security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-01-21 14:47:03 +01:00
Code Activity

scd:openpgp: Print a diagnostic for the use of default ECDH params.

Browse Source 
* scd/app-openpgp.c (ecc_writekey): Remove the useless check and print
a diagnostic if the default params are used.
--

Note that here in 2.2 we use different default ECDH parameters than in
2.4 (AES192 instead of AES256 for 384 bit curves).

GnuPG-bug-id: 6378
This commit is contained in:
Werner Koch 2023-11-23 16:04:52 +01:00
parent 4c700e3afe
commit 1d472e4934
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
1 changed files with 7 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
scd/app-openpgp.c
View File

@ -355,6 +355,7 @@ do_deinit (app_t app)
* we do not need this if the buffer has been allocated in secure * we do not need this if the buffer has been allocated in secure
* memory. However at some places we can't make that sure and thus we * memory. However at some places we can't make that sure and thus we
* better to an extra wipe here. */ * better to an extra wipe here. */
#if 0 /* Not yet used. */
static void static void
wipe_and_free (void *p, size_t len) wipe_and_free (void *p, size_t len)
{ {
@ -365,10 +366,11 @@ wipe_and_free (void *p, size_t len)
xfree (p); xfree (p);
} }
} }
#endif
/* Similar to wipe_and_free but assumes P is eitehr NULL or a proper /* Similar to wipe_and_free but assumes P is eitehr NULL or a proper
* string. */ * string. */
#if 0 /* Not yet used. */
static void static void
wipe_and_free_string (char *p) wipe_and_free_string (char *p)
{ {
@ -378,7 +380,7 @@ wipe_and_free_string (char *p)
xfree (p); xfree (p);
} }
} }
#endif
/* Wrapper around iso7816_get_data which first tries to get the data /* Wrapper around iso7816_get_data which first tries to get the data
from the cache. With GET_IMMEDIATE passed as true, the cache is from the cache. With GET_IMMEDIATE passed as true, the cache is
@ -4487,20 +4489,15 @@ ecc_writekey (app_t app, ctrl_t ctrl,
else else
algo = PUBKEY_ALGO_ECDSA; algo = PUBKEY_ALGO_ECDSA;
/* Not provided by GnuPG 2.2 - take the default value. */
if (algo == PUBKEY_ALGO_ECDH && !ecdh_param) if (algo == PUBKEY_ALGO_ECDH && !ecdh_param)
{ {
/* In case this is used by older clients we fallback to our
* default ecc parameters. */
log_info ("opgp: using default ecdh parameters\n");
ecdh_param = ecdh_params (curve); ecdh_param = ecdh_params (curve);
ecdh_param_len = 4; ecdh_param_len = 4;
} }
if (algo == PUBKEY_ALGO_ECDH && !ecdh_param)
{
log_error ("opgp: ecdh parameters missing\n");
err = gpg_error (GPG_ERR_INV_VALUE);
goto leave;
}
oidstr = openpgp_curve_to_oid (curve, &n, NULL); oidstr = openpgp_curve_to_oid (curve, &n, NULL);
ecc_d_fixed_len = (n+7)/8; ecc_d_fixed_len = (n+7)/8;
err = openpgp_oid_from_str (oidstr, &oid); err = openpgp_oid_from_str (oidstr, &oid);