2004-02-18 16:57:38 +00:00
|
|
|
/* pksign.c - public key signing (well, actually using a secret key)
|
2014-11-04 16:28:03 +01:00
|
|
|
* Copyright (C) 2001-2004, 2010 Free Software Foundation, Inc.
|
|
|
|
* Copyright (C) 2001-2004, 2010, 2013 Werner Koch
|
2003-08-05 17:11:04 +00:00
|
|
|
*
|
|
|
|
* This file is part of GnuPG.
|
|
|
|
*
|
|
|
|
* GnuPG is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License as published by
|
2007-07-04 19:49:40 +00:00
|
|
|
* the Free Software Foundation; either version 3 of the License, or
|
2003-08-05 17:11:04 +00:00
|
|
|
* (at your option) any later version.
|
|
|
|
*
|
|
|
|
* GnuPG is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
2016-11-05 12:02:19 +01:00
|
|
|
* along with this program; if not, see <https://www.gnu.org/licenses/>.
|
2003-08-05 17:11:04 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
#include <config.h>
|
|
|
|
#include <errno.h>
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include <ctype.h>
|
|
|
|
#include <sys/stat.h>
|
|
|
|
|
|
|
|
#include "agent.h"
|
agent: Resolve conflict of util.h.
* agent/Makefile.am (AM_CPPFLAGS): Remove -I$(top_srcdir)/common.
* agent/call-pinentry.c, agent/call-scd.c: Follow the change.
* agent/command-ssh.c, agent/command.c, agent/cvt-openpgp.c: Ditto.
* agent/divert-scd.c, agent/findkey.c, agent/genkey.c: Ditto.
* agent/gpg-agent.c, agent/pksign.c, agent/preset-passphrase.c: Ditto.
* agent/protect-tool.c, agent/protect.c, agent/trustlist.c: Ditto.
* agent/w32main.c: Ditto.
--
For openpty function, we need to include util.h on some OS.
We also have util.h in common/, so this change is needed.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2017-03-07 19:22:48 +09:00
|
|
|
#include "../common/i18n.h"
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
|
|
|
|
|
|
static int
|
2004-09-26 21:48:13 +00:00
|
|
|
do_encode_md (const byte * md, size_t mdlen, int algo, gcry_sexp_t * r_hash,
|
|
|
|
int raw_value)
|
2003-08-05 17:11:04 +00:00
|
|
|
{
|
2003-08-14 19:06:46 +00:00
|
|
|
gcry_sexp_t hash;
|
2004-09-26 21:48:13 +00:00
|
|
|
int rc;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
2006-10-06 10:58:18 +00:00
|
|
|
if (!raw_value)
|
2004-09-26 21:48:13 +00:00
|
|
|
{
|
|
|
|
const char *s;
|
|
|
|
char tmp[16+1];
|
|
|
|
int i;
|
2011-02-04 12:57:53 +01:00
|
|
|
|
2004-09-26 21:48:13 +00:00
|
|
|
s = gcry_md_algo_name (algo);
|
2019-05-28 12:13:27 +02:00
|
|
|
if (!s || strlen (s) >= 16)
|
|
|
|
{
|
|
|
|
hash = NULL;
|
|
|
|
rc = gpg_error (GPG_ERR_DIGEST_ALGO);
|
|
|
|
}
|
|
|
|
else
|
2004-09-26 21:48:13 +00:00
|
|
|
{
|
2019-05-28 12:13:27 +02:00
|
|
|
for (i=0; s[i]; i++)
|
|
|
|
tmp[i] = ascii_tolower (s[i]);
|
2011-02-04 12:57:53 +01:00
|
|
|
tmp[i] = '\0';
|
2004-09-26 21:48:13 +00:00
|
|
|
|
2019-05-28 12:13:27 +02:00
|
|
|
rc = gcry_sexp_build (&hash, NULL,
|
|
|
|
"(data (flags pkcs1) (hash %s %b))",
|
|
|
|
tmp, (int)mdlen, md);
|
|
|
|
}
|
2004-09-26 21:48:13 +00:00
|
|
|
}
|
|
|
|
else
|
2003-08-05 17:11:04 +00:00
|
|
|
{
|
2020-06-05 09:05:05 +09:00
|
|
|
rc = gcry_sexp_build (&hash, NULL,
|
|
|
|
"(data (flags raw) (value %b))",
|
|
|
|
(int)mdlen, md);
|
2003-08-05 17:11:04 +00:00
|
|
|
}
|
2011-02-04 12:57:53 +01:00
|
|
|
|
2003-08-14 19:06:46 +00:00
|
|
|
*r_hash = hash;
|
2011-02-04 12:57:53 +01:00
|
|
|
return rc;
|
2003-08-05 17:11:04 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2010-04-21 16:26:17 +00:00
|
|
|
/* Return the number of bits of the Q parameter from the DSA key
|
|
|
|
KEY. */
|
|
|
|
static unsigned int
|
|
|
|
get_dsa_qbits (gcry_sexp_t key)
|
|
|
|
{
|
|
|
|
gcry_sexp_t l1, l2;
|
|
|
|
gcry_mpi_t q;
|
|
|
|
unsigned int nbits;
|
|
|
|
|
|
|
|
l1 = gcry_sexp_find_token (key, "private-key", 0);
|
|
|
|
if (!l1)
|
|
|
|
l1 = gcry_sexp_find_token (key, "protected-private-key", 0);
|
|
|
|
if (!l1)
|
|
|
|
l1 = gcry_sexp_find_token (key, "shadowed-private-key", 0);
|
|
|
|
if (!l1)
|
|
|
|
l1 = gcry_sexp_find_token (key, "public-key", 0);
|
|
|
|
if (!l1)
|
|
|
|
return 0; /* Does not contain a key object. */
|
|
|
|
l2 = gcry_sexp_cadr (l1);
|
|
|
|
gcry_sexp_release (l1);
|
|
|
|
l1 = gcry_sexp_find_token (l2, "q", 1);
|
|
|
|
gcry_sexp_release (l2);
|
|
|
|
if (!l1)
|
|
|
|
return 0; /* Invalid object. */
|
|
|
|
q = gcry_sexp_nth_mpi (l1, 1, GCRYMPI_FMT_USG);
|
|
|
|
gcry_sexp_release (l1);
|
|
|
|
if (!q)
|
|
|
|
return 0; /* Missing value. */
|
|
|
|
nbits = gcry_mpi_get_nbits (q);
|
|
|
|
gcry_mpi_release (q);
|
|
|
|
|
|
|
|
return nbits;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2013-09-07 10:06:46 +02:00
|
|
|
/* Return an appropriate hash algorithm to be used with RFC-6979 for a
|
|
|
|
message digest of length MDLEN. Although a fallback of SHA-256 is
|
|
|
|
used the current implementation in Libgcrypt will reject a hash
|
|
|
|
algorithm which does not match the length of the message. */
|
|
|
|
static const char *
|
|
|
|
rfc6979_hash_algo_string (size_t mdlen)
|
|
|
|
{
|
|
|
|
switch (mdlen)
|
|
|
|
{
|
|
|
|
case 20: return "sha1";
|
|
|
|
case 28: return "sha224";
|
|
|
|
case 32: return "sha256";
|
|
|
|
case 48: return "sha384";
|
|
|
|
case 64: return "sha512";
|
|
|
|
default: return "sha256";
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2013-11-15 08:59:45 +01:00
|
|
|
/* Encode a message digest for use with the EdDSA algorithm
|
|
|
|
(i.e. curve Ed25519). */
|
|
|
|
static gpg_error_t
|
2020-06-24 10:05:03 +09:00
|
|
|
do_encode_eddsa (size_t nbits, const byte *md, size_t mdlen,
|
|
|
|
gcry_sexp_t *r_hash)
|
2013-11-15 08:59:45 +01:00
|
|
|
{
|
|
|
|
gpg_error_t err;
|
|
|
|
gcry_sexp_t hash;
|
2020-06-24 10:05:03 +09:00
|
|
|
const char *fmt;
|
|
|
|
|
|
|
|
if (nbits == 448)
|
|
|
|
fmt = "(data(value %b))";
|
|
|
|
else
|
|
|
|
fmt = "(data(flags eddsa)(hash-algo sha512)(value %b))";
|
2013-11-15 08:59:45 +01:00
|
|
|
|
|
|
|
*r_hash = NULL;
|
2020-06-24 10:05:03 +09:00
|
|
|
err = gcry_sexp_build (&hash, NULL, fmt, (int)mdlen, md);
|
2013-11-15 08:59:45 +01:00
|
|
|
if (!err)
|
|
|
|
*r_hash = hash;
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2010-04-21 16:26:17 +00:00
|
|
|
/* Encode a message digest for use with an DSA algorithm. */
|
|
|
|
static gpg_error_t
|
gpg: Use only OpenPGP public key algo ids and add the EdDSA algo id.
* common/sexputil.c (get_pk_algo_from_canon_sexp): Change to return a
string.
* g10/keygen.c (check_keygrip): Adjust for change.
* sm/certreqgen-ui.c (check_keygrip): Likewise.
* agent/pksign.c (do_encode_dsa): Remove bogus map_pk_openpgp_to_gcry.
* g10/misc.c (map_pk_openpgp_to_gcry): Remove.
(openpgp_pk_test_algo): Change to a wrapper for openpgp_pk_test_algo2.
(openpgp_pk_test_algo2): Rewrite.
(openpgp_pk_algo_usage, pubkey_nbits): Add support for EdDSA.
(openpgp_pk_algo_name): Rewrite to remove need for gcry calls.
(pubkey_get_npkey, pubkey_get_nskey): Ditto.
(pubkey_get_nsig, pubkey_get_nenc): Ditto.
* g10/keygen.c(do_create_from_keygrip): Support EdDSA.
(common_gen, gen_ecc, ask_keysize, generate_keypair): Ditto.
* g10/build-packet.c (do_key): Ditto.
* g10/export.c (transfer_format_to_openpgp): Ditto.
* g10/getkey.c (cache_public_key): Ditto.
* g10/import.c (transfer_secret_keys): Ditto.
* g10/keylist.c (list_keyblock_print, list_keyblock_colon): Ditto.
* g10/mainproc.c (proc_pubkey_enc): Ditto.
* g10/parse-packet.c (parse_key): Ditto,
* g10/sign.c (hash_for, sign_file, make_keysig_packet): Ditto.
* g10/keyserver.c (print_keyrec): Use openpgp_pk_algo_name.
* g10/pkglue.c (pk_verify, pk_encrypt, pk_check_secret_key): Use only
OpenPGP algo ids and support EdDSA.
* g10/pubkey-enc.c (get_it): Use only OpenPGP algo ids.
* g10/seskey.c (encode_md_value): Ditto.
--
This patch separates Libgcrypt and OpenPGP public key algorithms ids
and in most cases completely removes the Libgcrypt ones. This is
useful because for Libgcrypt we specify the algorithm in the
S-expressions and the public key ids are not anymore needed.
This patch also adds some support for PUBKEY_ALGO_EDDSA which will
eventually be used instead of merging EdDSA with ECDSA. As of now an
experimental algorithm id is used but the plan is to write an I-D so
that we can get a new id from the IETF. Note that EdDSA (Ed25519)
does not yet work and that more changes are required.
The ECC support is still broken right now. Needs to be fixed.
Signed-off-by: Werner Koch <wk@gnupg.org>
2014-01-30 18:48:37 +01:00
|
|
|
do_encode_dsa (const byte *md, size_t mdlen, int pkalgo, gcry_sexp_t pkey,
|
2010-04-21 16:26:17 +00:00
|
|
|
gcry_sexp_t *r_hash)
|
|
|
|
{
|
|
|
|
gpg_error_t err;
|
|
|
|
gcry_sexp_t hash;
|
|
|
|
unsigned int qbits;
|
|
|
|
|
|
|
|
*r_hash = NULL;
|
|
|
|
|
2020-06-19 13:58:13 +09:00
|
|
|
if (pkalgo == GCRY_PK_ECC)
|
2010-04-21 16:26:17 +00:00
|
|
|
qbits = gcry_pk_get_nbits (pkey);
|
2011-01-21 15:22:41 +01:00
|
|
|
else if (pkalgo == GCRY_PK_DSA)
|
2010-04-21 16:26:17 +00:00
|
|
|
qbits = get_dsa_qbits (pkey);
|
|
|
|
else
|
|
|
|
return gpg_error (GPG_ERR_WRONG_PUBKEY_ALGO);
|
2011-02-04 12:57:53 +01:00
|
|
|
|
2011-02-07 14:38:39 +01:00
|
|
|
if (pkalgo == GCRY_PK_DSA && (qbits%8))
|
2010-04-21 16:26:17 +00:00
|
|
|
{
|
2011-02-07 14:38:39 +01:00
|
|
|
/* FIXME: We check the QBITS but print a message about the hash
|
|
|
|
length. */
|
2010-04-21 16:26:17 +00:00
|
|
|
log_error (_("DSA requires the hash length to be a"
|
|
|
|
" multiple of 8 bits\n"));
|
|
|
|
return gpg_error (GPG_ERR_INV_LENGTH);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Don't allow any Q smaller than 160 bits. We don't want someone
|
|
|
|
to issue signatures from a key with a 16-bit Q or something like
|
|
|
|
that, which would look correct but allow trivial forgeries. Yes,
|
|
|
|
I know this rules out using MD5 with DSA. ;) */
|
|
|
|
if (qbits < 160)
|
|
|
|
{
|
|
|
|
log_error (_("%s key uses an unsafe (%u bit) hash\n"),
|
2011-01-21 15:22:41 +01:00
|
|
|
gcry_pk_algo_name (pkalgo), qbits);
|
2010-04-21 16:26:17 +00:00
|
|
|
return gpg_error (GPG_ERR_INV_LENGTH);
|
|
|
|
}
|
|
|
|
|
2020-08-13 11:00:59 +02:00
|
|
|
/* ECDSA 521 is special as it is larger than the largest hash
|
2017-04-28 10:06:33 +09:00
|
|
|
we have (SHA-512). Thus we change the size for further
|
2016-09-27 14:01:18 +09:00
|
|
|
processing to 512. */
|
2020-06-19 13:58:13 +09:00
|
|
|
if (pkalgo == GCRY_PK_ECC && qbits > 512)
|
2016-09-27 14:01:18 +09:00
|
|
|
qbits = 512;
|
|
|
|
|
2010-04-21 16:26:17 +00:00
|
|
|
/* Check if we're too short. Too long is safe as we'll
|
2016-09-27 14:01:18 +09:00
|
|
|
automatically left-truncate. */
|
|
|
|
if (mdlen < qbits/8)
|
2010-04-21 16:26:17 +00:00
|
|
|
{
|
|
|
|
log_error (_("a %zu bit hash is not valid for a %u bit %s key\n"),
|
2011-01-21 15:22:41 +01:00
|
|
|
mdlen*8,
|
2011-02-04 12:57:53 +01:00
|
|
|
gcry_pk_get_nbits (pkey),
|
2011-01-21 15:22:41 +01:00
|
|
|
gcry_pk_algo_name (pkalgo));
|
2016-09-27 14:01:18 +09:00
|
|
|
return gpg_error (GPG_ERR_INV_LENGTH);
|
2010-04-21 16:26:17 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Truncate. */
|
|
|
|
if (mdlen > qbits/8)
|
|
|
|
mdlen = qbits/8;
|
2011-02-04 12:57:53 +01:00
|
|
|
|
2013-11-11 11:33:14 +01:00
|
|
|
/* Create the S-expression. */
|
|
|
|
err = gcry_sexp_build (&hash, NULL,
|
|
|
|
"(data (flags rfc6979) (hash %s %b))",
|
|
|
|
rfc6979_hash_algo_string (mdlen),
|
|
|
|
(int)mdlen, md);
|
2010-04-21 16:26:17 +00:00
|
|
|
if (!err)
|
|
|
|
*r_hash = hash;
|
2011-02-04 12:57:53 +01:00
|
|
|
return err;
|
2010-04-21 16:26:17 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2008-09-23 09:57:45 +00:00
|
|
|
/* Special version of do_encode_md to take care of pkcs#1 padding.
|
2006-10-06 10:58:18 +00:00
|
|
|
For TLS-MD5SHA1 we need to do the padding ourself as Libgrypt does
|
|
|
|
not know about this special scheme. Fixme: We should have a
|
|
|
|
pkcs1-only-padding flag for Libgcrypt. */
|
|
|
|
static int
|
|
|
|
do_encode_raw_pkcs1 (const byte *md, size_t mdlen, unsigned int nbits,
|
|
|
|
gcry_sexp_t *r_hash)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
gcry_sexp_t hash;
|
|
|
|
unsigned char *frame;
|
|
|
|
size_t i, n, nframe;
|
2011-02-04 12:57:53 +01:00
|
|
|
|
2006-10-06 10:58:18 +00:00
|
|
|
nframe = (nbits+7) / 8;
|
|
|
|
if ( !mdlen || mdlen + 8 + 4 > nframe )
|
|
|
|
{
|
|
|
|
/* Can't encode this hash into a frame of size NFRAME. */
|
|
|
|
return gpg_error (GPG_ERR_TOO_SHORT);
|
|
|
|
}
|
|
|
|
|
|
|
|
frame = xtrymalloc (nframe);
|
|
|
|
if (!frame)
|
|
|
|
return gpg_error_from_syserror ();
|
2011-02-04 12:57:53 +01:00
|
|
|
|
2006-10-06 10:58:18 +00:00
|
|
|
/* Assemble the pkcs#1 block type 1. */
|
|
|
|
n = 0;
|
|
|
|
frame[n++] = 0;
|
|
|
|
frame[n++] = 1; /* Block type. */
|
|
|
|
i = nframe - mdlen - 3 ;
|
2019-05-14 10:31:46 +02:00
|
|
|
log_assert (i >= 8); /* At least 8 bytes of padding. */
|
2006-10-06 10:58:18 +00:00
|
|
|
memset (frame+n, 0xff, i );
|
|
|
|
n += i;
|
|
|
|
frame[n++] = 0;
|
|
|
|
memcpy (frame+n, md, mdlen );
|
|
|
|
n += mdlen;
|
2019-05-14 10:31:46 +02:00
|
|
|
log_assert (n == nframe);
|
2011-02-04 12:57:53 +01:00
|
|
|
|
2006-10-06 10:58:18 +00:00
|
|
|
/* Create the S-expression. */
|
|
|
|
rc = gcry_sexp_build (&hash, NULL,
|
|
|
|
"(data (flags raw) (value %b))",
|
|
|
|
(int)nframe, frame);
|
|
|
|
xfree (frame);
|
|
|
|
|
|
|
|
*r_hash = hash;
|
2011-02-04 12:57:53 +01:00
|
|
|
return rc;
|
2006-10-06 10:58:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-09-26 21:48:13 +00:00
|
|
|
/* SIGN whatever information we have accumulated in CTRL and return
|
2017-07-28 10:37:33 +02:00
|
|
|
* the signature S-expression. LOOKUP is an optional function to
|
|
|
|
* provide a way for lower layers to ask for the caching TTL. If a
|
|
|
|
* CACHE_NONCE is given that cache item is first tried to get a
|
|
|
|
* passphrase. If OVERRIDEDATA is not NULL, OVERRIDEDATALEN bytes
|
|
|
|
* from this buffer are used instead of the data in CTRL. The
|
|
|
|
* override feature is required to allow the use of Ed25519 with ssh
|
|
|
|
* because Ed25519 does the hashing itself. */
|
|
|
|
gpg_error_t
|
2010-09-01 11:07:16 +00:00
|
|
|
agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
|
|
|
|
const char *desc_text,
|
2009-05-15 11:16:28 +00:00
|
|
|
gcry_sexp_t *signature_sexp,
|
2014-03-22 20:51:16 +01:00
|
|
|
cache_mode_t cache_mode, lookup_ttl_t lookup_ttl,
|
|
|
|
const void *overridedata, size_t overridedatalen)
|
2003-08-05 17:11:04 +00:00
|
|
|
{
|
2017-07-28 10:37:33 +02:00
|
|
|
gpg_error_t err = 0;
|
2017-02-22 11:04:55 +01:00
|
|
|
gcry_sexp_t s_skey = NULL;
|
|
|
|
gcry_sexp_t s_sig = NULL;
|
2015-09-29 09:49:44 +09:00
|
|
|
gcry_sexp_t s_hash = NULL;
|
2015-10-06 15:10:25 +09:00
|
|
|
gcry_sexp_t s_pkey = NULL;
|
2003-08-05 17:11:04 +00:00
|
|
|
unsigned char *shadow_info = NULL;
|
2020-02-13 11:45:41 +01:00
|
|
|
int no_shadow_info = 0;
|
2014-03-22 20:51:16 +01:00
|
|
|
const unsigned char *data;
|
|
|
|
int datalen;
|
2015-09-29 09:49:44 +09:00
|
|
|
int check_signature = 0;
|
2020-06-19 13:58:13 +09:00
|
|
|
int algo;
|
2003-08-05 17:11:04 +00:00
|
|
|
|
2014-03-22 20:51:16 +01:00
|
|
|
if (overridedata)
|
|
|
|
{
|
|
|
|
data = overridedata;
|
|
|
|
datalen = overridedatalen;
|
|
|
|
}
|
2020-05-18 19:24:41 +02:00
|
|
|
else if (ctrl->digest.data)
|
|
|
|
{
|
|
|
|
data = ctrl->digest.data;
|
|
|
|
datalen = ctrl->digest.valuelen;
|
|
|
|
}
|
2014-03-22 20:51:16 +01:00
|
|
|
else
|
|
|
|
{
|
|
|
|
data = ctrl->digest.value;
|
|
|
|
datalen = ctrl->digest.valuelen;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!ctrl->have_keygrip)
|
2003-08-05 17:11:04 +00:00
|
|
|
return gpg_error (GPG_ERR_NO_SECKEY);
|
|
|
|
|
2022-05-19 14:04:33 +09:00
|
|
|
err = agent_key_from_file (ctrl, cache_nonce, desc_text, NULL,
|
2017-07-28 10:37:33 +02:00
|
|
|
&shadow_info, cache_mode, lookup_ttl,
|
2022-03-25 14:10:46 +09:00
|
|
|
&s_skey, NULL, NULL);
|
2020-02-13 11:45:41 +01:00
|
|
|
if (gpg_err_code (err) == GPG_ERR_NO_SECKEY)
|
|
|
|
no_shadow_info = 1;
|
|
|
|
else if (err)
|
2003-08-05 17:11:04 +00:00
|
|
|
{
|
2020-02-13 11:45:41 +01:00
|
|
|
log_error ("failed to read the secret key\n");
|
2003-08-05 17:11:04 +00:00
|
|
|
goto leave;
|
|
|
|
}
|
2020-12-08 13:20:29 +09:00
|
|
|
else
|
|
|
|
algo = get_pk_algo_from_key (s_skey);
|
2020-06-19 13:58:13 +09:00
|
|
|
|
2020-02-13 11:45:41 +01:00
|
|
|
if (shadow_info || no_shadow_info)
|
2004-09-26 21:48:13 +00:00
|
|
|
{
|
2020-02-13 11:45:41 +01:00
|
|
|
/* Divert operation to the smartcard. With NO_SHADOW_INFO set
|
|
|
|
* we don't have the keystub but we want to see whether the key
|
|
|
|
* is on the active card. */
|
2013-02-28 11:17:47 +09:00
|
|
|
size_t len;
|
2004-09-26 21:48:13 +00:00
|
|
|
unsigned char *buf = NULL;
|
2013-02-28 11:17:47 +09:00
|
|
|
|
2020-02-13 11:45:41 +01:00
|
|
|
if (no_shadow_info)
|
2015-10-06 15:10:25 +09:00
|
|
|
{
|
2020-02-13 11:45:41 +01:00
|
|
|
/* Try to get the public key from the card or fail with the
|
|
|
|
* original NO_SECKEY error. We also write a stub file (we
|
|
|
|
* are here only because no stub exists). */
|
|
|
|
char *serialno;
|
|
|
|
unsigned char *pkbuf = NULL;
|
|
|
|
size_t pkbuflen;
|
|
|
|
char hexgrip[2*KEYGRIP_LEN+1];
|
|
|
|
char *keyref;
|
|
|
|
|
|
|
|
if (agent_card_serialno (ctrl, &serialno, NULL))
|
|
|
|
{
|
Spelling cleanup.
No functional changes, just fixing minor spelling issues.
---
Most of these were identified from the command line by running:
codespell \
--ignore-words-list fpr,stati,keyserver,keyservers,asign,cas,iff,ifset \
--skip '*.po,ChangeLog*,help.*.txt,*.jpg,*.eps,*.pdf,*.png,*.gpg,*.asc' \
doc g13 g10 kbx agent artwork scd tests tools am common dirmngr sm \
NEWS README README.maint TODO
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2020-02-18 09:34:42 -05:00
|
|
|
/* No card available or error reading the card. */
|
2020-02-13 11:45:41 +01:00
|
|
|
err = gpg_error (GPG_ERR_NO_SECKEY);
|
|
|
|
goto leave;
|
|
|
|
}
|
|
|
|
bin2hex (ctrl->keygrip, KEYGRIP_LEN, hexgrip);
|
|
|
|
if (agent_card_readkey (ctrl, hexgrip, &pkbuf, &keyref))
|
|
|
|
{
|
|
|
|
/* No such key on the card. */
|
|
|
|
xfree (serialno);
|
|
|
|
err = gpg_error (GPG_ERR_NO_SECKEY);
|
|
|
|
goto leave;
|
|
|
|
}
|
|
|
|
pkbuflen = gcry_sexp_canon_len (pkbuf, 0, NULL, NULL);
|
|
|
|
err = gcry_sexp_sscan (&s_pkey, NULL, (char*)pkbuf, pkbuflen);
|
|
|
|
if (err)
|
|
|
|
{
|
|
|
|
xfree (serialno);
|
|
|
|
xfree (pkbuf);
|
|
|
|
xfree (keyref);
|
|
|
|
log_error ("%s: corrupted key returned by scdaemon\n", __func__);
|
|
|
|
goto leave;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (keyref)
|
|
|
|
agent_write_shadow_key (ctrl->keygrip, serialno, keyref, pkbuf, 0);
|
|
|
|
|
2020-12-08 13:20:29 +09:00
|
|
|
algo = get_pk_algo_from_key (s_pkey);
|
|
|
|
|
2020-02-13 11:45:41 +01:00
|
|
|
xfree (serialno);
|
|
|
|
xfree (pkbuf);
|
|
|
|
xfree (keyref);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
/* Get the public key from the stub file. */
|
|
|
|
err = agent_public_key_from_file (ctrl, ctrl->keygrip, &s_pkey);
|
|
|
|
if (err)
|
|
|
|
{
|
|
|
|
log_error ("failed to read the public key\n");
|
|
|
|
goto leave;
|
|
|
|
}
|
2015-10-06 15:10:25 +09:00
|
|
|
}
|
|
|
|
|
2017-02-22 11:04:55 +01:00
|
|
|
{
|
2021-03-09 13:50:29 -08:00
|
|
|
if (agent_is_tpm2_key (s_skey))
|
2022-05-20 13:43:08 +09:00
|
|
|
err = divert_tpm2_pksign (ctrl,
|
2021-03-09 13:50:29 -08:00
|
|
|
data, datalen,
|
|
|
|
ctrl->digest.algo,
|
|
|
|
shadow_info, &buf, &len);
|
|
|
|
else
|
2022-05-20 13:43:08 +09:00
|
|
|
err = divert_pksign (ctrl,
|
2021-03-09 13:50:29 -08:00
|
|
|
ctrl->keygrip,
|
|
|
|
data, datalen,
|
|
|
|
ctrl->digest.algo,
|
2022-05-20 13:43:08 +09:00
|
|
|
&buf, &len);
|
2017-02-22 11:04:55 +01:00
|
|
|
}
|
2017-07-28 10:37:33 +02:00
|
|
|
if (err)
|
2003-08-05 17:11:04 +00:00
|
|
|
{
|
2017-07-28 10:37:33 +02:00
|
|
|
log_error ("smartcard signing failed: %s\n", gpg_strerror (err));
|
2003-08-05 17:11:04 +00:00
|
|
|
goto leave;
|
|
|
|
}
|
2004-09-26 21:48:13 +00:00
|
|
|
|
2020-06-19 13:58:13 +09:00
|
|
|
if (algo == GCRY_PK_RSA)
|
2013-02-28 11:17:47 +09:00
|
|
|
{
|
2019-02-27 10:37:26 +09:00
|
|
|
unsigned char *p = buf;
|
|
|
|
|
2015-09-29 09:49:44 +09:00
|
|
|
check_signature = 1;
|
2019-02-27 10:37:26 +09:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Smartcard returns fixed-size data, which is good for
|
|
|
|
* PKCS1. If variable-size unsigned MPI is needed, remove
|
|
|
|
* zeros.
|
|
|
|
*/
|
|
|
|
if (ctrl->digest.algo == MD_USER_TLS_MD5SHA1
|
|
|
|
|| ctrl->digest.raw_value)
|
2013-02-28 11:17:47 +09:00
|
|
|
{
|
2019-02-27 10:37:26 +09:00
|
|
|
int i;
|
2013-02-28 11:17:47 +09:00
|
|
|
|
2019-02-27 10:37:26 +09:00
|
|
|
for (i = 0; i < len - 1; i++)
|
|
|
|
if (p[i])
|
|
|
|
break;
|
|
|
|
p += i;
|
|
|
|
len -= i;
|
2013-02-28 11:17:47 +09:00
|
|
|
}
|
|
|
|
|
2017-07-28 10:37:33 +02:00
|
|
|
err = gcry_sexp_build (&s_sig, NULL, "(sig-val(rsa(s%b)))",
|
2019-02-27 10:37:26 +09:00
|
|
|
(int)len, p);
|
2013-02-28 11:17:47 +09:00
|
|
|
}
|
2020-06-19 13:58:13 +09:00
|
|
|
else if (algo == GCRY_PK_EDDSA)
|
2014-04-08 12:15:20 +09:00
|
|
|
{
|
2017-07-28 10:37:33 +02:00
|
|
|
err = gcry_sexp_build (&s_sig, NULL, "(sig-val(eddsa(r%b)(s%b)))",
|
|
|
|
(int)len/2, buf, (int)len/2, buf + len/2);
|
2014-04-08 12:15:20 +09:00
|
|
|
}
|
2020-06-19 13:58:13 +09:00
|
|
|
else if (algo == GCRY_PK_ECC)
|
2013-02-28 11:17:47 +09:00
|
|
|
{
|
|
|
|
unsigned char *r_buf, *s_buf;
|
|
|
|
int r_buflen, s_buflen;
|
2019-02-27 10:37:26 +09:00
|
|
|
int i;
|
2013-02-28 11:17:47 +09:00
|
|
|
|
|
|
|
r_buflen = s_buflen = len/2;
|
|
|
|
|
2019-02-27 10:37:26 +09:00
|
|
|
/*
|
|
|
|
* Smartcard returns fixed-size data. For ECDSA signature,
|
|
|
|
* variable-size unsigned MPI is assumed, thus, remove
|
|
|
|
* zeros.
|
|
|
|
*/
|
|
|
|
r_buf = buf;
|
|
|
|
for (i = 0; i < r_buflen - 1; i++)
|
|
|
|
if (r_buf[i])
|
|
|
|
break;
|
|
|
|
r_buf += i;
|
|
|
|
r_buflen -= i;
|
|
|
|
|
|
|
|
s_buf = buf + len/2;
|
|
|
|
for (i = 0; i < s_buflen - 1; i++)
|
|
|
|
if (s_buf[i])
|
|
|
|
break;
|
|
|
|
s_buf += i;
|
|
|
|
s_buflen -= i;
|
2013-02-28 11:17:47 +09:00
|
|
|
|
2017-07-28 10:37:33 +02:00
|
|
|
err = gcry_sexp_build (&s_sig, NULL, "(sig-val(ecdsa(r%b)(s%b)))",
|
|
|
|
r_buflen, r_buf,
|
|
|
|
s_buflen, s_buf);
|
2013-02-28 11:17:47 +09:00
|
|
|
}
|
|
|
|
else
|
2017-07-28 10:37:33 +02:00
|
|
|
err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
|
2013-02-28 11:17:47 +09:00
|
|
|
|
2004-09-26 21:48:13 +00:00
|
|
|
xfree (buf);
|
2017-07-28 10:37:33 +02:00
|
|
|
if (err)
|
2004-09-26 21:48:13 +00:00
|
|
|
{
|
|
|
|
log_error ("failed to convert sigbuf returned by divert_pksign "
|
2017-07-28 10:37:33 +02:00
|
|
|
"into S-Exp: %s", gpg_strerror (err));
|
2004-09-26 21:48:13 +00:00
|
|
|
goto leave;
|
|
|
|
}
|
2003-08-05 17:11:04 +00:00
|
|
|
}
|
|
|
|
else
|
2004-09-26 21:48:13 +00:00
|
|
|
{
|
2020-02-13 11:45:41 +01:00
|
|
|
/* No smartcard, but a private key (in S_SKEY). */
|
2003-08-05 17:11:04 +00:00
|
|
|
|
2006-10-06 10:58:18 +00:00
|
|
|
/* Put the hash into a sexp */
|
2020-06-19 13:58:13 +09:00
|
|
|
if (algo == GCRY_PK_EDDSA)
|
2020-06-24 10:05:03 +09:00
|
|
|
err = do_encode_eddsa (gcry_pk_get_nbits (s_skey), data, datalen,
|
2017-07-28 10:37:33 +02:00
|
|
|
&s_hash);
|
2013-11-15 08:59:45 +01:00
|
|
|
else if (ctrl->digest.algo == MD_USER_TLS_MD5SHA1)
|
2017-07-28 10:37:33 +02:00
|
|
|
err = do_encode_raw_pkcs1 (data, datalen,
|
|
|
|
gcry_pk_get_nbits (s_skey),
|
|
|
|
&s_hash);
|
2020-06-19 13:58:13 +09:00
|
|
|
else if (algo == GCRY_PK_DSA || algo == GCRY_PK_ECC)
|
2017-07-28 10:37:33 +02:00
|
|
|
err = do_encode_dsa (data, datalen,
|
2020-06-19 13:58:13 +09:00
|
|
|
algo, s_skey,
|
2017-07-28 10:37:33 +02:00
|
|
|
&s_hash);
|
2020-08-10 10:01:03 +02:00
|
|
|
else if (ctrl->digest.is_pss)
|
|
|
|
{
|
|
|
|
log_info ("signing with rsaPSS is currently only supported"
|
|
|
|
" for (some) smartcards\n");
|
|
|
|
err = gpg_error (GPG_ERR_NOT_SUPPORTED);
|
|
|
|
}
|
2006-10-06 10:58:18 +00:00
|
|
|
else
|
2017-07-28 10:37:33 +02:00
|
|
|
err = do_encode_md (data, datalen,
|
|
|
|
ctrl->digest.algo,
|
|
|
|
&s_hash,
|
|
|
|
ctrl->digest.raw_value);
|
|
|
|
if (err)
|
2003-08-05 17:11:04 +00:00
|
|
|
goto leave;
|
|
|
|
|
|
|
|
if (DBG_CRYPTO)
|
|
|
|
{
|
2013-11-15 08:59:45 +01:00
|
|
|
gcry_log_debugsxp ("skey", s_skey);
|
|
|
|
gcry_log_debugsxp ("hash", s_hash);
|
2003-08-05 17:11:04 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* sign */
|
2017-07-28 10:37:33 +02:00
|
|
|
err = gcry_pk_sign (&s_sig, s_hash, s_skey);
|
|
|
|
if (err)
|
2003-08-05 17:11:04 +00:00
|
|
|
{
|
2017-07-28 10:37:33 +02:00
|
|
|
log_error ("signing failed: %s\n", gpg_strerror (err));
|
2003-08-05 17:11:04 +00:00
|
|
|
goto leave;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (DBG_CRYPTO)
|
2013-11-15 08:59:45 +01:00
|
|
|
gcry_log_debugsxp ("rslt", s_sig);
|
2003-08-05 17:11:04 +00:00
|
|
|
}
|
|
|
|
|
2015-09-29 09:49:44 +09:00
|
|
|
/* Check that the signature verification worked and nothing is
|
|
|
|
* fooling us e.g. by a bug in the signature create code or by
|
|
|
|
* deliberately introduced faults. Because Libgcrypt 1.7 does this
|
2020-02-13 11:45:41 +01:00
|
|
|
* for RSA internally there is no need to do it here again. We do
|
|
|
|
* this always for card based RSA keys, though. */
|
2015-09-29 09:49:44 +09:00
|
|
|
if (check_signature)
|
|
|
|
{
|
2016-01-05 10:15:49 +09:00
|
|
|
gcry_sexp_t sexp_key = s_pkey? s_pkey: s_skey;
|
|
|
|
|
2015-09-29 09:49:44 +09:00
|
|
|
if (s_hash == NULL)
|
|
|
|
{
|
2020-08-10 10:01:03 +02:00
|
|
|
if (ctrl->digest.is_pss)
|
|
|
|
{
|
|
|
|
err = gcry_sexp_build (&s_hash, NULL,
|
|
|
|
"(data (flags raw) (value %b))",
|
|
|
|
(int)datalen, data);
|
|
|
|
}
|
2021-03-26 14:27:00 +01:00
|
|
|
else if (algo == GCRY_PK_DSA || algo == GCRY_PK_ECC)
|
|
|
|
err = do_encode_dsa (data, datalen, algo, sexp_key, &s_hash);
|
2020-08-10 10:01:03 +02:00
|
|
|
else if (ctrl->digest.algo == MD_USER_TLS_MD5SHA1)
|
2017-07-28 10:37:33 +02:00
|
|
|
err = do_encode_raw_pkcs1 (data, datalen,
|
|
|
|
gcry_pk_get_nbits (sexp_key), &s_hash);
|
2015-09-29 09:49:44 +09:00
|
|
|
else
|
2017-07-28 10:37:33 +02:00
|
|
|
err = do_encode_md (data, datalen, ctrl->digest.algo, &s_hash,
|
|
|
|
ctrl->digest.raw_value);
|
2015-09-29 09:49:44 +09:00
|
|
|
}
|
|
|
|
|
2017-07-28 10:37:33 +02:00
|
|
|
if (!err)
|
|
|
|
err = gcry_pk_verify (s_sig, s_hash, sexp_key);
|
2015-09-29 09:49:44 +09:00
|
|
|
|
2017-07-28 10:37:33 +02:00
|
|
|
if (err)
|
2015-09-29 09:49:44 +09:00
|
|
|
{
|
|
|
|
log_error (_("checking created signature failed: %s\n"),
|
2017-07-28 10:37:33 +02:00
|
|
|
gpg_strerror (err));
|
2021-03-26 14:27:00 +01:00
|
|
|
if (DBG_CRYPTO)
|
|
|
|
{
|
|
|
|
gcry_log_debugsxp ("verify s_hsh", s_hash);
|
|
|
|
gcry_log_debugsxp ("verify s_sig", s_sig);
|
|
|
|
gcry_log_debugsxp ("verify s_key", sexp_key);
|
|
|
|
}
|
2015-09-29 09:49:44 +09:00
|
|
|
gcry_sexp_release (s_sig);
|
|
|
|
s_sig = NULL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2004-09-26 21:48:13 +00:00
|
|
|
leave:
|
|
|
|
|
|
|
|
*signature_sexp = s_sig;
|
|
|
|
|
2015-10-06 15:10:25 +09:00
|
|
|
gcry_sexp_release (s_pkey);
|
2004-09-26 21:48:13 +00:00
|
|
|
gcry_sexp_release (s_skey);
|
2015-09-29 09:49:44 +09:00
|
|
|
gcry_sexp_release (s_hash);
|
2004-09-26 21:48:13 +00:00
|
|
|
xfree (shadow_info);
|
|
|
|
|
2017-07-28 10:37:33 +02:00
|
|
|
return err;
|
2004-09-26 21:48:13 +00:00
|
|
|
}
|
|
|
|
|
2017-07-28 10:37:33 +02:00
|
|
|
|
2004-09-26 21:48:13 +00:00
|
|
|
/* SIGN whatever information we have accumulated in CTRL and write it
|
2017-07-28 10:37:33 +02:00
|
|
|
* back to OUTFP. If a CACHE_NONCE is given that cache item is first
|
|
|
|
* tried to get a passphrase. */
|
|
|
|
gpg_error_t
|
2010-09-01 11:07:16 +00:00
|
|
|
agent_pksign (ctrl_t ctrl, const char *cache_nonce, const char *desc_text,
|
2011-02-04 12:57:53 +01:00
|
|
|
membuf_t *outbuf, cache_mode_t cache_mode)
|
2004-09-26 21:48:13 +00:00
|
|
|
{
|
2017-07-28 10:37:33 +02:00
|
|
|
gpg_error_t err;
|
2004-09-26 21:48:13 +00:00
|
|
|
gcry_sexp_t s_sig = NULL;
|
|
|
|
char *buf = NULL;
|
|
|
|
size_t len = 0;
|
|
|
|
|
2017-07-28 10:37:33 +02:00
|
|
|
err = agent_pksign_do (ctrl, cache_nonce, desc_text, &s_sig, cache_mode,
|
|
|
|
NULL, NULL, 0);
|
|
|
|
if (err)
|
2004-09-26 21:48:13 +00:00
|
|
|
goto leave;
|
|
|
|
|
|
|
|
len = gcry_sexp_sprint (s_sig, GCRYSEXP_FMT_CANON, NULL, 0);
|
2017-07-28 10:37:33 +02:00
|
|
|
log_assert (len);
|
|
|
|
buf = xtrymalloc (len);
|
|
|
|
if (!buf)
|
|
|
|
{
|
|
|
|
err = gpg_error_from_syserror ();
|
|
|
|
goto leave;
|
|
|
|
}
|
2004-09-26 21:48:13 +00:00
|
|
|
len = gcry_sexp_sprint (s_sig, GCRYSEXP_FMT_CANON, buf, len);
|
2017-07-28 10:37:33 +02:00
|
|
|
log_assert (len);
|
2004-12-20 08:32:56 +00:00
|
|
|
put_membuf (outbuf, buf, len);
|
2003-08-05 17:11:04 +00:00
|
|
|
|
|
|
|
leave:
|
|
|
|
gcry_sexp_release (s_sig);
|
|
|
|
xfree (buf);
|
2004-09-26 21:48:13 +00:00
|
|
|
|
2017-07-28 10:37:33 +02:00
|
|
|
return err;
|
2003-08-05 17:11:04 +00:00
|
|
|
}
|