No OneTemporary
Actions

Size

261 KB

Subscribers

None

View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	diff --git a/g10/app-openpgp.c b/g10/app-openpgp.c
	index 34100b839..b2ca46910 100644
	--- a/g10/app-openpgp.c
	+++ b/g10/app-openpgp.c
	@@ -1,3804 +1,3803 @@
	/* app-openpgp.c - The OpenPGP card application.
	* Copyright (C) 2003, 2004, 2005, 2007, 2008,
	* 2009 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <http://www.gnu.org/licenses/>.
	*
	* $Id$
	*/

	/* Some notes:

	CHV means Card Holder Verification and is nothing else than a PIN
	or password. That term seems to have been used originally with GSM
	cards. Version v2 of the specs changes the term to the clearer
	term PW for password. We use the terms here interchangeable
	because we do not want to change existing strings i18n wise.

	Version 2 of the specs also drops the separate PW2 which was
	required in v1 due to ISO requirements. It is now possible to have
	one physical PW but two reference to it so that they can be
	individually be verified (e.g. to implement a forced verification
	for one key). Thus you will noticed the use of PW2 with the verify
	command but not with change_reference_data because the latter
	operates directly on the physical PW.

	The Reset Code (RC) as implemented by v2 cards uses the same error
	counter as the PW2 of v1 cards. By default no RC is set and thus
	that error counter is set to 0. After setting the RC the error
	counter will be initialized to 3.

	*/

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <assert.h>
	#include <time.h>

	#if GNUPG_MAJOR_VERSION == 1
	/* This is used with GnuPG version < 1.9. The code has been source
	copied from the current GnuPG >= 1.9 and is maintained over
	there. */
	#include "options.h"
	#include "errors.h"
	#include "memory.h"
	#include "util.h"
	#include "cardglue.h"
	#else /* GNUPG_MAJOR_VERSION != 1 */
	#include "scdaemon.h"
	#endif /* GNUPG_MAJOR_VERSION != 1 */

	#include "i18n.h"
	#include "iso7816.h"
	#include "app-common.h"
	#include "tlv.h"


	/* A table describing the DOs of the card. */
	static struct {
	int tag;
	int constructed;
	int get_from; /* Constructed DO with this DO or 0 for direct access. */
	int binary:1;
	int dont_cache:1;
	int flush_on_error:1;
	int get_immediate_in_v11:1; /* Enable a hack to bypass the cache of
	this data object if it is used in 1.1
	and later versions of the card. This
	does not work with composite DO and
	is currently only useful for the CHV
	status bytes. */
	int try_extlen:1; /* Large object; try to use an extended
	length APDU. */
	char *desc;
	} data_objects[] = {
	{ 0x005E, 0, 0, 1, 0, 0, 0, 0, "Login Data" },
	{ 0x5F50, 0, 0, 0, 0, 0, 0, 0, "URL" },
	{ 0x5F52, 0, 0, 1, 0, 0, 0, 0, "Historical Bytes" },
	{ 0x0065, 1, 0, 1, 0, 0, 0, 0, "Cardholder Related Data"},
	{ 0x005B, 0, 0x65, 0, 0, 0, 0, 0, "Name" },
	{ 0x5F2D, 0, 0x65, 0, 0, 0, 0, 0, "Language preferences" },
	{ 0x5F35, 0, 0x65, 0, 0, 0, 0, 0, "Sex" },
	{ 0x006E, 1, 0, 1, 0, 0, 0, 0, "Application Related Data" },
	{ 0x004F, 0, 0x6E, 1, 0, 0, 0, 0, "AID" },
	{ 0x0073, 1, 0, 1, 0, 0, 0, 0, "Discretionary Data Objects" },
	{ 0x0047, 0, 0x6E, 1, 1, 0, 0, 0, "Card Capabilities" },
	{ 0x00C0, 0, 0x6E, 1, 1, 0, 0, 0, "Extended Card Capabilities" },
	{ 0x00C1, 0, 0x6E, 1, 1, 0, 0, 0, "Algorithm Attributes Signature" },
	{ 0x00C2, 0, 0x6E, 1, 1, 0, 0, 0, "Algorithm Attributes Decryption" },
	{ 0x00C3, 0, 0x6E, 1, 1, 0, 0, 0, "Algorithm Attributes Authentication" },
	{ 0x00C4, 0, 0x6E, 1, 0, 1, 1, 0, "CHV Status Bytes" },
	{ 0x00C5, 0, 0x6E, 1, 0, 0, 0, 0, "Fingerprints" },
	{ 0x00C6, 0, 0x6E, 1, 0, 0, 0, 0, "CA Fingerprints" },
	{ 0x00CD, 0, 0x6E, 1, 0, 0, 0, 0, "Generation time" },
	{ 0x007A, 1, 0, 1, 0, 0, 0, 0, "Security Support Template" },
	{ 0x0093, 0, 0x7A, 1, 1, 0, 0, 0, "Digital Signature Counter" },
	{ 0x0101, 0, 0, 0, 0, 0, 0, 0, "Private DO 1"},
	{ 0x0102, 0, 0, 0, 0, 0, 0, 0, "Private DO 2"},
	{ 0x0103, 0, 0, 0, 0, 0, 0, 0, "Private DO 3"},
	{ 0x0104, 0, 0, 0, 0, 0, 0, 0, "Private DO 4"},
	{ 0x7F21, 1, 0, 1, 0, 0, 0, 1, "Cardholder certificate"},
	{ 0 }
	};


	/* The format of RSA private keys. */
	typedef enum
	{
	RSA_UNKNOWN_FMT,
	RSA_STD,
	RSA_STD_N,
	RSA_CRT,
	RSA_CRT_N
	}
	rsa_key_format_t;


	/* One cache item for DOs. */
	struct cache_s {
	struct cache_s *next;
	int tag;
	size_t length;
	unsigned char data[1];
	};


	/* Object with application (i.e. OpenPGP card) specific data. */
	struct app_local_s {
	/* A linked list with cached DOs. */
	struct cache_s *cache;

	/* Keep track of the public keys. */
	struct
	{
	int read_done; /* True if we have at least tried to read them. */
	unsigned char key; / This is a malloced buffer with a canonical
	encoded S-expression encoding a public
	key. Might be NULL if key is not
	available. */
	size_t keylen; /* The length of the above S-expression. This
	is usually only required for cross checks
	because the length of an S-expression is
	implicitly available. */
	} pk[3];

	unsigned char status_indicator; /* The card status indicator. */

	/* Keep track of the ISO card capabilities. */
	struct
	{
	unsigned int cmd_chaining:1; /* Command chaining is supported. */
	unsigned int ext_lc_le:1; /* Extended Lc and Le are supported. */
	} cardcap;

	/* Keep track of extended card capabilities. */
	struct
	{
	unsigned int is_v2:1; /* This is a v2.0 compatible card. */
	unsigned int get_challenge:1;
	unsigned int key_import:1;
	unsigned int change_force_chv:1;
	unsigned int private_dos:1;
	unsigned int algo_attr_change:1; /* Algorithm attributes changeable. */
	unsigned int sm_supported:1; /* Secure Messaging is supported. */
	unsigned int sm_aes128:1; /* Use AES-128 for SM. */
	unsigned int max_certlen_3:16;
	unsigned int max_get_challenge:16; /* Maximum size for get_challenge. */
	unsigned int max_cmd_data:16; /* Maximum data size for a command. */
	unsigned int max_rsp_data:16; /* Maximum size of a response. */
	} extcap;

	/* Flags used to control the application. */
	struct
	{
	unsigned int no_sync:1; /* Do not sync CHV1 and CHV2 */
	unsigned int def_chv2:1; /* Use 123456 for CHV2. */
	} flags;

	struct
	{
	unsigned int n_bits; /* Size of the modulus in bits. The rest
	of this strucuire is only valid if
	this is not 0. */
	unsigned int e_bits; /* Size of the public exponent in bits. */
	rsa_key_format_t format;
	} keyattr[3];

	};



	/*** Local prototypes ***/
	static unsigned long convert_sig_counter_value (const unsigned char *value,
	size_t valuelen);
	static unsigned long get_sig_counter (app_t app);
	static gpg_error_t do_auth (app_t app, const char *keyidstr,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *indata, size_t indatalen,
	unsigned char *outdata, size_t outdatalen);
	static void parse_algorithm_attribute (app_t app, int keyno);
	static gpg_error_t change_keyattr_from_string
	(app_t app,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *value, size_t valuelen);





	/* Deconstructor. */
	static void
	do_deinit (app_t app)
	{
	if (app && app->app_local)
	{
	struct cache_s c, c2;
	int i;

	for (c = app->app_local->cache; c; c = c2)
	{
	c2 = c->next;
	xfree (c);
	}

	for (i=0; i < DIM (app->app_local->pk); i++)
	{
	xfree (app->app_local->pk[i].key);
	app->app_local->pk[i].read_done = 0;
	}
	xfree (app->app_local);
	app->app_local = NULL;
	}
	}


	/* Wrapper around iso7816_get_data which first tries to get the data
	from the cache. With GET_IMMEDIATE passed as true, the cache is
	bypassed. With TRY_EXTLEN extended lengths APDUs are use if
	supported by the card. */
	static gpg_error_t
	get_cached_data (app_t app, int tag,
	unsigned char *result, size_t resultlen,
	int get_immediate, int try_extlen)
	{
	gpg_error_t err;
	int i;
	unsigned char *p;
	size_t len;
	struct cache_s *c;
	int exmode;

	*result = NULL;
	*resultlen = 0;

	if (!get_immediate)
	{
	for (c=app->app_local->cache; c; c = c->next)
	if (c->tag == tag)
	{
	if(c->length)
	{
	p = xtrymalloc (c->length);
	if (!p)
	return gpg_error (gpg_err_code_from_errno (errno));
	memcpy (p, c->data, c->length);
	*result = p;
	}

	*resultlen = c->length;

	return 0;
	}
	}

	if (try_extlen && app->app_local->cardcap.ext_lc_le)
	exmode = app->app_local->extcap.max_rsp_data;
	else
	exmode = 0;

	err = iso7816_get_data (app->slot, exmode, tag, &p, &len);
	if (err)
	return err;
	*result = p;
	*resultlen = len;

	/* Check whether we should cache this object. */
	if (get_immediate)
	return 0;

	for (i=0; data_objects[i].tag; i++)
	if (data_objects[i].tag == tag)
	{
	if (data_objects[i].dont_cache)
	return 0;
	break;
	}

	/* Okay, cache it. */
	for (c=app->app_local->cache; c; c = c->next)
	assert (c->tag != tag);

	c = xtrymalloc (sizeof *c + len);
	if (c)
	{
	memcpy (c->data, p, len);
	c->length = len;
	c->tag = tag;
	c->next = app->app_local->cache;
	app->app_local->cache = c;
	}

	return 0;
	}

	/* Remove DO at TAG from the cache. */
	static void
	flush_cache_item (app_t app, int tag)
	{
	struct cache_s c, cprev;
	int i;

	if (!app->app_local)
	return;

	for (c=app->app_local->cache, cprev=NULL; c ; cprev=c, c = c->next)
	if (c->tag == tag)
	{
	if (cprev)
	cprev->next = c->next;
	else
	app->app_local->cache = c->next;
	xfree (c);

	for (c=app->app_local->cache; c ; c = c->next)
	{
	assert (c->tag != tag); /* Oops: duplicated entry. */
	}
	return;
	}

	/* Try again if we have an outer tag. */
	for (i=0; data_objects[i].tag; i++)
	if (data_objects[i].tag == tag && data_objects[i].get_from
	&& data_objects[i].get_from != tag)
	flush_cache_item (app, data_objects[i].get_from);
	}

	/* Flush all entries from the cache which might be out of sync after
	an error. */
	static void
	flush_cache_after_error (app_t app)
	{
	int i;

	for (i=0; data_objects[i].tag; i++)
	if (data_objects[i].flush_on_error)
	flush_cache_item (app, data_objects[i].tag);
	}


	/* Flush the entire cache. */
	static void
	flush_cache (app_t app)
	{
	if (app && app->app_local)
	{
	struct cache_s c, c2;

	for (c = app->app_local->cache; c; c = c2)
	{
	c2 = c->next;
	xfree (c);
	}
	app->app_local->cache = NULL;
	}
	}


	/* Get the DO identified by TAG from the card in SLOT and return a
	buffer with its content in RESULT and NBYTES. The return value is
	NULL if not found or a pointer which must be used to release the
	buffer holding value. */
	static void *
	get_one_do (app_t app, int tag, unsigned char *result, size_t nbytes,
	int *r_rc)
	{
	int rc, i;
	unsigned char *buffer;
	size_t buflen;
	unsigned char *value;
	size_t valuelen;
	int dummyrc;
	int exmode;

	if (!r_rc)
	r_rc = &dummyrc;

	*result = NULL;
	*nbytes = 0;
	*r_rc = 0;
	for (i=0; data_objects[i].tag && data_objects[i].tag != tag; i++)
	;

	if (app->card_version > 0x0100 && data_objects[i].get_immediate_in_v11)
	{
	if (data_objects[i].try_extlen && app->app_local->cardcap.ext_lc_le)
	exmode = app->app_local->extcap.max_rsp_data;
	else
	exmode = 0;
	rc = iso7816_get_data (app->slot, exmode, tag, &buffer, &buflen);
	if (rc)
	{
	*r_rc = rc;
	return NULL;
	}
	*result = buffer;
	*nbytes = buflen;
	return buffer;
	}

	value = NULL;
	rc = -1;
	if (data_objects[i].tag && data_objects[i].get_from)
	{
	rc = get_cached_data (app, data_objects[i].get_from,
	&buffer, &buflen,
	(data_objects[i].dont_cache
	\|\| data_objects[i].get_immediate_in_v11),
	data_objects[i].try_extlen);
	if (!rc)
	{
	const unsigned char *s;

	s = find_tlv_unchecked (buffer, buflen, tag, &valuelen);
	if (!s)
	value = NULL; /* not found */
	else if (valuelen > buflen - (s - buffer))
	{
	log_error ("warning: constructed DO too short\n");
	value = NULL;
	xfree (buffer); buffer = NULL;
	}
	else
	value = buffer + (s - buffer);
	}
	}

	if (!value) /* Not in a constructed DO, try simple. */
	{
	rc = get_cached_data (app, tag, &buffer, &buflen,
	(data_objects[i].dont_cache
	\|\| data_objects[i].get_immediate_in_v11),
	data_objects[i].try_extlen);
	if (!rc)
	{
	value = buffer;
	valuelen = buflen;
	}
	}

	if (!rc)
	{
	*nbytes = valuelen;
	*result = value;
	return buffer;
	}
	*r_rc = rc;
	return NULL;
	}


	static void
	dump_all_do (int slot)
	{
	int rc, i, j;
	unsigned char *buffer;
	size_t buflen;

	for (i=0; data_objects[i].tag; i++)
	{
	if (data_objects[i].get_from)
	continue;

	/* We don't try extended length APDU because such large DO would
	be pretty useless in a log file. */
	rc = iso7816_get_data (slot, 0, data_objects[i].tag, &buffer, &buflen);
	if (gpg_err_code (rc) == GPG_ERR_NO_OBJ)
	;
	else if (rc)
	log_info ("DO `%s' not available: %s\n",
	data_objects[i].desc, gpg_strerror (rc));
	else
	{
	if (data_objects[i].binary)
	{
	log_info ("DO `%s': ", data_objects[i].desc);
	log_printhex ("", buffer, buflen);
	}
	else
	log_info ("DO `%s': `%.*s'\n",
	data_objects[i].desc,
	(int)buflen, buffer); /* FIXME: sanitize */

	if (data_objects[i].constructed)
	{
	for (j=0; data_objects[j].tag; j++)
	{
	const unsigned char *value;
	size_t valuelen;

	if (j==i \|\| data_objects[i].tag != data_objects[j].get_from)
	continue;
	value = find_tlv_unchecked (buffer, buflen,
	data_objects[j].tag, &valuelen);
	if (!value)
	; /* not found */
	else if (valuelen > buflen - (value - buffer))
	log_error ("warning: constructed DO too short\n");
	else
	{
	if (data_objects[j].binary)
	{
	log_info ("DO `%s': ", data_objects[j].desc);
	if (valuelen > 200)
	log_info ("[%u]\n", (unsigned int)valuelen);
	else
	log_printhex ("", value, valuelen);
	}
	else
	log_info ("DO `%s': `%.*s'\n",
	data_objects[j].desc,
	(int)valuelen, value); /* FIXME: sanitize */
	}
	}
	}
	}
	xfree (buffer); buffer = NULL;
	}
	}


	/* Count the number of bits, assuming the A represents an unsigned big
	integer of length LEN bytes. */
	static unsigned int
	count_bits (const unsigned char *a, size_t len)
	{
	unsigned int n = len * 8;
	int i;

	for (; len && !*a; len--, a++, n -=8)
	;
	if (len)
	{
	for (i=7; i && !(*a & (1<<i)); i--)
	n--;
	}
	return n;
	}

	/* GnuPG makes special use of the login-data DO, this function parses
	the login data to store the flags for later use. It may be called
	at any time and should be called after changing the login-data DO.

	Everything up to a LF is considered a mailbox or account name. If
	the first LF is followed by DC4 (0x14) control sequence are
	expected up to the next LF. Control sequences are separated by FS
	(0x18) and consist of key=value pairs. There is one key defined:

	F=<flags>

	Were FLAGS is a plain hexadecimal number representing flag values.
	The lsb is here the rightmost bit. Defined flags bits are:

	Bit 0 = CHV1 and CHV2 are not syncronized
	Bit 1 = CHV2 has been been set to the default PIN of "123456"
	(this implies that bit 0 is also set).

	*/
	static void
	parse_login_data (app_t app)
	{
	unsigned char buffer, p;
	size_t buflen, len;
	void *relptr;

	/* Set defaults. */
	app->app_local->flags.no_sync = 0;
	app->app_local->flags.def_chv2 = 0;

	/* Read the DO. */
	relptr = get_one_do (app, 0x005E, &buffer, &buflen, NULL);
	if (!relptr)
	return; /* Ooops. */
	for (; buflen; buflen--, buffer++)
	if (*buffer == '\n')
	break;
	if (buflen < 2 \|\| buffer[1] != '\x14')
	return; /* No control sequences. */
	buflen--;
	buffer++;
	do
	{
	buflen--;
	buffer++;
	if (buflen > 1 && *buffer == 'F' && buffer[1] == '=')
	{
	/* Flags control sequence found. */
	int lastdig = 0;

	/* For now we are only interested in the last digit, so skip
	any leading digits but bail out on invalid characters. */
	for (p=buffer+2, len = buflen-2; len && hexdigitp (p); p++, len--)
	lastdig = xtoi_1 (p);
	if (len && !(p == '\n' \|\| p == '\x18'))
	goto next; /* Invalid characters in field. */
	app->app_local->flags.no_sync = !!(lastdig & 1);
	app->app_local->flags.def_chv2 = (lastdig & 3) == 3;
	}
	next:
	for (; buflen && *buffer != '\x18'; buflen--, buffer++)
	if (*buffer == '\n')
	buflen = 1;
	}
	while (buflen);

	xfree (relptr);
	}

	/* Note, that FPR must be at least 20 bytes. */
	static gpg_error_t
	store_fpr (app_t app, int keynumber, u32 timestamp,
	const unsigned char *m, size_t mlen,
	const unsigned char *e, size_t elen,
	unsigned char *fpr, unsigned int card_version)
	{
	unsigned int n, nbits;
	unsigned char buffer, p;
	int tag, tag2;
	int rc;

	for (; mlen && !m; mlen--, m++) / strip leading zeroes */
	;
	for (; elen && !e; elen--, e++) / strip leading zeroes */
	;

	n = 6 + 2 + mlen + 2 + elen;
	p = buffer = xtrymalloc (3 + n);
	if (!buffer)
	return gpg_error_from_syserror ();

	p++ = 0x99; / ctb */
	p++ = n >> 8; / 2 byte length header */
	*p++ = n;
	p++ = 4; / key packet version */
	*p++ = timestamp >> 24;
	*p++ = timestamp >> 16;
	*p++ = timestamp >> 8;
	*p++ = timestamp;
	p++ = 1; / RSA */
	nbits = count_bits (m, mlen);
	*p++ = nbits >> 8;
	*p++ = nbits;
	memcpy (p, m, mlen); p += mlen;
	nbits = count_bits (e, elen);
	*p++ = nbits >> 8;
	*p++ = nbits;
	memcpy (p, e, elen); p += elen;

	gcry_md_hash_buffer (GCRY_MD_SHA1, fpr, buffer, n+3);

	xfree (buffer);

	tag = (card_version > 0x0007? 0xC7 : 0xC6) + keynumber;
	flush_cache_item (app, tag);
	tag2 = 0xCE + keynumber;
	flush_cache_item (app, tag2);

	rc = iso7816_put_data (app->slot, 0, tag, fpr, 20);
	if (rc)
	log_error (_("failed to store the fingerprint: %s\n"),gpg_strerror (rc));

	if (!rc && card_version > 0x0100)
	{
	unsigned char buf[4];

	buf[0] = timestamp >> 24;
	buf[1] = timestamp >> 16;
	buf[2] = timestamp >> 8;
	buf[3] = timestamp;

	rc = iso7816_put_data (app->slot, 0, tag2, buf, 4);
	if (rc)
	log_error (_("failed to store the creation date: %s\n"),
	gpg_strerror (rc));
	}

	return rc;
	}


	static void
	send_fpr_if_not_null (ctrl_t ctrl, const char *keyword,
	int number, const unsigned char *fpr)
	{
	int i;
	char buf[41];
	char numbuf[25];

	for (i=0; i < 20 && !fpr[i]; i++)
	;
	if (i==20)
	return; /* All zero. */
	bin2hex (fpr, 20, buf);
	if (number == -1)
	numbuf = 0; / Don't print the key number */
	else
	sprintf (numbuf, "%d", number);
	send_status_info (ctrl, keyword,
	numbuf, (size_t)strlen(numbuf),
	buf, (size_t)strlen (buf), NULL, 0);
	}

	static void
	send_fprtime_if_not_null (ctrl_t ctrl, const char *keyword,
	int number, const unsigned char *stamp)
	{
	char numbuf1[50], numbuf2[50];
	unsigned long value;

	value = (stamp[0] << 24) \| (stamp[1]<<16) \| (stamp[2]<<8) \| stamp[3];
	if (!value)
	return;
	sprintf (numbuf1, "%d", number);
	sprintf (numbuf2, "%lu", value);
	send_status_info (ctrl, keyword,
	numbuf1, (size_t)strlen(numbuf1),
	numbuf2, (size_t)strlen(numbuf2), NULL, 0);
	}

	static void
	send_key_data (ctrl_t ctrl, const char *name,
	const unsigned char *a, size_t alen)
	{
	char *buf;

	buf = bin2hex (a, alen, NULL);
	if (!buf)
	{
	log_error ("memory allocation error in send_key_data\n");
	return;
	}

	send_status_info (ctrl, "KEY-DATA",
	name, (size_t)strlen(name),
	buf, (size_t)strlen (buf),
	NULL, 0);
	xfree (buf);
	}


	static void
	send_key_attr (ctrl_t ctrl, app_t app, const char *keyword, int number)
	{
	char buffer[200];

	assert (number >=0 && number < DIM(app->app_local->keyattr));

	/* We only support RSA thus the algo identifier is fixed to 1. */
	snprintf (buffer, sizeof buffer, "%d 1 %u %u %d",
	number+1,
	app->app_local->keyattr[number].n_bits,
	app->app_local->keyattr[number].e_bits,
	app->app_local->keyattr[number].format);
	send_status_direct (ctrl, keyword, buffer);
	}


	/* Implement the GETATTR command. This is similar to the LEARN
	command but returns just one value via the status interface. */
	static gpg_error_t
	do_getattr (app_t app, ctrl_t ctrl, const char *name)
	{
	static struct {
	const char *name;
	int tag;
	int special;
	} table[] = {
	{ "DISP-NAME", 0x005B },
	{ "LOGIN-DATA", 0x005E },
	{ "DISP-LANG", 0x5F2D },
	{ "DISP-SEX", 0x5F35 },
	{ "PUBKEY-URL", 0x5F50 },
	{ "KEY-FPR", 0x00C5, 3 },
	{ "KEY-TIME", 0x00CD, 4 },
	{ "KEY-ATTR", 0x0000, -5 },
	{ "CA-FPR", 0x00C6, 3 },
	{ "CHV-STATUS", 0x00C4, 1 },
	{ "SIG-COUNTER", 0x0093, 2 },
	{ "SERIALNO", 0x004F, -1 },
	{ "AID", 0x004F },
	{ "EXTCAP", 0x0000, -2 },
	{ "PRIVATE-DO-1", 0x0101 },
	{ "PRIVATE-DO-2", 0x0102 },
	{ "PRIVATE-DO-3", 0x0103 },
	{ "PRIVATE-DO-4", 0x0104 },
	{ "$AUTHKEYID", 0x0000, -3 },
	{ "$DISPSERIALNO",0x0000, -4 },
	{ NULL, 0 }
	};
	int idx, i, rc;
	void *relptr;
	unsigned char *value;
	size_t valuelen;

	for (idx=0; table[idx].name && strcmp (table[idx].name, name); idx++)
	;
	if (!table[idx].name)
	return gpg_error (GPG_ERR_INV_NAME);

	if (table[idx].special == -1)
	{
	/* The serial number is very special. We could have used the
	AID DO to retrieve it, but we have it already in the app
	context and the stamp argument is required anyway which we
	can't by other means. The AID DO is available anyway but not
	hex formatted. */
	char *serial;
	time_t stamp;
	char tmp[50];

	if (!app_get_serial_and_stamp (app, &serial, &stamp))
	{
	sprintf (tmp, "%lu", (unsigned long)stamp);
	send_status_info (ctrl, "SERIALNO",
	serial, strlen (serial),
	tmp, strlen (tmp),
	NULL, 0);
	xfree (serial);
	}
	return 0;
	}
	if (table[idx].special == -2)
	{
	char tmp[100];

	snprintf (tmp, sizeof tmp,
	"gc=%d ki=%d fc=%d pd=%d mcl3=%u aac=%d sm=%d",
	app->app_local->extcap.get_challenge,
	app->app_local->extcap.key_import,
	app->app_local->extcap.change_force_chv,
	app->app_local->extcap.private_dos,
	app->app_local->extcap.max_certlen_3,
	app->app_local->extcap.algo_attr_change,
	(app->app_local->extcap.sm_supported
	? (app->app_local->extcap.sm_aes128? 7 : 2)
	: 0));
	send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
	return 0;
	}
	if (table[idx].special == -3)
	{
	char const tmp[] = "OPENPGP.3";
	send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
	return 0;
	}
	if (table[idx].special == -4)
	{
	char *serial;
	time_t stamp;

	if (!app_get_serial_and_stamp (app, &serial, &stamp))
	{
	if (strlen (serial) > 16+12)
	{
	send_status_info (ctrl, table[idx].name, serial+16, 12, NULL, 0);
	xfree (serial);
	return 0;
	}
	xfree (serial);
	}
	return gpg_error (GPG_ERR_INV_NAME);
	}
	if (table[idx].special == -5)
	{
	for (i=0; i < 3; i++)
	send_key_attr (ctrl, app, table[idx].name, i);
	return 0;
	}

	relptr = get_one_do (app, table[idx].tag, &value, &valuelen, &rc);
	if (relptr)
	{
	if (table[idx].special == 1)
	{
	char numbuf[7*23];

	for (i=0,*numbuf=0; i < valuelen && i < 7; i++)
	sprintf (numbuf+strlen (numbuf), " %d", value[i]);
	send_status_info (ctrl, table[idx].name,
	numbuf, strlen (numbuf), NULL, 0);
	}
	else if (table[idx].special == 2)
	{
	char numbuf[50];

	sprintf (numbuf, "%lu", convert_sig_counter_value (value, valuelen));
	send_status_info (ctrl, table[idx].name,
	numbuf, strlen (numbuf), NULL, 0);
	}
	else if (table[idx].special == 3)
	{
	if (valuelen >= 60)
	for (i=0; i < 3; i++)
	send_fpr_if_not_null (ctrl, table[idx].name, i+1, value+i*20);
	}
	else if (table[idx].special == 4)
	{
	if (valuelen >= 12)
	for (i=0; i < 3; i++)
	send_fprtime_if_not_null (ctrl, table[idx].name, i+1, value+i*4);
	}
	else
	send_status_info (ctrl, table[idx].name, value, valuelen, NULL, 0);

	xfree (relptr);
	}
	return rc;
	}

	/* Retrieve the fingerprint from the card inserted in SLOT and write
	the according hex representation to FPR. Caller must have provide
	a buffer at FPR of least 41 bytes. Returns 0 on success or an
	error code. */
	#if GNUPG_MAJOR_VERSION > 1
	static gpg_error_t
	retrieve_fpr_from_card (app_t app, int keyno, char *fpr)
	{
	gpg_error_t err = 0;
	void *relptr;
	unsigned char *value;
	size_t valuelen;

	assert (keyno >=0 && keyno <= 2);

	relptr = get_one_do (app, 0x00C5, &value, &valuelen, NULL);
	if (relptr && valuelen >= 60)
	bin2hex (value+keyno*20, 20, fpr);
	else
	err = gpg_error (GPG_ERR_NOT_FOUND);
	xfree (relptr);
	return err;
	}
	#endif /GNUPG_MAJOR_VERSION > 1/


	/* Retrieve the public key material for the RSA key, whose fingerprint
	is FPR, from gpg output, which can be read through the stream FP.
	The RSA modulus will be stored at the address of M and MLEN, the
	public exponent at E and ELEN. Returns zero on success, an error
	code on failure. Caller must release the allocated buffers at M
	and E if the function returns success. */
	#if GNUPG_MAJOR_VERSION > 1
	static gpg_error_t
	retrieve_key_material (FILE fp, const char hexkeyid,
	const unsigned char *m, size_t mlen,
	const unsigned char *e, size_t elen)
	{
	gcry_error_t err = 0;
	char line = NULL; / read_line() buffer. */
	size_t line_size = 0; /* Helper for for read_line. */
	int found_key = 0; /* Helper to find a matching key. */
	unsigned char *m_new = NULL;
	unsigned char *e_new = NULL;
	size_t m_new_n = 0;
	size_t e_new_n = 0;

	/* Loop over all records until we have found the subkey
	corresponding to the fingerprint. Inm general the first record
	should be the pub record, but we don't rely on that. Given that
	we only need to look at one key, it is sufficient to compare the
	keyid so that we don't need to look at "fpr" records. */
	for (;;)
	{
	char *p;
	char *fields[6];
	int nfields;
	size_t max_length;
	gcry_mpi_t mpi;
	int i;

	max_length = 4096;
	i = read_line (fp, &line, &line_size, &max_length);
	if (!i)
	break; /* EOF. */
	if (i < 0)
	{
	err = gpg_error_from_syserror ();
	goto leave; /* Error. */
	}
	if (!max_length)
	{
	err = gpg_error (GPG_ERR_TRUNCATED);
	goto leave; /* Line truncated - we better stop processing. */
	}

	/* Parse the line into fields. */
	for (nfields=0, p=line; p && nfields < DIM (fields); nfields++)
	{
	fields[nfields] = p;
	p = strchr (p, ':');
	if (p)
	*(p++) = 0;
	}
	if (!nfields)
	continue; /* No fields at all - skip line. */

	if (!found_key)
	{
	if ( (!strcmp (fields[0], "sub") \|\| !strcmp (fields[0], "pub") )
	&& nfields > 4 && !strcmp (fields[4], hexkeyid))
	found_key = 1;
	continue;
	}

	if ( !strcmp (fields[0], "sub") \|\| !strcmp (fields[0], "pub") )
	break; /* Next key - stop. */

	if ( strcmp (fields[0], "pkd") )
	continue; /* Not a key data record. */
	i = 0; /* Avoid erroneous compiler warning. */
	if ( nfields < 4 \|\| (i = atoi (fields[1])) < 0 \|\| i > 1
	\|\| (!i && m_new) \|\| (i && e_new))
	{
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave; /* Error: Invalid key data record or not an RSA key. */
	}

	err = gcry_mpi_scan (&mpi, GCRYMPI_FMT_HEX, fields[3], 0, NULL);
	if (err)
	mpi = NULL;
	else if (!i)
	err = gcry_mpi_aprint (GCRYMPI_FMT_STD, &m_new, &m_new_n, mpi);
	else
	err = gcry_mpi_aprint (GCRYMPI_FMT_STD, &e_new, &e_new_n, mpi);
	gcry_mpi_release (mpi);
	if (err)
	goto leave;
	}

	if (m_new && e_new)
	{
	*m = m_new;
	*mlen = m_new_n;
	m_new = NULL;
	*e = e_new;
	*elen = e_new_n;
	e_new = NULL;
	}
	else
	err = gpg_error (GPG_ERR_GENERAL);

	leave:
	xfree (m_new);
	xfree (e_new);
	xfree (line);
	return err;
	}
	#endif /GNUPG_MAJOR_VERSION > 1/


	/* Get the public key for KEYNO and store it as an S-expresion with
	the APP handle. On error that field gets cleared. If we already
	know about the public key we will just return. Note that this does
	not mean a key is available; this is soley indicated by the
	presence of the app->app_local->pk[KEYNO-1].key field.

	Note that GnuPG 1.x does not need this and it would be too time
	consuming to send it just for the fun of it. However, given that we
	use the same code in gpg 1.4, we can't use the gcry S-expresion
	here but need to open encode it. */
	#if GNUPG_MAJOR_VERSION > 1
	static gpg_error_t
	get_public_key (app_t app, int keyno)
	{
	gpg_error_t err = 0;
	unsigned char *buffer;
	const unsigned char keydata, m, *e;
	size_t buflen, keydatalen, mlen, elen;
	unsigned char *mbuf = NULL;
	unsigned char *ebuf = NULL;
	char *keybuf = NULL;
	char *keybuf_p;

	if (keyno < 1 \|\| keyno > 3)
	return gpg_error (GPG_ERR_INV_ID);
	keyno--;

	/* Already cached? */
	if (app->app_local->pk[keyno].read_done)
	return 0;

	xfree (app->app_local->pk[keyno].key);
	app->app_local->pk[keyno].key = NULL;
	app->app_local->pk[keyno].keylen = 0;

	m = e = NULL; /* (avoid cc warning) */

	if (app->card_version > 0x0100)
	{
	int exmode, le_value;

	/* We may simply read the public key out of these cards. */
	if (app->app_local->cardcap.ext_lc_le)
	{
	exmode = 1; /* Use extended length. */
	le_value = app->app_local->extcap.max_rsp_data;
	}
	else
	{
	exmode = 0;
	le_value = 256; /* Use legacy value. */
	}

	err = iso7816_read_public_key
	(app->slot, exmode,
	(const unsigned char*)(keyno == 0? "\xB6" :
	keyno == 1? "\xB8" : "\xA4"), 2,
	le_value,
	&buffer, &buflen);
	if (err)
	{
	log_error (_("reading public key failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	keydata = find_tlv (buffer, buflen, 0x7F49, &keydatalen);
	if (!keydata)
	{
	err = gpg_error (GPG_ERR_CARD);
	log_error (_("response does not contain the public key data\n"));
	goto leave;
	}

	m = find_tlv (keydata, keydatalen, 0x0081, &mlen);
	if (!m)
	{
	err = gpg_error (GPG_ERR_CARD);
	log_error (_("response does not contain the RSA modulus\n"));
	goto leave;
	}


	e = find_tlv (keydata, keydatalen, 0x0082, &elen);
	if (!e)
	{
	err = gpg_error (GPG_ERR_CARD);
	log_error (_("response does not contain the RSA public exponent\n"));
	goto leave;
	}

	/* Prepend numbers with a 0 if needed. */
	if (mlen && (*m & 0x80))
	{
	mbuf = xtrymalloc ( mlen + 1);
	if (!mbuf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	*mbuf = 0;
	memcpy (mbuf+1, m, mlen);
	mlen++;
	m = mbuf;
	}
	if (elen && (*e & 0x80))
	{
	ebuf = xtrymalloc ( elen + 1);
	if (!ebuf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	*ebuf = 0;
	memcpy (ebuf+1, e, elen);
	elen++;
	e = ebuf;
	}

	}
	else
	{
	/* Due to a design problem in v1.0 cards we can't get the public
	key out of these cards without doing a verify on CHV3.
	Clearly that is not an option and thus we try to locate the
	key using an external helper.

	The helper we use here is gpg itself, which should know about
	the key in any case. */

	char fpr[41];
	char *hexkeyid;
	char *command = NULL;
	FILE *fp;
	int ret;

	buffer = NULL; /* We don't need buffer. */

	err = retrieve_fpr_from_card (app, keyno, fpr);
	if (err)
	{
	log_error ("error while retrieving fpr from card: %s\n",
	gpg_strerror (err));
	goto leave;
	}
	hexkeyid = fpr + 24;

	ret = estream_asprintf (&command,
	"gpg --list-keys --with-colons --with-key-data '%s'",
	fpr);
	if (ret < 0)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	fp = popen (command, "r");
	xfree (command);
	if (!fp)
	{
	err = gpg_error_from_syserror ();
	log_error ("running gpg failed: %s\n", gpg_strerror (err));
	goto leave;
	}

	err = retrieve_key_material (fp, hexkeyid, &m, &mlen, &e, &elen);
	fclose (fp);
	if (err)
	{
	log_error ("error while retrieving key material through pipe: %s\n",
	gpg_strerror (err));
	goto leave;
	}
	}

	/* Allocate a buffer to construct the S-expression. */
	/* FIXME: We should provide a generalized S-expression creation
	mechanism. */
	keybuf = xtrymalloc (50 + 2*35 + mlen + elen + 1);
	if (!keybuf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	sprintf (keybuf, "(10:public-key(3:rsa(1:n%u:", (unsigned int) mlen);
	keybuf_p = keybuf + strlen (keybuf);
	memcpy (keybuf_p, m, mlen);
	keybuf_p += mlen;
	sprintf (keybuf_p, ")(1:e%u:", (unsigned int)elen);
	keybuf_p += strlen (keybuf_p);
	memcpy (keybuf_p, e, elen);
	keybuf_p += elen;
	strcpy (keybuf_p, ")))");
	keybuf_p += strlen (keybuf_p);

	app->app_local->pk[keyno].key = (unsigned char*)keybuf;
	app->app_local->pk[keyno].keylen = (keybuf_p - keybuf);

	leave:
	/* Set a flag to indicate that we tried to read the key. */
	app->app_local->pk[keyno].read_done = 1;

	xfree (buffer);
	xfree (mbuf);
	xfree (ebuf);
	return 0;
	}
	#endif /* GNUPG_MAJOR_VERSION > 1 */



	/* Send the KEYPAIRINFO back. KEYNO needs to be in the range [1,3].
	This is used by the LEARN command. */
	static gpg_error_t
	send_keypair_info (app_t app, ctrl_t ctrl, int keyno)
	{
	gpg_error_t err = 0;
	/* Note that GnuPG 1.x does not need this and it would be too time
	consuming to send it just for the fun of it. */
	#if GNUPG_MAJOR_VERSION > 1
	unsigned char grip[20];
	char gripstr[41];
	char idbuf[50];

	err = get_public_key (app, keyno);
	if (err)
	goto leave;

	assert (keyno >= 1 && keyno <= 3);
	if (!app->app_local->pk[keyno-1].key)
	goto leave; /* No such key - ignore. */

	err = keygrip_from_canon_sexp (app->app_local->pk[keyno-1].key,
	app->app_local->pk[keyno-1].keylen,
	grip);
	if (err)
	goto leave;

	bin2hex (grip, 20, gripstr);

	sprintf (idbuf, "OPENPGP.%d", keyno);
	send_status_info (ctrl, "KEYPAIRINFO",
	gripstr, 40,
	idbuf, strlen (idbuf),
	NULL, (size_t)0);

	leave:
	#endif /* GNUPG_MAJOR_VERSION > 1 */

	return err;
	}


	/* Handle the LEARN command for OpenPGP. */
	static gpg_error_t
	do_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
	{
	(void)flags;

	do_getattr (app, ctrl, "EXTCAP");
	do_getattr (app, ctrl, "DISP-NAME");
	do_getattr (app, ctrl, "DISP-LANG");
	do_getattr (app, ctrl, "DISP-SEX");
	do_getattr (app, ctrl, "PUBKEY-URL");
	do_getattr (app, ctrl, "LOGIN-DATA");
	do_getattr (app, ctrl, "KEY-FPR");
	if (app->card_version > 0x0100)
	do_getattr (app, ctrl, "KEY-TIME");
	do_getattr (app, ctrl, "CA-FPR");
	do_getattr (app, ctrl, "CHV-STATUS");
	do_getattr (app, ctrl, "SIG-COUNTER");
	if (app->app_local->extcap.private_dos)
	{
	do_getattr (app, ctrl, "PRIVATE-DO-1");
	do_getattr (app, ctrl, "PRIVATE-DO-2");
	if (app->did_chv2)
	do_getattr (app, ctrl, "PRIVATE-DO-3");
	if (app->did_chv3)
	do_getattr (app, ctrl, "PRIVATE-DO-4");
	}
	send_keypair_info (app, ctrl, 1);
	send_keypair_info (app, ctrl, 2);
	send_keypair_info (app, ctrl, 3);
	/* Note: We do not send the Cardholder Certificate, because that is
	relativly long and for OpenPGP applications not really needed. */
	return 0;
	}


	/* Handle the READKEY command for OpenPGP. On success a canonical
	encoded S-expression with the public key will get stored at PK and
	its length (for assertions) at PKLEN; the caller must release that
	buffer. On error PK and PKLEN are not changed and an error code is
	returned. */
	static gpg_error_t
	do_readkey (app_t app, const char keyid, unsigned char pk, size_t pklen)
	{
	#if GNUPG_MAJOR_VERSION > 1
	gpg_error_t err;
	int keyno;
	unsigned char *buf;

	if (!strcmp (keyid, "OPENPGP.1"))
	keyno = 1;
	else if (!strcmp (keyid, "OPENPGP.2"))
	keyno = 2;
	else if (!strcmp (keyid, "OPENPGP.3"))
	keyno = 3;
	else
	return gpg_error (GPG_ERR_INV_ID);

	err = get_public_key (app, keyno);
	if (err)
	return err;

	buf = app->app_local->pk[keyno-1].key;
	if (!buf)
	return gpg_error (GPG_ERR_NO_PUBKEY);
	*pklen = app->app_local->pk[keyno-1].keylen;;
	pk = xtrymalloc (pklen);
	if (!*pk)
	{
	err = gpg_error_from_syserror ();
	*pklen = 0;
	return err;
	}
	memcpy (pk, buf, pklen);
	return 0;
	#else
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	#endif
	}

	/* Read the standard certificate of an OpenPGP v2 card. It is
	returned in a freshly allocated buffer with that address stored at
	CERT and the length of the certificate stored at CERTLEN. CERTID
	needs to be set to "OPENPGP.3". */
	static gpg_error_t
	do_readcert (app_t app, const char *certid,
	unsigned char *cert, size_t certlen)
	{
	#if GNUPG_MAJOR_VERSION > 1
	gpg_error_t err;
	unsigned char *buffer;
	size_t buflen;
	void *relptr;

	*cert = NULL;
	*certlen = 0;
	if (strcmp (certid, "OPENPGP.3"))
	return gpg_error (GPG_ERR_INV_ID);
	if (!app->app_local->extcap.is_v2)
	return gpg_error (GPG_ERR_NOT_FOUND);

	relptr = get_one_do (app, 0x7F21, &buffer, &buflen, NULL);
	if (!relptr)
	return gpg_error (GPG_ERR_NOT_FOUND);

	if (!buflen)
	err = gpg_error (GPG_ERR_NOT_FOUND);
	else if (!(*cert = xtrymalloc (buflen)))
	err = gpg_error_from_syserror ();
	else
	{
	memcpy (*cert, buffer, buflen);
	*certlen = buflen;
	err = 0;
	}
	xfree (relptr);
	return err;
	#else
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	#endif
	}


	/* Verify a CHV either using using the pinentry or if possibile by
	using a keypad. PINCB and PINCB_ARG describe the usual callback
	for the pinentry. CHVNO must be either 1 or 2. SIGCOUNT is only
	used with CHV1. PINVALUE is the address of a pointer which will
	receive a newly allocated block with the actual PIN (this is useful
	in case that PIN shall be used for another verify operation). The
	caller needs to free this value. If the function returns with
	success and NULL is stored at PINVALUE, the caller should take this
	as an indication that the keypad has been used.
	*/
	static gpg_error_t
	verify_a_chv (app_t app,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	int chvno, unsigned long sigcount, char **pinvalue)
	{
	int rc = 0;
	char *prompt_buffer = NULL;
	const char *prompt;
	iso7816_pininfo_t pininfo;
	int minlen = 6;

	assert (chvno == 1 \|\| chvno == 2);

	*pinvalue = NULL;

	if (chvno == 2 && app->app_local->flags.def_chv2)
	{
	/* Special case for def_chv2 mechanism. */
	if (opt.verbose)
	log_info (_("using default PIN as %s\n"), "CHV2");
	rc = iso7816_verify (app->slot, 0x82, "123456", 6);
	if (rc)
	{
	/* Verification of CHV2 with the default PIN failed,
	although the card pretends to have the default PIN set as
	CHV2. We better disable the def_chv2 flag now. */
	log_info (_("failed to use default PIN as %s: %s"
	" - disabling further default use\n"),
	"CHV2", gpg_strerror (rc));
	app->app_local->flags.def_chv2 = 0;
	}
	return rc;
	}

	memset (&pininfo, 0, sizeof pininfo);
	pininfo.mode = 1;
	pininfo.minlen = minlen;


	if (chvno == 1)
	{
	#define PROMPTSTRING _("\|\|Please enter the PIN%%0A[sigs done: %lu]")
	size_t promptsize = strlen (PROMPTSTRING) + 50;

	prompt_buffer = xtrymalloc (promptsize);
	if (!prompt_buffer)
	return gpg_error_from_syserror ();
	snprintf (prompt_buffer, promptsize-1, PROMPTSTRING, sigcount);
	prompt = prompt_buffer;
	#undef PROMPTSTRING
	}
	else
	prompt = _("\|\|Please enter the PIN");


	if (!opt.disable_keypad
	&& !iso7816_check_keypad (app->slot, ISO7816_VERIFY, &pininfo) )
	{
	/* The reader supports the verify command through the keypad.
	Note that the pincb appends a text to the prompt telling the
	user to use the keypad. */
	rc = pincb (pincb_arg, prompt, NULL);
	prompt = NULL;
	xfree (prompt_buffer);
	prompt_buffer = NULL;
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	return rc;
	}
	rc = iso7816_verify_kp (app->slot, 0x80+chvno, "", 0, &pininfo);
	/* Dismiss the prompt. */
	pincb (pincb_arg, NULL, NULL);

	assert (!*pinvalue);
	}
	else
	{
	/* The reader has no keypad or we don't want to use it. */
	rc = pincb (pincb_arg, prompt, pinvalue);
	prompt = NULL;
	xfree (prompt_buffer);
	prompt_buffer = NULL;
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	return rc;
	}

	if (strlen (*pinvalue) < minlen)
	{
	log_error (_("PIN for CHV%d is too short;"
	" minimum length is %d\n"), chvno, minlen);
	xfree (*pinvalue);
	*pinvalue = NULL;
	return gpg_error (GPG_ERR_BAD_PIN);
	}

	rc = iso7816_verify (app->slot, 0x80+chvno,
	pinvalue, strlen (pinvalue));
	}

	if (rc)
	{
	log_error (_("verify CHV%d failed: %s\n"), chvno, gpg_strerror (rc));
	xfree (*pinvalue);
	*pinvalue = NULL;
	flush_cache_after_error (app);
	}

	return rc;
	}


	/* Verify CHV2 if required. Depending on the configuration of the
	card CHV1 will also be verified. */
	static gpg_error_t
	verify_chv2 (app_t app,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	int rc;
	char *pinvalue;

	if (app->did_chv2)
	return 0; /* We already verified CHV2. */

	rc = verify_a_chv (app, pincb, pincb_arg, 2, 0, &pinvalue);
	if (rc)
	return rc;
	app->did_chv2 = 1;

	if (!app->did_chv1 && !app->force_chv1 && pinvalue)
	{
	/* For convenience we verify CHV1 here too. We do this only if
	the card is not configured to require a verification before
	each CHV1 controlled operation (force_chv1) and if we are not
	using the keypad (PINVALUE == NULL). */
	rc = iso7816_verify (app->slot, 0x81, pinvalue, strlen (pinvalue));
	if (gpg_err_code (rc) == GPG_ERR_BAD_PIN)
	rc = gpg_error (GPG_ERR_PIN_NOT_SYNCED);
	if (rc)
	{
	log_error (_("verify CHV%d failed: %s\n"), 1, gpg_strerror (rc));
	flush_cache_after_error (app);
	}
	else
	app->did_chv1 = 1;
	}

	xfree (pinvalue);

	return rc;
	}


	/* Build the prompt to enter the Admin PIN. The prompt depends on the
	current sdtate of the card. */
	static gpg_error_t
	build_enter_admin_pin_prompt (app_t app, char **r_prompt)
	{
	void *relptr;
	unsigned char *value;
	size_t valuelen;
	int remaining;
	char *prompt;

	*r_prompt = NULL;

	relptr = get_one_do (app, 0x00C4, &value, &valuelen, NULL);
	if (!relptr \|\| valuelen < 7)
	{
	log_error (_("error retrieving CHV status from card\n"));
	xfree (relptr);
	return gpg_error (GPG_ERR_CARD);
	}
	if (value[6] == 0)
	{
	log_info (_("card is permanently locked!\n"));
	xfree (relptr);
	return gpg_error (GPG_ERR_BAD_PIN);
	}
	remaining = value[6];
	xfree (relptr);

	log_info(_("%d Admin PIN attempts remaining before card"
	" is permanently locked\n"), remaining);

	if (remaining < 3)
	{
	/* TRANSLATORS: Do not translate the "\|A\|" prefix but keep it at
	the start of the string. Use %%0A to force a linefeed. */
	prompt = xtryasprintf (_("\|A\|Please enter the Admin PIN%%0A"
	"[remaining attempts: %d]"), remaining);
	}
	else
	prompt = xtrystrdup (_("\|A\|Please enter the Admin PIN"));

	if (!prompt)
	return gpg_error_from_syserror ();

	*r_prompt = prompt;
	return 0;
	}


	/* Verify CHV3 if required. */
	static gpg_error_t
	verify_chv3 (app_t app,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	int rc = 0;

	#if GNUPG_MAJOR_VERSION != 1
	if (!opt.allow_admin)
	{
	log_info (_("access to admin commands is not configured\n"));
	return gpg_error (GPG_ERR_EACCES);
	}
	#endif

	if (!app->did_chv3)
	{
	iso7816_pininfo_t pininfo;
	int minlen = 8;
	char *prompt;

	memset (&pininfo, 0, sizeof pininfo);
	pininfo.mode = 1;
	pininfo.minlen = minlen;

	rc = build_enter_admin_pin_prompt (app, &prompt);
	if (rc)
	return rc;

	if (!opt.disable_keypad
	&& !iso7816_check_keypad (app->slot, ISO7816_VERIFY, &pininfo) )
	{
	/* The reader supports the verify command through the keypad. */
	rc = pincb (pincb_arg, prompt, NULL);
	xfree (prompt);
	prompt = NULL;
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	return rc;
	}
	rc = iso7816_verify_kp (app->slot, 0x83, "", 0, &pininfo);
	/* Dismiss the prompt. */
	pincb (pincb_arg, NULL, NULL);
	}
	else
	{
	char *pinvalue;

	rc = pincb (pincb_arg, prompt, &pinvalue);
	xfree (prompt);
	prompt = NULL;
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	return rc;
	}

	if (strlen (pinvalue) < minlen)
	{
	log_error (_("PIN for CHV%d is too short;"
	" minimum length is %d\n"), 3, minlen);
	xfree (pinvalue);
	return gpg_error (GPG_ERR_BAD_PIN);
	}

	rc = iso7816_verify (app->slot, 0x83, pinvalue, strlen (pinvalue));
	xfree (pinvalue);
	}

	if (rc)
	{
	log_error (_("verify CHV%d failed: %s\n"), 3, gpg_strerror (rc));
	flush_cache_after_error (app);
	return rc;
	}
	app->did_chv3 = 1;
	}
	return rc;
	}


	/* Handle the SETATTR operation. All arguments are already basically
	checked. */
	static gpg_error_t
	do_setattr (app_t app, const char *name,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const unsigned char *value, size_t valuelen)
	{
	gpg_error_t rc;
	int idx;
	static struct {
	const char *name;
	int tag;
	int need_chv;
	int special;
	unsigned int need_v2:1;
	} table[] = {
	{ "DISP-NAME", 0x005B, 3 },
	{ "LOGIN-DATA", 0x005E, 3, 2 },
	{ "DISP-LANG", 0x5F2D, 3 },
	{ "DISP-SEX", 0x5F35, 3 },
	{ "PUBKEY-URL", 0x5F50, 3 },
	{ "CHV-STATUS-1", 0x00C4, 3, 1 },
	{ "CA-FPR-1", 0x00CA, 3 },
	{ "CA-FPR-2", 0x00CB, 3 },
	{ "CA-FPR-3", 0x00CC, 3 },
	{ "PRIVATE-DO-1", 0x0101, 2 },
	{ "PRIVATE-DO-2", 0x0102, 3 },
	{ "PRIVATE-DO-3", 0x0103, 2 },
	{ "PRIVATE-DO-4", 0x0104, 3 },
	{ "CERT-3", 0x7F21, 3, 0, 1 },
	{ "SM-KEY-ENC", 0x00D1, 3, 0, 1 },
	{ "SM-KEY-MAC", 0x00D2, 3, 0, 1 },
	{ "KEY-ATTR", 0, 0, 3, 1 },
	{ NULL, 0 }
	};
	int exmode;

	for (idx=0; table[idx].name && strcmp (table[idx].name, name); idx++)
	;
	if (!table[idx].name)
	return gpg_error (GPG_ERR_INV_NAME);
	if (table[idx].need_v2 && !app->app_local->extcap.is_v2)
	return gpg_error (GPG_ERR_NOT_SUPPORTED); /* Not yet supported. */

	if (table[idx].special == 3)
	return change_keyattr_from_string (app, pincb, pincb_arg, value, valuelen);

	switch (table[idx].need_chv)
	{
	case 2:
	rc = verify_chv2 (app, pincb, pincb_arg);
	break;
	case 3:
	rc = verify_chv3 (app, pincb, pincb_arg);
	break;
	default:
	rc = 0;
	}
	if (rc)
	return rc;

	/* Flush the cache before writing it, so that the next get operation
	will reread the data from the card and thus get synced in case of
	errors (e.g. data truncated by the card). */
	flush_cache_item (app, table[idx].tag);

	if (app->app_local->cardcap.ext_lc_le && valuelen > 254)
	exmode = 1; /* Use extended length w/o a limit. */
	else if (app->app_local->cardcap.cmd_chaining && valuelen > 254)
	exmode = -254; /* Command chaining with max. 254 bytes. */
	else
	exmode = 0;
	rc = iso7816_put_data (app->slot, exmode, table[idx].tag, value, valuelen);
	if (rc)
	log_error ("failed to set `%s': %s\n", table[idx].name, gpg_strerror (rc));

	if (table[idx].special == 1)
	app->force_chv1 = (valuelen && *value == 0);
	else if (table[idx].special == 2)
	parse_login_data (app);

	return rc;
	}


	/* Handle the WRITECERT command for OpenPGP. This rites the standard
	certifciate to the card; CERTID needs to be set to "OPENPGP.3".
	PINCB and PINCB_ARG are the usual arguments for the pinentry
	callback. */
	static gpg_error_t
	do_writecert (app_t app, ctrl_t ctrl,
	const char *certidstr,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const unsigned char *certdata, size_t certdatalen)
	{
	(void)ctrl;
	#if GNUPG_MAJOR_VERSION > 1
	if (strcmp (certidstr, "OPENPGP.3"))
	return gpg_error (GPG_ERR_INV_ID);
	if (!certdata \|\| !certdatalen)
	return gpg_error (GPG_ERR_INV_ARG);
	if (!app->app_local->extcap.is_v2)
	return gpg_error (GPG_ERR_NOT_SUPPORTED);
	if (certdatalen > app->app_local->extcap.max_certlen_3)
	return gpg_error (GPG_ERR_TOO_LARGE);
	return do_setattr (app, "CERT-3", pincb, pincb_arg, certdata, certdatalen);
	#else
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	#endif
	}



	/* Handle the PASSWD command. The following combinations are
	possible:

	Flags CHVNO Vers. Description
	RESET 1 1 Verify CHV3 and set a new CHV1 and CHV2
	RESET 1 2 Verify PW3 and set a new PW1.
	RESET 2 1 Verify CHV3 and set a new CHV1 and CHV2.
	RESET 2 2 Verify PW3 and set a new Reset Code.
	RESET 3 any Returns GPG_ERR_INV_ID.
	- 1 1 Verify CHV2 and set a new CHV1 and CHV2.
	- 1 2 Verify PW1 and set a new PW1.
	- 2 1 Verify CHV2 and set a new CHV1 and CHV2.
	- 2 2 Verify Reset Code and set a new PW1.
	- 3 any Verify CHV3/PW3 and set a new CHV3/PW3.
	*/
	static gpg_error_t
	do_change_pin (app_t app, ctrl_t ctrl, const char *chvnostr,
	unsigned int flags,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	int rc = 0;
	int chvno = atoi (chvnostr);
	char *resetcode = NULL;
	char *oldpinvalue = NULL;
	char *pinvalue;
	int reset_mode = !!(flags & APP_CHANGE_FLAG_RESET);
	int set_resetcode = 0;

	(void)ctrl;

	if (reset_mode && chvno == 3)
	{
	rc = gpg_error (GPG_ERR_INV_ID);
	goto leave;
	}

	if (!app->app_local->extcap.is_v2)
	{
	/* Version 1 cards. */

	if (reset_mode \|\| chvno == 3)
	{
	/* We always require that the PIN is entered. */
	app->did_chv3 = 0;
	rc = verify_chv3 (app, pincb, pincb_arg);
	if (rc)
	goto leave;
	}
	else if (chvno == 1 \|\| chvno == 2)
	{
	/* On a v1.x card CHV1 and CVH2 should always have the same
	value, thus we enforce it here. */
	int save_force = app->force_chv1;

	app->force_chv1 = 0;
	app->did_chv1 = 0;
	app->did_chv2 = 0;
	rc = verify_chv2 (app, pincb, pincb_arg);
	app->force_chv1 = save_force;
	if (rc)
	goto leave;
	}
	else
	{
	rc = gpg_error (GPG_ERR_INV_ID);
	goto leave;
	}
	}
	else
	{
	/* Version 2 cards. */

	if (reset_mode)
	{
	/* To reset a PIN the Admin PIN is required. */
	app->did_chv3 = 0;
	rc = verify_chv3 (app, pincb, pincb_arg);
	if (rc)
	goto leave;

	if (chvno == 2)
	set_resetcode = 1;
	}
	else if (chvno == 1 \|\| chvno == 3)
	{
	int minlen = (chvno ==3)? 8 : 6;
	char *promptbuf = NULL;
	const char *prompt;

	if (chvno == 3)
	{
	rc = build_enter_admin_pin_prompt (app, &promptbuf);
	if (rc)
	goto leave;
	prompt = promptbuf;
	}
	else
	prompt = _("\|\|Please enter the PIN");
	rc = pincb (pincb_arg, prompt, &oldpinvalue);
	xfree (promptbuf);
	promptbuf = NULL;
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	goto leave;
	}

	if (strlen (oldpinvalue) < minlen)
	{
	log_info (_("PIN for CHV%d is too short;"
	" minimum length is %d\n"), chvno, minlen);
	rc = gpg_error (GPG_ERR_BAD_PIN);
	goto leave;
	}
	}
	else if (chvno == 2)
	{
	/* There is no PW2 for v2 cards. We use this condition to
	allow a PW reset using the Reset Code. */
	void *relptr;
	unsigned char *value;
	size_t valuelen;
	int remaining;
	int minlen = 8;

	relptr = get_one_do (app, 0x00C4, &value, &valuelen, NULL);
	if (!relptr \|\| valuelen < 7)
	{
	log_error (_("error retrieving CHV status from card\n"));
	xfree (relptr);
	rc = gpg_error (GPG_ERR_CARD);
	goto leave;
	}
	remaining = value[5];
	xfree (relptr);
	if (!remaining)
	{
	log_error (_("Reset Code not or not anymore available\n"));
	rc = gpg_error (GPG_ERR_BAD_PIN);
	goto leave;
	}

	rc = pincb (pincb_arg,
	_("\|\|Please enter the Reset Code for the card"),
	&resetcode);
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	goto leave;
	}
	if (strlen (resetcode) < minlen)
	{
	log_info (_("Reset Code is too short; minimum length is %d\n"),
	minlen);
	rc = gpg_error (GPG_ERR_BAD_PIN);
	goto leave;
	}
	}
	else
	{
	rc = gpg_error (GPG_ERR_INV_ID);
	goto leave;
	}
	}

	if (chvno == 3)
	app->did_chv3 = 0;
	else
	app->did_chv1 = app->did_chv2 = 0;

	/* TRANSLATORS: Do not translate the "\|*\|" prefixes but
	keep it at the start of the string. We need this elsewhere
	to get some infos on the string. */
	- rc = pincb (pincb_arg,
	- set_resetcode? _("\|RN\|New Reset Code") :
	+ rc = pincb (pincb_arg, set_resetcode? _("\|RN\|New Reset Code") :
	chvno == 3? _("\|AN\|New Admin PIN") : _("\|N\|New PIN"),
	&pinvalue);
	if (rc)
	{
	log_error (_("error getting new PIN: %s\n"), gpg_strerror (rc));
	goto leave;
	}


	if (resetcode)
	{
	char *buffer;

	buffer = xtrymalloc (strlen (resetcode) + strlen (pinvalue) + 1);
	if (!buffer)
	rc = gpg_error_from_syserror ();
	else
	{
	strcpy (stpcpy (buffer, resetcode), pinvalue);
	rc = iso7816_reset_retry_counter_with_rc (app->slot, 0x81,
	buffer, strlen (buffer));
	wipememory (buffer, strlen (buffer));
	xfree (buffer);
	}
	}
	else if (set_resetcode)
	{
	if (strlen (pinvalue) < 8)
	{
	log_error (_("Reset Code is too short; minimum length is %d\n"), 8);
	rc = gpg_error (GPG_ERR_BAD_PIN);
	}
	else
	rc = iso7816_put_data (app->slot, 0, 0xD3,
	pinvalue, strlen (pinvalue));
	}
	else if (reset_mode)
	{
	rc = iso7816_reset_retry_counter (app->slot, 0x81,
	pinvalue, strlen (pinvalue));
	if (!rc && !app->app_local->extcap.is_v2)
	rc = iso7816_reset_retry_counter (app->slot, 0x82,
	pinvalue, strlen (pinvalue));
	}
	else if (!app->app_local->extcap.is_v2)
	{
	/* Version 1 cards. */
	if (chvno == 1 \|\| chvno == 2)
	{
	rc = iso7816_change_reference_data (app->slot, 0x81, NULL, 0,
	pinvalue, strlen (pinvalue));
	if (!rc)
	rc = iso7816_change_reference_data (app->slot, 0x82, NULL, 0,
	pinvalue, strlen (pinvalue));
	}
	else /* CHVNO == 3 */
	{
	rc = iso7816_change_reference_data (app->slot, 0x80 + chvno, NULL, 0,
	pinvalue, strlen (pinvalue));
	}
	}
	else
	{
	/* Version 2 cards. */
	assert (chvno == 1 \|\| chvno == 3);

	rc = iso7816_change_reference_data (app->slot, 0x80 + chvno,
	oldpinvalue, strlen (oldpinvalue),
	pinvalue, strlen (pinvalue));
	}

	if (pinvalue)
	{
	wipememory (pinvalue, strlen (pinvalue));
	xfree (pinvalue);
	}
	if (rc)
	flush_cache_after_error (app);

	leave:
	if (resetcode)
	{
	wipememory (resetcode, strlen (resetcode));
	xfree (resetcode);
	}
	if (oldpinvalue)
	{
	wipememory (oldpinvalue, strlen (oldpinvalue));
	xfree (oldpinvalue);
	}
	return rc;
	}


	/* Check whether a key already exists. KEYIDX is the index of the key
	(0..2). If FORCE is TRUE a diagnositic will be printed but no
	error returned if the key already exists. The flag GENERATING is
	only used to print correct messages. */
	static gpg_error_t
	does_key_exist (app_t app, int keyidx, int generating, int force)
	{
	const unsigned char *fpr;
	unsigned char *buffer;
	size_t buflen, n;
	int i;

	assert (keyidx >=0 && keyidx <= 2);

	if (iso7816_get_data (app->slot, 0, 0x006E, &buffer, &buflen))
	{
	log_error (_("error reading application data\n"));
	return gpg_error (GPG_ERR_GENERAL);
	}
	fpr = find_tlv (buffer, buflen, 0x00C5, &n);
	if (!fpr \|\| n < 60)
	{
	log_error (_("error reading fingerprint DO\n"));
	xfree (buffer);
	return gpg_error (GPG_ERR_GENERAL);
	}
	fpr += 20*keyidx;
	for (i=0; i < 20 && !fpr[i]; i++)
	;
	xfree (buffer);
	if (i!=20 && !force)
	{
	log_error (_("key already exists\n"));
	return gpg_error (GPG_ERR_EEXIST);
	}
	else if (i!=20)
	log_info (_("existing key will be replaced\n"));
	else if (generating)
	log_info (_("generating new key\n"));
	else
	log_info (_("writing new key\n"));
	return 0;
	}


	/* Create a TLV tag and value and store it at BUFFER. Return the length
	of tag and length. A LENGTH greater than 65535 is truncated. */
	static size_t
	add_tlv (unsigned char *buffer, unsigned int tag, size_t length)
	{
	unsigned char *p = buffer;

	assert (tag <= 0xffff);
	if ( tag > 0xff )
	*p++ = tag >> 8;
	*p++ = tag;
	if (length < 128)
	*p++ = length;
	else if (length < 256)
	{
	*p++ = 0x81;
	*p++ = length;
	}
	else
	{
	if (length > 0xffff)
	length = 0xffff;
	*p++ = 0x82;
	*p++ = length >> 8;
	*p++ = length;
	}

	return p - buffer;
	}


	/* Build the private key template as specified in the OpenPGP specs
	v2.0 section 4.3.3.7. */
	static gpg_error_t
	build_privkey_template (app_t app, int keyno,
	const unsigned char *rsa_n, size_t rsa_n_len,
	const unsigned char *rsa_e, size_t rsa_e_len,
	const unsigned char *rsa_p, size_t rsa_p_len,
	const unsigned char *rsa_q, size_t rsa_q_len,
	unsigned char *result, size_t resultlen)
	{
	size_t rsa_e_reqlen;
	unsigned char privkey[7*(1+3)];
	size_t privkey_len;
	unsigned char exthdr[2+2+3];
	size_t exthdr_len;
	unsigned char suffix[2+3];
	size_t suffix_len;
	unsigned char *tp;
	size_t datalen;
	unsigned char *template;
	size_t template_size;

	*result = NULL;
	*resultlen = 0;

	switch (app->app_local->keyattr[keyno].format)
	{
	case RSA_STD:
	case RSA_STD_N:
	break;
	case RSA_CRT:
	case RSA_CRT_N:
	return gpg_error (GPG_ERR_NOT_SUPPORTED);

	default:
	return gpg_error (GPG_ERR_INV_VALUE);
	}

	/* Get the required length for E. */
	rsa_e_reqlen = app->app_local->keyattr[keyno].e_bits/8;
	assert (rsa_e_len <= rsa_e_reqlen);

	/* Build the 7f48 cardholder private key template. */
	datalen = 0;
	tp = privkey;

	tp += add_tlv (tp, 0x91, rsa_e_reqlen);
	datalen += rsa_e_reqlen;

	tp += add_tlv (tp, 0x92, rsa_p_len);
	datalen += rsa_p_len;

	tp += add_tlv (tp, 0x93, rsa_q_len);
	datalen += rsa_q_len;

	if (app->app_local->keyattr[keyno].format == RSA_STD_N
	\|\| app->app_local->keyattr[keyno].format == RSA_CRT_N)
	{
	tp += add_tlv (tp, 0x97, rsa_n_len);
	datalen += rsa_n_len;
	}
	privkey_len = tp - privkey;

	/* Build the extended header list without the private key template. */
	tp = exthdr;
	*tp++ = keyno ==0 ? 0xb6 : keyno == 1? 0xb8 : 0xa4;
	*tp++ = 0;
	tp += add_tlv (tp, 0x7f48, privkey_len);
	exthdr_len = tp - exthdr;

	/* Build the 5f48 suffix of the data. */
	tp = suffix;
	tp += add_tlv (tp, 0x5f48, datalen);
	suffix_len = tp - suffix;

	/* Now concatenate everything. */
	template_size = (1 + 3 /* 0x4d and len. */
	+ exthdr_len
	+ privkey_len
	+ suffix_len
	+ datalen);
	tp = template = xtrymalloc_secure (template_size);
	if (!template)
	return gpg_error_from_syserror ();

	tp += add_tlv (tp, 0x4d, exthdr_len + privkey_len + suffix_len + datalen);
	memcpy (tp, exthdr, exthdr_len);
	tp += exthdr_len;
	memcpy (tp, privkey, privkey_len);
	tp += privkey_len;
	memcpy (tp, suffix, suffix_len);
	tp += suffix_len;

	memcpy (tp, rsa_e, rsa_e_len);
	if (rsa_e_len < rsa_e_reqlen)
	{
	/* Right justify E. */
	memmove (tp + rsa_e_reqlen - rsa_e_len, tp, rsa_e_len);
	memset (tp, 0, rsa_e_reqlen - rsa_e_len);
	}
	tp += rsa_e_reqlen;

	memcpy (tp, rsa_p, rsa_p_len);
	tp += rsa_p_len;

	memcpy (tp, rsa_q, rsa_q_len);
	tp += rsa_q_len;

	if (app->app_local->keyattr[keyno].format == RSA_STD_N
	\|\| app->app_local->keyattr[keyno].format == RSA_CRT_N)
	{
	memcpy (tp, rsa_n, rsa_n_len);
	tp += rsa_n_len;
	}

	/* Sanity check. We don't know the exact length because we
	allocated 3 bytes for the first length header. */
	assert (tp - template <= template_size);

	*result = template;
	*resultlen = tp - template;
	return 0;
	}


	/* Helper for do_writekley to change the size of a key. Not ethat
	this deletes the entire key without asking. */
	static gpg_error_t
	change_keyattr (app_t app, int keyno, unsigned int nbits,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	gpg_error_t err;
	unsigned char *buffer;
	size_t buflen;
	void *relptr;

	assert (keyno >=0 && keyno <= 2);

	if (nbits > 3072)
	return gpg_error (GPG_ERR_TOO_LARGE);

	/* Read the current attributes into a buffer. */
	relptr = get_one_do (app, 0xC1+keyno, &buffer, &buflen, NULL);
	if (!relptr)
	return gpg_error (GPG_ERR_CARD);
	if (buflen < 6 \|\| buffer[0] != 1)
	{
	/* Attriutes too short or not an RSA key. */
	xfree (relptr);
	return gpg_error (GPG_ERR_CARD);
	}

	/* We only change n_bits and don't touch anything else. Before we
	do so, we round up NBITS to a sensible way in the same way as
	gpg's key generation does it. This may help to sort out problems
	with a few bits too short keys. */
	nbits = ((nbits + 31) / 32) * 32;
	buffer[1] = (nbits >> 8);
	buffer[2] = nbits;

	/* Prepare for storing the key. */
	err = verify_chv3 (app, pincb, pincb_arg);
	if (err)
	{
	xfree (relptr);
	return err;
	}

	/* Change the attribute. */
	err = iso7816_put_data (app->slot, 0, 0xC1+keyno, buffer, buflen);
	xfree (relptr);
	if (err)
	log_error ("error changing size of key %d to %u bits\n", keyno+1, nbits);
	else
	log_info ("size of key %d changed to %u bits\n", keyno+1, nbits);
	flush_cache (app);
	parse_algorithm_attribute (app, keyno);
	app->did_chv1 = 0;
	app->did_chv2 = 0;
	app->did_chv3 = 0;
	return err;
	}


	/* Helper to process an setattr command for name KEY-ATTR. It expects
	a string "--force <keyno> <algo> <nbits>" in (VALUE,VALUELEN). */
	static gpg_error_t
	change_keyattr_from_string (app_t app,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *value, size_t valuelen)
	{
	gpg_error_t err;
	char *string;
	int keyno, algo;
	unsigned int nbits;

	/* VALUE is expected to be a string but not guaranteed to be
	terminated. Thus copy it to an allocated buffer first. */
	string = xtrymalloc (valuelen+1);
	if (!string)
	return gpg_error_from_syserror ();
	memcpy (string, value, valuelen);
	string[valuelen] = 0;

	/* Because this function deletes the key we require the string
	"--force" in the data to make clear that something serious might
	happen. */
	if (sscanf (string, " --force %d %d %u", &keyno, &algo, &nbits) != 3)
	err = gpg_error (GPG_ERR_INV_DATA);
	else if (keyno < 1 \|\| keyno > 3)
	err = gpg_error (GPG_ERR_INV_ID);
	else if (algo != 1)
	err = gpg_error (GPG_ERR_PUBKEY_ALGO); /* Not RSA. */
	else if (nbits < 1024)
	err = gpg_error (GPG_ERR_TOO_SHORT);
	else
	err = change_keyattr (app, keyno-1, nbits, pincb, pincb_arg);

	xfree (string);
	return err;
	}


	/* Handle the WRITEKEY command for OpenPGP. This function expects a
	canonical encoded S-expression with the secret key in KEYDATA and
	its length (for assertions) in KEYDATALEN. KEYID needs to be the
	usual keyid which for OpenPGP is the string "OPENPGP.n" with
	n=1,2,3. Bit 0 of FLAGS indicates whether an existing key shall
	get overwritten. PINCB and PINCB_ARG are the usual arguments for
	the pinentry callback. */
	static gpg_error_t
	do_writekey (app_t app, ctrl_t ctrl,
	const char *keyid, unsigned int flags,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const unsigned char *keydata, size_t keydatalen)
	{
	gpg_error_t err;
	int force = (flags & 1);
	int keyno;
	const unsigned char buf, tok;
	size_t buflen, toklen;
	int depth, last_depth1, last_depth2;
	const unsigned char *rsa_n = NULL;
	const unsigned char *rsa_e = NULL;
	const unsigned char *rsa_p = NULL;
	const unsigned char *rsa_q = NULL;
	size_t rsa_n_len, rsa_e_len, rsa_p_len, rsa_q_len;
	unsigned int nbits;
	unsigned int maxbits;
	unsigned char *template = NULL;
	unsigned char *tp;
	size_t template_len;
	unsigned char fprbuf[20];
	u32 created_at = 0;

	(void)ctrl;

	if (!strcmp (keyid, "OPENPGP.1"))
	keyno = 0;
	else if (!strcmp (keyid, "OPENPGP.2"))
	keyno = 1;
	else if (!strcmp (keyid, "OPENPGP.3"))
	keyno = 2;
	else
	return gpg_error (GPG_ERR_INV_ID);

	err = does_key_exist (app, keyno, 0, force);
	if (err)
	return err;


	/*
	Parse the S-expression
	*/
	buf = keydata;
	buflen = keydatalen;
	depth = 0;
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if (!tok \|\| toklen != 11 \|\| memcmp ("private-key", tok, toklen))
	{
	if (!tok)
	;
	else if (toklen == 21 && !memcmp ("protected-private-key", tok, toklen))
	log_info ("protected-private-key passed to writekey\n");
	else if (toklen == 20 && !memcmp ("shadowed-private-key", tok, toklen))
	log_info ("shadowed-private-key passed to writekey\n");
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto leave;
	}
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if (!tok \|\| toklen != 3 \|\| memcmp ("rsa", tok, toklen))
	{
	err = gpg_error (GPG_ERR_WRONG_PUBKEY_ALGO);
	goto leave;
	}
	last_depth1 = depth;
	while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
	&& depth && depth >= last_depth1)
	{
	if (tok)
	{
	err = gpg_error (GPG_ERR_UNKNOWN_SEXP);
	goto leave;
	}
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if (tok && toklen == 1)
	{
	const unsigned char **mpi;
	size_t *mpi_len;

	switch (*tok)
	{
	case 'n': mpi = &rsa_n; mpi_len = &rsa_n_len; break;
	case 'e': mpi = &rsa_e; mpi_len = &rsa_e_len; break;
	case 'p': mpi = &rsa_p; mpi_len = &rsa_p_len; break;
	case 'q': mpi = &rsa_q; mpi_len = &rsa_q_len;break;
	default: mpi = NULL; mpi_len = NULL; break;
	}
	if (mpi && *mpi)
	{
	err = gpg_error (GPG_ERR_DUP_VALUE);
	goto leave;
	}
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if (tok && mpi)
	{
	/* Strip off leading zero bytes and save. */
	for (;toklen && !*tok; toklen--, tok++)
	;
	*mpi = tok;
	*mpi_len = toklen;
	}
	}
	/* Skip until end of list. */
	last_depth2 = depth;
	while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
	&& depth && depth >= last_depth2)
	;
	if (err)
	goto leave;
	}
	/* Parse other attributes. */
	last_depth1 = depth;
	while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
	&& depth && depth >= last_depth1)
	{
	if (tok)
	{
	err = gpg_error (GPG_ERR_UNKNOWN_SEXP);
	goto leave;
	}
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if (tok && toklen == 10 && !memcmp ("created-at", tok, toklen))
	{
	if ((err = parse_sexp (&buf,&buflen,&depth,&tok,&toklen)))
	goto leave;
	if (tok)
	{
	for (created_at=0; toklen && tok && tok >= '0' && *tok <= '9';
	tok++, toklen--)
	created_at = created_at10 + (tok - '0');
	}
	}
	/* Skip until end of list. */
	last_depth2 = depth;
	while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
	&& depth && depth >= last_depth2)
	;
	if (err)
	goto leave;
	}


	/* Check that we have all parameters and that they match the card
	description. */
	if (!created_at)
	{
	log_error (_("creation timestamp missing\n"));
	err = gpg_error (GPG_ERR_INV_VALUE);
	goto leave;
	}

	maxbits = app->app_local->keyattr[keyno].n_bits;
	nbits = rsa_n? count_bits (rsa_n, rsa_n_len) : 0;
	if (opt.verbose)
	log_info ("RSA modulus size is %u bits (%u bytes)\n",
	nbits, (unsigned int)rsa_n_len);
	if (nbits && nbits != maxbits
	&& app->app_local->extcap.algo_attr_change)
	{
	/* Try to switch the key to a new length. */
	err = change_keyattr (app, keyno, nbits, pincb, pincb_arg);
	if (!err)
	maxbits = app->app_local->keyattr[keyno].n_bits;
	}
	if (nbits != maxbits)
	{
	log_error (_("RSA modulus missing or not of size %d bits\n"),
	(int)maxbits);
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto leave;
	}

	maxbits = app->app_local->keyattr[keyno].e_bits;
	if (maxbits > 32 && !app->app_local->extcap.is_v2)
	maxbits = 32; /* Our code for v1 does only support 32 bits. */
	nbits = rsa_e? count_bits (rsa_e, rsa_e_len) : 0;
	if (nbits < 2 \|\| nbits > maxbits)
	{
	log_error (_("RSA public exponent missing or larger than %d bits\n"),
	(int)maxbits);
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto leave;
	}

	maxbits = app->app_local->keyattr[keyno].n_bits/2;
	nbits = rsa_p? count_bits (rsa_p, rsa_p_len) : 0;
	if (nbits != maxbits)
	{
	log_error (_("RSA prime %s missing or not of size %d bits\n"),
	"P", (int)maxbits);
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto leave;
	}
	nbits = rsa_q? count_bits (rsa_q, rsa_q_len) : 0;
	if (nbits != maxbits)
	{
	log_error (_("RSA prime %s missing or not of size %d bits\n"),
	"Q", (int)maxbits);
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto leave;
	}

	/* We need to remove the cached public key. */
	xfree (app->app_local->pk[keyno].key);
	app->app_local->pk[keyno].key = NULL;
	app->app_local->pk[keyno].keylen = 0;
	app->app_local->pk[keyno].read_done = 0;


	if (app->app_local->extcap.is_v2)
	{
	/* Build the private key template as described in section 4.3.3.7 of
	the OpenPGP card specs version 2.0. */
	int exmode;

	err = build_privkey_template (app, keyno,
	rsa_n, rsa_n_len,
	rsa_e, rsa_e_len,
	rsa_p, rsa_p_len,
	rsa_q, rsa_q_len,
	&template, &template_len);
	if (err)
	goto leave;

	/* Prepare for storing the key. */
	err = verify_chv3 (app, pincb, pincb_arg);
	if (err)
	goto leave;

	/* Store the key. */
	if (app->app_local->cardcap.ext_lc_le && template_len > 254)
	exmode = 1; /* Use extended length w/o a limit. */
	else if (app->app_local->cardcap.cmd_chaining && template_len > 254)
	exmode = -254;
	else
	exmode = 0;
	err = iso7816_put_data_odd (app->slot, exmode, 0x3fff,
	template, template_len);
	}
	else
	{
	/* Build the private key template as described in section 4.3.3.6 of
	the OpenPGP card specs version 1.1:
	0xC0 <length> public exponent
	0xC1 <length> prime p
	0xC2 <length> prime q
	*/
	assert (rsa_e_len <= 4);
	template_len = (1 + 1 + 4
	+ 1 + 1 + rsa_p_len
	+ 1 + 1 + rsa_q_len);
	template = tp = xtrymalloc_secure (template_len);
	if (!template)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	*tp++ = 0xC0;
	*tp++ = 4;
	memcpy (tp, rsa_e, rsa_e_len);
	if (rsa_e_len < 4)
	{
	/* Right justify E. */
	memmove (tp+4-rsa_e_len, tp, rsa_e_len);
	memset (tp, 0, 4-rsa_e_len);
	}
	tp += 4;

	*tp++ = 0xC1;
	*tp++ = rsa_p_len;
	memcpy (tp, rsa_p, rsa_p_len);
	tp += rsa_p_len;

	*tp++ = 0xC2;
	*tp++ = rsa_q_len;
	memcpy (tp, rsa_q, rsa_q_len);
	tp += rsa_q_len;

	assert (tp - template == template_len);

	/* Prepare for storing the key. */
	err = verify_chv3 (app, pincb, pincb_arg);
	if (err)
	goto leave;

	/* Store the key. */
	err = iso7816_put_data (app->slot, 0,
	(app->card_version > 0x0007? 0xE0:0xE9)+keyno,
	template, template_len);
	}
	if (err)
	{
	log_error (_("failed to store the key: %s\n"), gpg_strerror (err));
	goto leave;
	}

	err = store_fpr (app, keyno, created_at,
	rsa_n, rsa_n_len, rsa_e, rsa_e_len,
	fprbuf, app->card_version);
	if (err)
	goto leave;


	leave:
	xfree (template);
	return err;
	}


	/* Handle the GENKEY command. */
	static gpg_error_t
	do_genkey (app_t app, ctrl_t ctrl, const char *keynostr, unsigned int flags,
	time_t createtime,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	int rc;
	char numbuf[30];
	unsigned char fprbuf[20];
	const unsigned char keydata, m, *e;
	unsigned char *buffer = NULL;
	size_t buflen, keydatalen, mlen, elen;
	time_t created_at;
	int keyno = atoi (keynostr);
	int force = (flags & 1);
	time_t start_at;
	int exmode;
	int le_value;
	unsigned int keybits;

	if (keyno < 1 \|\| keyno > 3)
	return gpg_error (GPG_ERR_INV_ID);
	keyno--;

	/* We flush the cache to increase the traffic before a key
	generation. This _might_ help a card to gather more entropy. */
	flush_cache (app);

	/* Obviously we need to remove the cached public key. */
	xfree (app->app_local->pk[keyno].key);
	app->app_local->pk[keyno].key = NULL;
	app->app_local->pk[keyno].keylen = 0;
	app->app_local->pk[keyno].read_done = 0;

	/* Check whether a key already exists. */
	rc = does_key_exist (app, keyno, 1, force);
	if (rc)
	return rc;

	/* Because we send the key parameter back via status lines we need
	to put a limit on the max. allowed keysize. 2048 bit will
	already lead to a 527 byte long status line and thus a 4096 bit
	key would exceed the Assuan line length limit. */
	keybits = app->app_local->keyattr[keyno].n_bits;
	if (keybits > 3072)
	return gpg_error (GPG_ERR_TOO_LARGE);

	/* Prepare for key generation by verifying the Admin PIN. */
	rc = verify_chv3 (app, pincb, pincb_arg);
	if (rc)
	goto leave;

	/* Test whether we will need extended length mode. (1900 is an
	arbitrary length which for sure fits into a short apdu.) */
	if (app->app_local->cardcap.ext_lc_le && keybits > 1900)
	{
	exmode = 1; /* Use extended length w/o a limit. */
	le_value = app->app_local->extcap.max_rsp_data;
	/* No need to check le_value because it comes from a 16 bit
	value and thus can't create an overflow on a 32 bit
	system. */
	}
	else
	{
	exmode = 0;
	le_value = 256; /* Use legacy value. */
	}

	log_info (_("please wait while key is being generated ...\n"));
	start_at = time (NULL);
	rc = iso7816_generate_keypair
	/* # warning key generation temporary replaced by reading an existing key. */
	/* rc = iso7816_read_public_key */
	(app->slot, exmode,
	(const unsigned char*)(keyno == 0? "\xB6" :
	keyno == 1? "\xB8" : "\xA4"), 2,
	le_value,
	&buffer, &buflen);
	if (rc)
	{
	rc = gpg_error (GPG_ERR_CARD);
	log_error (_("generating key failed\n"));
	goto leave;
	}
	log_info (_("key generation completed (%d seconds)\n"),
	(int)(time (NULL) - start_at));

	keydata = find_tlv (buffer, buflen, 0x7F49, &keydatalen);
	if (!keydata)
	{
	rc = gpg_error (GPG_ERR_CARD);
	log_error (_("response does not contain the public key data\n"));
	goto leave;
	}

	m = find_tlv (keydata, keydatalen, 0x0081, &mlen);
	if (!m)
	{
	rc = gpg_error (GPG_ERR_CARD);
	log_error (_("response does not contain the RSA modulus\n"));
	goto leave;
	}
	/* log_printhex ("RSA n:", m, mlen); */
	send_key_data (ctrl, "n", m, mlen);

	e = find_tlv (keydata, keydatalen, 0x0082, &elen);
	if (!e)
	{
	rc = gpg_error (GPG_ERR_CARD);
	log_error (_("response does not contain the RSA public exponent\n"));
	goto leave;
	}
	/* log_printhex ("RSA e:", e, elen); */
	send_key_data (ctrl, "e", e, elen);

	created_at = createtime? createtime : gnupg_get_time ();
	sprintf (numbuf, "%lu", (unsigned long)created_at);
	send_status_info (ctrl, "KEY-CREATED-AT",
	numbuf, (size_t)strlen(numbuf), NULL, 0);

	rc = store_fpr (app, keyno, (u32)created_at,
	m, mlen, e, elen, fprbuf, app->card_version);
	if (rc)
	goto leave;
	send_fpr_if_not_null (ctrl, "KEY-FPR", -1, fprbuf);


	leave:
	xfree (buffer);
	return rc;
	}


	static unsigned long
	convert_sig_counter_value (const unsigned char *value, size_t valuelen)
	{
	unsigned long ul;

	if (valuelen == 3 )
	ul = (value[0] << 16) \| (value[1] << 8) \| value[2];
	else
	{
	log_error (_("invalid structure of OpenPGP card (DO 0x93)\n"));
	ul = 0;
	}
	return ul;
	}

	static unsigned long
	get_sig_counter (app_t app)
	{
	void *relptr;
	unsigned char *value;
	size_t valuelen;
	unsigned long ul;

	relptr = get_one_do (app, 0x0093, &value, &valuelen, NULL);
	if (!relptr)
	return 0;
	ul = convert_sig_counter_value (value, valuelen);
	xfree (relptr);
	return ul;
	}

	static gpg_error_t
	compare_fingerprint (app_t app, int keyno, unsigned char *sha1fpr)
	{
	const unsigned char *fpr;
	unsigned char *buffer;
	size_t buflen, n;
	int rc, i;

	assert (keyno >= 1 && keyno <= 3);

	rc = get_cached_data (app, 0x006E, &buffer, &buflen, 0, 0);
	if (rc)
	{
	log_error (_("error reading application data\n"));
	return gpg_error (GPG_ERR_GENERAL);
	}
	fpr = find_tlv (buffer, buflen, 0x00C5, &n);
	if (!fpr \|\| n != 60)
	{
	xfree (buffer);
	log_error (_("error reading fingerprint DO\n"));
	return gpg_error (GPG_ERR_GENERAL);
	}
	fpr += (keyno-1)*20;
	for (i=0; i < 20; i++)
	if (sha1fpr[i] != fpr[i])
	{
	xfree (buffer);
	log_info (_("fingerprint on card does not match requested one\n"));
	return gpg_error (GPG_ERR_WRONG_SECKEY);
	}
	xfree (buffer);
	return 0;
	}


	/* If a fingerprint has been specified check it against the one on the
	card. This allows for a meaningful error message in case the key
	on the card has been replaced but the shadow information known to
	gpg has not been updated. If there is no fingerprint we assume
	that this is okay. */
	static gpg_error_t
	check_against_given_fingerprint (app_t app, const char *fpr, int keyno)
	{
	unsigned char tmp[20];
	const char *s;
	int n;

	for (s=fpr, n=0; hexdigitp (s); s++, n++)
	;
	if (n != 40)
	return gpg_error (GPG_ERR_INV_ID);
	else if (!*s)
	; /* okay */
	else
	return gpg_error (GPG_ERR_INV_ID);

	for (s=fpr, n=0; n < 20; s += 2, n++)
	tmp[n] = xtoi_2 (s);
	return compare_fingerprint (app, keyno, tmp);
	}



	/* Compute a digital signature on INDATA which is expected to be the
	raw message digest. For this application the KEYIDSTR consists of
	the serialnumber and the fingerprint delimited by a slash.

	Note that this function may return the error code
	GPG_ERR_WRONG_CARD to indicate that the card currently present does
	not match the one required for the requested action (e.g. the
	serial number does not match).

	As a special feature a KEYIDSTR of "OPENPGP.3" redirects the
	operation to the auth command.
	*/
	static gpg_error_t
	do_sign (app_t app, const char *keyidstr, int hashalgo,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *indata, size_t indatalen,
	unsigned char *outdata, size_t outdatalen )
	{
	static unsigned char rmd160_prefix[15] = /* Object ID is 1.3.36.3.2.1 */
	{ 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x24, 0x03,
	0x02, 0x01, 0x05, 0x00, 0x04, 0x14 };
	static unsigned char sha1_prefix[15] = /* (1.3.14.3.2.26) */
	{ 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03,
	0x02, 0x1a, 0x05, 0x00, 0x04, 0x14 };
	static unsigned char sha224_prefix[19] = /* (2.16.840.1.101.3.4.2.4) */
	{ 0x30, 0x2D, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
	0x01, 0x65, 0x03, 0x04, 0x02, 0x04, 0x05, 0x00, 0x04,
	0x1C };
	static unsigned char sha256_prefix[19] = /* (2.16.840.1.101.3.4.2.1) */
	{ 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
	0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05,
	0x00, 0x04, 0x20 };
	static unsigned char sha384_prefix[19] = /* (2.16.840.1.101.3.4.2.2) */
	{ 0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
	0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05,
	0x00, 0x04, 0x30 };
	static unsigned char sha512_prefix[19] = /* (2.16.840.1.101.3.4.2.3) */
	{ 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
	0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05,
	0x00, 0x04, 0x40 };
	int rc;
	unsigned char data[19+64];
	size_t datalen;
	unsigned char tmp_sn[20]; /* Actually 16 bytes but also for the fpr. */
	const char *s;
	int n;
	const char *fpr = NULL;
	unsigned long sigcount;
	int use_auth = 0;
	int exmode, le_value;

	if (!keyidstr \|\| !*keyidstr)
	return gpg_error (GPG_ERR_INV_VALUE);

	/* Strip off known prefixes. */
	#define X(a,b,c,d) \
	if (hashalgo == GCRY_MD_ ## a \
	&& (d) \
	&& indatalen == sizeof b ## _prefix + (c) \
	&& !memcmp (indata, b ## _prefix, sizeof b ## _prefix)) \
	{ \
	indata = (const char*)indata + sizeof b ## _prefix; \
	indatalen -= sizeof b ## _prefix; \
	}

	if (indatalen == 20)
	; /* Assume a plain SHA-1 or RMD160 digest has been given. */
	else X(SHA1, sha1, 20, 1)
	else X(RMD160, rmd160, 20, 1)
	else X(SHA224, sha224, 28, app->app_local->extcap.is_v2)
	else X(SHA256, sha256, 32, app->app_local->extcap.is_v2)
	else X(SHA384, sha384, 48, app->app_local->extcap.is_v2)
	else X(SHA512, sha512, 64, app->app_local->extcap.is_v2)
	else if ((indatalen == 28 \|\| indatalen == 32
	\|\| indatalen == 48 \|\| indatalen ==64)
	&& app->app_local->extcap.is_v2)
	; /* Assume a plain SHA-3 digest has been given. */
	else
	{
	log_error (_("card does not support digest algorithm %s\n"),
	gcry_md_algo_name (hashalgo));
	/* Or the supplied digest length does not match an algorithm. */
	return gpg_error (GPG_ERR_INV_VALUE);
	}
	#undef X

	/* Check whether an OpenPGP card of any version has been requested. */
	if (!strcmp (keyidstr, "OPENPGP.1"))
	;
	else if (!strcmp (keyidstr, "OPENPGP.3"))
	use_auth = 1;
	else if (strlen (keyidstr) < 32 \|\| strncmp (keyidstr, "D27600012401", 12))
	return gpg_error (GPG_ERR_INV_ID);
	else
	{
	for (s=keyidstr, n=0; hexdigitp (s); s++, n++)
	;
	if (n != 32)
	return gpg_error (GPG_ERR_INV_ID);
	else if (!*s)
	; /* no fingerprint given: we allow this for now. */
	else if (*s == '/')
	fpr = s + 1;
	else
	return gpg_error (GPG_ERR_INV_ID);

	for (s=keyidstr, n=0; n < 16; s += 2, n++)
	tmp_sn[n] = xtoi_2 (s);

	if (app->serialnolen != 16)
	return gpg_error (GPG_ERR_INV_CARD);
	if (memcmp (app->serialno, tmp_sn, 16))
	return gpg_error (GPG_ERR_WRONG_CARD);
	}

	/* If a fingerprint has been specified check it against the one on
	the card. This is allows for a meaningful error message in case
	the key on the card has been replaced but the shadow information
	known to gpg was not updated. If there is no fingerprint, gpg
	will detect a bogus signature anyway due to the
	verify-after-signing feature. */
	rc = fpr? check_against_given_fingerprint (app, fpr, 1) : 0;
	if (rc)
	return rc;

	/* Concatenate prefix and digest. */
	#define X(a,b,d) \
	if (hashalgo == GCRY_MD_ ## a && (d) ) \
	{ \
	datalen = sizeof b ## _prefix + indatalen; \
	assert (datalen <= sizeof data); \
	memcpy (data, b ## _prefix, sizeof b ## _prefix); \
	memcpy (data + sizeof b ## _prefix, indata, indatalen); \
	}

	X(SHA1, sha1, 1)
	else X(RMD160, rmd160, 1)
	else X(SHA224, sha224, app->app_local->extcap.is_v2)
	else X(SHA256, sha256, app->app_local->extcap.is_v2)
	else X(SHA384, sha384, app->app_local->extcap.is_v2)
	else X(SHA512, sha512, app->app_local->extcap.is_v2)
	else
	return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
	#undef X

	/* Redirect to the AUTH command if asked to. */
	if (use_auth)
	{
	return do_auth (app, "OPENPGP.3", pincb, pincb_arg,
	data, datalen,
	outdata, outdatalen);
	}

	/* Show the number of signature done using this key. */
	sigcount = get_sig_counter (app);
	log_info (_("signatures created so far: %lu\n"), sigcount);

	/* Check CHV if needed. */
	if (!app->did_chv1 \|\| app->force_chv1 )
	{
	char *pinvalue;

	rc = verify_a_chv (app, pincb, pincb_arg, 1, sigcount, &pinvalue);
	if (rc)
	return rc;

	app->did_chv1 = 1;

	/* For cards with versions < 2 we want to keep CHV1 and CHV2 in
	sync, thus we verify CHV2 here using the given PIN. Cards
	with version2 to not have the need for a separate CHV2 and
	internally use just one. Obviously we can't do that if the
	keypad has been used. */
	if (!app->did_chv2 && pinvalue && !app->app_local->extcap.is_v2)
	{
	rc = iso7816_verify (app->slot, 0x82, pinvalue, strlen (pinvalue));
	if (gpg_err_code (rc) == GPG_ERR_BAD_PIN)
	rc = gpg_error (GPG_ERR_PIN_NOT_SYNCED);
	if (rc)
	{
	log_error (_("verify CHV%d failed: %s\n"), 2, gpg_strerror (rc));
	xfree (pinvalue);
	flush_cache_after_error (app);
	return rc;
	}
	app->did_chv2 = 1;
	}
	xfree (pinvalue);
	}


	if (app->app_local->cardcap.ext_lc_le)
	{
	exmode = 1; /* Use extended length. */
	le_value = app->app_local->extcap.max_rsp_data;
	}
	else
	{
	exmode = 0;
	le_value = 0;
	}
	rc = iso7816_compute_ds (app->slot, exmode, data, datalen, le_value,
	outdata, outdatalen);
	return rc;
	}

	/* Compute a digital signature using the INTERNAL AUTHENTICATE command
	on INDATA which is expected to be the raw message digest. For this
	application the KEYIDSTR consists of the serialnumber and the
	fingerprint delimited by a slash. Optionally the id OPENPGP.3 may
	be given.

	Note that this function may return the error code
	GPG_ERR_WRONG_CARD to indicate that the card currently present does
	not match the one required for the requested action (e.g. the
	serial number does not match). */
	static gpg_error_t
	do_auth (app_t app, const char *keyidstr,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *indata, size_t indatalen,
	unsigned char *outdata, size_t outdatalen )
	{
	int rc;
	unsigned char tmp_sn[20]; /* Actually 16 but we use it also for the fpr. */
	const char *s;
	int n;
	const char *fpr = NULL;

	if (!keyidstr \|\| !*keyidstr)
	return gpg_error (GPG_ERR_INV_VALUE);
	if (indatalen > 101) /* For a 2048 bit key. */
	return gpg_error (GPG_ERR_INV_VALUE);

	/* Check whether an OpenPGP card of any version has been requested. */
	if (!strcmp (keyidstr, "OPENPGP.3"))
	;
	else if (strlen (keyidstr) < 32 \|\| strncmp (keyidstr, "D27600012401", 12))
	return gpg_error (GPG_ERR_INV_ID);
	else
	{
	for (s=keyidstr, n=0; hexdigitp (s); s++, n++)
	;
	if (n != 32)
	return gpg_error (GPG_ERR_INV_ID);
	else if (!*s)
	; /* no fingerprint given: we allow this for now. */
	else if (*s == '/')
	fpr = s + 1;
	else
	return gpg_error (GPG_ERR_INV_ID);

	for (s=keyidstr, n=0; n < 16; s += 2, n++)
	tmp_sn[n] = xtoi_2 (s);

	if (app->serialnolen != 16)
	return gpg_error (GPG_ERR_INV_CARD);
	if (memcmp (app->serialno, tmp_sn, 16))
	return gpg_error (GPG_ERR_WRONG_CARD);
	}

	/* If a fingerprint has been specified check it against the one on
	the card. This is allows for a meaningful error message in case
	the key on the card has been replaced but the shadow information
	known to gpg was not updated. If there is no fingerprint, gpg
	will detect a bogus signature anyway due to the
	verify-after-signing feature. */
	rc = fpr? check_against_given_fingerprint (app, fpr, 3) : 0;
	if (rc)
	return rc;

	rc = verify_chv2 (app, pincb, pincb_arg);
	if (!rc)
	{
	int exmode, le_value;

	if (app->app_local->cardcap.ext_lc_le)
	{
	exmode = 1; /* Use extended length. */
	le_value = app->app_local->extcap.max_rsp_data;
	}
	else
	{
	exmode = 0;
	le_value = 0;
	}
	rc = iso7816_internal_authenticate (app->slot, exmode,
	indata, indatalen, le_value,
	outdata, outdatalen);
	}
	return rc;
	}


	static gpg_error_t
	do_decipher (app_t app, const char *keyidstr,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *indata, size_t indatalen,
	unsigned char *outdata, size_t outdatalen )
	{
	int rc;
	unsigned char tmp_sn[20]; /* actually 16 but we use it also for the fpr. */
	const char *s;
	int n;
	const char *fpr = NULL;
	int exmode, le_value;

	if (!keyidstr \|\| !*keyidstr \|\| !indatalen)
	return gpg_error (GPG_ERR_INV_VALUE);

	/* Check whether an OpenPGP card of any version has been requested. */
	if (!strcmp (keyidstr, "OPENPGP.2"))
	;
	else if (strlen (keyidstr) < 32 \|\| strncmp (keyidstr, "D27600012401", 12))
	return gpg_error (GPG_ERR_INV_ID);
	else
	{
	for (s=keyidstr, n=0; hexdigitp (s); s++, n++)
	;
	if (n != 32)
	return gpg_error (GPG_ERR_INV_ID);
	else if (!*s)
	; /* no fingerprint given: we allow this for now. */
	else if (*s == '/')
	fpr = s + 1;
	else
	return gpg_error (GPG_ERR_INV_ID);

	for (s=keyidstr, n=0; n < 16; s += 2, n++)
	tmp_sn[n] = xtoi_2 (s);

	if (app->serialnolen != 16)
	return gpg_error (GPG_ERR_INV_CARD);
	if (memcmp (app->serialno, tmp_sn, 16))
	return gpg_error (GPG_ERR_WRONG_CARD);
	}

	/* If a fingerprint has been specified check it against the one on
	the card. This is allows for a meaningful error message in case
	the key on the card has been replaced but the shadow information
	known to gpg was not updated. If there is no fingerprint, the
	decryption won't produce the right plaintext anyway. */
	rc = fpr? check_against_given_fingerprint (app, fpr, 2) : 0;
	if (rc)
	return rc;

	rc = verify_chv2 (app, pincb, pincb_arg);
	if (!rc)
	{
	size_t fixuplen;
	unsigned char *fixbuf = NULL;
	int padind = 0;

	/* We might encounter a couple of leading zeroes in the
	cryptogram. Due to internal use of MPIs thease leading
	zeroes are stripped. However the OpenPGP card expects
	exactly 128 bytes for the cryptogram (for a 1k key). Thus we
	need to fix it up. We do this for up to 16 leading zero
	bytes; a cryptogram with more than this is with a very high
	probability anyway broken. */
	if (indatalen >= (128-16) && indatalen < 128) /* 1024 bit key. */
	fixuplen = 128 - indatalen;
	else if (indatalen >= (192-16) && indatalen < 192) /* 1536 bit key. */
	fixuplen = 192 - indatalen;
	else if (indatalen >= (256-16) && indatalen < 256) /* 2048 bit key. */
	fixuplen = 256 - indatalen;
	else if (indatalen >= (384-16) && indatalen < 384) /* 3072 bit key. */
	fixuplen = 384 - indatalen;
	else
	fixuplen = 0;

	if (fixuplen)
	{
	/* While we have to prepend stuff anyway, we can also
	include the padding byte here so that iso1816_decipher
	does not need to do another data mangling. */
	fixuplen++;

	fixbuf = xtrymalloc (fixuplen + indatalen);
	if (!fixbuf)
	return gpg_error_from_syserror ();

	memset (fixbuf, 0, fixuplen);
	memcpy (fixbuf+fixuplen, indata, indatalen);
	indata = fixbuf;
	indatalen = fixuplen + indatalen;
	padind = -1; /* Already padded. */
	}

	if (app->app_local->cardcap.ext_lc_le && indatalen > 254 )
	{
	exmode = 1; /* Extended length w/o a limit. */
	le_value = app->app_local->extcap.max_rsp_data;
	}
	else if (app->app_local->cardcap.cmd_chaining && indatalen > 254)
	{
	exmode = -254; /* Command chaining with max. 254 bytes. */
	le_value = 0;
	}
	else
	exmode = le_value = 0;

	rc = iso7816_decipher (app->slot, exmode,
	indata, indatalen, le_value, padind,
	outdata, outdatalen);
	xfree (fixbuf);
	}

	return rc;
	}


	/* Perform a simple verify operation for CHV1 and CHV2, so that
	further operations won't ask for CHV2 and it is possible to do a
	cheap check on the PIN: If there is something wrong with the PIN
	entry system, only the regular CHV will get blocked and not the
	dangerous CHV3. KEYIDSTR is the usual card's serial number; an
	optional fingerprint part will be ignored.

	There is a special mode if the keyidstr is "<serialno>[CHV3]" with
	the "[CHV3]" being a literal string: The Admin Pin is checked if
	and only if the retry counter is still at 3. */
	static gpg_error_t
	do_check_pin (app_t app, const char *keyidstr,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	unsigned char tmp_sn[20];
	const char *s;
	int n;
	int admin_pin = 0;

	if (!keyidstr \|\| !*keyidstr)
	return gpg_error (GPG_ERR_INV_VALUE);

	/* Check whether an OpenPGP card of any version has been requested. */
	if (strlen (keyidstr) < 32 \|\| strncmp (keyidstr, "D27600012401", 12))
	return gpg_error (GPG_ERR_INV_ID);

	for (s=keyidstr, n=0; hexdigitp (s); s++, n++)
	;
	if (n != 32)
	return gpg_error (GPG_ERR_INV_ID);
	else if (!*s)
	; /* No fingerprint given: we allow this for now. */
	else if (*s == '/')
	; /* We ignore a fingerprint. */
	else if (!strcmp (s, "[CHV3]") )
	admin_pin = 1;
	else
	return gpg_error (GPG_ERR_INV_ID);

	for (s=keyidstr, n=0; n < 16; s += 2, n++)
	tmp_sn[n] = xtoi_2 (s);

	if (app->serialnolen != 16)
	return gpg_error (GPG_ERR_INV_CARD);
	if (memcmp (app->serialno, tmp_sn, 16))
	return gpg_error (GPG_ERR_WRONG_CARD);

	/* Yes, there is a race conditions: The user might pull the card
	right here and we won't notice that. However this is not a
	problem and the check above is merely for a graceful failure
	between operations. */

	if (admin_pin)
	{
	void *relptr;
	unsigned char *value;
	size_t valuelen;
	int count;

	relptr = get_one_do (app, 0x00C4, &value, &valuelen, NULL);
	if (!relptr \|\| valuelen < 7)
	{
	log_error (_("error retrieving CHV status from card\n"));
	xfree (relptr);
	return gpg_error (GPG_ERR_CARD);
	}
	count = value[6];
	xfree (relptr);

	if (!count)
	{
	log_info (_("card is permanently locked!\n"));
	return gpg_error (GPG_ERR_BAD_PIN);
	}
	else if (value[6] < 3)
	{
	log_info (_("verification of Admin PIN is currently prohibited "
	"through this command\n"));
	return gpg_error (GPG_ERR_GENERAL);
	}

	app->did_chv3 = 0; /* Force verification. */
	return verify_chv3 (app, pincb, pincb_arg);
	}
	else
	return verify_chv2 (app, pincb, pincb_arg);
	}


	/* Show information about card capabilities. */
	static void
	show_caps (struct app_local_s *s)
	{
	log_info ("Version-2 ......: %s\n", s->extcap.is_v2? "yes":"no");
	log_info ("Get-Challenge ..: %s", s->extcap.get_challenge? "yes":"no");
	if (s->extcap.get_challenge)
	log_printf (" (%u bytes max)", s->extcap.max_get_challenge);
	log_info ("Key-Import .....: %s\n", s->extcap.key_import? "yes":"no");
	log_info ("Change-Force-PW1: %s\n", s->extcap.change_force_chv? "yes":"no");
	log_info ("Private-DOs ....: %s\n", s->extcap.private_dos? "yes":"no");
	log_info ("Algo-Attr-Change: %s\n", s->extcap.algo_attr_change? "yes":"no");
	log_info ("SM-Support .....: %s", s->extcap.sm_supported? "yes":"no");
	if (s->extcap.sm_supported)
	log_printf (" (%s)", s->extcap.sm_aes128? "AES-128":"3DES");
	log_info ("Max-Cert3-Len ..: %u\n", s->extcap.max_certlen_3);
	log_info ("Max-Cmd-Data ...: %u\n", s->extcap.max_cmd_data);
	log_info ("Max-Rsp-Data ...: %u\n", s->extcap.max_rsp_data);
	log_info ("Cmd-Chaining ...: %s\n", s->cardcap.cmd_chaining?"yes":"no");
	log_info ("Ext-Lc-Le ......: %s\n", s->cardcap.ext_lc_le?"yes":"no");
	log_info ("Status Indicator: %02X\n", s->status_indicator);

	log_info ("GnuPG-No-Sync ..: %s\n", s->flags.no_sync? "yes":"no");
	log_info ("GnuPG-Def-PW2 ..: %s\n", s->flags.def_chv2? "yes":"no");
	}


	/* Parse the historical bytes in BUFFER of BUFLEN and store them in
	APPLOC. */
	static void
	parse_historical (struct app_local_s *apploc,
	const unsigned char * buffer, size_t buflen)
	{
	/* Example buffer: 00 31 C5 73 C0 01 80 00 90 00 */
	if (buflen < 4)
	{
	log_error ("warning: historical bytes are too short\n");
	return; /* Too short. */
	}
	if (*buffer)
	{
	log_error ("warning: bad category indicator in historical bytes\n");
	return;
	}

	/* Skip category indicator. */
	buffer++;
	buflen--;

	/* Get the status indicator. */
	apploc->status_indicator = buffer[buflen-3];
	buflen -= 3;

	/* Parse the compact TLV. */
	while (buflen)
	{
	unsigned int tag = (*buffer & 0xf0) >> 4;
	unsigned int len = (*buffer & 0x0f);
	if (len+1 > buflen)
	{
	log_error ("warning: bad Compact-TLV in historical bytes\n");
	return; /* Error. */
	}
	buffer++;
	buflen--;
	if (tag == 7 && len == 3)
	{
	/* Card capabilities. */
	apploc->cardcap.cmd_chaining = !!(buffer[2] & 0x80);
	apploc->cardcap.ext_lc_le = !!(buffer[2] & 0x40);
	}
	buffer += len;
	buflen -= len;
	}
	}


	/* Parse and optionally show the algorithm attributes for KEYNO.
	KEYNO must be in the range 0..2. */
	static void
	parse_algorithm_attribute (app_t app, int keyno)
	{
	unsigned char *buffer;
	size_t buflen;
	void *relptr;
	const char desc[3][5] = {"sign", "encr", "auth"};

	assert (keyno >=0 && keyno <= 2);

	app->app_local->keyattr[keyno].n_bits = 0;

	relptr = get_one_do (app, 0xC1+keyno, &buffer, &buflen, NULL);
	if (!relptr)
	{
	log_error ("error reading DO 0x%02X\n", 0xc1+keyno);
	return;
	}
	if (buflen < 1)
	{
	log_error ("error reading DO 0x%02X\n", 0xc1+keyno);
	xfree (relptr);
	return;
	}

	if (opt.verbose)
	log_info ("Key-Attr-%s ..: ", desc[keyno]);
	if (*buffer == 1 && (buflen == 5 \|\| buflen == 6))
	{
	app->app_local->keyattr[keyno].n_bits = (buffer[1]<<8 \| buffer[2]);
	app->app_local->keyattr[keyno].e_bits = (buffer[3]<<8 \| buffer[4]);
	app->app_local->keyattr[keyno].format = 0;
	if (buflen < 6)
	app->app_local->keyattr[keyno].format = RSA_STD;
	else
	app->app_local->keyattr[keyno].format = (buffer[5] == 0? RSA_STD :
	buffer[5] == 1? RSA_STD_N :
	buffer[5] == 2? RSA_CRT :
	buffer[5] == 3? RSA_CRT_N :
	RSA_UNKNOWN_FMT);

	if (opt.verbose)
	log_printf
	("RSA, n=%u, e=%u, fmt=%s\n",
	app->app_local->keyattr[keyno].n_bits,
	app->app_local->keyattr[keyno].e_bits,
	app->app_local->keyattr[keyno].format == RSA_STD? "std" :
	app->app_local->keyattr[keyno].format == RSA_STD_N?"std+n":
	app->app_local->keyattr[keyno].format == RSA_CRT? "crt" :
	app->app_local->keyattr[keyno].format == RSA_CRT_N?"crt+n":"?");
	}
	else if (opt.verbose)
	log_printhex ("", buffer, buflen);

	xfree (relptr);
	}

	/* Select the OpenPGP application on the card in SLOT. This function
	must be used before any other OpenPGP application functions. */
	gpg_error_t
	app_select_openpgp (app_t app)
	{
	static char const aid[] = { 0xD2, 0x76, 0x00, 0x01, 0x24, 0x01 };
	int slot = app->slot;
	int rc;
	unsigned char *buffer;
	size_t buflen;
	void *relptr;

	/* Note that the card can't cope with P2=0xCO, thus we need to pass a
	special flag value. */
	rc = iso7816_select_application (slot, aid, sizeof aid, 0x0001);
	if (!rc)
	{
	unsigned int manufacturer;

	app->apptype = "OPENPGP";

	app->did_chv1 = 0;
	app->did_chv2 = 0;
	app->did_chv3 = 0;
	app->app_local = NULL;

	/* The OpenPGP card returns the serial number as part of the
	AID; because we prefer to use OpenPGP serial numbers, we
	replace a possibly already set one from a EF.GDO with this
	one. Note, that for current OpenPGP cards, no EF.GDO exists
	and thus it won't matter at all. */
	rc = iso7816_get_data (slot, 0, 0x004F, &buffer, &buflen);
	if (rc)
	goto leave;
	if (opt.verbose)
	{
	log_info ("AID: ");
	log_printhex ("", buffer, buflen);
	}

	app->card_version = buffer[6] << 8;
	app->card_version \|= buffer[7];
	manufacturer = (buffer[8]<<8 \| buffer[9]);

	xfree (app->serialno);
	app->serialno = buffer;
	app->serialnolen = buflen;
	buffer = NULL;
	app->app_local = xtrycalloc (1, sizeof *app->app_local);
	if (!app->app_local)
	{
	rc = gpg_error (gpg_err_code_from_errno (errno));
	goto leave;
	}

	if (app->card_version >= 0x0200)
	app->app_local->extcap.is_v2 = 1;


	/* Read the historical bytes. */
	relptr = get_one_do (app, 0x5f52, &buffer, &buflen, NULL);
	if (relptr)
	{
	if (opt.verbose)
	{
	log_info ("Historical Bytes: ");
	log_printhex ("", buffer, buflen);
	}
	parse_historical (app->app_local, buffer, buflen);
	xfree (relptr);
	}

	/* Read the force-chv1 flag. */
	relptr = get_one_do (app, 0x00C4, &buffer, &buflen, NULL);
	if (!relptr)
	{
	log_error (_("can't access %s - invalid OpenPGP card?\n"),
	"CHV Status Bytes");
	goto leave;
	}
	app->force_chv1 = (buflen && *buffer == 0);
	xfree (relptr);

	/* Read the extended capabilities. */
	relptr = get_one_do (app, 0x00C0, &buffer, &buflen, NULL);
	if (!relptr)
	{
	log_error (_("can't access %s - invalid OpenPGP card?\n"),
	"Extended Capability Flags" );
	goto leave;
	}
	if (buflen)
	{
	app->app_local->extcap.sm_supported = !!(*buffer & 0x80);
	app->app_local->extcap.get_challenge = !!(*buffer & 0x40);
	app->app_local->extcap.key_import = !!(*buffer & 0x20);
	app->app_local->extcap.change_force_chv = !!(*buffer & 0x10);
	app->app_local->extcap.private_dos = !!(*buffer & 0x08);
	app->app_local->extcap.algo_attr_change = !!(*buffer & 0x04);
	}
	if (buflen >= 10)
	{
	/* Available with v2 cards. */
	app->app_local->extcap.sm_aes128 = (buffer[1] == 1);
	app->app_local->extcap.max_get_challenge
	= (buffer[2] << 8 \| buffer[3]);
	app->app_local->extcap.max_certlen_3 = (buffer[4] << 8 \| buffer[5]);
	app->app_local->extcap.max_cmd_data = (buffer[6] << 8 \| buffer[7]);
	app->app_local->extcap.max_rsp_data = (buffer[8] << 8 \| buffer[9]);
	}
	xfree (relptr);

	/* Some of the first cards accidently don't set the
	CHANGE_FORCE_CHV bit but allow it anyway. */
	if (app->card_version <= 0x0100 && manufacturer == 1)
	app->app_local->extcap.change_force_chv = 1;

	parse_login_data (app);

	if (opt.verbose)
	show_caps (app->app_local);

	parse_algorithm_attribute (app, 0);
	parse_algorithm_attribute (app, 1);
	parse_algorithm_attribute (app, 2);

	if (opt.verbose > 1)
	dump_all_do (slot);

	app->fnc.deinit = do_deinit;
	app->fnc.learn_status = do_learn_status;
	app->fnc.readcert = do_readcert;
	app->fnc.readkey = do_readkey;
	app->fnc.getattr = do_getattr;
	app->fnc.setattr = do_setattr;
	app->fnc.writecert = do_writecert;
	app->fnc.writekey = do_writekey;
	app->fnc.genkey = do_genkey;
	app->fnc.sign = do_sign;
	app->fnc.auth = do_auth;
	app->fnc.decipher = do_decipher;
	app->fnc.change_pin = do_change_pin;
	app->fnc.check_pin = do_check_pin;
	}

	leave:
	if (rc)
	do_deinit (app);
	return rc;
	}



	diff --git a/g10/misc.c b/g10/misc.c
	index 8dd4e52b1..b688a93d7 100644
	--- a/g10/misc.c
	+++ b/g10/misc.c
	@@ -1,1388 +1,1388 @@
	/* misc.c - miscellaneous functions
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
	* 2008 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <http://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>
	#include <errno.h>
	#if defined(__linux__) && defined(__alpha__) && __GLIBC__ < 2
	#include <asm/sysinfo.h>
	#include <asm/unistd.h>
	#endif
	#ifdef HAVE_SETRLIMIT
	#include <time.h>
	#include <sys/time.h>
	#include <sys/resource.h>
	#endif
	#ifdef ENABLE_SELINUX_HACKS
	#include <sys/stat.h>
	#endif
	#ifdef _WIN32
	#include <time.h>
	#include <process.h>
	#include <windows.h>
	#include <shlobj.h>
	#ifndef CSIDL_APPDATA
	#define CSIDL_APPDATA 0x001a
	#endif
	#ifndef CSIDL_LOCAL_APPDATA
	#define CSIDL_LOCAL_APPDATA 0x001c
	#endif
	#ifndef CSIDL_FLAG_CREATE
	#define CSIDL_FLAG_CREATE 0x8000
	#endif
	#include "errors.h"
	#include "dynload.h"
	#endif /_WIN32/

	#ifdef __VMS
	# include <time.h>
	#endif /* def __VMS */

	#include "util.h"
	#include "main.h"
	#include "photoid.h"
	#include "options.h"
	#include "i18n.h"
	#include "cardglue.h"




	#ifdef ENABLE_SELINUX_HACKS
	/* A object and a global variable to keep track of files marked as
	secured. */
	struct secured_file_item
	{
	struct secured_file_item *next;
	ino_t ino;
	dev_t dev;
	};
	static struct secured_file_item *secured_files;
	#endif /ENABLE_SELINUX_HACKS/



	#if defined(__linux__) && defined(__alpha__) && __GLIBC__ < 2
	static int
	setsysinfo(unsigned long op, void *buffer, unsigned long size,
	int start, void arg, unsigned long flag)
	{
	return syscall(__NR_osf_setsysinfo, op, buffer, size, start, arg, flag);
	}

	void
	trap_unaligned(void)
	{
	unsigned int buf[2];

	buf[0] = SSIN_UACPROC;
	buf[1] = UAC_SIGBUS \| UAC_NOPRINT;
	setsysinfo(SSI_NVPAIRS, buf, 1, 0, 0, 0);
	}
	#else
	void
	trap_unaligned(void)
	{ /* dummy */
	}
	#endif


	int
	disable_core_dumps()
	{
	#if defined(HAVE_DOSISH_SYSTEM) \|\| defined(__VMS)
	return 0;
	#else
	#ifdef HAVE_SETRLIMIT
	struct rlimit limit;

	limit.rlim_cur = 0;
	limit.rlim_max = 0;
	if( !setrlimit( RLIMIT_CORE, &limit ) )
	return 0;
	if( errno != EINVAL && errno != ENOSYS )
	log_fatal(_("can't disable core dumps: %s\n"), strerror(errno) );
	#endif
	return 1;
	#endif
	}


	/* For the sake of SELinux we want to restrict access through gpg to
	certain files we keep under our own control. This function
	registers such a file and is_secured_file may then be used to
	check whether a file has ben registered as secured. */
	void
	register_secured_file (const char *fname)
	{
	#ifdef ENABLE_SELINUX_HACKS
	struct stat buf;
	struct secured_file_item *sf;

	/* Note that we stop immediatley if something goes wrong here. */
	if (stat (fname, &buf))
	log_fatal (_("fstat of `%s' failed in %s: %s\n"), fname,
	"register_secured_file", strerror (errno));
	/* log_debug ("registering `%s' i=%lu.%lu\n", fname, */
	/* (unsigned long)buf.st_dev, (unsigned long)buf.st_ino); */
	for (sf=secured_files; sf; sf = sf->next)
	{
	if (sf->ino == buf.st_ino && sf->dev == buf.st_dev)
	return; /* Already registered. */
	}

	sf = xmalloc (sizeof *sf);
	sf->ino = buf.st_ino;
	sf->dev = buf.st_dev;
	sf->next = secured_files;
	secured_files = sf;
	#endif /ENABLE_SELINUX_HACKS/
	}

	/* Remove a file registerd as secure. */
	void
	unregister_secured_file (const char *fname)
	{
	#ifdef ENABLE_SELINUX_HACKS
	struct stat buf;
	struct secured_file_item sf, sfprev;

	if (stat (fname, &buf))
	{
	log_error (_("fstat of `%s' failed in %s: %s\n"), fname,
	"unregister_secured_file", strerror (errno));
	return;
	}
	/* log_debug ("unregistering `%s' i=%lu.%lu\n", fname, */
	/* (unsigned long)buf.st_dev, (unsigned long)buf.st_ino); */
	for (sfprev=NULL,sf=secured_files; sf; sfprev=sf, sf = sf->next)
	{
	if (sf->ino == buf.st_ino && sf->dev == buf.st_dev)
	{
	if (sfprev)
	sfprev->next = sf->next;
	else
	secured_files = sf->next;
	xfree (sf);
	return;
	}
	}
	#endif /ENABLE_SELINUX_HACKS/
	}

	/* Return true if FD is corresponds to a secured file. Using -1 for
	FS is allowed and will return false. */
	int
	is_secured_file (int fd)
	{
	#ifdef ENABLE_SELINUX_HACKS
	struct stat buf;
	struct secured_file_item *sf;

	if (fd == -1)
	return 0; /* No file descriptor so it can't be secured either. */

	/* Note that we print out a error here and claim that a file is
	secure if something went wrong. */
	if (fstat (fd, &buf))
	{
	log_error (_("fstat(%d) failed in %s: %s\n"), fd,
	"is_secured_file", strerror (errno));
	return 1;
	}
	/* log_debug ("is_secured_file (%d) i=%lu.%lu\n", fd, */
	/* (unsigned long)buf.st_dev, (unsigned long)buf.st_ino); */
	for (sf=secured_files; sf; sf = sf->next)
	{
	if (sf->ino == buf.st_ino && sf->dev == buf.st_dev)
	return 1; /* Yes. */
	}
	#endif /ENABLE_SELINUX_HACKS/
	return 0; /* No. */
	}

	/* Return true if FNAME is corresponds to a secured file. Using NULL,
	"" or "-" for FS is allowed and will return false. This function is
	used before creating a file, thus it won't fail if the file does
	not exist. */
	int
	is_secured_filename (const char *fname)
	{
	#ifdef ENABLE_SELINUX_HACKS
	struct stat buf;
	struct secured_file_item *sf;

	if (iobuf_is_pipe_filename (fname) \|\| !*fname)
	return 0;

	/* Note that we print out a error here and claim that a file is
	secure if something went wrong. */
	if (stat (fname, &buf))
	{
	if (errno == ENOENT \|\| errno == EPERM \|\| errno == EACCES)
	return 0;
	log_error (_("fstat of `%s' failed in %s: %s\n"), fname,
	"is_secured_filename", strerror (errno));
	return 1;
	}
	/* log_debug ("is_secured_filename (%s) i=%lu.%lu\n", fname, */
	/* (unsigned long)buf.st_dev, (unsigned long)buf.st_ino); */
	for (sf=secured_files; sf; sf = sf->next)
	{
	if (sf->ino == buf.st_ino && sf->dev == buf.st_dev)
	return 1; /* Yes. */
	}
	#endif /ENABLE_SELINUX_HACKS/
	return 0; /* No. */
	}



	u16
	checksum_u16( unsigned n )
	{
	u16 a;

	a = (n >> 8) & 0xff;
	a += n & 0xff;
	return a;
	}


	u16
	checksum( byte *p, unsigned n )
	{
	u16 a;

	for(a=0; n; n-- )
	a += *p++;
	return a;
	}

	u16
	checksum_mpi( MPI a )
	{
	u16 csum;
	byte *buffer;
	unsigned nbytes;
	unsigned nbits;

	buffer = mpi_get_buffer( a, &nbytes, NULL );
	nbits = mpi_get_nbits(a);
	csum = checksum_u16( nbits );
	csum += checksum( buffer, nbytes );
	xfree( buffer );
	return csum;
	}

	u32
	buffer_to_u32( const byte *buffer )
	{
	unsigned long a;
	a = *buffer << 24;
	a \|= buffer[1] << 16;
	a \|= buffer[2] << 8;
	a \|= buffer[3];
	return a;
	}

	void
	print_pubkey_algo_note( int algo )
	{
	if(algo >= 100 && algo <= 110)
	{
	static int warn=0;
	if(!warn)
	{
	warn=1;
	log_info(_("WARNING: using experimental public key algorithm %s\n"),
	pubkey_algo_to_string(algo));
	}
	}
	else if (algo == 20)
	{
	log_info (_("WARNING: Elgamal sign+encrypt keys are deprecated\n"));
	}
	}

	void
	print_cipher_algo_note( int algo )
	{
	if(algo >= 100 && algo <= 110)
	{
	static int warn=0;
	if(!warn)
	{
	warn=1;
	log_info(_("WARNING: using experimental cipher algorithm %s\n"),
	cipher_algo_to_string(algo));
	}
	}
	}

	void
	print_digest_algo_note( int algo )
	{
	if(algo >= 100 && algo <= 110)
	{
	static int warn=0;
	if(!warn)
	{
	warn=1;
	log_info(_("WARNING: using experimental digest algorithm %s\n"),
	digest_algo_to_string(algo));
	}
	}
	else if(algo==DIGEST_ALGO_MD5)
	md5_digest_warn (1);
	}

	/* Return a string which is used as a kind of process ID */
	const byte *
	get_session_marker( size_t *rlen )
	{
	static byte marker[SIZEOF_UNSIGNED_LONG*2];
	static int initialized;

	if ( !initialized ) {
	volatile ulong aa, bb; /* we really want the uninitialized value */
	ulong a, b;

	initialized = 1;
	/* also this marker is guessable it is not easy to use this
	* for a faked control packet because an attacker does not
	* have enough control about the time the verification does
	* take place. Of course, we can add just more random but
	* than we need the random generator even for verification
	* tasks - which does not make sense. */
	a = aa ^ (ulong)getpid();
	b = bb ^ (ulong)time(NULL);
	memcpy( marker, &a, SIZEOF_UNSIGNED_LONG );
	memcpy( marker+SIZEOF_UNSIGNED_LONG, &b, SIZEOF_UNSIGNED_LONG );
	}
	*rlen = sizeof(marker);
	return marker;
	}

	/****************
	* Wrapper around the libgcrypt function with addional checks on
	* openPGP contraints for the algo ID.
	*/
	int
	openpgp_cipher_test_algo( int algo )
	{
	if( algo < 0 \|\| algo > 110 )
	return G10ERR_CIPHER_ALGO;
	return check_cipher_algo(algo);
	}

	int
	openpgp_pk_test_algo( int algo, unsigned int usage_flags )
	{
	/* Dont't allow type 20 keys unless in rfc2440 mode. */
	if (!RFC2440 && algo == 20)
	return G10ERR_PUBKEY_ALGO;
	if( algo < 0 \|\| algo > 110 )
	return G10ERR_PUBKEY_ALGO;
	return check_pubkey_algo2( algo, usage_flags );
	}

	int
	openpgp_pk_algo_usage ( int algo )
	{
	int use = 0;

	/* they are hardwired in gpg 1.0 */
	switch ( algo ) {
	case PUBKEY_ALGO_RSA:
	use = PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG \| PUBKEY_USAGE_ENC \| PUBKEY_USAGE_AUTH;
	break;
	case PUBKEY_ALGO_RSA_E:
	use = PUBKEY_USAGE_ENC;
	break;
	case PUBKEY_ALGO_RSA_S:
	use = PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG;
	break;
	case PUBKEY_ALGO_ELGAMAL:
	/* Allow encryption with type 20 keys if RFC-2440 compliance
	has been selected. Signing is broken thus we won't allow
	this. */
	if (RFC2440)
	use = PUBKEY_USAGE_ENC;
	break;
	case PUBKEY_ALGO_ELGAMAL_E:
	use = PUBKEY_USAGE_ENC;
	break;
	case PUBKEY_ALGO_DSA:
	use = PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG \| PUBKEY_USAGE_AUTH;
	break;
	default:
	break;
	}
	return use;
	}

	int
	openpgp_md_test_algo( int algo )
	{
	if( algo < 0 \|\| algo > 110 )
	return G10ERR_DIGEST_ALGO;
	return check_digest_algo(algo);
	}

	#ifdef USE_IDEA
	/* Special warning for the IDEA cipher */
	void
	idea_cipher_warn(int show)
	{
	static int warned=0;

	if(!warned \|\| show)
	{
	log_info(_("the IDEA cipher plugin is not present\n"));
	log_info(_("please see %s for more information\n"),
	"http://www.gnupg.org/faq/why-not-idea.html");
	warned=1;
	}
	}
	#endif

	/* Print a warning if the md5 digest algorithm has been used. This
	warning is printed only once unless SHOW is used. */
	void
	md5_digest_warn (int show)
	{
	static int warned = 0;

	if (!warned \|\| show)
	{
	log_info (_("WARNING: digest algorithm %s is deprecated\n"),
	digest_algo_to_string (DIGEST_ALGO_MD5));
	log_info (_("please see %s for more information\n"),
	"http://www.gnupg.org/faq/weak-digest-algos.html");
	warned = 1;
	}
	}


	void
	not_in_gpg1_notice (void)
	{
	static int warned = 0;

	if (!warned)
	{
	log_info (_("NOTE: This feature is not available in %s\n"), "GnuPG 1.x");
	log_info (_("please see %s for more information\n"),
	"http://www.gnupg.org/faq/features-not-in-gnupg-1.html");
	warned = 1;
	}
	}


	static unsigned long
	get_signature_count(PKT_secret_key *sk)
	{
	#ifdef ENABLE_CARD_SUPPORT
	if(sk && sk->is_protected && sk->protect.s2k.mode==1002)
	{
	struct agent_card_info_s info;
	if(agent_scd_getattr("SIG-COUNTER",&info)==0)
	return info.sig_counter;
	}
	#endif

	/* How to do this without a card? */

	return 0;
	}

	/* Expand %-strings. Returns a string which must be xfreed. Returns
	NULL if the string cannot be expanded (too large). */
	char *
	pct_expando(const char string,struct expando_args args)
	{
	const char *ch=string;
	int idx=0,maxlen=0,done=0;
	u32 pk_keyid[2]={0,0},sk_keyid[2]={0,0};
	char *ret=NULL;

	if(args->pk)
	keyid_from_pk(args->pk,pk_keyid);

	if(args->sk)
	keyid_from_sk(args->sk,sk_keyid);

	/* This is used so that %k works in photoid command strings in
	--list-secret-keys (which of course has a sk, but no pk). */
	if(!args->pk && args->sk)
	keyid_from_sk(args->sk,pk_keyid);

	while(*ch!='\0')
	{
	if(!done)
	{
	/* 8192 is way bigger than we'll need here */
	if(maxlen>=8192)
	goto fail;

	maxlen+=1024;
	ret=xrealloc(ret,maxlen);
	}

	done=0;

	if(*ch=='%')
	{
	switch(*(ch+1))
	{
	case 's': /* short key id */
	if(idx+8<maxlen)
	{
	sprintf(&ret[idx],"%08lX",(ulong)sk_keyid[1]);
	idx+=8;
	done=1;
	}
	break;

	case 'S': /* long key id */
	if(idx+16<maxlen)
	{
	sprintf(&ret[idx],"%08lX%08lX",
	(ulong)sk_keyid[0],(ulong)sk_keyid[1]);
	idx+=16;
	done=1;
	}
	break;

	case 'k': /* short key id */
	if(idx+8<maxlen)
	{
	sprintf(&ret[idx],"%08lX",(ulong)pk_keyid[1]);
	idx+=8;
	done=1;
	}
	break;

	case 'K': /* long key id */
	if(idx+16<maxlen)
	{
	sprintf(&ret[idx],"%08lX%08lX",
	(ulong)pk_keyid[0],(ulong)pk_keyid[1]);
	idx+=16;
	done=1;
	}
	break;

	case 'c': /* signature count from card, if any. */
	if(idx+10<maxlen)
	{
	sprintf(&ret[idx],"%lu",get_signature_count(args->sk));
	idx+=strlen(&ret[idx]);
	done=1;
	}
	break;

	case 'p': /* primary pk fingerprint of a sk */
	case 'f': /* pk fingerprint */
	case 'g': /* sk fingerprint */
	{
	byte array[MAX_FINGERPRINT_LEN];
	size_t len;
	int i;

	if((*(ch+1))=='p' && args->sk)
	{
	if(args->sk->is_primary)
	fingerprint_from_sk(args->sk,array,&len);
	else if(args->sk->main_keyid[0] \|\| args->sk->main_keyid[1])
	{
	PKT_public_key *pk=
	xmalloc_clear(sizeof(PKT_public_key));

	if(get_pubkey_fast(pk,args->sk->main_keyid)==0)
	fingerprint_from_pk(pk,array,&len);
	else
	memset(array,0,(len=MAX_FINGERPRINT_LEN));
	free_public_key(pk);
	}
	else
	memset(array,0,(len=MAX_FINGERPRINT_LEN));
	}
	else if((*(ch+1))=='f' && args->pk)
	fingerprint_from_pk(args->pk,array,&len);
	else if((*(ch+1))=='g' && args->sk)
	fingerprint_from_sk(args->sk,array,&len);
	else
	memset(array,0,(len=MAX_FINGERPRINT_LEN));

	if(idx+(len*2)<maxlen)
	{
	for(i=0;i<len;i++)
	{
	sprintf(&ret[idx],"%02X",array[i]);
	idx+=2;
	}
	done=1;
	}
	}
	break;

	case 'v': /* validity letters */
	if(args->validity_info && idx+1<maxlen)
	{
	ret[idx++]=args->validity_info;
	ret[idx]='\0';
	done=1;
	}
	break;

	/* The text string types */
	case 't':
	case 'T':
	case 'V':
	{
	const char *str=NULL;

	switch(*(ch+1))
	{
	case 't': /* e.g. "jpg" */
	str=image_type_to_string(args->imagetype,0);
	break;

	case 'T': /* e.g. "image/jpeg" */
	str=image_type_to_string(args->imagetype,2);
	break;

	case 'V': /* e.g. "full", "expired", etc. */
	str=args->validity_string;
	break;
	}

	if(str && idx+strlen(str)<maxlen)
	{
	strcpy(&ret[idx],str);
	idx+=strlen(str);
	done=1;
	}
	}
	break;

	case '%':
	if(idx+1<maxlen)
	{
	ret[idx++]='%';
	ret[idx]='\0';
	done=1;
	}
	break;

	/* Any unknown %-keys (like %i, %o, %I, and %O) are
	passed through for later expansion. Note this also
	handles the case where the last character in the
	string is a '%' - the terminating \0 will end up here
	and properly terminate the string. */
	default:
	if(idx+2<maxlen)
	{
	ret[idx++]='%';
	ret[idx++]=*(ch+1);
	ret[idx]='\0';
	done=1;
	}
	break;
	}

	if(done)
	ch++;
	}
	else
	{
	if(idx+1<maxlen)
	{
	ret[idx++]=*ch;
	ret[idx]='\0';
	done=1;
	}
	}

	if(done)
	ch++;
	}

	return ret;

	fail:
	xfree(ret);
	return NULL;
	}

	void
	deprecated_warning(const char *configname,unsigned int configlineno,
	const char option,const char repl1,const char *repl2)
	{
	if(configname)
	{
	if(strncmp("--",option,2)==0)
	option+=2;

	if(strncmp("--",repl1,2)==0)
	repl1+=2;

	log_info(_("%s:%d: deprecated option \"%s\"\n"),
	configname,configlineno,option);
	}
	else
	log_info(_("WARNING: \"%s\" is a deprecated option\n"),option);

	log_info(_("please use \"%s%s\" instead\n"),repl1,repl2);
	}


	void
	deprecated_command (const char *name)
	{
	log_info(_("WARNING: \"%s\" is a deprecated command - do not use it\n"),
	name);
	}


	const char *
	compress_algo_to_string(int algo)
	{
	const char *s=NULL;

	switch(algo)
	{
	case COMPRESS_ALGO_NONE:
	s=_("Uncompressed");
	break;

	case COMPRESS_ALGO_ZIP:
	s="ZIP";
	break;

	case COMPRESS_ALGO_ZLIB:
	s="ZLIB";
	break;

	#ifdef HAVE_BZIP2
	case COMPRESS_ALGO_BZIP2:
	s="BZIP2";
	break;
	#endif
	}

	return s;
	}

	int
	string_to_compress_algo(const char *string)
	{
	- /* NOTE TO TRANSLATOR: See doc/TRANSLATE about this string. */
	+ /* TRANSLATORS: See doc/TRANSLATE about this string. */
	if(match_multistr(_("uncompressed\|none"),string))
	return 0;
	else if(ascii_strcasecmp(string,"uncompressed")==0)
	return 0;
	else if(ascii_strcasecmp(string,"none")==0)
	return 0;
	else if(ascii_strcasecmp(string,"zip")==0)
	return 1;
	else if(ascii_strcasecmp(string,"zlib")==0)
	return 2;
	#ifdef HAVE_BZIP2
	else if(ascii_strcasecmp(string,"bzip2")==0)
	return 3;
	#endif
	else if(ascii_strcasecmp(string,"z0")==0)
	return 0;
	else if(ascii_strcasecmp(string,"z1")==0)
	return 1;
	else if(ascii_strcasecmp(string,"z2")==0)
	return 2;
	#ifdef HAVE_BZIP2
	else if(ascii_strcasecmp(string,"z3")==0)
	return 3;
	#endif
	else
	return -1;
	}

	int
	check_compress_algo(int algo)
	{
	#ifdef HAVE_BZIP2
	if(algo>=0 && algo<=3)
	return 0;
	#else
	if(algo>=0 && algo<=2)
	return 0;
	#endif

	return G10ERR_COMPR_ALGO;
	}

	int
	default_cipher_algo(void)
	{
	if(opt.def_cipher_algo)
	return opt.def_cipher_algo;
	else if(opt.personal_cipher_prefs)
	return opt.personal_cipher_prefs[0].value;
	else
	return opt.s2k_cipher_algo;
	}

	/* There is no default_digest_algo function, but see
	sign.c:hash_for() */

	int
	default_compress_algo(void)
	{
	if(opt.compress_algo!=-1)
	return opt.compress_algo;
	else if(opt.personal_compress_prefs)
	return opt.personal_compress_prefs[0].value;
	else
	return DEFAULT_COMPRESS_ALGO;
	}

	const char *
	compliance_option_string(void)
	{
	char *ver="???";

	switch(opt.compliance)
	{
	case CO_GNUPG: return "--gnupg";
	case CO_RFC4880: return "--openpgp";
	case CO_RFC2440: return "--rfc2440";
	case CO_RFC1991: return "--rfc1991";
	case CO_PGP2: return "--pgp2";
	case CO_PGP6: return "--pgp6";
	case CO_PGP7: return "--pgp7";
	case CO_PGP8: return "--pgp8";
	}

	return ver;
	}

	void
	compliance_failure(void)
	{
	char *ver="???";

	switch(opt.compliance)
	{
	case CO_GNUPG:
	ver="GnuPG";
	break;

	case CO_RFC4880:
	ver="OpenPGP";
	break;

	case CO_RFC2440:
	ver="OpenPGP (older)";
	break;

	case CO_RFC1991:
	ver="old PGP";
	break;

	case CO_PGP2:
	ver="PGP 2.x";
	break;

	case CO_PGP6:
	ver="PGP 6.x";
	break;

	case CO_PGP7:
	ver="PGP 7.x";
	break;

	case CO_PGP8:
	ver="PGP 8.x";
	break;
	}

	log_info(_("this message may not be usable by %s\n"),ver);
	opt.compliance=CO_GNUPG;
	}

	/* Break a string into successive option pieces. Accepts single word
	options and key=value argument options. */
	char *
	optsep(char **stringp)
	{
	char tok,end;

	tok=*stringp;
	if(tok)
	{
	end=strpbrk(tok," ,=");
	if(end)
	{
	int sawequals=0;
	char *ptr=end;

	/* what we need to do now is scan along starting with *end,
	If the next character we see (ignoring spaces) is an =
	sign, then there is an argument. */

	while(*ptr)
	{
	if(*ptr=='=')
	sawequals=1;
	else if(*ptr!=' ')
	break;
	ptr++;
	}

	/* There is an argument, so grab that too. At this point,
	ptr points to the first character of the argument. */
	if(sawequals)
	{
	/* Is it a quoted argument? */
	if(*ptr=='"')
	{
	ptr++;
	end=strchr(ptr,'"');
	if(end)
	end++;
	}
	else
	end=strpbrk(ptr," ,");
	}

	if(end && *end)
	{
	*end='\0';
	*stringp=end+1;
	}
	else
	*stringp=NULL;
	}
	else
	*stringp=NULL;
	}

	return tok;
	}

	/* Breaks an option value into key and value. Returns NULL if there
	is no value. Note that "string" is modified to remove the =value
	part. */
	char *
	argsplit(char *string)
	{
	char equals,arg=NULL;

	equals=strchr(string,'=');
	if(equals)
	{
	char quote,space;

	*equals='\0';
	arg=equals+1;

	/* Quoted arg? */
	quote=strchr(arg,'"');
	if(quote)
	{
	arg=quote+1;

	quote=strchr(arg,'"');
	if(quote)
	*quote='\0';
	}
	else
	{
	size_t spaces;

	/* Trim leading spaces off of the arg */
	spaces=strspn(arg," ");
	arg+=spaces;
	}

	/* Trim tailing spaces off of the tag */
	space=strchr(string,' ');
	if(space)
	*space='\0';
	}

	return arg;
	}

	/* Return the length of the initial token, leaving off any
	argument. */
	static size_t
	optlen(const char *s)
	{
	char *end=strpbrk(s," =");

	if(end)
	return end-s;
	else
	return strlen(s);
	}

	int
	parse_options(char str,unsigned int options,
	struct parse_options *opts,int noisy)
	{
	char *tok;

	if (str && !strcmp (str, "help"))
	{
	int i,maxlen=0;

	/* Figure out the longest option name so we can line these up
	neatly. */
	for(i=0;opts[i].name;i++)
	if(opts[i].help && maxlen<strlen(opts[i].name))
	maxlen=strlen(opts[i].name);

	for(i=0;opts[i].name;i++)
	if(opts[i].help)
	printf("%s%*s%s\n",opts[i].name,
	maxlen+2-(int)strlen(opts[i].name),"",_(opts[i].help));

	g10_exit(0);
	}

	while((tok=optsep(&str)))
	{
	int i,rev=0;
	char *otok=tok;

	if(tok[0]=='\0')
	continue;

	if(ascii_strncasecmp("no-",tok,3)==0)
	{
	rev=1;
	tok+=3;
	}

	for(i=0;opts[i].name;i++)
	{
	size_t toklen=optlen(tok);

	if(ascii_strncasecmp(opts[i].name,tok,toklen)==0)
	{
	/* We have a match, but it might be incomplete */
	if(toklen!=strlen(opts[i].name))
	{
	int j;

	for(j=i+1;opts[j].name;j++)
	{
	if(ascii_strncasecmp(opts[j].name,tok,toklen)==0)
	{
	if(noisy)
	log_info(_("ambiguous option `%s'\n"),otok);
	return 0;
	}
	}
	}

	if(rev)
	{
	*options&=~opts[i].bit;
	if(opts[i].value)
	*opts[i].value=NULL;
	}
	else
	{
	*options\|=opts[i].bit;
	if(opts[i].value)
	*opts[i].value=argsplit(tok);
	}
	break;
	}
	}

	if(!opts[i].name)
	{
	if(noisy)
	log_info(_("unknown option `%s'\n"),otok);
	return 0;
	}
	}

	return 1;
	}


	/* Return a new malloced string by unescaping the string S. Escaping
	is percent escaping and '+'/space mapping. A binary nul will
	silently be replaced by a 0xFF. */
	char *
	unescape_percent_string (const unsigned char *s)
	{
	char buffer, d;

	buffer = d = xmalloc (strlen (s)+1);
	while (*s)
	{
	if (*s == '%' && s[1] && s[2])
	{
	s++;
	*d = xtoi_2 (s);
	if (!*d)
	*d = '\xff';
	d++;
	s += 2;
	}
	else if (*s == '+')
	{
	*d++ = ' ';
	s++;
	}
	else
	d++ = s++;
	}
	*d = 0;
	return buffer;
	}


	/* Check whether the string has characters not valid in an RFC-822
	address. To cope with OpenPGP we ignore non-ascii characters
	so that for example umlauts are legal in an email address. An
	OpenPGP user ID must be utf-8 encoded but there is no strict
	requirement for RFC-822. Thus to avoid IDNA encoding we put the
	address verbatim as utf-8 into the user ID under the assumption
	that mail programs handle IDNA at a lower level and take OpenPGP
	user IDs as utf-8. Note that we can't do an utf-8 encoding
	checking here because in keygen.c this function is called with the
	native encoding and native to utf-8 encoding is only done later. */
	int
	has_invalid_email_chars (const char *s)
	{
	int at_seen=0;
	const char *valid_chars=
	"01234567890_-.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";

	for ( ; *s; s++ )
	{
	if ( *s & 0x80 )
	continue; /* We only care about ASCII. */
	if ( *s == '@' )
	at_seen=1;
	else if ( !at_seen && !( !!strchr( valid_chars, s ) \|\| s == '+' ) )
	return 1;
	else if ( at_seen && !strchr( valid_chars, *s ) )
	return 1;
	}
	return 0;
	}


	/* Check whether NAME represents a valid mailbox according to
	RFC822. Returns true if so. */
	int
	is_valid_mailbox (const char *name)
	{
	return !( !name
	\|\| !*name
	\|\| has_invalid_email_chars (name)
	\|\| string_count_chr (name,'@') != 1
	\|\| *name == '@'
	\|\| name[strlen(name)-1] == '@'
	\|\| name[strlen(name)-1] == '.'
	\|\| strstr (name, "..") );
	}


	/* This is a helper function to load a Windows function from either of
	one DLLs. */
	#ifdef HAVE_W32_SYSTEM
	static HRESULT
	w32_shgetfolderpath (HWND a, int b, HANDLE c, DWORD d, LPSTR e)
	{
	static int initialized;
	static HRESULT (WINAPI * func)(HWND,int,HANDLE,DWORD,LPSTR);

	if (!initialized)
	{
	static char *dllnames[] = { "shell32.dll", "shfolder.dll", NULL };
	void *handle;
	int i;

	initialized = 1;

	for (i=0, handle = NULL; !handle && dllnames[i]; i++)
	{
	handle = dlopen (dllnames[i], RTLD_LAZY);
	if (handle)
	{
	func = dlsym (handle, "SHGetFolderPathA");
	if (!func)
	{
	dlclose (handle);
	handle = NULL;
	}
	}
	}
	}

	if (func)
	return func (a,b,c,d,e);
	else
	return -1;
	}
	#endif /HAVE_W32_SYSTEM/


	/* Set up the default home directory. The usual --homedir option
	should be parsed later. */
	char *
	default_homedir (void)
	{
	char *dir;

	dir = getenv("GNUPGHOME");
	#ifdef HAVE_W32_SYSTEM
	if (!dir \|\| !*dir)
	dir = read_w32_registry_string (NULL, "Software\\GNU\\GnuPG", "HomeDir");
	if (!dir \|\| !*dir)
	{
	char path[MAX_PATH];

	/* It might be better to use LOCAL_APPDATA because this is
	defined as "non roaming" and thus more likely to be kept
	locally. For private keys this is desired. However, given
	that many users copy private keys anyway forth and back,
	using a system roaming serives might be better than to let
	them do it manually. A security conscious user will anyway
	use the registry entry to have better control. */
	if (w32_shgetfolderpath (NULL, CSIDL_APPDATA\|CSIDL_FLAG_CREATE,
	NULL, 0, path) >= 0)
	{
	char *tmp = xmalloc (strlen (path) + 6 +1);
	strcpy (stpcpy (tmp, path), "\\gnupg");
	dir = tmp;

	/* Try to create the directory if it does not yet
	exists. */
	if (access (dir, F_OK))
	CreateDirectory (dir, NULL);
	}
	}
	#endif /HAVE_W32_SYSTEM/
	if (!dir \|\| !*dir)
	dir = GNUPG_HOMEDIR;

	return dir;
	}


	/* Return the name of the libexec directory. The name is allocated in
	a static area on the first use. This function won't fail. */
	const char *
	get_libexecdir (void)
	{
	#ifdef HAVE_W32_SYSTEM
	static int got_dir;
	static char dir[MAX_PATH+5];

	if (!got_dir)
	{
	char *p;

	if ( !GetModuleFileName ( NULL, dir, MAX_PATH) )
	{
	log_debug ("GetModuleFileName failed: %s\n", w32_strerror (0));
	*dir = 0;
	}
	got_dir = 1;
	p = strrchr (dir, DIRSEP_C);
	if (p)
	*p = 0;
	else
	{
	log_debug ("bad filename `%s' returned for this process\n", dir);
	*dir = 0;
	}
	}

	if (*dir)
	return dir;
	/* Fallback to the hardwired value. */
	#endif /HAVE_W32_SYSTEM/

	return GNUPG_LIBEXECDIR;
	}

	/* Similar to access(2), but uses PATH to find the file.

	(2006-07-08 SMS: See "vmslib/vms.c" for a VMS-specific replacement
	function) */
	#ifndef __VMS
	int
	path_access(const char *file,int mode)
	{
	char *envpath;
	int ret=-1;

	envpath=getenv("PATH");

	if(!envpath
	#ifdef HAVE_DRIVE_LETTERS
	\|\| (((file[0]>='A' && file[0]<='Z')
	\|\| (file[0]>='a' && file[0]<='z'))
	&& file[1]==':')
	#else
	\|\| file[0]=='/'
	#endif
	)
	return access(file,mode);
	else
	{
	/* At least as large as, but most often larger than we need. */
	char *buffer=xmalloc(strlen(envpath)+1+strlen(file)+1);
	char split,item,*path=xstrdup(envpath);

	split=path;

	while((item=strsep(&split,PATHSEP_S)))
	{
	strcpy(buffer,item);
	strcat(buffer,"/");
	strcat(buffer,file);
	ret=access(buffer,mode);
	if(ret==0)
	break;
	}

	xfree(path);
	xfree(buffer);
	}

	return ret;
	}
	#endif /ndef __VMS/

	diff --git a/g10/pkclist.c b/g10/pkclist.c
	index 5154b19b1..d0d2a532c 100644
	--- a/g10/pkclist.c
	+++ b/g10/pkclist.c
	@@ -1,1475 +1,1475 @@
	/* pkclist.c
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
	* 2008, 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <http://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#ifdef HAVE_STRINGS_H
	#include <strings.h>
	#endif
	#include <errno.h>
	#include <assert.h>

	#include "options.h"
	#include "packet.h"
	#include "errors.h"
	#include "keydb.h"
	#include "memory.h"
	#include "util.h"
	#include "main.h"
	#include "trustdb.h"
	#include "ttyio.h"
	#include "status.h"
	#include "photoid.h"
	#include "i18n.h"

	#define CONTROL_D ('D' - 'A' + 1)

	/****************
	* Show the revocation reason as it is stored with the given signature
	*/
	static void
	do_show_revocation_reason( PKT_signature *sig )
	{
	size_t n, nn;
	const byte p, pp;
	int seq = 0;
	const char *text;

	while( (p = enum_sig_subpkt (sig->hashed, SIGSUBPKT_REVOC_REASON,
	&n, &seq, NULL )) ) {
	if( !n )
	continue; /* invalid - just skip it */

	if( *p == 0 )
	text = _("No reason specified");
	else if( *p == 0x01 )
	text = _("Key is superseded");
	else if( *p == 0x02 )
	text = _("Key has been compromised");
	else if( *p == 0x03 )
	text = _("Key is no longer used");
	else if( *p == 0x20 )
	text = _("User ID is no longer valid");
	else
	text = NULL;

	log_info( _("reason for revocation: ") );
	if( text )
	fputs( text, log_stream() );
	else
	fprintf( log_stream(), "code=%02x", *p );
	putc( '\n', log_stream() );
	n--; p++;
	pp = NULL;
	do {
	/* We don't want any empty lines, so skip them */
	while( n && *p == '\n' ) {
	p++;
	n--;
	}
	if( n ) {
	pp = memchr( p, '\n', n );
	nn = pp? pp - p : n;
	log_info( _("revocation comment: ") );
	print_string( log_stream(), p, nn, 0 );
	putc( '\n', log_stream() );
	p += nn; n -= nn;
	}
	} while( pp );
	}
	}

	/* Mode 0: try and find the revocation based on the pk (i.e. check
	subkeys, etc.) Mode 1: use only the revocation on the main pk */

	void
	show_revocation_reason( PKT_public_key *pk, int mode )
	{
	/* Hmmm, this is not so easy becuase we have to duplicate the code
	* used in the trustbd to calculate the keyflags. We need to find
	* a clean way to check revocation certificates on keys and
	* signatures. And there should be no duplicate code. Because we
	* enter this function only when the trustdb told us that we have
	* a revoked key, we could simply look for a revocation cert and
	* display this one, when there is only one. Let's try to do this
	* until we have a better solution. */
	KBNODE node, keyblock = NULL;
	byte fingerprint[MAX_FINGERPRINT_LEN];
	size_t fingerlen;
	int rc;

	/* get the keyblock */
	fingerprint_from_pk( pk, fingerprint, &fingerlen );
	rc = get_keyblock_byfprint( &keyblock, fingerprint, fingerlen );
	if( rc ) { /* that should never happen */
	log_debug( "failed to get the keyblock\n");
	return;
	}

	for( node=keyblock; node; node = node->next ) {
	if( (mode && node->pkt->pkttype == PKT_PUBLIC_KEY) \|\|
	( ( node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
	&& !cmp_public_keys( node->pkt->pkt.public_key, pk ) ) )
	break;
	}
	if( !node ) {
	log_debug("Oops, PK not in keyblock\n");
	release_kbnode( keyblock );
	return;
	}
	/* now find the revocation certificate */
	for( node = node->next; node ; node = node->next ) {
	if( node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
	break;
	if( node->pkt->pkttype == PKT_SIGNATURE
	&& (node->pkt->pkt.signature->sig_class == 0x20
	\|\| node->pkt->pkt.signature->sig_class == 0x28 ) ) {
	/* FIXME: we should check the signature here */
	do_show_revocation_reason ( node->pkt->pkt.signature );
	break;
	}
	}

	/* We didn't find it, so check if the whole key is revoked */
	if(!node && !mode)
	show_revocation_reason(pk,1);

	release_kbnode( keyblock );
	}


	/****************
	* mode: 0 = standard
	* 1 = Without key info and additional menu option 'm'
	* this does also add an option to set the key to ultimately trusted.
	* Returns:
	* -2 = nothing changed - caller should show some additional info
	* -1 = quit operation
	* 0 = nothing changed
	* 1 = new ownertrust now in new_trust
	*/
	static int
	do_edit_ownertrust (PKT_public_key *pk, int mode,
	unsigned *new_trust, int defer_help )
	{
	char *p;
	u32 keyid[2];
	int changed=0;
	int quit=0;
	int show=0;
	int min_num;
	int did_help=defer_help;
	unsigned int minimum=get_min_ownertrust(pk);

	switch(minimum)
	{
	default:
	case TRUST_UNDEFINED: min_num=1; break;
	case TRUST_NEVER: min_num=2; break;
	case TRUST_MARGINAL: min_num=3; break;
	case TRUST_FULLY: min_num=4; break;
	}

	keyid_from_pk (pk, keyid);
	for(;;) {
	/* A string with valid answers.

	- Note to translators: These are the allowed answers in lower and
	+ TRANSLATORS: These are the allowed answers in lower and
	uppercase. Below you will find the matching strings which
	should be translated accordingly and the letter changed to
	match the one in the answer string.

	i = please show me more information
	m = back to the main menu
	s = skip this key
	q = quit
	*/
	const char *ans = _("iImMqQsS");

	if( !did_help )
	{
	if( !mode )
	{
	KBNODE keyblock, un;

	tty_printf(_("No trust value assigned to:\n"));
	tty_printf("%4u%c/%s %s\n",nbits_from_pk( pk ),
	pubkey_letter( pk->pubkey_algo ),
	keystr(keyid), datestr_from_pk( pk ) );
	p=get_user_id_native(keyid);
	tty_printf(_(" \"%s\"\n"),p);
	xfree(p);

	keyblock = get_pubkeyblock (keyid);
	if (!keyblock)
	BUG ();
	for (un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype != PKT_USER_ID )
	continue;
	if (un->pkt->pkt.user_id->is_revoked )
	continue;
	if (un->pkt->pkt.user_id->is_expired )
	continue;
	/* Only skip textual primaries */
	if (un->pkt->pkt.user_id->is_primary
	&& !un->pkt->pkt.user_id->attrib_data )
	continue;

	if((opt.verify_options&VERIFY_SHOW_PHOTOS)
	&& un->pkt->pkt.user_id->attrib_data)
	show_photos(un->pkt->pkt.user_id->attribs,
	un->pkt->pkt.user_id->numattribs,pk,NULL,
	un->pkt->pkt.user_id);

	p=utf8_to_native(un->pkt->pkt.user_id->name,
	un->pkt->pkt.user_id->len,0);

	tty_printf(_(" aka \"%s\"\n"),p);
	}

	print_fingerprint (pk, NULL, 2);
	tty_printf("\n");
	release_kbnode (keyblock);
	}

	if(opt.trust_model==TM_DIRECT)
	{
	tty_printf(_("How much do you trust that this key actually "
	"belongs to the named user?\n"));
	tty_printf("\n");
	}
	else
	{
	/* This string also used in keyedit.c:trustsig_prompt */
	tty_printf(_("Please decide how far you trust this user to"
	" correctly verify other users' keys\n"
	"(by looking at passports, checking fingerprints from"
	" different sources, etc.)\n"));
	tty_printf("\n");
	}

	if(min_num<=1)
	tty_printf (_(" %d = I don't know or won't say\n"), 1);
	if(min_num<=2)
	tty_printf (_(" %d = I do NOT trust\n"), 2);
	if(min_num<=3)
	tty_printf (_(" %d = I trust marginally\n"), 3);
	if(min_num<=4)
	tty_printf (_(" %d = I trust fully\n"), 4);
	if (mode)
	tty_printf (_(" %d = I trust ultimately\n"), 5);
	#if 0
	/* not yet implemented */
	tty_printf (" i = please show me more information\n");
	#endif
	if( mode )
	tty_printf(_(" m = back to the main menu\n"));
	else
	{
	tty_printf(_(" s = skip this key\n"));
	tty_printf(_(" q = quit\n"));
	}
	tty_printf("\n");
	if(minimum)
	tty_printf(_("The minimum trust level for this key is: %s\n\n"),
	trust_value_to_string(minimum));
	did_help = 1;
	}
	if( strlen(ans) != 8 )
	BUG();
	p = cpr_get("edit_ownertrust.value",_("Your decision? "));
	trim_spaces(p);
	cpr_kill_prompt();
	if( !*p )
	did_help = 0;
	else if( *p && p[1] )
	;
	else if( !p[1] && ((p >= '0'+min_num) && p <= (mode?'5':'4')) )
	{
	unsigned int trust;
	switch( *p )
	{
	case '1': trust = TRUST_UNDEFINED; break;
	case '2': trust = TRUST_NEVER ; break;
	case '3': trust = TRUST_MARGINAL ; break;
	case '4': trust = TRUST_FULLY ; break;
	case '5': trust = TRUST_ULTIMATE ; break;
	default: BUG();
	}
	if (trust == TRUST_ULTIMATE
	&& !cpr_get_answer_is_yes ("edit_ownertrust.set_ultimate.okay",
	_("Do you really want to set this key"
	" to ultimate trust? (y/N) ")))
	; /* no */
	else
	{
	*new_trust = trust;
	changed = 1;
	break;
	}
	}
	#if 0
	/* not yet implemented */
	else if( p == ans[0] \|\| p == ans[1] )
	{
	tty_printf(_("Certificates leading to an ultimately trusted key:\n"));
	show = 1;
	break;
	}
	#endif
	else if( mode && (p == ans[2] \|\| p == ans[3] \|\| *p == CONTROL_D ) )
	{
	break ; /* back to the menu */
	}
	else if( !mode && (p == ans[6] \|\| p == ans[7] ) )
	{
	break; /* skip */
	}
	else if( !mode && (p == ans[4] \|\| p == ans[5] ) )
	{
	quit = 1;
	break ; /* back to the menu */
	}
	xfree(p); p = NULL;
	}
	xfree(p);
	return show? -2: quit? -1 : changed;
	}

	/*
	* Display a menu to change the ownertrust of the key PK (which should
	* be a primary key).
	* For mode values see do_edit_ownertrust ()
	*/
	int
	edit_ownertrust (PKT_public_key *pk, int mode )
	{
	unsigned int trust = 0; /* Needs to be initialized to avoid gcc warning. */
	int no_help = 0;

	for(;;)
	{
	switch ( do_edit_ownertrust (pk, mode, &trust, no_help ) )
	{
	case -1: /* quit */
	return -1;
	case -2: /* show info */
	no_help = 1;
	break;
	case 1: /* trust value set */
	trust &= ~TRUST_FLAG_DISABLED;
	trust \|= get_ownertrust (pk) & TRUST_FLAG_DISABLED;
	update_ownertrust (pk, trust );
	return 1;
	default:
	return 0;
	}
	}
	}


	/****************
	* Check whether we can trust this pk which has a trustlevel of TRUSTLEVEL
	* Returns: true if we trust.
	*/
	static int
	do_we_trust( PKT_public_key *pk, unsigned int trustlevel )
	{
	/* We should not be able to get here with a revoked or expired
	key */
	if(trustlevel & TRUST_FLAG_REVOKED
	\|\| trustlevel & TRUST_FLAG_SUB_REVOKED
	\|\| (trustlevel & TRUST_MASK) == TRUST_EXPIRED)
	BUG();

	if( opt.trust_model==TM_ALWAYS )
	{
	if( opt.verbose )
	log_info("No trust check due to `--trust-model always' option\n");
	return 1;
	}

	switch(trustlevel & TRUST_MASK)
	{
	default:
	log_error ("invalid trustlevel %u returned from validation layer\n",
	trustlevel);
	/* fall thru */
	case TRUST_UNKNOWN:
	case TRUST_UNDEFINED:
	log_info(_("%s: There is no assurance this key belongs"
	" to the named user\n"),keystr_from_pk(pk));
	return 0; /* no */

	case TRUST_MARGINAL:
	log_info(_("%s: There is limited assurance this key belongs"
	" to the named user\n"),keystr_from_pk(pk));
	return 1; /* yes */

	case TRUST_FULLY:
	if( opt.verbose )
	log_info(_("This key probably belongs to the named user\n"));
	return 1; /* yes */

	case TRUST_ULTIMATE:
	if( opt.verbose )
	log_info(_("This key belongs to us\n"));
	return 1; /* yes */
	}

	return 1; /NOTREACHED/
	}


	/****************
	* wrapper around do_we_trust, so we can ask whether to use the
	* key anyway.
	*/
	static int
	do_we_trust_pre( PKT_public_key *pk, unsigned int trustlevel )
	{
	int rc;

	rc = do_we_trust( pk, trustlevel );

	if( !opt.batch && !rc )
	{
	print_pubkey_info(NULL,pk);
	print_fingerprint (pk, NULL, 2);
	tty_printf("\n");

	tty_printf(
	_("It is NOT certain that the key belongs to the person named\n"
	"in the user ID. If you really know what you are doing,\n"
	"you may answer the next question with yes.\n"));

	tty_printf("\n");

	if( cpr_get_answer_is_yes("untrusted_key.override",
	_("Use this key anyway? (y/N) ")) )
	rc = 1;

	/* Hmmm: Should we set a flag to tell the user about
	* his decision the next time he encrypts for this recipient?
	*/
	}

	return rc;
	}


	/****************
	* Check whether we can trust this signature.
	* Returns: Error if we shall not trust this signatures.
	*/
	int
	check_signatures_trust( PKT_signature *sig )
	{
	PKT_public_key pk = xmalloc_clear( sizeof pk );
	unsigned int trustlevel;
	int rc=0;

	rc = get_pubkey( pk, sig->keyid );
	if (rc)
	{ /* this should not happen */
	log_error("Ooops; the key vanished - can't check the trust\n");
	rc = G10ERR_NO_PUBKEY;
	goto leave;
	}

	if ( opt.trust_model==TM_ALWAYS )
	{
	if( !opt.quiet )
	log_info(_("WARNING: Using untrusted key!\n"));
	if (opt.with_fingerprint)
	print_fingerprint (pk, NULL, 1);
	goto leave;
	}

	if(pk->maybe_revoked && !pk->is_revoked)
	log_info(_("WARNING: this key might be revoked (revocation key"
	" not present)\n"));

	trustlevel = get_validity (pk, NULL);

	if ( (trustlevel & TRUST_FLAG_REVOKED) )
	{
	write_status( STATUS_KEYREVOKED );
	if(pk->is_revoked==2)
	log_info(_("WARNING: This key has been revoked by its"
	" designated revoker!\n"));
	else
	log_info(_("WARNING: This key has been revoked by its owner!\n"));
	log_info(_(" This could mean that the signature is forged.\n"));
	show_revocation_reason( pk, 0 );
	}
	else if ((trustlevel & TRUST_FLAG_SUB_REVOKED) )
	{
	write_status( STATUS_KEYREVOKED );
	log_info(_("WARNING: This subkey has been revoked by its owner!\n"));
	show_revocation_reason( pk, 0 );
	}

	if ((trustlevel & TRUST_FLAG_DISABLED))
	log_info (_("Note: This key has been disabled.\n"));

	/* If we have PKA information adjust the trustlevel. */
	if (sig->pka_info && sig->pka_info->valid)
	{
	unsigned char fpr[MAX_FINGERPRINT_LEN];
	PKT_public_key *primary_pk;
	size_t fprlen;
	int okay;


	primary_pk = xmalloc_clear (sizeof *primary_pk);
	get_pubkey (primary_pk, pk->main_keyid);
	fingerprint_from_pk (primary_pk, fpr, &fprlen);
	free_public_key (primary_pk);

	if ( fprlen == 20 && !memcmp (sig->pka_info->fpr, fpr, 20) )
	{
	okay = 1;
	write_status_text (STATUS_PKA_TRUST_GOOD, sig->pka_info->email);
	log_info (_("Note: Verified signer's address is `%s'\n"),
	sig->pka_info->email);
	}
	else
	{
	okay = 0;
	write_status_text (STATUS_PKA_TRUST_BAD, sig->pka_info->email);
	log_info (_("Note: Signer's address `%s' "
	"does not match DNS entry\n"), sig->pka_info->email);
	}

	switch ( (trustlevel & TRUST_MASK) )
	{
	case TRUST_UNKNOWN:
	case TRUST_UNDEFINED:
	case TRUST_MARGINAL:
	if (okay && opt.verify_options&VERIFY_PKA_TRUST_INCREASE)
	{
	trustlevel = ((trustlevel & ~TRUST_MASK) \| TRUST_FULLY);
	log_info (_("trustlevel adjusted to FULL"
	" due to valid PKA info\n"));
	}
	/* (fall through) */
	case TRUST_FULLY:
	if (!okay)
	{
	trustlevel = ((trustlevel & ~TRUST_MASK) \| TRUST_NEVER);
	log_info (_("trustlevel adjusted to NEVER"
	" due to bad PKA info\n"));
	}
	break;
	}
	}

	/* Now let the user know what up with the trustlevel. */
	switch ( (trustlevel & TRUST_MASK) )
	{
	case TRUST_EXPIRED:
	log_info(_("Note: This key has expired!\n"));
	print_fingerprint (pk, NULL, 1);
	break;

	default:
	log_error ("invalid trustlevel %u returned from validation layer\n",
	trustlevel);
	/* fall thru */
	case TRUST_UNKNOWN:
	case TRUST_UNDEFINED:
	write_status( STATUS_TRUST_UNDEFINED );
	log_info(_("WARNING: This key is not certified with"
	" a trusted signature!\n"));
	log_info(_(" There is no indication that the "
	"signature belongs to the owner.\n" ));
	print_fingerprint (pk, NULL, 1);
	break;

	case TRUST_NEVER:
	/* currently we won't get that status */
	write_status( STATUS_TRUST_NEVER );
	log_info(_("WARNING: We do NOT trust this key!\n"));
	log_info(_(" The signature is probably a FORGERY.\n"));
	if (opt.with_fingerprint)
	print_fingerprint (pk, NULL, 1);
	rc = G10ERR_BAD_SIGN;
	break;

	case TRUST_MARGINAL:
	write_status( STATUS_TRUST_MARGINAL );
	log_info(_("WARNING: This key is not certified with"
	" sufficiently trusted signatures!\n"));
	log_info(_(" It is not certain that the"
	" signature belongs to the owner.\n" ));
	print_fingerprint (pk, NULL, 1);
	break;

	case TRUST_FULLY:
	write_status( STATUS_TRUST_FULLY );
	if (opt.with_fingerprint)
	print_fingerprint (pk, NULL, 1);
	break;

	case TRUST_ULTIMATE:
	write_status( STATUS_TRUST_ULTIMATE );
	if (opt.with_fingerprint)
	print_fingerprint (pk, NULL, 1);
	break;
	}

	leave:
	free_public_key( pk );
	return rc;
	}


	void
	release_pk_list( PK_LIST pk_list )
	{
	PK_LIST pk_rover;

	for( ; pk_list; pk_list = pk_rover ) {
	pk_rover = pk_list->next;
	free_public_key( pk_list->pk );
	xfree( pk_list );
	}
	}


	static int
	key_present_in_pk_list(PK_LIST pk_list, PKT_public_key *pk)
	{
	for( ; pk_list; pk_list = pk_list->next)
	if (cmp_public_keys(pk_list->pk, pk) == 0)
	return 0;

	return -1;
	}


	/****************
	* Return a malloced string with a default reciepient if there is any
	*/
	static char *
	default_recipient(void)
	{
	PKT_secret_key *sk;
	byte fpr[MAX_FINGERPRINT_LEN+1];
	size_t n;
	char *p;
	int i;

	if( opt.def_recipient )
	return xstrdup( opt.def_recipient );
	if( !opt.def_recipient_self )
	return NULL;
	sk = xmalloc_clear( sizeof *sk );
	i = get_seckey_byname( sk, NULL, 0 );
	if( i ) {
	free_secret_key( sk );
	return NULL;
	}
	n = MAX_FINGERPRINT_LEN;
	fingerprint_from_sk( sk, fpr, &n );
	free_secret_key( sk );
	p = xmalloc( 2*n+3 );
	*p++ = '0';
	*p++ = 'x';
	for(i=0; i < n; i++ )
	sprintf( p+2*i, "%02X", fpr[i] );
	p -= 2;
	return p;
	}

	static int
	expand_id(const char id,STRLIST into,unsigned int flags)
	{
	struct groupitem *groups;
	int count=0;

	for(groups=opt.grouplist;groups;groups=groups->next)
	{
	/* need strcasecmp() here, as this should be localized */
	if(strcasecmp(groups->name,id)==0)
	{
	STRLIST each,sl;

	/* this maintains the current utf8-ness */
	for(each=groups->values;each;each=each->next)
	{
	sl=add_to_strlist(into,each->d);
	sl->flags=flags;
	count++;
	}

	break;
	}
	}

	return count;
	}

	/* For simplicity, and to avoid potential loops, we only expand once -
	you can't make an alias that points to an alias. */
	static STRLIST
	expand_group(STRLIST input)
	{
	STRLIST sl,output=NULL,rover;

	for(rover=input;rover;rover=rover->next)
	if(expand_id(rover->d,&output,rover->flags)==0)
	{
	/* Didn't find any groups, so use the existing string */
	sl=add_to_strlist(&output,rover->d);
	sl->flags=rover->flags;
	}

	return output;
	}


	/* This is the central function to collect the keys for recipients.
	It is thus used to prepare a public key encryption. encrypt-to
	keys, default keys and the keys for the actual recipients are all
	collected here. When not in batch mode and no recipient has been
	passed on the commandline, the function will also ask for
	recipients.

	RCPTS is a string list with the recipients; NULL is an allowed
	value but not very useful. Group expansion is done on these names;
	they may be in any of the user Id formats we can handle. The flags
	bits for each string in the string list are used for:
	Bit 0: This is an encrypt-to recipient.
	Bit 1: This is a hidden recipient.

	USE is the desired use for the key - usually PUBKEY_USAGE_ENC.
	RET_PK_LIST.

	On success a list of keys is stored at the address RET_PK_LIST; the
	caller must free this list. On error the value at this address is
	not changed.
	*/
	int
	build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned int use )
	{
	PK_LIST pk_list = NULL;
	PKT_public_key *pk=NULL;
	int rc=0;
	int any_recipients=0;
	STRLIST rov,remusr;
	char *def_rec = NULL;

	/* Try to expand groups if any have been defined. */
	if (opt.grouplist)
	remusr = expand_group (rcpts);
	else
	remusr = rcpts;

	/* Check whether there are any recipients in the list and build the
	* list of the encrypt-to ones (we always trust them). */
	for ( rov = remusr; rov; rov = rov->next )
	{
	if ( !(rov->flags & 1) )
	{
	/* This is a regular recipient; i.e. not an encrypt-to
	one. */
	any_recipients = 1;

	/* Hidden recipients are not allowed while in PGP mode,
	issue a warning and switch into GnuPG mode. */
	if ((rov->flags&2) && (PGP2 \|\| PGP6 \|\| PGP7 \|\| PGP8))
	{
	log_info(_("you may not use %s while in %s mode\n"),
	"--hidden-recipient",
	compliance_option_string());

	compliance_failure();
	}
	}
	else if ( (use & PUBKEY_USAGE_ENC) && !opt.no_encrypt_to )
	{
	/* Encryption has been requested and --encrypt-to has not
	been disabled. Check this encrypt-to key. */
	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = use;

	/* We explicitly allow encrypt-to to an disabled key; thus
	we pass 1 as last argument. */
	if ( (rc = get_pubkey_byname ( pk, rov->d, NULL, NULL, 1 )) )
	{
	free_public_key ( pk ); pk = NULL;
	log_error (_("%s: skipped: %s\n"), rov->d, g10_errstr(rc) );
	write_status_text_and_buffer (STATUS_INV_RECP, "0 ",
	rov->d, strlen (rov->d), -1);
	goto fail;
	}
	else if ( !(rc=check_pubkey_algo2 (pk->pubkey_algo, use )) )
	{
	/* Skip the actual key if the key is already present
	* in the list. Add it to our list if not. */
	if (key_present_in_pk_list(pk_list, pk) == 0)
	{
	free_public_key (pk); pk = NULL;
	log_info (_("%s: skipped: public key already present\n"),
	rov->d);
	}
	else
	{
	PK_LIST r;
	r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = (rov->flags&2)?1:0;
	pk_list = r;

	/* Hidden encrypt-to recipients are not allowed while
	in PGP mode, issue a warning and switch into
	GnuPG mode. */
	if ((r->flags&1) && (PGP2 \|\| PGP6 \|\| PGP7 \|\| PGP8))
	{
	log_info(_("you may not use %s while in %s mode\n"),
	"--hidden-encrypt-to",
	compliance_option_string());

	compliance_failure();
	}
	}
	}
	else
	{
	/* The public key is not usable for encryption or not
	available. */
	free_public_key( pk ); pk = NULL;
	log_error(_("%s: skipped: %s\n"), rov->d, g10_errstr(rc) );
	write_status_text_and_buffer (STATUS_INV_RECP, "0 ",
	rov->d, strlen (rov->d), -1);
	goto fail;
	}
	}
	}

	/* If we don't have any recipients yet and we are not in batch mode
	drop into interactive selection mode. */
	if ( !any_recipients && !opt.batch )
	{
	int have_def_rec;
	char *answer = NULL;
	STRLIST backlog = NULL;

	if (pk_list)
	any_recipients = 1;
	def_rec = default_recipient();
	have_def_rec = !!def_rec;
	if ( !have_def_rec )
	tty_printf(_("You did not specify a user ID. (you may use \"-r\")\n"));

	for (;;)
	{
	rc = 0;
	xfree(answer);
	if ( have_def_rec )
	{
	/* A default recipient is taken as the first entry. */
	answer = def_rec;
	def_rec = NULL;
	}
	else if (backlog)
	{
	/* This is part of our trick to expand and display groups. */
	answer = pop_strlist (&backlog);
	}
	else
	{
	/* Show the list of already collected recipients and ask
	for more. */
	PK_LIST iter;

	tty_printf("\n");
	tty_printf(_("Current recipients:\n"));
	for (iter=pk_list;iter;iter=iter->next)
	{
	u32 keyid[2];

	keyid_from_pk(iter->pk,keyid);
	tty_printf("%4u%c/%s %s \"",
	nbits_from_pk(iter->pk),
	pubkey_letter(iter->pk->pubkey_algo),
	keystr(keyid),
	datestr_from_pk(iter->pk));

	if (iter->pk->user_id)
	tty_print_utf8_string(iter->pk->user_id->name,
	iter->pk->user_id->len);
	else
	{
	size_t n;
	char *p = get_user_id( keyid, &n );
	tty_print_utf8_string( p, n );
	xfree(p);
	}
	tty_printf("\"\n");
	}

	answer = cpr_get_utf8("pklist.user_id.enter",
	_("\nEnter the user ID. "
	"End with an empty line: "));
	trim_spaces(answer);
	cpr_kill_prompt();
	}

	if ( !answer \|\| !*answer )
	{
	xfree(answer);
	break; /* No more recipients entered - get out of loop. */
	}

	/* Do group expand here too. The trick here is to continue
	the loop if any expansion occured. The code above will
	then list all expanded keys. */
	if (expand_id(answer,&backlog,0))
	continue;

	/* Get and check key for the current name. */
	if (pk)
	free_public_key (pk);
	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = use;
	rc = get_pubkey_byname( pk, answer, NULL, NULL, 0 );
	if (rc)
	tty_printf(_("No such user ID.\n"));
	else if ( !(rc=check_pubkey_algo2(pk->pubkey_algo, use)) )
	{
	if ( have_def_rec )
	{
	/* No validation for a default recipient. */
	if (!key_present_in_pk_list(pk_list, pk))
	{
	free_public_key (pk); pk = NULL;
	log_info (_("skipped: public key "
	"already set as default recipient\n") );
	}
	else
	{
	PK_LIST r = xmalloc (sizeof *r);
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = 0; /* No throwing default ids. */
	pk_list = r;
	}
	any_recipients = 1;
	continue;
	}
	else
	{ /* Check validity of this key. */
	int trustlevel;

	trustlevel = get_validity (pk, pk->user_id);
	if ( (trustlevel & TRUST_FLAG_DISABLED) )
	{
	tty_printf (_("Public key is disabled.\n") );
	}
	else if ( do_we_trust_pre (pk, trustlevel) )
	{
	/* Skip the actual key if the key is already
	* present in the list */
	if (!key_present_in_pk_list(pk_list, pk))
	{
	free_public_key(pk); pk = NULL;
	log_info(_("skipped: public key already set\n") );
	}
	else
	{
	PK_LIST r;
	r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = 0; /* No throwing interactive ids. */
	pk_list = r;
	}
	any_recipients = 1;
	continue;
	}
	}
	}
	xfree(def_rec); def_rec = NULL;
	have_def_rec = 0;
	}
	if ( pk )
	{
	free_public_key( pk );
	pk = NULL;
	}
	}
	else if ( !any_recipients && (def_rec = default_recipient()) )
	{
	/* We are in batch mode and have only a default recipient. */
	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = use;

	/* The default recipient is allowed to be disabled; thus pass 1
	as last argument. */
	rc = get_pubkey_byname (pk, def_rec, NULL, NULL, 1);
	if (rc)
	log_error(_("unknown default recipient \"%s\"\n"), def_rec );
	else if ( !(rc=check_pubkey_algo2(pk->pubkey_algo, use)) )
	{
	/* Mark any_recipients here since the default recipient
	would have been used if it wasn't already there. It
	doesn't really matter if we got this key from the default
	recipient or an encrypt-to. */
	any_recipients = 1;
	if (!key_present_in_pk_list(pk_list, pk))
	log_info (_("skipped: public key already set "
	"as default recipient\n"));
	else
	{
	PK_LIST r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = 0; /* No throwing default ids. */
	pk_list = r;
	}
	}
	if ( pk )
	{
	free_public_key( pk );
	pk = NULL;
	}
	xfree(def_rec); def_rec = NULL;
	}
	else
	{
	/* General case: Check all keys. */
	any_recipients = 0;
	for (; remusr; remusr = remusr->next )
	{
	if ( (remusr->flags & 1) )
	continue; /* encrypt-to keys are already handled. */

	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = use;
	if ( (rc = get_pubkey_byname( pk, remusr->d, NULL, NULL, 0 )) )
	{
	/* Key not found or other error. */
	free_public_key( pk ); pk = NULL;
	log_error(_("%s: skipped: %s\n"), remusr->d, g10_errstr(rc) );
	write_status_text_and_buffer (STATUS_INV_RECP, "0 ",
	remusr->d, strlen (remusr->d),
	-1);
	goto fail;
	}
	else if ( !(rc=check_pubkey_algo2(pk->pubkey_algo, use )) )
	{
	/* Key found and usable. Check validity. */
	int trustlevel;

	trustlevel = get_validity (pk, pk->user_id);
	if ( (trustlevel & TRUST_FLAG_DISABLED) )
	{
	/Key has been disabled. /
	free_public_key(pk); pk = NULL;
	log_info(_("%s: skipped: public key is disabled\n"),
	remusr->d);
	write_status_text_and_buffer (STATUS_INV_RECP, "0 ",
	remusr->d,
	strlen (remusr->d),
	-1);
	rc=G10ERR_UNU_PUBKEY;
	goto fail;
	}
	else if ( do_we_trust_pre( pk, trustlevel ) )
	{
	/* Note: do_we_trust may have changed the trustlevel */

	/* We have at least one valid recipient. It doesn't
	* matters if this recipient is already present. */
	any_recipients = 1;

	/* Skip the actual key if the key is already present
	* in the list */
	if (!key_present_in_pk_list(pk_list, pk))
	{
	free_public_key(pk); pk = NULL;
	log_info(_("%s: skipped: public key already present\n"),
	remusr->d);
	}
	else
	{
	PK_LIST r;
	r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = (remusr->flags&2)?1:0;
	pk_list = r;
	}
	}
	else
	{ /* We don't trust this key. */
	free_public_key( pk ); pk = NULL;
	write_status_text_and_buffer (STATUS_INV_RECP, "10 ",
	remusr->d,
	strlen (remusr->d),
	-1);
	rc=G10ERR_UNU_PUBKEY;
	goto fail;
	}
	}
	else
	{
	/* Key found but not usable for us (e.g. sign-only key). */
	free_public_key( pk ); pk = NULL;
	write_status_text_and_buffer (STATUS_INV_RECP, "0 ",
	remusr->d,
	strlen (remusr->d),
	-1);
	log_error(_("%s: skipped: %s\n"), remusr->d, g10_errstr(rc) );
	goto fail;
	}
	}
	}

	if ( !rc && !any_recipients )
	{
	log_error(_("no valid addressees\n"));
	write_status_text (STATUS_NO_RECP, "0");
	rc = G10ERR_NO_USER_ID;
	}

	fail:

	if ( rc )
	release_pk_list( pk_list );
	else
	*ret_pk_list = pk_list;
	if (opt.grouplist)
	free_strlist(remusr);
	return rc;
	}


	/* In pgp6 mode, disallow all ciphers except IDEA (1), 3DES (2), and
	CAST5 (3), all hashes except MD5 (1), SHA1 (2), and RIPEMD160 (3),
	and all compressions except none (0) and ZIP (1). pgp7 and pgp8
	mode expands the cipher list to include AES128 (7), AES192 (8),
	AES256 (9), and TWOFISH (10). pgp8 adds the SHA-256 hash (8). For
	a true PGP key all of this is unneeded as they are the only items
	present in the preferences subpacket, but checking here covers the
	weird case of encrypting to a key that had preferences from a
	different implementation which was then used with PGP. I am not
	completely comfortable with this as the right thing to do, as it
	slightly alters the list of what the user is supposedly requesting.
	It is not against the RFC however, as the preference chosen will
	never be one that the user didn't specify somewhere ("The
	implementation may use any mechanism to pick an algorithm in the
	intersection"), and PGP has no mechanism to fix such a broken
	preference list, so I'm including it. -dms */

	int
	algo_available( preftype_t preftype, int algo, const union pref_hint *hint )
	{
	if( preftype == PREFTYPE_SYM )
	{
	if(PGP6 && (algo != CIPHER_ALGO_IDEA
	&& algo != CIPHER_ALGO_3DES
	&& algo != CIPHER_ALGO_CAST5))
	return 0;

	if(PGP7 && (algo != CIPHER_ALGO_IDEA
	&& algo != CIPHER_ALGO_3DES
	&& algo != CIPHER_ALGO_CAST5
	&& algo != CIPHER_ALGO_AES
	&& algo != CIPHER_ALGO_AES192
	&& algo != CIPHER_ALGO_AES256
	&& algo != CIPHER_ALGO_TWOFISH))
	return 0;

	/* PGP8 supports all the ciphers we do.. */

	return algo && !check_cipher_algo( algo );
	}
	else if( preftype == PREFTYPE_HASH )
	{
	if(hint && hint->digest_length)
	{
	if(hint->digest_length!=20 \|\| opt.flags.dsa2)
	{
	/* If --enable-dsa2 is set or the hash isn't 160 bits
	(which implies DSA2), then we'll accept a hash that
	is larger than we need. Otherwise we won't accept
	any hash that isn't exactly the right size. */
	if(hint->digest_length > md_digest_length(algo))
	return 0;
	}
	else if(hint->digest_length != md_digest_length(algo))
	return 0;
	}

	if((PGP6 \|\| PGP7) && (algo != DIGEST_ALGO_MD5
	&& algo != DIGEST_ALGO_SHA1
	&& algo != DIGEST_ALGO_RMD160))
	return 0;


	if(PGP8 && (algo != DIGEST_ALGO_MD5
	&& algo != DIGEST_ALGO_SHA1
	&& algo != DIGEST_ALGO_RMD160
	&& algo != DIGEST_ALGO_SHA256))
	return 0;

	return algo && !check_digest_algo( algo );
	}
	else if( preftype == PREFTYPE_ZIP )
	{
	if((PGP6 \|\| PGP7) && (algo != COMPRESS_ALGO_NONE
	&& algo != COMPRESS_ALGO_ZIP))
	return 0;

	/* PGP8 supports all the compression algos we do */

	return !check_compress_algo( algo );
	}
	else
	return 0;
	}

	/****************
	* Return -1 if we could not find an algorithm.
	*/
	int
	select_algo_from_prefs(PK_LIST pk_list, int preftype,
	int request, const union pref_hint *hint)
	{
	PK_LIST pkr;
	u32 bits[8];
	const prefitem_t *prefs;
	int result=-1,i;
	u16 scores[256];

	if( !pk_list )
	return -1;

	memset(bits,0xFF,sizeof(bits));
	memset(scores,0,sizeof(scores));

	for( pkr = pk_list; pkr; pkr = pkr->next )
	{
	u32 mask[8];
	int rank=1,implicit=-1;

	memset(mask,0,sizeof(mask));

	switch(preftype)
	{
	case PREFTYPE_SYM:
	/* IDEA is implicitly there for v3 keys with v3 selfsigs if
	--pgp2 mode is on. This was a 2440 thing that was
	dropped from 4880 but is still relevant to GPG's 1991
	support. All this doesn't mean IDEA is actually
	available, of course. */
	if(PGP2 && pkr->pk->version<4 && pkr->pk->selfsigversion<4)
	implicit=CIPHER_ALGO_IDEA;
	else
	implicit=CIPHER_ALGO_3DES;

	break;

	case PREFTYPE_HASH:
	/* While I am including this code for completeness, note
	that currently --pgp2 mode locks the hash at MD5, so this
	code will never even be called. Even if the hash wasn't
	locked at MD5, we don't support sign+encrypt in --pgp2
	mode, and that's the only time PREFTYPE_HASH is used
	anyway. -dms */

	/* MD5 is there for v3 keys with v3 selfsigs when --pgp2 is
	on. */
	if(PGP2 && pkr->pk->version<4 && pkr->pk->selfsigversion<4)
	implicit=DIGEST_ALGO_MD5;
	else
	implicit=DIGEST_ALGO_SHA1;

	break;

	case PREFTYPE_ZIP:
	/* Uncompressed is always an option. */
	implicit=COMPRESS_ALGO_NONE;
	}

	if (pkr->pk->user_id) /* selected by user ID */
	prefs = pkr->pk->user_id->prefs;
	else
	prefs = pkr->pk->prefs;

	if( prefs )
	{
	for (i=0; prefs[i].type; i++ )
	{
	if( prefs[i].type == preftype )
	{
	/* Make sure all scores don't add up past 0xFFFF
	(and roll around) */
	if(rank+scores[prefs[i].value]<=0xFFFF)
	scores[prefs[i].value]+=rank;
	else
	scores[prefs[i].value]=0xFFFF;

	mask[prefs[i].value/32] \|= 1<<(prefs[i].value%32);

	rank++;

	/* We saw the implicit algorithm, so we don't need
	tack it on the end ourselves. */
	if(implicit==prefs[i].value)
	implicit=-1;
	}
	}
	}

	if(rank==1 && preftype==PREFTYPE_ZIP)
	{
	/* If the compression preferences are not present, they are
	assumed to be ZIP, Uncompressed (RFC4880:13.3.1) */
	scores[1]=1; /* ZIP is first choice */
	scores[0]=2; /* Uncompressed is second choice */
	mask[0]\|=3;
	}

	/* If the key didn't have the implicit algorithm listed
	explicitly, add it here at the tail of the list. */
	if(implicit>-1)
	{
	scores[implicit]+=rank;
	mask[implicit/32] \|= 1<<(implicit%32);
	}

	for(i=0;i<8;i++)
	bits[i]&=mask[i];
	}

	/* We've now scored all of the algorithms, and the usable ones have
	bits set. Let's pick the winner. */

	/* The caller passed us a request. Can we use it? */
	if(request>-1 && (bits[request/32] & (1<<(request%32))) &&
	algo_available(preftype,request,hint))
	result=request;

	if(result==-1)
	{
	/* If we have personal prefs set, use them. */
	prefs=NULL;
	if(preftype==PREFTYPE_SYM && opt.personal_cipher_prefs)
	prefs=opt.personal_cipher_prefs;
	else if(preftype==PREFTYPE_HASH && opt.personal_digest_prefs)
	prefs=opt.personal_digest_prefs;
	else if(preftype==PREFTYPE_ZIP && opt.personal_compress_prefs)
	prefs=opt.personal_compress_prefs;

	if( prefs )
	for(i=0; prefs[i].type; i++ )
	{
	if(bits[prefs[i].value/32] & (1<<(prefs[i].value%32))
	&& algo_available( preftype, prefs[i].value, hint))
	{
	result = prefs[i].value;
	break;
	}
	}
	}

	if(result==-1)
	{
	unsigned int best=-1;

	/* At this point, we have not selected an algorithm due to a
	special request or via personal prefs. Pick the highest
	ranked algorithm (i.e. the one with the lowest score). */

	if(preftype==PREFTYPE_HASH && scores[DIGEST_ALGO_MD5])
	{
	/* "If you are building an authentication system, the recipient
	may specify a preferred signing algorithm. However, the
	signer would be foolish to use a weak algorithm simply
	because the recipient requests it." (RFC4880:14). If any
	other hash algorithm is available, pretend that MD5 isn't.
	Note that if the user intentionally chose MD5 by putting it
	in their personal prefs, then we do what the user said (as we
	never reach this code). */

	for(i=DIGEST_ALGO_MD5+1;i<256;i++)
	if(scores[i])
	{
	scores[DIGEST_ALGO_MD5]=0;
	break;
	}
	}

	for(i=0;i<256;i++)
	{
	/* Note the '<' here. This means in case of a tie, we will
	favor the lower algorithm number. We have a choice
	between the lower number (probably an older algorithm
	with more time in use), or the higher number (probably a
	newer algorithm with less time in use). Older is
	probably safer here, even though the newer algorithms
	tend to be "stronger". */
	if(scores[i] && scores[i]<best
	&& (bits[i/32] & (1<<(i%32)))
	&& algo_available(preftype,i,hint))
	{
	best=scores[i];
	result=i;
	}
	}
	}

	return result;
	}

	/*
	* Select the MDC flag from the pk_list. We can only use MDC if all recipients
	* support this feature
	*/
	int
	select_mdc_from_pklist (PK_LIST pk_list)
	{
	PK_LIST pkr;

	if( !pk_list )
	return 0;

	for (pkr = pk_list; pkr; pkr = pkr->next) {
	int mdc;

	if (pkr->pk->user_id) /* selected by user ID */
	mdc = pkr->pk->user_id->flags.mdc;
	else
	mdc = pkr->pk->mdc_feature;
	if (!mdc)
	return 0; /* at least one recipient does not support it */
	}
	return 1; /* can be used */
	}
	diff --git a/g10/trustdb.c b/g10/trustdb.c
	index a3fae5d09..24d675b22 100644
	--- a/g10/trustdb.c
	+++ b/g10/trustdb.c
	@@ -1,2494 +1,2494 @@
	/* trustdb.c
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
	* 2008, 2012 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <http://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <assert.h>

	#ifndef DISABLE_REGEX
	#include <sys/types.h>
	#ifdef USE_INTERNAL_REGEX
	#include "_regex.h"
	#else
	#include <regex.h>
	#endif
	#endif /* !DISABLE_REGEX */

	#include "errors.h"
	#include "iobuf.h"
	#include "keydb.h"
	#include "memory.h"
	#include "util.h"
	#include "options.h"
	#include "packet.h"
	#include "main.h"
	#include "i18n.h"
	#include "tdbio.h"
	#include "trustdb.h"


	/*
	* A structure to store key identification as well as some stuff needed
	* for validation
	*/
	struct key_item {
	struct key_item *next;
	unsigned int ownertrust,min_ownertrust;
	byte trust_depth;
	byte trust_value;
	char *trust_regexp;
	u32 kid[2];
	};


	typedef struct key_item *KeyHashTable; / see new_key_hash_table() */

	/*
	* Structure to keep track of keys, this is used as an array wherre
	* the item right after the last one has a keyblock set to NULL.
	* Maybe we can drop this thing and replace it by key_item
	*/
	struct key_array {
	KBNODE keyblock;
	};


	/* control information for the trust DB */
	static struct {
	int init;
	int level;
	char *dbname;
	} trustdb_args;

	/* some globals */
	static struct key_item user_utk_list; / temp. used to store --trusted-keys */
	static struct key_item utk_list; / all ultimately trusted keys */

	static int pending_check_trustdb;

	static int validate_keys (int interactive);


	/**********************************************
	*********** some helpers *****************
	**********************************************/

	static struct key_item *
	new_key_item (void)
	{
	struct key_item *k;

	k = xmalloc_clear (sizeof *k);
	return k;
	}

	static void
	release_key_items (struct key_item *k)
	{
	struct key_item *k2;

	for (; k; k = k2)
	{
	k2 = k->next;
	xfree (k->trust_regexp);
	xfree (k);
	}
	}

	/*
	* For fast keylook up we need a hash table. Each byte of a KeyIDs
	* should be distributed equally over the 256 possible values (except
	* for v3 keyIDs but we consider them as not important here). So we
	* can just use 10 bits to index a table of 1024 key items.
	* Possible optimization: Don not use key_items but other hash_table when the
	* duplicates lists gets too large.
	*/
	static KeyHashTable
	new_key_hash_table (void)
	{
	struct key_item **tbl;

	tbl = xmalloc_clear (1024 * sizeof *tbl);
	return tbl;
	}

	static void
	release_key_hash_table (KeyHashTable tbl)
	{
	int i;

	if (!tbl)
	return;
	for (i=0; i < 1024; i++)
	release_key_items (tbl[i]);
	xfree (tbl);
	}

	/*
	* Returns: True if the keyID is in the given hash table
	*/
	static int
	test_key_hash_table (KeyHashTable tbl, u32 *kid)
	{
	struct key_item *k;

	for (k = tbl[(kid[1] & 0x03ff)]; k; k = k->next)
	if (k->kid[0] == kid[0] && k->kid[1] == kid[1])
	return 1;
	return 0;
	}

	/*
	* Add a new key to the hash table. The key is identified by its key ID.
	*/
	static void
	add_key_hash_table (KeyHashTable tbl, u32 *kid)
	{
	struct key_item k, kk;

	for (k = tbl[(kid[1] & 0x03ff)]; k; k = k->next)
	if (k->kid[0] == kid[0] && k->kid[1] == kid[1])
	return; /* already in table */

	kk = new_key_item ();
	kk->kid[0] = kid[0];
	kk->kid[1] = kid[1];
	kk->next = tbl[(kid[1] & 0x03ff)];
	tbl[(kid[1] & 0x03ff)] = kk;
	}

	/*
	* Release a key_array
	*/
	static void
	release_key_array ( struct key_array *keys )
	{
	struct key_array *k;

	if (keys) {
	for (k=keys; k->keyblock; k++)
	release_kbnode (k->keyblock);
	xfree (keys);
	}
	}


	/*********************************************
	******** Initialization ***************
	*********************************************/



	/*
	* Used to register extra ultimately trusted keys - this has to be done
	* before initializing the validation module.
	* FIXME: Should be replaced by a function to add those keys to the trustdb.
	*/
	void
	register_trusted_keyid(u32 *keyid)
	{
	struct key_item *k;

	k = new_key_item ();
	k->kid[0] = keyid[0];
	k->kid[1] = keyid[1];
	k->next = user_utk_list;
	user_utk_list = k;
	}

	void
	register_trusted_key( const char *string )
	{
	KEYDB_SEARCH_DESC desc;

	if (classify_user_id (string, &desc) != KEYDB_SEARCH_MODE_LONG_KID )
	{
	log_error(_("`%s' is not a valid long keyID\n"), string );
	return;
	}

	register_trusted_keyid(desc.u.kid);
	}

	/*
	* Helper to add a key to the global list of ultimately trusted keys.
	* Retruns: true = inserted, false = already in in list.
	*/
	static int
	add_utk (u32 *kid)
	{
	struct key_item *k;

	for (k = utk_list; k; k = k->next)
	{
	if (k->kid[0] == kid[0] && k->kid[1] == kid[1])
	{
	return 0;
	}
	}

	k = new_key_item ();
	k->kid[0] = kid[0];
	k->kid[1] = kid[1];
	k->ownertrust = TRUST_ULTIMATE;
	k->next = utk_list;
	utk_list = k;
	if( opt.verbose > 1 )
	log_info(_("key %s: accepted as trusted key\n"), keystr(kid));
	return 1;
	}


	/****************
	* Verify that all our secret keys are usable and put them into the utk_list.
	*/
	static void
	verify_own_keys(void)
	{
	TRUSTREC rec;
	ulong recnum;
	int rc;
	struct key_item *k;

	if (utk_list)
	return;

	/* scan the trustdb to find all ultimately trusted keys */
	for (recnum=1; !tdbio_read_record (recnum, &rec, 0); recnum++ )
	{
	if ( rec.rectype == RECTYPE_TRUST
	&& (rec.r.trust.ownertrust & TRUST_MASK) == TRUST_ULTIMATE)
	{
	byte *fpr = rec.r.trust.fingerprint;
	int fprlen;
	u32 kid[2];

	/* Problem: We do only use fingerprints in the trustdb but
	* we need the keyID here to indetify the key; we can only
	* use that ugly hack to distinguish between 16 and 20
	* butes fpr - it does not work always so we better change
	* the whole validation code to only work with
	* fingerprints */
	fprlen = (!fpr[16] && !fpr[17] && !fpr[18] && !fpr[19])? 16:20;
	keyid_from_fingerprint (fpr, fprlen, kid);
	if (!add_utk (kid))
	log_info(_("key %s occurs more than once in the trustdb\n"),
	keystr(kid));
	}
	}

	/* Put any --trusted-key keys into the trustdb */
	for (k = user_utk_list; k; k = k->next)
	{
	if ( add_utk (k->kid) )
	{ /* not yet in trustDB as ultimately trusted */
	PKT_public_key pk;

	memset (&pk, 0, sizeof pk);
	rc = get_pubkey (&pk, k->kid);
	if (rc)
	log_info(_("key %s: no public key for trusted key - skipped\n"),
	keystr(k->kid));
	else
	{
	update_ownertrust (&pk,
	((get_ownertrust (&pk) & ~TRUST_MASK)
	\| TRUST_ULTIMATE ));
	release_public_key_parts (&pk);
	}

	log_info (_("key %s marked as ultimately trusted\n"),keystr(k->kid));
	}
	}

	/* release the helper table table */
	release_key_items (user_utk_list);
	user_utk_list = NULL;
	return;
	}


	/*********************************************
	********* TrustDB stuff *****************
	*********************************************/

	/*
	* Read a record but die if it does not exist
	*/
	static void
	read_record (ulong recno, TRUSTREC *rec, int rectype )
	{
	int rc = tdbio_read_record (recno, rec, rectype);
	if (rc)
	{
	log_error(_("trust record %lu, req type %d: read failed: %s\n"),
	recno, rec->rectype, g10_errstr(rc) );
	tdbio_invalid();
	}
	if (rectype != rec->rectype)
	{
	log_error(_("trust record %lu is not of requested type %d\n"),
	rec->recnum, rectype);
	tdbio_invalid();
	}
	}

	/*
	* Write a record and die on error
	*/
	static void
	write_record (TRUSTREC *rec)
	{
	int rc = tdbio_write_record (rec);
	if (rc)
	{
	log_error(_("trust record %lu, type %d: write failed: %s\n"),
	rec->recnum, rec->rectype, g10_errstr(rc) );
	tdbio_invalid();
	}
	}

	/*
	* sync the TrustDb and die on error
	*/
	static void
	do_sync(void)
	{
	int rc = tdbio_sync ();
	if(rc)
	{
	log_error (_("trustdb: sync failed: %s\n"), g10_errstr(rc) );
	g10_exit(2);
	}
	}

	static const char *
	trust_model_string(void)
	{
	switch(opt.trust_model)
	{
	case TM_CLASSIC: return "classic";
	case TM_PGP: return "PGP";
	case TM_EXTERNAL: return "external";
	case TM_ALWAYS: return "always";
	case TM_DIRECT: return "direct";
	default: return "unknown";
	}
	}

	/****************
	* Perform some checks over the trustdb
	* level 0: only open the db
	* 1: used for initial program startup
	*/
	int
	setup_trustdb( int level, const char *dbname )
	{
	/* just store the args */
	if( trustdb_args.init )
	return 0;
	trustdb_args.level = level;
	trustdb_args.dbname = dbname? xstrdup(dbname): NULL;
	return 0;
	}

	void
	how_to_fix_the_trustdb ()
	{
	const char *name = trustdb_args.dbname;

	if (!name)
	name = "trustdb.gpg";

	log_info (_("You may try to re-create the trustdb using the commands:\n"));
	log_info (" cd %s\n", default_homedir ());
	log_info (" gpg2 --export-ownertrust > otrust.tmp\n");
	#ifdef HAVE_W32_SYSTEM
	log_info (" del %s\n", name);
	#else
	log_info (" rm %s\n", name);
	#endif
	log_info (" gpg2 --import-ownertrust < otrust.tmp\n");
	log_info (_("If that does not work, please consult the manual\n"));
	}


	void
	init_trustdb()
	{
	int level = trustdb_args.level;
	const char* dbname = trustdb_args.dbname;

	if( trustdb_args.init )
	return;

	trustdb_args.init = 1;

	if(level==0 \|\| level==1)
	{
	int rc = tdbio_set_dbname( dbname, !!level );
	if( rc )
	log_fatal("can't init trustdb: %s\n", g10_errstr(rc) );
	}
	else
	BUG();

	if(opt.trust_model==TM_AUTO)
	{
	/* Try and set the trust model off of whatever the trustdb says
	it is. */
	opt.trust_model=tdbio_read_model();

	/* Sanity check this ;) */
	if(opt.trust_model!=TM_CLASSIC
	&& opt.trust_model!=TM_PGP
	&& opt.trust_model!=TM_EXTERNAL)
	{
	log_info(_("unable to use unknown trust model (%d) - "
	"assuming %s trust model\n"),opt.trust_model,"PGP");
	opt.trust_model=TM_PGP;
	}

	if(opt.verbose)
	log_info(_("using %s trust model\n"),trust_model_string());
	}

	if(opt.trust_model==TM_PGP \|\| opt.trust_model==TM_CLASSIC)
	{
	/* Verify the list of ultimately trusted keys and move the
	--trusted-keys list there as well. */
	if(level==1)
	verify_own_keys();

	if(!tdbio_db_matches_options())
	pending_check_trustdb=1;
	}
	}


	/***********************************************
	*********** Print helpers **************
	***********************************************/

	/****************
	* This function returns a letter for a trustvalue Trust flags
	* are ignore.
	*/
	static int
	trust_letter (unsigned int value)
	{
	switch( (value & TRUST_MASK) )
	{
	case TRUST_UNKNOWN: return '-';
	case TRUST_EXPIRED: return 'e';
	case TRUST_UNDEFINED: return 'q';
	case TRUST_NEVER: return 'n';
	case TRUST_MARGINAL: return 'm';
	case TRUST_FULLY: return 'f';
	case TRUST_ULTIMATE: return 'u';
	default: return '?';
	}
	}

	-/* NOTE TO TRANSLATOR: these strings are similar to those in
	+const char *
	+uid_trust_string_fixed(PKT_public_key key,PKT_user_id uid)
	+{
	+ if(!key && !uid)
	+/* TRANSLATORS: these strings are similar to those in
	trust_value_to_string(), but are a fixed length. This is needed to
	make attractive information listings where columns line up
	properly. The value "10" should be the length of the strings you
	choose to translate to. This is the length in printable columns.
	It gets passed to atoi() so everything after the number is
	essentially a comment and need not be translated. Either key and
	uid are both NULL, or neither are NULL. */
	-const char *
	-uid_trust_string_fixed(PKT_public_key key,PKT_user_id uid)
	-{
	- if(!key && !uid)
	return _("10 translator see trustdb.c:uid_trust_string_fixed");
	else if(uid->is_revoked \|\| (key && key->is_revoked))
	return _("[ revoked]");
	else if(uid->is_expired)
	return _("[ expired]");
	else if(key)
	switch(get_validity(key,uid)&TRUST_MASK)
	{
	case TRUST_UNKNOWN: return _("[ unknown]");
	case TRUST_EXPIRED: return _("[ expired]");
	case TRUST_UNDEFINED: return _("[ undef ]");
	case TRUST_MARGINAL: return _("[marginal]");
	case TRUST_FULLY: return _("[ full ]");
	case TRUST_ULTIMATE: return _("[ultimate]");
	}

	return "err";
	}

	/* The strings here are similar to those in
	pkclist.c:do_edit_ownertrust() */
	const char *
	trust_value_to_string (unsigned int value)
	{
	switch( (value & TRUST_MASK) )
	{
	case TRUST_UNKNOWN: return _("unknown");
	case TRUST_EXPIRED: return _("expired");
	case TRUST_UNDEFINED: return _("undefined");
	case TRUST_NEVER: return _("never");
	case TRUST_MARGINAL: return _("marginal");
	case TRUST_FULLY: return _("full");
	case TRUST_ULTIMATE: return _("ultimate");
	default: return "err";
	}
	}

	int
	string_to_trust_value (const char *str)
	{
	if(ascii_strcasecmp(str,"undefined")==0)
	return TRUST_UNDEFINED;
	else if(ascii_strcasecmp(str,"never")==0)
	return TRUST_NEVER;
	else if(ascii_strcasecmp(str,"marginal")==0)
	return TRUST_MARGINAL;
	else if(ascii_strcasecmp(str,"full")==0)
	return TRUST_FULLY;
	else if(ascii_strcasecmp(str,"ultimate")==0)
	return TRUST_ULTIMATE;
	else
	return -1;
	}

	/****************
	* Recreate the WoT but do not ask for new ownertrusts. Special
	* feature: In batch mode and without a forced yes, this is only done
	* when a check is due. This can be used to run the check from a crontab
	*/
	void
	check_trustdb ()
	{
	init_trustdb();
	if(opt.trust_model==TM_PGP \|\| opt.trust_model==TM_CLASSIC)
	{
	if (opt.batch && !opt.answer_yes)
	{
	ulong scheduled;

	scheduled = tdbio_read_nextcheck ();
	if (!scheduled)
	{
	log_info (_("no need for a trustdb check\n"));
	return;
	}

	if (scheduled > make_timestamp ())
	{
	log_info (_("next trustdb check due at %s\n"),
	strtimestamp (scheduled));
	return;
	}
	}

	validate_keys (0);
	}
	else
	log_info (_("no need for a trustdb check with `%s' trust model\n"),
	trust_model_string());
	}


	/*
	* Recreate the WoT.
	*/
	void
	update_trustdb()
	{
	init_trustdb();
	if(opt.trust_model==TM_PGP \|\| opt.trust_model==TM_CLASSIC)
	validate_keys (1);
	else
	log_info (_("no need for a trustdb update with `%s' trust model\n"),
	trust_model_string());
	}

	void
	revalidation_mark (void)
	{
	init_trustdb();
	/* we simply set the time for the next check to 1 (far back in 1970)
	* so that a --update-trustdb will be scheduled */
	if (tdbio_write_nextcheck (1))
	do_sync ();
	pending_check_trustdb = 1;
	}

	int
	trustdb_pending_check(void)
	{
	return pending_check_trustdb;
	}

	/* If the trustdb is dirty, and we're interactive, update it.
	Otherwise, check it unless no-auto-check-trustdb is set. */
	void
	trustdb_check_or_update(void)
	{
	if(trustdb_pending_check())
	{
	if(opt.interactive)
	update_trustdb();
	else if(!opt.no_auto_check_trustdb)
	check_trustdb();
	}
	}

	void
	read_trust_options(byte trust_model,ulong created,ulong *nextcheck,
	byte marginals,byte completes,byte *cert_depth,
	byte *min_cert_level)
	{
	TRUSTREC opts;

	init_trustdb();

	read_record(0,&opts,RECTYPE_VER);

	if(trust_model)
	*trust_model=opts.r.ver.trust_model;
	if(created)
	*created=opts.r.ver.created;
	if(nextcheck)
	*nextcheck=opts.r.ver.nextcheck;
	if(marginals)
	*marginals=opts.r.ver.marginals;
	if(completes)
	*completes=opts.r.ver.completes;
	if(cert_depth)
	*cert_depth=opts.r.ver.cert_depth;
	if(min_cert_level)
	*min_cert_level=opts.r.ver.min_cert_level;
	}

	/***********************************************
	********* Ownertrust et al. **************
	***********************************************/

	static int
	read_trust_record (PKT_public_key pk, TRUSTREC rec)
	{
	int rc;

	init_trustdb();
	rc = tdbio_search_trust_bypk (pk, rec);
	if (rc == -1)
	return -1; /* no record yet */
	if (rc)
	{
	log_error ("trustdb: searching trust record failed: %s\n",
	g10_errstr (rc));
	return rc;
	}

	if (rec->rectype != RECTYPE_TRUST)
	{
	log_error ("trustdb: record %lu is not a trust record\n",
	rec->recnum);
	return G10ERR_TRUSTDB;
	}

	return 0;
	}

	/****************
	* Return the assigned ownertrust value for the given public key.
	* The key should be the primary key.
	*/
	unsigned int
	get_ownertrust ( PKT_public_key *pk)
	{
	TRUSTREC rec;
	int rc;

	rc = read_trust_record (pk, &rec);
	if (rc == -1)
	return TRUST_UNKNOWN; /* no record yet */
	if (rc)
	{
	tdbio_invalid ();
	return rc; /* actually never reached */
	}

	return rec.r.trust.ownertrust;
	}

	unsigned int
	get_min_ownertrust (PKT_public_key *pk)
	{
	TRUSTREC rec;
	int rc;

	rc = read_trust_record (pk, &rec);
	if (rc == -1)
	return TRUST_UNKNOWN; /* no record yet */
	if (rc)
	{
	tdbio_invalid ();
	return rc; /* actually never reached */
	}

	return rec.r.trust.min_ownertrust;
	}

	/*
	* Same as get_ownertrust but this takes the minimum ownertrust value
	* into into account, and will bump up the value as needed.
	*/
	static int
	get_ownertrust_with_min (PKT_public_key *pk)
	{
	unsigned int otrust,otrust_min;

	otrust = (get_ownertrust (pk) & TRUST_MASK);
	otrust_min = get_min_ownertrust (pk);
	if(otrust<otrust_min)
	{
	/* If the trust that the user has set is less than the trust
	that was calculated from a trust signature chain, use the
	higher of the two. We do this here and not in
	get_ownertrust since the underlying ownertrust should not
	really be set - just the appearance of the ownertrust. */

	otrust=otrust_min;
	}

	return otrust;
	}

	/*
	* Same as get_ownertrust but return a trust letter instead of an
	* value. This takes the minimum ownertrust value into account.
	*/
	int
	get_ownertrust_info (PKT_public_key *pk)
	{
	return trust_letter(get_ownertrust_with_min(pk));
	}

	/*
	* Same as get_ownertrust but return a trust string instead of an
	* value. This takes the minimum ownertrust value into account.
	*/
	const char *
	get_ownertrust_string (PKT_public_key *pk)
	{
	return trust_value_to_string(get_ownertrust_with_min(pk));
	}

	/*
	* Set the trust value of the given public key to the new value.
	* The key should be a primary one.
	*/
	void
	update_ownertrust (PKT_public_key *pk, unsigned int new_trust )
	{
	TRUSTREC rec;
	int rc;

	rc = read_trust_record (pk, &rec);
	if (!rc)
	{
	if (DBG_TRUST)
	log_debug ("update ownertrust from %u to %u\n",
	(unsigned int)rec.r.trust.ownertrust, new_trust );
	if (rec.r.trust.ownertrust != new_trust)
	{
	rec.r.trust.ownertrust = new_trust;
	write_record( &rec );
	revalidation_mark ();
	do_sync ();
	}
	}
	else if (rc == -1)
	{ /* no record yet - create a new one */
	size_t dummy;

	if (DBG_TRUST)
	log_debug ("insert ownertrust %u\n", new_trust );

	memset (&rec, 0, sizeof rec);
	rec.recnum = tdbio_new_recnum ();
	rec.rectype = RECTYPE_TRUST;
	fingerprint_from_pk (pk, rec.r.trust.fingerprint, &dummy);
	rec.r.trust.ownertrust = new_trust;
	write_record (&rec);
	revalidation_mark ();
	do_sync ();
	rc = 0;
	}
	else
	{
	tdbio_invalid ();
	}
	}

	static void
	update_min_ownertrust (u32 *kid, unsigned int new_trust )
	{
	PKT_public_key *pk;
	TRUSTREC rec;
	int rc;

	pk = xmalloc_clear (sizeof *pk);
	rc = get_pubkey (pk, kid);
	if (rc)
	{
	log_error(_("public key %s not found: %s\n"),keystr(kid),g10_errstr(rc));
	return;
	}

	rc = read_trust_record (pk, &rec);
	if (!rc)
	{
	if (DBG_TRUST)
	log_debug ("key %08lX%08lX: update min_ownertrust from %u to %u\n",
	(ulong)kid[0],(ulong)kid[1],
	(unsigned int)rec.r.trust.min_ownertrust,
	new_trust );
	if (rec.r.trust.min_ownertrust != new_trust)
	{
	rec.r.trust.min_ownertrust = new_trust;
	write_record( &rec );
	revalidation_mark ();
	do_sync ();
	}
	}
	else if (rc == -1)
	{ /* no record yet - create a new one */
	size_t dummy;

	if (DBG_TRUST)
	log_debug ("insert min_ownertrust %u\n", new_trust );

	memset (&rec, 0, sizeof rec);
	rec.recnum = tdbio_new_recnum ();
	rec.rectype = RECTYPE_TRUST;
	fingerprint_from_pk (pk, rec.r.trust.fingerprint, &dummy);
	rec.r.trust.min_ownertrust = new_trust;
	write_record (&rec);
	revalidation_mark ();
	do_sync ();
	rc = 0;
	}
	else
	{
	tdbio_invalid ();
	}
	}

	/* Clear the ownertrust and min_ownertrust values. Return true if a
	change actually happened. */
	int
	clear_ownertrusts (PKT_public_key *pk)
	{
	TRUSTREC rec;
	int rc;

	rc = read_trust_record (pk, &rec);
	if (!rc)
	{
	if (DBG_TRUST)
	{
	log_debug ("clearing ownertrust (old value %u)\n",
	(unsigned int)rec.r.trust.ownertrust);
	log_debug ("clearing min_ownertrust (old value %u)\n",
	(unsigned int)rec.r.trust.min_ownertrust);
	}
	if (rec.r.trust.ownertrust \|\| rec.r.trust.min_ownertrust)
	{
	rec.r.trust.ownertrust = 0;
	rec.r.trust.min_ownertrust = 0;
	write_record( &rec );
	revalidation_mark ();
	do_sync ();
	return 1;
	}
	}
	else if (rc != -1)
	{
	tdbio_invalid ();
	}
	return 0;
	}

	/*
	* Note: Caller has to do a sync
	*/
	static void
	update_validity (PKT_public_key pk, PKT_user_id uid,
	int depth, int validity)
	{
	TRUSTREC trec, vrec;
	int rc;
	ulong recno;

	namehash_from_uid(uid);

	rc = read_trust_record (pk, &trec);
	if (rc && rc != -1)
	{
	tdbio_invalid ();
	return;
	}
	if (rc == -1) /* no record yet - create a new one */
	{
	size_t dummy;

	rc = 0;
	memset (&trec, 0, sizeof trec);
	trec.recnum = tdbio_new_recnum ();
	trec.rectype = RECTYPE_TRUST;
	fingerprint_from_pk (pk, trec.r.trust.fingerprint, &dummy);
	trec.r.trust.ownertrust = 0;
	}

	/* locate an existing one */
	recno = trec.r.trust.validlist;
	while (recno)
	{
	read_record (recno, &vrec, RECTYPE_VALID);
	if ( !memcmp (vrec.r.valid.namehash, uid->namehash, 20) )
	break;
	recno = vrec.r.valid.next;
	}

	if (!recno) /* insert a new validity record */
	{
	memset (&vrec, 0, sizeof vrec);
	vrec.recnum = tdbio_new_recnum ();
	vrec.rectype = RECTYPE_VALID;
	memcpy (vrec.r.valid.namehash, uid->namehash, 20);
	vrec.r.valid.next = trec.r.trust.validlist;
	trec.r.trust.validlist = vrec.recnum;
	}
	vrec.r.valid.validity = validity;
	vrec.r.valid.full_count = uid->help_full_count;
	vrec.r.valid.marginal_count = uid->help_marginal_count;
	write_record (&vrec);
	trec.r.trust.depth = depth;
	write_record (&trec);
	}


	/***********************************************
	******* Query trustdb values ************
	***********************************************/

	/* Return true if key is disabled */
	int
	cache_disabled_value(PKT_public_key *pk)
	{
	int rc;
	TRUSTREC trec;
	int disabled=0;

	if(pk->is_disabled)
	return (pk->is_disabled==2);

	init_trustdb();

	rc = read_trust_record (pk, &trec);
	if (rc && rc != -1)
	{
	tdbio_invalid ();
	goto leave;
	}
	if (rc == -1) /* no record found, so assume not disabled */
	goto leave;

	if(trec.r.trust.ownertrust & TRUST_FLAG_DISABLED)
	disabled=1;

	/* Cache it for later so we don't need to look at the trustdb every
	time */
	if(disabled)
	pk->is_disabled=2;
	else
	pk->is_disabled=1;

	leave:
	return disabled;
	}

	void
	check_trustdb_stale(void)
	{
	static int did_nextcheck=0;

	init_trustdb ();
	if (!did_nextcheck
	&& (opt.trust_model==TM_PGP \|\| opt.trust_model==TM_CLASSIC))
	{
	ulong scheduled;

	did_nextcheck = 1;
	scheduled = tdbio_read_nextcheck ();
	if ((scheduled && scheduled <= make_timestamp ())
	\|\| pending_check_trustdb)
	{
	if (opt.no_auto_check_trustdb)
	{
	pending_check_trustdb = 1;
	log_info (_("please do a --check-trustdb\n"));
	}
	else
	{
	log_info (_("checking the trustdb\n"));
	validate_keys (0);
	}
	}
	}
	}

	/*
	* Return the validity information for PK. If the namehash is not
	* NULL, the validity of the corresponsing user ID is returned,
	* otherwise, a reasonable value for the entire key is returned.
	*/
	unsigned int
	get_validity (PKT_public_key pk, PKT_user_id uid)
	{
	TRUSTREC trec, vrec;
	int rc;
	ulong recno;
	unsigned int validity;
	u32 kid[2];
	PKT_public_key *main_pk;

	if(uid)
	namehash_from_uid(uid);

	init_trustdb ();
	check_trustdb_stale();

	keyid_from_pk (pk, kid);
	if (pk->main_keyid[0] != kid[0] \|\| pk->main_keyid[1] != kid[1])
	{ /* this is a subkey - get the mainkey */
	main_pk = xmalloc_clear (sizeof *main_pk);
	rc = get_pubkey (main_pk, pk->main_keyid);
	if (rc)
	{
	char *tempkeystr=xstrdup(keystr(pk->main_keyid));
	log_error ("error getting main key %s of subkey %s: %s\n",
	tempkeystr, keystr(kid), g10_errstr(rc));
	xfree(tempkeystr);
	validity = TRUST_UNKNOWN;
	goto leave;
	}
	}
	else
	main_pk = pk;

	if(opt.trust_model==TM_DIRECT)
	{
	/* Note that this happens BEFORE any user ID stuff is checked.
	The direct trust model applies to keys as a whole. */
	validity=get_ownertrust(main_pk);
	goto leave;
	}

	rc = read_trust_record (main_pk, &trec);
	if (rc && rc != -1)
	{
	tdbio_invalid ();
	return 0;
	}
	if (rc == -1) /* no record found */
	{
	validity = TRUST_UNKNOWN;
	goto leave;
	}

	/* loop over all user IDs */
	recno = trec.r.trust.validlist;
	validity = 0;
	while (recno)
	{
	read_record (recno, &vrec, RECTYPE_VALID);

	if(uid)
	{
	/* If a user ID is given we return the validity for that
	user ID ONLY. If the namehash is not found, then there
	is no validity at all (i.e. the user ID wasn't
	signed). */
	if(memcmp(vrec.r.valid.namehash,uid->namehash,20)==0)
	{
	validity=(vrec.r.valid.validity & TRUST_MASK);
	break;
	}
	}
	else
	{
	/* If no namehash is given, we take the maximum validity
	over all user IDs */
	if ( validity < (vrec.r.valid.validity & TRUST_MASK) )
	validity = (vrec.r.valid.validity & TRUST_MASK);
	}

	recno = vrec.r.valid.next;
	}

	if ( (trec.r.trust.ownertrust & TRUST_FLAG_DISABLED) )
	{
	validity \|= TRUST_FLAG_DISABLED;
	pk->is_disabled=2;
	}
	else
	pk->is_disabled=1;

	leave:
	/* set some flags direct from the key */
	if (main_pk->is_revoked)
	validity \|= TRUST_FLAG_REVOKED;
	if (main_pk != pk && pk->is_revoked)
	validity \|= TRUST_FLAG_SUB_REVOKED;
	/* Note: expiration is a trust value and not a flag - don't know why
	* I initially designed it that way */
	if (main_pk->has_expired \|\| pk->has_expired)
	validity = (validity & ~TRUST_MASK) \| TRUST_EXPIRED;

	if (pending_check_trustdb)
	validity \|= TRUST_FLAG_PENDING_CHECK;

	if (main_pk != pk)
	free_public_key (main_pk);
	return validity;
	}

	int
	get_validity_info (PKT_public_key pk, PKT_user_id uid)
	{
	int trustlevel;

	if (!pk)
	return '?'; /* Just in case a NULL PK is passed. */

	trustlevel = get_validity (pk, uid);
	if( trustlevel & TRUST_FLAG_REVOKED )
	return 'r';
	return trust_letter ( trustlevel );
	}

	const char *
	get_validity_string (PKT_public_key pk, PKT_user_id uid)
	{
	int trustlevel;

	if (!pk)
	return "err"; /* Just in case a NULL PK is passed. */

	trustlevel = get_validity (pk, uid);
	if( trustlevel & TRUST_FLAG_REVOKED )
	return _("revoked");
	return trust_value_to_string(trustlevel);
	}

	static void
	get_validity_counts (PKT_public_key pk, PKT_user_id uid)
	{
	TRUSTREC trec, vrec;
	ulong recno;

	if(pk==NULL \|\| uid==NULL)
	BUG();

	namehash_from_uid(uid);

	uid->help_marginal_count=uid->help_full_count=0;

	init_trustdb ();

	if(read_trust_record (pk, &trec)!=0)
	return;

	/* loop over all user IDs */
	recno = trec.r.trust.validlist;
	while (recno)
	{
	read_record (recno, &vrec, RECTYPE_VALID);

	if(memcmp(vrec.r.valid.namehash,uid->namehash,20)==0)
	{
	uid->help_marginal_count=vrec.r.valid.marginal_count;
	uid->help_full_count=vrec.r.valid.full_count;
	/* printf("Fetched marginal %d, full %d\n",uid->help_marginal_count,uid->help_full_count); */
	break;
	}

	recno = vrec.r.valid.next;
	}
	}

	void
	list_trust_path( const char *username )
	{
	}

	/****************
	* Enumerate all keys, which are needed to build all trust paths for
	* the given key. This function does not return the key itself or
	* the ultimate key (the last point in cerificate chain). Only
	* certificate chains which ends up at an ultimately trusted key
	* are listed. If ownertrust or validity is not NULL, the corresponding
	* value for the returned LID is also returned in these variable(s).
	*
	* 1) create a void pointer and initialize it to NULL
	* 2) pass this void pointer by reference to this function.
	* Set lid to the key you want to enumerate and pass it by reference.
	* 3) call this function as long as it does not return -1
	* to indicate EOF. LID does contain the next key used to build the web
	* 4) Always call this function a last time with LID set to NULL,
	* so that it can free its context.
	*
	* Returns: -1 on EOF or the level of the returned LID
	*/
	int
	enum_cert_paths( void *context, ulong lid,
	unsigned ownertrust, unsigned validity )
	{
	return -1;
	}


	/****************
	* Print the current path
	*/
	void
	enum_cert_paths_print( void *context, FILE fp,
	int refresh, ulong selected_lid )
	{
	return;
	}



	/****************************************
	********* NEW NEW NEW **************
	****************************************/

	static int
	ask_ownertrust (u32 *kid,int minimum)
	{
	PKT_public_key *pk;
	int rc;
	int ot;

	pk = xmalloc_clear (sizeof *pk);
	rc = get_pubkey (pk, kid);
	if (rc)
	{
	log_error (_("public key %s not found: %s\n"),
	keystr(kid), g10_errstr(rc) );
	return TRUST_UNKNOWN;
	}

	if(opt.force_ownertrust)
	{
	log_info("force trust for key %s to %s\n",
	keystr(kid),trust_value_to_string(opt.force_ownertrust));
	update_ownertrust(pk,opt.force_ownertrust);
	ot=opt.force_ownertrust;
	}
	else
	{
	ot=edit_ownertrust(pk,0);
	if(ot>0)
	ot = get_ownertrust (pk);
	else if(ot==0)
	ot = minimum?minimum:TRUST_UNDEFINED;
	else
	ot = -1; /* quit */
	}

	free_public_key( pk );

	return ot;
	}


	static void
	mark_keyblock_seen (KeyHashTable tbl, KBNODE node)
	{
	for ( ;node; node = node->next )
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	u32 aki[2];

	keyid_from_pk (node->pkt->pkt.public_key, aki);
	add_key_hash_table (tbl, aki);
	}
	}


	static void
	dump_key_array (int depth, struct key_array *keys)
	{
	struct key_array *kar;

	for (kar=keys; kar->keyblock; kar++)
	{
	KBNODE node = kar->keyblock;
	u32 kid[2];

	keyid_from_pk(node->pkt->pkt.public_key, kid);
	printf ("%d:%08lX%08lX:K::%c::::\n",
	depth, (ulong)kid[0], (ulong)kid[1], '?');

	for (; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	int len = node->pkt->pkt.user_id->len;

	if (len > 30)
	len = 30;
	printf ("%d:%08lX%08lX:U:::%c:::",
	depth, (ulong)kid[0], (ulong)kid[1],
	(node->flag & 4)? 'f':
	(node->flag & 2)? 'm':
	(node->flag & 1)? 'q':'-');
	print_string (stdout, node->pkt->pkt.user_id->name, len, ':');
	putchar (':');
	putchar ('\n');
	}
	}
	}
	}


	static void
	store_validation_status (int depth, KBNODE keyblock, KeyHashTable stored)
	{
	KBNODE node;
	int status;
	int any = 0;

	for (node=keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;
	if (node->flag & 4)
	status = TRUST_FULLY;
	else if (node->flag & 2)
	status = TRUST_MARGINAL;
	else if (node->flag & 1)
	status = TRUST_UNDEFINED;
	else
	status = 0;

	if (status)
	{
	update_validity (keyblock->pkt->pkt.public_key,
	uid, depth, status);

	mark_keyblock_seen(stored,keyblock);

	any = 1;
	}
	}
	}

	if (any)
	do_sync ();
	}

	/*
	* check whether the signature sig is in the klist k
	*/
	static struct key_item *
	is_in_klist (struct key_item k, PKT_signature sig)
	{
	for (; k; k = k->next)
	{
	if (k->kid[0] == sig->keyid[0] && k->kid[1] == sig->keyid[1])
	return k;
	}
	return NULL;
	}

	/*
	* Mark the signature of the given UID which are used to certify it.
	* To do this, we first revmove all signatures which are not valid and
	* from the remain ones we look for the latest one. If this is not a
	* certification revocation signature we mark the signature by setting
	* node flag bit 8. Revocations are marked with flag 11, and sigs
	* from unavailable keys are marked with flag 12. Note that flag bits
	* 9 and 10 are used for internal purposes.
	*/
	static void
	mark_usable_uid_certs (KBNODE keyblock, KBNODE uidnode,
	u32 main_kid, struct key_item klist,
	u32 curtime, u32 *next_expire)
	{
	KBNODE node;
	PKT_signature *sig;

	/* first check all signatures */
	for (node=uidnode->next; node; node = node->next)
	{
	int rc;

	node->flag &= ~(1<<8 \| 1<<9 \| 1<<10 \| 1<<11 \| 1<<12);
	if (node->pkt->pkttype == PKT_USER_ID
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	break; /* ready */
	if (node->pkt->pkttype != PKT_SIGNATURE)
	continue;
	sig = node->pkt->pkt.signature;
	if (main_kid
	&& sig->keyid[0] == main_kid[0] && sig->keyid[1] == main_kid[1])
	continue; /* ignore self-signatures if we pass in a main_kid */
	if (!IS_UID_SIG(sig) && !IS_UID_REV(sig))
	continue; /* we only look at these signature classes */
	if(sig->sig_class>=0x11 && sig->sig_class<=0x13 &&
	sig->sig_class-0x10<opt.min_cert_level)
	continue; /* treat anything under our min_cert_level as an
	invalid signature */
	if (klist && !is_in_klist (klist, sig))
	continue; /* no need to check it then */
	if ((rc=check_key_signature (keyblock, node, NULL)))
	{
	/* we ignore anything that won't verify, but tag the
	no_pubkey case */
	if(rc==G10ERR_NO_PUBKEY)
	node->flag \|= 1<<12;
	continue;
	}
	node->flag \|= 1<<9;
	}
	/* reset the remaining flags */
	for (; node; node = node->next)
	node->flag &= ~(1<<8 \| 1<<9 \| 1<<10 \| 1<<11 \| 1<<12);

	/* kbnode flag usage: bit 9 is here set for signatures to consider,
	* bit 10 will be set by the loop to keep track of keyIDs already
	* processed, bit 8 will be set for the usable signatures, and bit
	* 11 will be set for usable revocations. */

	/* for each cert figure out the latest valid one */
	for (node=uidnode->next; node; node = node->next)
	{
	KBNODE n, signode;
	u32 kid[2];
	u32 sigdate;

	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	break;
	if ( !(node->flag & (1<<9)) )
	continue; /* not a node to look at */
	if ( (node->flag & (1<<10)) )
	continue; /* signature with a keyID already processed */
	node->flag \|= (1<<10); /* mark this node as processed */
	sig = node->pkt->pkt.signature;
	signode = node;
	sigdate = sig->timestamp;
	kid[0] = sig->keyid[0]; kid[1] = sig->keyid[1];

	/* Now find the latest and greatest signature */
	for (n=uidnode->next; n; n = n->next)
	{
	if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	break;
	if ( !(n->flag & (1<<9)) )
	continue;
	if ( (n->flag & (1<<10)) )
	continue; /* shortcut already processed signatures */
	sig = n->pkt->pkt.signature;
	if (kid[0] != sig->keyid[0] \|\| kid[1] != sig->keyid[1])
	continue;
	n->flag \|= (1<<10); /* mark this node as processed */

	/* If signode is nonrevocable and unexpired and n isn't,
	then take signode (skip). It doesn't matter which is
	older: if signode was older then we don't want to take n
	as signode is nonrevocable. If n was older then we're
	automatically fine. */

	if(((IS_UID_SIG(signode->pkt->pkt.signature) &&
	!signode->pkt->pkt.signature->flags.revocable &&
	(signode->pkt->pkt.signature->expiredate==0 \|\|
	signode->pkt->pkt.signature->expiredate>curtime))) &&
	(!(IS_UID_SIG(n->pkt->pkt.signature) &&
	!n->pkt->pkt.signature->flags.revocable &&
	(n->pkt->pkt.signature->expiredate==0 \|\|
	n->pkt->pkt.signature->expiredate>curtime))))
	continue;

	/* If n is nonrevocable and unexpired and signode isn't,
	then take n. Again, it doesn't matter which is older: if
	n was older then we don't want to take signode as n is
	nonrevocable. If signode was older then we're
	automatically fine. */

	if((!(IS_UID_SIG(signode->pkt->pkt.signature) &&
	!signode->pkt->pkt.signature->flags.revocable &&
	(signode->pkt->pkt.signature->expiredate==0 \|\|
	signode->pkt->pkt.signature->expiredate>curtime))) &&
	((IS_UID_SIG(n->pkt->pkt.signature) &&
	!n->pkt->pkt.signature->flags.revocable &&
	(n->pkt->pkt.signature->expiredate==0 \|\|
	n->pkt->pkt.signature->expiredate>curtime))))
	{
	signode = n;
	sigdate = sig->timestamp;
	continue;
	}

	/* At this point, if it's newer, it goes in as the only
	remaining possibilities are signode and n are both either
	revocable or expired or both nonrevocable and unexpired.
	If the timestamps are equal take the later ordered
	packet, presuming that the key packets are hopefully in
	their original order. */

	if (sig->timestamp >= sigdate)
	{
	signode = n;
	sigdate = sig->timestamp;
	}
	}

	sig = signode->pkt->pkt.signature;
	if (IS_UID_SIG (sig))
	{ /* this seems to be a usable one which is not revoked.
	* Just need to check whether there is an expiration time,
	* We do the expired certification after finding a suitable
	* certification, the assumption is that a signator does not
	* want that after the expiration of his certificate the
	* system falls back to an older certification which has a
	* different expiration time */
	const byte *p;
	u32 expire;

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_SIG_EXPIRE, NULL );
	expire = p? sig->timestamp + buffer_to_u32(p) : 0;

	if (expire==0 \|\| expire > curtime )
	{
	signode->flag \|= (1<<8); /* yeah, found a good cert */
	if (next_expire && expire && expire < *next_expire)
	*next_expire = expire;
	}
	}
	else
	signode->flag \|= (1<<11);
	}
	}

	static int
	clean_sigs_from_uid(KBNODE keyblock,KBNODE uidnode,int noisy,int self_only)
	{
	int deleted=0;
	KBNODE node;
	u32 keyid[2];

	assert(keyblock->pkt->pkttype==PKT_PUBLIC_KEY);

	keyid_from_pk(keyblock->pkt->pkt.public_key,keyid);

	/* Passing in a 0 for current time here means that we'll never weed
	out an expired sig. This is correct behavior since we want to
	keep the most recent expired sig in a series. */
	mark_usable_uid_certs(keyblock,uidnode,NULL,NULL,0,NULL);

	/* What we want to do here is remove signatures that are not
	considered as part of the trust calculations. Thus, all invalid
	signatures are out, as are any signatures that aren't the last of
	a series of uid sigs or revocations It breaks down like this:
	coming out of mark_usable_uid_certs, if a sig is unflagged, it is
	not even a candidate. If a sig has flag 9 or 10, that means it
	was selected as a candidate and vetted. If a sig has flag 8 it
	is a usable signature. If a sig has flag 11 it is a usable
	revocation. If a sig has flag 12 it was issued by an unavailable
	key. "Usable" here means the most recent valid
	signature/revocation in a series from a particular signer.

	Delete everything that isn't a usable uid sig (which might be
	expired), a usable revocation, or a sig from an unavailable
	key. */

	for(node=uidnode->next;
	node && node->pkt->pkttype==PKT_SIGNATURE;
	node=node->next)
	{
	int keep=self_only?(node->pkt->pkt.signature->keyid[0]==keyid[0]
	&& node->pkt->pkt.signature->keyid[1]==keyid[1]):1;

	/* Keep usable uid sigs ... */
	if((node->flag & (1<<8)) && keep)
	continue;

	/* ... and usable revocations... */
	if((node->flag & (1<<11)) && keep)
	continue;

	/* ... and sigs from unavailable keys. */
	/* disabled for now since more people seem to want sigs from
	unavailable keys removed altogether. */
	/*
	if(node->flag & (1<<12))
	continue;
	*/

	/* Everything else we delete */

	/* At this point, if 12 is set, the signing key was unavailable.
	If 9 or 10 is set, it's superseded. Otherwise, it's
	invalid. */

	if(noisy)
	log_info("removing signature from key %s on user ID \"%s\": %s\n",
	keystr(node->pkt->pkt.signature->keyid),
	uidnode->pkt->pkt.user_id->name,
	node->flag&(1<<12)?"key unavailable":
	node->flag&(1<<9)?"signature superseded":"invalid signature");

	delete_kbnode(node);
	deleted++;
	}

	return deleted;
	}

	/* This is substantially easier than clean_sigs_from_uid since we just
	have to establish if the uid has a valid self-sig, is not revoked,
	and is not expired. Note that this does not take into account
	whether the uid has a trust path to it - just whether the keyholder
	themselves has certified the uid. Returns true if the uid was
	compacted. To "compact" a user ID, we simply remove ALL signatures
	except the self-sig that caused the user ID to be remove-worthy.
	We don't actually remove the user ID packet itself since it might
	be ressurected in a later merge. Note that this function requires
	that the caller has already done a merge_keys_and_selfsig().

	TODO: change the import code to allow importing a uid with only a
	revocation if the uid already exists on the keyring. */

	static int
	clean_uid_from_key(KBNODE keyblock,KBNODE uidnode,int noisy)
	{
	KBNODE node;
	PKT_user_id *uid=uidnode->pkt->pkt.user_id;
	int deleted=0;

	assert(keyblock->pkt->pkttype==PKT_PUBLIC_KEY);
	assert(uidnode->pkt->pkttype==PKT_USER_ID);

	/* Skip valid user IDs, compacted user IDs, and non-self-signed user
	IDs if --allow-non-selfsigned-uid is set. */
	if(uid->created \|\| uid->flags.compacted
	\|\| (!uid->is_expired && !uid->is_revoked
	&& opt.allow_non_selfsigned_uid))
	return 0;

	for(node=uidnode->next;
	node && node->pkt->pkttype==PKT_SIGNATURE;
	node=node->next)
	if(!node->pkt->pkt.signature->flags.chosen_selfsig)
	{
	delete_kbnode(node);
	deleted=1;
	uidnode->pkt->pkt.user_id->flags.compacted=1;
	}

	if(noisy)
	{
	const char *reason;
	char *user=utf8_to_native(uid->name,uid->len,0);

	if(uid->is_revoked)
	reason=_("revoked");
	else if(uid->is_expired)
	reason=_("expired");
	else
	reason=_("invalid");

	log_info("compacting user ID \"%s\" on key %s: %s\n",
	user,keystr_from_pk(keyblock->pkt->pkt.public_key),
	reason);

	xfree(user);
	}

	return deleted;
	}

	/* Needs to be called after a merge_keys_and_selfsig() */
	void
	clean_one_uid(KBNODE keyblock,KBNODE uidnode,int noisy,int self_only,
	int uids_cleaned,int sigs_cleaned)
	{
	int dummy;

	assert(keyblock->pkt->pkttype==PKT_PUBLIC_KEY);
	assert(uidnode->pkt->pkttype==PKT_USER_ID);

	if(!uids_cleaned)
	uids_cleaned=&dummy;

	if(!sigs_cleaned)
	sigs_cleaned=&dummy;

	/* Do clean_uid_from_key first since if it fires off, we don't
	have to bother with the other */
	*uids_cleaned+=clean_uid_from_key(keyblock,uidnode,noisy);
	if(!uidnode->pkt->pkt.user_id->flags.compacted)
	*sigs_cleaned+=clean_sigs_from_uid(keyblock,uidnode,noisy,self_only);
	}

	void
	clean_key(KBNODE keyblock,int noisy,int self_only,
	int uids_cleaned,int sigs_cleaned)
	{
	KBNODE uidnode;

	merge_keys_and_selfsig(keyblock);

	for(uidnode=keyblock->next;
	uidnode && uidnode->pkt->pkttype!=PKT_PUBLIC_SUBKEY;
	uidnode=uidnode->next)
	if(uidnode->pkt->pkttype==PKT_USER_ID)
	clean_one_uid(keyblock,uidnode,noisy,self_only,
	uids_cleaned,sigs_cleaned);
	}

	/* Returns a sanitized copy of the regexp (which might be "", but not
	NULL). */
	static char *
	sanitize_regexp(const char *old)
	{
	size_t start=0,len=strlen(old),idx=0;
	int escaped=0,standard_bracket=0;
	char new=xmalloc((len2)+1); /* enough to \-escape everything if we
	have to */

	/* There are basically two commonly-used regexps here. GPG and most
	versions of PGP use "<[^>]+[@.]example\.com>$" and PGP (9)
	command line uses "example.com" (i.e. whatever the user specfies,
	and we can't expect users know to use "\." instead of "."). So
	here are the rules: we're allowed to start with "<[^>]+[@.]" and
	end with ">$" or start and end with nothing. In between, the
	only legal regex character is ".", and everything else gets
	escaped. Part of the gotcha here is that some regex packages
	allow more than RFC-4880 requires. For example, 4880 has no "{}"
	operator, but GNU regex does. Commenting removes these operators
	from consideration. A possible future enhancement is to use
	commenting to effectively back off a given regex to the Henry
	Spencer syntax in 4880. -dshaw */

	/* Are we bracketed between "<[^>]+[@.]" and ">$" ? */
	if(len>=12 && strncmp(old,"<[^>]+[@.]",10)==0
	&& old[len-2]=='>' && old[len-1]=='$')
	{
	strcpy(new,"<[^>]+[@.]");
	idx=strlen(new);
	standard_bracket=1;
	start+=10;
	len-=2;
	}

	/* Walk the remaining characters and ensure that everything that is
	left is not an operational regex character. */
	for(;start<len;start++)
	{
	if(!escaped && old[start]=='\\')
	escaped=1;
	else if(!escaped && old[start]!='.')
	new[idx++]='\\';
	else
	escaped=0;

	new[idx++]=old[start];
	}

	new[idx]='\0';

	/* Note that the (sub)string we look at might end with a bare "\".
	If it does, leave it that way. If the regexp actually ended with
	">$", then it was escaping the ">" and is fine. If the regexp
	actually ended with the bare "\", then it's an illegal regexp and
	regcomp should kick it out. */

	if(standard_bracket)
	strcat(new,">$");

	return new;
	}

	/* Used by validate_one_keyblock to confirm a regexp within a trust
	signature. Returns 1 for match, and 0 for no match or regex
	error. */
	static int
	check_regexp(const char expr,const char string)
	{
	#ifdef DISABLE_REGEX
	/* When DISABLE_REGEX is defined, assume all regexps do not
	match. */
	return 0;
	#else
	int ret;
	char *regexp;

	regexp=sanitize_regexp(expr);

	#ifdef __riscos__
	ret=riscos_check_regexp(expr, string, DBG_TRUST);
	#else
	{
	regex_t pat;

	ret=regcomp(&pat,regexp,REG_ICASE\|REG_NOSUB\|REG_EXTENDED);
	if(ret==0)
	{
	ret=regexec(&pat,string,0,NULL,0);
	regfree(&pat);
	ret=(ret==0);
	}
	}
	#endif

	if(DBG_TRUST)
	log_debug("regexp `%s' (`%s') on `%s': %s\n",
	regexp,expr,string,ret==0?"YES":"NO");

	xfree(regexp);

	return ret;
	#endif
	}

	/*
	* Return true if the key is signed by one of the keys in the given
	* key ID list. User IDs with a valid signature are marked by node
	* flags as follows:
	* flag bit 0: There is at least one signature
	* 1: There is marginal confidence that this is a legitimate uid
	* 2: There is full confidence that this is a legitimate uid.
	* 8: Used for internal purposes.
	* 9: Ditto (in mark_usable_uid_certs())
	* 10: Ditto (ditto)
	* This function assumes that all kbnode flags are cleared on entry.
	*/
	static int
	validate_one_keyblock (KBNODE kb, struct key_item *klist,
	u32 curtime, u32 *next_expire)
	{
	struct key_item *kr;
	KBNODE node, uidnode=NULL;
	PKT_user_id *uid=NULL;
	PKT_public_key *pk = kb->pkt->pkt.public_key;
	u32 main_kid[2];
	int issigned=0, any_signed = 0;

	keyid_from_pk(pk, main_kid);
	for (node=kb; node; node = node->next)
	{
	/* A bit of discussion here: is it better for the web of trust
	to be built among only self-signed uids? On the one hand, a
	self-signed uid is a statement that the key owner definitely
	intended that uid to be there, but on the other hand, a
	signed (but not self-signed) uid does carry trust, of a sort,
	even if it is a statement being made by people other than the
	key owner "through" the uids on the key owner's key. I'm
	going with the latter. However, if the user ID was
	explicitly revoked, or passively allowed to expire, that
	should stop validity through the user ID until it is
	resigned. -dshaw */

	if (node->pkt->pkttype == PKT_USER_ID
	&& !node->pkt->pkt.user_id->is_revoked
	&& !node->pkt->pkt.user_id->is_expired)
	{
	if (uidnode && issigned)
	{
	if (uid->help_full_count >= opt.completes_needed
	\|\| uid->help_marginal_count >= opt.marginals_needed )
	uidnode->flag \|= 4;
	else if (uid->help_full_count \|\| uid->help_marginal_count)
	uidnode->flag \|= 2;
	uidnode->flag \|= 1;
	any_signed = 1;
	}
	uidnode = node;
	uid=uidnode->pkt->pkt.user_id;

	/* If the selfsig is going to expire... */
	if(uid->expiredate && uid->expiredate<*next_expire)
	*next_expire = uid->expiredate;

	issigned = 0;
	get_validity_counts(pk,uid);
	mark_usable_uid_certs (kb, uidnode, main_kid, klist,
	curtime, next_expire);
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& (node->flag & (1<<8)) && uid)
	{
	/* Note that we are only seeing unrevoked sigs here */
	PKT_signature *sig = node->pkt->pkt.signature;

	kr = is_in_klist (klist, sig);
	/* If the trust_regexp does not match, it's as if the sig
	did not exist. This is safe for non-trust sigs as well
	since we don't accept a regexp on the sig unless it's a
	trust sig. */
	if (kr && (kr->trust_regexp==NULL \|\| opt.trust_model!=TM_PGP \|\|
	(uidnode && check_regexp(kr->trust_regexp,
	uidnode->pkt->pkt.user_id->name))))
	{
	/* Are we part of a trust sig chain? We always favor
	the latest trust sig, rather than the greater or
	lesser trust sig or value. I could make a decent
	argument for any of these cases, but this seems to be
	what PGP does, and I'd like to be compatible. -dms */
	if(opt.trust_model==TM_PGP
	&& sig->trust_depth
	&& pk->trust_timestamp<=sig->timestamp)
	{
	byte depth;

	/* If the depth on the signature is less than the
	chain currently has, then use the signature depth
	so we don't increase the depth beyond what the
	signer wanted. If the depth on the signature is
	more than the chain currently has, then use the
	chain depth so we use as much of the signature
	depth as the chain will permit. An ultimately
	trusted signature can restart the depth to
	whatever level it likes. */

	if(sig->trust_depth<kr->trust_depth
	\|\| kr->ownertrust==TRUST_ULTIMATE)
	depth=sig->trust_depth;
	else
	depth=kr->trust_depth;

	if(depth)
	{
	if(DBG_TRUST)
	log_debug("trust sig on %s, sig depth is %d,"
	" kr depth is %d\n",
	uidnode->pkt->pkt.user_id->name,
	sig->trust_depth,
	kr->trust_depth);

	/* If we got here, we know that:

	this is a trust sig.

	it's a newer trust sig than any previous trust
	sig on this key (not uid).

	it is legal in that it was either generated by an
	ultimate key, or a key that was part of a trust
	chain, and the depth does not violate the
	original trust sig.

	if there is a regexp attached, it matched
	successfully.
	*/

	if(DBG_TRUST)
	log_debug("replacing trust value %d with %d and "
	"depth %d with %d\n",
	pk->trust_value,sig->trust_value,
	pk->trust_depth,depth);

	pk->trust_value=sig->trust_value;
	pk->trust_depth=depth-1;

	/* If the trust sig contains a regexp, record it
	on the pk for the next round. */
	if(sig->trust_regexp)
	pk->trust_regexp=sig->trust_regexp;
	}
	}

	if (kr->ownertrust == TRUST_ULTIMATE)
	uid->help_full_count = opt.completes_needed;
	else if (kr->ownertrust == TRUST_FULLY)
	uid->help_full_count++;
	else if (kr->ownertrust == TRUST_MARGINAL)
	uid->help_marginal_count++;
	issigned = 1;
	}
	}
	}

	if (uidnode && issigned)
	{
	if (uid->help_full_count >= opt.completes_needed
	\|\| uid->help_marginal_count >= opt.marginals_needed )
	uidnode->flag \|= 4;
	else if (uid->help_full_count \|\| uid->help_marginal_count)
	uidnode->flag \|= 2;
	uidnode->flag \|= 1;
	any_signed = 1;
	}

	return any_signed;
	}


	static int
	search_skipfnc (void opaque, u32 kid, PKT_user_id *dummy)
	{
	return test_key_hash_table ((KeyHashTable)opaque, kid);
	}


	/*
	* Scan all keys and return a key_array of all suitable keys from
	* kllist. The caller has to pass keydb handle so that we don't use
	* to create our own. Returns either a key_array or NULL in case of
	* an error. No results found are indicated by an empty array.
	* Caller hast to release the returned array.
	*/
	static struct key_array *
	validate_key_list (KEYDB_HANDLE hd, KeyHashTable full_trust,
	struct key_item klist, u32 curtime, u32 next_expire)
	{
	KBNODE keyblock = NULL;
	struct key_array *keys = NULL;
	size_t nkeys, maxkeys;
	int rc;
	KEYDB_SEARCH_DESC desc;

	maxkeys = 1000;
	keys = xmalloc ((maxkeys+1) * sizeof *keys);
	nkeys = 0;

	rc = keydb_search_reset (hd);
	if (rc)
	{
	log_error ("keydb_search_reset failed: %s\n", g10_errstr(rc));
	xfree (keys);
	return NULL;
	}

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_FIRST;
	desc.skipfnc = search_skipfnc;
	desc.skipfncvalue = full_trust;
	rc = keydb_search (hd, &desc, 1);
	if (rc == -1)
	{
	keys[nkeys].keyblock = NULL;
	return keys;
	}
	if (rc)
	{
	log_error ("keydb_search_first failed: %s\n", g10_errstr(rc));
	xfree (keys);
	return NULL;
	}

	desc.mode = KEYDB_SEARCH_MODE_NEXT; /* change mode */
	do
	{
	PKT_public_key *pk;

	rc = keydb_get_keyblock (hd, &keyblock);
	if (rc)
	{
	log_error ("keydb_get_keyblock failed: %s\n", g10_errstr(rc));
	xfree (keys);
	return NULL;
	}

	if ( keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
	{
	log_debug ("ooops: invalid pkttype %d encountered\n",
	keyblock->pkt->pkttype);
	dump_kbnode (keyblock);
	release_kbnode(keyblock);
	continue;
	}

	/* prepare the keyblock for further processing */
	merge_keys_and_selfsig (keyblock);
	clear_kbnode_flags (keyblock);
	pk = keyblock->pkt->pkt.public_key;
	if (pk->has_expired \|\| pk->is_revoked)
	{
	/* it does not make sense to look further at those keys */
	mark_keyblock_seen (full_trust, keyblock);
	}
	else if (validate_one_keyblock (keyblock, klist, curtime, next_expire))
	{
	KBNODE node;

	if (pk->expiredate && pk->expiredate >= curtime
	&& pk->expiredate < *next_expire)
	*next_expire = pk->expiredate;

	if (nkeys == maxkeys) {
	maxkeys += 1000;
	keys = xrealloc (keys, (maxkeys+1) * sizeof *keys);
	}
	keys[nkeys++].keyblock = keyblock;

	/* Optimization - if all uids are fully trusted, then we
	never need to consider this key as a candidate again. */

	for (node=keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_USER_ID && !(node->flag & 4))
	break;

	if(node==NULL)
	mark_keyblock_seen (full_trust, keyblock);

	keyblock = NULL;
	}

	release_kbnode (keyblock);
	keyblock = NULL;
	}
	while ( !(rc = keydb_search (hd, &desc, 1)) );
	if (rc && rc != -1)
	{
	log_error ("keydb_search_next failed: %s\n", g10_errstr(rc));
	xfree (keys);
	return NULL;
	}

	keys[nkeys].keyblock = NULL;
	return keys;
	}

	/* Caller must sync */
	static void
	reset_trust_records(void)
	{
	TRUSTREC rec;
	ulong recnum;
	int count = 0, nreset = 0;

	for (recnum=1; !tdbio_read_record (recnum, &rec, 0); recnum++ )
	{
	if(rec.rectype==RECTYPE_TRUST)
	{
	count++;
	if(rec.r.trust.min_ownertrust)
	{
	rec.r.trust.min_ownertrust=0;
	write_record(&rec);
	}

	}
	else if(rec.rectype==RECTYPE_VALID
	&& ((rec.r.valid.validity&TRUST_MASK)
	\|\| rec.r.valid.marginal_count
	\|\| rec.r.valid.full_count))
	{
	rec.r.valid.validity &= ~TRUST_MASK;
	rec.r.valid.marginal_count=rec.r.valid.full_count=0;
	nreset++;
	write_record(&rec);
	}

	}

	if (opt.verbose)
	log_info (_("%d keys processed (%d validity counts cleared)\n"),
	count, nreset);
	}

	/*
	* Run the key validation procedure.
	*
	* This works this way:
	* Step 1: Find all ultimately trusted keys (UTK).
	* mark them all as seen and put them into klist.
	* Step 2: loop max_cert_times
	* Step 3: if OWNERTRUST of any key in klist is undefined
	* ask user to assign ownertrust
	* Step 4: Loop over all keys in the keyDB which are not marked seen
	* Step 5: if key is revoked or expired
	* mark key as seen
	* continue loop at Step 4
	* Step 6: For each user ID of that key signed by a key in klist
	* Calculate validity by counting trusted signatures.
	* Set validity of user ID
	* Step 7: If any signed user ID was found
	* mark key as seen
	* End Loop
	* Step 8: Build a new klist from all fully trusted keys from step 6
	* End Loop
	* Ready
	*
	*/
	static int
	validate_keys (int interactive)
	{
	int rc = 0;
	int quit=0;
	struct key_item *klist = NULL;
	struct key_item *k;
	struct key_array *keys = NULL;
	struct key_array *kar;
	KEYDB_HANDLE kdb = NULL;
	KBNODE node;
	int depth;
	int ot_unknown, ot_undefined, ot_never, ot_marginal, ot_full, ot_ultimate;
	KeyHashTable stored,used,full_trust;
	u32 start_time, next_expire;

	/* Make sure we have all sigs cached. TODO: This is going to
	require some architectual re-thinking, as it is agonizingly slow.
	Perhaps combine this with reset_trust_records(), or only check
	the caches on keys that are actually involved in the web of
	trust. */
	keydb_rebuild_caches(0);

	start_time = make_timestamp ();
	next_expire = 0xffffffff; /* set next expire to the year 2106 */
	stored = new_key_hash_table ();
	used = new_key_hash_table ();
	full_trust = new_key_hash_table ();

	kdb = keydb_new (0);
	reset_trust_records();

	/* Fixme: Instead of always building a UTK list, we could just build it
	* here when needed */
	if (!utk_list)
	{
	if (!opt.quiet)
	log_info (_("no ultimately trusted keys found\n"));
	goto leave;
	}

	/* mark all UTKs as used and fully_trusted and set validity to
	ultimate */
	for (k=utk_list; k; k = k->next)
	{
	KBNODE keyblock;
	PKT_public_key *pk;

	keyblock = get_pubkeyblock (k->kid);
	if (!keyblock)
	{
	log_error (_("public key of ultimately"
	" trusted key %s not found\n"), keystr(k->kid));
	continue;
	}
	mark_keyblock_seen (used, keyblock);
	mark_keyblock_seen (stored, keyblock);
	mark_keyblock_seen (full_trust, keyblock);
	pk = keyblock->pkt->pkt.public_key;
	for (node=keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	update_validity (pk, node->pkt->pkt.user_id, 0, TRUST_ULTIMATE);
	}
	if ( pk->expiredate && pk->expiredate >= start_time
	&& pk->expiredate < next_expire)
	next_expire = pk->expiredate;

	release_kbnode (keyblock);
	do_sync ();
	}

	klist = utk_list;

	log_info(_("%d marginal(s) needed, %d complete(s) needed, %s trust model\n"),
	opt.marginals_needed,opt.completes_needed,trust_model_string());

	for (depth=0; depth < opt.max_cert_depth; depth++)
	{
	int valids=0,key_count;
	/* See whether we should assign ownertrust values to the keys in
	klist. */
	ot_unknown = ot_undefined = ot_never = 0;
	ot_marginal = ot_full = ot_ultimate = 0;
	for (k=klist; k; k = k->next)
	{
	int min=0;

	/* 120 and 60 are as per RFC2440 */
	if(k->trust_value>=120)
	min=TRUST_FULLY;
	else if(k->trust_value>=60)
	min=TRUST_MARGINAL;

	if(min!=k->min_ownertrust)
	update_min_ownertrust(k->kid,min);

	if (interactive && k->ownertrust == TRUST_UNKNOWN)
	{
	k->ownertrust = ask_ownertrust (k->kid,min);

	if (k->ownertrust == (unsigned int)(-1))
	{
	quit=1;
	goto leave;
	}
	}

	/* This can happen during transition from an old trustdb
	before trust sigs. It can also happen if a user uses two
	different versions of GnuPG or changes the --trust-model
	setting. */
	if(k->ownertrust<min)
	{
	if(DBG_TRUST)
	log_debug("key %08lX%08lX:"
	" overriding ownertrust `%s' with `%s'\n",
	(ulong)k->kid[0],(ulong)k->kid[1],
	trust_value_to_string(k->ownertrust),
	trust_value_to_string(min));

	k->ownertrust=min;
	}

	if (k->ownertrust == TRUST_UNKNOWN)
	ot_unknown++;
	else if (k->ownertrust == TRUST_UNDEFINED)
	ot_undefined++;
	else if (k->ownertrust == TRUST_NEVER)
	ot_never++;
	else if (k->ownertrust == TRUST_MARGINAL)
	ot_marginal++;
	else if (k->ownertrust == TRUST_FULLY)
	ot_full++;
	else if (k->ownertrust == TRUST_ULTIMATE)
	ot_ultimate++;

	valids++;
	}

	/* Find all keys which are signed by a key in kdlist */
	keys = validate_key_list (kdb, full_trust, klist,
	start_time, &next_expire);
	if (!keys)
	{
	log_error ("validate_key_list failed\n");
	rc = G10ERR_GENERAL;
	goto leave;
	}

	for (key_count=0, kar=keys; kar->keyblock; kar++, key_count++)
	;

	/* Store the calculated valididation status somewhere */
	if (opt.verbose > 1)
	dump_key_array (depth, keys);

	for (kar=keys; kar->keyblock; kar++)
	store_validation_status (depth, kar->keyblock, stored);

	log_info (_("depth: %d valid: %3d signed: %3d"
	" trust: %d-, %dq, %dn, %dm, %df, %du\n"),
	depth, valids, key_count, ot_unknown, ot_undefined,
	ot_never, ot_marginal, ot_full, ot_ultimate );

	/* Build a new kdlist from all fully valid keys in KEYS */
	if (klist != utk_list)
	release_key_items (klist);
	klist = NULL;
	for (kar=keys; kar->keyblock; kar++)
	{
	for (node=kar->keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID && (node->flag & 4))
	{
	u32 kid[2];

	/* have we used this key already? */
	keyid_from_pk (kar->keyblock->pkt->pkt.public_key, kid);
	if(test_key_hash_table(used,kid)==0)
	{
	/* Normally we add both the primary and subkey
	ids to the hash via mark_keyblock_seen, but
	since we aren't using this hash as a skipfnc,
	that doesn't matter here. */
	add_key_hash_table (used,kid);
	k = new_key_item ();
	k->kid[0]=kid[0];
	k->kid[1]=kid[1];
	k->ownertrust =
	(get_ownertrust (kar->keyblock->pkt->pkt.public_key)
	& TRUST_MASK);
	k->min_ownertrust =
	get_min_ownertrust(kar->keyblock->pkt->pkt.public_key);
	k->trust_depth=
	kar->keyblock->pkt->pkt.public_key->trust_depth;
	k->trust_value=
	kar->keyblock->pkt->pkt.public_key->trust_value;
	if(kar->keyblock->pkt->pkt.public_key->trust_regexp)
	k->trust_regexp=
	xstrdup(kar->keyblock->pkt->
	pkt.public_key->trust_regexp);
	k->next = klist;
	klist = k;
	break;
	}
	}
	}
	}
	release_key_array (keys);
	keys = NULL;
	if (!klist)
	break; /* no need to dive in deeper */
	}

	leave:
	keydb_release (kdb);
	release_key_array (keys);
	release_key_items (klist);
	release_key_hash_table (full_trust);
	release_key_hash_table (used);
	release_key_hash_table (stored);
	if (!rc && !quit) /* mark trustDB as checked */
	{
	if (next_expire == 0xffffffff \|\| next_expire < start_time )
	tdbio_write_nextcheck (0);
	else
	{
	tdbio_write_nextcheck (next_expire);
	log_info (_("next trustdb check due at %s\n"),
	strtimestamp (next_expire));
	}

	if(tdbio_update_version_record()!=0)
	{
	log_error(_("unable to update trustdb version record: "
	"write failed: %s\n"), g10_errstr(rc));
	tdbio_invalid();
	}

	do_sync ();
	pending_check_trustdb = 0;
	}

	return rc;
	}

File Metadata

Mime Type: text/x-diff
Expires: Thu, Jul 17, 12:21 AM (12 h, 53 m)
Storage Engine: local-disk
Storage Format: Raw Data
Storage Handle: 3a/ff/0ae943b6ffd15d9a3672893e773c

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions