aboutsummaryrefslogtreecommitdiffstats
path: root/g10 (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* | Adjust for changed macro names in libgpg-error master.Werner Koch2017-12-114-5/+5
| | | | | | | | | | | | | | | | | | | | * common/logging.h (GPGRT_LOGLVL_): New replacement macros for older libgpg-error versions. -- Updates-commit: b56dfdfc1865ceb7c3c025d79996e049faee7fdf Signed-off-by: Werner Koch <[email protected]>
* | Use the gpgrt log functions if possible.Werner Koch2017-11-274-14/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/logging.c: Do not build any code if we can use the gpgrt_log functions. (log_logv_with_prefix): Rename to log_logv_prefix and change order of args so that this function matches its printf like counterpart gpgrt_logv_prefix. Change all callers. (log_debug_with_string): Rename to log_debug_string. Change all callers. (log_printhex): Move first arg to end so that this function matches its printf like counterpart gpgrt_log_printhex. Change all callers. * common/logging.h: Divert to gpgrt/libgpg-error if we can use the gpgrt_log functions. (bug_at): Add inline versions if we can use the gpgrt_log functions. * configure.ac (GPGRT_ENABLE_LOG_MACROS): Add to AH_BOTTOM. (mycflags): Add -Wno-format-zero-length. -- This patch enables the use of the log function from libgpgrt (aka libgpg-error). Instead of checking a version number, we enable them depending on macros set by recent gpg-error versions. Eventually the whole divert stuff can be removed. The -Wno-format-zero-length is required because log_printhex can be called with an empty format string. Note that this is fully specified standard C behaviour. Signed-off-by: Werner Koch <[email protected]>
* | Merge branch 'STABLE-BRANCH-2-2'Werner Koch2017-11-232-1/+7
|\| | | | | | | | | | | -- Signed-off-by: Werner Koch <[email protected]>
| * build: Update distsigkey.gpgWerner Koch2017-11-221-0/+0
| | | | | | | | --
| * gpg: Fix memory leaking for long inputs via --command-fd.Werner Koch2017-11-221-1/+7
| | | | | | | | | | | | | | | | | | | | | | * g10/cpr.c (do_get_from_fd): Free the old buffer. -- If the received input is longer than 200 characters we used to leak the previous allocated buffer. GnuPG-bug-id: 3528 Signed-off-by: Werner Koch <[email protected]>
* | gpg: Repurpose the ISO defined DO "sex" to "salutation".Werner Koch2017-11-151-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | * g10/card-util.c (current_card_status): String changes. (change_sex): Description change. (cmds): Add "salutation"; keep "sex" as an alias. -- Note that we can't change the used values or tags but at least the UI should show reflect the real purpose of the field. Signed-off-by: Werner Koch <[email protected]>
* | Merge branch 'STABLE-BRANCH-2-2'Werner Koch2017-11-151-2/+3
|\| | | | | | | | | -- Kept our AUTHORS and README
| * gpg: Print AKL info only in verbose mode.Werner Koch2017-11-151-2/+3
| | | | | | | | | | | | | | | | * g10/getkey.c (get_pubkey_byname): Print info only in verbose mode. -- GnuPG-bug-id: 3504 Signed-off-by: Werner Koch <[email protected]>
| * g10: Unattended key generation "Key-Grip" and "Subkey-Grip".NIIBE Yutaka2017-11-061-9/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/keygen.c (pSUBKEYGRIP): New. (read_parameter_file): Add "Key-Grip" and "Subkey-Grip". (do_generate_keypair): Support pSUBKEYGRIP. -- In the manual, it says "Key-Grip". gpgsm also supports "Key-Grip". Adding "Subkey-Grip" now, adding "Key-Grip" makes sense. GnuPG-bug-id: 3478 Signed-off-by: NIIBE Yutaka <[email protected]> (cherry picked from commit 6c63a04569c07c9c2817c7c530a92ccfa58155cc)
| * g10: Simplify "factory-reset" procedure.NIIBE Yutaka2017-11-061-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/card-util.c (factory_reset): Simplify. -- In this summer, I got report about old code before this change didn't work with newer Yubikey. I got another report test version of OpenPGP card V3.3 implementation didn't work, either. Then, I confirmed that according to the OpenPGP card specification, the procedure of old code is not expected by its author. This change simplify "factory-reset" as simple. Only versions of Gnuk 1.2.2, 1.2.3, 1.2.4, won't work with this change. That's because the factory-reset feature of Gnuk was introduced by reading the implementation of GnuPG, instead of reading the specification. Gnuk 1.2.5 and later works well. All OpenPGPcard implementations I have work well (2.0, 2.1, 2.2, test version of 3). GnuPG-bug-id: 3286 Signed-off-by: NIIBE Yutaka <[email protected]> (cherry picked from commit d63b7966cdd72548c60466c620de5cd6104a779e)
| * gpg: Introduce magic value 25519 to switch a card to ECC.Werner Koch2017-11-021-21/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/card-util.c (ask_card_keyattr): Handle special value 25519. (do_change_keyattr): Allow changing to cv25519/ed25519. (generate_card_keys): Ditto. (card_generate_subkey): Ditto. -- This is kludge to make it easier for gnuk to be switched into ECC mode. This is basically the same change as commit ea09b6cded9d31a8ebd91878553c3eaa2b76e817 but without the string change in show_keysize_warning. Signed-off-by: Werner Koch <[email protected]>
| * gpg: Rename two card related functions in card-util.Werner Koch2017-11-021-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | * g10/card-util.c (ask_card_rsa_keysize): Rename to ask_card_keyattr. (do_change_rsa_keysize): Rename to do_change_keyattr. -- We want to support other algos than RSA and thus we need a better name for the functions. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit f795f4529d8ab5a05db1cc1960abd34390bfae1b)
* | g10: Fix regexp sanitization.NIIBE Yutaka2017-11-091-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/trustdb.c (sanitize_regexp): Only escape operators. -- To sanitize a regular expression, quoting by backslash should be only done for defined characters. POSIX defines 12 characters including dot and backslash. Quoting other characters is wrong, in two ways; It may build an operator like: \b, \s, \w when using GNU library. Case ignored match doesn't work, because quoting lower letter means literally and no much to upper letter. GnuPG-bug-id: 2923 Co-authored-by: Damien Goutte-Gattat <[email protected]> Signed-off-by: NIIBE Yutaka <[email protected]>
* | gpg: Unifiy the message for re-configuring cards.Werner Koch2017-11-021-1/+5
| | | | | | | | | | | | | | | | | | | | * g10/card-util.c (ask_card_keyattr): Print "rsaNNNN". -- This is a separate patch from the previous to avoid string changes when backporting the other patch to 2.2. Signed-off-by: Werner Koch <[email protected]>
* | gpg: Introduce magic value 25519 to switch a card to ECC.Werner Koch2017-11-021-27/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/card-util.c (show_keysize_warning): Slightly change the text. (ask_card_keyattr): Handle special value 25519. (do_change_keyattr): Allow changing to cv25519/ed25519. (generate_card_keys): Ditto. (card_generate_subkey): Ditto. -- This is kludge to make it easier for gnuk to be switched into ECC mode. Signed-off-by: Werner Koch <[email protected]>
* | Register another OpenPGP card vendor.Werner Koch2017-11-011-0/+1
| | | | | | | | --
* | gpg: Remove trailing comma in an enum.Werner Koch2017-11-011-1/+1
| | | | | | | | | | | | -- Signed-off-by: Werner Koch <[email protected]>
* | gpg: Rename two card related functions in card-util.Werner Koch2017-11-011-6/+6
| | | | | | | | | | | | | | | | | | | | | | * g10/card-util.c (ask_card_rsa_keysize): Rename to ask_card_keyattr. (do_change_rsa_keysize): Rename to do_change_keyattr. -- We want to support other algos than RSA and thus we need a better name for the functions. Signed-off-by: Werner Koch <[email protected]>
* | g10: Unattended key generation "Key-Grip" and "Subkey-Grip".NIIBE Yutaka2017-11-011-9/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/keygen.c (pSUBKEYGRIP): New. (read_parameter_file): Add "Key-Grip" and "Subkey-Grip". (do_generate_keypair): Support pSUBKEYGRIP. -- In the manual, it says "Key-Grip". gpgsm also supports "Key-Grip". Adding "Subkey-Grip" now, adding "Key-Grip" makes sense. GnuPG-bug-id: 3478 Signed-off-by: NIIBE Yutaka <[email protected]>
* | g10: Simplify "factory-reset" procedure.NIIBE Yutaka2017-10-301-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/card-util.c (factory_reset): Simplify. -- In this summer, I got report about old code before this change didn't work with newer Yubikey. I got another report test version of OpenPGP card V3.3 implementation didn't work, either. Then, I confirmed that according to the OpenPGP card specification, the procedure of old code is not expected by its author. This change simplify "factory-reset" as simple. Only versions of Gnuk 1.2.2, 1.2.3, 1.2.4, won't work with this change. That's because the factory-reset feature of Gnuk was introduced by reading the implementation of GnuPG, instead of reading the specification. Gnuk 1.2.5 and later works well. All OpenPGPcard implementations I have work well (2.0, 2.1, 2.2, test version of 3). GnuPG-bug-id: 3286 Signed-off-by: NIIBE Yutaka <[email protected]>
* | Merge branch 'STABLE-BRANCH-2-2' into masterWerner Koch2017-10-275-93/+178
|\| | | | | | | | | | | -- Resolved Conflicts: configure.ac - Adjust due to new log_clock otions
| * gpg: Avoid superfluous sig check info during import.Werner Koch2017-10-241-47/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/key-check.c (print_info): New. (key_check_all_keysigs): Print sig checking results only in debug mode. Prettify the stats info and suppress them in quiet mode. -- This also makes usable stats by prefixing them with the key and the program name. GnuPG-bug-id: 3397 Signed-off-by: Werner Koch <[email protected]>
| * gpg: Improve the "secret key available" notice in keyedit.cWerner Koch2017-10-241-10/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/keyedit.c (KEYEDIT_NEED_SUBSK): New. (cmds): Add this flag to keytocard, bkuptocard, expire, and passwd. (keyedit_menu): Check whether only subkeys are available and take care of that in the command check and in the HELP listing. Also print a different notice if only subkeys are available. -- Print "Secret key is available" and the bailing out in all commands which require the _primary_ secret key was surprising. Now we print another notice and adjust the checks. GnuPG-bug-id: 3463 Signed-off-by: Werner Koch <[email protected]>
| * gpg: Remove unused flags from keyedit.c.Werner Koch2017-10-241-39/+35
| | | | | | | | | | | | | | | | | | | | | | * g10/keyedit.c (KEYEDIT_NOT_SK, KEYEDIT_ONLY_SK): Remove. (cmds): Remove them. -- These flags were cruft from the time we had to switch between secret and public key view. Signed-off-by: Werner Koch <[email protected]>
| * gpg: Fix creating on-disk subkey with on-card primary key.Werner Koch2017-10-191-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/keygen.c (generate_subkeypair): Ignore error code issued for trying to verify a card based key. -- We try to verify the primary key and thus seed the passphrase cache before generating the subkey. However, the verification does not yet work for on-card keys and thus the PASSWD --verify send to the agent returns an error. This patch detects this error and continues without a seeded passphrase cache. After all that pre-seeding is just a convenience. GnuPG-bug-id: 3280 Signed-off-by: Werner Koch <[email protected]>
| * gpg: Print sec/sbb with --import-option import-show or show-only.Werner Koch2017-10-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | * g10/import.c (import_one): Pass FROM_SK to list_keyblock_direct. -- Note that this will likely add the suffix '#' top "sec" because the secret key has not yet (or will not be) imported. If the secret key already exists locally another suffix might be printed. The upshot is that the suffix has no usefulness. GnuPG-bug-id: 3431 Signed-off-by: Werner Koch <[email protected]>
| * gpg: Make --dry-run and show-only work for secret keys.Werner Koch2017-10-191-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | * g10/import.c (import_secret_one): Check for dry-run before transferring keys. -- The use of --dry-run or --import-option show-only had no effect when importing a secret key and the public key already existed. If the public key did not exist an error message inhibited the import of the secret key. Signed-off-by: Werner Koch <[email protected]>
| * g10: Fix find_and_check_key for multiple keyrings.NIIBE Yutaka2017-10-191-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/pkclist.c (find_and_check_key): Call get_validity on a specific keyblock. -- When we have multiple keyrings, get_validity after get_best_pubkey_byname should access same keyring. Or else, the situation of an expired key in keyring A but valid key in keyring B causes SEGV. Thanks to Guido Günther for the use case and the log. Debian-bug-id: 878812 Signed-off-by: NIIBE Yutaka <[email protected]>
| * gpg: Keep a lock during the read-update/insert cycle in import.Werner Koch2017-10-193-3/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/keydb.c (keydb_handle): New field 'keep_lock'. (keydb_release): Clear that flag. (keydb_lock): New function. (unlock_all): Skip if KEEP_LOCK is set. * g10/getkey.c (get_keyblock_byfprint_fast): Call keep_lock if requested. -- That change is straightforward. It helps to avoid the race condition that another gpg process inserts a key while the first process is between the search and the insert. A similar change is due for gpgsm. Note that the key edit operations may still suffer from a race. GnuPG-bug-id: 3446
| * gpg: Improve keydb handling in the main import function.Werner Koch2017-10-193-60/+95
| | | | | | | | | | | | | | | | | | | | * g10/getkey.c (get_pubkey_byfprint_fast): Factor most code out to ... (get_keyblock_byfprint_fast): .. new function. * g10/import.c (revocation_present): s/int rc/gpg_error_t err/. (import_one): Use get_keyblock_byfprint_fast to get the keyblock and a handle. Remove the now surplus keyblock fetch in the merge branch. Signed-off-by: Werner Koch <[email protected]>
| * gpg: Simplify keydb handling of the main import function.Werner Koch2017-10-192-81/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/import.c (import_keys_internal): Return gpg_error_t instead of int. Change var names. (import_keys_es_stream): Ditto. (import_one): Ditto. Use a single keydb_new and simplify the use of of keydb_release. -- Note that this opens a keydb handle before we call get_pubkey_byfprint_fast which internally uses another key db handle. A further patch will cleanup this double use. Note that we also disable the keydb caching for the insert case. The s/int/gpg_error_t/ has been done while checking the call chains of the import functions and making sure that gpg_err_code is always used. Signed-off-by: Werner Koch <[email protected]>
| * gpg: Workaround for junk after --trusted-key.Werner Koch2017-09-281-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/trust.c (register_trusted_key): Cut off everthing starting as a hash sign. -- This problem is fallout from commit f99830b72812395da5451152bdd2f2d90a7cb7fb which fixes GnuPG-bug-id: 1206 The same could happen with other options taking keyids but we won't change that because a trailing '#' does not indicate a comment. So this is really only a workaround and eventually we will deprecate --trusted-key anyway or require a fingerprint as a value. Signed-off-by: Werner Koch <[email protected]>
* | g10: Fix find_and_check_key for multiple keyrings.NIIBE Yutaka2017-10-191-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/pkclist.c (find_and_check_key): Call get_validity on a specific keyblock. -- When we have multiple keyrings, get_validity after get_best_pubkey_byname should access same keyring. Or else, the situation of an expired key in keyring A but valid key in keyring B causes SEGV. Thanks to Guido Günther for the use case and the log. Debian-bug-id: 878812 Signed-off-by: NIIBE Yutaka <[email protected]>
* | gpg: Keep a lock during the read-update/insert cycle in import.Werner Koch2017-10-183-3/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/keydb.c (keydb_handle): New field 'keep_lock'. (keydb_release): Clear that flag. (keydb_lock): New function. (unlock_all): Skip if KEEP_LOCK is set. * g10/getkey.c (get_keyblock_byfprint_fast): Call keep_lock if requested. -- That change is straightforward. It helps to avoid the race condition that another gpg process inserts a key while the first process is between the search and the insert. A similar change is due for gpgsm. Note that the key edit operations may still suffer from a race. GnuPG-bug-id: 3446
* | gpg: Improve keydb handling in the main import function.Werner Koch2017-10-183-60/+95
| | | | | | | | | | | | | | | | | | | | * g10/getkey.c (get_pubkey_byfprint_fast): Factor most code out to ... (get_keyblock_byfprint_fast): .. new function. * g10/import.c (revocation_present): s/int rc/gpg_error_t err/. (import_one): Use get_keyblock_byfprint_fast to get the keyblock and a handle. Remove the now surplus keyblock fetch in the merge branch. Signed-off-by: Werner Koch <[email protected]>
* | gpg: Simplify keydb handling of the main import function.Werner Koch2017-10-182-81/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/import.c (import_keys_internal): Return gpg_error_t instead of int. Change var names. (import_keys_es_stream): Ditto. (import_one): Ditto. Use a single keydb_new and simplify the use of of keydb_release. -- Note that this opens a keydb handle before we call get_pubkey_byfprint_fast which internally uses another key db handle. A further patch will cleanup this double use. Note that we also disable the keydb caching for the insert case. The s/int/gpg_error_t/ has been done while checking the call chains of the import functions and making sure that gpg_err_code is always used. Signed-off-by: Werner Koch <[email protected]>
* | gpg: Fix wrong Tofu DB consistency check.Werner Koch2017-10-181-4/+7
| | | | | | | | | | | | | | | | | | | | | | * g10/tofu.c (build_conflict_set): Do not assume MAX_FINGERPRINT_LEN is the size of the fingerprint. -- This problem was exhibited by commit ecbbafb88d920e713439b6b1b8e1b41a6f8d0e38. Signed-off-by: Werner Koch <[email protected]>
* | gpg,sm: New option --with-key-screening.Werner Koch2017-10-173-0/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/pkscreening.c: New. * common/pkscreening.h: New. * common/Makefile.am (common_sources): Add them. * g10/gpg.c (opts): New option --with-key-screening. * g10/options.h (struct opt): New field with_key_screening. * g10/keylist.c: Include pkscreening.h. (print_pk_screening): New. (list_keyblock_print): Call it. (print_compliance_flags): Call it. * sm/gpgsm.c (opts): New option --with-key-screening. * sm/gpgsm.h (scruct opt): New field with_key_screening. * sm/keylist.c: Include pkscreening.h. (print_pk_screening): New. (print_compliance_flags): Call it. Add new arg cert. (list_cert_colon): Pass arg cert (list_cert_std): Call print_pk_screening. * sm/fingerprint.c (gpgsm_get_rsa_modulus): New. -- This new option can be used to detect ROCA affected keys. To scan an entire keyring and print the affected fingerprints use this: gpg -k --with-key-screening --with-colons | gawk -F: \ '$1~/pub|sub|sec|ssb|crt/ && $18~/\<6001\>/ {found=1;next}; $1=="fpr" && found {print $10}; {found=0}' The same works for gpgsm. Note that we need gawk due to the "\<" in the r.e. Signed-off-by: Werner Koch <[email protected]>
* | gpg: Fix comparison.Neal H. Walfield2017-10-061-1/+1
| | | | | | | | | | | | | | * g10/gpgcompose.c (literal_name): Complain if passed zero arguments, not one or fewer. Signed-off-by: Neal H. Walfield <[email protected]>
* | gpg: Prepare for a longer fingerprintWerner Koch2017-09-278-22/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/card-util.c (change_cafpr): Use MAX_FINGERPRINT_LEN. * g10/cipher.c (write_header): Use snprintf. * g10/gpg.h (MAX_FINGERPRINT_LEN): Change to 32. (MAX_FORMATTED_FINGERPRINT_LEN): Change to 59 * g10/keyid.c (format_hexfingerprint): Add v5 fingerprint format. * g10/tofu.c (get_policy): Use MAX_FINGERPRINT_LEN for the buffer but keep the raw length for now. -- Note that this patch only increases the size of the buffer and adds a new formatting for v5 fingerprints. Moe work is required to fix internal data structures like those in trustdb.gpg and the tofu tables. Signed-off-by: Werner Koch <[email protected]>
* | common: Add constant KEYGRIP_LEN.Werner Koch2017-09-272-4/+4
| | | | | | | | | | | | | | | | * common/util.h (KEYGRIP_LEN): New. * g10/call-agent.c (agent_probe_any_secret_key): Use that constant. * g10/keyid.c (keygrip_from_pk): Ditto. Signed-off-by: Werner Koch <[email protected]>
* | gpg: Let --debug clock time sign and verify.Werner Koch2017-09-272-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * configure.ac (ENABLE_LOG_CLOCK): New ac_define and option. * common/logging.c (log_clock): Use ENABLE_LOG_CLOCK to enable timestamp printing. * g10/call-agent.c (agent_pksign): Time signing. * g10/sig-check.c (check_signature_end_simple): Time verification. -- Timing for verification is limited to data signatures because this is the most common thing to evaluate. We should consider to change log_clock to printf style so that we could print the signature class and other info. Signed-off-by: Werner Koch <[email protected]>
* | Merge branch 'STABLE-BRANCH-2-2' into masterWerner Koch2017-09-262-1/+9
|\| | | | | | | | | | | | | | | | | -- Signed-off-by: Werner Koch <[email protected]> Conflicts: NEWS - include release info from 2.2.1 configure.ac - keep master.
| * gpgv: Initialize compliance checker.Werner Koch2017-09-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/gpgv.c (main): Call gnupg_initialize_compliance. -- The compliance checker needs to be initialize so that it won't let spit out a "not suitable" message. We use the module name of gpg. Because there is no option to change the compliance mode in gpgv we will always be in the default (CO_GNUPG) mode. It also does not make much sense to have it here because gpgv expects a "curated" keyring. GnuPG-bug-id: 3404 Signed-off-by: Werner Koch <[email protected]>
| * gpg: Fix "Fix key generation with only an email part".Werner Koch2017-09-121-1/+1
| | | | | | | | | | | | | | | | | | * g10/keygen.c (proc_parameter_file): Don't check the result of stpcpy. -- Fixes-commit: 7089dcc54099a4909ce7d386c07ab87e1398e2eb Signed-off-by: Werner Koch <[email protected]>
| * gpg: Fix key generation with only an email part.Werner Koch2017-09-111-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/keygen.c (proc_parameter_file): Special case the email only case. -- Using a parameter file like %ask-passphrase key-type: RSA key-length: 2048 key-usage: sign subkey-type: RSA subkey-length: 2048 subkey-usage: encrypt name-email: [email protected] with "gpg --gen-key --patch" the result was this key pub rsa2048 2017-09-11 [SC] 63A8C1BA12CC289A0E8072C971C7F8D4A18CE0BE uid [ultimate] <[email protected]> sub rsa2048 2017-09-11 [E] At least the the extra leading space the left angle bracket is wrong. Further some mail providers reject keys which consist of more than just a plain mail address. Using just a mail address is anyway the new new suggested content for a user id. With this patch the key will be pub rsa2048 2017-09-11 [SC] B302343C20EA6DECDB6A155135352F2520397080 uid [ultimate] [email protected] sub rsa2048 2017-09-11 [E] Signed-off-by: Werner Koch <[email protected]>
* | g10: Select a secret key by checking availability under gpg-agent.NIIBE Yutaka2017-09-261-4/+11
| | | | | | | | | | | | | | | | | | | | | | * g10/getkey.c (finish_lookup): Add WANT_SECRET argument to confirm by agent_probe_secret_key. (get_pubkey_fromfile, lookup): Supply WANT_SECRET argument. -- GnuPG-bug-id: 1967 Signed-off-by: NIIBE Yutaka <[email protected]>
* | gpg: default to AES-256.Daniel Kahn Gillmor2017-09-081-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/main.h (DEFAULT_CIPHER_ALGO): Prefer AES256 by default. -- It's 2017, and pretty much everyone has AES-256 available. Symmetric crypto is also rarely the bottleneck (asymmetric crypto is much more expensive). AES-256 provides some level of protection against large-scale decryption efforts, and longer key lengths provide a hedge against unforseen cryptanalysis. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* | gpg: default to 3072-bit RSA keys.Daniel Kahn Gillmor2017-09-082-7/+6
|/ | | | | | | | | | | | | | | | | | | | * agent/command.c (hlp_genkey): update help text to suggest the use of 3072 bits. * doc/wks.texi: Make example match default generation. * g10/keygen.c (DEFAULT_STD_KEY_PARAM): update to rsa3072/cert,sign+rsa3072/encr, and fix neighboring comment, (gen_rsa, get_keysize_range): update default from 2048 to 3072). * g10/keyid.c (pubkey_string): update comment so that first example is the default 3072-bit RSA. -- 3072-bit RSA is widely considered to be 128-bit-equivalent security. This is a sensible default in 2017. Signed-off-by: Daniel Kahn Gillmor <[email protected]> Gbp-Pq: Topic update-defaults Gbp-Pq: Name 0015-gpg-default-to-3072-bit-RSA-keys.patch
* gpg: Fix memory leak while running --check-trustdb.Werner Koch2017-08-241-0/+3
| | | | | | | | | * g10/trustdb.c (update_min_ownertrust): Free PK. -- This bug was revealed by the new trust-pgp-2.scm test. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-20 21:06:38 +0000