security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-02 22:46:30 +02:00
Code Activity

gpg: New option --override-session-key-fd.

Browse source 
* g10/gpg.c (oOverrideSessionKeyFD): New.
(opts): Add option --override-session-key-fd.
(main): Handle that option.
(read_sessionkey_from_fd): New.
--

The override-session-key feature was designed to mitigate the effect
of the British RIP act by allowing to keep the private key private and
hand out only a session key.  For that use case the leaking of the
session key would not be a problem.  However there are other use
cases, for example fast re-decryption after an initial decryption,
which would benefit from concealing the session key from other users.

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2016-11-16 09:02:53 +01:00
parent 500e594c2d
commit 43bfaf2c54
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
2 changed files with 53 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
doc/gpg.texi
View file

@ -3118,13 +3118,17 @@ inappropriate plaintext so they can take action against the offending
user.
@item --override-session-key @code{string}
@itemx --override-session-key-fd @code{fd}
@opindex override-session-key
Don't use the public key but the session key @code{string}. The format
of this string is the same as the one printed by
@option{--show-session-key}. This option is normally not used but comes
handy in case someone forces you to reveal the content of an encrypted
message; using this option you can do this without handing out the
secret key.
Don't use the public key but the session key @code{string} respective
the session key taken from the first line read from file descriptor
@code{fd}. The format of this string is the same as the one printed
by @option{--show-session-key}. This option is normally not used but
comes handy in case someone forces you to reveal the content of an
encrypted message; using this option you can do this without handing
out the secret key. Note that using @option{--override-session-key}
may reveal the session key to all local users via the global process
table.
@item --ask-sig-expire
@itemx --no-ask-sig-expire