1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-23 10:29:58 +01:00

8722 Commits

Author SHA1 Message Date
Werner Koch
32493ce50a
gpg: Add property "fpr" for use by --export-filter.
* g10/export.c (push_export_filters): New.
(pop_export_filters): New.
(export_pubkey_buffer): Add args prefix and prefixlen.  Adjust
callers.
* g10/import.c (impex_filter_getval): Add property "fpr".
* g10/main.h (struct impex_filter_parm_s): Add field hexfpr.
--

The push and pop feature will help us to use the export filter
internally in gpg.  Same for the export_pubkey_buffer change.

GnuPG-bug-id: 4856
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-03-13 13:19:31 +01:00
Werner Koch
90fb4a69d2
doc: Add a comment to explain the signature postscript.
--

Hal Finney explained this on January 22, 2004 on a question from Peter
Gutmann on the WG list.
2020-03-12 11:05:37 +01:00
Werner Koch
b4f1159a5b
gpgconf: Rewrite the gpgconf-comp module.
* tools/gpgconf.h (gc_component_t): Change type to ...
(gc_component_id_t): this.
(GC_COMPONENT_ANY): New, so that we can use that in gpgconf-comp.c
directly.
* tools/gpgconf-comp.c: Major rework.
--

The primary reason for this rework is to support the global options.
A second reason is to clean up the code and simplify it so that we do
not anymore need to maintain a list of options in the components _and_
in gpgconf-comp.c.

What we do now is to

 1. Read the option tables directly from the components using
    the new generic --dump-option-table option.  This includes
    the header (group) descriptions.

 2. Read the default values from the components as before using
    --gpgconf-list and update gpgconf's internal tables with
    that info.

 3. Read the options using gpgrt_argparser in the same way as we do
    this in the components.

The changes also do away with the second level notion of backends;
they were only used for dirmngr's extra dirmngr_ldapservers.conf file.
We intend to remove that file and replace it with a regular option so
that it will be similar on how OpenPGP keyservers are specified.

The whole thing will currently be slower than before (in particular on
Windows) but we can optimize that by keeping a cached version of the
option tables and the default values in a per homedir cache file.

There is also some work planned to remove most of the data returned by
--gpgconf-list.  What can also be done is to replace the internal
tables, which list the gpgconf maintainable options, by a configuration
file so that admins are able to maintain the list of these options.

GnuPG-bug-id: 4788
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-03-12 10:16:56 +01:00
Werner Koch
4c43fabbb0
dirmngr: Re-group the options in the --help output.
--

This looks better and is also required for further simplifications of
gpgconf.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-03-06 17:02:58 +01:00
Werner Koch
4762367d66
agent: Fix todays --re-group commit.
--

Fixes-commit: c693b7f4ade97357c33b410728bb741674255487
2020-03-06 17:02:01 +01:00
Werner Koch
9bc3e7ec03
gpgsm: Re-group the options in the --help output.
--

This looks better and is also required for further simplifications of
gpgconf.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-03-06 16:21:10 +01:00
Werner Koch
41eb5108ce
gpg: Re-group the options in the --help output.
* g10/gpg.c (opts): Change oLoadExtensions, oStrict, and oNoStrict to
use ARGPARSE_ignore and remove the code in the option switch.
--

This looks better and is also required for further simplifications of
gpgconf.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-03-06 15:18:27 +01:00
Werner Koch
daf5f4355d
scd: Re-group the options in the --help output.
--

This looks better and is also required for further simplifications of
gpgconf.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-03-06 15:15:21 +01:00
Werner Koch
c693b7f4ad
agent: Re-group the options in the --help output.
* agent/gpg-agent.c (oGreeting): Remove non existant dummy option.
--

This looks better and is also required for further simplifications of
gpgconf.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-03-06 15:14:16 +01:00
Werner Koch
4423e9dcde
gpgconf: Support reading global options (part 2).
* tools/gpgconf-comp.c: Remove all regular option descriptions.  They
are now read in from the component.  Also remove a few meanwhile
obsolete options.
* agent/gpg-agent.c: Add option description which were only set in
gpgconf-comp.c.
* dirmngr/dirmngr.c: Ditto.
* scd/scdaemon.c: Ditto.
* sm/gpgsm.c: Ditto.
* g10/gpg.c: Ditto.
--

This second part removes all regular option descriptions because they
can be read from the components.  A few were missing in the components
and thus moved to there.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-03-06 10:09:26 +01:00
Werner Koch
d2425d1495
gpgconf: Support reading global options (part 1).
* tools/gpgconf.c (main): Set the coinfig directories.
* tools/gpgconf-comp.c (gc_backend): Change the name of the config
files.
(struct gc_option): Add new field 'attr'.
(retrieve_options_from_program): Rewrite to use gpgrt_argparser.
--

We need to do larger changes to gpgconf so that it is possible to get
also global config options and their attributes.  The old code worked
along its own list of option and used a generic option file parser.
This has no support for global config files.  We now use
gpgrt_argparser so that we to do exactly the same as the component
does and thus delivers the actual option values as seen by the
component.

This is just a first step and we need to change more things.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-03-05 16:23:52 +01:00
Werner Koch
6fa1808cb7
common: Add xreallocarray function.
* common/miscellaneous.c (xreallocarray): New func.
* common/util.h (xtryreallocarray): New macro.
--

Very useful to match calloc behaviour.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-03-04 13:55:53 +01:00
Werner Koch
178b3772ff
gpgconf: Always use xmalloc.
* tools/gpgconf-comp.c: Fix spelling of "cannot".  Use log_assert
instead of a plain assert.
(gc_percent_escape, percent_deescape): Fail on malloc error.
--

It does not make sense to use xtryalloc and failing then anyway.  We
also should use our wrappers and not a plain realloc.  Everywhere
elese we use the non-formal "can't" so it is better to do the same
here.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-03-03 14:22:10 +01:00
Werner Koch
a94daa6549
card: Add yet another vendor.
--
2020-03-03 13:37:28 +01:00
Werner Koch
3c4ab531eb
card: Add new vendor.
--
2020-03-03 11:55:08 +01:00
NIIBE Yutaka
19f70b5072 scd: Fix the previous commit.
* scd/app-openpgp.c (do_setattr): Flush the KDF DO just before setting.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-02-28 16:25:15 +09:00
NIIBE Yutaka
3ba7c9bcf7 scd: Improve setattr for KDF.
* scd/app-openpgp.c (do_setattr): For setting KDF DO, support standard
OpenPGP card, which needs to update PIN.

GnuPG-bug-id: 3891
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-02-28 15:58:24 +09:00
NIIBE Yutaka
11da441016 scd: Fix pinpad handling when KDF enabled.
* scd/app-openpgp.c (do_getattr): Send the KDF DO information.

--

Fixes-commit: 95c7498b76231d3297541172d878f6a26702539b
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-02-28 15:56:53 +09:00
Werner Koch
79f2318aa5
gpg: Re-enable versioned config files
* g10/gpg.c (main): Use ARGPARSE_FLAG_USERVERS.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-25 15:18:55 +01:00
Werner Koch
7e8f28653c
gpg: Re-add checking of config file permissions.
* g10/gpg.c (main): Re-add permission checking of the user config
file.  Re-add code to check against the SE-Linux secured file list.
(get_default_configname): Remove unused func.
* configure.ac (SAFE_VERSION, SAFE_VERSION_DOT)
(SAFE_VERSION_DASH): Remove.
--

Die to the switch to the new option parser, the permissions were not
anymore checked.  This patch fixes this.  Note that there there is no
checking for the global config file because that file is not expected
to be user modifiable.

This patch also adds checking against the list of SE-linux secured
files.  However, like in the old code the checking does not work in
practise because the to be checked files are added to the the list
only after option parsing.  Tested using temporary debug code.

The SAFE_VERSION macros were used for RISC OS, which is not anymore
supported, and only in the now removed get_default_configname.  There
purpose was that a RISC OS could use a modified config.h here.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-25 14:09:46 +01:00
Werner Koch
833c04334a
Use gpgrt's new option parser for the new keyboxd.
* kbx/keyboxd.c: Switch to the new option parser and enable a global
conf file.
--

GnuPG-bug-id: 4788
2020-02-22 12:19:55 +01:00
Werner Koch
941a48f9b1
agent,dirmngr: Re-read the user specified config file.
* agent/gpg-agent.c (reread_configuration): Use a two-part config
file.
* dirmngr/dirmngr.c (reread_configuration): Ditto.
--

If --options is used to to set a specific options file, this file and
not the default file needs to be re-read on SIGHUP.

GnuPG-bug-id: 4788
2020-02-22 11:35:34 +01:00
Werner Koch
cdbe10b762
Remove the now obsolete argparse code.
* tests/gpgscm/main.c: Switch to the new option parser.
* common/argparse.c, common/argparse.h: Remove.
* common/init.c (_init_common_subsystems): Do not call obsolete func.
* common/Makefile.am (common_sources): Remove those files.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-22 09:52:48 +01:00
Werner Koch
ba463128ce
Use gpgrt's new option parser for the remaining daemons.
* scd/scdaemon.c: Switch to the new option parser and enable a global
conf file.
* dirmngr/dirmngr.c: Ditto.
* g13/g13.c: Ditto.
* g13/g13-syshelp.c: Ditto.  Do not force verbose mode.
* dirmngr/dirmngr_ldap.c: Switch to the new option parser.
* dirmngr/dirmngr-client.c: Switch to the new option parser.
--

This finalizes the switch to the new option parser.  What's left is to
remove the old argparser code from common.

g13-syshelp does not anymore default to --verbose because that can now
be enabled in /etc/gnupg/g13-syshelp.conf.

GnuPG-bug-id: 4788
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-21 21:45:13 +01:00
Werner Koch
3bc004decd
Use gpgrt's new option parser for the tools.
* agent/preset-passphrase.c: Switch to the new option parser.
* agent/protect-tool.c: Ditto.
* kbx/kbxutil.c: Ditto.
* tools/gpg-card.c: Ditto.
* tools/gpg-check-pattern.c: Ditto.
* tools/gpg-connect-agent.c: Ditto.
* tools/gpg-pair-tool.c: Ditto.
* tools/gpg-wks-client.c: Ditto.
* tools/gpg-wks-server.c: Ditto.
* tools/gpgconf.c: Ditto.
* tools/gpgsplit.c: Ditto.
* tools/gpgtar.c: Ditto.
--

This is another part of changes.  A followup patch will address the
remaining daemons.

GnuPG-bug-id: 4788
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-21 20:28:47 +01:00
Werner Koch
2c823bd878
Use gpgrt's new option parser for gpgc, gpgsm, and gpg-agent.
* g10/gpgv.c: Use new option parser.
* sm/gpgsm.c: Ditto.
* agent/gpg-agent.c: Ditto.
(opts): Add option --no-options.
--

This is the next part of changes.  The latest libgpg-error is required
so that that re-reading options (SIGHUP) works.

GnuPG-bug-id: 4788
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-20 14:59:58 +01:00
Werner Koch
0e8f6e2aa9
gpg: Use gpgrt's new option parser to provide a global conf file.
* common/util.h: Remove argparse.h.
* common/argparse.c: Undef GPGRT_ENABLE_ARGPARSE_MACROS.
* configure.ac (GPGRT_ENABLE_ARGPARSE_MACROS): Define.
* agent/gpg-agent.c: Undef GPGRT_ENABLE_ARGPARSE_MACROS and include
argparse.h.  Do this also for all main modules which use our option
parser except for gpg.  Replace calls to strusage by calls to
gpgrt_strusage everywhere.

* g10/gpg.c (opts): Change type to gpgrt_opt_t.  Flag oOptions and
oNoOptions with ARGPARSE_conffile and ARGPARSE_no_conffile.
(main): Change type of pargs to gpgrt_argparse_t.  Rework the option
parser to make use of the new gpgrt_argparser.
--

This is not yet finished but a make check works.  gpg has the most
complex and oldest option handling and thus this is the first
migration target.  SE-Linux checks and version-ed config files are
missing and will be added later.

GnuPG-bug-id: 4788
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-20 11:13:32 +01:00
Werner Koch
ccdf988b40
build: Require libgpg-error 1.38
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-19 20:42:02 +01:00
Werner Koch
ee911df979
card: New option --info for command list and select by s/n.
* tools/gpg-card.c (cmd_list): add option --info.  Factor soem code
out to ...
(print_card_list): new.
--

This change allows to use the printed s/n to sleect another card
instead of using the index.  For example:

  gpg/card> l --cards
  0* D276000124010200FFFE50FF6E060000
  1  D2760001240102000005000000370000

Now select the second card but do not print the entire listing, just
the card index, s/n and applications.  We also select by s/n:

  gpg/card> l --info D2760001240102000005000000370000
  1* D2760001240102000005000000370000

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-19 08:48:55 +01:00
NIIBE Yutaka
41913d76f7 gpg: Fix default-key selection when card is available.
* g10/getkey.c (get_seckey_default_or_card): Handle the case
when card key is not suitable for requested usage.

--

Cherry-pick stable commit of:
	1cdd9e57f701f0d99d118d32adffe5216a94b0b2

GnuPG-bug-id: 4850
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-02-19 11:05:25 +09:00
Daniel Kahn Gillmor
0904b8ef34 Spelling cleanup.
No functional changes, just fixing minor spelling issues.

---

Most of these were identified from the command line by running:

  codespell \
    --ignore-words-list fpr,stati,keyserver,keyservers,asign,cas,iff,ifset \
    --skip '*.po,ChangeLog*,help.*.txt,*.jpg,*.eps,*.pdf,*.png,*.gpg,*.asc' \
    doc g13 g10 kbx agent artwork scd tests tools am common dirmngr sm \
    NEWS README README.maint TODO

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2020-02-18 18:07:46 -05:00
Nick Piper
0e1cbabc0a doc: Correction of typo in documentation of KEY_CONSIDERED
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2020-02-18 18:07:33 -05:00
Werner Koch
d272308cc5
sm: Remove left over debug output.
--
2020-02-17 11:36:43 +01:00
NIIBE Yutaka
95c7498b76 scd: Disable pinpad if it's impossible by KDF DO.
* scd/app-openpgp.c (struct app_local_s): Add pinpad.disabled field.
(do_getattr): Set pinpad.disabled field.
(check_pinpad_request): Use the pinpad.disabled field.
(do_setattr): Update pinpad.disabled field.

--

GnuPG-bug-id: 4832
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-02-17 17:44:59 +09:00
Werner Koch
6248739799
gpgsm: Fix import of some CR,LF ternminated certificates
* common/ksba-io-support.c (base64_reader_cb): Detect the END tag and
don't just rely on the padding chars.  This could happen only with
CR+LF termnmated PEM files.  Also move the detection into the invalid
character detection branch for a minor parser speedup.
--

GnuPG-bug-id: 4847
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-15 19:20:21 +01:00
Werner Koch
6cac2bd038
build: New configure option --disable-keyboxd
* configure.ac: Add option --dsiable-keyboxd
* kbx/Makefile.am: Do not build keyboxd in that case.
--

This is useful to build a minimal version of gpgv.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-13 16:18:12 +01:00
Werner Koch
11d917c779
scd: Print the main app name also for not fully supported cards.
* scd/app.c (send_serialno_and_app_status): Add fallback.
--

The app list was only printed for apps which support the with_keygrip
function.  That is not the case for the netkey and otehr cards.  The
new fallback prints the actual app name.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-13 15:43:17 +01:00
Werner Koch
e582d8f5b2
card: Fix openpgp subkey listing.
* tools/gpg-card.c (list_one_kinfo): Fix printing of the subkeys.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-13 14:38:08 +01:00
Werner Koch
86312b920a
gpg: New option --full-timestrings.
* g10/options.h (opt): Add flags.full_timestrings.
* g10/gpg.c (oFullTimestrings): New.
(opts): New option.
(main): Set new flag.
* g10/keyid.c (dateonlystr_from_pk): New.
(dateonlystr_from_sig): New.
(datestr_from_pk): Divert to isotimestamp if requested.
(datestr_from_sig): Ditto.
(expirestr_from_pk): Ditto.
(expirestr_from_sig): Ditto.
(revokestr_from_pk): Ditto.
* g10/import.c (impex_filter_getval): Use dateonlystr_from_sig and
dateonlystr_from_pk.
--

Quite helpful for debugging keys.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-13 14:07:09 +01:00
Werner Koch
14ac350f86
gpg: Changes to allow direct key generation from an OpenPGP card.
* g10/call-agent.h (struct keypair_info_s): Add fields keytime and
usage.
* g10/call-agent.c (struct keypairinfo_cb_parm_s): New.
(scd_keypairinfo_status_cb): Rework to store parsed KEYPAIRINFO data.
(agent_scd_keypairinfo): Change accordingly.
(agent_scd_readkey): Add arg ctrl and change callers.  Change return
arg from an strlist_t to a keypair_info_t.
(readkey_status_cb): Use KEYPAIRINFO instead of KEY-TIME.
* g10/keygen.c (pSUBKEYCREATIONDATE): New.
(pAUTHKEYCREATIONDATE): New.
(get_parameter_u32): Allow for new parameters.
(do_create_from_keygrip): For card keys use direct scd call which does
not create a stub file.
(ask_algo): Rework to use the new keypair_info_t as return from
agent_scd_keypairinfo.
(parse_key_parameter_part): Likewise.  Also get and return the key
creation time using a arg.
(parse_key_parameter_string): New args r_keytime and r_subkeytime.
(parse_algo_usage_expire): New arg r_keytime.
(proc_parameter_file): Ignore the explict pCREATIONDATE for card keys.
(quickgen_set_para): New arg keytime.
(quick_generate_keypair): Get the keytimes and set the pCARDKEY flag.
(generate_keypair): Likewise.
(do_generate_keypair): Implement the cardkey with keytime thingy.
(generate_subkeypair): Use the keytime parameters.
* g10/keygen.c (pAUTHKEYCREATIONDATE): New.  Not yet set but may come
handy later.
(get_parameter_u32): Take care of that.
(do_generate_keypair): For cardkeys sign with the current time.
--

Key generation direct from the card used to work for all cards except
the OpenPGP cards. The key generation from card using an OpenPGP card
is special because the fingerprint is stored on the card and we must
make sure that the newly created key has the same fingerprint.  This
requires that we take the key creation date as stored on the card into
account.

Along with the recent change in gpg-agent this change also fixes a
problem with existing stub files.

Note that with a key take from a card the self-signature are created
with the current time and not the creation time.  This allows to
better distinguish keys created using the same card.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-13 14:07:04 +01:00
Werner Koch
e63f8bee40
card: Take the key creation time from the KEYPAIRINFO
* tools/card-call-scd.c (learn_status_cb): Adjust for recent change.
--

This adjusts for the chnage in scdaemon.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-13 11:53:32 +01:00
Werner Koch
1ad84aabb4
scd:openpgp: Return key creation time as part of KEYPARIINFO.
* scd/app-openpgp.c (send_keypair_info): Reaturn the key creation time
as part of a KEYPAIRINFO.
(do_readkey): Do not return the KEY-TIME anymore.
--

Sending the KEY_TIME status as part of a READKEY command was only
recently added.  It is better to merge that into the KEYPAIRINFO line.
Another patch with chnage this for the consumers of that info.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-13 11:52:10 +01:00
Werner Koch
638526d37f
agent: Allow signing with card key even without a stub key.
* agent/call-scd.c (agent_card_serialno): Allow NULL for R_SERIAL.
(struct readkey_status_parm_s): New.
(readkey_status_cb): New.
(agent_card_readkey): Add optional arg R_KEYREF and change all
callers.
* agent/findkey.c (key_parms_from_sexp): Allow also a "public-key".
* agent/divert-scd.c (ask_for_card): Allow for SHADOW_INFO being NULL.
* agent/pksign.c (agent_pksign_do): Fallback to sign with an on-card
if there is no stub key yet.  Create the stub key.  Also fixed a
misnaming between s_pkey and s_skey.
--

This change allows to create OpenPGP keys directly from a card without
first making sure that a stub key exists.  It is also the less
surprising behaviour.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-13 11:45:41 +01:00
Werner Koch
8c63430d1a
gpg: Rename the struct card_key_info_s.
* g10/call-agent.h (struct card_key_info_s): Rename to ...
(struct keypair_info_s): this.
(keypair_info_t): New.  Use this everywhere instead of
card_key_info_s.
* g10/call-agent.c (agent_scd_free_keyinfo): Rename to ..
(free_keypair_info): this.  Change all callers.
--

The struct is also useful to store the data from KEYPAIRINFO status
lines.  Thus renaming it makes sense.  A future patch will extend the
struct.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-12 17:29:51 +01:00
Werner Koch
125c959677
card: Fix parsing of the received card_list.
* tools/card-call-scd.c (scd_cardlist): Allow for SERIALNO without any
apps.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-12 15:17:25 +01:00
Werner Koch
1abfce82bd
card: List more info for an OpenPGP key.
* tools/gpg-card.h (struct pubkey_s): Add field created.
* tools/card-keys.c (parse_key_record): Set that field.
* tools/gpg-card.c (print_shax_fpr): Print the fingerprint without
spaces for easier c+p.
(list_one_kinfo): Print the actual used fingerprint and creation date
from the keyblock.
--

A common problem with OpenPGP cards is that the fingerprint as stored
on the card does not match the actual fingerprint.  Print both values
to be able to investigate such issues.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-12 12:50:38 +01:00
Werner Koch
2c6092bc5d
card: New option --no-key-lookup.
* tools/gpg-card.h (opt): Add var no_key_lookup.
* tools/gpg-card.c (oNoKeyLookup): New const.
(opts): New option --no-key-lookup.
(list_one_kinfo): Add arg no_key_lookup and implement.
(list_all_kinfo): Add arg no_key_lookup.
(list_openpgp, list_piv, list_card): Ditto.
(cmd_list): New option --no-key-lookup.
--

Printing the OpenPGP and X.509 keys used for a specific card key can
be a lengthy operation.  The new command line option and option to
"list" allows to suppress that part of the output.
2020-02-12 11:16:41 +01:00
Werner Koch
9c719c9c1f
gpg: Improve key creation direct from the card.
* g10/call-agent.c (readkey_status_cb): New.
(agent_scd_readkey): Add new arg r_keytime and allow NULL for
r_result.  Change all callers.
(agent_readkey): Minor code reformatting.
* g10/keygen.c (pCARDKEY): New.
(struct para_data_s): Add u.bool.
(get_parameter_bool): New.
(do_create_from_keygrip): Add arg cardkey and make use of it.
(ask_algo): Add args r_cardkey and r_keytime.  Read the keytime of the
selected card key and return it.
(generate_keypair): Store CARDKEY and KEYTIME.
(do_generate_keypair): Pass CARDKEY to do_create_from_keygrip.
(generate_subkeypair): Ditto.
--

This allows to first create keys on the card (e.g. using gpg-card)
even without having any public key for OpenPGP.  Then the key
generation option 14 (cardkey) can be used to create a primary OpenPGP
key from the key on the card.

There are still a couple of problems related to the agent which
creates the stub key and may run into problems if creating a second
key from the card.  This will be fixed in a future patch.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-11 20:51:33 +01:00
Werner Koch
77ea916533
scd:openpgp: Send a KEY-TIME status with READKEY
* scd/app-openpgp.c (retrieve_fprtime_from_card): New.
(do_readkey): Send a KEY_TIME status.
--

It might be easier to fold this into KEYPAIRINFO but for backward
compatibility using a separate status line is safer.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-11 20:41:29 +01:00
Werner Koch
6bc7318ef5
card: First code to actually create openpgp keys.
* tools/gpg-card.c (generate_all_openpgp_card_keys): Add demo key
generation.
(generate_key): Allow generatiing one OpenPGP key.
--

This does now allows to create a single OpenPGP key optioanlly with a
specified parameter.  For example to create an auth key:

  gpg-card generate --algo=ed25519 OPENPGP.3

Using option --force will overwrite and already existing key.
scdaemon does here take care of swicthing the key attributes before
generating the key.

TODO: We need to add some more stuff to app-openpgp so that the user
is not annoyed by beeing asked to enter the Admin-PIN twice (change
the key attributes clear the verification state).  gpg's key
generation also needs some tweaks for using an existing card key which
has no key stub in private-keys-v1.d.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-02-11 14:58:17 +01:00