mirrors/minisign
1
0
Fork 0
mirror of https://github.com/jedisct1/minisign.git synced 2025-04-03 02:47:41 +03:00
Code Issues Projects Releases Packages Wiki Activity

Simplify usage without key encryption

Browse source
This commit is contained in:
Frank Denis 2023-01-16 21:12:06 +01:00
parent 27bff8a1f5
commit 506ac9ce3e
2 changed files with 22 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

40
src/minisign.c
View file

@ -32,9 +32,9 @@ usage(void)
"Usage:\n"
#ifndef VERIFY_ONLY
"minisign -G [-f] [-p pubkey_file] [-s seckey_file] [-W]\n"
"minisign -R [-s seckey_file] [-W] [-p pubkey_file]\n"
"minisign -R [-s seckey_file] [-p pubkey_file]\n"
"minisign -C [-s seckey_file] [-W]\n"
"minisign -S [-l] [-x sig_file] [-s seckey_file] [-W] [-c untrusted_comment]\n"
"minisign -S [-l] [-x sig_file] [-s seckey_file] [-c untrusted_comment]\n"
" [-t trusted_comment] -m file [file ...]\n"
#endif
"minisign -V [-H] [-x sig_file] [-p pubkey_file | -P pubkey] [-o] [-q] -m file\n"
@ -384,7 +384,7 @@ encrypt_key(SeckeyStruct *const seckey_struct)
}
static SeckeyStruct *
seckey_load(const char *sk_file, char *const sk_comment_line, int unencrypted_key)
seckey_load(const char *sk_file, char *const sk_comment_line)
{
char sk_comment_line_buf[COMMENTMAXBYTES];
unsigned char chk[crypto_generichash_BYTES];
@ -421,14 +421,13 @@ seckey_load(const char *sk_file, char *const sk_comment_line, int unencrypted_ke
if (memcmp(seckey_struct->sig_alg, SIGALG, sizeof seckey_struct->sig_alg) != 0) {
exit_msg("Unsupported signature algorithm");
}
if (memcmp(seckey_struct->kdf_alg, KDFALG, sizeof seckey_struct->kdf_alg) != 0) {
exit_msg("Unsupported key derivation function");
}
if (memcmp(seckey_struct->chk_alg, CHKALG, sizeof seckey_struct->chk_alg) != 0) {
exit_msg("Unsupported checksum function");
}
if (unencrypted_key == 0) {
if (memcmp(seckey_struct->kdf_alg, KDFALG, sizeof seckey_struct->kdf_alg) == 0) {
decrypt_key(seckey_struct, chk);
} else if (memcmp(seckey_struct->kdf_alg, KDFNONE, sizeof seckey_struct->kdf_alg) != 0) {
exit_msg("Unsupported key derivation function");
}
return seckey_struct;
}
@ -680,8 +679,10 @@ generate(const char *pk_file, const char *sk_file, const char *comment, int forc
abort_on_existing_key_files(pk_file, sk_file, force);
randombytes_buf(seckey_struct->keynum_sk.keynum, sizeof seckey_struct->keynum_sk.keynum);
crypto_sign_keypair(pubkey_struct->keynum_pk.pk, seckey_struct->keynum_sk.sk);
memset(seckey_struct, 0, sizeof(SeckeyStruct));
memcpy(seckey_struct->sig_alg, SIGALG, sizeof seckey_struct->sig_alg);
memcpy(seckey_struct->kdf_alg, KDFALG, sizeof seckey_struct->kdf_alg);
memcpy(seckey_struct->kdf_alg, unencrypted_key ? KDFNONE : KDFALG,
sizeof seckey_struct->kdf_alg);
memcpy(seckey_struct->chk_alg, CHKALG, sizeof seckey_struct->chk_alg);
memcpy(pubkey_struct->keynum_pk.keynum, seckey_struct->keynum_sk.keynum,
sizeof pubkey_struct->keynum_pk.keynum);
@ -715,7 +716,7 @@ generate(const char *pk_file, const char *sk_file, const char *comment, int forc
}
static int
recreate_pk(const char *pk_file, const char *sk_file, int force, int unencrypted_key)
recreate_pk(const char *pk_file, const char *sk_file, int force)
{
SeckeyStruct *seckey_struct;
PubkeyStruct pubkey_struct;
@ -723,7 +724,7 @@ recreate_pk(const char *pk_file, const char *sk_file, int force, int unencrypted
if (force == 0) {
abort_on_existing_key_file(pk_file);
}
if ((seckey_struct = seckey_load(sk_file, NULL, unencrypted_key)) == NULL) {
if ((seckey_struct = seckey_load(sk_file, NULL)) == NULL) {
return -1;
}
memcpy(pubkey_struct.sig_alg, seckey_struct->sig_alg, sizeof pubkey_struct.sig_alg);
@ -750,15 +751,16 @@ update_password(const char *sk_file, int unencrypted_key)
size_t sk_comment_line_len;
sk_comment_line = xsodium_malloc(COMMENTMAXBYTES);
if (unencrypted_key == 0) {
printf("Enter the current password for [%s].\n", sk_file);
} else {
printf("Assuming the secret key in [%s] is unencrypted.\n", sk_file);
}
if ((seckey_struct = seckey_load(sk_file, sk_comment_line, unencrypted_key)) == NULL) {
if ((seckey_struct = seckey_load(sk_file, sk_comment_line)) == NULL) {
return -1;
}
encrypt_key(seckey_struct);
memcpy(seckey_struct->kdf_alg, unencrypted_key ? KDFNONE : KDFALG,
sizeof seckey_struct->kdf_alg);
if (unencrypted_key == 0) {
encrypt_key(seckey_struct);
} else {
printf("You are about to remove key encryption for [%s].\n", sk_file);
}
if ((fp = fopen_create_useronly(sk_file)) == NULL) {
exit_err(sk_file);
}
@ -961,7 +963,7 @@ main(int argc, char **argv)
comment = DEFAULT_COMMENT;
}
return sign_all(
seckey_load(sk_file, NULL, unencrypted_key),
seckey_load(sk_file, NULL),
((pk_file != NULL || pubkey_s != NULL) ? pubkey_load(pk_file, pubkey_s) : NULL),
message_file, (const char **) &argv[optind], argc - optind, sig_file, comment,
trusted_comment, sign_legacy) != 0;
@ -969,7 +971,7 @@ main(int argc, char **argv)
if (pk_file == NULL) {
pk_file = SIG_DEFAULT_PKFILE;
}
return recreate_pk(pk_file, sk_file, force, unencrypted_key) != 0;
return recreate_pk(pk_file, sk_file, force) != 0;
case ACTION_UPDATE_PASSWORD:
return update_password(sk_file, unencrypted_key) != 0;
#endif

1
src/minisign.h
View file

@ -9,6 +9,7 @@
#define SIGALG "Ed"
#define SIGALG_HASHED "ED"
#define KDFALG "Sc"
#define KDFNONE "\0\0"
#define CHKALG "B2"
#define COMMENT_PREFIX "untrusted comment: "
#define DEFAULT_COMMENT "signature from minisign secret key"