From db1f74ba5338f624f146a3cb41a346e46b15c8f9 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Fri, 4 Oct 2013 13:44:39 +0200 Subject: gpg: Protect against rogue keyservers sending secret keys. * g10/options.h (IMPORT_NO_SECKEY): New. * g10/keyserver.c (keyserver_spawn, keyserver_import_cert): Set new flag. * g10/import.c (import_secret_one): Deny import if flag is set. -- By modifying a keyserver or a DNS record to send a secret key, an attacker could trick a user into signing using a different key and user id. The trust model should protect against such rogue keys but we better make sure that secret keys are never received from remote sources. Suggested-by: Stefan Tomanek Signed-off-by: Werner Koch (cherry picked from commit e7abed3448c1c1a4e756c12f95b665b517d22ebe) Resolved conflicts: g10/import.c g10/keyserver.c --- g10/import.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'g10/import.c') diff --git a/g10/import.c b/g10/import.c index 74443ef10..c3ad53632 100644 --- a/g10/import.c +++ b/g10/import.c @@ -1563,6 +1563,12 @@ import_secret_one (ctrl_t ctrl, const char *fname, KBNODE keyblock, } stats->secret_read++; + if ((options & IMPORT_NO_SECKEY)) + { + log_error (_("importing secret keys not allowed\n")); + return 0; + } + if (!uidnode) { log_error( _("key %s: no user ID\n"), keystr_from_pk (pk)); -- cgit