From a149afe338d61d86985c533cde5e7dbcd31e8698 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Mon, 17 Jul 2017 15:52:26 +0200 Subject: gpg,sm: Check compliance of the RNG. * common/compliance.c (gnupg_rng_is_compliant): New. * g10/call-agent.c (start_agent) [W32]: Check rng compliance. * sm/call-agent.c (start_agent) [W32]: Ditto. * g10/encrypt.c (encrypt_simple, encrypt_crypt): Check that the RNG is compliant. * sm/encrypt.c (gpgsm_encrypt): Ditto. * g10/sign.c (do_sign): Ditto. * sm/sign.c (gpgsm_sign): Ditto. -- Under Windows we need to check that the Jitter RNG is active in de-vs mode. Under Linux this is not necessary because /dev/random can be scrutinized and is believed to provide enough entropy. Signed-off-by: Werner Koch --- g10/call-agent.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'g10/call-agent.c') diff --git a/g10/call-agent.c b/g10/call-agent.c index 7b769332e..3ad13e874 100644 --- a/g10/call-agent.c +++ b/g10/call-agent.c @@ -281,6 +281,24 @@ start_agent (ctrl_t ctrl, int flag_for_card) write_status_error ("set_pinentry_mode", rc); } } + + /* In DE_VS mode under Windows we require that the JENT RNG + * is active. */ +#ifdef HAVE_W32_SYSTEM + if (!rc && opt.compliance == CO_DE_VS) + { + if (assuan_transact (agent_ctx, "GETINFO jent_active", + NULL, NULL, NULL, NULL, NULL, NULL)) + { + rc = gpg_error (GPG_ERR_FORBIDDEN); + log_error (_("%s is not compliant with %s mode\n"), + GPG_AGENT_NAME, + gnupg_compliance_option_string (opt.compliance)); + write_status_error ("random-compliance", rc); + } + } +#endif /*HAVE_W32_SYSTEM*/ + } } -- cgit v1.2.3