From d770715e15744dc029e19e2c4207ee71c2ddf633 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Mon, 24 Oct 2022 17:38:49 +0200 Subject: [PATCH] gpgsm: Allow ECC encryption keys with just keyAgreement specified. * sm/certlist.c (cert_usage_p): Allow keyAgreement for ECC. * sm/fingerprint.c (gpgsm_is_ecc_key): New. -- For ECC encryption keys keyAgreement is the keyUsage we want. GnuPG-bug-id: 6253 --- sm/certlist.c | 3 ++- sm/fingerprint.c | 12 ++++++++++-- sm/gpgsm.h | 1 + 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/sm/certlist.c b/sm/certlist.c index fae760b07..94f85d2b2 100644 --- a/sm/certlist.c +++ b/sm/certlist.c @@ -171,7 +171,8 @@ cert_usage_p (ksba_cert_t cert, int mode, int silent) } encr_bits = (KSBA_KEYUSAGE_KEY_ENCIPHERMENT|KSBA_KEYUSAGE_DATA_ENCIPHERMENT); - if ((opt.compat_flags & COMPAT_ALLOW_KA_TO_ENCR)) + if ((opt.compat_flags & COMPAT_ALLOW_KA_TO_ENCR) + || gpgsm_is_ecc_key (cert)) encr_bits |= KSBA_KEYUSAGE_KEY_AGREEMENT; sign_bits = (KSBA_KEYUSAGE_DIGITAL_SIGNATURE|KSBA_KEYUSAGE_NON_REPUDIATION); diff --git a/sm/fingerprint.c b/sm/fingerprint.c index e692049fa..ce0830e29 100644 --- a/sm/fingerprint.c +++ b/sm/fingerprint.c @@ -307,8 +307,16 @@ gpgsm_get_key_algo_info (ksba_cert_t cert, unsigned int *nbits) } -/* This is a wrapper around pubkey_algo_string which takesa KSA - * certitificate instead of a Gcrypt public key. Note that this +/* Return true if CERT is an ECC key. */ +int +gpgsm_is_ecc_key (ksba_cert_t cert) +{ + return GCRY_PK_ECC == gpgsm_get_key_algo_info2 (cert, NULL, NULL); +} + + +/* This is a wrapper around pubkey_algo_string which takes a KSBA + * certificate instead of a Gcrypt public key. Note that this * function may return NULL on error. */ char * gpgsm_pubkey_algo_string (ksba_cert_t cert, int *r_algoid) diff --git a/sm/gpgsm.h b/sm/gpgsm.h index 93fa74a06..bbbd82b54 100644 --- a/sm/gpgsm.h +++ b/sm/gpgsm.h @@ -283,6 +283,7 @@ char *gpgsm_get_keygrip_hexstring (ksba_cert_t cert); int gpgsm_get_key_algo_info (ksba_cert_t cert, unsigned int *nbits); int gpgsm_get_key_algo_info2 (ksba_cert_t cert, unsigned int *nbits, char **r_curve); +int gpgsm_is_ecc_key (ksba_cert_t cert); char *gpgsm_pubkey_algo_string (ksba_cert_t cert, int *r_algoid); char *gpgsm_get_certid (ksba_cert_t cert);