* g10.c (main): Add --symmetric --encrypt command. This generates a

message that can be decrypted via a passphrase or public key system.

* main.h, encode.c (encode_seskey): Allow passing in an already-created
session key dek. (encode_simple): Use the actual symmetric cipher when
encrypting a session key for a symmetric message. (encode_crypt): Add a
flag to trigger a hybrid mode that can be decrypted via a passphrase or a
pk.  Change all callers.

* mainproc.c (symkey_decrypt_sesskey): There is no way to tell the
difference here between a bad passphrase and a cipher algorithm that we
don't have, so use a error message that makes that clear. Use the actual
list of ciphers when checking whether a cipher is invalid.  Return error
if the decrypted cipher algorithm is invalid. (proc_symkey_enc): In a
mixed passphrase/pk message, if a valid dek already exists from decrypting
via pk, do not try to process the passphrase. (proc_symkey_enc): Indicate
when we're decrypting a session key as opposed to decrypting data.  If a
passphrase is invalid, discard the dek so we'll keep trying.

5 files changed, 186 insertions, 54 deletions

diff --git a/g10/ChangeLog b/g10/ChangeLog
index 7d23d53e4..3ed0f520e 100644
--- a/g10/ChangeLog
+++ b/g10/ChangeLog
@@ -1,3 +1,29 @@
+2003-10-25  David Shaw  <[email protected]>
+
+	* g10.c (main): Add --symmetric --encrypt command.  This generates
+	a message that can be decrypted via a passphrase or public key
+	system.
+
+	* main.h, encode.c (encode_seskey): Allow passing in an
+	already-created session key dek.
+	(encode_simple): Use the actual symmetric cipher when encrypting a
+	session key for a symmetric message.
+	(encode_crypt): Add a flag to trigger a hybrid mode that can be
+	decrypted via a passphrase or a pk.  Change all callers.
+
+	* mainproc.c (symkey_decrypt_sesskey): There is no way to tell the
+	difference here between a bad passphrase and a cipher algorithm
+	that we don't have, so use a error message that makes that clear.
+	Use the actual list of ciphers when checking whether a cipher is
+	invalid.  Return error if the decrypted cipher algorithm is
+	invalid.
+	(proc_symkey_enc): In a mixed passphrase/pk message, if a valid
+	dek already exists from decrypting via pk, do not try to process
+	the passphrase.
+	(proc_symkey_enc): Indicate when we're decrypting a session key as
+	opposed to decrypting data.  If a passphrase is invalid, discard
+	the dek so we'll keep trying.
+
 2003-10-25  Werner Koch  <[email protected]>
 
 	* ccid-driver.c (ccid_open_reader): Return an error if no USB
diff --git a/g10/encode.c b/g10/encode.c
index 4486cba4e..05fdb6ac3 100644
--- a/g10/encode.c
+++ b/g10/encode.c
@@ -42,8 +42,6 @@
 static int encode_simple( const char *filename, int mode, int use_seskey );
 static int write_pubkey_enc_from_list( PK_LIST pk_list, DEK *dek, IOBUF out );
 
-
-
 /****************
  * Encode FILENAME with only the symmetric cipher.  Take input from
  * stdin if FILENAME is NULL.
@@ -65,32 +63,32 @@ encode_store( const char *filename )
 }
 
 static void
-encode_sesskey( DEK *dek, DEK **ret_dek, byte *enckey )
+encode_seskey( DEK *dek, DEK **seskey, byte *enckey )
 {
     CIPHER_HANDLE hd;
-    DEK *c;
     byte buf[33];
 
     assert ( dek->keylen <= 32 );
-    
-    c = m_alloc_clear( sizeof *c );
-    c->keylen = dek->keylen;
-    c->algo = dek->algo;
-    make_session_key( c );
-    /*log_hexdump( "thekey", c->key, c->keylen );*/
-
-    buf[0] = c->algo;
-    memcpy( buf + 1, c->key, c->keylen );
+    if(!*seskey)
+      {
+	*seskey=m_alloc_clear(sizeof(DEK));
+	(*seskey)->keylen=dek->keylen;
+	(*seskey)->algo=dek->algo;
+	make_session_key(*seskey);
+	/*log_hexdump( "thekey", c->key, c->keylen );*/
+      }
+
+    buf[0] = (*seskey)->algo;
+    memcpy( buf + 1, (*seskey)->key, (*seskey)->keylen );
     
     hd = cipher_open( dek->algo, CIPHER_MODE_CFB, 1 );
     cipher_setkey( hd, dek->key, dek->keylen );
     cipher_setiv( hd, NULL, 0 );
-    cipher_encrypt( hd, buf, buf, c->keylen + 1 );
+    cipher_encrypt( hd, buf, buf, (*seskey)->keylen + 1 );
     cipher_close( hd );
 
-    memcpy( enckey, buf, c->keylen + 1 );
+    memcpy( enckey, buf, (*seskey)->keylen + 1 );
     wipememory( buf, sizeof buf ); /* burn key */
-    *ret_dek = c;
 }
 
 /* We try very hard to use a MDC */
@@ -152,7 +150,6 @@ encode_simple( const char *filename, int mode, int use_seskey )
 {
     IOBUF inp, out;
     PACKET pkt;
-    DEK *dek = NULL;
     PKT_plaintext *pt = NULL;
     STRING2KEY *s2k = NULL;
     byte enckey[33];
@@ -212,11 +209,13 @@ encode_simple( const char *filename, int mode, int use_seskey )
                         "due to the S2K mode\n"));
         }
 
-        if ( use_seskey ) {            
-            seskeylen = cipher_get_keylen( opt.s2k_cipher_algo ) / 8;
-            encode_sesskey( cfx.dek, &dek, enckey );
+        if ( use_seskey )
+	  {
+	    DEK *dek = NULL;
+            seskeylen = cipher_get_keylen( default_cipher_algo() ) / 8;
+            encode_seskey( cfx.dek, &dek, enckey );
             m_free( cfx.dek ); cfx.dek = dek;
-        }
+	  }
 
 	cfx.dek->use_mdc=use_mdc(NULL,cfx.dek->algo);
     }
@@ -378,11 +377,13 @@ encode_simple( const char *filename, int mode, int use_seskey )
  * is supplied).
  */
 int
-encode_crypt( const char *filename, STRLIST remusr )
+encode_crypt( const char *filename, STRLIST remusr, int use_symkey )
 {
     IOBUF inp = NULL, out = NULL;
     PACKET pkt;
     PKT_plaintext *pt = NULL;
+    DEK *symkey_dek = NULL;
+    STRING2KEY *symkey_s2k = NULL;
     int rc = 0, rc2 = 0;
     u32 filesize;
     cipher_filter_context_t cfx;
@@ -393,7 +394,6 @@ encode_crypt( const char *filename, STRLIST remusr )
     PK_LIST pk_list,work_list;
     int do_compress = opt.compress && !RFC1991;
 
-
     memset( &cfx, 0, sizeof cfx);
     memset( &afx, 0, sizeof afx);
     memset( &zfx, 0, sizeof zfx);
@@ -403,6 +403,22 @@ encode_crypt( const char *filename, STRLIST remusr )
     if( (rc=build_pk_list( remusr, &pk_list, PUBKEY_USAGE_ENC)) )
 	return rc;
 
+    if(use_symkey)
+      {
+	symkey_s2k=m_alloc_clear(sizeof(STRING2KEY));
+	symkey_s2k->mode = opt.s2k_mode;
+	symkey_s2k->hash_algo = opt.s2k_digest_algo;
+
+	symkey_dek=passphrase_to_dek(NULL,0,opt.s2k_cipher_algo,
+				     symkey_s2k,2,NULL,NULL);
+	if(!symkey_dek || !symkey_dek->keylen)
+	  {
+	    m_free(symkey_dek);
+	    m_free(symkey_s2k);
+	    return G10ERR_PASSPHRASE;
+	  }
+      }
+
     if(PGP2) {
       for(work_list=pk_list; work_list; work_list=work_list->next)
 	if(!(is_RSA(work_list->pk->pubkey_algo) &&
@@ -505,6 +521,37 @@ encode_crypt( const char *filename, STRLIST remusr )
     if( rc  )
 	goto leave;
 
+    /* We put the passphrase (if any) after any public keys as this
+       seems to be the most useful on the recipient side - there is no
+       point in prompting a user for a passphrase if they have the
+       secret key needed to decrypt. */
+    if(use_symkey)
+      {
+	int seskeylen=cipher_get_keylen(cfx.dek->algo)/8;
+	PKT_symkey_enc *enc;
+	byte enckey[33];
+
+	enc=m_alloc_clear(sizeof(PKT_symkey_enc)+seskeylen+1);
+	encode_seskey(symkey_dek,&cfx.dek,enckey);
+
+	enc->version = 4;
+	enc->cipher_algo = opt.s2k_cipher_algo;
+	enc->s2k = *symkey_s2k;
+	enc->seskeylen = seskeylen + 1; /* algo id */
+	memcpy( enc->seskey, enckey, seskeylen + 1 );
+
+	pkt.pkttype = PKT_SYMKEY_ENC;
+	pkt.pkt.symkey_enc = enc;
+	if( (rc = build_packet( out, &pkt )) )
+	  {
+	    log_error("build symkey packet failed: %s\n", g10_errstr(rc) );
+	    m_free(enc);
+	    goto leave;
+	  }
+
+	m_free(enc);
+      }
+
     if (!opt.no_literal) {
 	/* setup the inner packet */
 	if( filename || opt.set_filename ) {
@@ -618,6 +665,8 @@ encode_crypt( const char *filename, STRLIST remusr )
 	pt->buf = NULL;
     free_packet(&pkt);
     m_free(cfx.dek);
+    m_free(symkey_dek);
+    m_free(symkey_s2k);
     release_pk_list( pk_list );
     return rc;
 }
@@ -788,7 +837,7 @@ encode_crypt_files(int nfiles, char **files, STRLIST remusr)
             }
           line[strlen(line)-1] = '\0';
           print_file_status(STATUS_FILE_START, line, 2);
-          if ( (rc = encode_crypt(line, remusr)) )
+          if ( (rc = encode_crypt(line, remusr, 0)) )
             log_error("%s: encryption failed: %s\n",
                       print_fname_stdin(line), g10_errstr(rc) );
           write_status( STATUS_FILE_DONE );
@@ -799,7 +848,7 @@ encode_crypt_files(int nfiles, char **files, STRLIST remusr)
       while (nfiles--)
         {
           print_file_status(STATUS_FILE_START, *files, 2);
-          if ( (rc = encode_crypt(*files, remusr)) )
+          if ( (rc = encode_crypt(*files, remusr, 0)) )
             log_error("%s: encryption failed: %s\n",
                       print_fname_stdin(*files), g10_errstr(rc) );
           write_status( STATUS_FILE_DONE );
diff --git a/g10/g10.c b/g10/g10.c
index 0f6003565..e1b4d42aa 100644
--- a/g10/g10.c
+++ b/g10/g10.c
@@ -80,7 +80,8 @@ enum cmd_and_opt_values
     oShowNotation,
     oNoShowNotation,
     aEncrFiles,
-    aDecryptFiles,                          
+    aEncrSym,
+    aDecryptFiles,
     aClearsign,
     aStore,
     aKeygen,
@@ -866,6 +867,10 @@ set_cmd( enum cmd_and_opt_values *ret_cmd, enum cmd_and_opt_values new_cmd )
 	cmd = aSignSym;
     else if( cmd == aSym && new_cmd == aSign )
 	cmd = aSignSym;
+    else if( cmd == aSym && new_cmd == aEncr )
+	cmd = aEncrSym;
+    else if( cmd == aEncr && new_cmd == aSym )
+	cmd = aEncrSym;
     else if( cmd == aKMode && new_cmd == aSym )
 	cmd = aKModeC;
     else if(	( cmd == aSign	   && new_cmd == aClearsign )
@@ -2255,6 +2260,9 @@ main( int argc, char **argv )
 	  case aSym:
 	    cmdname="--symmetric";
 	    break;
+	  case aEncrSym:
+	    cmdname="--symmetric --encrypt";
+	    break;
 	  case aStore:
 	    cmdname="--store";
 	    break;
@@ -2450,12 +2458,32 @@ main( int argc, char **argv )
 	  {
 	    if( argc > 1 )
 	      wrong_args(_("--encrypt [filename]"));
-	    if( (rc = encode_crypt(fname,remusr)) )
+	    if( (rc = encode_crypt(fname,remusr,0)) )
+	      log_error("%s: encryption failed: %s\n",
+			print_fname_stdin(fname), g10_errstr(rc) );
+	  }
+	break;
+
+      case aEncrSym:
+	/* This works with PGP 8.  It doesn't work with 2 or 6.  It
+	   might work with 7, but alas, I don't have a copy to test
+	   with right now. */
+	if( argc > 1 )
+	  wrong_args(_("--symmetric --encrypt [filename]"));
+	else if(opt.s2k_mode==0)
+	  log_error(_("you cannot use --symmetric --encrypt"
+		      " with --s2k-mode 0\n"));
+	else if(PGP2 || PGP6 || PGP7 || RFC1991)
+	  log_error(_("you cannot use --symmetric --encrypt"
+		      " while in %s mode\n"),compliance_option_string());
+	else
+	  {
+	    if( (rc = encode_crypt(fname,remusr,1)) )
 	      log_error("%s: encryption failed: %s\n",
 			print_fname_stdin(fname), g10_errstr(rc) );
 	  }
 	break;
-          
+
       case aSign: /* sign the given file */
 	sl = NULL;
 	if( detached_sig ) { /* sign all files */
diff --git a/g10/main.h b/g10/main.h
index b64e33577..5ea89b18d 100644
--- a/g10/main.h
+++ b/g10/main.h
@@ -112,7 +112,7 @@ void display_online_help( const char *keyword );
 /*-- encode.c --*/
 int encode_symmetric( const char *filename );
 int encode_store( const char *filename );
-int encode_crypt( const char *filename, STRLIST remusr );
+int encode_crypt( const char *filename, STRLIST remusr, int use_symkey );
 void encode_crypt_files(int nfiles, char **files, STRLIST remusr);
 int encrypt_filter( void *opaque, int control,
 		    IOBUF a, byte *buf, size_t *ret_len);
diff --git a/g10/mainproc.c b/g10/mainproc.c
index e6522f1ed..aefaad6c3 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -1,5 +1,6 @@
 /* mainproc.c - handle packets
- * Copyright (C) 1998,1999,2000,2001,2002,2003 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2002,
+ *               2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -238,8 +239,8 @@ add_signature( CTX c, PACKET *pkt )
     return 1;
 }
 
-static void
-symkey_decrypt_sesskey( DEK *dek, byte *sesskey, size_t slen )
+static int
+symkey_decrypt_seskey( DEK *dek, byte *seskey, size_t slen )
 {
     CIPHER_HANDLE hd;
     int n;
@@ -247,28 +248,35 @@ symkey_decrypt_sesskey( DEK *dek, byte *sesskey, size_t slen )
     if ( slen < 17 || slen > 33 ) {
         log_error ( _("weird size for an encrypted session key (%d)\n"),
 		    (int)slen);
-        return;   
+        return G10ERR_BAD_KEY;
     }
     hd = cipher_open( dek->algo, CIPHER_MODE_CFB, 1 );
     cipher_setkey( hd, dek->key, dek->keylen );
     cipher_setiv( hd, NULL, 0 );
-    cipher_decrypt( hd, sesskey, sesskey, slen );
+    cipher_decrypt( hd, seskey, seskey, slen );
     cipher_close( hd );
     /* check first byte (the cipher algo) */
-    if ( sesskey[0] > 10 ) {
-        log_error ( _("invalid symkey algorithm detected (%d)\n"),
-                    sesskey[0] );
-        return;
-    }
-    n = cipher_get_keylen (sesskey[0]) / 8;
+    if(check_cipher_algo(seskey[0]))
+      {
+	/* There is no way to tell the difference here between a bad
+	   passphrase and a cipher algorithm that we don't have. */
+	log_error(_("bad passphrase or unknown cipher algorithm (%d)\n"),
+		  seskey[0]);
+	if(seskey[0]==CIPHER_ALGO_IDEA)
+	  idea_cipher_warn(0);
+	return G10ERR_PASSPHRASE;
+      }
+    n = cipher_get_keylen (seskey[0]) / 8;
     if (n > DIM(dek->key))
          BUG ();
     /* now we replace the dek components with the real session key
        to decrypt the contents of the sequencing packet. */
-    dek->keylen = cipher_get_keylen( sesskey[0] ) / 8;
-    dek->algo = sesskey[0];
-    memcpy( dek->key, sesskey + 1, dek->keylen );
+    dek->keylen = cipher_get_keylen( seskey[0] ) / 8;
+    dek->algo = seskey[0];
+    memcpy( dek->key, seskey + 1, dek->keylen );
     /*log_hexdump( "thekey", dek->key, dek->keylen );*/
+
+    return 0;
 }   
 
 static void
@@ -279,26 +287,47 @@ proc_symkey_enc( CTX c, PACKET *pkt )
     enc = pkt->pkt.symkey_enc;
     if (!enc)
         log_error ("invalid symkey encrypted packet\n");
-    else {
+    else if(!c->dek)
+      {
         int algo = enc->cipher_algo;
-	const char *s;
+	const char *s = cipher_algo_to_string (algo);
 
-	s = cipher_algo_to_string (algo);
 	if( s )
-	    log_info(_("%s encrypted data\n"), s );
+	  {
+	    if(enc->seskeylen)
+	      log_info(_("%s encrypted session key\n"), s );
+	    else
+	      log_info(_("%s encrypted data\n"), s );
+	  }
 	else
-	    log_info(_("encrypted with unknown algorithm %d\n"), algo );
+	  log_info(_("encrypted with unknown algorithm %d\n"), algo );
 
 	c->last_was_session_key = 2;
 	if ( opt.list_only )
     	    goto leave;
 	c->dek = passphrase_to_dek( NULL, 0, algo, &enc->s2k, 0, NULL, NULL );
-        if (c->dek)
-            c->dek->algo_info_printed = 1;
-        if ( c->dek && enc->seskeylen )
-            symkey_decrypt_sesskey( c->dek, enc->seskey, enc->seskeylen );
-    }
-leave:
+	if(c->dek)
+	  {
+	    /* FIXME: This doesn't work perfectly if a symmetric key
+	       comes before a public key in the message - if the user
+	       doesn't know the passphrase, then there is a chance
+	       that the "decrypted" algorithm will happen to be a
+	       valid one, which will make the returned dek appear
+	       valid, so we won't try any public keys that come
+	       later. */
+	    if(enc->seskeylen)
+	      {
+		if(symkey_decrypt_seskey(c->dek, enc->seskey, enc->seskeylen))
+		  {
+		    m_free(c->dek);
+		    c->dek=NULL;
+		  }
+	      }
+	    else
+	      c->dek->algo_info_printed = 1;
+	  }
+      }
+ leave:
     free_packet(pkt);
 }