aboutsummaryrefslogtreecommitdiffstats
path: root/sm/certcheck.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-07-08gpgsm: Replace all assert calls by log_assert.Werner Koch1-3/+2
-- Signed-off-by: Werner Koch <[email protected]>
2020-07-03sm: Exclude rsaPSS from de-vs compliance mode.Werner Koch1-53/+20
* common/compliance.h (PK_ALGO_FLAG_RSAPSS): New. * common/compliance.c (gnupg_pk_is_compliant): Add arg alog_flags and test rsaPSS. Adjust all callers. (gnupg_pk_is_allowed): Ditto. * sm/misc.c (gpgsm_ksba_cms_get_sig_val): New wrapper function. (gpgsm_get_hash_algo_from_sigval): New. * sm/certcheck.c (gpgsm_check_cms_signature): Change type of sigval arg. Add arg pkalgoflags. Use the PK_ALGO_FLAG_RSAPSS. * sm/verify.c (gpgsm_verify): Use the new wrapper and new fucntion to also get the algo flags. Pass algo flags along. Signed-off-by: Werner Koch <[email protected]>
2020-06-25sm: Fix support verification of nistp521 signatures.Werner Koch1-1/+1
* sm/certcheck.c (do_encode_md): Fix obvious bug. -- Fixes-commit: 596212e71abf33b30608348b782c093dace83110 Signed-off-by: Werner Koch <[email protected]>
2020-06-17sm: Support verification of nistp521 signatures.Werner Koch1-5/+8
* sm/certcheck.c (do_encode_md): Take care of nistp521. -- That curve is a bit odd in that it does not match a common hash digest length. We fix that here for just this case instead of writing more general code to support all allowed cases (i.e. hash shorter than Q). Signed-off-by: Werner Koch <[email protected]>
2020-05-18sm: Support creation of EdDSA certificates.Werner Koch1-0/+10
* sm/misc.c (transform_sigval): Support EdDSA. * sm/certreqgen.c (create_request): Support EdDSA cert creation. * sm/certcheck.c (gpgsm_check_cert_sig): Map some ECC algo OIDs to hash algos. * sm/call-agent.c (struct sethash_inq_parm_s): New. (sethash_inq_cb): New. (gpgsm_agent_pksign): Add mode to pass plain data for EdDSA. -- Tested using a parameter file Key-Type: EdDSA Key-Length: 1024 Key-Grip: 09D9AE3D494F7888C93BE5106AD8A734A87617F0 Key-Usage: sign Serial: random Name-DN: CN=dummy test ed25519 where the keygrip is from a gpg generated Ed25519 key. ECDSA was tested using Key-Type: ECDSA Key-Length: 1024 Key-Grip: 8E06A180EFFE4C65B812150CAF19BF30C0689A4C Key-Usage: sign Serial: random Name-DN: CN=dummy test nistp256 and RSA using Key-Type: RSA Key-Length: 2048 Key-Grip: C6A6390E9388CDBAD71EAEA698233FE5E04F001E Key-Usage: sign Serial: random Name-DN: CN=dummy test rsa The command used in all cases is gpgsm -v --gen-key --batch a.parm >a.crt gpgsm -v --import <a.crt More support, in particular in the user interface, is required and will follow soon. GnuPG-bug-id: 4888 Signed-off-by: Werner Koch <[email protected]>
2020-05-13sm: Support import and verification of EdDSA certificates.Werner Koch1-17/+120
* sm/certdump.c (gpgsm_get_serial): New. * sm/certcheck.c (gpgsm_check_cert_sig): Support EdDSA signatures. -- Note that this does not work with the self-signed RFC-8410 sample certificate; see the code for comments. The Ed488 case has not been tested due to a lack of support in Libgcrypt. Signed-off-by: Werner Koch <[email protected]>
2020-05-08sm: Cleanup the use of GCRY_PK_ECC and GCRY_PK_ECDSA.Werner Koch1-5/+3
* common/sexputil.c (pubkey_algo_to_string): New. * sm/certcheck.c (do_encode_md): Replace GCRY_PK_ECDSA by GCRY_PK_ECC. * sm/certreqgen-ui.c (check_keygrip): Add all ECC algorithms. * sm/gpgsm.c (our_pk_test_algo): Also allow EdDSA. * sm/verify.c (gpgsm_verify): Map ECC algo to ECDSA. Use new pubkey algo name function Signed-off-by: Werner Koch <[email protected]>
2020-04-15sm,dirmngr: Restrict allowed parameters used with rsaPSS.Werner Koch1-1/+39
* sm/certcheck.c (extract_pss_params): Check the used PSS params. * dirmngr/crlcache.c (finish_sig_check): Ditto. * dirmngr/validate.c (check_cert_sig): Ditto. -- GnuPG-bug-id: 4538 # ------------------------ >8 ------------------------ See https://www.metzdowd.com/pipermail/cryptography/2019-November/035449.html Signed-off-by: Werner Koch <[email protected]>
2020-04-14sm: Support rsaPSS verification also for CMS signatures.Werner Koch1-38/+110
* sm/certcheck.c (gpgsm_check_cert_sig): Factor PSS parsing out to ... (extract_pss_params): new. (gpgsm_check_cms_signature): Implement PSS. -- GnuPG-bug-id: 4538
2020-04-09dirmngr: Support rsaPSS also in the general validate module.Werner Koch1-1/+5
* dirmngr/validate.c (hash_algo_from_buffer): New. (uint_from_buffer): New. (check_cert_sig): Support rsaPSS. * sm/certcheck.c (gpgsm_check_cert_sig): Fix small memory leak on error. -- Yes, I know that there is a lot of code duplication. In fact some of the code is ugly and it would be better if we enhance Libgcrypt to guarantee that returned memory buffers via gcry_sexp_extract_param are allways Nul terminated and we should also enhance that function to directly extract into an unsigned int or char *. GnuPG-bug-id: 4538 Signed-off-by: Werner Koch <[email protected]>
2020-04-09sm,dirmngr: Support rsaPSS signature verification.Werner Koch1-45/+145
* sm/certcheck.c (hash_algo_from_buffer): New. (uint_from_buffer): New. (gpgsm_check_cert_sig): Handle PSS. * dirmngr/crlcache.c (hash_algo_from_buffer): New. (uint_from_buffer): New. (start_sig_check): Detect PSS and extract hash algo. New arg to return a PSS flag. (finish_sig_check): New arg use_pss. Extract PSS args and use them. (crl_parse_insert): Pass use_pss flag along. -- GnuPG-bug-id: 4538 Signed-off-by: Werner Koch <[email protected]>
2017-11-27Use the gpgrt log functions if possible.Werner Koch1-1/+1
* common/logging.c: Do not build any code if we can use the gpgrt_log functions. (log_logv_with_prefix): Rename to log_logv_prefix and change order of args so that this function matches its printf like counterpart gpgrt_logv_prefix. Change all callers. (log_debug_with_string): Rename to log_debug_string. Change all callers. (log_printhex): Move first arg to end so that this function matches its printf like counterpart gpgrt_log_printhex. Change all callers. * common/logging.h: Divert to gpgrt/libgpg-error if we can use the gpgrt_log functions. (bug_at): Add inline versions if we can use the gpgrt_log functions. * configure.ac (GPGRT_ENABLE_LOG_MACROS): Add to AH_BOTTOM. (mycflags): Add -Wno-format-zero-length. -- This patch enables the use of the log function from libgpgrt (aka libgpg-error). Instead of checking a version number, we enable them depending on macros set by recent gpg-error versions. Eventually the whole divert stuff can be removed. The -Wno-format-zero-length is required because log_printhex can be called with an empty format string. Note that this is fully specified standard C behaviour. Signed-off-by: Werner Koch <[email protected]>
2017-03-07Remove -I option to common.NIIBE Yutaka1-1/+1
* dirmngr/Makefile.am (AM_CPPFLAGS): Remove -I$(top_srcdir)/common. * g10/Makefile.am (AM_CPPFLAGS): Ditto. * g13/Makefile.am (AM_CPPFLAGS): Ditto. * kbx/Makefile.am (AM_CPPFLAGS): Ditto. * scd/Makefile.am (AM_CPPFLAGS): Ditto. * sm/Makefile.am (AM_CPPFLAGS): Ditto. * tools/Makefile.am (AM_CPPFLAGS): Ditto. * Throughout: Follow the change. Signed-off-by: NIIBE Yutaka <[email protected]>
2016-11-05Change all http://www.gnu.org in license notices to https://Werner Koch1-1/+1
--
2012-06-05Change all quotes in strings and comments to the new GNU standard.Werner Koch1-1/+1
The asymmetric quotes used by GNU in the past (`...') don't render nicely on modern systems. We now use two \x27 characters ('...'). The proper solution would be to use the correct Unicode symmetric quotes here. However this has the disadvantage that the system requires Unicode support. We don't want that today. If Unicode is available a generated po file can be used to output proper quotes. A simple sed script like the one used for en@quote is sufficient to change them. The changes have been done by applying sed -i "s/\`\([^'\`]*\)'/'\1'/g" to most files and fixing obvious problems by hand. The msgid strings in the po files were fixed with a similar command.
2011-09-20Replace gcry_md_start_debug by gcry_md_debug.Werner Koch1-1/+1
This is to allow building with Libgcrypt master (1.6) which has some cleanups in the API/ABI.
2011-02-04Nuked almost all trailing white space.post-nuke-of-trailing-wsWerner Koch1-12/+9
We better do this once and for all instead of cluttering all future commits with diffs of trailing white spaces. In the majority of cases blank or single lines are affected and thus this change won't disturb a git blame too much. For future commits the pre-commit scripts checks that this won't happen again.
2008-09-29Remove hacks which are not anymore needed since we now require Libgcrypt 1.4Werner Koch1-7/+3
2007-08-10Implemented the chain model for X.509 validation.Werner Koch1-3/+9
2007-07-04Changed to GPLv3.Werner Koch1-4/+2
Removed intl/.
2007-05-07Upgraded gettext.Werner Koch1-3/+8
Fixed accidental dependency on libgcrypt 1.3.0.
2007-04-20 * certcheck.c (do_encode_md): Add arg PKEY. Add support for DSA2Werner Koch1-12/+74
and all ECDSA sizes. (get_dsa_qbits): New. (pk_algo_from_sexp): A key will never contain ecdsa as algorithm, so remove that.
2007-04-18sm/Werner Koch1-1/+7
* certcheck.c (do_encode_md): Support 160 bit ECDSA.
2006-10-05bug fixesWerner Koch1-0/+2
2006-09-06The big Assuan error code removal.Werner Koch1-2/+2
2006-06-20Updated FSF's address.Werner Koch1-1/+2
2005-11-13Added qualified signature features.Werner Koch1-0/+4
2005-07-27Removed directories which are only used by the 1.9 branchWerner Koch1-300/+0
2005-06-16gcc-4 defaults forced me to edit many many files to get rid of theWerner Koch1-6/+8
char * vs. unsigned char * warnings. The GNU coding standards used to say that these mismatches are okay and better than a bunch of casts. Obviously this has changed now.
2005-03-17* certcheck.c: Fixed use of DBG_CRYPTO and DBG_X509.Werner Koch1-5/+5
* certchain.c (gpgsm_basic_cert_check): Dump certificates after a failed gcry_pk_verify. (find_up): Do an external lookup also for an authorityKeyIdentifier lookup. Factored external lookup code out to .. (find_up_external): .. new.
2004-08-17* import.c (check_and_store): Do a full validation ifWerner Koch1-42/+96
--with-validation is set. * certchain.c (gpgsm_basic_cert_check): Print more detailed error messages. * certcheck.c (do_encode_md): Partly support DSA. Add new arg PKALGO. Changed all callers to pass it. (pk_algo_from_sexp): New. tests/pkits: New directory
2004-04-26* call-agent.c (gpgsm_agent_pksign, gpgsm_agent_pkdecrypt)Werner Koch1-3/+3
(gpgsm_agent_genkey, gpgsm_agent_istrusted) (gpgsm_agent_marktrusted, gpgsm_agent_havekey) (gpgsm_agent_passwd): Add new arg CTRL and changed all callers. (start_agent): New arg CTRL. Send progress item when starting a new agent. * sign.c (gpgsm_get_default_cert, get_default_signer): New arg CTRL to be passed down to the agent function. * decrypt.c (prepare_decryption): Ditto. * certreqgen.c (proc_parameters, read_parameters): Ditto. * certcheck.c (gpgsm_create_cms_signature): Ditto.
2004-02-17* gpgsm.c: New option --with-md5-fingerprint.Werner Koch1-1/+1
* keylist.c (list_cert_std): Print MD5 fpr. * gpgsm.c: New options --with-validation. * server.c (option_handler): New option "with-validation". * keylist.c (list_cert_std, list_internal_keys): New args CTRL and WITH_VALIDATION. Changed callers to set it. (list_external_cb, list_external_keys): Pass CTRL to the callback. (list_cert_colon): Add arg CTRL. Check validation if requested. * certchain.c (unknown_criticals, allowed_ca, check_cert_policy) (gpgsm_validate_chain): New args LISTMODE and FP. (do_list): New helper for info output. (find_up): New arg FIND_NEXT. (gpgsm_validate_chain): After a bad signature try again with other CA certificates. * import.c (print_imported_status): New arg NEW_CERT. Print additional STATUS_IMPORT_OK becuase that is what gpgme expects. (check_and_store): Always call above function after import. * server.c (get_status_string): Added STATUS_IMPORT_OK.
2004-02-13* certcheck.c (gpgsm_create_cms_signature): Format a descriptionWerner Koch1-2/+5
for use by the pinentry. * decrypt.c (gpgsm_decrypt): Ditto. Free HEXKEYGRIP. * certdump.c (format_name_cookie, format_name_writer) (gpgsm_format_name): New. (gpgsm_format_serial): New. (gpgsm_format_keydesc): New. * call-agent.c (gpgsm_agent_pksign): New arg DESC. (gpgsm_agent_pkdecrypt): Ditto.
2003-12-17Replaced deprecated type names.Werner Koch1-5/+5
* certdump.c (gpgsm_print_serial): Cleaned up cast use in strtoul. (gpgsm_dump_serial): Ditto. * decrypt.c (gpgsm_decrypt): Replaced ERR by RC.
2003-11-12Mainly changes to adjust for the changed KSBA API.Werner Koch1-2/+2
2003-08-05This commit was manufactured by cvs2svn to create branchRepo Admin1-0/+300
'GNUPG-1-9-BRANCH'.
2003-07-28Adjusted for use with current libgcrypt (1.1.42).Werner Koch1-1/+1
2003-06-27Key generation and signing using the OpenPGP card does rudimentary work.Werner Koch1-26/+26
2003-06-03Make use of libgpg-errorWerner Koch1-11/+11
2003-01-09Updated from latest NewPG projectWerner Koch1-2/+1
2002-10-19This commit was manufactured by cvs2svn to create branchRepo Admin1-301/+0
'GNUPG-1-9-BRANCH'.
2002-09-19* certcheck.c (gpgsm_check_cert_sig): Add cert hash debugging.NEWPG-0-9-2Werner Koch1-0/+12
* certchain.c (find_up): Print info when the cert was not found by the autorithyKeyIdentifier.
2002-08-09* gpgsm.c (emergency_cleanup): New.Werner Koch1-4/+30
(main): Initialize the signal handler. * sign.c (gpgsm_sign): Reset the hash context for subsequent signers and release it at the end.
2002-03-18Doc fixes, moved some fizmes to TODO, fixed minor bugs.Werner Koch1-4/+0
2002-03-05* gpgsm.c, gpgsm.h: Add local_user.Werner Koch1-3/+4
* sign.c (gpgsm_get_default_cert): New. (get_default_signer): Use the new function if local_user is not set otherwise used that value. * encrypt.c (get_default_recipient): Removed. (gpgsm_encrypt): Use gpgsm_get_default_cert. * verify.c (gpgsm_verify): Better error text for a bad signature found by comparing the hashs.
2002-02-25* server.c (option_handler): Allow to use -2 for "send all certsWerner Koch1-0/+1
except the root cert". * sign.c (add_certificate_list): Implement it here. * certpath.c (gpgsm_is_root_cert): New.
2002-02-07* certlist.c (gpgsm_add_to_certlist): Check that the specifiedWerner Koch1-1/+1
name identifies a certificate unambiguously. (gpgsm_find_cert): Ditto. * server.c (cmd_listkeys): Check that the data stream is available. (cmd_listsecretkeys): Ditto. (has_option): New. (cmd_sign): Fix ambiguousity in option recognition. * gpgsm.c (main): Enable --logger-fd. * encrypt.c (gpgsm_encrypt): Increased buffer size for better performance. * call-agent.c (gpgsm_agent_pksign): Check the S-Exp received from the agent. * keylist.c (list_cert_colon): Filter out control characters.
2001-12-18Changes to be used with the new libksba interface.Werner Koch1-111/+36
libgcrypt-1.1.5 is required (cvs or tarball)
2001-11-25The agent does now work and read the secret keys from the directoryWerner Koch1-1/+22
~/.gnupg-test/private-keys-v1.d/<keygrip-as-20-byte-hex-number>. I will post a sample key to gpa-dev.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-17 00:46:50 +0000