security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-02 22:46:30 +02:00
Code Activity

gpg: Allow only OCB for AEAD encryption.

Browse source 
* g10/gpg.c (opts): New option--force-ocb as alias for force-aead.
Turn --aead-algo and --personal-aead-preferences into dummy options.
(build_list_md_test_algo, build_list_aead_algo_name): Remove.
(my_strusage): Remove output of AEAD algos.
(main): Remove code from the --aead options.
* g10/encrypt.c (encrypt_seskey): Make file local.
(use_aead): Remove requirement for rfc4880bis.  Always return
AEAD_ALGO_OCB.
* g10/main.h (DEFAULT_AEAD_ALGO): Removed unused macro.
* g10/misc.c (default_aead_algo): Remove.
* g10/pkclist.c (select_aead_from_pklist): Return AEAD_ALGO_OCB or 0.
(select_algo_from_prefs): Remove personal AEAD algo setting.
* g10/keygen.c (keygen_set_std_prefs): Remove AEAD preference option
parsing.
* g10/options.h (opt): Remove def_aead_algo and personal_aead_prefs.
--

Due to the meanwhile expired patent on OCB there is no more reason for
using EAX.  Thus we forcefully use OCB if the AEAD feature flag is set
on a key.
This commit is contained in:
Werner Koch 2022-10-31 15:51:21 +01:00
parent 03f04dfb9a
commit 5a2cef801d
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
8 changed files with 20 additions and 140 deletions
Download patch file Download diff file Expand all files Collapse all files

12
g10/encrypt.c
View file

@ -219,7 +219,7 @@ check_encryption_compliance (DEK *dek, pk_list_t pk_list)
* stored at R_SESKEY. If AEAD_ALGO is not 0 the given AEAD algorithm
* is used for encryption.
*/
gpg_error_t
static gpg_error_t
encrypt_seskey (DEK *dek, aead_algo_t aead_algo,
DEK **r_seskey, void **r_enckey, size_t *r_enckeylen)
{
@ -344,14 +344,6 @@ use_aead (pk_list_t pk_list, int algo)
{
int can_use;
if (!opt.flags.rfc4880bis)
{
if (opt.force_aead)
log_info ("Warning: Option %s currently requires option '%s'\n",
"--force-aead", "--rfc4880bis");
return 0;
}
can_use = openpgp_cipher_get_algo_blklen (algo) == 16;
/* With --force-aead we want AEAD. */
@ -363,7 +355,7 @@ use_aead (pk_list_t pk_list, int algo)
openpgp_cipher_algo_name (algo));
return 0;
}
return default_aead_algo ();
return AEAD_ALGO_OCB;
}
/* AEAD does only work with 128 bit cipher blocklength. */