aboutsummaryrefslogtreecommitdiffstats
path: root/sm/certreqgen.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2025-01-29gpgsm: Allow CSR generation with an unprotected key.Werner Koch1-1/+4
* sm/call-agent.c (gpgsm_agent_genkey): Add arg no_protection. * sm/certreqgen.c (struct reqgen_ctrl_s): Add field no_protection. (read_parameters): Add keyword "%no-protection". (proc_parameters): Pass no_protection to gpgsm_agent_genkey.
2024-05-31indent: Fix spellingDaniel Kahn Gillmor1-2/+2
-- These are non-substantive corrections for minor spelling mistakes within the GnuPG codebase. With something like this applied to the codebase, and a judiciously tuned spellchecker integrated as part of a standard test suite, it should be possible to keep a uniform orthography within the project. GnuPG-bug-id: 7116
2024-03-27gpgsm: Allow to add extensions at the --gen-key prompt.Werner Koch1-0/+5
* sm/certreqgen-ui.c (gpgsm_gencertreq_tty): Add a prompt for extensions. -- An example for an extension would be extKeyUsage for authentication: 2.5.29.37 n 301406082B0601050507030206082B06010505070301
2020-07-08gpgsm: Replace all assert calls by log_assert.Werner Koch1-4/+7
-- Signed-off-by: Werner Koch <[email protected]>
2020-06-03sm: Fix recently introduced regression in CSR creation.Werner Koch1-1/+5
* sm/certreqgen.c (create_request): Also set SIGKEYLEN. -- Fixes-commit: 44676819f2873705b78849e7b2fd22214b691642 Signed-off-by: Werner Koch <[email protected]>
2020-05-19sm: Create ECC certificates with AKI and SKI by default.Werner Koch1-31/+127
* sm/certreqgen.c (create_request): Create AKI and SKI by default. -- GnuPG-bug-id: 4098 Signed-off-by: Werner Koch <[email protected]>
2020-05-18sm: Support creation of EdDSA certificates.Werner Koch1-21/+68
* sm/misc.c (transform_sigval): Support EdDSA. * sm/certreqgen.c (create_request): Support EdDSA cert creation. * sm/certcheck.c (gpgsm_check_cert_sig): Map some ECC algo OIDs to hash algos. * sm/call-agent.c (struct sethash_inq_parm_s): New. (sethash_inq_cb): New. (gpgsm_agent_pksign): Add mode to pass plain data for EdDSA. -- Tested using a parameter file Key-Type: EdDSA Key-Length: 1024 Key-Grip: 09D9AE3D494F7888C93BE5106AD8A734A87617F0 Key-Usage: sign Serial: random Name-DN: CN=dummy test ed25519 where the keygrip is from a gpg generated Ed25519 key. ECDSA was tested using Key-Type: ECDSA Key-Length: 1024 Key-Grip: 8E06A180EFFE4C65B812150CAF19BF30C0689A4C Key-Usage: sign Serial: random Name-DN: CN=dummy test nistp256 and RSA using Key-Type: RSA Key-Length: 2048 Key-Grip: C6A6390E9388CDBAD71EAEA698233FE5E04F001E Key-Usage: sign Serial: random Name-DN: CN=dummy test rsa The command used in all cases is gpgsm -v --gen-key --batch a.parm >a.crt gpgsm -v --import <a.crt More support, in particular in the user interface, is required and will follow soon. GnuPG-bug-id: 4888 Signed-off-by: Werner Koch <[email protected]>
2020-03-30sm: Fix possible NULL deref in error messages of --gen-key.Werner Koch1-20/+20
* sm/certreqgen.c: Protect printing the liniernur in case of !R. -- GnuPG-bug-id: 4895 Signed-off-by: Werner Koch <[email protected]>
2020-03-27gpgsm: Fix the previous commit.NIIBE Yutaka1-5/+5
Signed-off-by: NIIBE Yutaka <[email protected]>
2020-03-26gpgsm: Support key generation with ECC.NIIBE Yutaka1-5/+37
* sm/certreqgen.c (pKEYCURVE): New. (read_parameters): Add pKEYCURVE handling. (proc_parameters): Support ECC key generation. GnuPG-bug-id: 4888 Signed-off-by: NIIBE Yutaka <[email protected]>
2020-03-26gpgsm: Remove restriction of key generation (only RSA).NIIBE Yutaka1-8/+9
* sm/certreqgen.c (proc_parameters): Remove checking GCRY_PK_RSA. -- This is an initial change to support ECC key generation. GnuPG-bug-id: 4888 Signed-off-by: NIIBE Yutaka <[email protected]>
2019-02-21sm: Fix certificate creation with key on card.Werner Koch1-1/+1
* sm/certreqgen.c (create_request): Fix for certmode. -- When using an existing key from a card for certificate signing (in contrast to the default of generating a CSR), the code tried to use the same key for signing instead of the Signing-Key parameter. It is perfectly okay to use the regular signing path via gpg-agent for certificate creation - only self-signed certificates with a key on the card require the direct use of the card key (via "SCD PKSIGN"). Signed-off-by: Werner Koch <[email protected]>
2019-02-18sm: Support generation of card-based ed25519 CSR.Damien Goutte-Gattat via Gnupg-devel1-2/+4
* sm/call-agent.c (gpgsm_scd_pksign): Allow SHA512. Create proper S-expression for EdDSA signature. * sm/certreqgen.c (create_request): Force use of SHA512 when using a ed25519 key. * sm/misc.c (transform_sigval): Insert OID for ed25519. -- GnuPG-bug-id: 4013 Signed-off-by: Damien Goutte-Gattat <[email protected]>
2017-09-08gpgsm: default to 3072-bit keys.Daniel Kahn Gillmor1-2/+2
* doc/gpgsm.texi, doc/howto-create-a-server-cert.texi: : update default to 3072 bits. * sm/certreqgen-ui.c (gpgsm_gencertreq_tty): update default to 3072 bits. * sm/certreqgen.c (proc_parameters): update default to 3072 bits. * sm/gpgsm.c (main): print correct default_pubkey_algo. -- 3072-bit RSA is widely considered to be 128-bit-equivalent security. This is a sensible default in 2017. Signed-off-by: Daniel Kahn Gillmor <[email protected]> Gbp-Pq: Topic update-defaults Gbp-Pq: Name 0014-gpgsm-default-to-3072-bit-keys.patch
2017-03-07Remove -I option to common.NIIBE Yutaka1-1/+1
* dirmngr/Makefile.am (AM_CPPFLAGS): Remove -I$(top_srcdir)/common. * g10/Makefile.am (AM_CPPFLAGS): Ditto. * g13/Makefile.am (AM_CPPFLAGS): Ditto. * kbx/Makefile.am (AM_CPPFLAGS): Ditto. * scd/Makefile.am (AM_CPPFLAGS): Ditto. * sm/Makefile.am (AM_CPPFLAGS): Ditto. * tools/Makefile.am (AM_CPPFLAGS): Ditto. * Throughout: Follow the change. Signed-off-by: NIIBE Yutaka <[email protected]>
2017-02-16common: Rename remaining symbols in ksba-io-support.Werner Koch1-3/+3
* common/ksba-io-support.c (gpgsm_reader_eof_seen): Rename to ... (gnupg_ksba_reader_eof_seen): this. Change all callers. (gpgsm_destroy_reader): Rename to ... (gnupg_ksba_destroy_reader): this. Change all callers. (gpgsm_finish_writer): Rename to ... (gnupg_ksba_finish_writer): this. Change all callers. (gpgsm_destroy_writer): Rename to ... (gnupg_ksba_destroy_writer): this. Change all callers. * common/ksba-io-support.c (struct base64_context_s): Rename to ... (gnupg_ksba_io_s): this. * common/ksba-io-support.h (base64_context_s): Ditto. (Base64Context): Rename this typedef to ... (gnupg_ksba_io_t): this. Change all users. Signed-off-by: Werner Koch <[email protected]>
2017-02-16common: Remove gpgsm dependencies from ksba-io-support.Werner Koch1-1/+5
* common/ksba-io-support.c: Include ksba-io-support.h instead of ../sm/gpgsm.h. Include util.h. (writer_cb_parm_s): Remove const from 'pem_name'. (gpgsm_destroy_writer): Free 'pem_name'. (gpgsm_create_reader): Rename to ... (gnupg_ksba_create_reader): this. Replace args CTRL and ALLOW_MULTI_PEM by a new arg FLAGS. Change the code to evaluate FLAGS. Change all callers to pass the FLAGS. (gpgsm_create_writer): Rename to ... (gnupg_ksba_create_writer): this. Replace arg CTRL by new arg FLAGS. Add arg PEM_NAME. Evaluate FLAGS. Store a copy of PEM_NAME. Change all callers to pass the FLAGS and PEM_NAME. Signed-off-by: Werner Koch <[email protected]>
2016-11-05Change all http://www.gnu.org in license notices to https://Werner Koch1-1/+1
--
2016-10-21Fix use cases of snprintf.NIIBE Yutaka1-1/+1
* agent/call-pinentry.c, agent/call-scd.c, agent/command.c, build-aux/speedo/w32/g4wihelp.c, common/get-passphrase.c, dirmngr/dirmngr.c, g10/call-agent.c, g10/cpr.c, g10/keygen.c, g10/openfile.c, g10/passphrase.c, scd/app-openpgp.c, scd/scdaemon.c, sm/call-agent.c, sm/call-dirmngr.c, sm/certreqgen.c: Fix assuming C99. -- Signed-off-by: NIIBE Yutaka <[email protected]>
2015-10-28sm: Allow combination of usage flags --gen-key.Werner Koch1-31/+46
* sm/certreqgen.c (create_request): Re-implement building of the key-usage extension. -- GnuPG-bug-id: 2029 Signed-off-by: Werner Koch <[email protected]>
2015-03-25sm: Change default algos to SHA256 (CSR) and AES128 (bulk encryption).Werner Koch1-1/+1
* sm/certreqgen.c (create_request): Change default hash algo. * sm/gpgsm.c (DEFAULT_CIPHER_ALGO): Change default bulk cipher algo. -- Signed-off-by: Werner Koch <[email protected]>
2014-09-18sm: Silence compiler warnings.Werner Koch1-1/+1
* sm/certreqgen-ui.c (gpgsm_gencertreq_tty): Remove unused var I. * sm/certreqgen.c (proc_parameters): Init PUBLIC to avoid compiler warning.
2012-06-05Change all quotes in strings and comments to the new GNU standard.Werner Koch1-8/+8
The asymmetric quotes used by GNU in the past (`...') don't render nicely on modern systems. We now use two \x27 characters ('...'). The proper solution would be to use the correct Unicode symmetric quotes here. However this has the disadvantage that the system requires Unicode support. We don't want that today. If Unicode is available a generated po file can be used to output proper quotes. A simple sed script like the one used for en@quote is sufficient to change them. The changes have been done by applying sed -i "s/\`\([^'\`]*\)'/'\1'/g" to most files and fixing obvious problems by hand. The msgid strings in the po files were fixed with a similar command.
2011-12-06gpgsm: Allow specification of an AuthorityKeyIdentifier.Werner Koch1-0/+56
* sm/certreqgen.c (pAUTHKEYID): New. (read_parameters): Add keyword Authority-Key-Id. (proc_parameters): Check its value. (create_request): Insert an Authority-Key-Id.
2011-12-06gpgsm: Allow arbitrary extensions for cert creation.Werner Koch1-2/+182
* sm/certreqgen.c (pSUBJKEYID, pEXTENSION): New. (read_parameters): Add new keywords. (proc_parameters): Check values of new keywords. (create_request): Add SubjectKeyId and extensions. (parse_parameter_usage): Support "cert" and the encrypt alias "encr".
2011-12-06gpgsm: Fix storing of the serial numberWerner Koch1-1/+1
* sm/certreqgen.c (create_request): Fix hex-bin conversion.
2011-09-20Replace gcry_md_start_debug by gcry_md_debug.Werner Koch1-1/+1
This is to allow building with Libgcrypt master (1.6) which has some cleanups in the API/ABI.
2011-06-01Fix size_t vs int issues.Marcus Brinkmann1-1/+1
2011-03-01Move parameter file description to the manual.Werner Koch1-121/+14
2011-03-01Support X.509 certificate creation.Werner Koch1-68/+425
Using "gpgsm --genkey" allows the creation of a self-signed certificate via a new prompt. Using "gpgsm --genkey --batch" should allow the creation of arbitrary certificates controlled by a parameter file. An example parameter file is Key-Type: RSA Key-Length: 1024 Key-Grip: 2C50DC6101C10C9C643E315FE3EADCCBC24F4BEA Key-Usage: sign, encrypt Serial: random Name-DN: CN=some test key Name-Email: [email protected] Name-Email: [email protected] Hash-Algo: SHA384 not-after: 2038-01-16 12:44 This creates a self-signed X.509 certificate using the key given by the keygrip and using SHA-384 as hash algorithm. The keyword signing-key can be used to sign the certificate with a different key. See sm/certreggen.c for details.
2011-02-04Nuked almost all trailing white space.post-nuke-of-trailing-wsWerner Koch1-29/+28
We better do this once and for all instead of cluttering all future commits with diffs of trailing white spaces. In the majority of cases blank or single lines are affected and thus this change won't disturb a git blame too much. For future commits the pre-commit scripts checks that this won't happen again.
2010-11-26Remove superfluous parameter.Werner Koch1-1/+1
Make self-check interval larger
2010-04-232010-04-23 Marcus Brinkmann <[email protected]>Marcus Brinkmann1-2/+2
* certreqgen.c (read_parameters): Use ascii_isspace instead of spacep to stop at newline, too.
2010-03-08Removed almost al dup calls.Werner Koch1-3/+4
2009-11-23Add gpgconf related dummy options default_pubkey_algo.Werner Koch1-1/+2
Add option --skip-hidden-recipients Comment updates.
2009-11-10Change fallback keysize to 2048Werner Koch1-3/+3
2009-06-24Fixed a bunch of little bugs as reported by Fabian Keil.Werner Koch1-1/+1
Still one problem left; marked with a gcc #warning.
2008-12-05Add a custom prompt for the CSR generation.Werner Koch1-6/+20
Add a new percent escape fucntion.
2007-08-22Fixed creation of private keys under W32.Werner Koch1-3/+2
Minor code cleanups.
2007-08-22Updated estream.Werner Koch1-21/+7
More changes for Windows.
2007-07-04Changed to GPLv3.Werner Koch1-4/+2
Removed intl/.
2007-06-25Fixed a problem in estream-printf.c.Werner Koch1-4/+4
Changes for Windows (gpgsm -k does now work). Minor cleanups.
2007-06-21Implemented the --gen-key command as we can't use the gpgsm-gencert.sh under ↵Werner Koch1-5/+9
Windows.
2007-03-19Allow export to work on systems without funopen/fopencookie.Werner Koch1-1/+1
2006-11-21No more warnings for AMD64 (at least when cross-compiling). Thus tehre is aWerner Koch1-1/+1
good chance that gpg2 will now work. Other cleanups. Updated gettext.
2006-10-11Allow pkcs#10 creation directkly from a smart cardWerner Koch1-17/+57
2006-09-06The big Assuan error code removal.Werner Koch1-3/+3
2006-09-06Minor changes and typo fixes.Werner Koch1-1/+1
2006-08-16With --enable-gpg the keyservers are now build and a first test using gpg2Werner Koch1-4/+2
shows no prblems. Needs more testing of course.
2006-07-03better reporting of bad DNsWerner Koch1-7/+23
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-15 04:11:39 +0000