diff options
| author | Justus Winter <[email protected]> | 2017-06-06 14:01:40 +0000 |
|---|---|---|
| committer | Justus Winter <[email protected]> | 2017-06-08 12:22:54 +0000 |
| commit | a64a55e10420cf11e00062b590dffe5d0c3e8192 (patch) | |
| tree | 28b9c216316dd1a1aa48b397f68f475023dfea03 /common/compliance.h | |
| parent | gpg: Fix computation of compliance with CO_DE_VS. (diff) | |
| download | gnupg-a64a55e10420cf11e00062b590dffe5d0c3e8192.tar.gz gnupg-a64a55e10420cf11e00062b590dffe5d0c3e8192.zip | |
common,gpg,sm: Restrict the use of algorithms according to CO_DE_VS.
* common/compliance.c (gnupg_pk_is_allowed): New function.
(gnupg_cipher_is_allowed): Likewise.
(gnupg_digest_is_allowed): Likewise.
* common/compliance.h (enum pk_use_case): New definition.
(gnupg_pk_is_allowed): New prototype.
(gnupg_cipher_is_allowed): Likewise.
(gnupg_digest_is_allowed): Likewise.
* g10/decrypt-data.c (decrypt_data): Restrict use of algorithms using
the new predicates.
* g10/encrypt.c (encrypt_crypt): Likewise.
* g10/gpg.c (main): Likewise.
* g10/pubkey-enc.c (get_session_key): Likewise.
* g10/sig-check.c (check_signature2): Likewise.
* g10/sign.c (do_sign): Likewise.
* sm/decrypt.c (gpgsm_decrypt): Likewise.
* sm/encrypt.c (gpgsm_encrypt): Likewise.
* sm/gpgsm.c (main): Likewise.
* sm/sign.c (gpgsm_sign): Likewise.
* sm/verify.c (gpgsm_verify): Likewise.
--
With this change, policies can effectively restrict what algorithms
are used for different purposes. The algorithm policy for CO_DE_VS is
implemented.
GnuPG-bug-id: 3191
Signed-off-by: Justus Winter <[email protected]>
Diffstat (limited to 'common/compliance.h')
| -rw-r--r-- | common/compliance.h | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/common/compliance.h b/common/compliance.h index e57495da2..b2c969544 100644 --- a/common/compliance.h +++ b/common/compliance.h @@ -41,14 +41,28 @@ enum gnupg_compliance_mode CO_PGP6, CO_PGP7, CO_PGP8, CO_DE_VS }; +enum pk_use_case + { + PK_USE_ENCRYPTION, PK_USE_DECRYPTION, + PK_USE_SIGNING, PK_USE_VERIFICATION, + }; + int gnupg_pk_is_compliant (enum gnupg_compliance_mode compliance, int algo, gcry_mpi_t key[], unsigned int keylength, const char *curvename); +int gnupg_pk_is_allowed (enum gnupg_compliance_mode compliance, + enum pk_use_case use, int algo, gcry_mpi_t key[], + unsigned int keylength, const char *curvename); int gnupg_cipher_is_compliant (enum gnupg_compliance_mode compliance, cipher_algo_t cipher, enum gcry_cipher_modes mode); +int gnupg_cipher_is_allowed (enum gnupg_compliance_mode compliance, int producer, + cipher_algo_t cipher, + enum gcry_cipher_modes mode); int gnupg_digest_is_compliant (enum gnupg_compliance_mode compliance, digest_algo_t digest); +int gnupg_digest_is_allowed (enum gnupg_compliance_mode compliance, int producer, + digest_algo_t digest); const char *gnupg_status_compliance_flag (enum gnupg_compliance_mode compliance); struct gnupg_compliance_option |