security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-02 22:46:30 +02:00
Code Activity

kbx: Switch from MD5 to SHA-1 for the checksum.

Browse source 
* kbx/keybox-blob.c (put_membuf): Use a NULL buf to store zero bytes.
(create_blob_finish): Write just the needed space.
(create_blob_finish): Switch to SHA-1.
* kbx/keybox-dump.c (print_checksum): New.
(_keybox_dump_blob): Print the checksum and the verification status.
--

The checksum was never used in the past.  Due to fast SHA-1
computations in modern CPUs we now use SHA-1.  Eventually we will
support a First blob flag to enable the use of a secret or public
HMAC-SHA1.  The first may be used for authentication of keyblocks and
the latter to mitigate collission attacks on SHA-1.  It is not clear
whether this will be useful at all.
This commit is contained in:
Werner Koch 2013-01-08 18:15:49 +01:00
parent bbcdb3d3ce
commit b11f84b858
2 changed files with 74 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

16
kbx/keybox-blob.c
View file

@ -261,7 +261,10 @@ put_membuf (struct membuf *mb, const void *buf, size_t len)
}
mb->buf = p;
}
memcpy (mb->buf + mb->len, buf, len);
if (buf)
memcpy (mb->buf + mb->len, buf, len);
else
memset (mb->buf + mb->len, 0, len);
mb->len += len;
}
@ -311,6 +314,7 @@ put32 (struct membuf *mb, u32 a )
put_membuf (mb, tmp, 4);
}
/* Store a value in the fixup list */
static void
@ -638,12 +642,10 @@ create_blob_finish (KEYBOXBLOB blob)
struct membuf *a = blob->buf;
unsigned char *p;
unsigned char *pp;
int i;
size_t n;
/* write a placeholder for the checksum */
for (i = 0; i < 16; i++ )
put32 (a, 0); /* Hmmm: why put32() ?? */
/* Write a placeholder for the checksum */
put_membuf (a, NULL, 20);
/* get the memory area */
n = 0; /* (Just to avoid compiler warning.) */
@ -671,8 +673,8 @@ create_blob_finish (KEYBOXBLOB blob)
}
}
/* calculate and store the MD5 checksum */
gcry_md_hash_buffer (GCRY_MD_MD5, p + n - 16, p, n - 16);
/* Compute and store the SHA-1 checksum. */
gcry_md_hash_buffer (GCRY_MD_SHA1, p + n - 20, p, n - 20);
pp = xtrymalloc (n);
if ( !pp )