security-and-privacy/gnupg
security-and-privacy
/
gnupg
mirror of git://git.gnupg.org/gnupg.git
1
0
Fork 0
Code Releases Activity

gpg: Allow decryption w/o public key but with correct card inserted. 

* agent/command.c (cmd_readkey): Add option --no-data and special
handling for $SIGNKEYID and $AUTHKEYID.
* g10/call-agent.c (agent_scd_getattr): Create shadow keys for KEY-FPR
output.
* g10/skclist.c (enum_secret_keys): Automagically get a missing public
key for the current card.

Signed-off-by: Werner Koch <wk@gnupg.org>
Backported-from-master: 50293ec2eb)
This commit is contained in:
Werner Koch 2021-04-23 08:47:06 +02:00
parent 79e8ea100d
commit e53f603728
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
3 changed files with 64 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
agent/command.c
View File

@ -978,8 +978,8 @@ cmd_genkey (assuan_context_t ctx, char *line)
static const char hlp_readkey[] =
"READKEY <hexstring_with_keygrip>\n"
" --card <keyid>\n"
"READKEY [--no-data] <hexstring_with_keygrip>\n"
" --card <keyid>\n"
"\n"
"Return the public key for the given keygrip or keyid.\n"
"With --card, private key file with card information will be created.";
@ -992,18 +992,20 @@ cmd_readkey (assuan_context_t ctx, char *line)
gcry_sexp_t s_pkey = NULL;
unsigned char *pkbuf = NULL;
char *serialno = NULL;
char *keyidbuf = NULL;
size_t pkbuflen;
const char *opt_card;
int opt_card, opt_no_data;
if (ctrl->restricted)
return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));
opt_card = has_option_name (line, "--card");
opt_no_data = has_option (line, "--no-data");
opt_card = has_option (line, "--card");
line = skip_options (line);
if (opt_card)
{
const char *keyid = opt_card;
const char *keyid = line;
rc = agent_card_getattr (ctrl, "SERIALNO", &serialno);
if (rc)
@ -1013,6 +1015,11 @@ cmd_readkey (assuan_context_t ctx, char *line)
goto leave;
}
/* Hack to create the shadow key for the OpenPGP standard keys. */
if ((!strcmp (keyid, "$SIGNKEYID") || !strcmp (keyid, "$ENCRKEYID"))
&& !agent_card_getattr (ctrl, keyid, &keyidbuf))
keyid = keyidbuf;
rc = agent_card_readkey (ctrl, keyid, &pkbuf);
if (rc)
goto leave;
@ -1038,7 +1045,7 @@ cmd_readkey (assuan_context_t ctx, char *line)
goto leave;
}
rc = assuan_send_data (ctx, pkbuf, pkbuflen);
rc = opt_no_data? 0 : assuan_send_data (ctx, pkbuf, pkbuflen);
}
else
{
@ -1058,12 +1065,13 @@ cmd_readkey (assuan_context_t ctx, char *line)
{
pkbuflen = gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON,
pkbuf, pkbuflen);
rc = assuan_send_data (ctx, pkbuf, pkbuflen);
rc = opt_no_data? 0 : assuan_send_data (ctx, pkbuf, pkbuflen);
}
}
}
leave:
xfree (keyidbuf);
xfree (serialno);
xfree (pkbuf);
gcry_sexp_release (s_pkey);

10
g10/call-agent.c
View File

@ -1097,6 +1097,16 @@ agent_scd_getattr (const char *name, struct agent_card_info_s *info)
parm.ctx = agent_ctx;
rc = assuan_transact (agent_ctx, line, NULL, NULL, default_inq_cb, &parm,
learn_status_cb, info);
if (!rc && !strcmp (name, "KEY-FPR"))
{
/* Let the agent create the shadow keys if not yet done. */
if (info->fpr1valid)
assuan_transact (agent_ctx, "READKEY --card --no-data -- $SIGNKEYID",
NULL, NULL, NULL, NULL, NULL, NULL);
if (info->fpr2valid)
assuan_transact (agent_ctx, "READKEY --card --no-data -- $ENCRKEYID",
NULL, NULL, NULL, NULL, NULL, NULL);
}
return rc;
}

39
g10/skclist.c
View File

@ -31,6 +31,7 @@
#include "keydb.h"
#include "../common/util.h"
#include "../common/i18n.h"
#include "keyserver-internal.h"
#include "call-agent.h"
@ -326,11 +327,14 @@ enum_secret_keys (ctrl_t ctrl, void **context, PKT_public_key *sk)
{
gpg_error_t err = 0;
const char *name;
int cardkey; /* We got an encryption fingerprint from the card */
/* in c->info.fpr2. */
kbnode_t keyblock;
struct
{
int eof;
int state;
int cardkey_done;
strlist_t sl;
strlist_t card_list;
char *serialno;
@ -389,6 +393,7 @@ enum_secret_keys (ctrl_t ctrl, void **context, PKT_public_key *sk)
char *serialno;
name = NULL;
cardkey = 0;
keyblock = NULL;
switch (c->state)
{
@ -444,6 +449,7 @@ enum_secret_keys (ctrl_t ctrl, void **context, PKT_public_key *sk)
bin2hex (c->info.fpr2, sizeof c->info.fpr2,
c->fpr2 + 2);
name = c->fpr2;
cardkey = 1;
}
}
else if (gpg_err_code (err) == GPG_ERR_INV_NAME)
@ -551,6 +557,39 @@ enum_secret_keys (ctrl_t ctrl, void **context, PKT_public_key *sk)
it. */
release_kbnode (c->keyblock);
c->keyblock = NULL;
/* If this was a card key we might not yet have the
* public key for it. Thus check whether the card
* can return the fingerprint of the encryption key
* and we can then find the public key via LDAP. */
if (cardkey && !c->cardkey_done
&& gpg_err_code (err) == GPG_ERR_NO_SECKEY)
{
/* Note that this code does not handle the case
* for two readers having both openpgp
* encryption keys. Only one will be tried. */
c->cardkey_done = 1;
if (opt.debug)
log_debug ("using LDAP to find public key"
" for current card\n");
if (!keyserver_import_fprint
(ctrl, c->info.fpr2, sizeof c->info.fpr2,
opt.keyserver, KEYSERVER_IMPORT_FLAG_LDAP))
{
char fpr_string[MAX_FINGERPRINT_LEN * 2 + 1];
bin2hex (c->info.fpr2, sizeof c->info.fpr2,
fpr_string);
err = getkey_byname (ctrl, NULL, NULL, fpr_string, 1,
&c->keyblock);
if (err)
{
release_kbnode (c->keyblock);
c->keyblock = NULL;
}
else
c->node = c->keyblock;
}
}
}
else
c->node = c->keyblock;