security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-22 10:19:57 +01:00
Code Activity

agent: Improve the GENPIN callback.

Browse Source 
* agent/call-pinentry.c (DEFAULT_GENPIN_BYTES): Replace by  ...
(DEFAULT_GENPIN_BITS): this and increase to 150.
(generate_pin): Make sure that we use at least 128 bits.
This commit is contained in:
Werner Koch 2021-08-18 11:23:23 +02:00
parent 9fb6466602
commit 8ed7910347
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
1 changed files with 14 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
agent/call-pinentry.c
View File

@ -55,8 +55,12 @@
/* Define the maximum tries to generate a pin for the GENPIN inquire */ /* Define the maximum tries to generate a pin for the GENPIN inquire */
#define MAX_GENPIN_TRIES 10 #define MAX_GENPIN_TRIES 10
/* Define the number of characters to use for a generated pin */ /* Define the number of bits to use for a generated pin. The
#define DEFAULT_GENPIN_BYTES (128 / 8) * passphrase will be rendered as zbase32 which results for 150 bits
* in a string of 30 characters. That fits nicely into the 5
* character blocking which pinentry can do. 128 bits would actually
* be sufficient but can't be formatted nicely. */
#define DEFAULT_GENPIN_BITS 150
/* The assuan context of the current pinentry. */ /* The assuan context of the current pinentry. */
static assuan_context_t entry_ctx; static assuan_context_t entry_ctx;
@ -846,18 +850,19 @@ estimate_passphrase_quality (const char *pw)
/* Generate a random passphrase in zBase32 encoding (RFC-6189) to be /* Generate a random passphrase in zBase32 encoding (RFC-6189) to be
* used by pinetry to suggest a passphrase. */ * used by Pinentry to suggest a passphrase. */
static char * static char *
generate_pin (void) generate_pin (void)
{ {
size_t nbytes = opt.min_passphrase_len; unsigned int nbits = opt.min_passphrase_len * 8;
size_t nbytes;
void *rand; void *rand;
char *generated; char *generated;
if (nbytes < 8) if (nbits < 128)
{ nbits = DEFAULT_GENPIN_BITS;
nbytes = DEFAULT_GENPIN_BYTES;
} nbytes = (nbits + 7) / 8;
rand = gcry_random_bytes_secure (nbytes, GCRY_STRONG_RANDOM); rand = gcry_random_bytes_secure (nbytes, GCRY_STRONG_RANDOM);
if (!rand) if (!rand)
@ -866,7 +871,7 @@ generate_pin (void)
return NULL; return NULL;
} }
generated = zb32_encode (rand, nbytes * 8); generated = zb32_encode (rand, nbits);
gcry_free (rand); gcry_free (rand);
return generated; return generated;
} }