aboutsummaryrefslogtreecommitdiffstats
path: root/sm (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* sm: Create ECC certificates with AKI and SKI by default.Werner Koch2020-05-191-31/+127
| | | | | | | | * sm/certreqgen.c (create_request): Create AKI and SKI by default. -- GnuPG-bug-id: 4098 Signed-off-by: Werner Koch <[email protected]>
* sm: Support creation of EdDSA certificates.Werner Koch2020-05-184-63/+183
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * sm/misc.c (transform_sigval): Support EdDSA. * sm/certreqgen.c (create_request): Support EdDSA cert creation. * sm/certcheck.c (gpgsm_check_cert_sig): Map some ECC algo OIDs to hash algos. * sm/call-agent.c (struct sethash_inq_parm_s): New. (sethash_inq_cb): New. (gpgsm_agent_pksign): Add mode to pass plain data for EdDSA. -- Tested using a parameter file Key-Type: EdDSA Key-Length: 1024 Key-Grip: 09D9AE3D494F7888C93BE5106AD8A734A87617F0 Key-Usage: sign Serial: random Name-DN: CN=dummy test ed25519 where the keygrip is from a gpg generated Ed25519 key. ECDSA was tested using Key-Type: ECDSA Key-Length: 1024 Key-Grip: 8E06A180EFFE4C65B812150CAF19BF30C0689A4C Key-Usage: sign Serial: random Name-DN: CN=dummy test nistp256 and RSA using Key-Type: RSA Key-Length: 2048 Key-Grip: C6A6390E9388CDBAD71EAEA698233FE5E04F001E Key-Usage: sign Serial: random Name-DN: CN=dummy test rsa The command used in all cases is gpgsm -v --gen-key --batch a.parm >a.crt gpgsm -v --import <a.crt More support, in particular in the user interface, is required and will follow soon. GnuPG-bug-id: 4888 Signed-off-by: Werner Koch <[email protected]>
* sm: Support import and verification of EdDSA certificates.Werner Koch2020-05-133-17/+143
| | | | | | | | | | | | | | * sm/certdump.c (gpgsm_get_serial): New. * sm/certcheck.c (gpgsm_check_cert_sig): Support EdDSA signatures. -- Note that this does not work with the self-signed RFC-8410 sample certificate; see the code for comments. The Ed488 case has not been tested due to a lack of support in Libgcrypt. Signed-off-by: Werner Koch <[email protected]>
* sm: Support signing using ECDSA.Werner Koch2020-05-112-32/+54
| | | | | | | | | | * sm/gpgsm.h (struct certlist_s): Add helper field pk_algo. * sm/sign.c (gpgsm_sign): Store the public key algo. Take the hash algo from the curve. Improve diagnostic output in verbose mode. -- GnuPG-bug-id: 4098 Signed-off-by: Werner Koch <[email protected]>
* sm: Allow decryption using dhSinglePass-stdDH-sha1kdf-scheme.Werner Koch2020-05-084-67/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * sm/decrypt.c (ecdh_decrypt): Support dhSinglePass-stdDH-sha1kdf-scheme. Factor key derive code out to ... (ecdh_derive_kek): new global function. Allow for hashs shorter than the key. (hash_ecc_cms_shared_info): Make file-only. * sm/encrypt.c (ecdh_encrypt): Replace derive code by a call to the new ecdh_derive_kek. Add test code to create data using dhSinglePass-stdDH-sha1kdf-scheme. * sm/gpgsm.h (opt): Add member force_ecdh_sha1kdf. * sm/gpgsm.c: Add option --debug-force-ecdh-sha1kdf. -- I did some test against Governikus_Signer: 2.9.2.0 MCard security Provider: 2.4.0 Algorithm catalog from: 05.12.2019 using a Signature Card v2.0 and a nistp256 certificate. Encrypting with Governikus used the stdDH-sha1kdf scheme which we can now decrypt. Encrypting with GPGSM uses for that curve the recommended scheme sha256kdf but Governikus was not able to decrypt this (no usable error message). Encrypting using stdDH-sha1kdf with GPGSM by using the new --debug-force-ecdh-sha1kdf option showed that Governikus was able to decrypt this. FWIW: RFC5753 (Use of Elliptic Curve Cryptography (ECC) Algorithms) has this requirement: Implementations that support EnvelopedData with the ephemeral-static ECDH standard primitive: - MUST support the dhSinglePass-stdDH-sha256kdf-scheme key agreement algorithm, the id-aes128-wrap key wrap algorithm, and the id-aes128-cbc content encryption algorithm; and which Governikus seems not to fulfill. GnuPG-bug-id: 4098 Signed-off-by: Werner Koch <[email protected]>
* sm: Print algorithm infos in data decryption mode.Werner Koch2020-05-081-0/+13
| | | | | | | | * common/sexputil.c (cipher_mode_to_string): New. * sm/decrypt.c (prepare_decryption): Show cipher algo and mode. (gpgsm_decrypt): Show key algo and fingerprint Signed-off-by: Werner Koch <[email protected]>
* sm: Cleanup the use of GCRY_PK_ECC and GCRY_PK_ECDSA.Werner Koch2020-05-084-8/+13
| | | | | | | | | | | * common/sexputil.c (pubkey_algo_to_string): New. * sm/certcheck.c (do_encode_md): Replace GCRY_PK_ECDSA by GCRY_PK_ECC. * sm/certreqgen-ui.c (check_keygrip): Add all ECC algorithms. * sm/gpgsm.c (our_pk_test_algo): Also allow EdDSA. * sm/verify.c (gpgsm_verify): Map ECC algo to ECDSA. Use new pubkey algo name function Signed-off-by: Werner Koch <[email protected]>
* sm: Improve readability of the data verification output.Werner Koch2020-05-081-35/+66
| | | | | | | | | | * sm/verify.c (gpgsm_verify): Print the used algorithms. -- Note that we now use the full fingerprint instead of the certificate id. This better aligns with what we do in gpg. Signed-off-by: Werner Koch <[email protected]>
* sm: Fix annoying warning about not yet implemented --attribute.Werner Koch2020-05-071-1/+2
| | | | | | -- Signed-off-by: Werner Koch <[email protected]>
* sm: Print the key types as standard key algorithm strings.Werner Koch2020-05-073-14/+84
| | | | | | | | | | | | | | | | * sm/fingerprint.c (gpgsm_get_key_algo_info): Factor code out to ... (gpgsm_get_key_algo_info2): new. (gpgsm_pubkey_algo_string): New. * sm/keylist.c (list_cert_colon): Put curve into field 17 (list_cert_raw): Print the unified key algotithm string instead of the algo and size. (list_cert_std): Ditto. -- It is important to known whether a 256 bit ECC uses a NIST or a Brainpool curve. Signed-off-by: Werner Koch <[email protected]>
* sm: Support decryption of ECDH data using a smartcard.Werner Koch2020-05-071-8/+11
| | | | | | | | | | * sm/decrypt.c (ecdh_decrypt): Add arg nbits and detect bare secret. (prepare_decryption): Add arg nbits and pass on. (gpgsm_decrypt): Pass size of curve to prepare_decryption. -- GnuPG-bug-id: 4098 Signed-off-by: Werner Koch <[email protected]>
* sm: Support encryption using ECDH keys.Werner Koch2020-05-043-13/+313
| | | | | | | | | | | | | | * sm/decrypt.c (hash_ecc_cms_shared_info): Make global. * sm/encrypt.c (ecdh_encrypt): New. (encrypt_dek): Add arg PK_ALGO and support ECDH. (gpgsm_encrypt): Pass PK_ALGO. -- Note: This has only been tested with a messages created and decrypted by GnuPG. GnuPG-bug-id: 4098 Signed-off-by: Werner Koch <[email protected]>
* doc: Typo fixes in code commentsWerner Koch2020-05-041-1/+1
| | | | | | -- Signed-off-by: Werner Koch <[email protected]>
* sm: Add support to export ECC private keys.Werner Koch2020-04-274-211/+559
| | | | | | | | | | | | | | | | | | | * sm/minip12.c [TEST]: Remove test code. Include util.h, tlv.h. and openpgpdefs.h. Remove the class and tag constants and replace them by those from tlv.h. (builder_add_oid, builder_add_mpi): New. (build_key_sequence): Rename to ... (build_rsa_key_sequence): this. (build_ecc_key_sequence): New. (p12_build): Call RSA or ECC builder. (p12_raw_build): Ditto. * sm/export.c (gpgsm_p12_export): Use correct armor header for ECC. (sexp_to_kparms): Support ECC. * sm/t-minip12.c: New to replace the former TEST code in minip12.h. -- GnuPG-bug-id: 4921
* sm: Minor debug output format changes.Werner Koch2020-04-233-3/+3
| | | | --
* sm: Support decryption of ECDH data.Werner Koch2020-04-231-37/+365
| | | | | | | | | | | | | | | | | * sm/decrypt.c: Include tlv.h. (string_from_gcry_buffer): New. (hash_ecc_cms_shared_info): New. (ecdh_decrypt): New. (prepare_decryption): Support ECDH. Add arg pk_algo. (gpgsm_decrypt): Lift some variables from an inner code block. -- Note: This has only been tested with a single messages created by OpenSSL and taken from the Mozilla bug tracker. In particular the code to included UserKeyingMaterial (ukm) has not been tested. GnuPG-bug-id: 4098 Signed-off-by: Werner Koch <[email protected]>
* sm: Support import of PKCS#12 encoded ECC private keys.Werner Koch2020-04-213-62/+198
| | | | | | | | | | | | | * sm/minip12.c: Include ksba.h. (oid_pcPublicKey): New const. (parse_bag_data): Add arg 'r-curve'. Support parsing of ECC private keys. (p12_parse): Add arg 'r_curve'. * sm/import.c (parse_p12): Support ECC import. -- GnuPG-bug-id: 4921 Signed-off-by: Werner Koch <[email protected]>
* sm: Replace some debug message by log_error or log_infoWerner Koch2020-04-212-8/+10
| | | | | | -- Signed-off-by: Werner Koch <[email protected]>
* sm: Always allow authorityInfoAccess lookup if CRLs are also enabled.Werner Koch2020-04-161-6/+11
| | | | | | | | | * sm/certchain.c (find_up): Disable external lookups in offline mode. Always allow AKI lookup if CRLs are also enabled. -- GnuPG-bug-id: 4898 Signed-off-by: Werner Koch <[email protected]>
* sm: Lookup missing issuers first using authorityInfoAccess.Werner Koch2020-04-164-26/+180
| | | | | | | | | | | | | | | | * sm/call-dirmngr.c (gpgsm_dirmngr_lookup): Add optional arg URL and adjust all callers. * sm/certchain.c (oidstr_caIssuers): New. (struct find_up_store_certs_s): Add additional fields. (find_up_store_certs_cb): Store the fingerprint. (find_up_via_auth_info_access): New. (find_up): Try the AIA URI first. -- Note that --auto-issuer-key-retrieve is required to use that. GnuPG-bug-id: 4898 Signed-off-by: Werner Koch <[email protected]>
* sm,dirmngr: Restrict allowed parameters used with rsaPSS.Werner Koch2020-04-151-1/+39
| | | | | | | | | | | | | | | * sm/certcheck.c (extract_pss_params): Check the used PSS params. * dirmngr/crlcache.c (finish_sig_check): Ditto. * dirmngr/validate.c (check_cert_sig): Ditto. -- GnuPG-bug-id: 4538 # ------------------------ >8 ------------------------ See https://www.metzdowd.com/pipermail/cryptography/2019-November/035449.html Signed-off-by: Werner Koch <[email protected]>
* sm: Support rsaPSS verification also for CMS signatures.Werner Koch2020-04-142-40/+112
| | | | | | | | | * sm/certcheck.c (gpgsm_check_cert_sig): Factor PSS parsing out to ... (extract_pss_params): new. (gpgsm_check_cms_signature): Implement PSS. -- GnuPG-bug-id: 4538
* dirmngr: Support rsaPSS also in the general validate module.Werner Koch2020-04-091-1/+5
| | | | | | | | | | | | | | | | | | * dirmngr/validate.c (hash_algo_from_buffer): New. (uint_from_buffer): New. (check_cert_sig): Support rsaPSS. * sm/certcheck.c (gpgsm_check_cert_sig): Fix small memory leak on error. -- Yes, I know that there is a lot of code duplication. In fact some of the code is ugly and it would be better if we enhance Libgcrypt to guarantee that returned memory buffers via gcry_sexp_extract_param are allways Nul terminated and we should also enhance that function to directly extract into an unsigned int or char *. GnuPG-bug-id: 4538 Signed-off-by: Werner Koch <[email protected]>
* sm,dirmngr: Support rsaPSS signature verification.Werner Koch2020-04-091-45/+145
| | | | | | | | | | | | | | | | * sm/certcheck.c (hash_algo_from_buffer): New. (uint_from_buffer): New. (gpgsm_check_cert_sig): Handle PSS. * dirmngr/crlcache.c (hash_algo_from_buffer): New. (uint_from_buffer): New. (start_sig_check): Detect PSS and extract hash algo. New arg to return a PSS flag. (finish_sig_check): New arg use_pss. Extract PSS args and use them. (crl_parse_insert): Pass use_pss flag along. -- GnuPG-bug-id: 4538 Signed-off-by: Werner Koch <[email protected]>
* sm: Fix a warning in an es_fopencooie function.Werner Koch2020-04-011-0/+4
| | | | | | | | | | | | | | * sm/certdump.c (format_name_writer): Take care of a flush request. -- We won't see a flush here so that fix does not solve a real bug but we want to be correct. Note that this function seems to predate the es_fopenmem function and thus in master (2.3) we should replace it entirely. GnuPG-bug-id: 4495 Signed-off-by: Werner Koch <[email protected]> (cherry picked from 2.2 commit 8d0d61aca3d2713df8a33444af3658b859d72be8)
* sm: Fix possible NULL deref in error messages of --gen-key.Werner Koch2020-03-301-20/+20
| | | | | | | | * sm/certreqgen.c: Protect printing the liniernur in case of !R. -- GnuPG-bug-id: 4895 Signed-off-by: Werner Koch <[email protected]>
* sm: Consider certificates w/o CRL DP as valid.Werner Koch2020-03-273-0/+25
| | | | | | | | | | | | | | | | | | | * sm/certchain.c (is_cert_still_valid): Shortcut if tehre is no DP. * common/audit.c (proc_type_verify): Print "n/a" if a cert has no distribution point. * sm/gpgsm.h (opt): Add field enable_issuer_based_crl_check. * sm/gpgsm.c (oEnableIssuerBasedCRLCheck): New. (opts): Add option --enable-issuer-based-crl-check. (main): Set option. -- If the issuer does not provide a DP and the user wants such an issuer, we expect that a certificate does not need revocation checks. The new option --enable-issuer-based-crl-check can be used to revert to the old behaviour which requires that a suitable LDAP server has been configured to lookup a CRL by issuer. Signed-off-by: Werner Koch <[email protected]>
* gpgsm: Fix the previous commit.NIIBE Yutaka2020-03-271-5/+5
| | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* gpgsm: Support key generation with ECC.NIIBE Yutaka2020-03-261-5/+37
| | | | | | | | | * sm/certreqgen.c (pKEYCURVE): New. (read_parameters): Add pKEYCURVE handling. (proc_parameters): Support ECC key generation. GnuPG-bug-id: 4888 Signed-off-by: NIIBE Yutaka <[email protected]>
* gpgsm: Remove restriction of key generation (only RSA).NIIBE Yutaka2020-03-261-8/+9
| | | | | | | | | | | * sm/certreqgen.c (proc_parameters): Remove checking GCRY_PK_RSA. -- This is an initial change to support ECC key generation. GnuPG-bug-id: 4888 Signed-off-by: NIIBE Yutaka <[email protected]>
* gpgconf: Further simplify the gpgconf option processing.Werner Koch2020-03-141-18/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/gc-opt-flags.h (GC_OPT_FLAG_RUNTIME): Move to ... * tools/gpgconf-comp.c: here. (known_options_scdaemon): Remove "options". (known_options_dirmngr): Remove "options". (known_options_gpgsm): Remove "options". (known_options_gpg): Remove "options" and "keyserver". (struct gc_option_s): Rename active t gpgconf_list. (gc_component_list_options): Do not act upon active. (option_check_validity): Ditto. (is_known_option): Make it work correctly for unknown options. (retrieve_options_from_program): Use renamed flag gpgconf_list only to detect duplicated items from --gpgconf-list. Do not set runtime. Only e set the options if set by --gpgconf-list; never clear them. * agent/gpg-agent.c: Simplify the --gpgconf-list output. * dirmngr/dirmngr.c: Ditto. * g10/gpg.c: Ditto. * kbx/keyboxd.c: Ditto. * scd/scdaemon.c: Ditto. * sm/gpgsm.c: Ditto. * tests/openpgp/gpgconf.scm: Use "compliance" instead of "keyserver" for the string arg test. -- There is no need to read the list of options from the components unless they convey a default value. It is better to consult only the list we have in gpgconf-comp.c to decide on whether an option should be displayed. Right, this might mess up thing if a newer gpgconf version is used with an older component, but we already print warnings in this case and in general we do not want to support this anymore - the times of gpg 1.4. and 2.0 are long over now. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* gpgsm: Re-group the options in the --help output.Werner Koch2020-03-061-112/+127
| | | | | | | | | -- This looks better and is also required for further simplifications of gpgconf. Signed-off-by: Werner Koch <[email protected]>
* gpgconf: Support reading global options (part 2).Werner Koch2020-03-061-5/+9
| | | | | | | | | | | | | | | | | | | * tools/gpgconf-comp.c: Remove all regular option descriptions. They are now read in from the component. Also remove a few meanwhile obsolete options. * agent/gpg-agent.c: Add option description which were only set in gpgconf-comp.c. * dirmngr/dirmngr.c: Ditto. * scd/scdaemon.c: Ditto. * sm/gpgsm.c: Ditto. * g10/gpg.c: Ditto. -- This second part removes all regular option descriptions because they can be read from the components. A few were missing in the components and thus moved to there. Signed-off-by: Werner Koch <[email protected]>
* Use gpgrt's new option parser for gpgc, gpgsm, and gpg-agent.Werner Koch2020-02-201-97/+88
| | | | | | | | | | | | | | * g10/gpgv.c: Use new option parser. * sm/gpgsm.c: Ditto. * agent/gpg-agent.c: Ditto. (opts): Add option --no-options. -- This is the next part of changes. The latest libgpg-error is required so that that re-reading options (SIGHUP) works. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* gpg: Use gpgrt's new option parser to provide a global conf file.Werner Koch2020-02-203-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | * common/util.h: Remove argparse.h. * common/argparse.c: Undef GPGRT_ENABLE_ARGPARSE_MACROS. * configure.ac (GPGRT_ENABLE_ARGPARSE_MACROS): Define. * agent/gpg-agent.c: Undef GPGRT_ENABLE_ARGPARSE_MACROS and include argparse.h. Do this also for all main modules which use our option parser except for gpg. Replace calls to strusage by calls to gpgrt_strusage everywhere. * g10/gpg.c (opts): Change type to gpgrt_opt_t. Flag oOptions and oNoOptions with ARGPARSE_conffile and ARGPARSE_no_conffile. (main): Change type of pargs to gpgrt_argparse_t. Rework the option parser to make use of the new gpgrt_argparser. -- This is not yet finished but a make check works. gpg has the most complex and oldest option handling and thus this is the first migration target. SE-Linux checks and version-ed config files are missing and will be added later. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* Spelling cleanup.Daniel Kahn Gillmor2020-02-184-4/+4
| | | | | | | | | | | | | | | | No functional changes, just fixing minor spelling issues. --- Most of these were identified from the command line by running: codespell \ --ignore-words-list fpr,stati,keyserver,keyservers,asign,cas,iff,ifset \ --skip '*.po,ChangeLog*,help.*.txt,*.jpg,*.eps,*.pdf,*.png,*.gpg,*.asc' \ doc g13 g10 kbx agent artwork scd tests tools am common dirmngr sm \ NEWS README README.maint TODO Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* build: Always use EXTERN_UNLESS_MAIN_MODULE pattern.Werner Koch2020-02-102-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | * common/util.h (EXTERN_UNLESS_MAIN_MODULE): Add the definion only here but now without the Norcroft-C. Change all other places where it gets defined. * common/iobuf.h (iobuf_debug_mode): Declare unconditionally as extern. * common/iobuf.c (iobuf_debug_mode): Define it here. * agent/gpg-agent.c (INCLUDED_BY_MAIN_MODULE): Define here and also in all main modules of all other programs. * g10/main.h: Put util.h before the local header files. -- This change is required for use with gcc/ld's LTO feature which does not allow common blocks. Further gcc 10 will make -fno-common the default and thus this chnage is always needed. What a pitty. Co-authored-by: Tomáš Mráz GnuPG-bug-id: 4831 Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 21d9bd8b87a9f793a106095e3838eb71825189d7) - Applied respective chnages also to gpg-card and keyboxd. Signed-off-by: Werner Koch <[email protected]>
* sm: New option --issuer-der for the listkey commands.Werner Koch2020-02-031-7/+73
| | | | | | | | | | | | | | | | | | | | | * sm/server.c (do_listkeys): Implement new option. -- This option can be used by clients who can only provide a DER encoded form of the issuer. For example in PKCS#11 providers. Testing: Put the DER encoded issuer DN into a file, say issuer.der. The run gpg-connect-agent -E -- gpgsm --server > /definqfile ISSUER_DER issuer.der > list-keys --issuer-der 01020304 and if the local keyring has a certifictate with that issuer and a s/n of 0x01020304 that certificate will be listed. Signed-off-by: Werner Koch <[email protected]>
* gpg,sm: Avoid useless ASFW diagnostic in loopback mode.Werner Koch2020-01-131-0/+8
| | | | | | | | | | | * common/sysutils.c (inhibit_set_foregound_window): New var. (gnupg_inhibit_set_foregound_window): New func. (gnupg_allow_set_foregound_window): Use var. * g10/gpg.c (main): Inhibit in loopback mode. * sm/gpgsm.c (main): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
* sm: Add special case for expired intermediate certificates.Werner Koch2019-12-062-17/+91
| | | | | | | | | | | | | | | | | | | | | | | | | * sm/gpgsm.h (struct server_control_s): Add field 'current_time'. * sm/certchain.c (find_up_search_by_keyid): Detect a corner case. Also simplify by using ref-ed cert objects in place of an anyfound var. -- See the code for a description of the problem. Tested using the certs from the bug report and various command lines gpgsm --faked-system-time=XXXX --disable-crl-checks \ -ea -v --debug x509 -r 0x95599828 with XXXX being 20190230T000000 -> target cert too young with XXXX being 20190330T000000 -> okay with XXXX being 20190830T000000 -> okay, using the long term cert with XXXX being 20220330T000000 -> target cert expired The --disabled-crl-checks option is required because in our a simple test setting dirmngr does not know about the faked time. GnuPG-bug-id: 4696 Signed-off-by: Werner Koch <[email protected]>
* gpgsm: Allow sepcification of ldaps servers.Werner Koch2019-11-093-3/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | * sm/gpgsm.h (struct keyserver_spec): Add field use_ldaps. * sm/gpgsm.c (parse_keyserver_line): Parse flags. * sm/call-dirmngr.c (prepare_dirmngr): Send ldaps flag to the dirmngr. * dirmngr/dirmngr.h (struct ldap_server_s): Add field use_ldaps. * dirmngr/ldapserver.c (ldapserver_parse_one): Parse flags. * dirmngr/ldap.c (start_cert_fetch_ldap): Call wrapper with --tls. * dirmngr/dirmngr_ldap.c: New option --tls. (fetch_ldap): Make use of that option. -- There was no way to specify an LDAPS server in dirmngr_ldapserver.socnf or with gpgsm's --keyserver option. This patch fixes this. Eventually we should allow to replace host and port by a partial URI in the same way ldap_initialize does it. For backward compatibility we do not yet do that. Although the dirmngr code accepts an URL (eg. taken from a certificate), I can't see how the scheme was ever used. Thus the patch also detects an ldaps scheme and uses this. That part has not been tested, though. Signed-off-by: Werner Koch <[email protected]>
* Merge branch 'switch-to-gpgk' into masterWerner Koch2019-09-271-1/+1
|\ | | | | | | | | | | | | | | | | | | | | | | -- Resolved Conflicts: * common/asshelp.c: Keep the new code in master for spawing under Windows. * g10/Makefile.am: Keep all new file. * g10/photoid.c: Pass CTRL to pct_expando. Signed-off-by: Werner Koch <[email protected]>
| * kbx: Allow writing using a estream.Werner Koch2019-08-061-1/+1
| | | | | | | | | | | | | | * kbx/keybox-file.c (_keybox_write_header_blob): New optional arg stream. Change callers. Signed-off-by: Werner Koch <[email protected]>
* | gpg,sm: Implement keybox compression run and release lock in gpgsmWerner Koch2019-08-231-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | * g10/keydb.c (keydb_add_resource): Call keybox_compress. * sm/keydb.c (keydb_add_resource): Release the lock after a compress. -- Note that in gpgsm we already did the compress run but we didn't released the lock on the file. This might have been a reason for some strange hangs. GnuPG-bug-id: 4644 Signed-off-by: Werner Koch <[email protected]>
* | sm: Support AES-256 key.NIIBE Yutaka2019-08-051-3/+3
| | | | | | | | | | | | * sm/decrypt.c (prepare_decryption): Handle a case for AES-256. Signed-off-by: NIIBE Yutaka <[email protected]>
* | sm: Fix error checking of decryption result.NIIBE Yutaka2019-07-261-7/+8
| | | | | | | | | | | | * sm/call-agent.c (gpgsm_agent_pkdecrypt): Fix condition. Signed-off-by: NIIBE Yutaka <[email protected]>
* | gpg,gpgsm: Handle pkdecrypt responses with/without NUL terminators.Daniel Kahn Gillmor2019-07-261-3/+9
|/ | | | | | | | | | * g10/call-agent.c (agent_pkdecrypt): accept but do not require NUL-terminated data from the agent. * sm/call-agent.c (gpgsm_agent_pkdecrypt): accept but do not require NUL-terminated data from the agent. GnuPG-bug-id: 4652 Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* sm: Fix card access.NIIBE Yutaka2019-07-091-5/+5
| | | | | | | | | | | * sm/call-agent.c (gpgsm_scd_pksign): Cast to integer for %b. -- This fix is needed on big endian machine where size_t is bigger than integer. Signed-off-by: NIIBE Yutaka <[email protected]>
* sm: Return the last error for pubkey decryption.NIIBE Yutaka2019-07-051-6/+8
| | | | | | | | | | * sm/decrypt.c: Use TMP_RC for ksba_cms_get_issuer_serial, and return the last error when no key is available. Fix the error report with TMP_RC for second call of ksba_cms_get_issuer_serial. GnuPG-bug-id: 4561 Signed-off-by: NIIBE Yutaka <[email protected]>
* sm: Print a better diagnostic for encryption certificate selection.Werner Koch2019-06-041-10/+5
| | | | | | | | | | | | | | | | | | | | * sm/certlist.c (gpgsm_add_to_certlist): Add diagnostic and fold two similar branches. -- Without this patch gpgsm printed: gpgsm[23045]: DBG: chan_6 <- RECIPIENT [email protected] gpgsm[23045]: certificate is not usable for encryption gpgsm[23045]: certificate is good with this patch a gpgsm[23045]: looking for another certificate is inserted into the log. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-10 16:27:44 +0000