security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

gpg: New option --disable-pqc-encryption.

Browse source 
* g10/options.h (flags): Add field disable_pqc_encryption.
* g10/gpg.c (oDisablePQCEncryption): New.
(opts): Add --option.
(main): Set option.
* g10/getkey.c (finish_lookup): Skip subkeys if option is set.
--

This option can be used to avoid the use of Kyber encryption subkeys
if this does not make sense (i.e. protection of local files).
This commit is contained in:
Werner Koch 2025-02-06 17:45:23 +01:00
parent da9fb6bd16
commit 00c31f8b04
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
5 changed files with 29 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
g10/getkey.c
View file

@ -3804,6 +3804,14 @@ finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
req_usage, pk->pubkey_usage);
continue;
}
if (opt.flags.disable_pqc_encryption
&& pk->pubkey_algo == PUBKEY_ALGO_KYBER)
{
if (DBG_LOOKUP)
log_debug ("\tsubkey skipped due to option %s\n",
"--disable-pqc-encryption");
continue;
}
n_subkeys++;
if (pk->flags.revoked)

7
g10/gpg.c
View file

@ -461,6 +461,7 @@ enum cmd_and_opt_values
oAssertPubkeyAlgo,
oKbxBufferSize,
oRequirePQCEncryption,
oDisablePQCEncryption,
oProcAllSigs,
oNoop
@ -907,6 +908,7 @@ static gpgrt_opt_t opts[] = {
ARGPARSE_s_s (oDigestAlgo, "digest-algo", "@"),
ARGPARSE_s_s (oCertDigestAlgo, "cert-digest-algo", "@"),
ARGPARSE_s_n (oRequirePQCEncryption, "require-pqc-encryption", "@"),
ARGPARSE_s_n (oDisablePQCEncryption, "disable-pqc-encryption", "@"),
ARGPARSE_header (NULL, N_("Options for unattended use")),
@ -3095,6 +3097,11 @@ main (int argc, char **argv)
case oMinRSALength: opt.min_rsa_length = pargs.r.ret_ulong; break;
case oRequirePQCEncryption:
opt.flags.require_pqc_encryption = 1;
opt.flags.disable_pqc_encryption = 0;
break;
case oDisablePQCEncryption:
if (!opt.flags.require_pqc_encryption)
opt.flags.disable_pqc_encryption = 1;
break;
case oRFC2440Text: opt.rfc2440_text=1; break;

3
g10/options.h
View file

@ -308,6 +308,9 @@ struct
unsigned int require_compliance:1;
/* Fail encryption unless a PQC algorithm is used. */
unsigned int require_pqc_encryption:1;
/* Do not use PQC subkeys for encryption. This is never set if
* require_pqc_encryption is also set. */
unsigned int disable_pqc_encryption:1;
/* Process all signatures even in batch mode. */
unsigned int proc_all_sigs:1;
} flags;