6831
2023-11-14gpg,gpgsm: Hide password in debug output also for asked passwords.Werner Koch1-1/+5
* g10/call-agent.c (agent_get_passphrase): Call assuan_begin_confidential and assuan_end_confidential. * sm/call-agent.c (gpgsm_agent_ask_passphrase): Ditto. -- GnuPG-bug-id: 6654 The drawback of this solution is that we don't see any IPC lines from the assuan_transact. Everything else would require larger changes to libassuan.
2023-11-09gpg,sm: Set confidential in assuan communication for password.NIIBE Yutaka1-0/+2
* g10/call-agent.c (default_inq_cb): Call assuan_begin_confidential and assuan_end_confidential. * sm/call-agent.c (default_inq_cb): Likewise. -- Cherry pick from master commit of: ec1446f9446506b5fbdf90cdeb9cbe1f410a657e GnuPG-bug-id: 6654 Signed-off-by: NIIBE Yutaka <[email protected]>
2023-11-09gpg,sm: Set confidential in assuan communication for password.NIIBE Yutaka1-0/+2
* g10/call-agent.c (default_inq_cb): Call assuan_begin_confidential and assuan_end_confidential. * sm/call-agent.c (default_inq_cb): Likewise. -- GnuPG-bug-id: 6654 Signed-off-by: NIIBE Yutaka <[email protected]>
2023-10-06scd:openpgp: Return better error codes for the Reset Code.Werner Koch1-0/+1
* scd/app-openpgp.c (do_change_pin): Use GPG_ERR_BAD_RESET_CODE where appropriate. * common/util.h: Add error codes missing in gpgrt 1.46. * agent/call-pinentry.c (unlock_pinentry): Handle GPG_ERR_BAD_RESET_CODE. (agent_askpin): Ditlo. Also simply condition. (agent_get_passphrase): Ditto. * g10/call-agent.c (status_sc_op_failure): Handle GPG_ERR_BAD_RESET_CODE. * g10/card-util.c (write_sc_op_status): Ditto. * tools/card-call-scd.c (status_sc_op_failure): Ditto.
2023-08-29common: Prepare for more flags in start_new_service.Werner Koch1-1/+2
* common/asshelp.h (ASSHELP_FLAG_AUTOSTART): New. * common/asshelp.c (start_new_service): Rename arg autostart to flags and adjust checks. (start_new_gpg_agent): Likewise. Change all callers. (start_new_keyboxd): Likewise. Change all callers. (start_new_dirmngr): Likewise. Change all callers. -- It is easier to have a generic flags arg instead of adding more and more dedicated args. verbose and debug are kept as they are because they are not boolean.
2023-04-21gpg: Fix writing ECDH keys to OpenPGP smartcards.Werner Koch1-3/+5
* agent/command.c (cmd_keytocard): Add new arg for ECDH params. * scd/app-openpgp.c (ecc_writekey): Use provided ECDH params to compute the fingerprint. * g10/call-agent.c (agent_keytocard): Add arg ecdh_param_str. * g10/keyid.c (ecdh_param_str_from_pk): New. * g10/card-util.c (card_store_subkey): Pass ECDH params to writekey. * g10/keygen.c (card_store_key_with_backup): Ditto. * scd/app-openpgp.c (store_fpr): Add arg update. (rsa_read_pubkey, ecc_read_pubkey): Add arg meta_update and avoid writing the fingerprint back to the card if not set. (read_public_key): Also add arg meta_update. (get_public_key): Do not pass it as true here... (do_genkey): ... but here. (rsa_write_key, ecc_writekey): Force string the fingerprint. -- The problem showed up because in 2.4 we changed the standard ECDH parameter some years ago. Now when trying to write an ECDH key created by 2.2 with 2.4 to an openpgp card, scdaemon computes a wrong fingerprint and thus gpg was not able to find the key again by fingerprint. The patch also avoids updating the stored fingerprint in certain situations. This fix is somewhat related to GnuPG-bug-id: 6378
2023-04-18gpg: Make sure that we are not accidently working with the PIV app.Werner Koch1-0/+24
* g10/call-agent.c (agent_scd_switchapp): New. * g10/card-util.c (get_info_for_key_operation): Call it. -- It may happen that the active card was last used for PIV and in that case certain commands will fail because they assume the OpenPGP app. Fortunately we have a pretty central place to assure that the right app has been selected. The bug can be easily noticed on Windows. GnuPG-bug-id: 6378
2022-12-02gpg: New export option "mode1003".Werner Koch1-6/+14
* agent/command.c (cmd_export_key): Add option --mode1003. (command_has_option): Ditto. * g10/build-packet.c (do_key): Implement mode 1003. * g10/parse-packet.c (parse_key): Ditto. * g10/options.h (EXPORT_MODE1003): New.o * g10/call-agent.c (agent_export_key): Add arg mode1003. * g10/export.c (parse_export_options): Add "mode1003" (secret_key_to_mode1003): New. (receive_seckey_from_agent): Add arg mode1003. (do_export_one_keyblock): Pass option down. -- This option allows to export a secret key in GnuPG's native format. Thus no re-encryption is required and further the public key parameters are also authenticated if a protection passphrase has been used. Note that --import is not yet able to handle this new mode. Although old version of GnuPG will bail out with "invalid packet" if a mode1003 exported secret key is seen.
2022-08-04gpg: Fix wrong error message for keytocard.Werner Koch1-3/+1
* g10/call-agent.c (agent_keytocard): Emit SC_OP_FAILURE. -- GnuPG-bug-id: 6122
2022-01-18gpg: Print Yubikey version correctly.Werner Koch1-0/+7
* g10/call-agent.c (learn_status_cb): Parse APPVERSION. * g10/call-agent.h (struct agent_card_info_s): Add field appversion. * g10/card-util.c (print_a_version): New. (current_card_status): Print version from appversion. -- This is a regression due to the PIV support. Note that the newer gpg-card worked correctly. GnuPG-bug-id: 5787
2021-05-20g10: Avoid memory leaksJakub Jelen1-13/+15
* g10/call-agent.c (card_keyinfo_cb): free keyinfo. Restructure to avoid backward gotos. * g10/keyedit.c (menu_set_keyserver_url): properly enclose the block * g10/keygen.c (gen_card_key): free pk and pkt -- Signed-off-by: Jakub Jelen <[email protected]> GnuPG-bug-id: 5393 Additional changes: - Restructure to avoid backward gotos. Signed-off-by: Werner Koch <[email protected]>
2021-05-19gpg: Improve speed of secret key listing.Werner Koch1-16/+88
* agent/command.c (cmd_keyinfo): Factor some code out to ... (get_keyinfo_on_cards): ... new. (cmd_havekey): Add --list mode. * g10/gpg.h (struct server_control_s): Add new caching vars. * g10/gpg.c (gpg_deinit_default_ctrl): Release cache. * g10/call-agent.c (agent_probe_any_secret_key): Init and try to use the keygrip cache. (agent_genkey): Clear the cache. (agent_import_key): Ditto. * g10/keylist.c (list_all, list_one): Pass ctrl to agent_probe_any_secret_key. * g10/getkey.c (lookup): Ditto. -- With this change we first ask the agent for a list of all secret keygrips and use that list instead of asking the agent for each public key. Speeds up my "gpg -K" with a lot of secret and public keys by more than 25%. Signed-off-by: Werner Koch <[email protected]>
2021-04-23gpg: Allow decryption w/o public key but with correct card inserted.Werner Koch1-0/+10
* agent/command.c (cmd_readkey): Add option --no-data and special handling for $SIGNKEYID and $AUTHKEYID. * g10/call-agent.c (agent_scd_getattr): Create shadow keys for KEY-FPR output. * g10/skclist.c (enum_secret_keys): Automagically get a missing public key for the current card. Signed-off-by: Werner Koch <[email protected]>
2021-03-10gpg: Add new command keytotpm to convert a private key to TPM formatJames Bottomley1-0/+22
* agent/command.c (cmd_keytotpm): New. (agent/command.c): Register new command KEYTOTPM. * g10/call-agent.c (agent_keytotpm): New. * g10/keyedit.c (cmdKEYTOTPM): New command "keytotpm". (keyedit_menu): Implement. -- The plumbing is done in two parts: the agent is modified to understand a KEYTOTPM assuan command taking the key grip as an argument. This simply obtains the key s expression and calls the existing writeky diversion to the tpm2daemon. The daemon reponds with the TPM conversion of the key and that key is then stored in the keyfile as a shadowed-private-key with "tpm2-v1" type. To effect the conversion, all the user does from gpg --edit-key is select which private key they wish to move (or move the primary if no key is selected) and type keytotpm. The conversion to TPM form is instantaneous and once converted, the actual key cannot be recovered, meaning that if you want your gpg key to move to a new laptop you must keep an unconverted backup copy in a safe location. When you do a list command, all TPM keys show up as card-no: TPM-Protected The key is stored encrypted to the TPM2 storage seed and since each TPM has a unique seed, only the single TPM contained in your laptop can now read the key. This means you cannot simply copy the shadowed key file over to a new laptop, you must copy over the backup copy and then convert it to TPM form on the new laptop. To decomission your laptop, execute a tssclear command which regenerates the storage seed and effectively shreds all keys. Note when you have done this *every* TPM2 shadowed private key becomes unreadable by any TPM and all are effectively destroyed. Signed-off-by: James Bottomley <[email protected]> Very minor cosmetic changes. Signed-off-by: Werner Koch <[email protected]>
2020-12-07gpg,card: Allow no version information of Yubikey.NIIBE Yutaka1-1/+2
* g10/call-agent.c (learn_status_cb): Assume >= 2 when no version. * tools/card-call-scd.c (learn_status_cb): Likewise. -- GnuPG-bug-id: 5100 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-20gpg: Change API of agent_scd_serialno.NIIBE Yutaka1-2/+8
* g10/call-agent.c (agent_scd_serialno): Extend API to allow with R_SERIALNO == NULL. * g10/card-util.c (card_status): Use NULL for agent_scd_serialno. (factory_reset): Likewise. * g10/skclist.c (build_sk_list): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-20Fix the previous comment changes help doc string.NIIBE Yutaka1-1/+1
* scd/command.c (hlp_learn): Fix the doc string. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-20gpg,agent: Fix comments for KEYPAIRINFO status report.NIIBE Yutaka1-1/+1
-- Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-10gpg: Fix agent_delete_key interaction.NIIBE Yutaka1-0/+1
* g10/call-agent.c (agent_delete_key): Set up CTX. -- Fixes-commit: 20acc7c0226550530085a674ef1bb41ebfa39408 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-11-09card: Run factory-reset in locked stated also in gpg-card.Werner Koch1-2/+3
* tools/card-call-scd.c (scd_apdu): Add more pseudo APDUs. * tools/card-misc.c (send_apdu): Handle them. * tools/gpg-card.c (cmd_factoryreset): Use lock commands. -- This is port of the code used with gpg-card-edit. Note that the command "apdu" now also understands some extra keywords. Signed-off-by: Werner Koch <[email protected]>
2020-11-09card: Run factory-reset in locked stated.Werner Koch1-2/+28
* scd/command.c (reset_notify): Add option --keep-lock. (do_reset): Add arg keep_lock. (cmd_lock): Send progress status. * g10/call-agent.c (agent_scd_apdu): Add more pseudo APDUs. * g10/card-util.c (send_apdu): Ditto. (factory_reset): Use lock commands. -- This is required so that for example Kleopatra does not detect the RESET and issues a SERIALNO of its own, thus conflicting with our SERIALNO undefined. Signed-off-by: Werner Koch <[email protected]>
2020-10-26g10: Make call to agent_scd_serialno more robust.Werner Koch1-0/+1
* g10/call-agent.c (agent_scd_serialno): Make sure that NULL is stored on error at r_serialno. * g10/card-util.c (card_status): Simplify freeing of seriaono. (factory_reset): Ditto. -- This pattern is what we use with other functions returning an allocated string and thus less surprising.
2020-09-18common,agent,dirmngr,g10,tools: Fix split_fields API.NIIBE Yutaka1-3/+3
* common/stringhelp.h (split_fields): Use const * for the strings in the ARRAY. (split_fields_colon): Likewise. * common/stringhelp.c (split_fields, split_fields_colon): Fix the implementation. * agent/call-scd.c, agent/command.c: Follow the change. * common/t-stringhelp.c, dirmngr/loadswdb.c: Likewise. * g10/call-agent.c, tools/card-call-scd.c: Likewise. * tools/card-yubikey.c, tools/gpg-card.c: Likewise. * tools/gpg-card.h, tools/gpg-wks-client.c: Likewise. * tools/gpgconf-comp.c, tools/gpgconf.c: Likewise. * tools/wks-util.c: Likewise. -- The strings in the ARRAY don't need to be released by caller, as those are references. It's easier to follow the code when it's explicitly const *. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-09-08gpg,tools: Add handling of supported algorithms by a card.NIIBE Yutaka1-0/+24
* g10/call-agent.h (struct agent_card_info_s): Add supported_keyalgo. * g10/call-agent.c (learn_status_cb): Parse KEY-ATTR-INFO. (agent_release_card_info): Release supported_keyalgo. * tools/gpg-card.h (struct card_info_s): Add supported_keyalgo. * tools/card-call-scd.c (learn_status_cb): Parse KEY-ATTR-INFO. (release_card_info): Release supported_keyalgo. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-09-01Use only one copy of the warn_server_mismatch function.Werner Koch1-35/+3
* common/asshelp.c (warn_server_version_mismatch): New. Actually a slightly modified version of warn_version_mismatch found in other modules. * common/status.c (gnupg_status_strings): New. * g10/cpr.c (write_status_strings2): New. * g10/call-agent.c (warn_version_mismatch): Use the new unified warn_server_version_mismatch function. * g10/call-dirmngr.c (warn_version_mismatch): Ditto. * g10/call-keyboxd.c (warn_version_mismatch): Ditto. * sm/call-agent.c (warn_version_mismatch): Ditto. * sm/call-dirmngr.c (warn_version_mismatch): Ditto. * tools/card-call-scd.c (warn_version_mismatch): Ditto. Signed-off-by: Werner Koch <[email protected]>
2020-08-19gpg,gpgsm: Record the creation time of a private key.Werner Koch1-5/+26
* sm/call-agent.c (gpgsm_agent_genkey): Pass --timestamp option. (gpgsm_agent_import_key): Ditto. * g10/call-agent.c (agent_genkey): Add arg timestamp and pass it on. (agent_import_key): Ditto. * g10/import.c (transfer_secret_keys): Pass the creation date to the agent. * g10/keygen.c (common_gen): Ditto. -- Having the creation time in the private key file makes it a lot easier to re-create an OpenPGP public keyblock in case it was accidentally lost. Signed-off-by: Werner Koch <[email protected]>
2020-07-08Do not use the pinentry's qualitybarWerner Koch1-1/+1
* agent/genkey.c (agent_ask_new_passphrase): No qualitybar. * g10/call-agent.c (agent_get_passphrase): Ditto. * sm/call-agent.c (gpgsm_agent_ask_passphrase): Ditto. -- The concept of a passphrase quality indicator is anyway questionable because user are smart enough to trick them out and they also tend to limit the actually used entropy. Except for the red/green switching (to show whether constraints are fulfilled) our qualitybar is pretty bad and thus worse than none. Signed-off-by: Werner Koch <[email protected]>
2020-07-08gpg: Use integrated passphrase repeat entry also for -c.Werner Koch1-4/+15
* g10/call-agent.c (agent_get_passphrase): Add arg newsymkey. * g10/passphrase.c (passphrase_get): Add arg newsymkey. (passphrase_to_dek): Pass it on. Signed-off-by: Werner Koch <[email protected]>
2020-04-03gpg,card: Use the new MANUFACTURER attribute.Werner Koch1-0/+12
* tools/gpg-card.h (struct card_info_s): Add manufacturer fields. * tools/card-call-scd.c (release_card_info): Release them. (learn_status_cb): Parse MANUFACTURER attribute. * tools/gpg-card.c (get_manufacturer): Remove. (list_card): Use the new attribute. * g10/call-agent.h (struct agent_card_info_s): Add manufacturer fields. * g10/call-agent.c (agent_release_card_info): Release them. (learn_status_cb): Parse MANUFACTURER attribute. * g10/card-util.c (get_manufacturer): Remove. (current_card_status): Use new attribute. -- This does away with the duplicated OpenPGP vendor tables; they are now at a better place (app-openpgp.c). Signed-off-by: Werner Koch <[email protected]>
2020-02-20gpg: Use gpgrt's new option parser to provide a global conf file.Werner Koch1-1/+1
* common/util.h: Remove argparse.h. * common/argparse.c: Undef GPGRT_ENABLE_ARGPARSE_MACROS. * configure.ac (GPGRT_ENABLE_ARGPARSE_MACROS): Define. * agent/gpg-agent.c: Undef GPGRT_ENABLE_ARGPARSE_MACROS and include argparse.h. Do this also for all main modules which use our option parser except for gpg. Replace calls to strusage by calls to gpgrt_strusage everywhere. * g10/gpg.c (opts): Change type to gpgrt_opt_t. Flag oOptions and oNoOptions with ARGPARSE_conffile and ARGPARSE_no_conffile. (main): Change type of pargs to gpgrt_argparse_t. Rework the option parser to make use of the new gpgrt_argparser. -- This is not yet finished but a make check works. gpg has the most complex and oldest option handling and thus this is the first migration target. SE-Linux checks and version-ed config files are missing and will be added later. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
2020-02-18Spelling cleanup.Daniel Kahn Gillmor1-2/+2
No functional changes, just fixing minor spelling issues. --- Most of these were identified from the command line by running: codespell \ --ignore-words-list fpr,stati,keyserver,keyservers,asign,cas,iff,ifset \ --skip '*.po,ChangeLog*,help.*.txt,*.jpg,*.eps,*.pdf,*.png,*.gpg,*.asc' \ doc g13 g10 kbx agent artwork scd tests tools am common dirmngr sm \ NEWS README README.maint TODO Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2020-02-13gpg: Changes to allow direct key generation from an OpenPGP card.Werner Koch1-52/+145
* g10/call-agent.h (struct keypair_info_s): Add fields keytime and usage. * g10/call-agent.c (struct keypairinfo_cb_parm_s): New. (scd_keypairinfo_status_cb): Rework to store parsed KEYPAIRINFO data. (agent_scd_keypairinfo): Change accordingly. (agent_scd_readkey): Add arg ctrl and change callers. Change return arg from an strlist_t to a keypair_info_t. (readkey_status_cb): Use KEYPAIRINFO instead of KEY-TIME. * g10/keygen.c (pSUBKEYCREATIONDATE): New. (pAUTHKEYCREATIONDATE): New. (get_parameter_u32): Allow for new parameters. (do_create_from_keygrip): For card keys use direct scd call which does not create a stub file. (ask_algo): Rework to use the new keypair_info_t as return from agent_scd_keypairinfo. (parse_key_parameter_part): Likewise. Also get and return the key creation time using a arg. (parse_key_parameter_string): New args r_keytime and r_subkeytime. (parse_algo_usage_expire): New arg r_keytime. (proc_parameter_file): Ignore the explict pCREATIONDATE for card keys. (quickgen_set_para): New arg keytime. (quick_generate_keypair): Get the keytimes and set the pCARDKEY flag. (generate_keypair): Likewise. (do_generate_keypair): Implement the cardkey with keytime thingy. (generate_subkeypair): Use the keytime parameters. * g10/keygen.c (pAUTHKEYCREATIONDATE): New. Not yet set but may come handy later. (get_parameter_u32): Take care of that. (do_generate_keypair): For cardkeys sign with the current time. -- Key generation direct from the card used to work for all cards except the OpenPGP cards. The key generation from card using an OpenPGP card is special because the fingerprint is stored on the card and we must make sure that the newly created key has the same fingerprint. This requires that we take the key creation date as stored on the card into account. Along with the recent change in gpg-agent this change also fixes a problem with existing stub files. Note that with a key take from a card the self-signature are created with the current time and not the creation time. This allows to better distinguish keys created using the same card. Signed-off-by: Werner Koch <[email protected]>
2020-02-12gpg: Rename the struct card_key_info_s.Werner Koch1-7/+9
* g10/call-agent.h (struct card_key_info_s): Rename to ... (struct keypair_info_s): this. (keypair_info_t): New. Use this everywhere instead of card_key_info_s. * g10/call-agent.c (agent_scd_free_keyinfo): Rename to .. (free_keypair_info): this. Change all callers. -- The struct is also useful to store the data from KEYPAIRINFO status lines. Thus renaming it makes sense. A future patch will extend the struct. Signed-off-by: Werner Koch <[email protected]>
2020-02-11gpg: Improve key creation direct from the card.Werner Koch1-12/+53
* g10/call-agent.c (readkey_status_cb): New. (agent_scd_readkey): Add new arg r_keytime and allow NULL for r_result. Change all callers. (agent_readkey): Minor code reformatting. * g10/keygen.c (pCARDKEY): New. (struct para_data_s): Add u.bool. (get_parameter_bool): New. (do_create_from_keygrip): Add arg cardkey and make use of it. (ask_algo): Add args r_cardkey and r_keytime. Read the keytime of the selected card key and return it. (generate_keypair): Store CARDKEY and KEYTIME. (do_generate_keypair): Pass CARDKEY to do_create_from_keygrip. (generate_subkeypair): Ditto. -- This allows to first create keys on the card (e.g. using gpg-card) even without having any public key for OpenPGP. Then the key generation option 14 (cardkey) can be used to create a primary OpenPGP key from the key on the card. There are still a couple of problems related to the agent which creates the stub key and may run into problems if creating a second key from the card. This will be fixed in a future patch. Signed-off-by: Werner Koch <[email protected]>
2020-01-17gpg: Prefer card key on use in multiple subkeys situation.NIIBE Yutaka1-38/+63
* g10/call-agent.c (keyinfo_status_cb): Parse more fields. (agent_probe_secret_key): Use KEYINFO and returns bigger value representing the preference. * g10/getkey.c (finish_lookup): For subkeys, select one by using value of agent_probe_secret_key. -- GnuPG-bug-id: 3416 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-01-17gpg: Prepare enhancement of agent_probe_secret_key.NIIBE Yutaka1-3/+5
* g10/call-agent.c (agent_probe_secret_key): Change semantics of return value. * g10/call-agent.h (agent_probe_secret_key): Change comment. * g10/delkey.c (do_delete_key): Follow the change. * g10/getkey.c (get_seckey, parse_def_secret_key): Likewise. (finish_lookup, have_secret_key_with_kid): Likewise. * g10/gpgv.c (agent_probe_secret_key): Likewise. * g10/keyedit.c (keyedit_menu, quick_find_keyblock): Likewise. (show_key_with_all_names_colon): Likewise. * g10/revoke.c (gen_desig_revoke, gen_revoke): Likewise * g10/test-stubs.c (agent_probe_secret_key): Likewise. -- GnuPG-bug-id: 3416 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-01-16gpg: Add agent_scd_keyinfo to retrieve available card keys.NIIBE Yutaka1-0/+163
* g10/call-agent.c (card_keyinfo_cb, agent_scd_free_keyinfo) (agent_scd_keyinfo): New. * g10/call-agent.h: Define new functions. Signed-off-by: NIIBE Yutaka <[email protected]>
2019-08-21gpg: New option --use-only-openpgp-cardWerner Koch1-1/+3
* g10/gpg.c (opts): Add option. (main): Set flag. * g10/options.h: Add flags.use_only_openpgp_card. * g10/call-agent.c (start_agent): Implement option. -- With the previous patch we switch to autoselect an application instead of requesting an openpgp card. This option allows to revert this in case of use use cases which expected the former behaviour. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit c185f6dfbd1bfd809369da789239a371e9d1610e) This was first added to the 2.2 branch.
2019-07-26gpg,gpgsm: Handle pkdecrypt responses with/without NUL terminators.Daniel Kahn Gillmor1-5/+8
* g10/call-agent.c (agent_pkdecrypt): accept but do not require NUL-terminated data from the agent. * sm/call-agent.c (gpgsm_agent_pkdecrypt): accept but do not require NUL-terminated data from the agent. GnuPG-bug-id: 4652 Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2019-07-19card: Fix showing KDF object attribute.NIIBE Yutaka1-1/+9
* g10/call-agent.c (learn_status_cb): Parse the KDF DO. * g10/card-util.c (current_card_status): Show it correctly. Signed-off-by: NIIBE Yutaka <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-09 05:13:27 +0000