kbx: Redefine the UBID which is now the primary fingerprint.

* common/util.h (UBID_LEN): New.  Use it at all places.
* kbx/keybox-blob.c (create_blob_finish): Do not write the UBID item.
* kbx/keybox-dump.c (print_ubib): Remove.
(_keybox_dump_blob): Do not print the now removed ubid flag.
* kbx/keybox-search-desc.h (struct keydb_search_desc): Use constants
for the size of the ubid and grip.
* kbx/keybox-search.c (blob_cmp_ubid): New.
(has_ubid): Make it a simple wrapper around blob_cmp_ubid.
(keybox_get_data): Add arg 'r_ubid'.

* kbx/frontend.h (enum kbxd_store_modes): New.
* kbx/kbxserver.c (cmd_store): Add new option --insert.

* kbx/backend-cache.c (be_cache_initialize): New.
(be_cache_add_resource): Call it here.
* kbx/backend-kbx.c (be_kbx_seek): Remove args 'fpr' and 'fprlen'.
(be_kbx_search): Get the UBID from keybox_get_data.
* kbx/backend-support.c (be_fingerprint_from_blob): Replace by ...
(be_ubid_from_blob): new.  Change all callers.

* kbx/frontend.c (kbxd_add_resource): Temporary disable the cache but
use the new cache init function.
(kbxd_store): Replace arg 'only_update' by 'mode'.  Seek using the
ubid.  Take care of the mode.
--

It turned out that using the hash of the entire blob was not helpful.
Thus we redefine the Unique-Blob-ID (UBID) as the primary fingerprint
of the blob.  In case this is a v5 OpenPGP key a left truncated
version of the SHA-256 hash is used; in all other cases the full SHA-1
hash.  Using a SHA-256 hash does not make sense because v4 keys are
and will for some time be the majority of keys and thus padding them
with zeroes won't make any difference.  Even if fingerprint collisions
can eventually be created we will assume that the keys are bogus and
that it does not make sense to store its twin also in our key storage.
We can also easily extend the update code to detect a collision and
reject the update.

Signed-off-by: Werner Koch <[email protected]>

1 files changed, 8 insertions, 9 deletions

diff --git a/kbx/backend.h b/kbx/backend.h
index e97855246..c372d9071 100644
--- a/kbx/backend.h
+++ b/kbx/backend.h
@@ -83,11 +83,11 @@ struct db_request_s
   unsigned int next_dbidx;
 
   /* The last UBID found in the cache and the corresponding keyid and,
-   * if found via fpr, the fingerprint.  For the LAST_CACHE_FPRLEN see
-   * above.  The entry here is only valid if LAST_CACHE_VALID is set;
-   * if LAST_CACHE_FINAL is also set, this indicates that no further
+   * if found via fpr, the fingerprint.  For the LAST_CACHED_FPRLEN see
+   * above.  The entry here is only valid if LAST_CACHED_VALID is set;
+   * if LAST_CACHED_FINAL is also set, this indicates that no further
    * database searches are required.  */
-  unsigned char last_cached_ubid[20];
+  unsigned char last_cached_ubid[UBID_LEN];
   u32 last_cached_kid_h;
   u32 last_cached_kid_l;
   unsigned char last_cached_fpr[32];
@@ -106,12 +106,12 @@ gpg_error_t be_find_request_part (backend_handle_t backend_hd,
 gpg_error_t be_return_pubkey (ctrl_t ctrl, const void *buffer, size_t buflen,
                               enum pubkey_types pubkey_type,
                               const unsigned char *ubid);
-gpg_error_t be_fingerprint_from_blob (const void *blob, size_t bloblen,
-                                      enum pubkey_types *r_pktype,
-                                      char *r_fpr, unsigned int *r_fprlen);
+gpg_error_t be_ubid_from_blob (const void *blob, size_t bloblen,
+                               enum pubkey_types *r_pktype, char *r_ubid);
 
 
 /*-- backend-cache.c --*/
+gpg_error_t be_cache_initialize (void);
 gpg_error_t be_cache_add_resource (ctrl_t ctrl, backend_handle_t *r_hd);
 void be_cache_release_resource (ctrl_t ctrl, backend_handle_t hd);
 gpg_error_t be_cache_search (ctrl_t ctrl, backend_handle_t backend_hd,
@@ -137,8 +137,7 @@ gpg_error_t be_kbx_search (ctrl_t ctrl, backend_handle_t hd,
                            db_request_t request,
                            KEYDB_SEARCH_DESC *desc, unsigned int ndesc);
 gpg_error_t be_kbx_seek (ctrl_t ctrl, backend_handle_t backend_hd,
-                         db_request_t request, const unsigned char *ubid,
-                         const unsigned char *fpr, unsigned int fprlen);
+                         db_request_t request, const unsigned char *ubid);
 gpg_error_t be_kbx_insert (ctrl_t ctrl, backend_handle_t backend_hd,
                            db_request_t request, enum pubkey_types pktype,
                            const void *blob, size_t bloblen);