gnupg/doc/DETAILS, branch master

gpgsm: Basic support for ML-DSA certificates

2026-10-12T12:20:53Z

* common/sexputil.c (pubkey_algo_string): Support GCRY_PK_MLDSA. * sm/certcheck.c (gpgsm_check_cert_sig): Ditto. * sm/keylist.c (oidtranstbl): Add 2 OIDs for ML-DSA. -- Libgcrypt 1.12.5 is required to work properly. GnuPG-bug-id: 8517

doc: Typo fixes

2026-10-01T10:23:06Z

Merge branch 'wk/rfc9980'

2026-09-11T09:13:02Z

-- After 25 years the NSA could even convince GnuPG that their idea of using complex algorithm is better for someones(tm) security. But fortunately there is no need to enable it. Thus all guards of pretty good and gnu privacy won't enable --compliance=fips|de-vs or use the option --allow-9980.

gpg: Make use of the new curve name "ietf25" in 9980 mode.

2026-08-06T12:59:02Z

* g10/pkglue.c (do_encrypt_kem): Replace Curve25519 by ietf25. Move the wipememory behind the gcry_kdf_close. * g10/import.c (build_mode1003_sexp): Replace Curve25519 by ietf25 for X25519. Add support for PUBKEY_ALGO_MLK1024_448. (internal_skey_object_to_sexp): Replace Curve25519 by ietf25 for X25519. * kbx/keybox-openpgp.c (keygrip_from_keyparm): Ditto. * g10/keyid.c (keygrip_from_pk): Ditto. * g10/keygen.c (gen_ecc): Ditto. (gen_kyber): Ditto. * common/kem.c (ecc_table): Add curve ietf25. * common/openpgp-oid.c (oidtable): Ditto. We use a new OID here despite that RFC-9580 does not use an OID for this algo. Our curve registry however likes to have OIDs.

gpg: First take on adding a compliance mode "fips".

2026-08-05T12:59:01Z

* common/compliance.h (CO_FIPS): New. * common/compliance.c: Add basic support for CO_FIPS. (gnupg_pk_is_allowed): Factor code out to ... (gnupg_pk_is_allowed_de_vs): here and add (gnupg_pk_is_allowed_fips): new function. * common/openpgpdefs.h (AEAD_ALGO_GCM): New. * g10/cipher-aead.c (set_nonce_and_ad): Support GCM. * g10/options.h (GNUPG): Set macro also in FIPS mode. * g10/gpg.c (oFIPS): New. (gpgconf_list): Print a compliance_fips line. (compliance_options): Add "fips". (set_compliance_option): Set --allow-9980 in FIPS mode. * g10/keygen.c (write_keybinding): Provide fips compliance string. * g10/mainproc.c (check_sig_and_print): In require compliance mode also fail in FIPS complaince mode. * g10/misc.c (openpgp_aead_test_algo): Support GCM. (openpgp_aead_algo_name): Ditto. (openpgp_aead_algo_info): Ditto. (compliance_failure): Add fips string. * g10/sign.c (mk_notation_policy_etc): Use value 140 for the "manu" notation in FIPS mode. (write_signature_packets): Ditto. (make_keysig_packet): Ditto. * g10/encrypt.c (use_aead): In FIPS mode use GCM instead of OCB. * g10/pkclist.c (select_algo_from_prefs): For SHA256 in FIPS mode. -- This is by way not ready but gives a starting point. Encryption kind of works but even dycryption has not been tested. *PGP people will anyway never use this mode with its NSA approved algorithm set.

gpgsm: Emit issuer and serial no. when the certificate is not found.

2026-07-30T08:17:21Z

* doc/DETAILS: Update NO_PUBKEY for X.509 certificates. * sm/verify.c (gpgsm_verify): Print the issuer and serial no. of the signer's certificate when the certificate is not found. -- In case we cannot find the certificate of the signer, we should still print issuer and serial no. of the signer's certificate. This info is contained in the signature. GnuPG-bug-id: 8363 Co-authored-by: Werner Koch

gpgsm: Emit signing time as status output for bad signatures.

2026-07-30T07:31:13Z

* common/status.h (enum): Add new STATUS_SIGINFO. * doc/DETAILS: Add description for new STATUS_SIGINFO. * sm/verify.c (gpgsm_verify): Add signature creation time with STATUS_SIGINFO for bad signatures. -- Add the signature creation time with the new STATUS_SIGINFO. For now this status line is only emitted after a BADSIG status line. GnuPG-bug-id: 8364 Co-authored-by: Werner Koch

common: Prepare to get rid of map_w32_to_errno.

2026-06-29T07:13:48Z

* common/sysutils.c (gnupg_w32_set_errno): Use gpgrt function if available.

gpg: New options --show-session-hash and --show-only-session-hash.

2026-04-23T09:12:10Z

* g10/options.h (opt): Add field show_session_hash. * g10/gpg.c (oShowOnlySessionHash,oShowSessionHash): New. (opts): Add options. (main): Set flags. * common/status.h (STATUS_SESSION_HASH): New. * g10/decrypt-data.c (decrypt_data): Emit new status code. Make opt.show_only_session_key work for the new options.

tools: Add option --in-place to gpg-authcode-sign.sh

2026-03-10T14:25:18Z