From 915297705af6f1db74dacf0d6665b83eb0a58459 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Thu, 28 Nov 2019 09:39:35 +0100 Subject: kbx: Redefine the UBID which is now the primary fingerprint. * common/util.h (UBID_LEN): New. Use it at all places. * kbx/keybox-blob.c (create_blob_finish): Do not write the UBID item. * kbx/keybox-dump.c (print_ubib): Remove. (_keybox_dump_blob): Do not print the now removed ubid flag. * kbx/keybox-search-desc.h (struct keydb_search_desc): Use constants for the size of the ubid and grip. * kbx/keybox-search.c (blob_cmp_ubid): New. (has_ubid): Make it a simple wrapper around blob_cmp_ubid. (keybox_get_data): Add arg 'r_ubid'. * kbx/frontend.h (enum kbxd_store_modes): New. * kbx/kbxserver.c (cmd_store): Add new option --insert. * kbx/backend-cache.c (be_cache_initialize): New. (be_cache_add_resource): Call it here. * kbx/backend-kbx.c (be_kbx_seek): Remove args 'fpr' and 'fprlen'. (be_kbx_search): Get the UBID from keybox_get_data. * kbx/backend-support.c (be_fingerprint_from_blob): Replace by ... (be_ubid_from_blob): new. Change all callers. * kbx/frontend.c (kbxd_add_resource): Temporary disable the cache but use the new cache init function. (kbxd_store): Replace arg 'only_update' by 'mode'. Seek using the ubid. Take care of the mode. -- It turned out that using the hash of the entire blob was not helpful. Thus we redefine the Unique-Blob-ID (UBID) as the primary fingerprint of the blob. In case this is a v5 OpenPGP key a left truncated version of the SHA-256 hash is used; in all other cases the full SHA-1 hash. Using a SHA-256 hash does not make sense because v4 keys are and will for some time be the majority of keys and thus padding them with zeroes won't make any difference. Even if fingerprint collisions can eventually be created we will assume that the keys are bogus and that it does not make sense to store its twin also in our key storage. We can also easily extend the update code to detect a collision and reject the update. Signed-off-by: Werner Koch --- common/util.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'common/util.h') diff --git a/common/util.h b/common/util.h index 6c878083a..fc869800a 100644 --- a/common/util.h +++ b/common/util.h @@ -55,6 +55,10 @@ * parameters as generated by gcry_pk_get_keygrip. */ #define KEYGRIP_LEN 20 +/* The length of the unique blob identifier as used by the keyboxd. + * This is the possible truncated fingerprint of the primary key. */ +#define UBID_LEN 20 + /* Get all the stuff from jnlib. */ #include "../common/logging.h" -- cgit v1.2.3