No OneTemporary
Actions

Size

48 KB

Subscribers

None

View Options

	diff --git a/g10/ecdh.c b/g10/ecdh.c
	index ac2883cf4..9a1f535a0 100644
	--- a/g10/ecdh.c
	+++ b/g10/ecdh.c
	@@ -1,575 +1,582 @@
	/* ecdh.c - ECDH public key operations used in public key glue code
	* Copyright (C) 2010, 2011 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>

	#include "gpg.h"
	#include "../common/util.h"
	#include "pkglue.h"
	#include "main.h"
	#include "options.h"

	/* A table with the default KEK parameters used by GnuPG. */
	static const struct
	{
	unsigned int qbits;
	int openpgp_hash_id; /* KEK digest algorithm. */
	int openpgp_cipher_id; /* KEK cipher algorithm. */
	} kek_params_table[] =
	/* Note: Must be sorted by ascending values for QBITS. */
	{
	{ 256, DIGEST_ALGO_SHA256, CIPHER_ALGO_AES },
	{ 384, DIGEST_ALGO_SHA384, CIPHER_ALGO_AES256 },

	/* Note: 528 is 521 rounded to the 8 bit boundary */
	{ 528, DIGEST_ALGO_SHA512, CIPHER_ALGO_AES256 }
	};



	/* Return KEK parameters as an opaque MPI The caller must free the
	returned value. Returns NULL and sets ERRNO on error. */
	gcry_mpi_t
	pk_ecdh_default_params (unsigned int qbits)
	{
	byte *kek_params;
	int i;

	kek_params = xtrymalloc (4);
	if (!kek_params)
	return NULL;
	kek_params[0] = 3; /* Number of bytes to follow. */
	kek_params[1] = 1; /* Version for KDF+AESWRAP. */

	/* Search for matching KEK parameter. Defaults to the strongest
	possible choices. Performance is not an issue here, only
	interoperability. */
	for (i=0; i < DIM (kek_params_table); i++)
	{
	if (kek_params_table[i].qbits >= qbits
	\|\| i+1 == DIM (kek_params_table))
	{
	kek_params[2] = kek_params_table[i].openpgp_hash_id;
	kek_params[3] = kek_params_table[i].openpgp_cipher_id;
	break;
	}
	}
	log_assert (i < DIM (kek_params_table));
	if (DBG_CRYPTO)
	log_printhex (kek_params, sizeof(kek_params), "ECDH KEK params are");

	return gcry_mpi_set_opaque (NULL, kek_params, 4 * 8);
	}


	/* Extract xcomponent from the point SHARED. POINT_NBYTES is the
	size to represent an EC point which is determined by the public
	key. SECRET_X_SIZE is the size of x component to represent an
	integer which is determined by the curve. */
	static gpg_error_t
	extract_secret_x (byte **r_secret_x,
	const char *shared, size_t nshared,
	size_t point_nbytes, size_t secret_x_size)
	{
	byte *secret_x;

	*r_secret_x = NULL;

	/* Extract X from the result. It must be in the format of:
	04 \|\| X \|\| Y
	40 \|\| X
	41 \|\| X

	Since it may come with the prefix, the size of point is larger
	than or equals to the size of an integer X. */
	if (point_nbytes < secret_x_size)
	return gpg_error (GPG_ERR_BAD_DATA);

	/* Extract x component of the shared point: this is the actual
	shared secret. */
	secret_x = xtrymalloc_secure (point_nbytes);
	if (!secret_x)
	return gpg_error_from_syserror ();

	memcpy (secret_x, shared, nshared);

	/* Remove the prefix. */
	if ((point_nbytes & 1))
	memmove (secret_x, secret_x+1, secret_x_size);

	/* Clear the rest of data. */
	if (point_nbytes - secret_x_size)
	memset (secret_x+secret_x_size, 0, point_nbytes-secret_x_size);

	if (DBG_CRYPTO)
	log_printhex (secret_x, secret_x_size, "ECDH shared secret X is:");

	*r_secret_x = secret_x;
	return 0;
	}


	+/* Build KDF parameters */
	+/* RFC 6637 defines the KDF parameters and its encoding in Section
	+ 8. EC DH Algorighm (ECDH). Since it was written for v4 key, it
	+ said "20 octets representing a recipient encryption subkey or a
	+ master key fingerprint". For v5 key, it is considered "adequate"
	+ (in terms of NIST SP 800 56A, see 5.8.2 FixedInfo) to use the first
	+ 20 octets of its 32 octets fingerprint. */
	static gpg_error_t
	build_kdf_params (unsigned char kdf_params[256], size_t *r_size,
	gcry_mpi_t *pkey, const byte pk_fp[MAX_FINGERPRINT_LEN])
	{
	IOBUF obuf;
	gpg_error_t err;

	*r_size = 0;

	obuf = iobuf_temp();
	if (!obuf)
	return gpg_error_from_syserror ();

	/* variable-length field 1, curve name OID */
	err = gpg_mpi_write_nohdr (obuf, pkey[0]);
	/* fixed-length field 2 */
	iobuf_put (obuf, PUBKEY_ALGO_ECDH);
	/* variable-length field 3, KDF params */
	err = (err ? err : gpg_mpi_write_nohdr (obuf, pkey[2]));
	/* fixed-length field 4 */
	iobuf_write (obuf, "Anonymous Sender ", 20);
	- /* fixed-length field 5, recipient fp */
	+ /* fixed-length field 5, recipient fp (or first 20 octets of fp) */
	iobuf_write (obuf, pk_fp, 20);

	if (!err)
	*r_size = iobuf_temp_to_buffer (obuf, kdf_params, 256);

	iobuf_close (obuf);

	if (!err)
	{
	if (DBG_CRYPTO)
	log_printhex (kdf_params, *r_size, "ecdh KDF message params are:");
	}

	return err;
	}


	/* Derive KEK with KEK_SIZE into the memory at SECRET_X. */
	static gpg_error_t
	derive_kek (size_t kek_size,
	int kdf_hash_algo,
	byte *secret_x, int secret_x_size,
	const unsigned char *kdf_params, size_t kdf_params_size)
	{
	gpg_error_t err;
	gcry_md_hd_t h;

	log_assert( gcry_md_get_algo_dlen (kdf_hash_algo) >= 32 );

	err = gcry_md_open (&h, kdf_hash_algo, 0);
	if (err)
	{
	log_error ("gcry_md_open failed for kdf_hash_algo %d: %s",
	kdf_hash_algo, gpg_strerror (err));
	return err;
	}
	gcry_md_write(h, "\x00\x00\x00\x01", 4); /* counter = 1 */
	gcry_md_write(h, secret_x, secret_x_size); /* x of the point X */
	gcry_md_write(h, kdf_params, kdf_params_size); /* KDF parameters */
	gcry_md_final (h);
	memcpy (secret_x, gcry_md_read (h, kdf_hash_algo), kek_size);
	gcry_md_close (h);
	/* Clean the tail before returning. */
	memset (secret_x+kek_size, 0, secret_x_size - kek_size);
	if (DBG_CRYPTO)
	log_printhex (secret_x, kek_size, "ecdh KEK is:");
	return err;
	}


	/* Prepare ECDH using SHARED, PK_FP fingerprint, and PKEY array.
	Returns the cipher handle in R_HD, which needs to be closed by
	the caller. */
	static gpg_error_t
	prepare_ecdh_with_shared_point (const char *shared, size_t nshared,
	const byte pk_fp[MAX_FINGERPRINT_LEN],
	gcry_mpi_t pkey, gcry_cipher_hd_t r_hd)
	{
	gpg_error_t err;
	byte *secret_x;
	int secret_x_size;
	unsigned int nbits;
	const unsigned char *kek_params;
	size_t kek_params_size;
	int kdf_hash_algo;
	int kdf_encr_algo;
	unsigned char kdf_params[256];
	size_t kdf_params_size;
	size_t kek_size;
	gcry_cipher_hd_t hd;

	*r_hd = NULL;

	if (!gcry_mpi_get_flag (pkey[2], GCRYMPI_FLAG_OPAQUE))
	return gpg_error (GPG_ERR_BUG);

	kek_params = gcry_mpi_get_opaque (pkey[2], &nbits);
	kek_params_size = (nbits+7)/8;

	if (DBG_CRYPTO)
	log_printhex (kek_params, kek_params_size, "ecdh KDF params:");

	/* Expect 4 bytes 03 01 hash_alg symm_alg. */
	if (kek_params_size != 4 \|\| kek_params[0] != 3 \|\| kek_params[1] != 1)
	return gpg_error (GPG_ERR_BAD_PUBKEY);

	kdf_hash_algo = kek_params[2];
	kdf_encr_algo = kek_params[3];

	if (DBG_CRYPTO)
	log_debug ("ecdh KDF algorithms %s+%s with aeswrap\n",
	openpgp_md_algo_name (kdf_hash_algo),
	openpgp_cipher_algo_name (kdf_encr_algo));

	if (kdf_hash_algo != GCRY_MD_SHA256
	&& kdf_hash_algo != GCRY_MD_SHA384
	&& kdf_hash_algo != GCRY_MD_SHA512)
	return gpg_error (GPG_ERR_BAD_PUBKEY);

	if (kdf_encr_algo != CIPHER_ALGO_AES
	&& kdf_encr_algo != CIPHER_ALGO_AES192
	&& kdf_encr_algo != CIPHER_ALGO_AES256)
	return gpg_error (GPG_ERR_BAD_PUBKEY);

	kek_size = gcry_cipher_get_algo_keylen (kdf_encr_algo);
	if (kek_size > gcry_md_get_algo_dlen (kdf_hash_algo))
	return gpg_error (GPG_ERR_BAD_PUBKEY);

	/* Build kdf_params. */
	err = build_kdf_params (kdf_params, &kdf_params_size, pkey, pk_fp);
	if (err)
	return err;

	nbits = pubkey_nbits (PUBKEY_ALGO_ECDH, pkey);
	if (!nbits)
	return gpg_error (GPG_ERR_TOO_SHORT);

	secret_x_size = (nbits+7)/8;
	if (kek_size > secret_x_size)
	return gpg_error (GPG_ERR_BAD_PUBKEY);

	err = extract_secret_x (&secret_x, shared, nshared,
	/* pkey[1] is the public point */
	(mpi_get_nbits (pkey[1])+7)/8,
	secret_x_size);
	if (err)
	return err;

	/* We have now the shared secret bytes in secret_x. */

	/* At this point we are done with PK encryption and the rest of the
	* function uses symmetric key encryption techniques to protect the
	* input DATA. The following two sections will simply replace
	* current secret_x with a value derived from it. This will become
	* a KEK.
	*/

	/* Derive a KEK (key wrapping key) using SECRET_X and KDF_PARAMS. */
	err = derive_kek (kek_size, kdf_hash_algo, secret_x,
	secret_x_size, kdf_params, kdf_params_size);
	if (err)
	{
	xfree (secret_x);
	return err;
	}

	/* And, finally, aeswrap with key secret_x. */
	err = gcry_cipher_open (&hd, kdf_encr_algo, GCRY_CIPHER_MODE_AESWRAP, 0);
	if (err)
	{
	log_error ("ecdh failed to initialize AESWRAP: %s\n",
	gpg_strerror (err));
	xfree (secret_x);
	return err;
	}

	err = gcry_cipher_setkey (hd, secret_x, kek_size);
	xfree (secret_x);
	secret_x = NULL;
	if (err)
	{
	gcry_cipher_close (hd);
	log_error ("ecdh failed in gcry_cipher_setkey: %s\n",
	gpg_strerror (err));
	}
	else
	*r_hd = hd;

	return err;
	}

	/* Encrypts DATA using a key derived from the ECC shared point SHARED
	using the FIPS SP 800-56A compliant method
	key_derivation+key_wrapping. PKEY is the public key and PK_FP the
	fingerprint of this public key. On success the result is stored at
	R_RESULT; on failure NULL is stored at R_RESULT and an error code
	returned. */
	gpg_error_t
	pk_ecdh_encrypt_with_shared_point (const char *shared, size_t nshared,
	const byte pk_fp[MAX_FINGERPRINT_LEN],
	const byte *data, size_t ndata,
	gcry_mpi_t pkey, gcry_mpi_t r_result)
	{
	gpg_error_t err;
	gcry_cipher_hd_t hd;
	byte *data_buf;
	int data_buf_size;
	gcry_mpi_t result;
	byte *in;

	*r_result = NULL;

	err = prepare_ecdh_with_shared_point (shared, nshared, pk_fp, pkey, &hd);
	if (err)
	return err;

	data_buf_size = ndata;
	if ((data_buf_size & 7) != 0)
	{
	log_error ("can't use a shared secret of %d bytes for ecdh\n",
	data_buf_size);
	gcry_cipher_close (hd);
	return gpg_error (GPG_ERR_BAD_DATA);
	}

	data_buf = xtrymalloc_secure( 1 + 2*data_buf_size + 8);
	if (!data_buf)
	{
	err = gpg_error_from_syserror ();
	gcry_cipher_close (hd);
	return err;
	}

	in = data_buf+1+data_buf_size+8;

	/* Write data MPI into the end of data_buf. data_buf is size
	aeswrap data. */
	memcpy (in, data, ndata);

	if (DBG_CRYPTO)
	log_printhex (in, data_buf_size, "ecdh encrypting :");

	err = gcry_cipher_encrypt (hd, data_buf+1, data_buf_size+8,
	in, data_buf_size);
	memset (in, 0, data_buf_size);
	gcry_cipher_close (hd);
	if (err)
	{
	log_error ("ecdh failed in gcry_cipher_encrypt: %s\n",
	gpg_strerror (err));
	xfree (data_buf);
	return err;
	}
	data_buf[0] = data_buf_size+8;

	if (DBG_CRYPTO)
	log_printhex (data_buf+1, data_buf[0], "ecdh encrypted to:");

	result = gcry_mpi_set_opaque (NULL, data_buf, 8 * (1+data_buf[0]));
	if (!result)
	{
	err = gpg_error_from_syserror ();
	xfree (data_buf);
	log_error ("ecdh failed to create an MPI: %s\n",
	gpg_strerror (err));
	return err;
	}

	*r_result = result;
	return err;
	}


	static gcry_mpi_t
	gen_k (unsigned nbits, int little_endian, int is_opaque)
	{
	gcry_mpi_t k;

	if (is_opaque)
	{
	unsigned char *p;
	size_t nbytes = (nbits+7)/8;

	p = gcry_random_bytes_secure (nbytes, GCRY_STRONG_RANDOM);
	if ((nbits % 8))
	{
	if (little_endian)
	p[nbytes-1] &= ((1 << (nbits % 8)) - 1);
	else
	p[0] &= ((1 << (nbits % 8)) - 1);
	}
	k = gcry_mpi_set_opaque (NULL, p, nbits);
	return k;
	}

	k = gcry_mpi_snew (nbits);
	if (DBG_CRYPTO)
	log_debug ("choosing a random k of %u bits\n", nbits);

	gcry_mpi_randomize (k, nbits-1, GCRY_STRONG_RANDOM);

	if (DBG_CRYPTO)
	{
	unsigned char *buffer;
	if (gcry_mpi_aprint (GCRYMPI_FMT_HEX, &buffer, NULL, k))
	BUG ();
	log_debug ("ephemeral scalar MPI #0: %s\n", buffer);
	gcry_free (buffer);
	}

	return k;
	}


	/* Generate an ephemeral key for the public ECDH key in PKEY. On
	success the generated key is stored at R_K; on failure NULL is
	stored at R_K and an error code returned. */
	gpg_error_t
	pk_ecdh_generate_ephemeral_key (gcry_mpi_t pkey, gcry_mpi_t r_k)
	{
	unsigned int nbits;
	gcry_mpi_t k;
	int is_little_endian = 0;
	int require_opaque = 0;

	if (openpgp_oid_is_cv448 (pkey[0]))
	{
	is_little_endian = 1;
	require_opaque = 1;
	}

	*r_k = NULL;

	nbits = pubkey_nbits (PUBKEY_ALGO_ECDH, pkey);
	if (!nbits)
	return gpg_error (GPG_ERR_TOO_SHORT);
	k = gen_k (nbits, is_little_endian, require_opaque);
	if (!k)
	BUG ();

	*r_k = k;
	return 0;
	}



	/* Perform ECDH decryption. */
	int
	pk_ecdh_decrypt (gcry_mpi_t *r_result, const byte sk_fp[MAX_FINGERPRINT_LEN],
	gcry_mpi_t data,
	const byte shared, size_t nshared, gcry_mpi_t skey)
	{
	gpg_error_t err;
	gcry_cipher_hd_t hd;
	size_t nbytes;
	byte *data_buf;
	int data_buf_size;
	byte *in;
	const void *p;
	unsigned int nbits;

	*r_result = NULL;

	err = prepare_ecdh_with_shared_point (shared, nshared, sk_fp, skey, &hd);
	if (err)
	return err;

	p = gcry_mpi_get_opaque (data, &nbits);
	nbytes = (nbits+7)/8;

	data_buf_size = nbytes;
	if ((data_buf_size & 7) != 1)
	{
	log_error ("can't use a shared secret of %d bytes for ecdh\n",
	data_buf_size);
	gcry_cipher_close (hd);
	return gpg_error (GPG_ERR_BAD_DATA);
	}

	data_buf = xtrymalloc_secure( 1 + 2*data_buf_size + 8);
	if (!data_buf)
	{
	err = gpg_error_from_syserror ();
	gcry_cipher_close (hd);
	return err;
	}

	if (!p)
	{
	xfree (data_buf);
	gcry_cipher_close (hd);
	return gpg_error (GPG_ERR_BAD_MPI);
	}
	memcpy (data_buf, p, nbytes);
	if (data_buf[0] != nbytes-1)
	{
	log_error ("ecdh inconsistent size\n");
	xfree (data_buf);
	gcry_cipher_close (hd);
	return gpg_error (GPG_ERR_BAD_MPI);
	}
	in = data_buf+data_buf_size;
	data_buf_size = data_buf[0];

	if (DBG_CRYPTO)
	log_printhex (data_buf+1, data_buf_size, "ecdh decrypting :");

	err = gcry_cipher_decrypt (hd, in, data_buf_size, data_buf+1,
	data_buf_size);
	gcry_cipher_close (hd);
	if (err)
	{
	log_error ("ecdh failed in gcry_cipher_decrypt: %s\n",
	gpg_strerror (err));
	xfree (data_buf);
	return err;
	}

	data_buf_size -= 8;

	if (DBG_CRYPTO)
	log_printhex (in, data_buf_size, "ecdh decrypted to :");

	/* Padding is removed later. */
	/* if (in[data_buf_size-1] > 8 ) */
	/* { */
	/* log_error ("ecdh failed at decryption: invalid padding." */
	/* " 0x%02x > 8\n", in[data_buf_size-1] ); */
	/* return gpg_error (GPG_ERR_BAD_KEY); */
	/* } */

	err = gcry_mpi_scan (r_result, GCRYMPI_FMT_USG, in, data_buf_size, NULL);
	xfree (data_buf);
	if (err)
	{
	log_error ("ecdh failed to create a plain text MPI: %s\n",
	gpg_strerror (err));
	return err;
	}

	return err;
	}
	diff --git a/g10/pkglue.c b/g10/pkglue.c
	index 13f8e2f03..cab007f01 100644
	--- a/g10/pkglue.c
	+++ b/g10/pkglue.c
	@@ -1,541 +1,538 @@
	/* pkglue.c - public key operations glue code
	* Copyright (C) 2000, 2003, 2010 Free Software Foundation, Inc.
	* Copyright (C) 2014 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>

	#include "gpg.h"
	#include "../common/util.h"
	#include "pkglue.h"
	#include "main.h"
	#include "options.h"

	/* FIXME: Better change the function name because mpi_ is used by
	gcrypt macros. */
	gcry_mpi_t
	get_mpi_from_sexp (gcry_sexp_t sexp, const char *item, int mpifmt)
	{
	gcry_sexp_t list;
	gcry_mpi_t data;

	list = gcry_sexp_find_token (sexp, item, 0);
	log_assert (list);
	data = gcry_sexp_nth_mpi (list, 1, mpifmt);
	log_assert (data);
	gcry_sexp_release (list);
	return data;
	}


	/* Extract SOS representation from SEXP for PARAM, return the result
	in R_SOS. */
	gpg_error_t
	sexp_extract_param_sos (gcry_sexp_t sexp, const char param, gcry_mpi_t r_sos)
	{
	gpg_error_t err;
	gcry_sexp_t l2 = gcry_sexp_find_token (sexp, param, 0);

	*r_sos = NULL;
	if (!l2)
	err = gpg_error (GPG_ERR_NO_OBJ);
	else
	{
	size_t buflen;
	void *p0 = gcry_sexp_nth_buffer (l2, 1, &buflen);

	if (!p0)
	err = gpg_error_from_syserror ();
	else
	{
	gcry_mpi_t sos;
	unsigned int nbits = buflen*8;
	unsigned char *p = p0;

	if (p && nbits >= 8 && !(p & 0x80))
	if (--nbits >= 7 && !(*p & 0x40))
	if (--nbits >= 6 && !(*p & 0x20))
	if (--nbits >= 5 && !(*p & 0x10))
	if (--nbits >= 4 && !(*p & 0x08))
	if (--nbits >= 3 && !(*p & 0x04))
	if (--nbits >= 2 && !(*p & 0x02))
	if (--nbits >= 1 && !(*p & 0x01))
	--nbits;

	sos = gcry_mpi_set_opaque (NULL, p0, nbits);
	if (sos)
	{
	gcry_mpi_set_flag (sos, GCRYMPI_FLAG_USER2);
	*r_sos = sos;
	err = 0;
	}
	else
	err = gpg_error_from_syserror ();
	}
	gcry_sexp_release (l2);
	}

	return err;
	}


	static byte *
	get_data_from_sexp (gcry_sexp_t sexp, const char item, size_t r_size)
	{
	gcry_sexp_t list;
	size_t valuelen;
	const char *value;
	byte *v;

	if (DBG_CRYPTO)
	log_printsexp ("get_data_from_sexp:", sexp);

	list = gcry_sexp_find_token (sexp, item, 0);
	log_assert (list);
	value = gcry_sexp_nth_data (list, 1, &valuelen);
	log_assert (value);
	v = xtrymalloc (valuelen);
	memcpy (v, value, valuelen);
	gcry_sexp_release (list);
	*r_size = valuelen;
	return v;
	}


	/****************
	* Emulate our old PK interface here - sometime in the future we might
	* change the internal design to directly fit to libgcrypt.
	*/
	int
	pk_verify (pubkey_algo_t pkalgo, gcry_mpi_t hash,
	gcry_mpi_t data, gcry_mpi_t pkey)
	{
	gcry_sexp_t s_sig, s_hash, s_pkey;
	int rc;

	/* Make a sexp from pkey. */
	if (pkalgo == PUBKEY_ALGO_DSA)
	{
	rc = gcry_sexp_build (&s_pkey, NULL,
	"(public-key(dsa(p%m)(q%m)(g%m)(y%m)))",
	pkey[0], pkey[1], pkey[2], pkey[3]);
	}
	else if (pkalgo == PUBKEY_ALGO_ELGAMAL_E \|\| pkalgo == PUBKEY_ALGO_ELGAMAL)
	{
	rc = gcry_sexp_build (&s_pkey, NULL,
	"(public-key(elg(p%m)(g%m)(y%m)))",
	pkey[0], pkey[1], pkey[2]);
	}
	else if (pkalgo == PUBKEY_ALGO_RSA \|\| pkalgo == PUBKEY_ALGO_RSA_S)
	{
	rc = gcry_sexp_build (&s_pkey, NULL,
	"(public-key(rsa(n%m)(e%m)))", pkey[0], pkey[1]);
	}
	else if (pkalgo == PUBKEY_ALGO_ECDSA)
	{
	char *curve = openpgp_oid_to_str (pkey[0]);
	if (!curve)
	rc = gpg_error_from_syserror ();
	else
	{
	rc = gcry_sexp_build (&s_pkey, NULL,
	"(public-key(ecdsa(curve %s)(q%m)))",
	curve, pkey[1]);
	xfree (curve);
	}
	}
	else if (pkalgo == PUBKEY_ALGO_EDDSA)
	{
	char *curve = openpgp_oid_to_str (pkey[0]);
	if (!curve)
	rc = gpg_error_from_syserror ();
	else
	{
	const char *fmt;

	if (openpgp_oid_is_ed25519 (pkey[0]))
	fmt = "(public-key(ecc(curve %s)(flags eddsa)(q%m)))";
	else
	fmt = "(public-key(ecc(curve %s)(q%m)))";

	rc = gcry_sexp_build (&s_pkey, NULL, fmt, curve, pkey[1]);
	xfree (curve);
	}
	}
	else
	return GPG_ERR_PUBKEY_ALGO;

	if (rc)
	BUG (); /* gcry_sexp_build should never fail. */

	/* Put hash into a S-Exp s_hash. */
	if (pkalgo == PUBKEY_ALGO_EDDSA)
	{
	const char *fmt;

	if (openpgp_oid_is_ed25519 (pkey[0]))
	fmt = "(data(flags eddsa)(hash-algo sha512)(value %m))";
	else
	fmt = "(data(value %m))";

	if (gcry_sexp_build (&s_hash, NULL, fmt, hash))
	BUG (); /* gcry_sexp_build should never fail. */
	}
	else
	{
	if (gcry_sexp_build (&s_hash, NULL, "%m", hash))
	BUG (); /* gcry_sexp_build should never fail. */
	}

	/* Put data into a S-Exp s_sig. */
	s_sig = NULL;
	if (pkalgo == PUBKEY_ALGO_DSA)
	{
	if (!data[0] \|\| !data[1])
	rc = gpg_error (GPG_ERR_BAD_MPI);
	else
	rc = gcry_sexp_build (&s_sig, NULL,
	"(sig-val(dsa(r%m)(s%m)))", data[0], data[1]);
	}
	else if (pkalgo == PUBKEY_ALGO_ECDSA)
	{
	if (!data[0] \|\| !data[1])
	rc = gpg_error (GPG_ERR_BAD_MPI);
	else
	rc = gcry_sexp_build (&s_sig, NULL,
	"(sig-val(ecdsa(r%m)(s%m)))", data[0], data[1]);
	}
	else if (pkalgo == PUBKEY_ALGO_EDDSA)
	{
	gcry_mpi_t r = data[0];
	gcry_mpi_t s = data[1];

	if (openpgp_oid_is_ed25519 (pkey[0]))
	{
	size_t rlen, slen, n; /* (bytes) */
	char buf[64];
	unsigned int nbits;
	unsigned int neededfixedlen = 256 / 8;

	log_assert (neededfixedlen <= sizeof buf);

	if (!r \|\| !s)
	rc = gpg_error (GPG_ERR_BAD_MPI);
	else if ((rlen = (gcry_mpi_get_nbits (r)+7)/8) > neededfixedlen \|\| !rlen)
	rc = gpg_error (GPG_ERR_BAD_MPI);
	else if ((slen = (gcry_mpi_get_nbits (s)+7)/8) > neededfixedlen \|\| !slen)
	rc = gpg_error (GPG_ERR_BAD_MPI);
	else
	{
	/* We need to fixup the length in case of leading zeroes.
	* OpenPGP does not allow leading zeroes and the parser for
	* the signature packet has no information on the use curve,
	* thus we need to do it here. We won't do it for opaque
	* MPIs under the assumption that they are known to be fine;
	* we won't see them here anyway but the check is anyway
	* required. Fixme: A nifty feature for gcry_sexp_build
	* would be a format to left pad the value (e.g. "%M"). /
	rc = 0;

	if (rlen < neededfixedlen
	&& !gcry_mpi_get_flag (r, GCRYMPI_FLAG_OPAQUE)
	&& !(rc=gcry_mpi_print (GCRYMPI_FMT_USG, buf, sizeof buf, &n, r)))
	{
	log_assert (n < neededfixedlen);
	memmove (buf + (neededfixedlen - n), buf, n);
	memset (buf, 0, neededfixedlen - n);
	r = gcry_mpi_set_opaque_copy (NULL, buf, neededfixedlen * 8);
	}
	else if (rlen < neededfixedlen
	&& gcry_mpi_get_flag (r, GCRYMPI_FLAG_OPAQUE))
	{
	const unsigned char *p;

	p = gcry_mpi_get_opaque (r, &nbits);
	n = (nbits+7)/8;
	memcpy (buf + (neededfixedlen - n), p, n);
	memset (buf, 0, neededfixedlen - n);
	gcry_mpi_set_opaque_copy (r, buf, neededfixedlen * 8);
	}
	if (slen < neededfixedlen
	&& !gcry_mpi_get_flag (s, GCRYMPI_FLAG_OPAQUE)
	&& !(rc=gcry_mpi_print (GCRYMPI_FMT_USG, buf, sizeof buf, &n, s)))
	{
	log_assert (n < neededfixedlen);
	memmove (buf + (neededfixedlen - n), buf, n);
	memset (buf, 0, neededfixedlen - n);
	s = gcry_mpi_set_opaque_copy (NULL, buf, neededfixedlen * 8);
	}
	else if (slen < neededfixedlen
	&& gcry_mpi_get_flag (s, GCRYMPI_FLAG_OPAQUE))
	{
	const unsigned char *p;

	p = gcry_mpi_get_opaque (s, &nbits);
	n = (nbits+7)/8;
	memcpy (buf + (neededfixedlen - n), p, n);
	memset (buf, 0, neededfixedlen - n);
	gcry_mpi_set_opaque_copy (s, buf, neededfixedlen * 8);
	}
	}
	}
	else
	rc = 0;

	if (!rc)
	rc = gcry_sexp_build (&s_sig, NULL,
	"(sig-val(eddsa(r%M)(s%M)))", r, s);

	if (r != data[0])
	gcry_mpi_release (r);
	if (s != data[1])
	gcry_mpi_release (s);
	}
	else if (pkalgo == PUBKEY_ALGO_ELGAMAL \|\| pkalgo == PUBKEY_ALGO_ELGAMAL_E)
	{
	if (!data[0] \|\| !data[1])
	rc = gpg_error (GPG_ERR_BAD_MPI);
	else
	rc = gcry_sexp_build (&s_sig, NULL,
	"(sig-val(elg(r%m)(s%m)))", data[0], data[1]);
	}
	else if (pkalgo == PUBKEY_ALGO_RSA \|\| pkalgo == PUBKEY_ALGO_RSA_S)
	{
	if (!data[0])
	rc = gpg_error (GPG_ERR_BAD_MPI);
	else
	rc = gcry_sexp_build (&s_sig, NULL, "(sig-val(rsa(s%m)))", data[0]);
	}
	else
	BUG ();

	if (!rc)
	rc = gcry_pk_verify (s_sig, s_hash, s_pkey);

	gcry_sexp_release (s_sig);
	gcry_sexp_release (s_hash);
	gcry_sexp_release (s_pkey);
	return rc;
	}




	/****************
	* Emulate our old PK interface here - sometime in the future we might
	* change the internal design to directly fit to libgcrypt.
	* PK is only required to compute the fingerprint for ECDH.
	*/
	int
	pk_encrypt (pubkey_algo_t algo, gcry_mpi_t *resarr, gcry_mpi_t data,
	PKT_public_key pk, gcry_mpi_t pkey)
	{
	gcry_sexp_t s_ciph = NULL;
	gcry_sexp_t s_data = NULL;
	gcry_sexp_t s_pkey = NULL;
	int rc;

	/* Make a sexp from pkey. */
	if (algo == PUBKEY_ALGO_ELGAMAL \|\| algo == PUBKEY_ALGO_ELGAMAL_E)
	{
	rc = gcry_sexp_build (&s_pkey, NULL,
	"(public-key(elg(p%m)(g%m)(y%m)))",
	pkey[0], pkey[1], pkey[2]);
	/* Put DATA into a simplified S-expression. */
	if (!rc)
	rc = gcry_sexp_build (&s_data, NULL, "%m", data);
	}
	else if (algo == PUBKEY_ALGO_RSA \|\| algo == PUBKEY_ALGO_RSA_E)
	{
	rc = gcry_sexp_build (&s_pkey, NULL,
	"(public-key(rsa(n%m)(e%m)))",
	pkey[0], pkey[1]);
	/* Put DATA into a simplified S-expression. */
	if (!rc)
	rc = gcry_sexp_build (&s_data, NULL, "%m", data);
	}
	else if (algo == PUBKEY_ALGO_ECDH)
	{
	gcry_mpi_t k;

	rc = pk_ecdh_generate_ephemeral_key (pkey, &k);
	if (!rc)
	{
	char *curve;

	curve = openpgp_oid_to_str (pkey[0]);
	if (!curve)
	rc = gpg_error_from_syserror ();
	else
	{
	int with_djb_tweak_flag = openpgp_oid_is_cv25519 (pkey[0]);

	/* Now use the ephemeral secret to compute the shared point. */
	rc = gcry_sexp_build (&s_pkey, NULL,
	with_djb_tweak_flag ?
	"(public-key(ecdh(curve%s)(flags djb-tweak)(q%m)))"
	: "(public-key(ecdh(curve%s)(q%m)))",
	curve, pkey[1]);
	xfree (curve);
	/* Put K into a simplified S-expression. */
	if (!rc)
	rc = gcry_sexp_build (&s_data, NULL, "%m", k);
	}
	gcry_mpi_release (k);
	}
	}
	else
	rc = gpg_error (GPG_ERR_PUBKEY_ALGO);

	/* Pass it to libgcrypt. */
	if (!rc)
	rc = gcry_pk_encrypt (&s_ciph, s_data, s_pkey);

	gcry_sexp_release (s_data);
	gcry_sexp_release (s_pkey);

	if (rc)
	;
	else if (algo == PUBKEY_ALGO_ECDH)
	{
	gcry_mpi_t public, result;
	byte fp[MAX_FINGERPRINT_LEN];
	- size_t fpn;
	byte *shared;
	size_t nshared;

	/* Get the shared point and the ephemeral public key. */
	shared = get_data_from_sexp (s_ciph, "s", &nshared);
	rc = sexp_extract_param_sos (s_ciph, "e", &public);
	gcry_sexp_release (s_ciph);
	s_ciph = NULL;
	if (DBG_CRYPTO)
	{
	log_debug ("ECDH ephemeral key:");
	gcry_mpi_dump (public);
	log_printf ("\n");
	}

	result = NULL;
	- fingerprint_from_pk (pk, fp, &fpn);
	- if (fpn != 20)
	- rc = gpg_error (GPG_ERR_INV_LENGTH);
	+ fingerprint_from_pk (pk, fp, NULL);

	if (!rc)
	{
	unsigned int nbits;
	byte *p = gcry_mpi_get_opaque (data, &nbits);
	rc = pk_ecdh_encrypt_with_shared_point (shared, nshared, fp, p,
	(nbits+7)/8, pkey, &result);
	}
	xfree (shared);
	if (!rc)
	{
	resarr[0] = public;
	resarr[1] = result;
	}
	else
	{
	gcry_mpi_release (public);
	gcry_mpi_release (result);
	}
	}
	else /* Elgamal or RSA case. */
	{ /* Fixme: Add better error handling or make gnupg use
	S-expressions directly. */
	resarr[0] = get_mpi_from_sexp (s_ciph, "a", GCRYMPI_FMT_USG);
	if (!is_RSA (algo))
	resarr[1] = get_mpi_from_sexp (s_ciph, "b", GCRYMPI_FMT_USG);
	}

	gcry_sexp_release (s_ciph);
	return rc;
	}


	/* Check whether SKEY is a suitable secret key. */
	int
	pk_check_secret_key (pubkey_algo_t pkalgo, gcry_mpi_t *skey)
	{
	gcry_sexp_t s_skey;
	int rc;

	if (pkalgo == PUBKEY_ALGO_DSA)
	{
	rc = gcry_sexp_build (&s_skey, NULL,
	"(private-key(dsa(p%m)(q%m)(g%m)(y%m)(x%m)))",
	skey[0], skey[1], skey[2], skey[3], skey[4]);
	}
	else if (pkalgo == PUBKEY_ALGO_ELGAMAL \|\| pkalgo == PUBKEY_ALGO_ELGAMAL_E)
	{
	rc = gcry_sexp_build (&s_skey, NULL,
	"(private-key(elg(p%m)(g%m)(y%m)(x%m)))",
	skey[0], skey[1], skey[2], skey[3]);
	}
	else if (is_RSA (pkalgo))
	{
	rc = gcry_sexp_build (&s_skey, NULL,
	"(private-key(rsa(n%m)(e%m)(d%m)(p%m)(q%m)(u%m)))",
	skey[0], skey[1], skey[2], skey[3], skey[4],
	skey[5]);
	}
	else if (pkalgo == PUBKEY_ALGO_ECDSA \|\| pkalgo == PUBKEY_ALGO_ECDH)
	{
	char *curve = openpgp_oid_to_str (skey[0]);
	if (!curve)
	rc = gpg_error_from_syserror ();
	else
	{
	rc = gcry_sexp_build (&s_skey, NULL,
	"(private-key(ecc(curve%s)(q%m)(d%m)))",
	curve, skey[1], skey[2]);
	xfree (curve);
	}
	}
	else if (pkalgo == PUBKEY_ALGO_EDDSA)
	{
	char *curve = openpgp_oid_to_str (skey[0]);
	if (!curve)
	rc = gpg_error_from_syserror ();
	else
	{
	const char *fmt;

	if (openpgp_oid_is_ed25519 (skey[0]))
	fmt = "(private-key(ecc(curve %s)(flags eddsa)(q%m)(d%m)))";
	else
	fmt = "(private-key(ecc(curve %s)(q%m)(d%m)))";

	rc = gcry_sexp_build (&s_skey, NULL, fmt, curve, skey[1], skey[2]);
	xfree (curve);
	}
	}
	else
	return GPG_ERR_PUBKEY_ALGO;

	if (!rc)
	{
	rc = gcry_pk_testkey (s_skey);
	gcry_sexp_release (s_skey);
	}
	return rc;
	}
	diff --git a/g10/pubkey-enc.c b/g10/pubkey-enc.c
	index 9a2c107f8..6e1b0898e 100644
	--- a/g10/pubkey-enc.c
	+++ b/g10/pubkey-enc.c
	@@ -1,507 +1,503 @@
	/* pubkey-enc.c - Process a public key encoded packet.
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2006, 2009,
	* 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#include "gpg.h"
	#include "../common/util.h"
	#include "packet.h"
	#include "keydb.h"
	#include "trustdb.h"
	#include "../common/status.h"
	#include "options.h"
	#include "main.h"
	#include "../common/i18n.h"
	#include "pkglue.h"
	#include "call-agent.h"
	#include "../common/host2net.h"
	#include "../common/compliance.h"


	static gpg_error_t get_it (ctrl_t ctrl, struct pubkey_enc_list *k,
	DEK dek, PKT_public_key sk, u32 *keyid);


	/* Check that the given algo is mentioned in one of the valid user-ids. */
	static int
	is_algo_in_prefs (kbnode_t keyblock, preftype_t type, int algo)
	{
	kbnode_t k;

	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;
	prefitem_t *prefs = uid->prefs;

	if (uid->created && prefs && !uid->flags.revoked && !uid->flags.expired)
	{
	for (; prefs->type; prefs++)
	if (prefs->type == type && prefs->value == algo)
	return 1;
	}
	}
	}
	return 0;
	}


	/*
	* Get the session key from a pubkey enc packet and return it in DEK,
	* which should have been allocated in secure memory by the caller.
	*/
	gpg_error_t
	get_session_key (ctrl_t ctrl, struct pubkey_enc_list list, DEK dek)
	{
	PKT_public_key *sk = NULL;
	gpg_error_t err;
	void *enum_context = NULL;
	u32 keyid[2];
	int search_for_secret_keys = 1;
	struct pubkey_enc_list *k;

	if (DBG_CLOCK)
	log_clock ("get_session_key enter");

	while (search_for_secret_keys)
	{
	sk = xmalloc_clear (sizeof *sk);
	err = enum_secret_keys (ctrl, &enum_context, sk);
	if (err)
	break;

	/* Check compliance. */
	if (! gnupg_pk_is_allowed (opt.compliance, PK_USE_DECRYPTION,
	sk->pubkey_algo, 0,
	sk->pkey, nbits_from_pk (sk), NULL))
	{
	log_info (_("key %s is not suitable for decryption"
	" in %s mode\n"),
	keystr_from_pk (sk),
	gnupg_compliance_option_string (opt.compliance));
	continue;
	}

	/* FIXME: The list needs to be sorted so that we try the keys in
	* an appropriate order. For example:
	* - On-disk keys w/o protection
	* - On-disk keys with a cached passphrase
	* - On-card keys of an active card
	* - On-disk keys with protection
	* - On-card keys from cards which are not plugged it. Here a
	* cancel-all button should stop asking for other cards.
	* Without any anonymous keys the sorting can be skipped.
	*/
	for (k = list; k; k = k->next)
	{
	if (!(k->pubkey_algo == PUBKEY_ALGO_ELGAMAL_E
	\|\| k->pubkey_algo == PUBKEY_ALGO_ECDH
	\|\| k->pubkey_algo == PUBKEY_ALGO_RSA
	\|\| k->pubkey_algo == PUBKEY_ALGO_RSA_E
	\|\| k->pubkey_algo == PUBKEY_ALGO_ELGAMAL))
	continue;

	if (openpgp_pk_test_algo2 (k->pubkey_algo, PUBKEY_USAGE_ENC))
	continue;

	if (sk->pubkey_algo != k->pubkey_algo)
	continue;

	keyid_from_pk (sk, keyid);

	if (!k->keyid[0] && !k->keyid[1])
	{
	if (opt.skip_hidden_recipients)
	continue;

	if (!opt.quiet)
	log_info (_("anonymous recipient; trying secret key %s ...\n"),
	keystr (keyid));
	}
	else if (opt.try_all_secrets
	\|\| (k->keyid[0] == keyid[0] && k->keyid[1] == keyid[1]))
	{
	if (!opt.quiet && !(sk->pubkey_usage & PUBKEY_USAGE_ENC))
	log_info (_("used key is not marked for encryption use.\n"));
	}
	else
	continue;

	err = get_it (ctrl, k, dek, sk, keyid);
	k->result = err;
	if (!err)
	{
	if (!opt.quiet && !k->keyid[0] && !k->keyid[1])
	{
	log_info (_("okay, we are the anonymous recipient.\n"));
	if (!(sk->pubkey_usage & PUBKEY_USAGE_ENC))
	log_info (_("used key is not marked for encryption use.\n")
	);
	}
	search_for_secret_keys = 0;
	break;
	}
	else if (gpg_err_code (err) == GPG_ERR_FULLY_CANCELED)
	{
	search_for_secret_keys = 0;
	break; /* Don't try any more secret keys. */
	}
	}
	}
	enum_secret_keys (ctrl, &enum_context, NULL); /* free context */

	if (gpg_err_code (err) == GPG_ERR_EOF)
	{
	err = gpg_error (GPG_ERR_NO_SECKEY);

	/* Return the last specific error, if any. */
	for (k = list; k; k = k->next)
	if (k->result != -1)
	err = k->result;
	}

	if (DBG_CLOCK)
	log_clock ("get_session_key leave");
	return err;
	}


	static gpg_error_t
	get_it (ctrl_t ctrl,
	struct pubkey_enc_list enc, DEK dek, PKT_public_key sk, u32 keyid)
	{
	gpg_error_t err;
	byte *frame = NULL;
	unsigned int n;
	size_t nframe;
	u16 csum, csum2;
	int padding;
	gcry_sexp_t s_data;
	char *desc;
	char *keygrip;
	byte fp[MAX_FINGERPRINT_LEN];
	- size_t fpn;

	if (DBG_CLOCK)
	log_clock ("decryption start");

	/* Get the keygrip. */
	err = hexkeygrip_from_pk (sk, &keygrip);
	if (err)
	goto leave;

	/* Convert the data to an S-expression. */
	if (sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL
	\|\| sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL_E)
	{
	if (!enc->data[0] \|\| !enc->data[1])
	err = gpg_error (GPG_ERR_BAD_MPI);
	else
	err = gcry_sexp_build (&s_data, NULL, "(enc-val(elg(a%m)(b%m)))",
	enc->data[0], enc->data[1]);
	}
	else if (sk->pubkey_algo == PUBKEY_ALGO_RSA
	\|\| sk->pubkey_algo == PUBKEY_ALGO_RSA_E)
	{
	if (!enc->data[0])
	err = gpg_error (GPG_ERR_BAD_MPI);
	else
	err = gcry_sexp_build (&s_data, NULL, "(enc-val(rsa(a%m)))",
	enc->data[0]);
	}
	else if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
	{
	if (!enc->data[0] \|\| !enc->data[1])
	err = gpg_error (GPG_ERR_BAD_MPI);
	else
	err = gcry_sexp_build (&s_data, NULL, "(enc-val(ecdh(s%m)(e%m)))",
	enc->data[1], enc->data[0]);
	}
	else
	err = gpg_error (GPG_ERR_BUG);

	if (err)
	goto leave;

	if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
	- {
	- fingerprint_from_pk (sk, fp, &fpn);
	- log_assert (fpn == 20);
	- }
	+ fingerprint_from_pk (sk, fp, NULL);

	/* Decrypt. */
	desc = gpg_format_keydesc (ctrl, sk, FORMAT_KEYDESC_NORMAL, 1);
	err = agent_pkdecrypt (NULL, keygrip,
	desc, sk->keyid, sk->main_keyid, sk->pubkey_algo,
	s_data, &frame, &nframe, &padding);
	xfree (desc);
	gcry_sexp_release (s_data);
	if (err)
	goto leave;

	/* Now get the DEK (data encryption key) from the frame
	*
	* Old versions encode the DEK in this format (msb is left):
	*
	* 0 1 DEK(16 bytes) CSUM(2 bytes) 0 RND(n bytes) 2
	*
	* Later versions encode the DEK like this:
	*
	* 0 2 RND(n bytes) 0 A DEK(k bytes) CSUM(2 bytes)
	*
	* (mpi_get_buffer already removed the leading zero).
	*
	* RND are non-zero randow bytes.
	* A is the cipher algorithm
	* DEK is the encryption key (session key) with length k
	* CSUM
	*/
	if (DBG_CRYPTO)
	log_printhex (frame, nframe, "DEK frame:");
	n = 0;

	if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
	{
	gcry_mpi_t decoded;

	/* At the beginning the frame are the bytes of shared point MPI. */
	err = pk_ecdh_decrypt (&decoded, fp, enc->data[1]/encr data as an MPI/,
	frame, nframe, sk->pkey);
	if(err)
	goto leave;

	xfree (frame);
	err = gcry_mpi_aprint (GCRYMPI_FMT_USG, &frame, &nframe, decoded);
	mpi_release (decoded);
	if (err)
	goto leave;

	/* Now the frame are the bytes decrypted but padded session key. */
	if (!nframe \|\| nframe <= 8
	\|\| frame[nframe-1] > nframe)
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}
	nframe -= frame[nframe-1]; /* Remove padding. */
	log_assert (!n); /* (used just below) */
	}
	else
	{
	if (padding)
	{
	if (n + 7 > nframe)
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}

	/* FIXME: Actually the leading zero is required but due to
	* the way we encode the output in libgcrypt as an MPI we
	* are not able to encode that leading zero. However, when
	* using a Smartcard we are doing it the right way and
	* therefore we have to skip the zero. This should be fixed
	* in gpg-agent of course. */
	if (!frame[n])
	n++;

	if (frame[n] == 1 && frame[nframe - 1] == 2)
	{
	log_info (_("old encoding of the DEK is not supported\n"));
	err = gpg_error (GPG_ERR_CIPHER_ALGO);
	goto leave;
	}
	if (frame[n] != 2) /* Something went wrong. */
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}
	for (n++; n < nframe && frame[n]; n++) /* Skip the random bytes. */
	;
	n++; /* Skip the zero byte. */
	}
	}

	if (n + 4 > nframe)
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}

	dek->keylen = nframe - (n + 1) - 2;
	dek->algo = frame[n++];
	err = openpgp_cipher_test_algo (dek->algo);
	if (err)
	{
	if (!opt.quiet && gpg_err_code (err) == GPG_ERR_CIPHER_ALGO)
	{
	log_info (_("cipher algorithm %d%s is unknown or disabled\n"),
	dek->algo,
	dek->algo == CIPHER_ALGO_IDEA ? " (IDEA)" : "");
	}
	dek->algo = 0;
	goto leave;
	}
	if (dek->keylen != openpgp_cipher_get_algo_keylen (dek->algo))
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}

	/* Copy the key to DEK and compare the checksum. */
	csum = buf16_to_u16 (frame+nframe-2);
	memcpy (dek->key, frame + n, dek->keylen);
	for (csum2 = 0, n = 0; n < dek->keylen; n++)
	csum2 += dek->key[n];
	if (csum != csum2)
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}
	if (DBG_CLOCK)
	log_clock ("decryption ready");
	if (DBG_CRYPTO)
	log_printhex (dek->key, dek->keylen, "DEK is:");

	/* Check that the algo is in the preferences and whether it has
	* expired. Also print a status line with the key's fingerprint. */
	{
	PKT_public_key *pk = NULL;
	PKT_public_key *mainpk = NULL;
	KBNODE pkb = get_pubkeyblock (ctrl, keyid);

	if (!pkb)
	{
	err = -1;
	log_error ("oops: public key not found for preference check\n");
	}
	else if (pkb->pkt->pkt.public_key->selfsigversion > 3
	&& dek->algo != CIPHER_ALGO_3DES
	&& !opt.quiet
	&& !is_algo_in_prefs (pkb, PREFTYPE_SYM, dek->algo))
	log_info (_("WARNING: cipher algorithm %s not found in recipient"
	" preferences\n"), openpgp_cipher_algo_name (dek->algo));

	if (!err)
	{
	kbnode_t k;
	int first = 1;

	for (k = pkb; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	u32 aki[2];

	if (first)
	{
	first = 0;
	mainpk = k->pkt->pkt.public_key;
	}

	keyid_from_pk (k->pkt->pkt.public_key, aki);
	if (aki[0] == keyid[0] && aki[1] == keyid[1])
	{
	pk = k->pkt->pkt.public_key;
	break;
	}
	}
	}
	if (!pk)
	BUG ();
	if (pk->expiredate && pk->expiredate <= make_timestamp ())
	{
	log_info (_("Note: secret key %s expired at %s\n"),
	keystr (keyid), asctimestamp (pk->expiredate));
	}
	}

	if (pk && pk->flags.revoked)
	{
	log_info (_("Note: key has been revoked"));
	log_printf ("\n");
	show_revocation_reason (ctrl, pk, 1);
	}

	if (is_status_enabled () && pk && mainpk)
	{
	char pkhex[MAX_FINGERPRINT_LEN*2+1];
	char mainpkhex[MAX_FINGERPRINT_LEN*2+1];

	hexfingerprint (pk, pkhex, sizeof pkhex);
	hexfingerprint (mainpk, mainpkhex, sizeof mainpkhex);

	/* Note that we do not want to create a trustdb just for
	* getting the ownertrust: If there is no trustdb there can't
	* be ulitmately trusted key anyway and thus the ownertrust
	* value is irrelevant. */
	write_status_printf (STATUS_DECRYPTION_KEY, "%s %s %c",
	pkhex, mainpkhex,
	get_ownertrust_info (ctrl, mainpk, 1));

	}

	release_kbnode (pkb);
	err = 0;
	}

	leave:
	xfree (frame);
	xfree (keygrip);
	return err;
	}


	/*
	* Get the session key from the given string.
	* String is supposed to be formatted as this:
	* <algo-id>:<even-number-of-hex-digits>
	*/
	gpg_error_t
	get_override_session_key (DEK dek, const char string)
	{
	const char *s;
	int i;

	if (!string)
	return GPG_ERR_BAD_KEY;
	dek->algo = atoi (string);
	if (dek->algo < 1)
	return GPG_ERR_BAD_KEY;
	if (!(s = strchr (string, ':')))
	return GPG_ERR_BAD_KEY;
	s++;
	for (i = 0; i < DIM (dek->key) && *s; i++, s += 2)
	{
	int c = hextobyte (s);
	if (c == -1)
	return GPG_ERR_BAD_KEY;
	dek->key[i] = c;
	}
	if (*s)
	return GPG_ERR_BAD_KEY;
	dek->keylen = i;
	return 0;
	}

File Metadata

Mime Type: text/x-diff
Expires: Mon, May 12, 6:15 PM (13 h, 17 m)
Storage Engine: local-disk
Storage Format: Raw Data
Storage Handle: 89/2d/d308896d4c4c8bc41494b496eb01

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions