security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

kbx: Redefine the UBID which is now the primary fingerprint.

Browse source 
* common/util.h (UBID_LEN): New.  Use it at all places.
* kbx/keybox-blob.c (create_blob_finish): Do not write the UBID item.
* kbx/keybox-dump.c (print_ubib): Remove.
(_keybox_dump_blob): Do not print the now removed ubid flag.
* kbx/keybox-search-desc.h (struct keydb_search_desc): Use constants
for the size of the ubid and grip.
* kbx/keybox-search.c (blob_cmp_ubid): New.
(has_ubid): Make it a simple wrapper around blob_cmp_ubid.
(keybox_get_data): Add arg 'r_ubid'.

* kbx/frontend.h (enum kbxd_store_modes): New.
* kbx/kbxserver.c (cmd_store): Add new option --insert.

* kbx/backend-cache.c (be_cache_initialize): New.
(be_cache_add_resource): Call it here.
* kbx/backend-kbx.c (be_kbx_seek): Remove args 'fpr' and 'fprlen'.
(be_kbx_search): Get the UBID from keybox_get_data.
* kbx/backend-support.c (be_fingerprint_from_blob): Replace by ...
(be_ubid_from_blob): new.  Change all callers.

* kbx/frontend.c (kbxd_add_resource): Temporary disable the cache but
use the new cache init function.
(kbxd_store): Replace arg 'only_update' by 'mode'.  Seek using the
ubid.  Take care of the mode.
--

It turned out that using the hash of the entire blob was not helpful.
Thus we redefine the Unique-Blob-ID (UBID) as the primary fingerprint
of the blob.  In case this is a v5 OpenPGP key a left truncated
version of the SHA-256 hash is used; in all other cases the full SHA-1
hash.  Using a SHA-256 hash does not make sense because v4 keys are
and will for some time be the majority of keys and thus padding them
with zeroes won't make any difference.  Even if fingerprint collisions
can eventually be created we will assume that the keys are bogus and
that it does not make sense to store its twin also in our key storage.
We can also easily extend the update code to detect a collision and
reject the update.

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2019-11-28 09:39:35 +01:00
parent f59455d054
commit 915297705a
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
18 changed files with 170 additions and 180 deletions
Download patch file Download diff file Expand all files Collapse all files

35
kbx/frontend.c
View file

@ -112,7 +112,8 @@ kbxd_add_resource (ctrl_t ctrl, const char *filename_arg, int readonly)
* always be the first to be queried. */
if (!no_of_databases && !db_type)
{
err = kbxd_add_resource (ctrl, "[cache]", 0);
err = be_cache_initialize ();
/* err = kbxd_add_resource (ctrl, "[cache]", 0); */
if (err)
goto leave;
}
@ -339,7 +340,7 @@ kbxd_search (ctrl_t ctrl, KEYDB_SEARCH_DESC *desc, unsigned int ndesc,
{
/* We need to set the startpoint for the search. */
err = be_kbx_seek (ctrl, db->backend_handle, request,
request->last_cached_ubid, NULL, 0);
request->last_cached_ubid);
if (err)
{
log_debug ("%s: seeking %s to an UBID failed: %s\n",
@ -386,17 +387,17 @@ kbxd_search (ctrl_t ctrl, KEYDB_SEARCH_DESC *desc, unsigned int ndesc,
/* Store; that is insert or update the key (BLOB,BLOBLEN). If
* ONLY_UPDATE is set the key must exist. */
/* Store; that is insert or update the key (BLOB,BLOBLEN). MODE
* controls whether only updates or only inserts are allowed. */
gpg_error_t
kbxd_store (ctrl_t ctrl, const void *blob, size_t bloblen, int only_update)
kbxd_store (ctrl_t ctrl, const void *blob, size_t bloblen,
enum kbxd_store_modes mode)
{
gpg_error_t err;
db_request_t request;
unsigned int dbidx;
db_desc_t db;
char fpr[32];
unsigned int fprlen;
char ubid[UBID_LEN];
enum pubkey_types pktype;
int insert = 0;
@ -418,7 +419,7 @@ kbxd_store (ctrl_t ctrl, const void *blob, size_t bloblen, int only_update)
request = ctrl->opgp_req;
/* Check whether to insert or update. */
err = be_fingerprint_from_blob (blob, bloblen, &pktype, fpr, &fprlen);
err = be_ubid_from_blob (blob, bloblen, &pktype, ubid);
if (err)
goto leave;
@ -433,7 +434,7 @@ kbxd_store (ctrl_t ctrl, const void *blob, size_t bloblen, int only_update)
}
db = databases + dbidx;
err = be_kbx_seek (ctrl, db->backend_handle, request, NULL, fpr, fprlen);
err = be_kbx_seek (ctrl, db->backend_handle, request, ubid);
if (!err)
; /* Found - need to update. */
else if (gpg_err_code (err) == GPG_ERR_EOF)
@ -447,15 +448,19 @@ kbxd_store (ctrl_t ctrl, const void *blob, size_t bloblen, int only_update)
if (insert)
{
err = be_kbx_insert (ctrl, db->backend_handle, request,
pktype, blob, bloblen);
if (mode == KBXD_STORE_UPDATE)
err = gpg_error (GPG_ERR_CONFLICT);
else
err = be_kbx_insert (ctrl, db->backend_handle, request,
pktype, blob, bloblen);
}
else if (only_update)
err = gpg_error (GPG_ERR_DUP_KEY);
else /* Update. */
{
err = be_kbx_update (ctrl, db->backend_handle, request,
pktype, blob, bloblen);
if (mode == KBXD_STORE_INSERT)
err = gpg_error (GPG_ERR_CONFLICT);
else
err = be_kbx_update (ctrl, db->backend_handle, request,
pktype, blob, bloblen);
}
leave: