From 825dd7220ff6079cbe2d0df7fde93526c077fb6d Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Wed, 10 Feb 2021 14:31:34 +0100 Subject: gpg: Do not allow old cipher algorithms for encryption. * g10/gpg.c: New option --allow-old-cipher-algos. (set_compliance_option): Set --rfc4880bis explictly to SHA256 and AES256. Allow old cipher algos for OpenPGP, rfc4880, and rfc2440. * g10/options.h (opt): Add flags.allow_old_cipher_algos. * g10/misc.c (print_sha1_keysig_rejected_note): Always print the note unless in --quiet mode. * g10/encrypt.c (setup_symkey): Disallow by default algos with a blocklengt < 128. (encrypt_crypt): Ditto. Fallback by default to AES instead of 3DES. * g10/pkclist.c (algo_available): Take care of old cipher also. (select_algo_from_prefs): Use AES as implicit algorithm by default. * tests/openpgp/defs.scm (create-gpghome): Set allow-old-cipher-algos. -- GnuPG-bug-id: 3415 --- g10/misc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'g10/misc.c') diff --git a/g10/misc.c b/g10/misc.c index cd5c1bd7a..2a431b137 100644 --- a/g10/misc.c +++ b/g10/misc.c @@ -396,8 +396,9 @@ print_sha1_keysig_rejected_note (void) log_info (_("Note: third-party key signatures using" " the %s algorithm are rejected\n"), gcry_md_algo_name (GCRY_MD_SHA1)); - print_further_info ("use option \"%s\" to override", - "--allow-weak-key-signatures"); + if (!opt.quiet) + log_info (_("(use option \"%s\" to override)\n"), + "--allow-weak-key-signatures"); } -- cgit v1.2.3