diff options
| -rw-r--r-- | g10/pubkey-enc.c | 42 | ||||
| -rw-r--r-- | sm/decrypt.c | 19 |
2 files changed, 36 insertions, 25 deletions
diff --git a/g10/pubkey-enc.c b/g10/pubkey-enc.c index 272562b18..d7ba95391 100644 --- a/g10/pubkey-enc.c +++ b/g10/pubkey-enc.c @@ -90,16 +90,19 @@ get_session_key (ctrl_t ctrl, PKT_pubkey_enc * k, DEK * dek) sk->pubkey_algo = k->pubkey_algo; /* We want a pubkey with this algo. */ if (!(rc = get_seckey (ctrl, sk, k->keyid))) { - /* Print compliance warning. */ - if (!gnupg_pk_is_compliant (opt.compliance, - sk->pubkey_algo, - sk->pkey, nbits_from_pk (sk), NULL)) - log_info (_("Note: key %s is not suitable for encryption" - " in %s mode\n"), - keystr_from_pk (sk), - gnupg_compliance_option_string (opt.compliance)); - - rc = get_it (ctrl, k, dek, sk, k->keyid); + /* Check compliance. */ + if (! gnupg_pk_is_allowed (opt.compliance, PK_USE_DECRYPTION, + sk->pubkey_algo, + sk->pkey, nbits_from_pk (sk), NULL)) + { + log_info (_("key %s is not suitable for decryption" + " in %s mode\n"), + keystr_from_pk (sk), + gnupg_compliance_option_string (opt.compliance)); + rc = gpg_error (GPG_ERR_PUBKEY_ALGO); + } + else + rc = get_it (ctrl, k, dek, sk, k->keyid); } } else if (opt.skip_hidden_recipients) @@ -128,14 +131,17 @@ get_session_key (ctrl_t ctrl, PKT_pubkey_enc * k, DEK * dek) log_info (_("anonymous recipient; trying secret key %s ...\n"), keystr (keyid)); - /* Print compliance warning. */ - if (!gnupg_pk_is_compliant (opt.compliance, - sk->pubkey_algo, - sk->pkey, nbits_from_pk (sk), NULL)) - log_info (_("Note: key %s is not suitable for encryption" - " in %s mode\n"), - keystr_from_pk (sk), - gnupg_compliance_option_string (opt.compliance)); + /* Check compliance. */ + if (! gnupg_pk_is_allowed (opt.compliance, PK_USE_DECRYPTION, + sk->pubkey_algo, + sk->pkey, nbits_from_pk (sk), NULL)) + { + log_info (_("key %s is not suitable for decryption" + " in %s mode\n"), + keystr_from_pk (sk), + gnupg_compliance_option_string (opt.compliance)); + continue; + } rc = get_it (ctrl, k, dek, sk, keyid); if (!rc) diff --git a/sm/decrypt.c b/sm/decrypt.c index cdce1d434..60ed14a64 100644 --- a/sm/decrypt.c +++ b/sm/decrypt.c @@ -480,19 +480,22 @@ gpgsm_decrypt (ctrl_t ctrl, int in_fd, estream_t out_fp) unsigned int nbits; int pk_algo = gpgsm_get_key_algo_info (cert, &nbits); - /* Print compliance warning. */ - if (! gnupg_pk_is_compliant (opt.compliance, - pk_algo, NULL, nbits, NULL)) + /* Check compliance. */ + if (!gnupg_pk_is_allowed (opt.compliance, + PK_USE_DECRYPTION, + pk_algo, NULL, nbits, NULL)) { char kidstr[10+1]; snprintf (kidstr, sizeof kidstr, "0x%08lX", gpgsm_get_short_fingerprint (cert, NULL)); log_info - (_("Note: key %s is not suitable for encryption" + (_("key %s is not suitable for decryption" " in %s mode\n"), kidstr, gnupg_compliance_option_string (opt.compliance)); + rc = gpg_error (GPG_ERR_PUBKEY_ALGO); + goto oops; } /* Check that all certs are compliant with CO_DE_VS. */ @@ -504,9 +507,11 @@ gpgsm_decrypt (ctrl_t ctrl, int in_fd, estream_t out_fp) oops: if (rc) - /* We cannot check compliance of certs that we - * don't have. */ - is_de_vs = 0; + { + /* We cannot check compliance of certs that we + * don't have. */ + is_de_vs = 0; + } xfree (issuer); xfree (serial); ksba_cert_release (cert); |