1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-23 10:29:58 +01:00

4796 Commits

Author SHA1 Message Date
Werner Koch
a94674c54e doc: Remove some stuff for the very incomplete instguide.
--
2014-09-03 09:45:20 +02:00
Werner Koch
1449a22d2e doc: Typo fix
--
Debian-bug-id: 760273
2014-09-02 16:01:25 +02:00
Werner Koch
bf2fc12b83 gpg: Fix export of NIST ECC keys.
* common/openpgp-oid.c (struct oidtable): New.
(openpgp_curve_to_oid): Rewrite and allow OID as input.
(openpgp_oid_to_curve): Make use of the new table.
--

Due to the previous change we now usually store the OID with the
private key and not the name.  Thus during import we do not anymore
need to map the name to an oid but can use the oid directly.  We fix
that by extending openpgp_curve_to_oid to allow an oidstr as input.
2014-09-02 12:10:19 +02:00
Werner Koch
afe85582dd agent: Fix import of OpenPGP EdDSA keys.
* agent/cvt-openpgp.c (get_keygrip): Special case EdDSA.
(convert_secret_key): Ditto.
(convert_transfer_key): Ditto.
(apply_protection): Handle opaque MPIs.

(do_unprotect): Check FLAG_OPAQUE instead of FLAG_USER1 before
unpacking an opaque mpi.
--

The key transfer protocol between gpg and gpg-agent uses gcrypt
algorithm numbers which merge all ECC algorithms into one.  Thus it is
not possible to use the algorithm number to determine the EdDSA
algorithm.  We need to known that because Libgcrypt requires the
"eddsa" flag with the curve "Ed25519" to actually use the Ed25519
signature specification.

The last fix is for correctness; the first case won't be used anyway.
2014-09-02 11:22:07 +02:00
Kyle Butt
4054d86abc gpg: Fix export of ecc secret keys by adjusting check ordering.
* g10/export.c (transfer_format_to_openpgp): Move the check against
PUBKEY_MAX_NSKEY to after the ECC code adjusts the number of
parameters.
2014-09-01 10:20:17 +02:00
Werner Koch
c913e09ebd agent: Allow key unprotection using AES-256.
* agent/protect.c (PROT_CIPHER): Rename to GCRY_CIPHER_AES128 for
clarity.
(do_decryption): Add args prot_cipher and prot_cipher_keylen.  USe
them instead of the hardwired values.
(agent_unprotect): Change to use a table of protection algorithms.
Add AES-256 variant.
--

This patch will make a possible future key protection algorithm
changes smoother.  AES-256 is also allowed although there is currently
no way to encrypt using it.
2014-09-01 10:15:21 +02:00
Werner Koch
b6386367ac speedo: Fix for non-Windows build of glib.
--
2014-09-01 10:10:30 +02:00
Werner Koch
be98b5960e gpg: Do not show "MD5" and triplicated "RSA" in --version.
* g10/gpg.c (build_list_pk_test_algo): Ignore RSA aliases
(build_list_md_test_algo): Ignore MD5.
2014-08-28 16:02:04 +02:00
Werner Koch
40ad42dbe3 gpg: Do not show "MD5" and triplicated "RSA" in --version.
* g10/gpg.c (build_list_pk_test_algo): Ignore RSA aliases
(build_list_md_test_algo): Ignore MD5.
2014-08-28 16:01:22 +02:00
Werner Koch
15cfd9a3bc gpg: Remove CAST5 from the default prefs and order SHA-1 last.
* g10/keygen.c (keygen_set_std_prefs): Update prefs.
2014-08-26 23:20:07 +02:00
Werner Koch
519305feb8 Switch to the libgpg-error provided estream.
* configure.ac (NEED_GPG_ERROR_VERSION): Reguire 1.14.
(GPGRT_ENABLE_ES_MACROS): Define.
(estream_INIT): Remove.
* m4/estream.m4: Remove.
* common/estream-printf.c, common/estream-printf.h: Remove.
* common/estream.c, common/estream.h: Remove.
* common/init.c (_init_common_subsystems): Call gpgrt initialization.
2014-08-26 17:47:54 +02:00
Werner Koch
a731c22952 gpg: Allow for positional parameters in the passphrase prompt.
* g10/passphrase.c (passphrase_get): Replace sprintf by xasprintf.
--

Without that at least the French translation does not always work
because it requires positional parameters.  Windows for example does
not support them as they are not defined by C99 but by POSIX.
2014-08-26 10:16:04 +02:00
Werner Koch
cb680c5ea5 gpg: Fix "can't handle public key algorithm" warning.
* g10/parse-packet.c (unknown_pubkey_warning): Check for encr/sign
capabilities.
2014-08-20 09:59:36 +02:00
Werner Koch
31649e72fd speedo: Get version numbers from online database.
* build-aux/getswdb.sh: New.
* build-aux/speedo.mk: Get release version numbers from swdb.lst.
--

This should make maintaining GnuPG installations easier.  Running

 make -f /foo/gnupg/build-aux/speedo.mk TARGETOS=native WHAT=release

downloads all GnuPG related packages and builds them.  The gnupg
directory may be a GIT checkout but in that case please run
./autogen.sh on it first.  Note that currently swdb.lst is always
downloaded from gnupg.org and thus monitoring the network or the gnupg
machine reveal information on who is currently building GnuPG.  If
there is an easy way to detect that TOR is enabled this can be changed
to directly download from the GnuPG hidden service.
2014-08-19 12:49:45 +02:00
Werner Koch
4fc1c712e9 build: Create VERSION file via autoconf.
* Makefile.am (dist-hook): Remove creation of VERSION.
(EXTRA_DIST): Add VERSION.
* configure.ac: Let autoconf create VERSION.
2014-08-19 11:12:26 +02:00
Werner Koch
e5da80bc18 gpg: Install the current release signing pubkey.
* g10/distsigkey.gpg: New.
--

This might be useful to help installing updates.
2014-08-18 16:38:13 +02:00
Werner Koch
3981ff15f3 agent: Return NO_SECKEY instead of ENONET for PKSIGN and others.
* agent/pksign.c (agent_pksign_do): Replace ENONET by NO_SECKEY.
* agent/findkey.c (agent_key_from_file): No diagnostic for NO_SECKEY.
* agent/pkdecrypt.c (agent_pkdecrypt): Replace checking for ENOENT.
2014-08-18 15:42:54 +02:00
Werner Koch
3259862cb4 tests: Re-enable OpenPGP ecc test.
--
2014-08-18 12:55:54 +02:00
Werner Koch
e4aa006e48 kbx: Make user id and signature data optional for OpenPGP.
* kbx/keybox-blob.c (_keybox_create_openpgp_blob): Remove restriction.
--

Although self-signature and key binding signatures are required by
OpenPGP, we should not enforce that in the storage backend.
2014-08-18 12:55:29 +02:00
Werner Koch
57df1121c1 gpg: Change default cipher for --symmetric from CAST5 to AES-128.
* g10/main.h (DEFAULT_CIPHER_ALGO): Chhange to AES or CAST5 or 3DES
depending on configure option.
* g10/gpg.c (main): Set opt.s2k_cipher_algo to DEFAULT_CIPHER_ALGO.
2014-08-18 11:45:00 +02:00
Werner Koch
425d075016 yat2m: Support @set and @value.
* doc/yat2m.c (variablelist): New.
(set_variable): New.
(macro_set_p): Also check the variables.
(proc_texi_cmd): Support the @value command.
(parse_file): Support the @set command.
(top_parse_file): Release variablelist.
2014-08-18 11:42:10 +02:00
Werner Koch
7e51ef0f77 yat2m: Support the $* command for man page rendering. 2014-08-18 11:40:15 +02:00
Werner Koch
af1196512f estream: Change license from GPL to LPGL.
* common/estream-printf.c, common/estream-printf.h: Change license.
* common/estream.c, common/estream.h: Ditto.
--

g10 Code is the sole copyright holder of Libestream and thus as CEO I
have the rights to to change the license.  This copy here in GnuPG is
currently the most current one thus the change is recorded in this
repository.  This change is also deemed valid for all older versions.

Signed-off-by: Werner Koch <wk@gnupg.org>
2014-08-17 15:24:48 +02:00
Werner Koch
01dd1601a4 Post beta release update.
--
2014-08-14 17:31:33 +02:00
Werner Koch
a13198d9bc Release 2.1.0-beta783 gnupg-2.1.0-beta783 2014-08-14 17:16:21 +02:00
Werner Koch
fe9ff33b9d po: Update the German (de) translation 2014-08-14 17:16:12 +02:00
Werner Koch
c4b60cdae8 sm: Create homedir and lock empty keybox creation.
* sm/gpgsm.h (opt): Add field "no_homedir_creation".
* sm/gpgsm.c (main): Set it if --no-options is used.
* sm/keydb.c (try_make_homedir): New.  Similar to the one from
g10/openfile.c.
(maybe_create_keybox): New.  Similar to the one from g10/keydb.c.
(keydb_add_resource): Replace some code by maybe_create_keybox.
2014-08-14 17:15:50 +02:00
Werner Koch
21e5125e44 build: Yet another autogen.sh --find-version change.
--
2014-08-14 17:15:25 +02:00
Werner Koch
c23c18c154 gpg: Screen keyserver responses.
* g10/main.h (import_screener_t): New.
* g10/import.c (import): Add screener callbacks to param list.
(import_one): Ditto.
(import_secret_one): Ditto.
(import_keys_internal): Ditto.
(import_keys_stream): Ditto.
* g10/keyserver.c (struct ks_retrieval_screener_arg_s): New.
(keyserver_retrieval_screener): New.
(keyserver_get): Pass screener to import_keys_es_stream().
--
These changes introduces import functions that apply a constraining
filter to imported keys. These filters can verify the fingerprints of
the keys returned before importing them into the keyring, ensuring
that the keys fetched from the keyserver are in fact those selected by
the user beforehand.

Signed-off-by: Stefan Tomanek <tomanek@internet-sicherheit.de>

This is an extended and fixed versions of Stefan's patch.  In addition
to the changes done in gnupg 2.0, namely the commits

  5e933008beffbeae7255ece02383606481f9c169
  044847a0e2013a2833605c1a9f80cfa6ef353309
  088f82c0b5e39687f70e44d3ab719854e808eeb6

the symbol names have been changed to "screener" to void mixing them
up with the iobuf filter feature and it has been changed to be used
with the dirmngr based keyserver lookup.

Signed-off-by: Werner Koch <wk@gnupg.org>
2014-08-14 15:21:21 +02:00
Werner Koch
a61b28df1f scd: Minor changes to app-sc-hsm.
* scd/app-sc-hsm.c: Re-indendet some parts and set some vars to NULL
after xfree for improbed robustness.
(read_ef_prkd): Replace serial operator by blocks for better
readability.
(apply_PKCS_padding): Rewrite for easier auditing.
(strip_PKCS15_padding): Ditto.  Add stricter check on SRCLEN.

Signed-off-by: Werner Koch <wk@gnupg.org>
2014-08-14 14:09:37 +02:00
Werner Koch
ae29b52119 gpg: Disable an MD5 workaround for pgp2 by default.
* g10/sig-check.c (do_check): Move some code to ...
* g10/misc.c (print_md5_rejected_note): new function.
* g10/mainproc.c (proc_tree, proc_plaintext): Enable MD5 workaround
only if option --allow-weak-digest-algos is used.
2014-08-14 11:28:11 +02:00
Werner Koch
2b8d8369d5 gpg: Remove options --pgp2 and --rfc1991.
* g10/gpg.c (oRFC1991, oPGP2): Remove
(opts): Remove --pgp2 and --rfc1991.
* g10/options.h (CO_PGP2, CO_RFC1991): Remove.  Remove all users.
(RFC2440, PGP2): Remove.  Remove all code only enabled by these
conditions.
* tests/openpgp/clearsig.test: Remove --rfc1991 test.
--

The use of PGP 2.c is considered insecure for quite some time
now (e.g. due to the use of MD5).  Thus we remove all support for
_creating_ PGP 2 compatible messages.
2014-08-14 11:03:55 +02:00
Werner Koch
49c9a958e0 build: Fix autogen.sh base version hack.
* autogen.sh <find-version>: Fix.
2014-08-14 09:55:13 +02:00
Werner Koch
71b55e91f0 gpg: Remove --compress-keys and --compress-sigs feature.
* g10/gpg.c (oCompressKeys, oCompressSigs): Remove.
(opts): Turn --compress-keys and --compress-signs in NOPs.
* g10/options.h (opt): Remove fields compress_keys and compress_sigs.
* g10/export.c (do_export): Remove compress_keys feature.
* g10/sign.c (sign_file): Remove compress_sigs feature.
--

These features are disabled in GnuPG since the very early days and
they fulfill no real purpose.  For now we keep the command line
options as dummys.
2014-08-14 09:55:09 +02:00
Werner Koch
7d0492075e gpg: Add list-option "show-usage".
* g10/gpg.c (parse_list_options): Add "show-usage".
* g10/options.h (LIST_SHOW_USAGE): New.
* g10/keyid.c (usagestr_from_pk): Add arg FILL.  Change caller.
* g10/keylist.c (list_keyblock_print): Print usage info.
2014-08-13 10:11:36 +02:00
Werner Koch
cb127024b9 po: Remove extra LF from ja.po
--
2014-08-12 16:28:01 +02:00
Werner Koch
a57c33c855 gpg: Make --with-colons work again for --search-keys.
* g10/keyserver.c (search_line_handler): Replace log_debug by
es_printf.
2014-08-12 16:19:44 +02:00
Werner Koch
1bde869d11 speedo: Comment typo fix
--
2014-08-12 11:33:10 +02:00
Werner Koch
e30e5381bd common: Fix typo in header inclusion protection macro.
--
GnuPG-bug-id: 1669
2014-08-11 17:22:47 +02:00
NIIBE Yutaka
2d9f76e070 po: Update Japanese translation. 2014-08-08 10:00:46 +09:00
Werner Koch
2e936915cf scd: Minor and editorial changes to app-sc-hsm.c
* scd/app-sc-hsm.c (select_and_read_binary): Use SW_ macro.
(parse_certid): Remove useless test.
(send_certinfo, send_keypairinfo): Shrink malloc to the needed size.
(do_getattr): Ditto.
(verify_pin): Use SW_ macro.
(do_decipher): Replace OFS variable and extend comment.
--

Code parts which have not been audited are marked with a warning
pragma.
2014-07-25 11:04:53 +02:00
Werner Koch
e49c851ff5 scd: Add a new status word code.
* scd/apdu.h (SW_REF_DATA_INV): New.
* scd/apdu.c (apdu_strerror): Add string.
2014-07-25 10:58:57 +02:00
Werner Koch
07b64eec14 scd: Comment typo fixes.
--
2014-07-25 10:56:51 +02:00
Andreas Schwier
8eb9224f32 scd: Support for SmartCard-HSM
* scd/app-sc-hsm.c: New.
* scd/app.c (select_application, get_supported_applications): Register
new app.

--
Add a read/only driver for scdaemon that provides access to keys and
certificates on a SmartCard-HSM (www.smartcard-hsm.com).

The driver supports RSA and ECC keys on SmartCard-HSM cards and
USB-Sticks.

The driver does not yet support the MicroSD edition.

--
ChangeLog and FSF copyright year fix by wk.
2014-07-25 09:43:29 +02:00
Werner Koch
557cc11a60 gpg: Switch to an EdDSA format with prefix byte.
* g10/keygen.c (gen_ecc): USe "comp" for EdDSA.
2014-07-25 08:25:06 +02:00
Werner Koch
f2011e4622 po: Update the German (de) translation
--
2014-07-23 21:12:58 +02:00
Werner Koch
b3378b3a56 agent: Show just one warning with all failed passphrase constraints.
* agent/genkey.c (check_passphrase_constraints): Build a final warning
after all checks.
2014-07-23 19:51:52 +02:00
Werner Koch
a24510d53b agent: Only one confirmation prompt for an empty passphrase.
* agent/genkey.c (check_passphrase_constraints): Moev empty passphrase
check to the front.
2014-07-23 19:16:51 +02:00
Werner Koch
ea186540db gpg: Add command --quick-gen-key
* g10/gpg.c (aQuickKeygen): New.
* g10/misc.c (is_valid_user_id): New stub.
* g10/keygen.c (quickgen_set_para): New.
(quick_generate_keypair): New.
--

Note that the validation of the specified user id has not yet been
implemented.
2014-07-23 15:12:43 +02:00
Werner Koch
75127bc456 common: Add cpr_get_answer_is_yes_def()
* g10/cpr.c (cpr_get_answer_is_yes): Factor code out to ....
(cpr_get_answer_is_yes_def): ...new.
2014-07-23 14:35:22 +02:00