From 825dd7220ff6079cbe2d0df7fde93526c077fb6d Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Wed, 10 Feb 2021 14:31:34 +0100 Subject: gpg: Do not allow old cipher algorithms for encryption. * g10/gpg.c: New option --allow-old-cipher-algos. (set_compliance_option): Set --rfc4880bis explictly to SHA256 and AES256. Allow old cipher algos for OpenPGP, rfc4880, and rfc2440. * g10/options.h (opt): Add flags.allow_old_cipher_algos. * g10/misc.c (print_sha1_keysig_rejected_note): Always print the note unless in --quiet mode. * g10/encrypt.c (setup_symkey): Disallow by default algos with a blocklengt < 128. (encrypt_crypt): Ditto. Fallback by default to AES instead of 3DES. * g10/pkclist.c (algo_available): Take care of old cipher also. (select_algo_from_prefs): Use AES as implicit algorithm by default. * tests/openpgp/defs.scm (create-gpghome): Set allow-old-cipher-algos. -- GnuPG-bug-id: 3415 --- g10/options.h | 1 + 1 file changed, 1 insertion(+) (limited to 'g10/options.h') diff --git a/g10/options.h b/g10/options.h index 5b0b12fd3..61118314e 100644 --- a/g10/options.h +++ b/g10/options.h @@ -237,6 +237,7 @@ struct unsigned int use_embedded_filename:1; unsigned int utf8_filename:1; unsigned int dsa2:1; + unsigned int allow_old_cipher_algos:1; unsigned int allow_weak_digest_algos:1; unsigned int allow_weak_key_signatures:1; unsigned int large_rsa:1; -- cgit v1.2.3