aboutsummaryrefslogtreecommitdiffstats
path: root/scd/app-openpgp.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* scd:openpgp: Send a KEY-TIME status with READKEYWerner Koch2020-02-111-0/+38
| | | | | | | | | | | * scd/app-openpgp.c (retrieve_fprtime_from_card): New. (do_readkey): Send a KEY_TIME status. -- It might be easier to fold this into KEYPAIRINFO but for backward compatibility using a separate status line is safer. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Optional allow for lowercase keyrefs.Werner Koch2020-02-111-10/+10
| | | | | | | | | * scd/app-openpgp.c (do_readkey): Use case insensitive match of the keyref. (do_writekey, do_sign, do_auth, do_decipher): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Allow auto-changing of the key attributes in genkey.Werner Koch2020-02-111-45/+176
| | | | | | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): Add field keyalgo. (parse_algorithm_attribute): Store the new keyalgo field. (change_keyattr): Change info message. (change_keyattr_from_string): Rewrite to also accept a keyref and a keyalgo string. (do_genkey): Change the keyattr if a keyalgo string is given. -- Having this feature makes it easier to use OpenPGP cards in a similar way to other cards. Note that the explicit changing via SETATTR is still supported. Signed-off-by: Werner Koch <[email protected]>
* common: Extend the openpgp_curve_to_oid function.Werner Koch2020-02-111-4/+4
| | | | | | | | | * common/openpgp-oid.c (openpgp_curve_to_oid): Add optional arg R_NBITS. Change all callers. -- In particular for ed25519 and cv25519 it is quite useful to have an ability to get the required algorithm.
* scd:openpgp: Let the genkey function also accept a full keyref.Werner Koch2020-02-091-3/+12
| | | | | | | | | | | * scd/app-openpgp.c (send_key_attr): Use log_assert. (do_genkey): Allow prefix. -- It is more uniform to always use full keyref (e.g. "OPENPGP.1") instead of just the key number. Signed-off-by: Werner Koch <[email protected]>
* scd: Make the PIN cache robust against wrongdoing of gpg-agent.Werner Koch2020-01-131-3/+34
| | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): New field pincache. (cache_pin): Set it. (pin_from_cache): Consult it. * scd/app-piv.c (struct app_local_s): New field pincache. (cache_pin): Set it. (pin_from_cache): Consult it. -- Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Implement PIN cache.Werner Koch2020-01-131-1/+2
| | | | | | | | | | | | | | | | | | | | | | * scd/command.c (pincache_put): Add arg pinlen and change all callers to provide it. * scd/app-piv.c (cache_pin): New. (pin_from_cache): New. (ask_and_prepare_chv): Add args no_cache and r_unpaddedpinlen. Take PIN from the cache. Return the unpadded length. (verify_chv): Add arg ctrl. Cache the PIN. (do_change_chv): Clear PIN cache. -- The PIV pins are padded but we want to store the unpadded PIN. Thus the changes to the function. Code has has been tested by commenting the no_cache parameter because we the current test certificate was created for PIV.9C which requires a verification for each use. More testing is required. GnuPG-bug-id: 4791 Signed-off-by: Werner Koch <[email protected]>
* scd: Implement direct access by KEYGRIP for GETATTR and READKEY.NIIBE Yutaka2020-01-101-1/+15
| | | | | | | | | * scd/app-openpgp.c (do_readkey): Handle KEYGRIP access. * scd/command.c (do_readkey): New. (cmd_readkey): Use do_readkey supporting KEYGRIP access. (cmd_getattr): Supporting KEYGRIP access. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:openpgp: Implement PIN cache.Werner Koch2020-01-091-104/+229
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (wipe_and_free, wipe_and_free_string): Use them everywere where we do a wipememory followed by a free. (pin2hash_if_kdf): Change interface. The input PIN is not anymore changed. Further there are no more assumptions about the length of the provided buffer. (cache_pin): Restructure. (chvno_to_keyref): New. (pin_from_cache): New. (verify_a_chv): Add arg CTRL. Adjust for changed pin2hash_if_kdf. Chache and retrieve the PIN here. (verify_chv2): Do not cache the PIN here. (build_enter_admin_pin_prompt): Add arg 'r_remaining'. (verify_chv3): Adjust for changed pin2hash_if_kdf. Implement the PIN cache. (do_change_pin): Clear the PIN cache. Do not change the PIN here. Lots of adjustments to cope with the chnaged pin2hash_if_kdf. (do_sign): Do not cache the PIN here. -- Note that some of the changes are required because we can't rely that the PIN is always cached in secure memory. Thus it is better to do an explicit wipe. Testing the PIN cache can currently only be done my modifying the code to do a verification for each operation. Only some basic testing has been done. Clearing the PIN cache is also not fully implemented. With the forthcoming changes to app-piv we should be enter able to test the PIN cache. Missing stuff: - The agent should be able to selectively clear the cache on a per slot base. - We should replace AESWRAP by OCB. Signed-off-by: Werner Koch <[email protected]>
* scd: First changes to implement a PIN cache.Werner Koch2020-01-071-49/+109
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/command.c (pincache_put): New. Uses a dummy key for now. (pincache_get): New. * scd/app.c (select_application): Flush the PIN cache. (scd_update_reader_status_file): Ditto. (maybe_switch_app): Call the new prep_reselect function. (app_write_learn_status): Ditto. * scd/app-openpgp.c (cache_pin): New helper to cache a PIN. (verify_chv2): Call it. (verify_chv3): Call it. (clear_chv_status): Call it. (do_change_pin): Call it. * scd/app-common.h (struct app_ctx_s): Add function 'prep_select'. * scd/app-openpgp.c (do_prep_reselect): New stub function. (app_select_openpgp): Set new stub function. * scd/app-piv.c (do_prep_reselect): New stub function. (app_select_piv): Set new stub function. * scd/app-common.h (struct app_ctx_s): Add parameter ctrl to setattr, sign, auth, decipher, and check_pin. Change all implementations and callers to pass such a parameter. -- This is work in progress. Signed-off-by: Werner Koch <[email protected]>
* scd: Enhance KEYINFO command to limit listing with capability.NIIBE Yutaka2019-12-191-13/+29
| | | | | | | | | | | | | | | | | | * scd/app-common.h: Add CAPABILITY argument to the WITH_KEYGRIP. (app_do_with_keygrip): Likewise. * scd/app-openpgp.c (send_keyinfo_if_available): New. (do_with_keygrip): Support listing with CAPABILITY. * scd/app-piv.c (do_with_keygrip): Likewise. * scd/app.c (maybe_switch_app): Supply the argument. (app_do_with_keygrip): Add CAPABILITY argument. * scd/command.c (cmd_pksign, cmd_pkauth): Supply the argument. (cmd_pkdecrypt): Likewise. (cmd_keyinfo): Support listing with CAPABILITY. -- GnuPG-bug-id: 4784 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:openpgp: Avoid PIN caching issues after re-select.Werner Koch2019-09-051-0/+6
| | | | | | | | | | | * scd/app-openpgp.c (do_reselect): Clear PIN cache flags. -- It seems that the verification status of the OpenPGP app on a Yubikey is reset on a select. We need to reflect this in our cache to avoid a "Bad PIN" error on computing a signature. Signed-off-by: Werner Koch <[email protected]>
* scd: Support "[CHV3]" attribute for keyid string.NIIBE Yutaka2019-07-191-3/+2
| | | | | | | * scd/app-openpgp.c (check_keyidstr0: Relax the check. Fixes-commit: b0f0791e4ade845b2a0e2a94dbda4f3bf1ceb039 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Add an re-select mechanism to switch apps.Werner Koch2019-06-251-2/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-common.h (struct app_ctx_s): Add func ptr 'reselect'. * scd/app-piv.c (do_reselect): New. (app_select_piv): Move AID constant to file scope. * scd/app-openpgp.c (do_reselect): New. (app_select_openpgp): Move AID constant to file scope. * scd/app.c (apptype_from_name): New. (check_application_conflict): Check against all apps of the card. Always set current_apptype. (select_additional_application): New. (maybe_switch_app): New. (app_write_learn_status, app_readcert, app_readkey, app_getattr) (app_setattr, app_sign, app_auth, app_decipher, app_writecert) (app_writekey, app_genkey, app_change_pin, app_check_pin): Use it here. (app_do_with_keygrip): Force reselect on success. (app_new_register): Move setting of CURRENT_APPTYPE to ... (select_application): here so that it will be set to the requested card. * scd/command.c (open_card_with_request): Select additional application if possible. -- Noet that we will likely need to rework this even more so to get well defined semantics for card access. Signed-off-by: Werner Koch <[email protected]>
* scd: Simplify inclusion of app-common.h.Werner Koch2019-06-211-1/+0
| | | | | | | | | | | | | | * scd/scdaemon.h: Include app-common.h. Remove inclusion of that header from all other files. (card_t, app_t): Move typedef to ... * scd/app-common.h: here. Use them in the defs. -- In another patch we will need apptype_t in the ctrl object and thus we need to reorganize things a bit now. Given that most files need app-common anyway it makes sense to always include it. Signed-off-by: Werner Koch <[email protected]>
* scd: Use enums for cardtype and apptype.Werner Koch2019-06-211-1/+1
| | | | | | | | | | | | | | | | * scd/app-common.h (cardtype_t): New. (apptype_t): New. (struct card_ctx_s): Change type of cardtype. (struct app_ctx_s): Change type of apptype. Adjust all users. * scd/app.c (struct app_priority_list_s): Add field apptype. (strcardtype): New. Use as needed. (strapptype): New. Use as needed. -- Using strcmp is lame and we can't use a switch to let the compiler complain about missed cases. Signed-off-by: Werner Koch <[email protected]>
* scd: Split data structures into app and card related objects.Werner Koch2019-06-191-45/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-common.h (struct card_ctx_s): New. (struct app_ctx_s): Factor card specific fields out to card_ctx_s. (app_get_slot): New. * scd/scdaemon.h (card_t): New. (struct server_control_s): Rename field app_ctx to card_ctx and change all users. * scd/app-dinsig.c: Use app_get_slot and adjust for chang in card related fields. * scd/app-geldkarte.c: Ditto. * scd/app-nks.c: Ditto. * scd/app-openpgp.c: Ditto. * scd/app-p15.c: Ditto. * scd/app-sc-hsm.c: Ditto. * scd/app.c: Lost of changes to adjust for the changed data structures. Change all callers. (app_list_lock): Rename to card_list_lock. (app_top): Remove. (card_top): New. (lock_app): Rename to lock_card and change arg type. (unlock_app): Rename to unlock_card. (app_dump_state): Print card and app info. (app_reset): Rename to card_reset. (app_new_register): Change for the new data structure. (deallocate_card): Dealloc card and all apps. (app_ref): Rename to card_ref. (app_unref): Rename to card_unref. (app_unref_locked): Rename to card_unref_locked. (card_get_serialno): New. * scd/command.c (cmd_pkdecrypt): Actually use the looked up card and former app object and not the standard one from the context. -- Although quite large, this is a straightforward change to separate card/token related data from card application related data. Before this change there was a one-to-one relation between card and application and no way to represent several applications on a card. The new data structure will allow for such a representation. Signed-off-by: Werner Koch <[email protected]>
* scd: Slight change to app->fnc.do_with_keygrip.Werner Koch2019-06-171-8/+10
| | | | | | | | | | | | | * scd/app-openpgp.c (do_with_keygrip): Return a real error code to avoid misinterpretation of the result. Also fix the case for a too small buffer. -- The only real chnage is the case for a too small buffer. That should in general never happen but if so we now return an error instead of success. Signed-off-by: Werner Koch <[email protected]>
* scd: Use the correct gpg for the v1.0 OpenPGP card hack.Werner Koch2019-06-171-1/+2
| | | | | | | | | | | * scd/app-openpgp.c (get_public_key): Use gnupg_module_name instead of just "gpg". -- There is no bug report regarding this and it would be very unlikely but we should always use the gpg belonging to our code. Signed-off-by: Werner Koch <[email protected]>
* scd: Remove unused cruft from GnuPG 1.xWerner Koch2019-05-161-33/+0
| | | | | | | | | * scd/apdu.c: Remove code used only by GnuPG 1. * scd/app-openpgp.c: Ditto. * scd/ccid-driver.c: Ditto. * scd/iso7816.c: Ditto. Signed-off-by: Werner Koch <[email protected]>
* agent,scd: Scan and load all public keys for availability.NIIBE Yutaka2019-05-161-0/+4
| | | | | | | * agent/divert-scd.c (ask_for_card): Scan by SERIALNO command. * scd/app-openpgp.c (do_with_keygrip): Make sure to load pubkey. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Add new command: KEYINFO.NIIBE Yutaka2019-04-251-0/+54
| | | | | | | | | | | | | | | * scd/app-common.h (struct app_ctx_s): Add with_keygrip function. * scd/app-openpgp.c (do_with_keygrip): New. * scd/app.c (app_do_with_keygrip): New. * scd/command.c (cmd_keyinfo): New. (send_keyinfo): New. -- KEYGRIP_ACTION_LOOKUP is not yet used. It will be used for directly asking PK* action to determine an APP. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Allow KEYGRIP as KEYIDSTR.NIIBE Yutaka2019-04-231-15/+52
| | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): Add keygrip_str. (store_keygrip): New. (read_public_key): Call store_keygrip to hold keygrip. (get_public_key): Likewise. (send_keypair_info): Use stored keygrip_str. (check_keyidstr): Allow use of KEYGRIP. (do_check_pin): Allow use of KEYGRIP of signing slot. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Factor out a function to check keyidstr.NIIBE Yutaka2019-04-221-126/+59
| | | | | | | * scd/app-openpgp.c (check_keyidstr): New. (do_sign, do_auth, do_decipher, do_check_pin): Use check_keyidstr. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: New options --info and --info-only for READKEY.Werner Koch2019-04-031-8/+19
| | | | | | | | | | | | | | | | | | | | | | * scd/command.c (cmd_readkey): New options --info and --info-only. * scd/app.c (app_readkey): New arg 'flags'. * scd/app-common.h (APP_READKEY_FLAG_INFO): New. (struct app_ctx_s): New args 'ctrl' and 'flags' for member readkey. Change all implementers. * scd/app-nks.c (do_readkey): Stub implementation of APP_READKEY_FLAG_INFO. * scd/app-openpgp.c (do_readkey): Implement APP_READKEY_FLAG_INFO. * scd/app-piv.c (do_readkey): Ditto. -- This feature allows to quickly get the keygrip and in most cases also the usage flags for one specific keyref. Example: <- readkey --info-only PIV.9D -> S KEYPAIRINFO FC6061FB457224370B85C6F34DD56CD29E669620 PIV.9D e -> OK Signed-off-by: Werner Koch <[email protected]>
* scd: New standard attributes $ENCRKEYID and $SIGNKEYID.Werner Koch2019-04-031-0/+14
| | | | | | | | | | | | | | | | * g10/call-agent.c (agent_scd_keypairinfo): Use --keypairinfo. * sm/call-agent.c (gpgsm_agent_scd_keypairinfo): Ditto. * scd/app-openpgp.c (do_getattr): Add attributes "$ENCRKEYID" and "$SIGNKEYID". * scd/app-piv.c (do_getattr): Ditto. -- We already have $AUTHKEYID to locate the keyref of the key to be used with ssh. It will also be useful to have default keyref for encryption and signing. For example, this will allow us to repalce the use of "OPENPGP.2" by a app type specific keyref. Signed-off-by: Werner Koch <[email protected]>
* Fix the previous commit.NIIBE Yutaka2019-03-131-3/+3
| | | | | | | | | | | | * g10/ecdh.c (kek_params_table): Revert the change. * scd/app-openpgp.c (ecdh_params): Use CIPHER_ALGO_AES256 for 384-bit key. -- Avoiding CIPHER_ALGO_AES192 is intentional here. Signed-off-by: NIIBE Yutaka <[email protected]>
* g10: Fix symmetric cipher algo constant for ECDH.NIIBE Yutaka2019-03-131-2/+2
| | | | | | | | | | * g10/ecdh.c (kek_params_table): Use CIPHER_ALGO_AES192 for ECC strength 384, according to RFC-6637. -- Reported-by: Trevor Bentley Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Rename a shared info field name.Werner Koch2019-03-051-12/+12
| | | | | | | | * scd/app-piv.c (app_select_piv): * scd/app-common.h (struct app_ctx_s): Rename 'card_version' to 'cardversion'. Rename all users. Add 'appversion'. Signed-off-by: Werner Koch <[email protected]>
* scd: Simplify the app_readkey parameters.Werner Koch2019-02-261-38/+8
| | | | | | | | | | | | | | * scd/app-help.c (app_help_pubkey_from_cert): New. * scd/command.c (cmd_readkey): Refactor to use that new function and handle the --advanced flag only here. * scd/app.c (app_readkey): Remove parm advanced. * scd/app-common.h (struct app_ctx_s): Remove parm advanced from the readkey member. * scd/app-nks.c (do_readkey): Adjust for removed parm. * scd/app-piv.c (do_readkey): Ditto. * scd/app-openpgp.c (do_readkey): Ditto. Signed-off-by: Werner Koch <[email protected]>
* scd: Extend KEYPAIRINFO by key usage info.Werner Koch2019-02-211-0/+10
| | | | | | | | | | * scd/app-openpgp.c (send_keypair_info): Append usage string. * scd/app-piv.c (struct data_object_s): Remove column 'binary'. Add column 'usage'. (dump_all_do): Adjust for removed 'binary'. (send_keypair_and_cert_info): Append usage string. Signed-off-by: Werner Koch <[email protected]>
* scd: Clear CHV status on timeout error.NIIBE Yutaka2019-02-211-34/+45
| | | | | | | | | * scd/app-openpgp.c (clear_chv_status): New. (do_change_pin): Use clear_chv_status. (do_sign): Call clear_chv_status on GPG_ERR_TIMEOUT. (do_auth, do_decipher): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Make app_genkey and supporting ISO function more flexible.Werner Koch2019-02-061-3/+5
| | | | | | | | | | | | | | | | | | | * scd/app.c (app_genkey): Add arg keytype. * scd/app-common.h (struct app_ctx_s): Fitto for the genkey member. * scd/command.c (cmd_genkey): Adjust for change. * scd/iso7816.c (do_generate_keypair): Replace arg read_only by new args p1 and p2. (iso7816_read_public_key): Adjust for this. (iso7816_generate_keypair): Add new args p1 and p2. * scd/app-openpgp.c (do_genkey): Adjust for changes. -- The OpenPGP card creates keys according to parameters read from a data object. Other cards we are about to implement require a direct specification of the requested keytype. This patch implements the required changes. Signed-off-by: Werner Koch <[email protected]>
* scd: Allow standard keyref scheme for app-openpgp.Werner Koch2019-02-051-1/+14
| | | | | | | | | | | | | | * scd/app-openpgp.c (do_change_pin): Allow prefixing the CHVNO with "OPENPGP." * tools/card-call-scd.c (scd_change_pin): Change API to use strings. * tools/gpg-card-tool.c (cmd_passwd): Adjust for change. (cmd_unblock): Ditto. -- The generic keyref allows for better error detection in case a keyref is send to a wrong card. Signed-off-by: Werner Koch <[email protected]>
* scd: Fix flushing of CA-FPR data objectsWerner Koch2019-01-251-23/+25
| | | | | | | | | | | | | | * scd/app-openpgp.c (do_setattr): Add new table item to flush a different tag. -- For whatever reasons the OpenPGP card reads the 3 CA fingerprints from one object but sets them individually using 3 different tags. The cache flushing was not prepared for this and so a changed CA fingerprint showed only up after a card reset. This patch fixes it. Signed-off-by: Werner Koch <[email protected]>
* scd: Support PASSWD --clear for OpenPGP card.NIIBE Yutaka2019-01-231-1/+32
| | | | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (do_change_pin): Implement handling APP_CHANGE_FLAG_CLEAR. -- It is specified in the specification version 3.1 or later. Some version 2 cards (including Gnuk) support this feature. Any version 1 card has no support for this feature. For CHVNO = 1, it clears for both of 81 and 82; That is, user's key usages for signing and others (decryption and auth). For CHVNO = 3, it clears for 83, admin key. For CHVNO = 2, it clears 82; That is, user's key usages others (decryption and auth). Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Add option --clear to PASSWD.Werner Koch2019-01-211-0/+4
| | | | | | | | | | | | | | | * scd/command.c (cmd_passwd): Add option --clear. (send_status_printf): New. * scd/app-common.h (APP_CHANGE_FLAG_CLEAR): New. * scd/app-nks.c (do_change_pin): Return an error if that option is used. * scd/app-openpgp.c (do_change_pin): Ditto. -- Card application may support this option to clear the PIN verification status of a specific PIN. Signed-off-by: Werner Koch <[email protected]>
* doc: Typo fix in code commentWerner Koch2019-01-021-4/+4
| | | | --
* scd: Fix description string.NIIBE Yutaka2018-12-181-2/+2
| | | | | | * scd/app-openpgp.c (data_objects): Capitalize the word for usage. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Make "learn" report about KDF data object.NIIBE Yutaka2018-11-151-3/+8
| | | | | | | * scd/app-openpgp.c (do_learn_status): Report KDF attr. * g10/card-util.c (current_card_status): Output KDF for with_colons. Signed-off-by: NIIBE Yutaka <[email protected]>
* g10,scd: Improve UIF support.NIIBE Yutaka2018-10-251-3/+6
| | | | | | | | | | * g10/call-agent.c (learn_status_cb): Parse "bt" flag. * g10/call-agent.h: New member field "bt". * g10/card-util.c (uif): Limit its access only when it is supported. * scd/app-openpgp.c (do_setattr): Allow access to UIF objects only when there is a button. Signed-off-by: NIIBE Yutaka <[email protected]>
* all: fix spelling and typosDaniel Kahn Gillmor2018-10-241-1/+1
| | | | Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* scd: Fix signing authentication status.NIIBE Yutaka2018-10-151-1/+4
| | | | | | | | | | | | | * scd/app-openpgp.c (do_sign): Clear DID_CHV1 after signing. -- We have a corner case: In "not forced" situation and authenticated, and it is changed to "forced", card implementaiton can actually accept signing, but GnuPG requires authentication, because it is "forced". GnuPG-bug-id: 4177 Signed-off-by: NIIBE Yutaka <[email protected]>
* g10,scd: Support UIF changing command.NIIBE Yutaka2018-09-271-3/+15
| | | | | | | | | | | | | * g10/card-util.c (uif, cmdUIF): New. (card_edit): Add call to uif by cmdUIF. * scd/app-openpgp.c (do_getattr): Support UIF-1, UIF-2, and UIF-3. (do_setattr): Likewise. (do_learn_status): Learn UIF-1, UIF-2, and UIF-3. -- GnuPG-bug-id: 4158 Signed-off-by: NIIBE Yutaka <[email protected]>
* Merge branch 'STABLE-BRANCH-2-2' into masterWerner Koch2018-04-101-14/+47
|\ | | | | | | | | | | | | | | | | -- Fixed conflicts: NEWS - keep master configure.ac - merge g10/card-util.c - mostly 2.2 g10/sig-check.c - 2.2
| * scd: Writing KDF resets auth state.NIIBE Yutaka2018-04-031-1/+7
| | | | | | | | | | | | * scd/app-openpgp.c (do_setattr): Clear auth state. Signed-off-by: NIIBE Yutaka <[email protected]>
| * g10,scd: Support single salt for KDF data object.NIIBE Yutaka2018-03-301-7/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/card-util.c (gen_kdf_data): Support single salt. (kdf_setup): Can have argument for single salt. * scd/app-openpgp.c (pin2hash_if_kdf): Support single salt. -- Gnuk has "admin-less" mode. To support "admin-less" mode with KDF feature, salt should be same for user and admin. Thus, I introduce a valid use of single salt. Signed-off-by: NIIBE Yutaka <[email protected]>
| * scd: Support changing key attribute back to RSA.NIIBE Yutaka2018-03-301-6/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (change_rsa_keyattr): Try usual RSA. -- In the OpenPGP card specification, there are multiple options to support RSA (having P and Q or not, etc.), and it is implementation dependent. Since GnuPG doesn't have knowledge which card implementation support which option and there is no way (yet) for card to express itself which key attributes are supported, we haven't supported key attribute change back to RSA. But, many card implementation uses P and Q, try this option. If other cases, factory-reset would be easier option. Signed-off-by: NIIBE Yutaka <[email protected]>
* | Merge branch 'STABLE-BRANCH-2-2' into masterWerner Koch2018-03-271-2/+3
|\|
| * scd: Support KDF DO setup.NIIBE Yutaka2018-03-221-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | * g10/call-agent.c (learn_status_cb): Parse the capability for KDF. * g10/card-util.c (gen_kdf_data, kdf_setup): New. (card_edit): New admin command cmdKDFSETUP to call kdf_setup. * scd/app-openpgp.c (do_getattr): Emit KDF capability. -- GnuPG-bug-id: 3823 Signed-off-by: NIIBE Yutaka <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-15 22:14:01 +0000