Skip to content

Commit b59c4db

Browse files
TJ-91TJ-91
committed
fixes after rebasing
1 parent 2b2381d commit b59c4db

16 files changed

+101
-153
lines changed

‎src/lib/crypto/ec_curves.cpp‎

Lines changed: 25 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -259,29 +259,38 @@ static const Curve ec_curves[] = {
259259
{PGP_CURVE_ED448,
260260
255,
261261
{0x2B, 0x65, 0x71},
262-
"Ed25519",
263-
"Ed25519",
262+
"Ed448",
263+
"Ed448",
264264
true,
265-
"",
266-
"",
267-
"",
268-
"",
269-
"",
270-
"",
271-
""},
265+
"0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
266+
"FFFFFFFFFFFFFFFFFFFFFFFF",
267+
"0x01",
268+
"0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
269+
"FFFFFFFFFFFFFFFFFFFF6756",
270+
"0x3FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7CCA23E9C44EDB49AED63690216CC272"
271+
"8DC58F552378C292AB5844F3",
272+
"0x4F1970C66BED0DED221D15A622BF36DA9E146570470F1767EA6DE324A3D3A46412AE1AF72AB66511433B80E1"
273+
"8B00938E2626A82BC70CC05E",
274+
"0x693F46716EB6BC248876203756C9C7624BEA73736CA3984087789C1E05A0C2D73AD3FF1CE67C39C4FDBD132C"
275+
"4ED7C8AD9808795BF230FA14",
276+
"0x08"},
272277
{PGP_CURVE_448,
273278
448,
274279
{0x2B, 0x65, 0x6F},
275280
"curve25519",
276281
"Curve25519",
277282
true,
278-
"",
279-
"",
280-
"",
281-
"",
282-
"",
283-
"",
284-
""},
283+
"0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
284+
"FFFFFFFFFFFFFFFFFFFFFFFF",
285+
"0x98A9",
286+
"0x01",
287+
"0x3FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7CCA23E9C44EDB49AED63690216CC272"
288+
"8DC58F552378C292AB5844F3",
289+
"0x0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
290+
"000000000000000000000005",
291+
"0x7D235D1295F5B1F66C98AB6E58326FCECBAE5D34F55545D060F75DC28DF3F6EDB8027E2346430D211312C4B1"
292+
"50677AF76FD7223D457B5B1A",
293+
"0x04"},
285294
#endif
286295
};
287296

‎src/lib/crypto/exdsa_ecdhkem.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ ecdh_kem_public_key_t::botan_key_ecdh(rnp::RNG *rng) const
8080
assert(curve_ >= PGP_CURVE_NIST_P_256 && curve_ <= PGP_CURVE_P256K1);
8181

8282
auto ec_desc = pgp::ec::Curve::get(curve_);
83-
Botan::EC_Group group = Botan::EC_Group::from_name(ec_desc->botan_name);
83+
Botan::EC_Group group = Botan::EC_Group::from_name(ec_desc->botan_name);
8484
return Botan::ECDH_PublicKey(group, Botan::EC_AffinePoint(group, key_).to_legacy_point());
8585
}
8686

@@ -263,7 +263,7 @@ exdsa_public_key_t::botan_key() const
263263
{
264264
// format: 04 | X | Y
265265
auto ec_desc = pgp::ec::Curve::get(curve_);
266-
Botan::EC_Group group = Botan::EC_Group::from_name(ec_desc->botan_name);
266+
Botan::EC_Group group = Botan::EC_Group::from_name(ec_desc->botan_name);
267267
return Botan::ECDSA_PublicKey(group, Botan::EC_AffinePoint(group, key_).to_legacy_point());
268268
}
269269

‎src/lib/crypto/signatures.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@ signature_validate(const pgp::pkt::Signature & sig,
175175
if (!key.sig_hash_allowed(hash.alg())) {
176176
RNP_LOG("The signature's digest size is below the minimum digest size required for "
177177
"that key.");
178-
return RNP_ERROR_SIGNATURE_INVALID;
178+
res.add_error(RNP_ERROR_SIG_HASH_ALG_MISMATCH);
179179
}
180180

181181
/* Finalize hash */

‎src/lib/enc_material.cpp‎

Lines changed: 25 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -180,36 +180,35 @@ X25519EncMaterial::write(pgp_packet_body_t &pkt) const
180180
bool
181181
X448EncMaterial::parse(pgp_packet_body_t &pkt) noexcept
182182
{
183-
auto ec_desc = ec::Curve::get(PGP_CURVE_448);
184-
enc.eph_key.resize(BITS_TO_BYTES(ec_desc->bitlen));
185-
if (!pkt.get(enc.eph_key.data(), enc.eph_key.size())) {
186-
RNP_LOG("failed to parse X448 PKESK (eph. pubkey)");
187-
return false;
188-
}
189-
uint8_t sess_len;
190-
if (!pkt.get(sess_len)) {
191-
RNP_LOG("failed to parse X448 PKESK (enc sesskey length)");
192-
return false;
193-
}
194-
/* get plaintext salg if PKESKv3 */
195-
if (version == PGP_PKSK_V3) {
196-
uint8_t bt = 0;
197-
if (!pkt.get(bt)) {
198-
RNP_LOG("failed to get salg");
199-
return false;
200-
}
201-
sess_len--;
202-
salg = (pgp_symm_alg_t) bt;
203-
}
204-
enc.enc_sess_key.resize(sess_len);
205-
if (!pkt.get(enc.enc_sess_key.data(), sess_len)) {
206-
RNP_LOG("failed to parse X448 PKESK (enc sesskey)");
183+
auto ec_desc = ec::Curve::get(PGP_CURVE_448);
184+
enc.eph_key.resize(BITS_TO_BYTES(ec_desc->bitlen));
185+
if (!pkt.get(enc.eph_key.data(), enc.eph_key.size())) {
186+
RNP_LOG("failed to parse X448 PKESK (eph. pubkey)");
187+
return false;
188+
}
189+
uint8_t sess_len;
190+
if (!pkt.get(sess_len)) {
191+
RNP_LOG("failed to parse X448 PKESK (enc sesskey length)");
192+
return false;
193+
}
194+
/* get plaintext salg if PKESKv3 */
195+
if (version == PGP_PKSK_V3) {
196+
uint8_t bt = 0;
197+
if (!pkt.get(bt)) {
198+
RNP_LOG("failed to get salg");
207199
return false;
208200
}
209-
return true;
201+
sess_len--;
202+
salg = (pgp_symm_alg_t) bt;
203+
}
204+
enc.enc_sess_key.resize(sess_len);
205+
if (!pkt.get(enc.enc_sess_key.data(), sess_len)) {
206+
RNP_LOG("failed to parse X448 PKESK (enc sesskey)");
207+
return false;
208+
}
209+
return true;
210210
}
211211

212-
213212
void
214213
X448EncMaterial::write(pgp_packet_body_t &pkt) const
215214
{

‎src/lib/fingerprint.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,9 +109,9 @@ Fingerprint::size_valid(size_t size) noexcept
109109
return (size == PGP_FINGERPRINT_V4_SIZE) || (size == PGP_FINGERPRINT_V3_SIZE) ||
110110
(size == PGP_FINGERPRINT_V5_SIZE)
111111
#if defined(ENABLE_CRYPTO_REFRESH)
112-
|| PGP_FINGERPRINT_V6_SIZE
112+
|| (size == PGP_FINGERPRINT_V6_SIZE)
113113
#endif
114-
;
114+
;
115115
}
116116

117117
const KeyID &

‎src/lib/generate-key.cpp‎

Lines changed: 0 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -44,61 +44,6 @@ static const uint8_t DEFAULT_COMPRESS_ALGS[] = {
4444
static const uint8_t DEFAULT_AEAD_ALGS[] = {PGP_AEAD_OCB};
4545
#endif
4646

47-
static const id_str_pair pubkey_alg_map[] = {
48-
{PGP_PKA_RSA, "RSA (Encrypt or Sign)"},
49-
{PGP_PKA_RSA_ENCRYPT_ONLY, "RSA Encrypt-Only"},
50-
{PGP_PKA_RSA_SIGN_ONLY, "RSA Sign-Only"},
51-
{PGP_PKA_ELGAMAL, "Elgamal (Encrypt-Only)"},
52-
{PGP_PKA_DSA, "DSA"},
53-
{PGP_PKA_ECDH, "ECDH"},
54-
{PGP_PKA_ECDSA, "ECDSA"},
55-
{PGP_PKA_ELGAMAL_ENCRYPT_OR_SIGN, "Reserved (formerly Elgamal Encrypt or Sign"},
56-
{PGP_PKA_RESERVED_DH, "Reserved for Diffie-Hellman (X9.42)"},
57-
{PGP_PKA_EDDSA, "EdDSA"},
58-
{PGP_PKA_SM2, "SM2"},
59-
#if defined(ENABLE_CRYPTO_REFRESH)
60-
{PGP_PKA_ED25519, "ED25519"},
61-
{PGP_PKA_X25519, "X25519"},
62-
{PGP_PKA_ED448, "ED448"},
63-
{PGP_PKA_X448, "X448"},
64-
#endif
65-
#if defined(ENABLE_PQC)
66-
{PGP_PKA_KYBER768_X25519, "ML-KEM-768_X25519"},
67-
{PGP_PKA_KYBER1024_X448, "ML-KEM-1024_X448"},
68-
{PGP_PKA_KYBER768_P256, "ML-KEM-768_P256"},
69-
{PGP_PKA_KYBER1024_P384, "ML-KEM-1024_P384"},
70-
{PGP_PKA_KYBER768_BP256, "ML-KEM-768_BP256"},
71-
{PGP_PKA_KYBER1024_BP384, "ML-KEM-1024_BP384"},
72-
{PGP_PKA_DILITHIUM3_ED25519, "ML-DSA-65_ED25519"},
73-
{PGP_PKA_DILITHIUM5_ED448, "ML-DSA-87_ED448"},
74-
{PGP_PKA_DILITHIUM3_P256, "ML-DSA-65_P256"},
75-
{PGP_PKA_DILITHIUM5_P384, "ML-DSA-87_P384"},
76-
{PGP_PKA_DILITHIUM3_BP256, "ML-DSA-65_BP256"},
77-
{PGP_PKA_DILITHIUM5_BP384, "ML-DSA-87_BP384"},
78-
{PGP_PKA_SPHINCSPLUS_SHAKE_128f, "SLH-DSA-SHAKE-128f"},
79-
{PGP_PKA_SPHINCSPLUS_SHAKE_128s, "SLH-DSA-SHAKE-128s"},
80-
{PGP_PKA_SPHINCSPLUS_SHAKE_256s, "SLH-DSA-SHAKE-256s"},
81-
{PGP_PKA_PRIVATE00, "Private/Experimental"},
82-
{PGP_PKA_PRIVATE01, "Private/Experimental"},
83-
{PGP_PKA_PRIVATE02, "Private/Experimental"},
84-
{PGP_PKA_PRIVATE03, "Private/Experimental"},
85-
{PGP_PKA_PRIVATE04, "Private/Experimental"},
86-
{PGP_PKA_PRIVATE10, "Private/Experimental"},
87-
#else
88-
{PGP_PKA_PRIVATE00, "Private/Experimental"},
89-
{PGP_PKA_PRIVATE01, "Private/Experimental"},
90-
{PGP_PKA_PRIVATE02, "Private/Experimental"},
91-
{PGP_PKA_PRIVATE03, "Private/Experimental"},
92-
{PGP_PKA_PRIVATE04, "Private/Experimental"},
93-
{PGP_PKA_PRIVATE05, "Private/Experimental"},
94-
{PGP_PKA_PRIVATE06, "Private/Experimental"},
95-
{PGP_PKA_PRIVATE07, "Private/Experimental"},
96-
{PGP_PKA_PRIVATE08, "Private/Experimental"},
97-
{PGP_PKA_PRIVATE09, "Private/Experimental"},
98-
{PGP_PKA_PRIVATE10, "Private/Experimental"},
99-
#endif
100-
{0, NULL}};
101-
10247
static bool
10348
load_generated_g10_key(pgp_key_t * dst,
10449
pgp_key_pkt_t * newkey,

‎src/lib/key.cpp‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -115,15 +115,6 @@ pgp_decrypt_seckey(const Key & key,
115115
}
116116
}
117117

118-
static const id_str_pair ss_rr_code_map[] = {
119-
{PGP_REVOCATION_NO_REASON, "No reason specified"},
120-
{PGP_REVOCATION_SUPERSEDED, "Key is superseded"},
121-
{PGP_REVOCATION_COMPROMISED, "Key material has been compromised"},
122-
{PGP_REVOCATION_RETIRED, "Key is retired and no longer used"},
123-
{PGP_REVOCATION_NO_LONGER_VALID, "User ID information is no longer valid"},
124-
{0x00, NULL},
125-
};
126-
127118
bool
128119
Key::write_sec_pgp(pgp_dest_t & dst,
129120
pgp_key_pkt_t & seckey,

‎src/lib/key.hpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -142,8 +142,8 @@ class Key {
142142
bool can_encrypt() const noexcept;
143143
bool has_secret() const noexcept;
144144
#if defined(ENABLE_PQC)
145-
bool is_pqc() const noexcept;
146-
static bool is_pqc_alg(pgp_pubkey_alg_t alg);
145+
bool is_pqc() const noexcept;
146+
static bool is_pqc_alg(pgp_pubkey_alg_t alg);
147147
#endif
148148
/**
149149
* @brief Check whether key is usable for the specified operation.

‎src/lib/key_material.hpp‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -472,12 +472,12 @@ class Ed25519KeyMaterial : public KeyMaterial {
472472
void write(pgp_packet_body_t &pkt) const override;
473473
void write_secret(pgp_packet_body_t &pkt) const override;
474474
bool generate(rnp::SecurityContext &ctx, const KeyParams &params) override;
475-
rnp_result_t verify(const rnp::SecurityContext & ctx,
476-
const pgp_signature_material_t & sig,
477-
const rnp::secure_vector<uint8_t> &hash) const override;
478-
rnp_result_t sign(rnp::SecurityContext & ctx,
479-
pgp_signature_material_t & sig,
480-
const rnp::secure_vector<uint8_t> &hash) const override;
475+
rnp_result_t verify(const rnp::SecurityContext &ctx,
476+
const SigMaterial & sig,
477+
const rnp::secure_bytes & hash) const override;
478+
rnp_result_t sign(rnp::SecurityContext & ctx,
479+
SigMaterial & sig,
480+
const rnp::secure_bytes &hash) const override;
481481
pgp_hash_alg_t adjust_hash(pgp_hash_alg_t hash) const override;
482482
bool sig_hash_allowed(pgp_hash_alg_t hash) const override;
483483
size_t bits() const noexcept override;
@@ -534,12 +534,12 @@ class Ed448KeyMaterial : public KeyMaterial {
534534
void write(pgp_packet_body_t &pkt) const override;
535535
void write_secret(pgp_packet_body_t &pkt) const override;
536536
bool generate(rnp::SecurityContext &ctx, const KeyParams &params) override;
537-
rnp_result_t verify(const rnp::SecurityContext & ctx,
538-
const pgp_signature_material_t & sig,
539-
const rnp::secure_vector<uint8_t> &hash) const override;
540-
rnp_result_t sign(rnp::SecurityContext & ctx,
541-
pgp_signature_material_t & sig,
542-
const rnp::secure_vector<uint8_t> &hash) const override;
537+
rnp_result_t verify(const rnp::SecurityContext &ctx,
538+
const SigMaterial & sig,
539+
const rnp::secure_bytes & hash) const override;
540+
rnp_result_t sign(rnp::SecurityContext & ctx,
541+
SigMaterial & sig,
542+
const rnp::secure_bytes &hash) const override;
543543
pgp_hash_alg_t adjust_hash(pgp_hash_alg_t hash) const override;
544544
bool sig_hash_allowed(pgp_hash_alg_t hash) const override;
545545

@@ -630,12 +630,12 @@ class DilithiumEccKeyMaterial : public KeyMaterial {
630630
void write(pgp_packet_body_t &pkt) const override;
631631
void write_secret(pgp_packet_body_t &pkt) const override;
632632
bool generate(rnp::SecurityContext &ctx, const KeyParams &params) override;
633-
rnp_result_t verify(const rnp::SecurityContext & ctx,
634-
const pgp_signature_material_t & sig,
635-
const rnp::secure_vector<uint8_t> &hash) const override;
636-
rnp_result_t sign(rnp::SecurityContext & ctx,
637-
pgp_signature_material_t & sig,
638-
const rnp::secure_vector<uint8_t> &hash) const override;
633+
rnp_result_t verify(const rnp::SecurityContext &ctx,
634+
const SigMaterial & sig,
635+
const rnp::secure_bytes & hash) const override;
636+
rnp_result_t sign(rnp::SecurityContext & ctx,
637+
SigMaterial & sig,
638+
const rnp::secure_bytes &hash) const override;
639639
pgp_hash_alg_t adjust_hash(pgp_hash_alg_t hash) const override;
640640
bool sig_hash_allowed(pgp_hash_alg_t hash) const override;
641641
size_t bits() const noexcept override;
@@ -661,12 +661,12 @@ class SlhdsaKeyMaterial : public KeyMaterial {
661661
void write(pgp_packet_body_t &pkt) const override;
662662
void write_secret(pgp_packet_body_t &pkt) const override;
663663
bool generate(rnp::SecurityContext &ctx, const KeyParams &params) override;
664-
rnp_result_t verify(const rnp::SecurityContext & ctx,
665-
const pgp_signature_material_t & sig,
666-
const rnp::secure_vector<uint8_t> &hash) const override;
667-
rnp_result_t sign(rnp::SecurityContext & ctx,
668-
pgp_signature_material_t & sig,
669-
const rnp::secure_vector<uint8_t> &hash) const override;
664+
rnp_result_t verify(const rnp::SecurityContext &ctx,
665+
const SigMaterial & sig,
666+
const rnp::secure_bytes & hash) const override;
667+
rnp_result_t sign(rnp::SecurityContext & ctx,
668+
SigMaterial & sig,
669+
const rnp::secure_bytes &hash) const override;
670670
pgp_hash_alg_t adjust_hash(pgp_hash_alg_t hash) const override;
671671
bool sig_hash_allowed(pgp_hash_alg_t hash) const override;
672672
size_t bits() const noexcept override;

‎src/lib/sec_profile.cpp‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -204,8 +204,9 @@ SecurityContext::SecurityContext() : time_(0), prov_state_(NULL), rng(RNG::Type:
204204
profile.add_rule(
205205
{FeatureType::Cipher, PGP_SA_BLOWFISH, SecurityLevel::Insecure, 1727730000});
206206
#if defined(ENABLE_CRYPTO_REFRESH)
207-
/* Mark RIPEMD insecure */
208-
profile.add_rule({FeatureType::Hash, PGP_HASH_RIPEMD, SecurityLevel::Insecure, 1727730000});
207+
/* Mark RIPEMD insecure since 2024-01-19 by default */
208+
profile.add_rule(
209+
{FeatureType::Hash, PGP_HASH_RIPEMD, SecurityLevel::Insecure, 1705629600});
209210
#endif
210211
}
211212

0 commit comments

Comments
 (0)