Accepting request 1029595 from Base:System
OBS-URL: https://build.opensuse.org/request/show/1029595 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/gpg2?expand=0&rev=163devel
Dominique Leuenberger
8 months ago
committed by
Git OBS Bridge
commit
3b336f0774
@ -1,61 +0,0 @@
|
||||
From f34b9147eb3070bce80d53febaa564164cd6c977 Mon Sep 17 00:00:00 2001
|
||||
From: NIIBE Yutaka <gniibe@fsij.org>
|
||||
Date: Wed, 13 Jul 2022 10:40:55 +0900
|
||||
Subject: [PATCH] scd:openpgp: Fix workaround for Yubikey heuristics.
|
||||
References: https://bugzilla.opensuse.org/show_bug.cgi?id=1202201
|
||||
|
||||
* scd/app-openpgp.c (parse_algorithm_attribute): Handle the case
|
||||
of firmware 5.4, too.
|
||||
|
||||
--
|
||||
|
||||
GnuPG-bug-id: 6070
|
||||
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
|
||||
---
|
||||
scd/app-openpgp.c | 29 +++++++++++++++++++++--------
|
||||
1 file changed, 21 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
|
||||
index 8bb346a86..4667416df 100644
|
||||
--- a/scd/app-openpgp.c
|
||||
+++ b/scd/app-openpgp.c
|
||||
@@ -6259,15 +6259,28 @@ parse_algorithm_attribute (app_t app, int keyno)
|
||||
app->app_local->keyattr[keyno].ecc.algo = *buffer;
|
||||
app->app_local->keyattr[keyno].ecc.flags = 0;
|
||||
|
||||
- if (APP_CARD(app)->cardtype == CARDTYPE_YUBIKEY
|
||||
- || buffer[buflen-1] == 0x00 || buffer[buflen-1] == 0xff)
|
||||
- { /* Found "pubkey required"-byte for private key template. */
|
||||
- oidlen--;
|
||||
- if (buffer[buflen-1] == 0xff)
|
||||
- app->app_local->keyattr[keyno].ecc.flags |= ECC_FLAG_PUBKEY;
|
||||
+ if (APP_CARD(app)->cardtype == CARDTYPE_YUBIKEY)
|
||||
+ {
|
||||
+ /* Yubikey implementations vary.
|
||||
+ * Firmware version 5.2 returns "pubkey required"-byte with
|
||||
+ * 0x00, but after removal and second time insertion, it
|
||||
+ * returns bogus value there.
|
||||
+ * Firmware version 5.4 returns none.
|
||||
+ */
|
||||
+ curve = ecc_curve (buffer + 1, oidlen);
|
||||
+ if (!curve)
|
||||
+ curve = ecc_curve (buffer + 1, oidlen - 1);
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ if (buffer[buflen-1] == 0x00 || buffer[buflen-1] == 0xff)
|
||||
+ { /* Found "pubkey required"-byte for private key template. */
|
||||
+ oidlen--;
|
||||
+ if (buffer[buflen-1] == 0xff)
|
||||
+ app->app_local->keyattr[keyno].ecc.flags |= ECC_FLAG_PUBKEY;
|
||||
+ }
|
||||
+ curve = ecc_curve (buffer + 1, oidlen);
|
||||
}
|
||||
-
|
||||
- curve = ecc_curve (buffer + 1, oidlen);
|
||||
|
||||
if (!curve)
|
||||
{
|
||||
--
|
||||
2.37.1
|
||||
|
||||
@ -1,3 +0,0 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:ee163a5fb9ec99ffc1b18e65faef8d086800c5713d15a672ab57d3799da83669
|
||||
size 7599853
|
||||
Binary file not shown.
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:540b7a40e57da261fb10ef521a282e0021532a80fd023e75fb71757e8a4969ed
|
||||
size 7644926
|
||||
Binary file not shown.
@ -1,34 +1,18 @@
|
||||
Index: gnupg-2.1.1/g10/encrypt.c
|
||||
Index: gnupg-2.3.8/g10/mainproc.c
|
||||
===================================================================
|
||||
--- gnupg-2.1.1.orig/g10/encrypt.c
|
||||
+++ gnupg-2.1.1/g10/encrypt.c
|
||||
@@ -783,7 +783,10 @@ encrypt_filter (void *opaque, int contro
|
||||
/* Because 3DES is implicitly in the prefs, this can
|
||||
only happen if we do not have any public keys in
|
||||
the list. */
|
||||
- efx->cfx.dek->algo = DEFAULT_CIPHER_ALGO;
|
||||
+ /* Libgcrypt manual says that gcry_version_check must be called
|
||||
+ before calling gcry_fips_mode_active. */
|
||||
+ gcry_check_version (NULL);
|
||||
+ efx->cfx.dek->algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : DEFAULT_CIPHER_ALGO;
|
||||
}
|
||||
|
||||
/* In case 3DES has been selected, print a warning if
|
||||
Index: gnupg-2.1.1/g10/mainproc.c
|
||||
===================================================================
|
||||
--- gnupg-2.1.1.orig/g10/mainproc.c
|
||||
+++ gnupg-2.1.1/g10/mainproc.c
|
||||
@@ -719,7 +719,12 @@ proc_plaintext( CTX c, PACKET *pkt )
|
||||
--- gnupg-2.3.8.orig/g10/mainproc.c
|
||||
+++ gnupg-2.3.8/g10/mainproc.c
|
||||
@@ -1011,7 +1011,12 @@ proc_plaintext( CTX c, PACKET *pkt )
|
||||
according to 2440, so hopefully it won't come up that often.
|
||||
There is no good way to specify what algorithms to use in
|
||||
that case, so these there are the historical answer. */
|
||||
- gcry_md_enable (c->mfx.md, DIGEST_ALGO_RMD160);
|
||||
+
|
||||
+ /* Libgcrypt manual says that gcry_version_check must be called
|
||||
+ before calling gcry_fips_mode_active. */
|
||||
+ * before calling gcry_fips_mode_active. */
|
||||
+ gcry_check_version (NULL);
|
||||
+ if( !gcry_fips_mode_active() )
|
||||
+ gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 );
|
||||
+ if(!gcry_fips_mode_active())
|
||||
+ gcry_md_enable(c->mfx.md, DIGEST_ALGO_RMD160);
|
||||
gcry_md_enable (c->mfx.md, DIGEST_ALGO_SHA1);
|
||||
}
|
||||
if (DBG_HASHING)
|
||||
|
||||
Loading…
Reference in New Issue