/**************** * Get the session key from a pubkey enc paket and return * it in DEK, which should have been allocated in secure memory. */ int get_session_key( PKT_pubkey_enc *k, DEK *dek ) { PKT_secret_key *sk = NULL; int rc; rc = check_pubkey_algo( k->pubkey_algo ); if( rc ) goto leave; if( (k->keyid[0] || k->keyid[1]) && !opt.try_all_secrets ) { sk = m_alloc_clear( sizeof *sk ); sk->pubkey_algo = k->pubkey_algo; /* we want a pubkey with this algo*/ if( !(rc = get_seckey( sk, k->keyid )) ) rc = get_it( k, dek, sk, k->keyid ); } else { /* anonymous receiver: Try all available secret keys */ void *enum_context = NULL; u32 keyid[2]; for(;;) { if( sk ) free_secret_key( sk ); sk = m_alloc_clear( sizeof *sk ); rc=enum_secret_keys( &enum_context, sk, 1); if( rc ) { rc = G10ERR_NO_SECKEY; break; } if( sk->pubkey_algo != k->pubkey_algo ) continue; keyid_from_sk( sk, keyid ); log_info(_("anonymous receiver; trying secret key %08lX ...\n"), (ulong)keyid[1] ); rc = check_secret_key( sk, 1 ); /* ask only once */ if( !rc ) rc = get_it( k, dek, sk, keyid ); if( !rc ) { log_info(_("okay, we are the anonymous recipient.\n") ); break; } } enum_secret_keys( &enum_context, NULL, 0 ); /* free context */ } leave: if( sk ) free_secret_key( sk ); return rc; }
static gcry_err_code_t ecc_check_secret_key (int algo, gcry_mpi_t *skey) { gpg_err_code_t err; ECC_secret_key sk; (void)algo; if (!skey[0] || !skey[1] || !skey[2] || !skey[3] || !skey[4] || !skey[5] || !skey[6] || !skey[7] || !skey[8] || !skey[9] || !skey[10]) return GPG_ERR_BAD_MPI; sk.E.p = skey[0]; sk.E.a = skey[1]; sk.E.b = skey[2]; point_init (&sk.E.G); err = os2ec (&sk.E.G, skey[3]); if (err) { point_free (&sk.E.G); return err; } sk.E.n = skey[4]; point_init (&sk.Q); err = os2ec (&sk.Q, skey[5]); if (err) { point_free (&sk.E.G); point_free (&sk.Q); return err; } sk.d = skey[6]; if (check_secret_key (&sk)) { point_free (&sk.E.G); point_free (&sk.Q); return GPG_ERR_BAD_SECKEY; } point_free (&sk.E.G); point_free (&sk.Q); return 0; }
int elg_check_secret_key( int algo, MPI *skey ) { ELG_secret_key sk; if( !is_ELGAMAL(algo) ) return G10ERR_PUBKEY_ALGO; if( !skey[0] || !skey[1] || !skey[2] || !skey[3] ) return G10ERR_BAD_MPI; sk.p = skey[0]; sk.g = skey[1]; sk.y = skey[2]; sk.x = skey[3]; if( !check_secret_key( &sk ) ) return G10ERR_BAD_SECKEY; return 0; }
gcry_err_code_t _gcry_elg_check_secret_key (int algo, gcry_mpi_t *skey) { gcry_err_code_t err = GPG_ERR_NO_ERROR; ELG_secret_key sk; (void)algo; if ((! skey[0]) || (! skey[1]) || (! skey[2]) || (! skey[3])) err = GPG_ERR_BAD_MPI; else { sk.p = skey[0]; sk.g = skey[1]; sk.y = skey[2]; sk.x = skey[3]; if (! check_secret_key (&sk)) err = GPG_ERR_BAD_SECKEY; } return err; }
/**************** * Get the session key from a pubkey enc packet and return * it in DEK, which should have been allocated in secure memory. */ int get_session_key( PKT_pubkey_enc *k, DEK *dek ) { PKT_secret_key *sk = NULL; int rc; rc = openpgp_pk_test_algo2 (k->pubkey_algo, PUBKEY_USAGE_ENC); if( rc ) goto leave; if( (k->keyid[0] || k->keyid[1]) && !opt.try_all_secrets ) { sk = xmalloc_clear( sizeof *sk ); sk->pubkey_algo = k->pubkey_algo; /* we want a pubkey with this algo*/ if( !(rc = get_seckey( sk, k->keyid )) ) rc = get_it( k, dek, sk, k->keyid ); } else { /* anonymous receiver: Try all available secret keys */ void *enum_context = NULL; u32 keyid[2]; char *p; for(;;) { if( sk ) free_secret_key( sk ); sk = xmalloc_clear( sizeof *sk ); rc=enum_secret_keys( &enum_context, sk, 1, 0); if( rc ) { rc = G10ERR_NO_SECKEY; break; } if( sk->pubkey_algo != k->pubkey_algo ) continue; keyid_from_sk( sk, keyid ); log_info(_("anonymous recipient; trying secret key %s ...\n"), keystr(keyid)); if(!opt.try_all_secrets && !is_status_enabled()) { p=get_last_passphrase(); set_next_passphrase(p); xfree(p); } rc = check_secret_key( sk, opt.try_all_secrets?1:-1 ); /* ask only once */ if( !rc ) { rc = get_it( k, dek, sk, keyid ); /* Successfully checked the secret key (either it was a card, had no passphrase, or had the right passphrase) but couldn't decrypt the session key, so thus that key is not the anonymous recipient. Move the next passphrase into last for the next round. We only do this if the secret key was successfully checked as in the normal case, check_secret_key handles this for us via passphrase_to_dek */ if(rc) next_to_last_passphrase(); } if( !rc ) { log_info(_("okay, we are the anonymous recipient.\n") ); break; } } enum_secret_keys( &enum_context, NULL, 0, 0 ); /* free context */ } leave: if( sk ) free_secret_key( sk ); return rc; }
int build_sk_list( strlist_t locusr, SK_LIST *ret_sk_list, int unlock, unsigned int use ) { SK_LIST sk_list = NULL; int rc; if( !locusr ) { /* use the default one */ PKT_secret_key *sk; sk = xmalloc_clear( sizeof *sk ); sk->req_usage = use; if( (rc = get_seckey_byname( sk, NULL, unlock )) ) { free_secret_key( sk ); sk = NULL; log_error("no default secret key: %s\n", g10_errstr(rc) ); write_status_text (STATUS_INV_SGNR, get_inv_recpsgnr_code (GPG_ERR_NO_SECKEY)); } else if( !(rc=openpgp_pk_test_algo2 (sk->pubkey_algo, use)) ) { SK_LIST r; if( random_is_faked() && !is_insecure( sk ) ) { log_info(_("key is not flagged as insecure - " "can't use it with the faked RNG!\n")); free_secret_key( sk ); sk = NULL; write_status_text (STATUS_INV_SGNR, get_inv_recpsgnr_code (GPG_ERR_NOT_TRUSTED)); } else { r = xmalloc( sizeof *r ); r->sk = sk; sk = NULL; r->next = sk_list; r->mark = 0; sk_list = r; } } else { free_secret_key( sk ); sk = NULL; log_error("invalid default secret key: %s\n", g10_errstr(rc) ); write_status_text (STATUS_INV_SGNR, get_inv_recpsgnr_code (rc)); } } else { strlist_t locusr_orig = locusr; for(; locusr; locusr = locusr->next ) { PKT_secret_key *sk; rc = 0; /* Do an early check agains duplicated entries. However this * won't catch all duplicates because the user IDs may be * specified in different ways. */ if ( is_duplicated_entry ( locusr_orig, locusr ) ) { log_info (_("skipped \"%s\": duplicated\n"), locusr->d ); continue; } sk = xmalloc_clear( sizeof *sk ); sk->req_usage = use; if( (rc = get_seckey_byname( sk, locusr->d, 0 )) ) { free_secret_key( sk ); sk = NULL; log_error(_("skipped \"%s\": %s\n"), locusr->d, g10_errstr(rc) ); write_status_text_and_buffer (STATUS_INV_SGNR, get_inv_recpsgnr_code (rc), locusr->d, strlen (locusr->d), -1); } else if ( key_present_in_sk_list(sk_list, sk) == 0) { free_secret_key(sk); sk = NULL; log_info(_("skipped: secret key already present\n")); } else if ( unlock && (rc = check_secret_key( sk, 0 )) ) { free_secret_key( sk ); sk = NULL; log_error(_("skipped \"%s\": %s\n"), locusr->d, g10_errstr(rc) ); write_status_text_and_buffer (STATUS_INV_SGNR, get_inv_recpsgnr_code (rc), locusr->d, strlen (locusr->d), -1); } else if( !(rc=openpgp_pk_test_algo2 (sk->pubkey_algo, use)) ) { SK_LIST r; if( sk->version == 4 && (use & PUBKEY_USAGE_SIG) && sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL_E ) { log_info(_("skipped \"%s\": %s\n"),locusr->d, _("this is a PGP generated Elgamal key which" " is not secure for signatures!")); free_secret_key( sk ); sk = NULL; write_status_text_and_buffer (STATUS_INV_SGNR, get_inv_recpsgnr_code (GPG_ERR_WRONG_KEY_USAGE), locusr->d, strlen (locusr->d), -1); } else if( random_is_faked() && !is_insecure( sk ) ) { log_info(_("key is not flagged as insecure - " "can't use it with the faked RNG!\n")); free_secret_key( sk ); sk = NULL; write_status_text_and_buffer (STATUS_INV_SGNR, get_inv_recpsgnr_code (GPG_ERR_NOT_TRUSTED), locusr->d, strlen (locusr->d), -1); } else { r = xmalloc( sizeof *r ); r->sk = sk; sk = NULL; r->next = sk_list; r->mark = 0; sk_list = r; } } else { free_secret_key( sk ); sk = NULL; log_error("skipped \"%s\": %s\n", locusr->d, g10_errstr(rc) ); write_status_text_and_buffer (STATUS_INV_SGNR, get_inv_recpsgnr_code (rc), locusr->d, strlen (locusr->d), -1); } } } if( !rc && !sk_list ) { log_error("no valid signators\n"); write_status_text (STATUS_NO_SGNR, "0"); rc = G10ERR_NO_USER_ID; } if( rc ) release_sk_list( sk_list ); else *ret_sk_list = sk_list; return rc; }
/* If keyblock_out is non-NULL, AND the exit code is zero, then it contains a pointer to the first keyblock found and exported. No other keyblocks are exported. The caller must free it. */ static int do_export_stream( IOBUF out, strlist_t users, int secret, KBNODE *keyblock_out, unsigned int options, int *any ) { int rc = 0; PACKET pkt; KBNODE keyblock = NULL; KBNODE kbctx, node; size_t ndesc, descindex; KEYDB_SEARCH_DESC *desc = NULL; subkey_list_t subkey_list = NULL; /* Track alreay processed subkeys. */ KEYDB_HANDLE kdbhd; strlist_t sl; int indent = 0; *any = 0; init_packet( &pkt ); kdbhd = keydb_new (secret); if (!users) { ndesc = 1; desc = xcalloc ( ndesc, sizeof *desc ); desc[0].mode = KEYDB_SEARCH_MODE_FIRST; } else { for (ndesc=0, sl=users; sl; sl = sl->next, ndesc++) ; desc = xmalloc ( ndesc * sizeof *desc); for (ndesc=0, sl=users; sl; sl = sl->next) { if (classify_user_id (sl->d, desc+ndesc)) ndesc++; else log_error (_("key \"%s\" not found: %s\n"), sl->d, g10_errstr (G10ERR_INV_USER_ID)); } /* It would be nice to see which of the given users did actually match one in the keyring. To implement this we need to have a found flag for each entry in desc and to set this we must check all those entries after a match to mark all matched one - currently we stop at the first match. To do this we need an extra flag to enable this feature so */ } #ifdef ENABLE_SELINUX_HACKS if (secret) { log_error (_("exporting secret keys not allowed\n")); rc = G10ERR_GENERAL; goto leave; } #endif while (!(rc = keydb_search2 (kdbhd, desc, ndesc, &descindex))) { int sha1_warned=0,skip_until_subkey=0; u32 sk_keyid[2]; if (!users) desc[0].mode = KEYDB_SEARCH_MODE_NEXT; /* Read the keyblock. */ rc = keydb_get_keyblock (kdbhd, &keyblock ); if( rc ) { log_error (_("error reading keyblock: %s\n"), g10_errstr(rc) ); goto leave; } if((node=find_kbnode(keyblock,PKT_SECRET_KEY))) { PKT_secret_key *sk=node->pkt->pkt.secret_key; keyid_from_sk(sk,sk_keyid); /* We can't apply GNU mode 1001 on an unprotected key. */ if( secret == 2 && !sk->is_protected ) { log_info(_("key %s: not protected - skipped\n"), keystr(sk_keyid)); continue; } /* No v3 keys with GNU mode 1001. */ if( secret == 2 && sk->version == 3 ) { log_info(_("key %s: PGP 2.x style key - skipped\n"), keystr(sk_keyid)); continue; } /* It does not make sense to export a key with a primary key on card using a non-key stub. We simply skip those keys when used with --export-secret-subkeys. */ if (secret == 2 && sk->is_protected && sk->protect.s2k.mode == 1002 ) { log_info(_("key %s: key material on-card - skipped\n"), keystr(sk_keyid)); continue; } } else { /* It's a public key export, so do the cleaning if requested. Note that both export-clean and export-minimal only apply to UID sigs (0x10, 0x11, 0x12, and 0x13). A designated revocation is never stripped, even with export-minimal set. */ if(options&EXPORT_CLEAN) clean_key(keyblock,opt.verbose,options&EXPORT_MINIMAL,NULL,NULL); } /* And write it. */ for( kbctx=NULL; (node = walk_kbnode( keyblock, &kbctx, 0 )); ) { if( skip_until_subkey ) { if(node->pkt->pkttype==PKT_PUBLIC_SUBKEY || node->pkt->pkttype==PKT_SECRET_SUBKEY) skip_until_subkey=0; else continue; } /* We used to use comment packets, but not any longer. In case we still have comments on a key, strip them here before we call build_packet(). */ if( node->pkt->pkttype == PKT_COMMENT ) continue; /* Make sure that ring_trust packets never get exported. */ if (node->pkt->pkttype == PKT_RING_TRUST) continue; /* If exact is set, then we only export what was requested (plus the primary key, if the user didn't specifically request it). */ if(desc[descindex].exact && (node->pkt->pkttype==PKT_PUBLIC_SUBKEY || node->pkt->pkttype==PKT_SECRET_SUBKEY)) { if (!exact_subkey_match_p (desc+descindex, node)) { /* Before skipping this subkey, check whether any other description wants an exact match on a subkey and include that subkey into the output too. Need to add this subkey to a list so that it won't get processed a second time. So the first step here is to check that list and skip in any case if the key is in that list. We need this whole mess because the import function is not able to merge secret keys and thus it is useless to output them as two separate keys and have import merge them. */ if (subkey_in_list_p (subkey_list, node)) skip_until_subkey = 1; /* Already processed this one. */ else { size_t j; for (j=0; j < ndesc; j++) if (j != descindex && desc[j].exact && exact_subkey_match_p (desc+j, node)) break; if (!(j < ndesc)) skip_until_subkey = 1; /* No other one matching. */ } } if(skip_until_subkey) continue; /* Mark this one as processed. */ { subkey_list_t tmp = new_subkey_list_item (node); tmp->next = subkey_list; subkey_list = tmp; } } if(node->pkt->pkttype==PKT_SIGNATURE) { /* do not export packets which are marked as not exportable */ if(!(options&EXPORT_LOCAL_SIGS) && !node->pkt->pkt.signature->flags.exportable) continue; /* not exportable */ /* Do not export packets with a "sensitive" revocation key unless the user wants us to. Note that we do export these when issuing the actual revocation (see revoke.c). */ if(!(options&EXPORT_SENSITIVE_REVKEYS) && node->pkt->pkt.signature->revkey) { int i; for(i=0;i<node->pkt->pkt.signature->numrevkeys;i++) if(node->pkt->pkt.signature->revkey[i]->class & 0x40) break; if(i<node->pkt->pkt.signature->numrevkeys) continue; } } /* Don't export attribs? */ if( !(options&EXPORT_ATTRIBUTES) && node->pkt->pkttype == PKT_USER_ID && node->pkt->pkt.user_id->attrib_data ) { /* Skip until we get to something that is not an attrib or a signature on an attrib */ while(kbctx->next && kbctx->next->pkt->pkttype==PKT_SIGNATURE) { kbctx=kbctx->next; } continue; } if( secret == 2 && node->pkt->pkttype == PKT_SECRET_KEY ) { /* We don't want to export the secret parts of the * primary key, this is done by using GNU protection mode 1001 */ int save_mode = node->pkt->pkt.secret_key->protect.s2k.mode; node->pkt->pkt.secret_key->protect.s2k.mode = 1001; if ((options&EXPORT_SEXP_FORMAT)) rc = build_sexp (out, node->pkt, &indent); else rc = build_packet (out, node->pkt); node->pkt->pkt.secret_key->protect.s2k.mode = save_mode; } else if (secret == 2 && node->pkt->pkttype == PKT_SECRET_SUBKEY && (opt.export_options&EXPORT_RESET_SUBKEY_PASSWD)) { /* If the subkey is protected reset the passphrase to export an unprotected subkey. This feature is useful in cases of a subkey copied to an unattended machine where a passphrase is not required. */ PKT_secret_key *sk_save, *sk; sk_save = node->pkt->pkt.secret_key; sk = copy_secret_key (NULL, sk_save); node->pkt->pkt.secret_key = sk; log_info (_("about to export an unprotected subkey\n")); switch (is_secret_key_protected (sk)) { case -1: rc = G10ERR_PUBKEY_ALGO; break; case 0: break; default: if (sk->protect.s2k.mode == 1001) ; /* No secret parts. */ else if( sk->protect.s2k.mode == 1002 ) ; /* Card key stub. */ else { rc = check_secret_key( sk, 0 ); } break; } if (rc) { node->pkt->pkt.secret_key = sk_save; free_secret_key (sk); log_error (_("failed to unprotect the subkey: %s\n"), g10_errstr (rc)); goto leave; } if ((options&EXPORT_SEXP_FORMAT)) rc = build_sexp (out, node->pkt, &indent); else rc = build_packet (out, node->pkt); node->pkt->pkt.secret_key = sk_save; free_secret_key (sk); } else { /* Warn the user if the secret key or any of the secret subkeys are protected with SHA1 and we have simple_sk_checksum set. */ if(!sha1_warned && opt.simple_sk_checksum && (node->pkt->pkttype==PKT_SECRET_KEY || node->pkt->pkttype==PKT_SECRET_SUBKEY) && node->pkt->pkt.secret_key->protect.sha1chk) { /* I hope this warning doesn't confuse people. */ log_info(_("WARNING: secret key %s does not have a " "simple SK checksum\n"),keystr(sk_keyid)); sha1_warned=1; } if ((options&EXPORT_SEXP_FORMAT)) rc = build_sexp (out, node->pkt, &indent); else rc = build_packet (out, node->pkt); } if( rc ) { log_error("build_packet(%d) failed: %s\n", node->pkt->pkttype, g10_errstr(rc) ); goto leave; } } if ((options&EXPORT_SEXP_FORMAT) && indent) { for (; indent; indent--) iobuf_put (out, ')'); iobuf_put (out, '\n'); } ++*any; if(keyblock_out) { *keyblock_out=keyblock; break; } }