mirror of
git://git.gnupg.org/gnupg.git
synced 2025-02-07 17:33:02 +01:00
agent: Convert key format document to org.
* agent/keyformat.txt: Convert to org mode. Signed-off-by: Justus Winter <justus@g10code.com>
This commit is contained in:
parent
0c35e09278
commit
342cc48889
@ -1,11 +1,11 @@
|
|||||||
keyformat.txt (wk 2001-12-18)
|
keyformat.txt emacs, please switch to -*- org -*- mode
|
||||||
-----------------------------
|
-------------
|
||||||
|
|
||||||
|
|
||||||
Some notes on the format of the secret keys used with gpg-agent.
|
Some notes on the format of the secret keys used with gpg-agent.
|
||||||
|
|
||||||
Location of keys
|
* Location of keys
|
||||||
================
|
|
||||||
The secret keys[1] are stored on a per file basis in a directory below
|
The secret keys[1] are stored on a per file basis in a directory below
|
||||||
the ~/.gnupg home directory. This directory is named
|
the ~/.gnupg home directory. This directory is named
|
||||||
|
|
||||||
@ -16,9 +16,8 @@ and should have permissions 700.
|
|||||||
The secret keys are stored in files with a name matching the
|
The secret keys are stored in files with a name matching the
|
||||||
hexadecimal representation of the keygrip[2] and suffixed with ".key".
|
hexadecimal representation of the keygrip[2] and suffixed with ".key".
|
||||||
|
|
||||||
|
* Unprotected Private Key Format
|
||||||
|
|
||||||
Unprotected Private Key Format
|
|
||||||
==============================
|
|
||||||
The content of the file is an S-Expression like the ones used with
|
The content of the file is an S-Expression like the ones used with
|
||||||
Libgcrypt. Here is an example of an unprotected file:
|
Libgcrypt. Here is an example of an unprotected file:
|
||||||
|
|
||||||
@ -43,9 +42,8 @@ optional but required for some operations to calculate the fingerprint
|
|||||||
of the key. This timestamp should be a string with the number of
|
of the key. This timestamp should be a string with the number of
|
||||||
seconds since Epoch or an ISO time string (yyyymmddThhmmss).
|
seconds since Epoch or an ISO time string (yyyymmddThhmmss).
|
||||||
|
|
||||||
|
* Protected Private Key Format
|
||||||
|
|
||||||
Protected Private Key Format
|
|
||||||
==============================
|
|
||||||
A protected key is like this:
|
A protected key is like this:
|
||||||
|
|
||||||
(protected-private-key
|
(protected-private-key
|
||||||
@ -69,7 +67,7 @@ optional; the isotimestamp is 15 bytes long (e.g. "19610711T172000").
|
|||||||
|
|
||||||
The currently defined protection modes are:
|
The currently defined protection modes are:
|
||||||
|
|
||||||
1. openpgp-s2k3-sha1-aes-cbc
|
** openpgp-s2k3-sha1-aes-cbc
|
||||||
|
|
||||||
This describes an algorithm using using AES in CBC mode for
|
This describes an algorithm using using AES in CBC mode for
|
||||||
encryption, SHA-1 for integrity protection and the String to Key
|
encryption, SHA-1 for integrity protection and the String to Key
|
||||||
@ -118,7 +116,7 @@ The currently defined protection modes are:
|
|||||||
the stored one - If they don't match the integrity of the key is not
|
the stored one - If they don't match the integrity of the key is not
|
||||||
given.
|
given.
|
||||||
|
|
||||||
2. openpgp-s2k3-ocb-aes
|
** openpgp-s2k3-ocb-aes
|
||||||
|
|
||||||
This describes an algorithm using using AES-128 in OCB mode, a nonce
|
This describes an algorithm using using AES-128 in OCB mode, a nonce
|
||||||
of 96 bit, a taglen of 128 bit, and the String to Key algorithm 3
|
of 96 bit, a taglen of 128 bit, and the String to Key algorithm 3
|
||||||
@ -156,8 +154,7 @@ The currently defined protection modes are:
|
|||||||
(protected-at "18950523T000000")
|
(protected-at "18950523T000000")
|
||||||
)
|
)
|
||||||
|
|
||||||
|
** openpgp-native
|
||||||
3. openpgp-native
|
|
||||||
|
|
||||||
This is a wrapper around the OpenPGP Private Key Transport format
|
This is a wrapper around the OpenPGP Private Key Transport format
|
||||||
which resembles the standard OpenPGP format and allows the use of an
|
which resembles the standard OpenPGP format and allows the use of an
|
||||||
@ -194,10 +191,8 @@ The currently defined protection modes are:
|
|||||||
(uri http://foo.bar x-foo:whatever_you_want)
|
(uri http://foo.bar x-foo:whatever_you_want)
|
||||||
(comment whatever))
|
(comment whatever))
|
||||||
|
|
||||||
|
* Shadowed Private Key Format
|
||||||
|
|
||||||
|
|
||||||
Shadowed Private Key Format
|
|
||||||
============================
|
|
||||||
To keep track of keys stored on IC cards we use a third format for
|
To keep track of keys stored on IC cards we use a third format for
|
||||||
private kyes which are called shadow keys as they are only a reference
|
private kyes which are called shadow keys as they are only a reference
|
||||||
to keys stored on a token:
|
to keys stored on a token:
|
||||||
@ -224,9 +219,7 @@ readers don't allow passing a variable length PIN.
|
|||||||
|
|
||||||
More items may be added to the list.
|
More items may be added to the list.
|
||||||
|
|
||||||
|
* OpenPGP Private Key Transfer Format
|
||||||
OpenPGP Private Key Transfer Format
|
|
||||||
===================================
|
|
||||||
|
|
||||||
This format is used to transfer keys between gpg and gpg-agent.
|
This format is used to transfer keys between gpg and gpg-agent.
|
||||||
|
|
||||||
@ -239,28 +232,26 @@ This format is used to transfer keys between gpg and gpg-agent.
|
|||||||
(protection PROTTYPE PROTALGO IV S2KMODE S2KHASH S2KSALT S2KCOUNT))
|
(protection PROTTYPE PROTALGO IV S2KMODE S2KHASH S2KSALT S2KCOUNT))
|
||||||
|
|
||||||
|
|
||||||
* V is the packet version number (3 or 4).
|
* V is the packet version number (3 or 4).
|
||||||
* PUBKEYALGO is a Libgcrypt algo name
|
* PUBKEYALGO is a Libgcrypt algo name
|
||||||
* CURVENAME is the name of the curve - only used with ECC.
|
* CURVENAME is the name of the curve - only used with ECC.
|
||||||
* P1 .. PN are the parameters; the public parameters are never encrypted
|
* P1 .. PN are the parameters; the public parameters are never encrypted
|
||||||
the secrect key parameters are encrypted if the "protection" list is
|
the secrect key parameters are encrypted if the "protection" list is
|
||||||
given. To make this more explicit each parameter is preceded by a
|
given. To make this more explicit each parameter is preceded by a
|
||||||
flag "_" for cleartext or "e" for encrypted text.
|
flag "_" for cleartext or "e" for encrypted text.
|
||||||
* CSUM is the deprecated 16 bit checksum as defined by OpenPGP. This
|
* CSUM is the deprecated 16 bit checksum as defined by OpenPGP. This
|
||||||
is an optional element.
|
is an optional element.
|
||||||
* If PROTTYPE is "sha1" the new style SHA1 checksum is used if it is "sum"
|
* If PROTTYPE is "sha1" the new style SHA1 checksum is used if it is "sum"
|
||||||
the old 16 bit checksum (above) is used and if it is "none" no
|
the old 16 bit checksum (above) is used and if it is "none" no
|
||||||
protection at all is used.
|
protection at all is used.
|
||||||
* PROTALGO is a Libgcrypt style cipher algorithm name
|
* PROTALGO is a Libgcrypt style cipher algorithm name
|
||||||
* IV is the initialization verctor.
|
* IV is the initialization verctor.
|
||||||
* S2KMODE is the value from RFC-4880.
|
* S2KMODE is the value from RFC-4880.
|
||||||
* S2KHASH is a a libgcrypt style hash algorithm identifier.
|
* S2KHASH is a a libgcrypt style hash algorithm identifier.
|
||||||
* S2KSALT is the 8 byte salt
|
* S2KSALT is the 8 byte salt
|
||||||
* S2KCOUNT is the count value from RFC-4880.
|
* S2KCOUNT is the count value from RFC-4880.
|
||||||
|
|
||||||
|
* Persistent Passphrase Format
|
||||||
Persistent Passphrase Format
|
|
||||||
============================
|
|
||||||
|
|
||||||
Note: That this has not yet been implemented.
|
Note: That this has not yet been implemented.
|
||||||
|
|
||||||
@ -355,14 +346,8 @@ hashed:
|
|||||||
(protected-at "20100915T111722")
|
(protected-at "20100915T111722")
|
||||||
)
|
)
|
||||||
|
|
||||||
|
* Notes
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Notes:
|
|
||||||
======
|
|
||||||
[1] I usually use the terms private and secret key exchangeable but prefer the
|
[1] I usually use the terms private and secret key exchangeable but prefer the
|
||||||
term secret key because it can be visually be better distinguished
|
term secret key because it can be visually be better distinguished
|
||||||
from the term public key.
|
from the term public key.
|
||||||
|
Loading…
x
Reference in New Issue
Block a user