/* -*-c-*-
*
- * $Id: keyutil.c,v 1.24 2004/04/08 01:36:15 mdw Exp $
+ * $Id$
*
* Simple key manager program
*
#include <noise.h>
#include <rand.h>
+#include "bintab.h"
#include "bbs.h"
#include "dh.h"
#include "dsa.h"
#include "ectab.h"
#include "fibrand.h"
#include "getdate.h"
+#include "gfreduce.h"
#include "key.h"
#include "mp.h"
#include "mpmont.h"
#include "ptab.h"
#include "rsa.h"
+#include "cc.h"
#include "sha-mgf.h"
#include "sha256-mgf.h"
#include "sha224-mgf.h"
static int copyparam(keyopts *k, const char **pp)
{
key_filter kf;
+ key_attriter i;
+ const char *n, *v;
/* --- Quick check if no parameters supplied --- */
kf.m = KF_CATMASK;
if (!key_copy(&k->k->k, &k->p->k, &kf))
die(EXIT_FAILURE, "unexpected failure while copying parameters");
+
+ /* --- Copy over attributes --- */
+
+ for (key_mkattriter(&i, k->p); key_nextattr(&i, &n, &v); )
+ key_putattr(k->kf, k->k, n, v);
+
+ /* --- Done --- */
+
return (1);
}
if (k->curve) {
qd_parse qd;
+ group *g;
+ const char *e;
if (strcmp(k->curve, "list") == 0) {
- const pentry *pe;
- printf("Built-in prime groups:\n");
- for (pe = ptab; pe->name; pe++)
- printf(" %s\n", pe->name);
+ unsigned i, w;
+ LIST("Built-in prime fields", stdout, ptab[i].name, ptab[i].name);
exit(0);
}
qd.p = k->curve;
if (dh_parse(&qd, &dp))
- die(EXIT_FAILURE, "error in group spec: %s", qd.e);
+ die(EXIT_FAILURE, "error in field spec: %s", qd.e);
+ if (!qd_eofp(&qd))
+ die(EXIT_FAILURE, "junk at end of field spec");
+ if ((g = group_prime(&dp)) == 0)
+ die(EXIT_FAILURE, "invalid prime field");
+ if (!(k->f & f_quiet) && (e = G_CHECK(g, &rand_global)) != 0)
+ moan("WARNING! group check failed: %s", e);
+ G_DESTROYGROUP(g);
goto done;
}
-
+
if (!k->bits)
k->bits = 1024;
bbs_privfree(&bp);
}
+static void alg_binparam(keyopts *k)
+{
+ static const char *pl[] = { "p", "q", "g", 0 };
+ if (!copyparam(k, pl)) {
+ gbin_param gb;
+ qd_parse qd;
+ group *g;
+ const char *e;
+ key_data *kd = &k->k->k;
+
+ /* --- Decide on a field --- */
+
+ if (!k->bits) k->bits = 128;
+ if (k->curve && strcmp(k->curve, "list") == 0) {
+ unsigned i, w;
+ LIST("Built-in binary fields", stdout,
+ bintab[i].name, bintab[i].name);
+ exit(0);
+ }
+ if (!k->curve) {
+ if (k->bits <= 40) k->curve = "p1363-40";
+ else if (k->bits <= 56) k->curve = "p1363-56";
+ else if (k->bits <= 64) k->curve = "p1363-64";
+ else if (k->bits <= 80) k->curve = "p1363-80";
+ else if (k->bits <= 112) k->curve = "p1363-112";
+ else if (k->bits <= 128) k->curve = "p1363-128";
+ else {
+ die(EXIT_FAILURE,
+ "no built-in binary fields provide %u-bit security",
+ k->bits);
+ }
+ }
+
+ /* --- Check it --- */
+
+ qd.e = 0;
+ qd.p = k->curve;
+ if (dhbin_parse(&qd, &gb))
+ die(EXIT_FAILURE, "error in field spec: %s", qd.e);
+ if (!qd_eofp(&qd))
+ die(EXIT_FAILURE, "junk at end of field spec");
+ if ((g = group_binary(&gb)) == 0)
+ die(EXIT_FAILURE, "invalid binary field");
+ if (!(k->f & f_quiet) && (e = G_CHECK(g, &rand_global)) != 0)
+ moan("WARNING! group check failed: %s", e);
+ G_DESTROYGROUP(g);
+
+ /* --- Write out the answer --- */
+
+ key_structure(kd);
+ mpkey(kd, "p", gb.p, KCAT_SHARE);
+ mpkey(kd, "q", gb.q, KCAT_SHARE);
+ mpkey(kd, "g", gb.g, KCAT_SHARE);
+ mp_drop(gb.q);
+ mp_drop(gb.p);
+ mp_drop(gb.g);
+ }
+}
+
+static void alg_bin(keyopts *k)
+{
+ mp *x, *y;
+ mp *p, *q, *g;
+ gfreduce r;
+ key_data *kd = &k->k->k;
+
+ /* --- Get the shared parameters --- */
+
+ alg_binparam(k);
+ p = getmp(kd, "p");
+ q = getmp(kd, "q");
+ g = getmp(kd, "g");
+
+ /* --- Choose a suitable private key --- *
+ *
+ * Since %$g$% has order %$q$%, choose %$x < q$%.
+ */
+
+ x = mprand_range(MP_NEWSEC, q, k->r, 0);
+
+ /* --- Compute the public key %$y = g^x \bmod p$% --- */
+
+ gfreduce_create(&r, p);
+ y = gfreduce_exp(&r, MP_NEW, g, x);
+ gfreduce_destroy(&r);
+
+ /* --- Store everything away --- */
+
+ mpkey(kd, "y", y, KCAT_PUB);
+
+ kd = key_structcreate(kd, "private");
+ key_structure(kd);
+ mpkey(kd, "x", x, KCAT_PRIV | KF_BURN);
+ dolock(k, kd, "private");
+
+ mp_drop(x); mp_drop(y);
+}
+
static void alg_ecparam(keyopts *k)
{
static const char *pl[] = { "curve", 0 };
if (!k->bits) k->bits = 256;
if (k->curve && strcmp(k->curve, "list") == 0) {
- const ecentry *ee;
- printf("Built-in elliptic curves:\n");
- for (ee = ectab; ee->name; ee++)
- printf(" %s\n", ee->name);
+ unsigned i, w;
+ LIST("Built-in elliptic curves", stdout,
+ ectab[i].name, ectab[i].name);
exit(0);
}
if (!k->curve) {
{ "binary", alg_binary, "Plain binary data" },
{ "des", alg_des, "Binary with DES-style parity" },
{ "rsa", alg_rsa, "RSA public-key encryption" },
+ { "bbs", alg_bbs, "Blum-Blum-Shub generator" },
{ "dsa", alg_dsa, "DSA digital signatures" },
{ "dsa-param", alg_dsaparam, "DSA shared parameters" },
{ "dh", alg_dh, "Diffie-Hellman key exchange" },
{ "dh-param", alg_dhparam, "Diffie-Hellman parameters" },
- { "bbs", alg_bbs, "Blum-Blum-Shub generator" },
+ { "bindh", alg_bin, "DH over a binary field" },
+ { "bindh-param", alg_binparam, "Binary-field DH parameters" },
{ "ec-param", alg_ecparam, "Elliptic curve parameters" },
{ "ec", alg_ec, "Elliptic curve crypto" },
{ 0, 0 }
if ((k.f & f_bogus) || optind + 1 > argc) {
die(EXIT_FAILURE,
- "Usage: add [options] type [attr...]");
+ "Usage: add [OPTIONS] TYPE [ATTR...]");
}
if (key_chkident(argv[optind]))
die(EXIT_FAILURE, "bad key type `%s'", argv[optind]);
}
if (o.f & f_bogus)
- die(EXIT_FAILURE, "Usage: list [-uqv] [-f filter] [tag...]");
+ die(EXIT_FAILURE, "Usage: list [-uqv] [-f FILTER] [TAG...]");
/* --- Open the key file --- */
int rc = 0;
if (argc < 2)
- die(EXIT_FAILURE, "Usage: expire tag...");
+ die(EXIT_FAILURE, "Usage: expire TAG...");
doopen(&f, KOPEN_WRITE);
for (i = 1; i < argc; i++) {
if ((k = key_bytag(&f, argv[i])) != 0)
int rc = 0;
if (argc < 2)
- die(EXIT_FAILURE, "Usage: delete tag...");
+ die(EXIT_FAILURE, "Usage: delete TAG...");
doopen(&f, KOPEN_WRITE);
for (i = 1; i < argc; i++) {
if ((k = key_bytag(&f, argv[i])) != 0)
key *k;
if (argc < 3)
- die(EXIT_FAILURE, "Usage: setattr tag attr...");
+ die(EXIT_FAILURE, "Usage: setattr TAG ATTR...");
doopen(&f, KOPEN_WRITE);
if ((k = key_bytag(&f, argv[1])) == 0)
die(EXIT_FAILURE, "key `%s' not found", argv[1]);
argv += optind; argc -= optind;
if (rc)
- die(EXIT_FAILURE, "Usage: fingerprint [-f filter] [tag...]");
+ die(EXIT_FAILURE, "Usage: fingerprint [-f FILTER] [TAG...]");
doopen(&f, KOPEN_READ);
int err;
if (argc < 2 || argc > 3)
- die(EXIT_FAILURE, "Usage: comment tag [comment]");
+ die(EXIT_FAILURE, "Usage: comment TAG [COMMENT]");
doopen(&f, KOPEN_WRITE);
if ((k = key_bytag(&f, argv[1])) == 0)
die(EXIT_FAILURE, "key `%s' not found", argv[1]);
argv += optind; argc -= optind;
if (argc < 1 || argc > 2 || rc)
- die(EXIT_FAILURE, "Usage: tag [-r] tag [new-tag]");
+ die(EXIT_FAILURE, "Usage: tag [-r] TAG [NEW-TAG]");
doopen(&f, KOPEN_WRITE);
if (flags & f_retag) {
if ((k = key_bytag(&f, argv[1])) != 0 && strcmp(k->tag, argv[1]) == 0)
dstr d = DSTR_INIT;
if (argc != 2)
- die(EXIT_FAILURE, "Usage: lock qtag");
+ die(EXIT_FAILURE, "Usage: lock QTAG");
doopen(&f, KOPEN_WRITE);
if (key_qtag(&f, argv[1], &d, &k, &kd))
die(EXIT_FAILURE, "key `%s' not found", argv[1]);
dstr d = DSTR_INIT;
if (argc != 2)
- die(EXIT_FAILURE, "Usage: unlock qtag");
+ die(EXIT_FAILURE, "Usage: unlock QTAG");
doopen(&f, KOPEN_WRITE);
if (key_qtag(&f, argv[1], &d, &k, &kd))
die(EXIT_FAILURE, "key `%s' not found", argv[1]);
argv += optind; argc -= optind;
if (rc || argc < 1)
- die(EXIT_FAILURE, "Usage: extract [-f filter] file [tag...]");
+ die(EXIT_FAILURE, "Usage: extract [-f FILTER] FILE [TAG...]");
if (strcmp(*argv, "-") == 0)
fp = stdout;
else if (!(fp = fopen(*argv, "w"))) {
{
key_file f;
if (argc != 1)
- die(EXIT_FAILURE, "usage: tidy");
+ die(EXIT_FAILURE, "Usage: tidy");
doopen(&f, KOPEN_WRITE);
f.f |= KF_MODIFIED; /* Nasty hack */
doclose(&f);
FILE *fp;
if (argc != 2)
- die(EXIT_FAILURE, "Usage: merge file");
+ die(EXIT_FAILURE, "Usage: merge FILE");
if (strcmp(argv[1], "-") == 0)
fp = stdin;
else if (!(fp = fopen(argv[1], "r"))) {
return (0);
}
+/* --- @cmd_show@ --- */
+
+#define LISTS(LI) \
+ LI("Lists", list, \
+ listtab[i].name, listtab[i].name) \
+ LI("Hash functions", hash, \
+ ghashtab[i], ghashtab[i]->name) \
+ LI("Elliptic curves", ec, \
+ ectab[i].name, ectab[i].name) \
+ LI("Prime Diffie-Hellman groups", dh, \
+ ptab[i].name, ptab[i].name) \
+ LI("Binary Diffie-Hellman groups", bindh, \
+ bintab[i].name, bintab[i].name) \
+ LI("Key-generation algorithms", keygen, \
+ algtab[i].name, algtab[i].name) \
+ LI("Random seeding algorithms", seed, \
+ seedtab[i].p, seedtab[i].p)
+
+MAKELISTTAB(listtab, LISTS)
+
+static int cmd_show(int argc, char *argv[])
+{
+ return (displaylists(listtab, argv + 1));
+}
+
/*----- Main command table ------------------------------------------------*/
-static struct cmd {
- const char *name;
- int (*cmd)(int /*argc*/, char */*argv*/[]);
- const char *usage;
- const char *help;
-} cmds[] = {
+static int cmd_help(int argc, char *argv[]);
+
+static cmd cmds[] = {
+ { "help", cmd_help, "help [COMMAND...]" },
+ { "show", cmd_show, "show [ITEM...]" },
+ { "list", cmd_list, "list [-uqv] [-f FILTER] [TAG...]", "\
+Options:\n\
+\n\
+-u, --utc Display expiry times etc. in UTC, not local time.\n\
+-q, --quiet Show less information.\n\
+-v, --verbose Show more information.\n\
+" },
+ { "fingerprint", cmd_finger, "fingerprint [-f FILTER] [TAG...]", "\
+Options:\n\
+\n\
+-f, --filter=FILT Only hash key components matching FILT.\n\
+-a, --algorithm=HASH Use the named HASH algorithm.\n\
+ ($ show hash for list.)\n\
+" },
+ { "extract", cmd_extract, "extract [-f FILTER] FILE [TAG...]", "\
+Options:\n\
+\n\
+-f, --filter=FILT Only extract key components matching FILT.\n\
+" },
+ { "merge", cmd_merge, "merge FILE" },
+ { "expire", cmd_expire, "expire TAG..." },
+ { "delete", cmd_delete, "delete TAG..." },
+ { "setattr", cmd_setattr, "setattr TAG ATTR..." },
+ { "comment", cmd_comment, "comment TAG [COMMENT]" },
+ { "lock", cmd_lock, "lock QTAG" },
+ { "unlock", cmd_unlock, "unlock QTAG" },
+ { "tag", cmd_tag, "tag [-r] TAG [NEW-TAG]", "\
+Options:\n\
+\n\
+-r, --retag Untag any key currently called new-tag.\n\
+" },
+ { "tidy", cmd_tidy, "tidy" },
{ "add", cmd_add,
- "add [options] type [attr...]\n\
- Options: [-lqrLS] [-a alg] [-bB bits] [-p param] [-R tag]\n\
- [-e expire] [-t tag] [-c comment]", "\
+ "add [-OPTIONS] TYPE [ATTR...]\n\
+ Options: [-lqrLS] [-a ALG] [-bB BITS] [-p PARAM] [-R TAG]\n\
+ [-A SEEDALG] [-s SEED] [-n BITS]\n\
+ [-e EXPIRE] [-t TAG] [-c COMMENT]", "\
Options:\n\
\n\
-a, --algorithm=ALG Generate keys suitable for ALG.\n\
+ ($ show keygen for list.)\n\
-b, --bits=N Generate an N-bit key.\n\
-B, --qbits=N Use an N-bit subgroup or factors.\n\
-p, --parameters=TAG Get group parameters from TAG.\n\
--C, --curve=CURVE Use elliptic curve CURVE.\n\
+-C, --curve=NAME Use elliptic curve or DH group NAME.\n\
+ ($ show ec or $ show dh for list.)\n\
+-A, --seedalg=ALG Use pseudorandom generator ALG to generate key.\n\
+ ($ show seed for list.)\n\
+-s, --seed=BASE64 Use Base64-encoded string BASE64 as seed.\n\
+-n, --newseed=COUNT Generate new COUNT-bit seed.\n\
-e, --expire=TIME Make the key expire after TIME.\n\
-c, --comment=STRING Attach the command STRING to the key.\n\
-t, --tag=TAG Tag the key with the name TAG.\n\
-L, --lim-lee Generate Lim-Lee primes for Diffie-Hellman groups.\n\
-S, --subgroup Use a prime-order subgroup for Diffie-Hellman.\n\
" },
- { "expire", cmd_expire, "expire tag..." },
- { "delete", cmd_delete, "delete tag..." },
- { "tag", cmd_tag, "tag [-r] tag [new-tag]", "\
-Options:\n\
-\n\
--r, --retag Untag any key currently called new-tag.\n\
-" },
- { "setattr", cmd_setattr, "setattr tag attr..." },
- { "comment", cmd_comment, "comment tag [comment]" },
- { "lock", cmd_lock, "lock qtag" },
- { "unlock", cmd_unlock, "unlock qtag" },
- { "list", cmd_list, "list [-uqv] [-f filter] [tag...]", "\
-Options:\n\
-\n\
--u, --utc Display expiry times etc. in UTC, not local time.\n\
--q, --quiet Show less information.\n\
--v, --verbose Show more information.\n\
-" },
- { "fingerprint", cmd_finger, "fingerprint [-f filter] [tag...]", "\
-Options:\n\
-\n\
--f, --filter=FILT Only hash key components matching FILT.\n\
--a, --algorithm=HASH Use the named HASH algorithm.\n\
-" },
- { "tidy", cmd_tidy, "tidy" },
- { "extract", cmd_extract, "extract [-f filter] file [tag...]", "\
-Options:\n\
-\n\
--f, --filter=FILT Only extract key components matching FILT.\n\
-" },
- { "merge", cmd_merge, "merge file" },
{ 0, 0, 0 }
};
-typedef struct cmd cmd;
-
-/*----- Main code ---------------------------------------------------------*/
-
-/* --- @findcmd@ --- *
- *
- * Arguments: @const char *name@ = a command name
- *
- * Returns: Pointer to the command structure.
- *
- * Use: Looks up a command by name. If the command isn't found, an
- * error is reported and the program is terminated.
- */
-
-static cmd *findcmd(const char *name)
+static int cmd_help(int argc, char *argv[])
{
- cmd *c, *chosen = 0;
- size_t sz = strlen(name);
-
- for (c = cmds; c->name; c++) {
- if (strncmp(name, c->name, sz) == 0) {
- if (c->name[sz] == 0) {
- chosen = c;
- break;
- } else if (chosen)
- die(EXIT_FAILURE, "ambiguous command name `%s'", name);
- else
- chosen = c;
- }
- }
- if (!chosen)
- die(EXIT_FAILURE, "unknown command name `%s'", name);
- return (chosen);
+ sc_help(cmds, stdout, argv + 1);
+ return (0);
}
+/*----- Main code ---------------------------------------------------------*/
+
/* --- Helpful GNUy functions --- */
-void usage(FILE *fp)
+static void usage(FILE *fp)
{
- pquis(fp, "Usage: $ [-k keyring] command [args]\n");
+ pquis(fp, "Usage: $ [-k KEYRING] COMMAND [ARGS]\n");
}
void version(FILE *fp)
pquis(fp, "$, Catacomb version " VERSION "\n");
}
-void help(FILE *fp, char **argv)
+void help_global(FILE *fp)
{
- cmd *c;
-
- version(fp);
- fputc('\n', fp);
- if (*argv) {
- c = findcmd(*argv);
- fprintf(fp, "Usage: %s [-k keyring] %s\n", QUIS, c->usage);
- if (c->help) {
- fputc('\n', fp);
- fputs(c->help, fp);
- }
- } else {
- usage(fp);
- fputs("\n\
-Performs various simple key management operations. Command line options\n\
-recognized are:\n\
+ usage(fp);
+ fputs("\n\
+Performs various simple key management operations.\n\
+\n\
+Global command line options:\n\
\n\
--h, --help [COMMAND] Display this help text (or help for COMMAND).\n\
+-h, --help [COMMAND...] Display this help text (or help for COMMANDs).\n\
-v, --version Display version number.\n\
-u, --usage Display short usage summary.\n\
\n\
--k, --keyring=FILE Read and write keys in FILE.\n\
--i, --id=TAG Use key TAG for random number generator.\n\
--t, --type=TYPE Use key TYPE for random number generator.\n\
-\n\
-The following commands are understood:\n\n",
- fp);
- for (c = cmds; c->name; c++)
- fprintf(fp, "%s\n", c->usage);
- }
+-k, --keyring=FILE Read and write keys in FILE.\n",
+ fp);
}
/* --- @main@ --- *
/* --- GNU help options --- */
case 'h':
- help(stdout, argv + optind);
+ sc_help(cmds, stdout, argv + optind);
exit(0);
case 'v':
version(stdout);
argc -= optind;
argv += optind;
optind = 0;
- return (findcmd(argv[0])->cmd(argc, argv));
+ return (findcmd(cmds, argv[0])->cmd(argc, argv));
}
/*----- That's all, folks -------------------------------------------------*/
projects / u / mdw / catacomb / blobdiff