aboutsummaryrefslogtreecommitdiffstats
path: root/g10 (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* sm: Exclude rsaPSS from de-vs compliance mode.Werner Koch2020-07-036-11/+12
| | | | | | | | | | | | | | | * common/compliance.h (PK_ALGO_FLAG_RSAPSS): New. * common/compliance.c (gnupg_pk_is_compliant): Add arg alog_flags and test rsaPSS. Adjust all callers. (gnupg_pk_is_allowed): Ditto. * sm/misc.c (gpgsm_ksba_cms_get_sig_val): New wrapper function. (gpgsm_get_hash_algo_from_sigval): New. * sm/certcheck.c (gpgsm_check_cms_signature): Change type of sigval arg. Add arg pkalgoflags. Use the PK_ALGO_FLAG_RSAPSS. * sm/verify.c (gpgsm_verify): Use the new wrapper and new fucntion to also get the algo flags. Pass algo flags along. Signed-off-by: Werner Koch <[email protected]>
* ecc: Support Ed448/X448 key generation.NIIBE Yutaka2020-06-301-2/+5
| | | | | | | * g10/keygen.c (ask_curve): Support Ed448/X448 keys. (generate_keypair): Support switch to X448 key. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg,agent: Support Ed448 signing.NIIBE Yutaka2020-06-244-93/+128
| | | | | | | | | | | | | | | | | | | * agent/pksign.c (do_encode_eddsa): First argument is NBITs, so that it can support Ed448, as well as Ed25519. (agent_pksign_do): Follow the change. * agent/sexp-secret.c (fixup_when_ecc_private_key): No fix-up needed for Ed448, it's only for classic curves. * common/openpgp-oid.c (oidtable): Add Ed448. * common/sexputil.c (get_pk_algo_from_key): Ed448 is only for EdDSA. * g10/export.c (match_curve_skey_pk): Ed448 is for EdDSA. * g10/keygen.c (gen_ecc): Support Ed448 with the name of "ed448". (ask_algo, parse_key_parameter_part): Handle "ed448". * g10/pkglue.c (pk_verify): Support Ed448. (pk_check_secret_key): Support Ed448. * g10/sign.c (hash_for): Defaults to SHA512 for Ed448. (make_keysig_packet): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* ecc: Use "cv448" to specify key using X448.NIIBE Yutaka2020-06-233-6/+7
| | | | | | | | | | | | | * common/openpgp-oid.c (oidtable): Use "cv448". (oid_cv448): Rename from oid_x448. (openpgp_oidbuf_is_cv448, openpgp_oid_is_cv448): Likewise. * common/util.h (openpgp_oid_is_cv448): Follow the change. * g10/ecdh.c (pk_ecdh_generate_ephemeral_key): Likewise. * g10/keygen.c (gen_ecc, ask_algo): Use "cv448". (parse_key_parameter_part): Likewise. * g10/pkglue.c (get_data_from_sexp): Fix for debug output. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Fix for new SOS changes when used with Libgcrypt < 1.8.6.Werner Koch2020-06-091-0/+27
| | | | | | | | | | * g10/free-packet.c (is_mpi_copy_broken): New. (my_mpi_copy): Mix gcry_mpi_copy. -- Note that in this case it is better to do a runtime check. Signed-off-by: Werner Koch <[email protected]>
* gpg: Extend the TRUST_ status lines.Werner Koch2020-06-091-11/+31
| | | | | | | | | * g10/pkclist.c (write_trust_status): Add arg mbox. (check_signatures_trust): Appenmd mbox to the status lines. -- GnuPG-bug-id: 4735 Signed-off-by: Werner Koch <[email protected]>
* gpg: Use bytes for ECDH.NIIBE Yutaka2020-06-094-60/+64
| | | | | | | | | | | | | | | * g10/ecdh.c (extract_secret_x): Use byte * instead of MPI. (prepare_ecdh_with_shared_point): Use char * instead of MPI. (pk_ecdh_encrypt_with_shared_point): Likewise. (pk_ecdh_decrypt): Likewise. * g10/pkglue.h (pk_ecdh_encrypt_with_shared_point, pk_ecdh_decrypt): Change declaration. * g10/pkglue.c (get_data_from_sexp): New. (pk_encrypt): Use get_data_from_sexp instead of get_mpi_from_sexp. Follow the change of pk_ecdh_encrypt_with_shared_point. * g10/pubkey-enc.c (get_it): Follow the change of pk_ecdh_decrypt. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Add X448 support.NIIBE Yutaka2020-06-092-2/+41
| | | | | | | | | | | | | * common/openpgp-oid.c (oidtable): Add X448. (oid_x448,openpgp_oidbuf_is_x448,openpgp_oid_is_x448): New. * common/util.h (openpgp_oid_is_x448): New. * g10/ecdh.c (gen_k): Add handling of opaque MPI and support endianness. (pk_ecdh_generate_ephemeral_key): X448 requires opaque MPI. * g10/keygen.c (gen_ecc): Add support for X448. (ask_algo, parse_key_parameter_part): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg,ecc: Handle external representation as SOS with opaque MPI.NIIBE Yutaka2020-06-099-59/+316
| | | | | | | | | | | | | | | | | | | | * g10/pkglue.h (sexp_extract_param_sos): New. * g10/build-packet.c (sos_write): New. (do_key, do_pubkey_enc, do_signature): Use sos_write for ECC. * g10/export.c (cleartext_secret_key_to_openpgp): Use sexp_extract_param_sos. (transfer_format_to_openpgp): Use opaque MPI for ECC. * g10/keygen.c (ecckey_from_sexp): Use sexp_extract_param_sos. * g10/keyid.c (hash_public_key): Handle opaque MPI for SOS. * g10/parse-packet.c (sos_read): New. (parse_pubkeyenc,parse_signature,parse_key): Use sos_read for ECC. * g10/pkglue.c (sexp_extract_param_sos): New. (pk_verify): Handle opaque MPI for SOS. (pk_encrypt): Use sexp_extract_param_sos. * g10/seskey.c (encode_session_key): Use opaque MPI. * g10/sign.c (do_sign): Use sexp_extract_param_sos. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: If possible TRUST values now depend on signer's UID or --sender.Werner Koch2020-06-085-44/+178
| | | | | | | | | | | | | | * g10/mainproc.c (check_sig_and_print): Add failsafe check for PK. Pass KEYBLOCK down do check_signatures_trust. Protect existsing error ocde in case the signature expired. * g10/pkclist.c (is_in_sender_list): New. (check_signatures_trust): Add args keyblock and pk. Add new uid based checking code. * g10/test-stubs.c, g10/gpgv.c: Adjust stubs. -- GnuPG-bug-id: 4735 Signed-off-by: Werner Koch <[email protected]>
* doc: Minor code comment fixes.Werner Koch2020-06-086-6/+10
| | | | --
* gpg: Improve generation of keys stored on card (brainpool,cv25519).Werner Koch2020-06-031-28/+48
| | | | | | | | | | | | | | | | | | | | | | | | | * g10/keygen.c (ask_key_flags_with_mask): Allow more than ECDH for legacy curves. (ask_algo): Tweak mapping of ECC to OpenPGP algos (parse_key_parameter_part): Ditto. (generate_subkeypair): Create the subkey with the time stored on the card. -- This fixes two problems with generating keys from a card: 1. The key usage is now set correctly for brainpool curves. 2. The add-key and --quick-add-key commands now also take the creation time from the time stored on the card. Without that we would need to update the creation time and fingerprint already stored on the card which is a no-go if another key has already been created using that on-card key. Note: To create a key on a card without an OpenPGP keyblock use gpg-card. Signed-off-by: Werner Koch <[email protected]>
* gpg: Clean up ECDH code path (5).NIIBE Yutaka2020-05-223-117/+136
| | | | | | | | | | | * g10/ecdh.c (pk_ecdh_encrypt_with_shared_point): Now, it's only for encrytion. (pk_ecdh_decrypt): Use prepare_ecdh_with_shared_point and move decrypt code path in original pk_ecdh_encrypt_with_shared_point here. * g10/pkglue.h (pk_ecdh_encrypt_with_shared_point): Change API. * g10/pkglue.c (pk_encrypt): Follow the change. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Clean up ECDH code path (4).NIIBE Yutaka2020-05-221-167/+186
| | | | | | | | * g10/ecdh.c (prepare_ecdh_with_shared_point): New. (pk_ecdh_encrypt_with_shared_point): Fixing error paths for closing the cipher handle, use prepare_ecdh_with_shared_point. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Clean up ECDH code path (3).NIIBE Yutaka2020-05-221-36/+52
| | | | | | | * g10/ecdh.c (derive_kek): New. (pk_ecdh_encrypt_with_shared_point): Use derive_kek. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Clean up ECDH code path (2).NIIBE Yutaka2020-05-221-65/+72
| | | | | | | | * g10/ecdh.c (build_kdf_params): New. (pk_ecdh_encrypt_with_shared_point): Use build_kdf_params, and check things before extract_secret_x. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Clean up ECDH code path (1).NIIBE Yutaka2020-05-221-49/+61
| | | | | | | * g10/ecdh.c (extract_secret_x): New. (pk_ecdh_encrypt_with_shared_point): Use extract_secret_x. Signed-off-by: NIIBE Yutaka <[email protected]>
* doc: Typo fixes in code commentsWerner Koch2020-05-041-2/+2
| | | | | | -- Signed-off-by: Werner Koch <[email protected]>
* gpg: Make AEAD modes subject to compliance checks.Werner Koch2020-04-161-10/+13
| | | | | | | | | * g10/decrypt-data.c (decrypt_data): Move aead algo detection up. -- Note that the AEAD modes are not yet approved for --compliance=de-vs Signed-off-by: Werner Koch <[email protected]>
* indent: Some typo and indentation changes for gpg.Werner Koch2020-04-154-14/+16
| | | | --
* gpg: Fix broken setting of AEAD algo.Werner Koch2020-04-151-7/+1
| | | | | | | | | * g10/main.h (DEFAULT_AEAD_ALGO): Set to OCB. -- With the old code and using libgcrypt 1.9 would have switched from the high performance OCB to the ugly EAX mode. We are free software, we are OCB.
* gpg: ECDH: Accept longer padding.NIIBE Yutaka2020-04-081-4/+1
| | | | | | | | | | | | | | * g10/pubkey-enc.c (get_it): Remove check which mandates shorter padding. -- According to the section 8 of RFC 6637, the sender MAY use 21 bytes of padding for AES-128 to provide 40-byte "m". Reported-by: Metin Savignano GnuPG-bug-id: 4908 Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg,card: Use the new MANUFACTURER attribute.Werner Koch2020-04-033-43/+20
| | | | | | | | | | | | | | | | | | | * tools/gpg-card.h (struct card_info_s): Add manufacturer fields. * tools/card-call-scd.c (release_card_info): Release them. (learn_status_cb): Parse MANUFACTURER attribute. * tools/gpg-card.c (get_manufacturer): Remove. (list_card): Use the new attribute. * g10/call-agent.h (struct agent_card_info_s): Add manufacturer fields. * g10/call-agent.c (agent_release_card_info): Release them. (learn_status_cb): Parse MANUFACTURER attribute. * g10/card-util.c (get_manufacturer): Remove. (current_card_status): Use new attribute. -- This does away with the duplicated OpenPGP vendor tables; they are now at a better place (app-openpgp.c). Signed-off-by: Werner Koch <[email protected]>
* gpg: Add regular expression support.NIIBE Yutaka2020-04-032-21/+3
| | | | | | | | | | | | | | | | | * AUTHORS, COPYING.other: Update. * Makefile.am (SUBDIRS): Add regexp sub directory. * configure.ac (DISABLE_REGEX): Remove. * g10/Makefile.am (needed_libs): Add libregexp.a. * g10/trustdb.c: Remove DISABLE_REGEX support. * regexp/LICENSE, regexp/jimregexp.c, regexp/jimregexp.h, regexp/utf8.c, regexp/utf8.h: New from Jim Tcl. * regexp/UnicodeData.txt: New from Unicode. * regexp/Makefile.am, regexp/parse-unidata.awk: New. * tests/openpgp/Makefile.am: Remove DISABLE_REGEX support. * tools/Makefile.am: Remove DISABLE_REGEX support. GnuPG-bug-id: 4843 Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Also allow a v5 fingerprint for --trusted-key.Werner Koch2020-03-181-0/+7
| | | | | | | | | * g10/trustdb.c (tdb_register_trusted_key): Add case for 32 octet fingerprints. -- GnuPG-bug-id: 4855 Signed-off-by: Werner Koch <[email protected]>
* gpg: Update --trusted-key to accept fingerprint as well as long key id.Daniel Kahn Gillmor2020-03-181-6/+18
| | | | | | | | | | | | | | | * g10/trustdb.c (tdb_register_trusted_key): accept fingerprint as well as long key ID. * doc/gpg.texi: document that --trusted-key can accept a fingerprint. -- GnuPG-bug-id: 4855 Signed-off-by: Daniel Kahn Gillmor <[email protected]> Fixed uses or return and kept the old string to avoid breaking translations. Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix key expiration and usage for keys created at the Epoch.Werner Koch2020-03-181-12/+16
| | | | | | | | | | | | | | | * g10/getkey.c (merge_selfsigs_main): Take a zero key creation time in account. -- Keys created at the Epoch have a creation time of 0; when figuring out the latest signature with properties to apply to a key the usual comparison A > B does not work if A is always 0. We now special case this for the expiration and usage data. Co-authored-by: [email protected] GnuPG-bug-id: 4670 Signed-off-by: Werner Koch <[email protected]>
* gpgconf: Further simplify the gpgconf option processing.Werner Koch2020-03-141-34/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/gc-opt-flags.h (GC_OPT_FLAG_RUNTIME): Move to ... * tools/gpgconf-comp.c: here. (known_options_scdaemon): Remove "options". (known_options_dirmngr): Remove "options". (known_options_gpgsm): Remove "options". (known_options_gpg): Remove "options" and "keyserver". (struct gc_option_s): Rename active t gpgconf_list. (gc_component_list_options): Do not act upon active. (option_check_validity): Ditto. (is_known_option): Make it work correctly for unknown options. (retrieve_options_from_program): Use renamed flag gpgconf_list only to detect duplicated items from --gpgconf-list. Do not set runtime. Only e set the options if set by --gpgconf-list; never clear them. * agent/gpg-agent.c: Simplify the --gpgconf-list output. * dirmngr/dirmngr.c: Ditto. * g10/gpg.c: Ditto. * kbx/keyboxd.c: Ditto. * scd/scdaemon.c: Ditto. * sm/gpgsm.c: Ditto. * tests/openpgp/gpgconf.scm: Use "compliance" instead of "keyserver" for the string arg test. -- There is no need to read the list of options from the components unless they convey a default value. It is better to consult only the list we have in gpgconf-comp.c to decide on whether an option should be displayed. Right, this might mess up thing if a newer gpgconf version is used with an older component, but we already print warnings in this case and in general we do not want to support this anymore - the times of gpg 1.4. and 2.0 are long over now. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* gpg: New option --auto-key-importWerner Koch2020-03-143-9/+20
| | | | | | | | | | | | | | | | | * g10/gpg.c (opts): New options --auto-key-import, --no-auto-key-import, and --no-include-key-block. (gpgconf_list): Add them. * g10/options.h (opt): Add field flags.auto_key_import. * g10/mainproc.c (check_sig_and_print): Use flag to enable that feature. * tools/gpgconf-comp.c: Give the new options a Basic config level. -- Note that the --no variants of the options are intended for easy disabling at the command line. GnuPG-bug-id: 4856 Signed-off-by: Werner Koch <[email protected]>
* gpg: Make use of the included key block in a signature.Werner Koch2020-03-1311-50/+246
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/import.c (read_key_from_file): Rename to ... (read_key_from_file_or_buffer): this and add new parameters. Adjust callers. (import_included_key_block): New. * g10/packet.h (PKT_signature): Add field flags.key_block. * g10/parse-packet.c (parse_signature): Set that flags. * g10/sig-check.c (check_signature2): Add parm forced_pk and change all callers. * g10/mainproc.c (do_check_sig): Ditto. (check_sig_and_print): Try the included key block if no key is available. -- This is is the second part to support the new Key Block subpacket. The idea is that after having received a signed mail, it is instantly possible to reply encrypted - without the need for any centralized infrastructure. There is one case where this does not work: A signed mail is received using a specified signer ID (e.g. using gpg --sender option) and the key block with only that user ID is thus imported. The next time a mail is received using the same key but with a different user ID; the signatures checks out using the key imported the last time. However, the new user id is not imported. Now when trying to reply to that last mail, no key will be found. We need to see whether we can update a key in such a case. GnuPG-bug-id: 4856 Signed-off-by: Werner Koch <[email protected]>
* gpg: New option --include-key-block.Werner Koch2020-03-134-11/+134
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/openpgpdefs.h (SIGSUBPKT_KEY_BLOCK): New. * g10/gpg.c (oIncludeKeyBlock): New. (opts): New option --include-key-block. (main): Implement. * g10/options.h (opt): New flag include_key_block. * g10/parse-packet.c (dump_sig_subpkt): Support SIGSUBPKT_KEY_BLOCK. (parse_one_sig_subpkt): Ditto. (can_handle_critical): Ditto. * g10/sign.c (mk_sig_subpkt_key_block): New. (write_signature_packets): Call it for data signatures. -- This patch adds support for a to be proposed OpenPGP ferature: Introduce the Key Block subpacket to align OpenPGP with CMS. This new subpacket may be used similar to the CertificateSet of CMS (RFC-5652) and thus allows to start encrypted communication after having received a signed message. In practice a stripped down version of the key should be including having only the key material and the self-signatures which are really useful and shall be used by the recipient to reply encrypted. #### Key Block (1 octet with value 0, N octets of key data) This subpacket MAY be used to convey key data along with a signature of class 0x00, 0x01, or 0x02. It MUST contain the key used to create the signature; either as the primary key or as a subkey. The key SHOULD contain a primary or subkey capable of encryption and the entire key must be a valid OpenPGP key including at least one User ID packet and the corresponding self-signatures. Implementations MUST ignore this subpacket if the first octet does not have a value of zero or if the key data does not represent a valid transferable public key. GnuPG-bug-id: 4856 Signed-off-by: Werner Koch <[email protected]>
* gpg: Add property "fpr" for use by --export-filter.Werner Koch2020-03-136-2/+67
| | | | | | | | | | | | | | | | * g10/export.c (push_export_filters): New. (pop_export_filters): New. (export_pubkey_buffer): Add args prefix and prefixlen. Adjust callers. * g10/import.c (impex_filter_getval): Add property "fpr". * g10/main.h (struct impex_filter_parm_s): Add field hexfpr. -- The push and pop feature will help us to use the export filter internally in gpg. Same for the export_pubkey_buffer change. GnuPG-bug-id: 4856 Signed-off-by: Werner Koch <[email protected]>
* doc: Add a comment to explain the signature postscript.Werner Koch2020-03-121-3/+8
| | | | | | | -- Hal Finney explained this on January 22, 2004 on a question from Peter Gutmann on the WG list.
* gpg: Re-group the options in the --help output.Werner Koch2020-03-061-288/+291
| | | | | | | | | | | * g10/gpg.c (opts): Change oLoadExtensions, oStrict, and oNoStrict to use ARGPARSE_ignore and remove the code in the option switch. -- This looks better and is also required for further simplifications of gpgconf. Signed-off-by: Werner Koch <[email protected]>
* gpgconf: Support reading global options (part 2).Werner Koch2020-03-061-9/+15
| | | | | | | | | | | | | | | | | | | * tools/gpgconf-comp.c: Remove all regular option descriptions. They are now read in from the component. Also remove a few meanwhile obsolete options. * agent/gpg-agent.c: Add option description which were only set in gpgconf-comp.c. * dirmngr/dirmngr.c: Ditto. * scd/scdaemon.c: Ditto. * sm/gpgsm.c: Ditto. * g10/gpg.c: Ditto. -- This second part removes all regular option descriptions because they can be read from the components. A few were missing in the components and thus moved to there. Signed-off-by: Werner Koch <[email protected]>
* card: Add yet another vendor.Werner Koch2020-03-031-0/+1
| | | | --
* card: Add new vendor.Werner Koch2020-03-031-0/+1
| | | | --
* gpg: Re-enable versioned config filesWerner Koch2020-02-251-2/+2
| | | | | | * g10/gpg.c (main): Use ARGPARSE_FLAG_USERVERS. Signed-off-by: Werner Koch <[email protected]>
* gpg: Re-add checking of config file permissions.Werner Koch2020-02-251-98/+18
| | | | | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (main): Re-add permission checking of the user config file. Re-add code to check against the SE-Linux secured file list. (get_default_configname): Remove unused func. * configure.ac (SAFE_VERSION, SAFE_VERSION_DOT) (SAFE_VERSION_DASH): Remove. -- Die to the switch to the new option parser, the permissions were not anymore checked. This patch fixes this. Note that there there is no checking for the global config file because that file is not expected to be user modifiable. This patch also adds checking against the list of SE-linux secured files. However, like in the old code the checking does not work in practise because the to be checked files are added to the the list only after option parsing. Tested using temporary debug code. The SAFE_VERSION macros were used for RISC OS, which is not anymore supported, and only in the now removed get_default_configname. There purpose was that a RISC OS could use a modified config.h here. Signed-off-by: Werner Koch <[email protected]>
* Use gpgrt's new option parser for gpgc, gpgsm, and gpg-agent.Werner Koch2020-02-201-11/+14
| | | | | | | | | | | | | | * g10/gpgv.c: Use new option parser. * sm/gpgsm.c: Ditto. * agent/gpg-agent.c: Ditto. (opts): Add option --no-options. -- This is the next part of changes. The latest libgpg-error is required so that that re-reading options (SIGHUP) works. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* gpg: Use gpgrt's new option parser to provide a global conf file.Werner Koch2020-02-205-162/+177
| | | | | | | | | | | | | | | | | | | | | | | | * common/util.h: Remove argparse.h. * common/argparse.c: Undef GPGRT_ENABLE_ARGPARSE_MACROS. * configure.ac (GPGRT_ENABLE_ARGPARSE_MACROS): Define. * agent/gpg-agent.c: Undef GPGRT_ENABLE_ARGPARSE_MACROS and include argparse.h. Do this also for all main modules which use our option parser except for gpg. Replace calls to strusage by calls to gpgrt_strusage everywhere. * g10/gpg.c (opts): Change type to gpgrt_opt_t. Flag oOptions and oNoOptions with ARGPARSE_conffile and ARGPARSE_no_conffile. (main): Change type of pargs to gpgrt_argparse_t. Rework the option parser to make use of the new gpgrt_argparser. -- This is not yet finished but a make check works. gpg has the most complex and oldest option handling and thus this is the first migration target. SE-Linux checks and version-ed config files are missing and will be added later. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix default-key selection when card is available.NIIBE Yutaka2020-02-191-1/+9
| | | | | | | | | | | | | * g10/getkey.c (get_seckey_default_or_card): Handle the case when card key is not suitable for requested usage. -- Cherry-pick stable commit of: 1cdd9e57f701f0d99d118d32adffe5216a94b0b2 GnuPG-bug-id: 4850 Signed-off-by: NIIBE Yutaka <[email protected]>
* Spelling cleanup.Daniel Kahn Gillmor2020-02-1813-19/+19
| | | | | | | | | | | | | | | | No functional changes, just fixing minor spelling issues. --- Most of these were identified from the command line by running: codespell \ --ignore-words-list fpr,stati,keyserver,keyservers,asign,cas,iff,ifset \ --skip '*.po,ChangeLog*,help.*.txt,*.jpg,*.eps,*.pdf,*.png,*.gpg,*.asc' \ doc g13 g10 kbx agent artwork scd tests tools am common dirmngr sm \ NEWS README README.maint TODO Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* gpg: New option --full-timestrings.Werner Koch2020-02-135-4/+47
| | | | | | | | | | | | | | | | | | | | | * g10/options.h (opt): Add flags.full_timestrings. * g10/gpg.c (oFullTimestrings): New. (opts): New option. (main): Set new flag. * g10/keyid.c (dateonlystr_from_pk): New. (dateonlystr_from_sig): New. (datestr_from_pk): Divert to isotimestamp if requested. (datestr_from_sig): Ditto. (expirestr_from_pk): Ditto. (expirestr_from_sig): Ditto. (revokestr_from_pk): Ditto. * g10/import.c (impex_filter_getval): Use dateonlystr_from_sig and dateonlystr_from_pk. -- Quite helpful for debugging keys. Signed-off-by: Werner Koch <[email protected]>
* gpg: Changes to allow direct key generation from an OpenPGP card.Werner Koch2020-02-133-183/+344
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/call-agent.h (struct keypair_info_s): Add fields keytime and usage. * g10/call-agent.c (struct keypairinfo_cb_parm_s): New. (scd_keypairinfo_status_cb): Rework to store parsed KEYPAIRINFO data. (agent_scd_keypairinfo): Change accordingly. (agent_scd_readkey): Add arg ctrl and change callers. Change return arg from an strlist_t to a keypair_info_t. (readkey_status_cb): Use KEYPAIRINFO instead of KEY-TIME. * g10/keygen.c (pSUBKEYCREATIONDATE): New. (pAUTHKEYCREATIONDATE): New. (get_parameter_u32): Allow for new parameters. (do_create_from_keygrip): For card keys use direct scd call which does not create a stub file. (ask_algo): Rework to use the new keypair_info_t as return from agent_scd_keypairinfo. (parse_key_parameter_part): Likewise. Also get and return the key creation time using a arg. (parse_key_parameter_string): New args r_keytime and r_subkeytime. (parse_algo_usage_expire): New arg r_keytime. (proc_parameter_file): Ignore the explict pCREATIONDATE for card keys. (quickgen_set_para): New arg keytime. (quick_generate_keypair): Get the keytimes and set the pCARDKEY flag. (generate_keypair): Likewise. (do_generate_keypair): Implement the cardkey with keytime thingy. (generate_subkeypair): Use the keytime parameters. * g10/keygen.c (pAUTHKEYCREATIONDATE): New. Not yet set but may come handy later. (get_parameter_u32): Take care of that. (do_generate_keypair): For cardkeys sign with the current time. -- Key generation direct from the card used to work for all cards except the OpenPGP cards. The key generation from card using an OpenPGP card is special because the fingerprint is stored on the card and we must make sure that the newly created key has the same fingerprint. This requires that we take the key creation date as stored on the card into account. Along with the recent change in gpg-agent this change also fixes a problem with existing stub files. Note that with a key take from a card the self-signature are created with the current time and not the creation time. This allows to better distinguish keys created using the same card. Signed-off-by: Werner Koch <[email protected]>
* gpg: Rename the struct card_key_info_s.Werner Koch2020-02-123-17/+22
| | | | | | | | | | | | | | | | * g10/call-agent.h (struct card_key_info_s): Rename to ... (struct keypair_info_s): this. (keypair_info_t): New. Use this everywhere instead of card_key_info_s. * g10/call-agent.c (agent_scd_free_keyinfo): Rename to .. (free_keypair_info): this. Change all callers. -- The struct is also useful to store the data from KEYPAIRINFO status lines. Thus renaming it makes sense. A future patch will extend the struct. Signed-off-by: Werner Koch <[email protected]>
* gpg: Improve key creation direct from the card.Werner Koch2020-02-113-26/+122
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/call-agent.c (readkey_status_cb): New. (agent_scd_readkey): Add new arg r_keytime and allow NULL for r_result. Change all callers. (agent_readkey): Minor code reformatting. * g10/keygen.c (pCARDKEY): New. (struct para_data_s): Add u.bool. (get_parameter_bool): New. (do_create_from_keygrip): Add arg cardkey and make use of it. (ask_algo): Add args r_cardkey and r_keytime. Read the keytime of the selected card key and return it. (generate_keypair): Store CARDKEY and KEYTIME. (do_generate_keypair): Pass CARDKEY to do_create_from_keygrip. (generate_subkeypair): Ditto. -- This allows to first create keys on the card (e.g. using gpg-card) even without having any public key for OpenPGP. Then the key generation option 14 (cardkey) can be used to create a primary OpenPGP key from the key on the card. There are still a couple of problems related to the agent which creates the stub key and may run into problems if creating a second key from the card. This will be fixed in a future patch. Signed-off-by: Werner Koch <[email protected]>
* common: Extend the openpgp_curve_to_oid function.Werner Koch2020-02-114-6/+7
| | | | | | | | | * common/openpgp-oid.c (openpgp_curve_to_oid): Add optional arg R_NBITS. Change all callers. -- In particular for ed25519 and cv25519 it is quite useful to have an ability to get the required algorithm.
* build: Always use EXTERN_UNLESS_MAIN_MODULE pattern.Werner Koch2020-02-104-9/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | * common/util.h (EXTERN_UNLESS_MAIN_MODULE): Add the definion only here but now without the Norcroft-C. Change all other places where it gets defined. * common/iobuf.h (iobuf_debug_mode): Declare unconditionally as extern. * common/iobuf.c (iobuf_debug_mode): Define it here. * agent/gpg-agent.c (INCLUDED_BY_MAIN_MODULE): Define here and also in all main modules of all other programs. * g10/main.h: Put util.h before the local header files. -- This change is required for use with gcc/ld's LTO feature which does not allow common blocks. Further gcc 10 will make -fno-common the default and thus this chnage is always needed. What a pitty. Co-authored-by: Tomáš Mráz GnuPG-bug-id: 4831 Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 21d9bd8b87a9f793a106095e3838eb71825189d7) - Applied respective chnages also to gpg-card and keyboxd. Signed-off-by: Werner Koch <[email protected]>
* gpg: Make really sure that --verify-files always returns an error.Werner Koch2020-02-101-5/+13
| | | | | | | | | | | | | | | | * g10/verify.c (verify_files): Track the first error code. -- It seems to be possible to play tricks with packet structures so that log_error is not used for a bad input data. By actually checking the return code and let the main driver in gpg call log_error, we can fix this case. Note that using gpg --verify-files and relying solely on gpg's return code is at best a questionable strategy. It is for example impossible to tell which data has been signed. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-09 10:49:58 +0000