Home GnuPG
Diffusion GnuPG 825dd7220ff6

gpg: Do not allow old cipher algorithms for encryption.

Description

gpg: Do not allow old cipher algorithms for encryption.

* g10/gpg.c: New option --allow-old-cipher-algos.
(set_compliance_option): Set --rfc4880bis explictly to SHA256 and
AES256.  Allow old cipher algos for OpenPGP, rfc4880, and rfc2440.
* g10/options.h (opt): Add flags.allow_old_cipher_algos.
* g10/misc.c (print_sha1_keysig_rejected_note): Always print the note
unless in --quiet mode.
* g10/encrypt.c (setup_symkey): Disallow by default algos with a
blocklengt < 128.
(encrypt_crypt): Ditto.  Fallback by default to AES instead of 3DES.
* g10/pkclist.c (algo_available): Take care of old cipher also.
(select_algo_from_prefs): Use AES as implicit algorithm by default.
* tests/openpgp/defs.scm (create-gpghome): Set allow-old-cipher-algos.

Details

Provenance
wernerAuthored on Feb 10 2021, 2:31 PM
Parents
rG6e730c18816f: Remove obsolete M4 macros.
Branches
Unknown
Tags
Unknown
Tasks
T3415: GnuPG should refuse to encrypt using 64-bit block ciphers by default