Merged jnlib into common.

[gnupg.git] / g10 / card-util.c

diff --git a/g10/card-util.c b/g10/card-util.c
index 9295a17..9bd5013 100644 (file)
--- a/g10/card-util.c
+++ b/g10/card-util.c
@@ -1,5 +1,5 @@
 /* card-util.c - Utility functions for the OpenPGP card.
 /* card-util.c - Utility functions for the OpenPGP card.

- *     Copyright (C) 2003, 2004, 2005 Free Software Foundation, Inc.
+ * Copyright (C) 2003, 2004, 2005, 2009 Free Software Foundation, Inc.

  *
  * This file is part of GnuPG.
  *
  *
  * This file is part of GnuPG.
  *


@@ -23,6 +23,10 @@
 #include <string.h>
 #include <errno.h>
 #include <assert.h>
 #include <string.h>
 #include <errno.h>
 #include <assert.h>

+#ifdef HAVE_LIBREADLINE
+# define GNUPG_LIBREADLINE_H_INCLUDED
+# include <readline/readline.h>
+#endif /*HAVE_LIBREADLINE*/

 
 #if GNUPG_MAJOR_VERSION != 1
 # include "gpg.h"
 
 #if GNUPG_MAJOR_VERSION != 1
 # include "gpg.h"


@@ -34,12 +38,8 @@
 #include "options.h"
 #include "main.h"
 #include "keyserver-internal.h"
 #include "options.h"
 #include "main.h"
 #include "keyserver-internal.h"

+

 #if GNUPG_MAJOR_VERSION == 1
 #if GNUPG_MAJOR_VERSION == 1

-# ifdef HAVE_LIBREADLINE
-# define GNUPG_LIBREADLINE_H_INCLUDED
-# include <stdio.h>
-# include <readline/readline.h>
-# endif /*HAVE_LIBREADLINE*/

 # include "cardglue.h"
 #else /*GNUPG_MAJOR_VERSION!=1*/
 # include "call-agent.h"
 # include "cardglue.h"
 #else /*GNUPG_MAJOR_VERSION!=1*/
 # include "call-agent.h"


@@ -948,7 +948,7 @@ change_cert (const char *args)
     }
   else
     {
     }
   else
     {

-      tty_printf ("usage error: redirectrion to file required\n");
+      tty_printf ("usage error: redirection to file required\n");

       return -1;
     }
 
       return -1;
     }
 


@@ -977,7 +977,7 @@ read_cert (const char *args)
     }
   else
     {
     }
   else
     {

-      tty_printf ("usage error: redirectrion to file required\n");
+      tty_printf ("usage error: redirection to file required\n");

       return -1;
     }
 
       return -1;
     }
 


@@ -1156,6 +1156,10 @@ get_info_for_key_operation (struct agent_card_info_s *info)
     rc = agent_scd_getattr ("CHV-STATUS", info);
   if (!rc)
     rc = agent_scd_getattr ("DISP-NAME", info);
     rc = agent_scd_getattr ("CHV-STATUS", info);
   if (!rc)
     rc = agent_scd_getattr ("DISP-NAME", info);

+  if (!rc)
+    rc = agent_scd_getattr ("EXTCAP", info);
+  if (!rc)
+    rc = agent_scd_getattr ("KEY-ATTR", info);

   if (rc)
     log_error (_("error getting current key info: %s\n"), gpg_strerror (rc));
   return rc;
   if (rc)
     log_error (_("error getting current key info: %s\n"), gpg_strerror (rc));
   return rc;


@@ -1252,46 +1256,135 @@ replace_existing_key_p (struct agent_card_info_s *info, int keyno)
 
 
 static void
 
 
 static void

+show_keysize_warning (void)
+{
+  static int shown;
+
+  if (shown)
+    return;
+  shown = 1;
+  tty_printf
+    (_("NOTE: There is no guarantee that the card "
+       "supports the requested size.\n"
+       "      If the key generation does not succeed, "
+       "please check the\n"
+       "      documentation of your card to see what "
+       "sizes are allowed.\n"));
+}
+
+
+/* Ask for the size of a card key.  NBITS is the current size
+   configured for the card.  KEYNO is the number of the key used to
+   select the prompt.  Returns 0 to use the default size (i.e. NBITS)
+   or the selected size.  */
+static unsigned int
+ask_card_keysize (int keyno, unsigned int nbits)
+{
+  unsigned int min_nbits = 1024;
+  unsigned int max_nbits = 3072; /* GnuPG limit due to Assuan.  */
+  char *prompt, *answer;
+  unsigned int req_nbits;
+
+  for (;;)
+    {
+      prompt = xasprintf 
+        (keyno == 0?
+         _("What keysize do you want for the Signature key? (%u) "):
+         keyno == 1?
+         _("What keysize do you want for the Encryption key? (%u) "):
+         _("What keysize do you want for the Authentication key? (%u) "),
+         nbits);
+      answer = cpr_get ("cardedit.genkeys.size", prompt);
+      cpr_kill_prompt ();
+      req_nbits = *answer? atoi (answer): nbits;
+      xfree (prompt);
+      xfree (answer);
+      
+      if (req_nbits != nbits && (req_nbits % 32) )
+        {
+          req_nbits = ((req_nbits + 31) / 32) * 32;
+          tty_printf (_("rounded up to %u bits\n"), req_nbits);
+        }
+  
+      if (req_nbits == nbits)
+        return 0;  /* Use default.  */
+      
+      if (req_nbits < min_nbits || req_nbits > max_nbits)
+        {
+          tty_printf (_("%s keysizes must be in the range %u-%u\n"),
+                      "RSA", min_nbits, max_nbits);
+        }
+      else
+        {
+          tty_printf (_("The card will now be re-configured "
+                        "to generate a key of %u bits\n"), req_nbits);
+          show_keysize_warning ();
+          return req_nbits;
+        }
+    }
+}
+
+
+/* Change the size of key KEYNO (0..2) to NBITS and show an error
+   message if that fails.  */
+static gpg_error_t
+do_change_keysize (int keyno, unsigned int nbits) 
+{
+  gpg_error_t err;
+  char args[100];
+  
+  snprintf (args, sizeof args, "--force %d 1 %u", keyno+1, nbits);
+  err = agent_scd_setattr ("KEY-ATTR", args, strlen (args), NULL);
+  if (err)
+    log_error (_("error changing size of key %d to %u bits: %s\n"), 
+               keyno+1, nbits, gpg_strerror (err));
+  return err;
+}
+ 
+
+static void

 generate_card_keys (void)
 {
   struct agent_card_info_s info;
   int forced_chv1;
   int want_backup;
 generate_card_keys (void)
 {
   struct agent_card_info_s info;
   int forced_chv1;
   int want_backup;

+  int keyno;

 
   if (get_info_for_key_operation (&info))
     return;
 
 
   if (get_info_for_key_operation (&info))
     return;
 

-#if GNUPG_MAJOR_VERSION == 1
-  {
-    char *answer=cpr_get("cardedit.genkeys.backup_enc",
-                        _("Make off-card backup of encryption key? (Y/n) "));
+  if (info.extcap.ki)
+    {
+      char *answer;

 
 

-    want_backup=answer_is_yes_no_default(answer,1);
-    cpr_kill_prompt();
-    xfree(answer);
-  }
-#else
-  want_backup = cpr_get_answer_is_yes 
-                  ( "cardedit.genkeys.backup_enc",
-                    _("Make off-card backup of encryption key? (Y/n) "));
-  /*FIXME: we need answer_is_yes_no_default()*/
-#endif
+      answer = cpr_get ("cardedit.genkeys.backup_enc",
+                        _("Make off-card backup of encryption key? (Y/n) "));
+
+      want_backup = answer_is_yes_no_default (answer, 1/*(default to Yes)*/);
+      cpr_kill_prompt ();
+      xfree (answer);
+    }
+  else
+    want_backup = 0;

 
   if ( (info.fpr1valid && !fpr_is_zero (info.fpr1))
        || (info.fpr2valid && !fpr_is_zero (info.fpr2))
        || (info.fpr3valid && !fpr_is_zero (info.fpr3)))
     {
       tty_printf ("\n");
 
   if ( (info.fpr1valid && !fpr_is_zero (info.fpr1))
        || (info.fpr2valid && !fpr_is_zero (info.fpr2))
        || (info.fpr3valid && !fpr_is_zero (info.fpr3)))
     {
       tty_printf ("\n");

-      log_info ("NOTE: keys are already stored on the card!\n");
+      log_info (_("NOTE: keys are already stored on the card!\n"));

       tty_printf ("\n");
       tty_printf ("\n");

-      if ( !cpr_get_answer_is_yes( "cardedit.genkeys.replace_keys",
-                                  _("Replace existing keys? (y/N) ")))
+      if ( !cpr_get_answer_is_yes ("cardedit.genkeys.replace_keys",
+                                   _("Replace existing keys? (y/N) ")))

         {
           agent_release_card_info (&info);
           return;
         }
     }
         {
           agent_release_card_info (&info);
           return;
         }
     }

-  else if (!info.disp_name || !*info.disp_name)
+
+  /* If no displayed name has been set, we assume that this is a fresh
+     card and print a hint about the default PINs.  */
+  if (!info.disp_name || !*info.disp_name)

     {
       tty_printf ("\n");
       tty_printf (_("Please note that the factory settings of the PINs are\n"
     {
       tty_printf ("\n");
       tty_printf (_("Please note that the factory settings of the PINs are\n"


@@ -1303,9 +1396,31 @@ generate_card_keys (void)
 
   if (check_pin_for_key_operation (&info, &forced_chv1))
     goto leave;
 
   if (check_pin_for_key_operation (&info, &forced_chv1))
     goto leave;

-  
-  generate_keypair (NULL, info.serialno,
-                    want_backup? opt.homedir:NULL);
+
+  /* If the cards features changeable key attributes, we ask for the
+     key size.  */
+  if (info.is_v2 && info.extcap.aac)
+    {
+      unsigned int nbits;
+
+      for (keyno = 0; keyno < DIM (info.key_attr); keyno++)
+        {
+          nbits = ask_card_keysize (keyno, info.key_attr[keyno].nbits);
+          if (nbits && do_change_keysize (keyno, nbits))
+            {
+              /* Error: Better read the default key size again.  */
+              agent_release_card_info (&info);
+              if (get_info_for_key_operation (&info))
+                goto leave;
+              /* Ask again for this key size. */
+              keyno--;
+            }
+        }
+      /* Note that INFO has not be synced.  However we will only use
+         the serialnumber and thus it won't harm.  */
+    }
+     
+  generate_keypair (NULL, info.serialno, want_backup? opt.homedir:NULL);

 
  leave:
   agent_release_card_info (&info);
 
  leave:
   agent_release_card_info (&info);


@@ -1357,6 +1472,26 @@ card_generate_subkey (KBNODE pub_keyblock, KBNODE sec_keyblock)
   if (check_pin_for_key_operation (&info, &forced_chv1))
     goto leave;
 
   if (check_pin_for_key_operation (&info, &forced_chv1))
     goto leave;
 

+  /* If the cards features changeable key attributes, we ask for the
+     key size.  */
+  if (info.is_v2 && info.extcap.aac)
+    {
+      unsigned int nbits;
+
+    ask_again:
+      nbits = ask_card_keysize (keyno-1, info.key_attr[keyno-1].nbits);
+      if (nbits && do_change_keysize (keyno-1, nbits))
+        {
+          /* Error: Better read the default key size again.  */
+          agent_release_card_info (&info);
+          if (get_info_for_key_operation (&info))
+            goto leave;
+          goto ask_again;
+        }
+      /* Note that INFO has not be synced.  However we will only use
+         the serialnumber and thus it won't harm.  */
+    }
+

   okay = generate_card_subkeypair (pub_keyblock, sec_keyblock,
                                    keyno, info.serialno);
 
   okay = generate_card_subkeypair (pub_keyblock, sec_keyblock,
                                    keyno, info.serialno);
 


@@ -1383,6 +1518,8 @@ card_store_subkey (KBNODE node, int use)
   size_t n;
   const char *s;
   int allow_keyno[3];
   size_t n;
   const char *s;
   int allow_keyno[3];

+  unsigned int nbits;
+

 
   assert (node->pkt->pkttype == PKT_SECRET_KEY
           || node->pkt->pkttype == PKT_SECRET_SUBKEY);
 
   assert (node->pkt->pkttype == PKT_SECRET_KEY
           || node->pkt->pkttype == PKT_SECRET_SUBKEY);


@@ -1391,9 +1528,18 @@ card_store_subkey (KBNODE node, int use)
   if (get_info_for_key_operation (&info))
     return 0;
 
   if (get_info_for_key_operation (&info))
     return 0;
 

+  if (!info.extcap.ki)
+    {
+      tty_printf ("The card does not support the import of keys\n");
+      tty_printf ("\n");
+      goto leave;
+    }
+

   show_card_key_info (&info);
 
   show_card_key_info (&info);
 

-  if (!is_RSA (sk->pubkey_algo) || nbits_from_sk (sk) != 1024 )
+  nbits = nbits_from_sk (sk);
+
+  if (!is_RSA (sk->pubkey_algo) || (!info.is_v2 && nbits != 1024) )

     {
       tty_printf ("You may only store a 1024 bit RSA key on the card\n");
       tty_printf ("\n");
     {
       tty_printf ("You may only store a 1024 bit RSA key on the card\n");
       tty_printf ("\n");


@@ -1426,8 +1572,17 @@ card_store_subkey (KBNODE node, int use)
       keyno = *answer? atoi(answer): 0;
       xfree(answer);
       if (keyno >= 1 && keyno <= 3 && allow_keyno[keyno-1])
       keyno = *answer? atoi(answer): 0;
       xfree(answer);
       if (keyno >= 1 && keyno <= 3 && allow_keyno[keyno-1])

-        break; /* Okay. */
-      tty_printf(_("Invalid selection.\n"));
+        {
+          if (info.is_v2 && !info.extcap.aac 
+              && info.key_attr[keyno-1].nbits != nbits)
+            {
+              tty_printf ("Key does not match the card's capability.\n");
+            }
+          else
+            break; /* Okay. */
+        }
+      else
+        tty_printf(_("Invalid selection.\n"));

     }
 
   if (replace_existing_key_p (&info, keyno))
     }
 
   if (replace_existing_key_p (&info, keyno))


@@ -1461,7 +1616,10 @@ card_store_subkey (KBNODE node, int use)
 
   rc = save_unprotected_key_to_card (sk, keyno);
   if (rc)
 
   rc = save_unprotected_key_to_card (sk, keyno);
   if (rc)

-    goto leave;
+    {
+      log_error (_("error writing key to card: %s\n"), gpg_strerror (rc));
+      goto leave;
+    }

 
   /* Get back to the maybe protected original secret key.  */
   if (copied_sk)
 
   /* Get back to the maybe protected original secret key.  */
   if (copied_sk)


@@ -1546,7 +1704,7 @@ static struct
   };
 
 
   };
 
 

-#if GNUPG_MAJOR_VERSION == 1 && defined (HAVE_LIBREADLINE)
+#ifdef HAVE_LIBREADLINE

 
 /* These two functions are used by readline for command completion. */
 
 
 /* These two functions are used by readline for command completion. */
 


@@ -1579,6 +1737,7 @@ command_generator(const char *text,int state)
 static char **
 card_edit_completion(const char *text, int start, int end)
 {
 static char **
 card_edit_completion(const char *text, int start, int end)
 {

+  (void)end;

   /* If we are at the start of a line, we try and command-complete.
      If not, just do nothing for now. */
 
   /* If we are at the start of a line, we try and command-complete.
      If not, just do nothing for now. */
 


@@ -1589,7 +1748,7 @@ card_edit_completion(const char *text, int start, int end)
 
   return NULL;
 }
 
   return NULL;
 }

-#endif /* GNUPG_MAJOR_VERSION == 1 && HAVE_LIBREADLINE */
+#endif /*HAVE_LIBREADLINE*/

 
 /* Menu to edit all user changeable values on an OpenPGP card.  Only
    Key creation is not handled here. */
 
 /* Menu to edit all user changeable values on an OpenPGP card.  Only
    Key creation is not handled here. */


@@ -1600,7 +1759,7 @@ card_edit (strlist_t commands)
   int have_commands = !!commands;
   int redisplay = 1;
   char *answer = NULL;
   int have_commands = !!commands;
   int redisplay = 1;
   char *answer = NULL;

-  int did_checkpin = 0, allow_admin=0;
+  int allow_admin=0;

   char serialnobuf[50];
 
 
   char serialnobuf[50];
 
 


@@ -1657,15 +1816,11 @@ card_edit (strlist_t commands)
 
            if (!have_commands)
               {
 
            if (!have_commands)
               {

-#if GNUPG_MAJOR_VERSION == 1

                tty_enable_completion (card_edit_completion);
                tty_enable_completion (card_edit_completion);

-#endif
-               answer = cpr_get_no_help("cardedit.prompt", _("Command> "));
+               answer = cpr_get_no_help("cardedit.prompt", _("gpg/card> "));

                cpr_kill_prompt();
                cpr_kill_prompt();

-#if GNUPG_MAJOR_VERSION == 1

                tty_disable_completion ();
                tty_disable_completion ();

-#endif
-           }
+              }

            trim_spaces(answer);
        }
       while ( *answer == '#' );
            trim_spaces(answer);
        }
       while ( *answer == '#' );


@@ -1812,12 +1967,10 @@ card_edit (strlist_t commands)
 
         case cmdPASSWD:
           change_pin (0, allow_admin);
 
         case cmdPASSWD:
           change_pin (0, allow_admin);

-          did_checkpin = 0; /* Need to reset it of course. */

           break;
 
         case cmdUNBLOCK:
           change_pin (1, allow_admin);
           break;
 
         case cmdUNBLOCK:
           change_pin (1, allow_admin);

-          did_checkpin = 0; /* Need to reset it of course. */

           break;
 
         case cmdQUIT:
           break;
 
         case cmdQUIT: