gpg,sm: New option --with-key-screening.
authorWerner Koch <wk@gnupg.org>
Tue, 17 Oct 2017 19:10:19 +0000 (21:10 +0200)
committerWerner Koch <wk@gnupg.org>
Tue, 17 Oct 2017 19:10:19 +0000 (21:10 +0200)
commit825abec0e7f38667a34dce3025fc2f3a05001dde
tree8508d92f6b68271377353c15756cec57f03fc694
parent69e579d78545aee5096a5d170e1cb9e511a09a90
gpg,sm: New option --with-key-screening.

* common/pkscreening.c: New.
* common/pkscreening.h: New.
* common/Makefile.am (common_sources): Add them.
* g10/gpg.c (opts): New option --with-key-screening.
* g10/options.h (struct opt): New field with_key_screening.
* g10/keylist.c: Include pkscreening.h.
(print_pk_screening): New.
(list_keyblock_print): Call it.
(print_compliance_flags): Call it.
* sm/gpgsm.c (opts): New option --with-key-screening.
* sm/gpgsm.h (scruct opt): New field with_key_screening.
* sm/keylist.c:  Include pkscreening.h.
(print_pk_screening): New.
(print_compliance_flags): Call it.  Add new arg cert.
(list_cert_colon): Pass arg cert
(list_cert_std): Call print_pk_screening.
* sm/fingerprint.c (gpgsm_get_rsa_modulus): New.
--

This new option can be used to detect ROCA affected keys.  To scan an
entire keyring and print the affected fingerprints use this:

  gpg -k --with-key-screening --with-colons | gawk -F: \
       '$1~/pub|sub|sec|ssb|crt/ && $18~/\<6001\>/ {found=1;next};
        $1=="fpr" && found {print $10}; {found=0}'

The same works for gpgsm.  Note that we need gawk due to the "\<" in
the r.e.

Signed-off-by: Werner Koch <wk@gnupg.org>
common/Makefile.am
common/pkscreening.c [new file with mode: 0644]
common/pkscreening.h [new file with mode: 0644]
doc/DETAILS
g10/gpg.c
g10/keylist.c
g10/options.h
sm/fingerprint.c
sm/gpgsm.c
sm/gpgsm.h
sm/keylist.c