security-and-privacy/gnupg
security-and-privacy
/
gnupg
mirror of git://git.gnupg.org/gnupg.git
1
0
Fork 0
Code Activity

gpg: Check that a key may do certifications. 

* g10/sig-check.c (check_signature_end_simple): Check key usage for
certifications.
(check_signature_over_key_or_uid): Request usage certification.
--

GnuPG-bug-id: 3844
Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2018-04-06 11:04:04 +02:00
parent 0336e5d1a7
commit 1a5d95e731
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
g10/sig-check.c
View File

@ -464,6 +464,24 @@ check_signature_end_simple (PKT_public_key *pk, PKT_signature *sig,
}
}
/* For key signatures check that the key has a cert usage. We may
* do this only for subkeys because the primary may always issue key
* signature. The latter may not be reflected in the pubkey_usage
* field because we need to check the key signatures to extract the
* key usage. */
if (!pk->flags.primary
&& IS_CERT (sig) && !(pk->pubkey_usage & PUBKEY_USAGE_CERT))
{
rc = gpg_error (GPG_ERR_WRONG_KEY_USAGE);
if (!opt.quiet)
log_info (_("bad key signature from key %s: %s (0x%02x, 0x%x)\n"),
keystr_from_pk (pk), gpg_strerror (rc),
sig->sig_class, pk->pubkey_usage);
return rc;
}
/* Fixme: Should we also check the signing capability here for data
* signature? */
/* Make sure the digest algo is enabled (in case of a detached
* signature). */
gcry_md_enable (digest, sig->digest_algo);
@ -893,6 +911,9 @@ check_signature_over_key_or_uid (ctrl_t ctrl, PKT_public_key *signer,
signer_alloced = 2;
}
if (IS_CERT (sig))
signer->req_usage = PUBKEY_USAGE_CERT;
rc = get_pubkey (ctrl, signer, sig->keyid);
if (rc)
{