mirror of
git://git.gnupg.org/gnupg.git
synced 2025-01-02 12:01:32 +01:00
See ChangeLog: Fri Apr 9 12:26:25 CEST 1999 Werner Koch
This commit is contained in:
Werner Koch
parent
97efca04ef
commit
02d018f9c8
6
NEWS
6
NEWS
@ -1,6 +1,10 @@
|
||||
|
||||
* Full Twofish support. It is now statically linked by default.
|
||||
----> Hmmm, still have to check the message format
|
||||
The experimental 128 bit version is now disabled.
|
||||
----> Hmmm, there is an internal conflict in the RFC
|
||||
|
||||
* Dropped support for the ancient Blowfish160 which is not OpenPGP.
|
||||
|
||||
|
||||
Noteworthy changes in version 0.9.5
|
||||
-----------------------------------
|
||||
|
||||
135
README
135
README
@ -1,18 +1,17 @@
|
||||
Please note that this is only a bug fix release and some things
|
||||
do not yet work - see TODO for parts which are problematic
|
||||
|
||||
The genkey1024 test will fail due to an expect problem :-(
|
||||
|
||||
|
||||
-----BEGIN PGP SIGNED MESSAGE-----
|
||||
|
||||
GnuPG - The GNU Privacy Guard
|
||||
-------------------------------
|
||||
Version 0.9
|
||||
GnuPG - The GNU Privacy Guard
|
||||
-------------------------------
|
||||
Version 0.9
|
||||
|
||||
GnuPG is now in Beta test and you should report all bugs to the
|
||||
mailing list (see below). The 0.9.x versions are released mainly
|
||||
to fix all remaining serious bugs. As soon as version 1.0 is out,
|
||||
to fix all remaining serious bugs. As soon as version 1.0 is out,
|
||||
development will continue with a 1.1 series and bug fixes for the
|
||||
1.0 version as needed.
|
||||
|
||||
@ -32,7 +31,7 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
"Key fingerprint = ECAF 7590 EB34 43B5 C7CF 3ACB 6C7E E1B8 621C C013"
|
||||
|
||||
You may want add my new DSA key to your GnuPG pubring and use it in
|
||||
the future to verify new releases. Because you verified this README
|
||||
the future to verify new releases. Because you verified this README
|
||||
file and _checked_that_it_is_really_my PGP2 key 0C9857A5, you can be
|
||||
sure that the above fingerprints are correct.
|
||||
|
||||
@ -67,7 +66,7 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
|
||||
Here is a quick summary:
|
||||
|
||||
1) "./configure"
|
||||
1) "./configure"
|
||||
|
||||
2) "make"
|
||||
|
||||
@ -93,7 +92,7 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
|
||||
The normal way to create a key is
|
||||
|
||||
gpg --gen-key
|
||||
gpg --gen-key
|
||||
|
||||
This asks some questions and then starts key generation. To create
|
||||
good random numbers for the key parameters, GnuPG needs to gather
|
||||
@ -120,7 +119,7 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
Next, you should create a revocation certificate in case someone
|
||||
gets knowledge of your secret key or you forgot your passphrase
|
||||
|
||||
gpg --gen-revoke your_user_id
|
||||
gpg --gen-revoke your_user_id
|
||||
|
||||
Run this command and store the revocation certificate away. The output
|
||||
is always ASCII armored, so that you can print it and (hopefully
|
||||
@ -128,20 +127,20 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
|
||||
Now you can use your key to create digital signatures
|
||||
|
||||
gpg -s file
|
||||
gpg -s file
|
||||
|
||||
This creates a file "file.gpg" which is compressed and has a
|
||||
signature attached.
|
||||
|
||||
gpg -sa file
|
||||
gpg -sa file
|
||||
|
||||
Same as above, but creates a file "file.asc" which is ASCII armored
|
||||
and and ready for sending by mail. It is better to use your
|
||||
and and ready for sending by mail. It is better to use your
|
||||
mailers features to create signatures (The mailer uses GnuPG to do
|
||||
this) because the mailer has the ability to MIME encode such
|
||||
signatures - but this is not a security issue.
|
||||
|
||||
gpg -s -o out file
|
||||
gpg -s -o out file
|
||||
|
||||
Creates a signature of "file", but writes the output to the file
|
||||
"out".
|
||||
@ -150,7 +149,7 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
your key by putting it on a key server, a web page or in your .plan
|
||||
file) is now able to check whether you really signed this text
|
||||
|
||||
gpg --verify file
|
||||
gpg --verify file
|
||||
|
||||
GnuPG now checks whether the signature is valid and prints an
|
||||
appropriate message. If the signature is good, you know at least
|
||||
@ -161,29 +160,29 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
create a new file that is identical to the original. gpg can also
|
||||
run as a filter, so that you can pipe data to verify trough it
|
||||
|
||||
cat signed-file | gpg | wc -l
|
||||
cat signed-file | gpg | wc -l
|
||||
|
||||
which will check the signature of signed-file and then display the
|
||||
number of lines in the original file.
|
||||
|
||||
To send a message encrypted to someone you can use
|
||||
|
||||
gpg -e -r heine file
|
||||
gpg -e -r heine file
|
||||
|
||||
This encrypts "file" with the public key of the user "heine" and
|
||||
writes it to "file.gpg"
|
||||
|
||||
echo "hello" | gpg -ea -r heine | mail heine
|
||||
echo "hello" | gpg -ea -r heine | mail heine
|
||||
|
||||
Ditto, but encrypts "hello\n" and mails it as ASCII armored message
|
||||
to the user with the mail address heine.
|
||||
|
||||
gpg -se -r heine file
|
||||
gpg -se -r heine file
|
||||
|
||||
This encrypts "file" with the public key of "heine" and writes it
|
||||
to "file.gpg" after signing it with your user id.
|
||||
|
||||
gpg -se -r heine -u Suttner file
|
||||
gpg -se -r heine -u Suttner file
|
||||
|
||||
Ditto, but sign the file with your alternative user id "Suttner"
|
||||
|
||||
@ -191,7 +190,7 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
GnuPG has some options to help you publish public keys. This is
|
||||
called "exporting" a key, thus
|
||||
|
||||
gpg --export >all-my-keys
|
||||
gpg --export >all-my-keys
|
||||
|
||||
exports all the keys in the keyring and writes them (in a binary
|
||||
format) to "all-my-keys". You may then mail "all-my-keys" as an
|
||||
@ -202,14 +201,14 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
To mail a public key or put it on a web page you have to create
|
||||
the key in ASCII armored format
|
||||
|
||||
gpg --export --armor | mail panther@tiger.int
|
||||
gpg --export --armor | mail panther@tiger.int
|
||||
|
||||
This will send all your public keys to your friend panther.
|
||||
|
||||
If you have received a key from someone else you can put it
|
||||
into your public keyring. This is called "importing"
|
||||
|
||||
gpg --import [filenames]
|
||||
gpg --import [filenames]
|
||||
|
||||
New keys are appended to your keyring and already existing
|
||||
keys are updated. Note that GnuPG does not import keys that
|
||||
@ -223,7 +222,7 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
every other program used for management of cryptographic keys)
|
||||
provides other solutions.
|
||||
|
||||
gpg --fingerprint <username>
|
||||
gpg --fingerprint <username>
|
||||
|
||||
prints the so called "fingerprint" of the given username which
|
||||
is a sequence of hex bytes (which you may have noticed in mail
|
||||
@ -237,43 +236,43 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
Suppose however that friend of yours knows someone who knows someone
|
||||
who has met the owner of the public key at some computer conference.
|
||||
Suppose that all the people between you and the public key holder
|
||||
may now act as introducers to you. Introducers signing keys thereby
|
||||
may now act as introducers to you. Introducers signing keys thereby
|
||||
certify that they know the owner of the keys they sign. If you then
|
||||
trust all the introducers to have correctly signed other keys, you
|
||||
can be be sure that the other key really belongs to the one who
|
||||
claims to own it..
|
||||
|
||||
There are 2 steps to validate a key:
|
||||
1. First check that there is a complete chain
|
||||
of signed keys from the public key you want to use
|
||||
and your key and verify each signature.
|
||||
2. Make sure that you have full trust in the certificates
|
||||
of all the introduces between the public key holder and
|
||||
you.
|
||||
1. First check that there is a complete chain
|
||||
of signed keys from the public key you want to use
|
||||
and your key and verify each signature.
|
||||
2. Make sure that you have full trust in the certificates
|
||||
of all the introduces between the public key holder and
|
||||
you.
|
||||
Step 2 is the more complicated part because there is no easy way
|
||||
for a computer to decide who is trustworthy and who is not. GnuPG
|
||||
leaves this decision to you and will ask you for a trust value
|
||||
(here also referenced as the owner-trust of a key) for every key
|
||||
needed to check the chain of certificates. You may choose from:
|
||||
needed to check the chain of certificates. You may choose from:
|
||||
a) "I don't know" - then it is not possible to use any
|
||||
of the chains of certificates, in which this key is used
|
||||
as an introducer, to validate the target key. Use this if
|
||||
you don't know the introducer.
|
||||
of the chains of certificates, in which this key is used
|
||||
as an introducer, to validate the target key. Use this if
|
||||
you don't know the introducer.
|
||||
b) "I do not trust" - Use this if you know that the introducer
|
||||
does not do a good job in certifying other keys. The effect
|
||||
is the same as with a) but for a) you may later want to
|
||||
change the value because you got new information about this
|
||||
introducer.
|
||||
does not do a good job in certifying other keys. The effect
|
||||
is the same as with a) but for a) you may later want to
|
||||
change the value because you got new information about this
|
||||
introducer.
|
||||
c) "I trust marginally" - Use this if you assume that the
|
||||
introducer knows what he is doing. Together with some
|
||||
other marginally trusted keys, GnuPG validates the target
|
||||
key then as good.
|
||||
introducer knows what he is doing. Together with some
|
||||
other marginally trusted keys, GnuPG validates the target
|
||||
key then as good.
|
||||
d) "I fully trust" - Use this if you really know that this
|
||||
introducer does a good job when certifying other keys.
|
||||
If all the introducer are of this trust value, GnuPG
|
||||
normally needs only one chain of signatures to validate
|
||||
a target key okay. (But this may be adjusted with the help
|
||||
of some options).
|
||||
introducer does a good job when certifying other keys.
|
||||
If all the introducer are of this trust value, GnuPG
|
||||
normally needs only one chain of signatures to validate
|
||||
a target key okay. (But this may be adjusted with the help
|
||||
of some options).
|
||||
This information is confidential because it gives your personal
|
||||
opinion on the trustworthiness of someone else. Therefore this data
|
||||
is not stored in the keyring but in the "trustdb"
|
||||
@ -286,7 +285,7 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
Okay, here is how GnuPG helps you with key management. Most stuff
|
||||
is done with the --edit-key command
|
||||
|
||||
gpg --edit-key <keyid or username>
|
||||
gpg --edit-key <keyid or username>
|
||||
|
||||
GnuPG displays some information about the key and then prompts
|
||||
for a command (enter "help" to see a list of commands and see
|
||||
@ -326,37 +325,37 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
|
||||
* Only by the short keyid (prepend a zero if it begins with A..F):
|
||||
|
||||
"234567C4"
|
||||
"0F34E556E"
|
||||
"01347A56A"
|
||||
"0xAB123456
|
||||
"234567C4"
|
||||
"0F34E556E"
|
||||
"01347A56A"
|
||||
"0xAB123456
|
||||
|
||||
* By a complete keyid:
|
||||
|
||||
"234AABBCC34567C4"
|
||||
"0F323456784E56EAB"
|
||||
"01AB3FED1347A5612"
|
||||
"0x234AABBCC34567C4"
|
||||
"234AABBCC34567C4"
|
||||
"0F323456784E56EAB"
|
||||
"01AB3FED1347A5612"
|
||||
"0x234AABBCC34567C4"
|
||||
|
||||
* By a fingerprint:
|
||||
|
||||
"1234343434343434C434343434343434"
|
||||
"123434343434343C3434343434343734349A3434"
|
||||
"0E12343434343434343434EAB3484343434343434"
|
||||
"1234343434343434C434343434343434"
|
||||
"123434343434343C3434343434343734349A3434"
|
||||
"0E12343434343434343434EAB3484343434343434"
|
||||
|
||||
The first one is MD5 the others are ripemd160 or sha1.
|
||||
|
||||
* By an exact string:
|
||||
|
||||
"=Heinrich Heine <heinrichh@uni-duesseldorf.de>"
|
||||
"=Heinrich Heine <heinrichh@uni-duesseldorf.de>"
|
||||
|
||||
* By an email address:
|
||||
|
||||
"<heinrichh@uni-duesseldorf.de>"
|
||||
"<heinrichh@uni-duesseldorf.de>"
|
||||
|
||||
* By word match
|
||||
|
||||
"+Heinrich Heine duesseldorf"
|
||||
"+Heinrich Heine duesseldorf"
|
||||
|
||||
All words must match excatly (not case sensitive) and appear in
|
||||
any order in the user ID. Words are any sequences of letters,
|
||||
@ -364,15 +363,15 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
|
||||
* By the Local ID (from the trust DB):
|
||||
|
||||
"#34"
|
||||
"#34"
|
||||
|
||||
This may be used by a MUA to specify an exact key after selecting
|
||||
a key from GnuPG (by using a special option or an extra utility)
|
||||
|
||||
* Or by the usual substring:
|
||||
|
||||
"Heine"
|
||||
"*Heine"
|
||||
"Heine"
|
||||
"*Heine"
|
||||
|
||||
The '*' indicates substring search explicitly.
|
||||
|
||||
@ -400,22 +399,22 @@ The genkey1024 test will fail due to an expect problem :-(
|
||||
Esoteric commands
|
||||
-----------------
|
||||
|
||||
gpg --list-packets datafile
|
||||
gpg --list-packets datafile
|
||||
|
||||
Use this to list the contents of a data file. If the file is encrypted
|
||||
you are asked for the passphrase, so that GnuPG is able to look at the
|
||||
inner structure of a encrypted packet. This command should list all
|
||||
kinds of rfc2440 messages.
|
||||
|
||||
gpgm --list-trustdb
|
||||
gpgm --list-trustdb
|
||||
|
||||
List the contents of the trust DB in a human readable format
|
||||
|
||||
gpgm --list-trustdb <usernames>
|
||||
gpgm --list-trustdb <usernames>
|
||||
|
||||
List the tree of certificates for the given usernames
|
||||
|
||||
gpgm --list-trust-path username
|
||||
gpgm --list-trust-path username
|
||||
|
||||
List the possible trust paths for the given username. The length
|
||||
of such a trust path is limited by the option --max-cert-depth
|
||||
|
||||
7
TODO
7
TODO
@ -21,18 +21,15 @@
|
||||
* Add NO_PUBKEY and NO_SECKEY status lines.
|
||||
* Add more NODATA status lines
|
||||
|
||||
* Solaris make as problems with the generated POTFILES - seems to be a
|
||||
* Solaris make has problems with the generated POTFILES - seems to be a
|
||||
gettext bug.
|
||||
|
||||
* Need suffix rules for .S to produce .s for some systems
|
||||
|
||||
* do a chmod as soon as the secring is created. Print a warning if
|
||||
the directory mode is wrong.
|
||||
|
||||
|
||||
Nice to have
|
||||
------------
|
||||
* use DEL and ^H for erasing the previous character (util/ttyio.c).
|
||||
* Print a warning if the directory mode is wrong.
|
||||
* replace the keyserver stuff either by a call to a specialized
|
||||
utility or SOCKSify the stuff.
|
||||
* Do a real fix for bug #7 or document that it is a PGP 5 error.
|
||||
|
||||
@ -91,14 +91,7 @@ expect {
|
||||
timeout { exit 1 } }
|
||||
set timeout 600
|
||||
expect {
|
||||
-ex "\r \rWe need to generate a lot of random bytes. It is a good idea to perform\r
|
||||
some other action (work in another window, move the mouse, utilize the\r
|
||||
the disks) during the prime generation; this gives the random\r
|
||||
number generator a better chance to gain enough entropy.\r" {}
|
||||
timeout { exit 1 } }
|
||||
set timeout 600
|
||||
expect {
|
||||
-ex "public and secret key created and signed.\r" { exit 0 }
|
||||
-re "^.*\r\npublic and secret key" { exit 0 }
|
||||
eof { exit 1 }
|
||||
}
|
||||
exit 1
|
||||
|
||||
@ -1,3 +1,11 @@
|
||||
Fri Apr 9 12:26:25 CEST 1999 Werner Koch <wk@isil.d.shuttle.de>
|
||||
|
||||
* cipher.c (cipher_open): Reversed the changes for AUTO_CFB.
|
||||
|
||||
* blowfish.c: Dropped the Blowfish 160 mode.
|
||||
* cipher.c (cipher_open): Ditto.
|
||||
(setup_cipher_table): Ditto. And removed support of twofish128
|
||||
|
||||
Wed Apr 7 20:51:39 CEST 1999 Werner Koch <wk@isil.d.shuttle.de>
|
||||
|
||||
* random.c (get_random_bits): Can now handle requests > POOLSIZE
|
||||
|
||||
@ -42,7 +42,6 @@
|
||||
|
||||
|
||||
#define CIPHER_ALGO_BLOWFISH 4 /* blowfish 128 bit key */
|
||||
#define CIPHER_ALGO_BLOWFISH160 42 /* blowfish 160 bit key (not in OpenPGP)*/
|
||||
|
||||
#define FNCCAST_SETKEY(f) (int(*)(void*, byte*, unsigned))(f)
|
||||
#define FNCCAST_CRYPT(f) (void(*)(void*, byte*, byte*))(f)
|
||||
@ -582,7 +581,7 @@ blowfish_get_info( int algo, size_t *keylen,
|
||||
void (**r_decrypt)( void *c, byte *outbuf, byte *inbuf )
|
||||
)
|
||||
{
|
||||
*keylen = algo == CIPHER_ALGO_BLOWFISH ? 128 : 160;
|
||||
*keylen = 128;
|
||||
*blocksize = BLOWFISH_BLOCKSIZE;
|
||||
*contextsize = sizeof(BLOWFISH_context);
|
||||
*r_setkey = FNCCAST_SETKEY(bf_setkey);
|
||||
@ -591,8 +590,6 @@ blowfish_get_info( int algo, size_t *keylen,
|
||||
|
||||
if( algo == CIPHER_ALGO_BLOWFISH )
|
||||
return "BLOWFISH";
|
||||
if( algo == CIPHER_ALGO_BLOWFISH160 )
|
||||
return "BLOWFISH160";
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
||||
@ -127,28 +127,6 @@ setup_cipher_table(void)
|
||||
if( !cipher_table[i].name )
|
||||
BUG();
|
||||
i++;
|
||||
cipher_table[i].algo = CIPHER_ALGO_BLOWFISH160;
|
||||
cipher_table[i].name = blowfish_get_info( cipher_table[i].algo,
|
||||
&cipher_table[i].keylen,
|
||||
&cipher_table[i].blocksize,
|
||||
&cipher_table[i].contextsize,
|
||||
&cipher_table[i].setkey,
|
||||
&cipher_table[i].encrypt,
|
||||
&cipher_table[i].decrypt );
|
||||
if( !cipher_table[i].name )
|
||||
BUG();
|
||||
i++;
|
||||
cipher_table[i].algo = CIPHER_ALGO_TWOFISH_OLD;
|
||||
cipher_table[i].name = twofish_get_info( cipher_table[i].algo,
|
||||
&cipher_table[i].keylen,
|
||||
&cipher_table[i].blocksize,
|
||||
&cipher_table[i].contextsize,
|
||||
&cipher_table[i].setkey,
|
||||
&cipher_table[i].encrypt,
|
||||
&cipher_table[i].decrypt );
|
||||
if( !cipher_table[i].name )
|
||||
BUG();
|
||||
i++;
|
||||
cipher_table[i].algo = CIPHER_ALGO_DUMMY;
|
||||
cipher_table[i].name = "DUMMY";
|
||||
cipher_table[i].blocksize = 8;
|
||||
@ -362,8 +340,7 @@ cipher_open( int algo, int mode, int secure )
|
||||
if( algo == CIPHER_ALGO_DUMMY )
|
||||
hd->mode = CIPHER_MODE_DUMMY;
|
||||
else if( mode == CIPHER_MODE_AUTO_CFB ) {
|
||||
if( hd->blocksize > 8
|
||||
|| algo == CIPHER_ALGO_BLOWFISH160 || algo >= 100 )
|
||||
if( algo >= 100 )
|
||||
hd->mode = CIPHER_MODE_CFB;
|
||||
else
|
||||
hd->mode = CIPHER_MODE_PHILS_CFB;
|
||||
|
||||
@ -2,6 +2,9 @@
|
||||
* By Matthew Skala <mskala@ansuz.sooke.bc.ca>, July 26, 1998
|
||||
* 256-bit key length added March 20, 1999
|
||||
*
|
||||
* The original author has disclaimed all copyright interest in this
|
||||
* code and thus putting it in the public domain.
|
||||
*
|
||||
* This code is a "clean room" implementation, written from the paper
|
||||
* _Twofish: A 128-Bit Block Cipher_ by Bruce Schneier, John Kelsey,
|
||||
* Doug Whiting, David Wagner, Chris Hall, and Niels Ferguson, available
|
||||
|
||||
13
doc/DETAILS
13
doc/DETAILS
@ -111,13 +111,26 @@ more arguments in future versions.
|
||||
NEED_PASSPHRASE_SYM <cipher_algo> <s2k_mode> <s2k_hash>
|
||||
Issued whenever a passphrase for symmetric encryption is needed.
|
||||
|
||||
MISSING_PASSPHRASE
|
||||
|
||||
BAD_PASSPHRASE <long keyid>
|
||||
The supplied passphrase was wrong
|
||||
|
||||
GOOD_PASSPHRASE
|
||||
The supplied passphrase was good and the secret key material
|
||||
is therefore usuable.
|
||||
|
||||
DECRYPTION_FAILED
|
||||
The symmetric decryption failed - one reason could be a wrong
|
||||
passphrase for a symmetrical encrypted message.
|
||||
|
||||
DECRYPTION_OKAY
|
||||
The decryption process succeeded. This means, that either the
|
||||
correct secret key has been used or the correct passphrase
|
||||
for a conventional encrypted message was given. The program
|
||||
itself may return an errorcode becuase it may not be possible to
|
||||
verify a signature for some reasons.
|
||||
|
||||
NO_PUBKEY <long keyid>
|
||||
NO_SECKEY <long keyid>
|
||||
The key is not available
|
||||
|
||||
@ -1,3 +1,14 @@
|
||||
Fri Apr 9 12:26:25 CEST 1999 Werner Koch <wk@isil.d.shuttle.de>
|
||||
|
||||
* status.c (write_status_text): Some more status codes.
|
||||
* passphrase_to_dek (passphrase_to_dek): add a status code.
|
||||
* seckey_cert.c (check_secret_key): Likewise.
|
||||
|
||||
* encr-data.c (decrypt_data): Reverse the last changes
|
||||
* cipher.c (write_header): Ditto.
|
||||
|
||||
* parse-packet.c (parse_key): Dropped kludge for ancient blowfish mode.
|
||||
|
||||
Thu Apr 8 09:35:53 CEST 1999 Werner Koch <wk@isil.d.shuttle.de>
|
||||
|
||||
* mainproc.c (proc_encrypted): Add a new status output
|
||||
|
||||
@ -58,10 +58,7 @@ write_header( cipher_filter_context_t *cfx, IOBUF a )
|
||||
blocksize = cipher_get_blocksize( cfx->dek->algo );
|
||||
if( blocksize < 8 || blocksize > 16 )
|
||||
log_fatal("unsupported blocksize %u\n", blocksize );
|
||||
/* FIXME: remove the kludge for the experimental twofish128 mode:
|
||||
* we always use the 10 byte prefix and not one depending on the blocksize
|
||||
*/
|
||||
nprefix = cfx->dek->algo == CIPHER_ALGO_TWOFISH_OLD? blocksize : 8;
|
||||
nprefix = blocksize;
|
||||
randomize_buffer( temp, nprefix, 1 );
|
||||
temp[nprefix] = temp[nprefix-2];
|
||||
temp[nprefix+1] = temp[nprefix-1];
|
||||
|
||||
@ -66,10 +66,7 @@ decrypt_data( PKT_encrypted *ed, DEK *dek )
|
||||
blocksize = cipher_get_blocksize(dek->algo);
|
||||
if( !blocksize || blocksize > 16 )
|
||||
log_fatal("unsupported blocksize %u\n", blocksize );
|
||||
/* FIXME: remove the kludge for the experimental twofish128 mode:
|
||||
* we always use the 10 byte prefix and not one depending on the blocksize
|
||||
*/
|
||||
nprefix = dek->algo == CIPHER_ALGO_TWOFISH_OLD? blocksize : 8;
|
||||
nprefix = blocksize;
|
||||
if( ed->len && ed->len < (nprefix+2) )
|
||||
BUG();
|
||||
|
||||
|
||||
@ -988,6 +988,10 @@ merge_blocks( const char *fname, KBNODE keyblock_orig, KBNODE keyblock,
|
||||
/****************
|
||||
* append the userid starting with NODE and all signatures to KEYBLOCK.
|
||||
* Mark all new and copied packets by setting flag bit 0.
|
||||
* FIXME: It may happen that two identical user ID gets imported; should we
|
||||
* add another check and how can we handle the signature? Maybe
|
||||
* we have to collapse both UIDs into one and then remove duplicated
|
||||
* signatures.
|
||||
*/
|
||||
static int
|
||||
append_uid( KBNODE keyblock, KBNODE node, int *n_sigs,
|
||||
|
||||
@ -241,6 +241,7 @@ proc_encrypted( CTX c, PACKET *pkt )
|
||||
if( result == -1 )
|
||||
;
|
||||
else if( !result ) {
|
||||
write_status( STATUS_DECRYPTION_OKAY );
|
||||
if( opt.verbose > 1 )
|
||||
log_info(_("decryption okay\n"));
|
||||
}
|
||||
|
||||
@ -1305,11 +1305,7 @@ parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
|
||||
}
|
||||
else { /* old version; no S2K, so we set mode to 0, hash MD5 */
|
||||
sk->protect.s2k.mode = 0;
|
||||
/* We need a kludge to cope with old GNUPG versions */
|
||||
sk->protect.s2k.hash_algo =
|
||||
( sk->protect.algo == CIPHER_ALGO_BLOWFISH160
|
||||
&& algorithm == PUBKEY_ALGO_ELGAMAL_E ) ?
|
||||
DIGEST_ALGO_RMD160 : DIGEST_ALGO_MD5;
|
||||
sk->protect.s2k.hash_algo = DIGEST_ALGO_MD5;
|
||||
if( list_mode )
|
||||
printf( "\tprotect algo: %d (hash algo: %d)\n",
|
||||
sk->protect.algo, sk->protect.s2k.hash_algo );
|
||||
|
||||
@ -201,6 +201,10 @@ passphrase_to_dek( u32 *keyid, int cipher_algo, STRING2KEY *s2k, int mode )
|
||||
m_free(pw2);
|
||||
}
|
||||
}
|
||||
|
||||
if( !pw || !*pw )
|
||||
write_status( STATUS_MISSING_PASSPHRASE );
|
||||
|
||||
dek = m_alloc_secure( sizeof *dek );
|
||||
dek->algo = cipher_algo;
|
||||
if( !*pw && mode == 2 )
|
||||
|
||||
@ -187,6 +187,9 @@ check_secret_key( PKT_secret_key *sk, int n )
|
||||
break;
|
||||
}
|
||||
|
||||
if( !rc )
|
||||
write_status( STATUS_GOOD_PASSPHRASE );
|
||||
|
||||
return rc;
|
||||
}
|
||||
|
||||
|
||||
@ -106,6 +106,9 @@ write_status_text ( int no, const char *text)
|
||||
case STATUS_NO_SECKEY : s = "NO_SECKEY\n"; break;
|
||||
case STATUS_NEED_PASSPHRASE_SYM: s = "NEED_PASSPHRASE_SYM\n"; break;
|
||||
case STATUS_DECRYPTION_FAILED: s = "DECRYPTION_FAILED\n"; break;
|
||||
case STATUS_DECRYPTION_OKAY: s = "DECRYPTION_OKAY\n"; break;
|
||||
case STATUS_MISSING_PASSPHRASE: s = "MISSING_PASSPHRASE\n"; break;
|
||||
case STATUS_GOOD_PASSPHRASE : s = "GOOD_PASSPHRASE\n"; break;
|
||||
default: s = "?\n"; break;
|
||||
}
|
||||
|
||||
|
||||
@ -57,6 +57,9 @@
|
||||
#define STATUS_NO_SECKEY 27
|
||||
#define STATUS_NEED_PASSPHRASE_SYM 28
|
||||
#define STATUS_DECRYPTION_FAILED 29
|
||||
#define STATUS_DECRYPTION_OKAY 30
|
||||
#define STATUS_MISSING_PASSPHRASE 31
|
||||
#define STATUS_GOOD_PASSPHRASE 32
|
||||
|
||||
/*-- status.c --*/
|
||||
void set_status_fd ( int fd );
|
||||
|
||||
@ -1,3 +1,7 @@
|
||||
Fri Apr 9 12:26:25 CEST 1999 Werner Koch <wk@isil.d.shuttle.de>
|
||||
|
||||
* cipher.h (BLOWFISH160): Removed.
|
||||
|
||||
Tue Apr 6 19:58:12 CEST 1999 Werner Koch <wk@isil.d.shuttle.de>
|
||||
|
||||
* cipher.h (DEK): increased max. key length to 32 bytes
|
||||
|
||||
@ -34,7 +34,6 @@
|
||||
#define CIPHER_ALGO_SAFER_SK128 5
|
||||
#define CIPHER_ALGO_DES_SK 6
|
||||
#define CIPHER_ALGO_TWOFISH 10 /* twofish 256 bit */
|
||||
#define CIPHER_ALGO_BLOWFISH160 42 /* blowfish 160 bit key (not in OpenPGP)*/
|
||||
#define CIPHER_ALGO_SKIPJACK 101 /* experimental: skipjack */
|
||||
#define CIPHER_ALGO_TWOFISH_OLD 102 /* experimental: twofish 128 bit */
|
||||
#define CIPHER_ALGO_DUMMY 110 /* no encryption at all */
|
||||
|
||||
@ -123,20 +123,19 @@ static void check_allmem( const char *info );
|
||||
static void
|
||||
add_entry( byte *p, unsigned n, int mode, const char *info, const char *by )
|
||||
{
|
||||
unsigned index;
|
||||
unsigned idx;
|
||||
struct memtbl_entry *e;
|
||||
struct info_entry *ie;
|
||||
|
||||
if( memtbl_len < memtbl_size )
|
||||
index = memtbl_len++;
|
||||
idx = memtbl_len++;
|
||||
else {
|
||||
struct memtbl_entry *e;
|
||||
/* look for a used entry in the table. We take the first one,
|
||||
* so that freed entries remain as long as possible in the table
|
||||
* (free appends a new one)
|
||||
*/
|
||||
if( (e = memtbl_unused) ) {
|
||||
index = e - memtbl;
|
||||
idx = e - memtbl;
|
||||
memtbl_unused = e->next;
|
||||
e->next = NULL;
|
||||
}
|
||||
@ -145,32 +144,33 @@ add_entry( byte *p, unsigned n, int mode, const char *info, const char *by )
|
||||
memtbl_size = 100;
|
||||
if( !(memtbl = calloc( memtbl_size, sizeof *memtbl )) )
|
||||
membug("memory debug table malloc failed\n");
|
||||
index = 0;
|
||||
idx = 0;
|
||||
memtbl_len = 1;
|
||||
atexit( dump_table_at_exit );
|
||||
}
|
||||
else { /* realloc */
|
||||
unsigned n = memtbl_size / 4; /* enlarge by 25% */
|
||||
if(!(memtbl = realloc(memtbl, (memtbl_size+n)*sizeof *memtbl)))
|
||||
unsigned nn = memtbl_size / 4; /* enlarge by 25% */
|
||||
if(!(memtbl = realloc(memtbl, (memtbl_size+nn)*sizeof *memtbl)))
|
||||
membug("memory debug table realloc failed\n");
|
||||
memset(memtbl+memtbl_size, 0, n*sizeof *memtbl );
|
||||
memtbl_size += n;
|
||||
index = memtbl_len++;
|
||||
memtbl_size += nn;
|
||||
idx = memtbl_len++;
|
||||
}
|
||||
}
|
||||
}
|
||||
e = memtbl+index;
|
||||
e = memtbl+idx;
|
||||
if( e->inuse )
|
||||
membug("Ooops: entry %u is flagged as in use\n", index);
|
||||
membug("Ooops: entry %u is flagged as in use\n", idx);
|
||||
e->user_p = p + 4;
|
||||
e->user_n = n;
|
||||
e->count++;
|
||||
if( e->next )
|
||||
membug("Ooops: entry is in free entry list\n");
|
||||
/* do we already have this info string */
|
||||
for( ie = info_strings[info_hash(info)]; ie; ie = ie->next )
|
||||
for( ie = info_strings[info_hash(info)]; ie; ie = ie->next ) {
|
||||
if( ie->info == info )
|
||||
break;
|
||||
}
|
||||
if( !ie ) { /* no: make a new entry */
|
||||
if( !(ie = malloc( sizeof *ie )) )
|
||||
membug("can't allocate info entry\n");
|
||||
@ -184,9 +184,9 @@ add_entry( byte *p, unsigned n, int mode, const char *info, const char *by )
|
||||
e->inuse = 1;
|
||||
|
||||
/* put the index at the start of the memory */
|
||||
p[0] = index;
|
||||
p[1] = index >> 8 ;
|
||||
p[2] = index >> 16 ;
|
||||
p[0] = idx;
|
||||
p[1] = idx >> 8 ;
|
||||
p[2] = idx >> 16 ;
|
||||
p[3] = mode? MAGIC_SEC_BYTE : MAGIC_NOR_BYTE ;
|
||||
if( DBG_MEMORY )
|
||||
log_debug( "%s allocates %u bytes using %s\n", info, e->user_n, by );
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user