static void
hash_add_key(pgp_hash_t *hash, const pgp_pubkey_t *key)
{
pgp_memory_t *mem = pgp_memory_new();
const unsigned dontmakepacket = 0;
size_t len;
pgp_build_pubkey(mem, key, dontmakepacket);
len = pgp_mem_len(mem);
pgp_hash_add_int(hash, 0x99, 1);
pgp_hash_add_int(hash, (unsigned)len, 2);
hash->add(hash, pgp_mem_data(mem), (unsigned)len);
pgp_memory_free(mem);
}
/**
\ingroup Core_Keys
\brief Add selfsigned User ID to key
\param keydata Key to which to add user ID
\param userid Self-signed User ID to add
\return 1 if OK; else 0
*/
unsigned
pgp_add_selfsigned_userid(pgp_key_t *key, uint8_t *userid)
{
pgp_create_sig_t *sig;
pgp_subpacket_t sigpacket;
pgp_memory_t *mem_userid = NULL;
pgp_output_t *useridoutput = NULL;
pgp_memory_t *mem_sig = NULL;
pgp_output_t *sigoutput = NULL;
/*
* create signature packet for this userid
*/
/* create userid pkt */
pgp_setup_memory_write(&useridoutput, &mem_userid, 128);
pgp_write_struct_userid(useridoutput, userid);
/* create sig for this pkt */
sig = pgp_create_sig_new();
pgp_sig_start_key_sig(sig, &key->key.seckey.pubkey, userid, PGP_CERT_POSITIVE);
pgp_add_time(sig, (int64_t)time(NULL), "birth");
pgp_add_issuer_keyid(sig, key->sigid);
pgp_add_primary_userid(sig, 1);
pgp_end_hashed_subpkts(sig);
pgp_setup_memory_write(&sigoutput, &mem_sig, 128);
pgp_write_sig(sigoutput, sig, &key->key.seckey.pubkey, &key->key.seckey);
/* add this packet to key */
sigpacket.length = pgp_mem_len(mem_sig);
sigpacket.raw = pgp_mem_data(mem_sig);
/* add userid to key */
(void) pgp_add_userid(key, userid);
(void) pgp_add_subpacket(key, &sigpacket);
/* cleanup */
pgp_create_sig_delete(sig);
pgp_output_delete(useridoutput);
pgp_output_delete(sigoutput);
pgp_memory_free(mem_userid);
pgp_memory_free(mem_sig);
return 1;
}
/**
\ingroup HighLevel_Crypto
Encrypt a file
\param infile Name of file to be encrypted
\param outfile Name of file to write to. If NULL, name is constructed from infile
\param pubkey Public Key to encrypt file for
\param use_armour Write armoured text, if set
\param allow_overwrite Allow output file to be overwrwritten if it exists
\return 1 if OK; else 0
*/
unsigned
pgp_encrypt_file(pgp_io_t *io,
const char *infile,
const char *outfile,
const pgp_key_t *key,
const unsigned use_armour,
const unsigned allow_overwrite,
const char *cipher)
{
pgp_output_t *output;
pgp_memory_t *inmem;
int fd_out;
__PGP_USED(io);
inmem = pgp_memory_new();
if (!pgp_mem_readfile(inmem, infile)) {
return 0;
}
fd_out = pgp_setup_file_write(&output, outfile, allow_overwrite);
if (fd_out < 0) {
pgp_memory_free(inmem);
return 0;
}
/* set armoured/not armoured here */
if (use_armour) {
pgp_writer_push_armor_msg(output);
}
/* Push the encrypted writer */
if (!pgp_push_enc_se_ip(output, key, cipher)) {
pgp_memory_free(inmem);
return 0;
}
/* This does the writing */
pgp_write(output, pgp_mem_data(inmem), (unsigned)pgp_mem_len(inmem));
/* tidy up */
pgp_memory_free(inmem);
pgp_teardown_file_write(output, fd_out);
return 1;
}
unsigned
pgp_fileread_litdata(const char *filename,
const pgp_litdata_enum type,
pgp_output_t *output)
{
pgp_memory_t *mem;
unsigned ret;
int len;
mem = pgp_memory_new();
if (!pgp_mem_readfile(mem, filename)) {
(void) fprintf(stderr, "pgp_mem_readfile of '%s' failed\n", filename);
return 0;
}
len = (int)pgp_mem_len(mem);
ret = pgp_write_litdata(output, pgp_mem_data(mem), len, type);
pgp_memory_free(mem);
return ret;
}
/* this interface isn't right - hook into callback for getting passphrase */
char *
pgp_export_key(pgp_io_t *io, const pgp_key_t *keydata, uint8_t *passphrase)
{
pgp_output_t *output;
pgp_memory_t *mem;
char *cp;
__PGP_USED(io);
pgp_setup_memory_write(&output, &mem, 128);
if (keydata->type == PGP_PTAG_CT_PUBLIC_KEY) {
pgp_write_xfer_pubkey(output, keydata, 1);
} else {
pgp_write_xfer_seckey(output, keydata, passphrase,
strlen((char *)passphrase), 1);
}
cp = netpgp_strdup(pgp_mem_data(mem));
pgp_teardown_memory_write(output, mem);
return cp;
}
static void add_selfsigned_userid(pgp_key_t *skey, pgp_key_t *pkey, const uint8_t *userid, time_t key_expiry)
{
/* similar to pgp_add_selfsigned_userid() which, however, uses different key flags */
pgp_create_sig_t* sig = NULL;
pgp_subpacket_t sigpacket;
pgp_memory_t* mem_sig = NULL;
pgp_output_t* sigoutput = NULL;
/* create sig for this pkt */
sig = pgp_create_sig_new();
pgp_sig_start_key_sig(sig, &skey->key.seckey.pubkey, NULL, userid, PGP_CERT_POSITIVE);
pgp_add_creation_time(sig, time(NULL));
pgp_add_key_expiration_time(sig, key_expiry);
pgp_add_primary_userid(sig, 1);
pgp_add_key_flags(sig, PGP_KEYFLAG_SIGN_DATA|PGP_KEYFLAG_CERT_KEYS);
add_key_prefs(sig);
pgp_add_key_features(sig); /* will add 0x01 - modification detection */
pgp_end_hashed_subpkts(sig);
pgp_add_issuer_keyid(sig, skey->pubkeyid); /* the issuer keyid is not hashed by definition */
pgp_setup_memory_write(&sigoutput, &mem_sig, 128);
pgp_write_sig(sigoutput, sig, &skey->key.seckey.pubkey, &skey->key.seckey);
/* add this packet to key */
sigpacket.length = pgp_mem_len(mem_sig);
sigpacket.raw = pgp_mem_data(mem_sig);
/* add user id and signature to key */
pgp_update_userid(skey, userid, &sigpacket, &sig->sig.info);
if(pkey) {
pgp_update_userid(pkey, userid, &sigpacket, &sig->sig.info);
}
/* cleanup */
pgp_create_sig_delete(sig);
pgp_output_delete(sigoutput);
pgp_memory_free(mem_sig);
}
/**
\ingroup HighLevel_Sign
\brief Sign a file
\param inname Input filename
\param outname Output filename. If NULL, a name is constructed from the input filename.
\param seckey Secret Key to use for signing
\param armored Write armoured text, if set.
\param overwrite May overwrite existing file, if set.
\return 1 if OK; else 0;
*/
unsigned
pgp_sign_file(pgp_io_t *io,
const char *inname,
const char *outname,
const pgp_seckey_t *seckey,
const char *hashname,
const int64_t from,
const uint64_t duration,
const unsigned armored,
const unsigned cleartext,
const unsigned overwrite)
{
pgp_create_sig_t *sig;
pgp_sig_type_t sig_type;
pgp_hash_alg_t hash_alg;
pgp_memory_t *infile;
pgp_output_t *output;
pgp_hash_t *hash;
unsigned ret;
uint8_t keyid[PGP_KEY_ID_SIZE];
int fd_out;
sig = NULL;
sig_type = PGP_SIG_BINARY;
infile = NULL;
output = NULL;
hash = NULL;
fd_out = 0;
/* find the hash algorithm */
hash_alg = pgp_str_to_hash_alg(hashname);
if (hash_alg == PGP_HASH_UNKNOWN) {
(void) fprintf(io->errs,
"pgp_sign_file: unknown hash algorithm: \"%s\"\n",
hashname);
return 0;
}
/* read input file into buf */
infile = pgp_memory_new();
if (!pgp_mem_readfile(infile, inname)) {
return 0;
}
/* setup output file */
fd_out = open_output_file(&output, inname, outname,
(armored) ? "asc" : "gpg", overwrite);
if (fd_out < 0) {
pgp_memory_free(infile);
return 0;
}
/* set up signature */
sig = pgp_create_sig_new();
if (!sig) {
pgp_memory_free(infile);
pgp_teardown_file_write(output, fd_out);
return 0;
}
pgp_start_sig(sig, seckey, hash_alg, sig_type);
if (cleartext) {
if (pgp_writer_push_clearsigned(output, sig) != 1) {
return 0;
}
/* Do the signing */
pgp_write(output, pgp_mem_data(infile), (unsigned)pgp_mem_len(infile));
pgp_memory_free(infile);
/* add signature with subpackets: */
/* - creation time */
/* - key id */
ret = pgp_writer_use_armored_sig(output) &&
pgp_add_time(sig, (int64_t)from, "birth") &&
pgp_add_time(sig, (int64_t)duration, "expiration");
if (ret == 0) {
pgp_teardown_file_write(output, fd_out);
return 0;
}
pgp_keyid(keyid, PGP_KEY_ID_SIZE, &seckey->pubkey, hash_alg);
ret = pgp_add_issuer_keyid(sig, keyid) &&
pgp_end_hashed_subpkts(sig) &&
pgp_write_sig(output, sig, &seckey->pubkey, seckey);
pgp_teardown_file_write(output, fd_out);
if (ret == 0) {
PGP_ERROR_1(&output->errors, PGP_E_W, "%s",
"Cannot sign file as cleartext");
}
} else {
/* set armoured/not armoured here */
if (armored) {
pgp_writer_push_armor_msg(output);
}
/* write one_pass_sig */
pgp_write_one_pass_sig(output, seckey, hash_alg, sig_type);
/* hash file contents */
hash = pgp_sig_get_hash(sig);
hash->add(hash, pgp_mem_data(infile), (unsigned)pgp_mem_len(infile));
#if 1
/* output file contents as Literal Data packet */
pgp_write_litdata(output, pgp_mem_data(infile),
(const int)pgp_mem_len(infile),
PGP_LDT_BINARY);
#else
/* XXX - agc - sync with writer.c 1094 for ops_writez */
pgp_setup_memory_write(&litoutput, &litmem, bufsz);
pgp_setup_memory_write(&zoutput, &zmem, bufsz);
pgp_write_litdata(litoutput,
pgp_mem_data(pgp_mem_data(infile),
(const int)pgp_mem_len(infile), PGP_LDT_BINARY);
pgp_writez(zoutput, pgp_mem_data(litmem), pgp_mem_len(litmem));
#endif
/* add creation time to signature */
pgp_add_time(sig, (int64_t)from, "birth");
pgp_add_time(sig, (int64_t)duration, "expiration");
/* add key id to signature */
pgp_keyid(keyid, PGP_KEY_ID_SIZE, &seckey->pubkey, hash_alg);
pgp_add_issuer_keyid(sig, keyid);
pgp_end_hashed_subpkts(sig);
pgp_write_sig(output, sig, &seckey->pubkey, seckey);
/* tidy up */
pgp_teardown_file_write(output, fd_out);
pgp_create_sig_delete(sig);
pgp_memory_free(infile);
ret = 1;
}
return ret;
}
unsigned
pgp_write_sig(pgp_output_t *output,
pgp_create_sig_t *sig,
const pgp_pubkey_t *key,
const pgp_seckey_t *seckey)
{
unsigned ret = 0;
size_t len = pgp_mem_len(sig->mem);
/* check key not decrypted */
switch (seckey->pubkey.alg) {
case PGP_PKA_RSA:
case PGP_PKA_RSA_ENCRYPT_ONLY:
case PGP_PKA_RSA_SIGN_ONLY:
if (seckey->key.rsa.d == NULL) {
(void) fprintf(stderr, "pgp_write_sig: null rsa.d\n");
return 0;
}
break;
case PGP_PKA_DSA:
if (seckey->key.dsa.x == NULL) {
(void) fprintf(stderr, "pgp_write_sig: null dsa.x\n");
return 0;
}
break;
default:
(void) fprintf(stderr, "Unsupported algorithm %d\n",
seckey->pubkey.alg);
return 0;
}
if (sig->hashlen == (unsigned) -1) {
(void) fprintf(stderr,
"ops_write_sig: bad hashed data len\n");
return 0;
}
pgp_memory_place_int(sig->mem, sig->unhashoff,
(unsigned)(len - sig->unhashoff - 2), 2);
/* add the packet from version number to end of hashed subpackets */
if (pgp_get_debug_level(__FILE__)) {
(void) fprintf(stderr, "ops_write_sig: hashed packet info\n");
}
sig->hash.add(&sig->hash, pgp_mem_data(sig->mem), sig->unhashoff);
/* add final trailer */
pgp_hash_add_int(&sig->hash, (unsigned)sig->sig.info.version, 1);
pgp_hash_add_int(&sig->hash, 0xff, 1);
/* +6 for version, type, pk alg, hash alg, hashed subpacket length */
pgp_hash_add_int(&sig->hash, sig->hashlen + 6, 4);
if (pgp_get_debug_level(__FILE__)) {
(void) fprintf(stderr, "ops_write_sig: done writing hashed\n");
}
/* XXX: technically, we could figure out how big the signature is */
/* and write it directly to the output instead of via memory. */
switch (seckey->pubkey.alg) {
case PGP_PKA_RSA:
case PGP_PKA_RSA_ENCRYPT_ONLY:
case PGP_PKA_RSA_SIGN_ONLY:
if (!rsa_sign(&sig->hash, &key->key.rsa, &seckey->key.rsa,
sig->output)) {
(void) fprintf(stderr,
"pgp_write_sig: rsa_sign failure\n");
return 0;
}
break;
case PGP_PKA_DSA:
if (!dsa_sign(&sig->hash, &key->key.dsa, &seckey->key.dsa,
sig->output)) {
(void) fprintf(stderr,
"pgp_write_sig: dsa_sign failure\n");
return 0;
}
break;
default:
(void) fprintf(stderr, "Unsupported algorithm %d\n",
seckey->pubkey.alg);
return 0;
}
ret = pgp_write_ptag(output, PGP_PTAG_CT_SIGNATURE);
if (ret) {
len = pgp_mem_len(sig->mem);
ret = pgp_write_length(output, (unsigned)len) &&
pgp_write(output, pgp_mem_data(sig->mem), (unsigned)len);
}
pgp_memory_free(sig->mem);
if (ret == 0) {
PGP_ERROR_1(&output->errors, PGP_E_W, "%s",
"Cannot write signature");
}
return ret;
}
/* sign a file, and put the signature in a separate file */
int
pgp_sign_detached(pgp_io_t *io,
const char *f,
char *sigfile,
pgp_seckey_t *seckey,
const char *hash,
const int64_t from,
const uint64_t duration,
const unsigned armored, const unsigned overwrite)
{
pgp_create_sig_t *sig;
pgp_hash_alg_t hash_alg;
pgp_output_t *output;
pgp_memory_t *mem;
uint8_t keyid[PGP_KEY_ID_SIZE];
int fd;
/* find out which hash algorithm to use */
hash_alg = pgp_str_to_hash_alg(hash);
if (hash_alg == PGP_HASH_UNKNOWN) {
(void) fprintf(io->errs,"Unknown hash algorithm: %s\n", hash);
return 0;
}
/* setup output file */
fd = open_output_file(&output, f, sigfile,
(armored) ? "asc" : "sig", overwrite);
if (fd < 0) {
(void) fprintf(io->errs,"Can't open output file: %s\n", f);
return 0;
}
/* create a new signature */
sig = pgp_create_sig_new();
pgp_start_sig(sig, seckey, hash_alg, PGP_SIG_BINARY);
/* read the contents of 'f', and add that to the signature */
mem = pgp_memory_new();
if (!pgp_mem_readfile(mem, f)) {
pgp_teardown_file_write(output, fd);
return 0;
}
/* set armoured/not armoured here */
if (armored) {
pgp_writer_push_armor_msg(output);
}
pgp_sig_add_data(sig, pgp_mem_data(mem), pgp_mem_len(mem));
pgp_memory_free(mem);
/* calculate the signature */
pgp_add_time(sig, from, "birth");
pgp_add_time(sig, (int64_t)duration, "expiration");
pgp_keyid(keyid, sizeof(keyid), &seckey->pubkey, hash_alg);
pgp_add_issuer_keyid(sig, keyid);
pgp_end_hashed_subpkts(sig);
pgp_write_sig(output, sig, &seckey->pubkey, seckey);
pgp_teardown_file_write(output, fd);
pgp_seckey_free(seckey);
return 1;
}
