security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

dirmngr: Support ECDSA for CRLs

Browse source 
* dirmngr/crlcache.c (finish_sig_check): Support ECDSA.
* dirmngr/validate.c (check_cert_sig): Ditto.  Remove the never
used support for DSA.
This commit is contained in:
Werner Koch 2022-02-27 12:13:49 +01:00
parent 890e9849b5
commit de87c8e1ea
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
2 changed files with 92 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

48
dirmngr/crlcache.c
View file

@ -1660,6 +1660,7 @@ finish_sig_check (ksba_crl_t crl, gcry_md_hd_t md, int algo,
size_t n;
gcry_sexp_t s_sig = NULL, s_hash = NULL, s_pkey = NULL;
unsigned int saltlen = 0; /* (used only with use_pss) */
int pkalgo;
/* This also stops debugging on the MD. */
gcry_md_final (md);
@ -1787,6 +1788,53 @@ finish_sig_check (ksba_crl_t crl, gcry_md_hd_t md, int algo,
gcry_md_read (md, algo),
saltlen);
}
else if ((pkalgo = pk_algo_from_sexp (s_pkey)) == GCRY_PK_ECC)
{
unsigned int qbits0, qbits;
qbits0 = gcry_pk_get_nbits (s_pkey);
qbits = qbits0 == 521? 512 : qbits0;
if ((qbits%8))
{
log_error ("ECDSA requires the hash length to be a"
" multiple of 8 bits\n");
err = gpg_error (GPG_ERR_INTERNAL);
goto leave;
}
/* Don't allow any Q smaller than 160 bits. */
if (qbits < 160)
{
log_error (_("%s key uses an unsafe (%u bit) hash\n"),
gcry_pk_algo_name (pkalgo), qbits0);
err = gpg_error (GPG_ERR_INTERNAL);
goto leave;
}
/* Check if we're too short. */
n = gcry_md_get_algo_dlen (algo);
if (n < qbits/8)
{
log_error (_("a %u bit hash is not valid for a %u bit %s key\n"),
(unsigned int)n*8,
qbits0,
gcry_pk_algo_name (pkalgo));
if (n < 20)
{
err = gpg_error (GPG_ERR_INTERNAL);
goto leave;
}
}
/* Truncate. */
if (n > qbits/8)
n = qbits/8;
err = gcry_sexp_build (&s_hash, NULL, "%b",
(int)n,
gcry_md_read (md, algo));
}
else
{
err = gcry_sexp_build (&s_hash, NULL,