Mix/Src/pgpcreat.c

/* Mixmaster version 3  --  (C) 1999 Anonymizer Inc.

   Mixmaster may be redistributed and modified under certain conditions.
   This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF
   ANY KIND, either express or implied. See the file COPYRIGHT for
   details.

   Create OpenPGP packets
   $Id: pgpcreat.c,v 1.11 2002/09/20 17:59:25 disastry Exp $ */


#include "mix3.h"
#ifdef USE_PGP
#include "pgp.h"
#include "crypto.h"
#include <assert.h>
#include <time.h>
#include <string.h>

int pgp_packet(BUFFER *in, int type)
{
  int ctb;
  BUFFER *out;

  out = buf_new();
 if (type > 15) {
    ctb = 0xC0 | type; /* make v4 packet */
    buf_setc(out, ctb);
    if (in->length > 8383) {
      buf_appendc(out, 0xFF);
      buf_appendl(out, in->length);
    } else if (in->length > 191) {
#if 0
      buf_appendc(out, ((in->length-192) >> 8) + 192);
      buf_appendc(out,  (in->length-192) & 0xFF);
#else /* end of 0 */
      buf_appendi(out, in->length - 0xC0 + 0xC000);
#endif /* else if not 0 */
    } else {
      buf_appendc(out, in->length);
    }
 } else {
  ctb = 128 + (type << 2);
  if (in->length < 256 && type != PGP_PUBKEY && type != PGP_SECKEY &&
      type != PGP_SIG && type != PGP_PUBSUBKEY && type != PGP_SECSUBKEY
#ifdef MIMIC
      && type != PGP_ENCRYPTED
#endif /* MIMIC */
    ) {
    buf_setc(out, ctb);
    buf_appendc(out, in->length);
  }
#ifndef MIMIC
  else if (in->length < 65536)
#else /* end of not MIMIC */
  else if ((type == PGP_PUBKEY || type == PGP_SECKEY || type == PGP_SIG
           || type == PGP_SESKEY || type == PGP_PUBSUBKEY ||
           type == PGP_SECSUBKEY) && in->length < 65536)
#endif /* else if MIMIC */
  {
    buf_appendc(out, ctb | 1);
    buf_appendi(out, in->length);
  } else {
    buf_appendc(out, ctb | 2);
    buf_appendl(out, in->length);
  }
 }
  buf_cat(out, in);
  buf_move(in, out);
  buf_free(out);
  return (0);
}

int pgp_subpacket(BUFFER *in, int type)
{
  BUFFER *out;
  int len;

  out = buf_new();
  len = in->length + 1;
  if (len < 192)
    buf_setc(out, len);
  else {
    buf_setc(out, 255);
    buf_appendl(out, len);
  }
  buf_appendc(out, type);
  buf_cat(out, in);
  buf_move(in, out);
  buf_free(out);
  return (0);
}

int pgp_packet3(BUFFER *in, int type)
{
#ifdef MIMIC
  int ctb;
  BUFFER *out;

  out = buf_new();
  ctb = 128 + (type << 2);
  buf_setc(out, ctb | 3);
  buf_cat(out, in);
  buf_move(in, out);
  buf_free(out);
  return (0);
#else /* end of MIMIC */
  return pgp_packet(in, type);
#endif /* else if not MIMIC */
}

#ifdef USE_IDEA
static int pgp_ideaencrypt(BUFFER *in, BUFFER *out, BUFFER *key, int mdc)
{
  byte iv[8];
  int i, n = 0;
  IDEA_KEY_SCHEDULE ks;
  SHA_CTX c;

  assert(key->length == 17);

  for (i = 0; i < 8; i++)
    iv[i] = 0;

  idea_set_encrypt_key(key->data + 1, &ks);

  if (mdc) {
    mdc = 1;
    out->data[0] = 1;
  }
  rnd_bytes(out->data + mdc, 8);
  out->data[8 + mdc] = out->data[6 + mdc], out->data[9 + mdc] = out->data[7 + mdc];
  if (mdc) {
    SHA1_Init(&c);
    SHA1_Update(&c, out->data + 1, 10);
    SHA1_Update(&c, in->data, in->length);
  }
  n = 0;
  idea_cfb64_encrypt(out->data + mdc, out->data + mdc, 10, &ks, iv, &n, IDEA_ENCRYPT);
  if (!mdc) {
    iv[6] = iv[0], iv[7] = iv[1];
    memcpy(iv, out->data + 2, 6);
    n = 0;
  }
  idea_cfb64_encrypt(in->data, out->data + 10 + mdc, in->length, &ks, iv, &n,
                     IDEA_ENCRYPT);
  if (mdc) {
    SHA1_Update(&c, "\xD3\x14", 2); /* 0xD3 = 0xC0 | PGP_MDC */
    idea_cfb64_encrypt("\xD3\x14", out->data + 11 + in->length, 2, &ks, iv, &n,
                       IDEA_ENCRYPT);
    SHA1_Final(out->data + 13 + in->length, &c);
    idea_cfb64_encrypt(out->data + 13 + in->length, out->data + 13 + in->length, 20, &ks, iv, &n,
                       IDEA_ENCRYPT);
  }
  return (0);
}
#endif /* USE_IDEA */

static int pgp_3desencrypt(BUFFER *in, BUFFER *out, BUFFER *key, int mdc)
{
  des_cblock iv;
  int i, n = 0;
  des_key_schedule ks1;
  des_key_schedule ks2;
  des_key_schedule ks3;
  SHA_CTX c;

  assert(key->length == 25);

  for (i = 0; i < 8; i++)
    iv[i] = 0;

  des_set_key((const_des_cblock *) (key->data + 1), ks1);
  des_set_key((const_des_cblock *) (key->data + 9), ks2);
  des_set_key((const_des_cblock *) (key->data+ 17), ks3);

  if (mdc) {
    mdc = 1;
    out->data[0] = 1;
  }
  rnd_bytes(out->data + mdc, 8);
  out->data[8 + mdc] = out->data[6 + mdc], out->data[9 + mdc] = out->data[7 + mdc];
  if (mdc) {
    SHA1_Init(&c);
    SHA1_Update(&c, out->data + 1, 10);
    SHA1_Update(&c, in->data, in->length);
  }
  n = 0;
  des_ede3_cfb64_encrypt(out->data + mdc, out->data + mdc, 10, ks1, ks2, ks3, &iv, &n,
                         ENCRYPT);
  if (!mdc) {
    iv[6] = iv[0], iv[7] = iv[1];
    memcpy(iv, out->data + 2, 6);
    n = 0;
  }
  des_ede3_cfb64_encrypt(in->data, out->data + 10 + mdc, in->length, ks1, ks2, ks3,
                         &iv, &n, ENCRYPT);
  if (mdc) {
    SHA1_Update(&c, "\xD3\x14", 2); /* 0xD3 = 0xC0 | PGP_MDC */
    des_ede3_cfb64_encrypt("\xD3\x14", out->data + 11 + in->length, 2, ks1, ks2, ks3,
                       &iv, &n, ENCRYPT);
    SHA1_Final(out->data + 13 + in->length, &c);
    des_ede3_cfb64_encrypt(out->data + 13 + in->length, out->data + 13 + in->length, 20, ks1, ks2, ks3,
                       &iv, &n, ENCRYPT);
  }
  return (0);
}

static int pgp_castencrypt(BUFFER *in, BUFFER *out, BUFFER *key, int mdc)
{
  byte iv[8];
  int i, n = 0;
  CAST_KEY ks;
  SHA_CTX c;

  assert(key->length == 17);

  for (i = 0; i < 8; i++)
    iv[i] = 0;

  CAST_set_key(&ks, 16, key->data + 1);

  if (mdc) {
    mdc = 1;
    out->data[0] = 1;
  }
  rnd_bytes(out->data + mdc, 8);
  out->data[8 + mdc] = out->data[6 + mdc], out->data[9 + mdc] = out->data[7 + mdc];
  if (mdc) {
    SHA1_Init(&c);
    SHA1_Update(&c, out->data + 1, 10);
    SHA1_Update(&c, in->data, in->length);
  }
  n = 0;
  CAST_cfb64_encrypt(out->data + mdc, out->data + mdc, 10, &ks, iv, &n, CAST_ENCRYPT);
  if (!mdc) {
    iv[6] = iv[0], iv[7] = iv[1];
    memcpy(iv, out->data + 2, 6);
    n = 0;
  }
  CAST_cfb64_encrypt(in->data, out->data + 10 + mdc, in->length, &ks, iv, &n,
                     CAST_ENCRYPT);
  if (mdc) {
    SHA1_Update(&c, "\xD3\x14", 2); /* 0xD3 = 0xC0 | PGP_MDC */
    CAST_cfb64_encrypt("\xD3\x14", out->data + 11 + in->length, 2, &ks, iv, &n,
                       CAST_ENCRYPT);
    SHA1_Final(out->data + 13 + in->length, &c);
    CAST_cfb64_encrypt(out->data + 13 + in->length, out->data + 13 + in->length, 20, &ks, iv, &n,
                       CAST_ENCRYPT);
  }
  return (0);
}

static int pgp_bfencrypt(BUFFER *in, BUFFER *out, BUFFER *key, int mdc)
{
  byte iv[8];
  int i, n = 0;
  BF_KEY ks;
  SHA_CTX c;

  assert(key->length == 17);

  for (i = 0; i < 8; i++)
    iv[i] = 0;

  BF_set_key(&ks, 16, key->data + 1);

  if (mdc) {
    mdc = 1;
    out->data[0] = 1;
  }
  rnd_bytes(out->data + mdc, 8);
  out->data[8 + mdc] = out->data[6 + mdc], out->data[9 + mdc] = out->data[7 + mdc];
  if (mdc) {
    SHA1_Init(&c);
    SHA1_Update(&c, out->data + 1, 10);
    SHA1_Update(&c, in->data, in->length);
  }
  n = 0;
  BF_cfb64_encrypt(out->data + mdc, out->data + mdc, 10, &ks, iv, &n, BF_ENCRYPT);
  if (!mdc) {
    iv[6] = iv[0], iv[7] = iv[1];
    memcpy(iv, out->data + 2, 6);
    n = 0;
  }
  BF_cfb64_encrypt(in->data, out->data + 10 + mdc, in->length, &ks, iv, &n,
                     BF_ENCRYPT);
  if (mdc) {
    SHA1_Update(&c, "\xD3\x14", 2); /* 0xD3 = 0xC0 | PGP_MDC */
    BF_cfb64_encrypt("\xD3\x14", out->data + 11 + in->length, 2, &ks, iv, &n,
                       BF_ENCRYPT);
    SHA1_Final(out->data + 13 + in->length, &c);
    BF_cfb64_encrypt(out->data + 13 + in->length, out->data + 13 + in->length, 20, &ks, iv, &n,
                       BF_ENCRYPT);
  }
  return (0);
}

#ifdef USE_AES
static int pgp_aesencrypt(BUFFER *in, BUFFER *out, BUFFER *key, int mdc)
{
  byte iv[16];
  int i, n = 0;
  AES_KEY ks;
  SHA_CTX c;

  assert(key->length == 17 || key->length == 25 || key->length == 33);

  for (i = 0; i < 16; i++)
    iv[i] = 0;

  AES_set_encrypt_key(key->data + 1, (key->length-1)<<3, &ks);

  if (mdc) {
    mdc = 1;
    out->data[0] = 1;
  }
  rnd_bytes(out->data + mdc, 16);
  out->data[16 + mdc] = out->data[14 + mdc], out->data[17 + mdc] = out->data[15 + mdc];
  if (mdc) {
    SHA1_Init(&c);
    SHA1_Update(&c, out->data + 1, 18);
    SHA1_Update(&c, in->data, in->length);
  }
  n = 0;
  AES_cfb128_encrypt(out->data + mdc, out->data + mdc, 18, &ks, iv, &n, AES_ENCRYPT);
  if (!mdc) {
    iv[14] = iv[0], iv[15] = iv[1];
    memcpy(iv, out->data + 2, 14);
    n = 0;
  }
  AES_cfb128_encrypt(in->data, out->data + 18 + mdc, in->length, &ks, iv, &n,
                     AES_ENCRYPT);
  if (mdc) {
    SHA1_Update(&c, "\xD3\x14", 2); /* 0xD3 = 0xC0 | PGP_MDC */
    AES_cfb128_encrypt("\xD3\x14", out->data + 19 + in->length, 2, &ks, iv, &n,
                       AES_ENCRYPT);
    SHA1_Final(out->data + 21 + in->length, &c);
    AES_cfb128_encrypt(out->data + 21 + in->length, out->data + 21 + in->length, 20, &ks, iv, &n,
                       AES_ENCRYPT);
  }
  return (0);
}
#endif /* USE_AES */

int pgp_symmetric(BUFFER *in, BUFFER *key, int mdc)
{
  BUFFER *out;
  int sym;

  out = buf_new();
  if (pgp_blocklen(sym = buf_getc(key)) > 8)
    mdc = 1; /* force MDC for AES */
  buf_prepare(out, in->length + (mdc?(1+2+22):2) + pgp_blocklen(sym));
  switch (sym) {
#ifdef USE_IDEA
   case PGP_K_IDEA:
    pgp_ideaencrypt(in, out, key, mdc);
    break;
#endif /* USE_IDEA */
#ifdef USE_AES
   case PGP_K_AES128:
   case PGP_K_AES192:
   case PGP_K_AES256:
    pgp_aesencrypt(in, out, key, mdc);
    break;
#endif /* USE_AES */
   case PGP_K_3DES:
    pgp_3desencrypt(in, out, key, mdc);
    break;
  case PGP_K_CAST5:
    pgp_castencrypt(in, out, key, mdc);
    break;
  case PGP_K_BF:
    pgp_bfencrypt(in, out, key, mdc);
    break;
   default:
    errlog(ERRORMSG, "Unknown symmetric algorithm.\n");
  }
  pgp_packet(out, mdc?PGP_ENCRYPTEDMDC:PGP_ENCRYPTED);

  buf_move(in, out);
  buf_free(out);
  return (0);
}

int pgp_literal(BUFFER *b, char *filename, int text)
{
  BUFFER *out;
  BUFFER *line;

  if (filename == NULL)
    filename = "stdin";

  if (strlen(filename) > 255)
    return (-1);

  out = buf_new();
  line = buf_new();

  if (text)
    buf_setc(out, 't');
  else
    buf_setc(out, 'b');
  buf_appendc(out, strlen(filename));
  buf_appends(out, filename);
  buf_appendl(out, 0);          /* timestamp */

  if (b->length > 0) {
    if (text)
      while (buf_getline(b, line) != -1) {
        buf_cat(out, line);
        buf_appends(out, "\r\n");
      } else
        buf_cat(out, b);
  }
  pgp_packet(out, PGP_LITERAL);
  buf_move(b, out);
  buf_free(out);
  buf_free(line);

  return (0);
}

int pgp_compress(BUFFER *in)
{
  int err;
  BUFFER *out;

  out = buf_new();
  buf_setc(out, 1);
  err = buf_zip(out, in, 13);
  if (err == 0) {
    pgp_packet3(out, PGP_COMPRESSED);
    buf_move(in, out);
  }
  buf_free(out);
  return (err);
}

int pgp_sessionkey(BUFFER *out, BUFFER *user, BUFFER *keyid, BUFFER *seskey,
                   char *pubring)
{
  BUFFER *encrypt, *key, *id;
  int algo, sym, err = -1;
  int i, csum = 0;
  int tempbuf = 0;

  encrypt = buf_new();
  key = buf_new();
  id = buf_new();
  if (keyid == NULL) {
    keyid = buf_new();
    tempbuf = 1;
  }
  sym = seskey->data[0];
  if ((algo = pgpdb_getkey(PK_ENCRYPT, PGP_ANY, &sym, NULL, NULL, key, user, NULL, keyid,
                           pubring, NULL)) == -1)
    goto end;

  buf_setc(out, 3);             /* type */
  buf_cat(out, keyid);
  buf_appendc(out, algo);       /* algorithm */

  buf_set(encrypt, seskey);

  for (i = 1; i < encrypt->length; i++)
    csum = (csum + encrypt->data[i]) % 65536;
  buf_appendi(encrypt, csum);

  switch (algo) {
#ifdef USE_RSA
  case PGP_ES_RSA:
    err = pgp_rsa(encrypt, key, PK_ENCRYPT);
    mpi_put(out, encrypt);
    break;
#endif /* USE_RSA */
   case PGP_E_ELG:
    err = pgp_elgencrypt(encrypt, key);
    buf_cat(out, encrypt);
    break;
  default:
    errlog(NOTICE, "Unknown encryption algorithm.\n");
    err = -1;
    goto end;
  }
  if (err == -1) {
    errlog(ERRORMSG, "Encryption failed!\n");
    goto end;
  }
  pgp_packet(out, PGP_SESKEY);
end:
  if (tempbuf)
    buf_free(keyid);
  buf_free(id);
  buf_free(encrypt);
  buf_free(key);
  return (err);
}

void pgp_marker(BUFFER *out)
{
  buf_clear(out);
  buf_append(out, "PGP", 3);
  pgp_packet(out, PGP_MARKER);
}

int pgp_symsessionkey(BUFFER *out, BUFFER *seskey, BUFFER *pass)
{
  BUFFER *key;
  int sym;
  key = buf_new();

  sym = seskey->data[0];
  buf_setc(out, 4); /* version */
#ifdef MIMICPGP5
  pgp_makesk(out, key, sym, 1, PGP_H_MD5, pass);
#else /* end of MIMICPGP5 */
  pgp_makesk(out, key, sym, 3, PGP_H_SHA1, pass);
#endif /* else if not MIMICPGP5 */
  if (seskey->length > 1)
    buf_cat(out, seskey);
  else {
    buf_setc(seskey, sym);
    buf_cat(seskey, key);
  }
  pgp_packet(out, PGP_SYMSESKEY);
  buf_free(key);
  return (0);
}

int pgp_digest(int hashalgo, BUFFER *in, BUFFER *d)
{
  switch (hashalgo) {
   case PGP_H_MD5:
    digest_md5(in, d);
    return (0);
   case PGP_H_SHA1:
    digest_sha1(in, d);
    return (0);
  case PGP_H_RIPEMD:
    digest_rmd160(in, d);
    return (0);
   default:
    return (-1);
  }
}    

int asnprefix(BUFFER *b, int hashalgo)
{
  switch (hashalgo) {
  case PGP_H_MD5:
    buf_append(b, MD5PREFIX, sizeof(MD5PREFIX) - 1);
    return (0);
  case PGP_H_SHA1:
    buf_append(b, SHA1PREFIX, sizeof(SHA1PREFIX) - 1);
    return (0);
  default:
    return (-1);
  }
}

int pgp_expandsk(BUFFER *key, int skalgo, int hashalgo, BUFFER *data)
{
  BUFFER *temp;
  int keylen;
  int err = 0;
  temp = buf_new();

  keylen = pgp_keylen(skalgo);
  buf_clear(key);
  while (key->length < keylen) {
    if (pgp_digest(hashalgo, data, temp) == -1) {
      err = -1;
      goto end;
    }
    buf_cat(key, temp);

    buf_setc(temp, 0);
    buf_cat(temp, data);
    buf_move(data, temp);
  }

  if (key->length > keylen) {
    buf_set(temp, key);
    buf_get(temp, key, keylen);
  }
 end:
  buf_free(temp);
  return(err);
}

int pgp_makesk(BUFFER *out, BUFFER *key, int sym, int type, int hash,
               BUFFER *pass)
{
  int err = 0;
  BUFFER *salted;
  salted = buf_new();

  buf_appendc(out, sym);
  buf_appendc(out, type);
  buf_appendc(out, hash);
  switch (type) {
  case 0:
    buf_set(salted, pass);
    break;
  case 1:
    buf_appendrnd(salted, 8); /* salt */
    buf_cat(out, salted);
    buf_cat(salted, pass);
    break;
  case 3:
    buf_appendrnd(salted, 8); /* salt */
    buf_cat(out, salted);
    buf_appendc(out, 96); /* encoded count value 65536 */
    pgp_iteratedsk(salted, salted, pass, 96);
    break;
  default:
    err = -1;
  }
  pgp_expandsk(key, sym, hash, salted);
  buf_free(salted);
  return (err);
}

/* PGP/MIME needs to know the hash algorithm */
int pgp_signhashalgo(BUFFER *algo, BUFFER *userid, char *secring, BUFFER *pass)
{
  int pkalgo;

  pkalgo = pgpdb_getkey(PK_SIGN, PGP_ANY, NULL, NULL, NULL, NULL, userid, NULL, NULL,
                        secring, pass);
  if (pkalgo == PGP_S_DSA)
    buf_sets(algo, "sha1");
  if (pkalgo == PGP_ES_RSA)
    buf_sets(algo, "md5");
  return (pkalgo > 0 ? 0 : -1);
}

int pgp_sign(BUFFER *msg, BUFFER *msg2, BUFFER *sig, BUFFER *userid,
             BUFFER *pass, int type, int self, long now, int remail,
             BUFFER *keypacket, char *secring)
/*  msg:      data to be signed (buffer is modified)
    msg2:     additional data to be signed for certain sig types
    sig:      signature is placed here
    userid:   select signing key
    pass:     pass phrase for signing key
    type:     PGP signature type
    self:     is this a self-signature?
    now:      time of signature creation
    remail:   is this an anonymous message?
    keypacket: signature key
    secring:   key ring with signature key */
{
  BUFFER *key, *id, *d, *sub, *enc;
  int algo, err = -1;
  int version = 3, hashalgo;
  int type1;

  id = buf_new();
  d = buf_new();
  sub = buf_new();
  enc = buf_new();
  key = buf_new();

  if (now == 0) {
    now = time(NULL);
    if (remail)
      now -= rnd_number(4 * 24 * 60 * 60);
  }
  if (keypacket) {
    buf_rewind(keypacket);
    algo = pgp_getkey(PK_SIGN, PGP_ANY, NULL, NULL, NULL, keypacket, key, id, NULL, pass);
  } else
    algo = pgpdb_getkey(PK_SIGN, PGP_ANY, NULL, NULL, NULL, key, userid, NULL, id, secring,
                        pass);
  if (algo <= -1) {
    err = algo;
    goto end;
  }
  if (algo == PGP_S_DSA || algo == PGP_E_ELG)
    version = 4;
  if (version == 3)
    hashalgo = PGP_H_MD5;
  else
    hashalgo = PGP_H_SHA1;

  if (!self && type != PGP_SIG_BINDSUBKEY)
    version = 3;

  switch (type) {
   case PGP_SIG_CERT:
   case PGP_SIG_CERT1:
   case PGP_SIG_CERT2:
   case PGP_SIG_CERT3:
     type1 = pgp_getpacket(msg, d) == PGP_PUBKEY;
     assert (type1);
     buf_setc(msg, 0x99);
     buf_appendi(msg, d->length);
     buf_cat(msg, d);

     pgp_getpacket(msg2, d);
     switch (version) {
     case 3:
       buf_cat(msg, d);
       break;
     case 4:
       buf_appendc(msg, 0xb4);
       buf_appendl(msg, d->length);
       buf_cat(msg, d);
       break;
     }
     break;
   case PGP_SIG_BINDSUBKEY:
     type1 = pgp_getpacket(msg, d) == PGP_PUBKEY;
     assert (type1);
     buf_clear(msg);
     buf_appendc(msg, 0x99);
     buf_appendi(msg, d->length);
     buf_cat(msg, d);
     
     type1 = pgp_getpacket(msg2, d) == PGP_PUBSUBKEY;
     assert (type1);
     buf_appendc(msg, 0x99);
     buf_appendi(msg, d->length);
     buf_cat(msg, d);
     break;
   case PGP_SIG_BINARY:
     break;
   case PGP_SIG_CANONIC:
    pgp_sigcanonic(msg);
    break;
   default:
    NOT_IMPLEMENTED;
  }
  switch (version) {
   case 3:
    buf_set(d, msg);
    buf_appendc(d, type);
    buf_appendl(d, now);
    pgp_digest(hashalgo, d, d);
    if (algo == PGP_ES_RSA)
      asnprefix(enc, hashalgo);
    buf_cat(enc, d);
    err = pgp_dosign(algo, enc, key);

    buf_setc(sig, version);
    buf_appendc(sig, 5);
    buf_appendc(sig, type);
    buf_appendl(sig, now);
    buf_cat(sig, id);
    buf_appendc(sig, algo);
    buf_appendc(sig, hashalgo);
    buf_append(sig, d->data, 2);
    buf_cat(sig, enc);
    break;

   case 4:
    buf_setc(sig, version);
    buf_appendc(sig, type);
    buf_appendc(sig, algo);
    buf_appendc(sig, hashalgo);

    buf_clear(d);
    buf_appendl(d, now);
    pgp_subpacket(d, PGP_SUB_CREATIME);
    buf_cat(sub, d);

    if (self || type == PGP_SIG_BINDSUBKEY) {
      if (KEYLIFETIME) { /* add key expirtaion time */
        buf_clear(d);
        buf_appendl(d, KEYLIFETIME);
        pgp_subpacket(d, PGP_SUB_KEYEXPIRETIME);
        buf_cat(sub, d);
      }
    }

    if (self) {
      buf_setc(d, PGP_K_CAST5);
#ifdef USE_AES 
      buf_appendc(d, PGP_K_AES128);
#endif /* USE_AES */
      buf_appendc(d, PGP_K_3DES);
      pgp_subpacket(d, PGP_SUB_PSYMMETRIC);
      buf_cat(sub, d);

      buf_setc(d, 0x01); /* now we support MDC, so we can add MDC flag */
      pgp_subpacket(d, PGP_SUB_FEATURES);
      buf_cat(sub, d);
    }

    buf_appendi(sig, sub->length); /* hashed subpacket length */
    buf_cat(sig, sub);

    /* compute message digest */
    buf_set(d, msg);
    buf_cat(d, sig);
    buf_appendc(d, version);
    buf_appendc(d, 0xff);
    buf_appendl(d, sig->length);
    pgp_digest(hashalgo, d, d);

    pgp_subpacket(id, PGP_SUB_ISSUER);
    buf_appendi(sig, id->length); /* unhashed subpacket length */
    buf_cat(sig, id);

    buf_append(sig, d->data, 2);

    if (algo == PGP_ES_RSA)
      asnprefix(enc, hashalgo);
    buf_cat(enc, d);
    err = pgp_dosign(algo, enc, key);
    buf_cat(sig, enc);
    break;
  } 
  pgp_packet(sig, PGP_SIG);

end:
  buf_free(key);
  buf_free(id);
  buf_free(d);
  buf_free(sub);
  buf_free(enc);
  return (err);
}

int pgp_pubkeycert(BUFFER *userid, char *keyring, BUFFER *pass,
                   BUFFER *out, int remail)
{
  BUFFER *key;
  KEYRING *r;
  int err = -1;

  key = buf_new();
  r = pgpdb_open(keyring, pass, 0);
  if (r != NULL)
    while (pgpdb_getnext(r, key, NULL, userid) != -1) {
      if (pgp_makepubkey(key, NULL, out, pass, 0) != -1)
        err = 0;
    }
  if (err == 0)
    pgp_armor(out, remail);
  else
    buf_clear(out);
  buf_free(key);
  return (err);
}

#endif /* USE_PGP */
1	/* Mixmaster version 3 -- (C) 1999 Anonymizer Inc.
2
3	Mixmaster may be redistributed and modified under certain conditions.
4	This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF
5	ANY KIND, either express or implied. See the file COPYRIGHT for
6	details.
7
8	Create OpenPGP packets
9	$Id: pgpcreat.c,v 1.11 2002/09/20 17:59:25 disastry Exp $ */
10
11
12	#include "mix3.h"
13	#ifdef USE_PGP
14	#include "pgp.h"
15	#include "crypto.h"
16	#include <assert.h>
17	#include <time.h>
18	#include <string.h>
19
20	int pgp_packet(BUFFER *in, int type)
21	{
22	int ctb;
23	BUFFER *out;
24
25	out = buf_new();
26	if (type > 15) {
27	ctb = 0xC0 \| type; /* make v4 packet */
28	buf_setc(out, ctb);
29	if (in->length > 8383) {
30	buf_appendc(out, 0xFF);
31	buf_appendl(out, in->length);
32	} else if (in->length > 191) {
33	#if 0
34	buf_appendc(out, ((in->length-192) >> 8) + 192);
35	buf_appendc(out, (in->length-192) & 0xFF);
36	#else /* end of 0 */
37	buf_appendi(out, in->length - 0xC0 + 0xC000);
38	#endif /* else if not 0 */
39	} else {
40	buf_appendc(out, in->length);
41	}
42	} else {
43	ctb = 128 + (type << 2);
44	if (in->length < 256 && type != PGP_PUBKEY && type != PGP_SECKEY &&
45	type != PGP_SIG && type != PGP_PUBSUBKEY && type != PGP_SECSUBKEY
46	#ifdef MIMIC
47	&& type != PGP_ENCRYPTED
48	#endif /* MIMIC */
49	) {
50	buf_setc(out, ctb);
51	buf_appendc(out, in->length);
52	}
53	#ifndef MIMIC
54	else if (in->length < 65536)
55	#else /* end of not MIMIC */
56	else if ((type == PGP_PUBKEY \|\| type == PGP_SECKEY \|\| type == PGP_SIG
57	\|\| type == PGP_SESKEY \|\| type == PGP_PUBSUBKEY \|\|
58	type == PGP_SECSUBKEY) && in->length < 65536)
59	#endif /* else if MIMIC */
60	{
61	buf_appendc(out, ctb \| 1);
62	buf_appendi(out, in->length);
63	} else {
64	buf_appendc(out, ctb \| 2);
65	buf_appendl(out, in->length);
66	}
67	}
68	buf_cat(out, in);
69	buf_move(in, out);
70	buf_free(out);
71	return (0);
72	}
73
74	int pgp_subpacket(BUFFER *in, int type)
75	{
76	BUFFER *out;
77	int len;
78
79	out = buf_new();
80	len = in->length + 1;
81	if (len < 192)
82	buf_setc(out, len);
83	else {
84	buf_setc(out, 255);
85	buf_appendl(out, len);
86	}
87	buf_appendc(out, type);
88	buf_cat(out, in);
89	buf_move(in, out);
90	buf_free(out);
91	return (0);
92	}
93
94	int pgp_packet3(BUFFER *in, int type)
95	{
96	#ifdef MIMIC
97	int ctb;
98	BUFFER *out;
99
100	out = buf_new();
101	ctb = 128 + (type << 2);
102	buf_setc(out, ctb \| 3);
103	buf_cat(out, in);
104	buf_move(in, out);
105	buf_free(out);
106	return (0);
107	#else /* end of MIMIC */
108	return pgp_packet(in, type);
109	#endif /* else if not MIMIC */
110	}
111
112	#ifdef USE_IDEA
113	static int pgp_ideaencrypt(BUFFER in, BUFFER out, BUFFER *key, int mdc)
114	{
115	byte iv[8];
116	int i, n = 0;
117	IDEA_KEY_SCHEDULE ks;
118	SHA_CTX c;
119
120	assert(key->length == 17);
121
122	for (i = 0; i < 8; i++)
123	iv[i] = 0;
124
125	idea_set_encrypt_key(key->data + 1, &ks);
126
127	if (mdc) {
128	mdc = 1;
129	out->data[0] = 1;
130	}
131	rnd_bytes(out->data + mdc, 8);
132	out->data[8 + mdc] = out->data[6 + mdc], out->data[9 + mdc] = out->data[7 + mdc];
133	if (mdc) {
134	SHA1_Init(&c);
135	SHA1_Update(&c, out->data + 1, 10);
136	SHA1_Update(&c, in->data, in->length);
137	}
138	n = 0;
139	idea_cfb64_encrypt(out->data + mdc, out->data + mdc, 10, &ks, iv, &n, IDEA_ENCRYPT);
140	if (!mdc) {
141	iv[6] = iv[0], iv[7] = iv[1];
142	memcpy(iv, out->data + 2, 6);
143	n = 0;
144	}
145	idea_cfb64_encrypt(in->data, out->data + 10 + mdc, in->length, &ks, iv, &n,
146	IDEA_ENCRYPT);
147	if (mdc) {
148	SHA1_Update(&c, "\xD3\x14", 2); /* 0xD3 = 0xC0 \| PGP_MDC */
149	idea_cfb64_encrypt("\xD3\x14", out->data + 11 + in->length, 2, &ks, iv, &n,
150	IDEA_ENCRYPT);
151	SHA1_Final(out->data + 13 + in->length, &c);
152	idea_cfb64_encrypt(out->data + 13 + in->length, out->data + 13 + in->length, 20, &ks, iv, &n,
153	IDEA_ENCRYPT);
154	}
155	return (0);
156	}
157	#endif /* USE_IDEA */
158
159	static int pgp_3desencrypt(BUFFER in, BUFFER out, BUFFER *key, int mdc)
160	{
161	des_cblock iv;
162	int i, n = 0;
163	des_key_schedule ks1;
164	des_key_schedule ks2;
165	des_key_schedule ks3;
166	SHA_CTX c;
167
168	assert(key->length == 25);
169
170	for (i = 0; i < 8; i++)
171	iv[i] = 0;
172
173	des_set_key((const_des_cblock *) (key->data + 1), ks1);
174	des_set_key((const_des_cblock *) (key->data + 9), ks2);
175	des_set_key((const_des_cblock *) (key->data+ 17), ks3);
176
177	if (mdc) {
178	mdc = 1;
179	out->data[0] = 1;
180	}
181	rnd_bytes(out->data + mdc, 8);
182	out->data[8 + mdc] = out->data[6 + mdc], out->data[9 + mdc] = out->data[7 + mdc];
183	if (mdc) {
184	SHA1_Init(&c);
185	SHA1_Update(&c, out->data + 1, 10);
186	SHA1_Update(&c, in->data, in->length);
187	}
188	n = 0;
189	des_ede3_cfb64_encrypt(out->data + mdc, out->data + mdc, 10, ks1, ks2, ks3, &iv, &n,
190	ENCRYPT);
191	if (!mdc) {
192	iv[6] = iv[0], iv[7] = iv[1];
193	memcpy(iv, out->data + 2, 6);
194	n = 0;
195	}
196	des_ede3_cfb64_encrypt(in->data, out->data + 10 + mdc, in->length, ks1, ks2, ks3,
197	&iv, &n, ENCRYPT);
198	if (mdc) {
199	SHA1_Update(&c, "\xD3\x14", 2); /* 0xD3 = 0xC0 \| PGP_MDC */
200	des_ede3_cfb64_encrypt("\xD3\x14", out->data + 11 + in->length, 2, ks1, ks2, ks3,
201	&iv, &n, ENCRYPT);
202	SHA1_Final(out->data + 13 + in->length, &c);
203	des_ede3_cfb64_encrypt(out->data + 13 + in->length, out->data + 13 + in->length, 20, ks1, ks2, ks3,
204	&iv, &n, ENCRYPT);
205	}
206	return (0);
207	}
208
209	static int pgp_castencrypt(BUFFER in, BUFFER out, BUFFER *key, int mdc)
210	{
211	byte iv[8];
212	int i, n = 0;
213	CAST_KEY ks;
214	SHA_CTX c;
215
216	assert(key->length == 17);
217
218	for (i = 0; i < 8; i++)
219	iv[i] = 0;
220
221	CAST_set_key(&ks, 16, key->data + 1);
222
223	if (mdc) {
224	mdc = 1;
225	out->data[0] = 1;
226	}
227	rnd_bytes(out->data + mdc, 8);
228	out->data[8 + mdc] = out->data[6 + mdc], out->data[9 + mdc] = out->data[7 + mdc];
229	if (mdc) {
230	SHA1_Init(&c);
231	SHA1_Update(&c, out->data + 1, 10);
232	SHA1_Update(&c, in->data, in->length);
233	}
234	n = 0;
235	CAST_cfb64_encrypt(out->data + mdc, out->data + mdc, 10, &ks, iv, &n, CAST_ENCRYPT);
236	if (!mdc) {
237	iv[6] = iv[0], iv[7] = iv[1];
238	memcpy(iv, out->data + 2, 6);
239	n = 0;
240	}
241	CAST_cfb64_encrypt(in->data, out->data + 10 + mdc, in->length, &ks, iv, &n,
242	CAST_ENCRYPT);
243	if (mdc) {
244	SHA1_Update(&c, "\xD3\x14", 2); /* 0xD3 = 0xC0 \| PGP_MDC */
245	CAST_cfb64_encrypt("\xD3\x14", out->data + 11 + in->length, 2, &ks, iv, &n,
246	CAST_ENCRYPT);
247	SHA1_Final(out->data + 13 + in->length, &c);
248	CAST_cfb64_encrypt(out->data + 13 + in->length, out->data + 13 + in->length, 20, &ks, iv, &n,
249	CAST_ENCRYPT);
250	}
251	return (0);
252	}
253
254	static int pgp_bfencrypt(BUFFER in, BUFFER out, BUFFER *key, int mdc)
255	{
256	byte iv[8];
257	int i, n = 0;
258	BF_KEY ks;
259	SHA_CTX c;
260
261	assert(key->length == 17);
262
263	for (i = 0; i < 8; i++)
264	iv[i] = 0;
265
266	BF_set_key(&ks, 16, key->data + 1);
267
268	if (mdc) {
269	mdc = 1;
270	out->data[0] = 1;
271	}
272	rnd_bytes(out->data + mdc, 8);
273	out->data[8 + mdc] = out->data[6 + mdc], out->data[9 + mdc] = out->data[7 + mdc];
274	if (mdc) {
275	SHA1_Init(&c);
276	SHA1_Update(&c, out->data + 1, 10);
277	SHA1_Update(&c, in->data, in->length);
278	}
279	n = 0;
280	BF_cfb64_encrypt(out->data + mdc, out->data + mdc, 10, &ks, iv, &n, BF_ENCRYPT);
281	if (!mdc) {
282	iv[6] = iv[0], iv[7] = iv[1];
283	memcpy(iv, out->data + 2, 6);
284	n = 0;
285	}
286	BF_cfb64_encrypt(in->data, out->data + 10 + mdc, in->length, &ks, iv, &n,
287	BF_ENCRYPT);
288	if (mdc) {
289	SHA1_Update(&c, "\xD3\x14", 2); /* 0xD3 = 0xC0 \| PGP_MDC */
290	BF_cfb64_encrypt("\xD3\x14", out->data + 11 + in->length, 2, &ks, iv, &n,
291	BF_ENCRYPT);
292	SHA1_Final(out->data + 13 + in->length, &c);
293	BF_cfb64_encrypt(out->data + 13 + in->length, out->data + 13 + in->length, 20, &ks, iv, &n,
294	BF_ENCRYPT);
295	}
296	return (0);
297	}
298
299	#ifdef USE_AES
300	static int pgp_aesencrypt(BUFFER in, BUFFER out, BUFFER *key, int mdc)
301	{
302	byte iv[16];
303	int i, n = 0;
304	AES_KEY ks;
305	SHA_CTX c;
306
307	assert(key->length == 17 \|\| key->length == 25 \|\| key->length == 33);
308
309	for (i = 0; i < 16; i++)
310	iv[i] = 0;
311
312	AES_set_encrypt_key(key->data + 1, (key->length-1)<<3, &ks);
313
314	if (mdc) {
315	mdc = 1;
316	out->data[0] = 1;
317	}
318	rnd_bytes(out->data + mdc, 16);
319	out->data[16 + mdc] = out->data[14 + mdc], out->data[17 + mdc] = out->data[15 + mdc];
320	if (mdc) {
321	SHA1_Init(&c);
322	SHA1_Update(&c, out->data + 1, 18);
323	SHA1_Update(&c, in->data, in->length);
324	}
325	n = 0;
326	AES_cfb128_encrypt(out->data + mdc, out->data + mdc, 18, &ks, iv, &n, AES_ENCRYPT);
327	if (!mdc) {
328	iv[14] = iv[0], iv[15] = iv[1];
329	memcpy(iv, out->data + 2, 14);
330	n = 0;
331	}
332	AES_cfb128_encrypt(in->data, out->data + 18 + mdc, in->length, &ks, iv, &n,
333	AES_ENCRYPT);
334	if (mdc) {
335	SHA1_Update(&c, "\xD3\x14", 2); /* 0xD3 = 0xC0 \| PGP_MDC */
336	AES_cfb128_encrypt("\xD3\x14", out->data + 19 + in->length, 2, &ks, iv, &n,
337	AES_ENCRYPT);
338	SHA1_Final(out->data + 21 + in->length, &c);
339	AES_cfb128_encrypt(out->data + 21 + in->length, out->data + 21 + in->length, 20, &ks, iv, &n,
340	AES_ENCRYPT);
341	}
342	return (0);
343	}
344	#endif /* USE_AES */
345
346	int pgp_symmetric(BUFFER in, BUFFER key, int mdc)
347	{
348	BUFFER *out;
349	int sym;
350
351	out = buf_new();
352	if (pgp_blocklen(sym = buf_getc(key)) > 8)
353	mdc = 1; /* force MDC for AES */
354	buf_prepare(out, in->length + (mdc?(1+2+22):2) + pgp_blocklen(sym));
355	switch (sym) {
356	#ifdef USE_IDEA
357	case PGP_K_IDEA:
358	pgp_ideaencrypt(in, out, key, mdc);
359	break;
360	#endif /* USE_IDEA */
361	#ifdef USE_AES
362	case PGP_K_AES128:
363	case PGP_K_AES192:
364	case PGP_K_AES256:
365	pgp_aesencrypt(in, out, key, mdc);
366	break;
367	#endif /* USE_AES */
368	case PGP_K_3DES:
369	pgp_3desencrypt(in, out, key, mdc);
370	break;
371	case PGP_K_CAST5:
372	pgp_castencrypt(in, out, key, mdc);
373	break;
374	case PGP_K_BF:
375	pgp_bfencrypt(in, out, key, mdc);
376	break;
377	default:
378	errlog(ERRORMSG, "Unknown symmetric algorithm.\n");
379	}
380	pgp_packet(out, mdc?PGP_ENCRYPTEDMDC:PGP_ENCRYPTED);
381
382	buf_move(in, out);
383	buf_free(out);
384	return (0);
385	}
386
387	int pgp_literal(BUFFER b, char filename, int text)
388	{
389	BUFFER *out;
390	BUFFER *line;
391
392	if (filename == NULL)
393	filename = "stdin";
394
395	if (strlen(filename) > 255)
396	return (-1);
397
398	out = buf_new();
399	line = buf_new();
400
401	if (text)
402	buf_setc(out, 't');
403	else
404	buf_setc(out, 'b');
405	buf_appendc(out, strlen(filename));
406	buf_appends(out, filename);
407	buf_appendl(out, 0); /* timestamp */
408
409	if (b->length > 0) {
410	if (text)
411	while (buf_getline(b, line) != -1) {
412	buf_cat(out, line);
413	buf_appends(out, "\r\n");
414	} else
415	buf_cat(out, b);
416	}
417	pgp_packet(out, PGP_LITERAL);
418	buf_move(b, out);
419	buf_free(out);
420	buf_free(line);
421
422	return (0);
423	}
424
425	int pgp_compress(BUFFER *in)
426	{
427	int err;
428	BUFFER *out;
429
430	out = buf_new();
431	buf_setc(out, 1);
432	err = buf_zip(out, in, 13);
433	if (err == 0) {
434	pgp_packet3(out, PGP_COMPRESSED);
435	buf_move(in, out);
436	}
437	buf_free(out);
438	return (err);
439	}
440
441	int pgp_sessionkey(BUFFER out, BUFFER user, BUFFER keyid, BUFFER seskey,
442	char *pubring)
443	{
444	BUFFER encrypt, key, *id;
445	int algo, sym, err = -1;
446	int i, csum = 0;
447	int tempbuf = 0;
448
449	encrypt = buf_new();
450	key = buf_new();
451	id = buf_new();
452	if (keyid == NULL) {
453	keyid = buf_new();
454	tempbuf = 1;
455	}
456	sym = seskey->data[0];
457	if ((algo = pgpdb_getkey(PK_ENCRYPT, PGP_ANY, &sym, NULL, NULL, key, user, NULL, keyid,
458	pubring, NULL)) == -1)
459	goto end;
460
461	buf_setc(out, 3); /* type */
462	buf_cat(out, keyid);
463	buf_appendc(out, algo); /* algorithm */
464
465	buf_set(encrypt, seskey);
466
467	for (i = 1; i < encrypt->length; i++)
468	csum = (csum + encrypt->data[i]) % 65536;
469	buf_appendi(encrypt, csum);
470
471	switch (algo) {
472	#ifdef USE_RSA
473	case PGP_ES_RSA:
474	err = pgp_rsa(encrypt, key, PK_ENCRYPT);
475	mpi_put(out, encrypt);
476	break;
477	#endif /* USE_RSA */
478	case PGP_E_ELG:
479	err = pgp_elgencrypt(encrypt, key);
480	buf_cat(out, encrypt);
481	break;
482	default:
483	errlog(NOTICE, "Unknown encryption algorithm.\n");
484	err = -1;
485	goto end;
486	}
487	if (err == -1) {
488	errlog(ERRORMSG, "Encryption failed!\n");
489	goto end;
490	}
491	pgp_packet(out, PGP_SESKEY);
492	end:
493	if (tempbuf)
494	buf_free(keyid);
495	buf_free(id);
496	buf_free(encrypt);
497	buf_free(key);
498	return (err);
499	}
500
501	void pgp_marker(BUFFER *out)
502	{
503	buf_clear(out);
504	buf_append(out, "PGP", 3);
505	pgp_packet(out, PGP_MARKER);
506	}
507
508	int pgp_symsessionkey(BUFFER out, BUFFER seskey, BUFFER *pass)
509	{
510	BUFFER *key;
511	int sym;
512	key = buf_new();
513
514	sym = seskey->data[0];
515	buf_setc(out, 4); /* version */
516	#ifdef MIMICPGP5
517	pgp_makesk(out, key, sym, 1, PGP_H_MD5, pass);
518	#else /* end of MIMICPGP5 */
519	pgp_makesk(out, key, sym, 3, PGP_H_SHA1, pass);
520	#endif /* else if not MIMICPGP5 */
521	if (seskey->length > 1)
522	buf_cat(out, seskey);
523	else {
524	buf_setc(seskey, sym);
525	buf_cat(seskey, key);
526	}
527	pgp_packet(out, PGP_SYMSESKEY);
528	buf_free(key);
529	return (0);
530	}
531
532	int pgp_digest(int hashalgo, BUFFER in, BUFFER d)
533	{
534	switch (hashalgo) {
535	case PGP_H_MD5:
536	digest_md5(in, d);
537	return (0);
538	case PGP_H_SHA1:
539	digest_sha1(in, d);
540	return (0);
541	case PGP_H_RIPEMD:
542	digest_rmd160(in, d);
543	return (0);
544	default:
545	return (-1);
546	}
547	}
548
549	int asnprefix(BUFFER *b, int hashalgo)
550	{
551	switch (hashalgo) {
552	case PGP_H_MD5:
553	buf_append(b, MD5PREFIX, sizeof(MD5PREFIX) - 1);
554	return (0);
555	case PGP_H_SHA1:
556	buf_append(b, SHA1PREFIX, sizeof(SHA1PREFIX) - 1);
557	return (0);
558	default:
559	return (-1);
560	}
561	}
562
563	int pgp_expandsk(BUFFER key, int skalgo, int hashalgo, BUFFER data)
564	{
565	BUFFER *temp;
566	int keylen;
567	int err = 0;
568	temp = buf_new();
569
570	keylen = pgp_keylen(skalgo);
571	buf_clear(key);
572	while (key->length < keylen) {
573	if (pgp_digest(hashalgo, data, temp) == -1) {
574	err = -1;
575	goto end;
576	}
577	buf_cat(key, temp);
578
579	buf_setc(temp, 0);
580	buf_cat(temp, data);
581	buf_move(data, temp);
582	}
583
584	if (key->length > keylen) {
585	buf_set(temp, key);
586	buf_get(temp, key, keylen);
587	}
588	end:
589	buf_free(temp);
590	return(err);
591	}
592
593	int pgp_makesk(BUFFER out, BUFFER key, int sym, int type, int hash,
594	BUFFER *pass)
595	{
596	int err = 0;
597	BUFFER *salted;
598	salted = buf_new();
599
600	buf_appendc(out, sym);
601	buf_appendc(out, type);
602	buf_appendc(out, hash);
603	switch (type) {
604	case 0:
605	buf_set(salted, pass);
606	break;
607	case 1:
608	buf_appendrnd(salted, 8); /* salt */
609	buf_cat(out, salted);
610	buf_cat(salted, pass);
611	break;
612	case 3:
613	buf_appendrnd(salted, 8); /* salt */
614	buf_cat(out, salted);
615	buf_appendc(out, 96); /* encoded count value 65536 */
616	pgp_iteratedsk(salted, salted, pass, 96);
617	break;
618	default:
619	err = -1;
620	}
621	pgp_expandsk(key, sym, hash, salted);
622	buf_free(salted);
623	return (err);
624	}
625
626	/* PGP/MIME needs to know the hash algorithm */
627	int pgp_signhashalgo(BUFFER algo, BUFFER userid, char secring, BUFFER pass)
628	{
629	int pkalgo;
630
631	pkalgo = pgpdb_getkey(PK_SIGN, PGP_ANY, NULL, NULL, NULL, NULL, userid, NULL, NULL,
632	secring, pass);
633	if (pkalgo == PGP_S_DSA)
634	buf_sets(algo, "sha1");
635	if (pkalgo == PGP_ES_RSA)
636	buf_sets(algo, "md5");
637	return (pkalgo > 0 ? 0 : -1);
638	}
639
640	int pgp_sign(BUFFER msg, BUFFER msg2, BUFFER sig, BUFFER userid,
641	BUFFER *pass, int type, int self, long now, int remail,
642	BUFFER keypacket, char secring)
643	/* msg: data to be signed (buffer is modified)
644	msg2: additional data to be signed for certain sig types
645	sig: signature is placed here
646	userid: select signing key
647	pass: pass phrase for signing key
648	type: PGP signature type
649	self: is this a self-signature?
650	now: time of signature creation
651	remail: is this an anonymous message?
652	keypacket: signature key
653	secring: key ring with signature key */
654	{
655	BUFFER key, id, d, sub, *enc;
656	int algo, err = -1;
657	int version = 3, hashalgo;
658	int type1;
659
660	id = buf_new();
661	d = buf_new();
662	sub = buf_new();
663	enc = buf_new();
664	key = buf_new();
665
666	if (now == 0) {
667	now = time(NULL);
668	if (remail)
669	now -= rnd_number(4 * 24 * 60 * 60);
670	}
671	if (keypacket) {
672	buf_rewind(keypacket);
673	algo = pgp_getkey(PK_SIGN, PGP_ANY, NULL, NULL, NULL, keypacket, key, id, NULL, pass);
674	} else
675	algo = pgpdb_getkey(PK_SIGN, PGP_ANY, NULL, NULL, NULL, key, userid, NULL, id, secring,
676	pass);
677	if (algo <= -1) {
678	err = algo;
679	goto end;
680	}
681	if (algo == PGP_S_DSA \|\| algo == PGP_E_ELG)
682	version = 4;
683	if (version == 3)
684	hashalgo = PGP_H_MD5;
685	else
686	hashalgo = PGP_H_SHA1;
687
688	if (!self && type != PGP_SIG_BINDSUBKEY)
689	version = 3;
690
691	switch (type) {
692	case PGP_SIG_CERT:
693	case PGP_SIG_CERT1:
694	case PGP_SIG_CERT2:
695	case PGP_SIG_CERT3:
696	type1 = pgp_getpacket(msg, d) == PGP_PUBKEY;
697	assert (type1);
698	buf_setc(msg, 0x99);
699	buf_appendi(msg, d->length);
700	buf_cat(msg, d);
701
702	pgp_getpacket(msg2, d);
703	switch (version) {
704	case 3:
705	buf_cat(msg, d);
706	break;
707	case 4:
708	buf_appendc(msg, 0xb4);
709	buf_appendl(msg, d->length);
710	buf_cat(msg, d);
711	break;
712	}
713	break;
714	case PGP_SIG_BINDSUBKEY:
715	type1 = pgp_getpacket(msg, d) == PGP_PUBKEY;
716	assert (type1);
717	buf_clear(msg);
718	buf_appendc(msg, 0x99);
719	buf_appendi(msg, d->length);
720	buf_cat(msg, d);
721
722	type1 = pgp_getpacket(msg2, d) == PGP_PUBSUBKEY;
723	assert (type1);
724	buf_appendc(msg, 0x99);
725	buf_appendi(msg, d->length);
726	buf_cat(msg, d);
727	break;
728	case PGP_SIG_BINARY:
729	break;
730	case PGP_SIG_CANONIC:
731	pgp_sigcanonic(msg);
732	break;
733	default:
734	NOT_IMPLEMENTED;
735	}
736	switch (version) {
737	case 3:
738	buf_set(d, msg);
739	buf_appendc(d, type);
740	buf_appendl(d, now);
741	pgp_digest(hashalgo, d, d);
742	if (algo == PGP_ES_RSA)
743	asnprefix(enc, hashalgo);
744	buf_cat(enc, d);
745	err = pgp_dosign(algo, enc, key);
746
747	buf_setc(sig, version);
748	buf_appendc(sig, 5);
749	buf_appendc(sig, type);
750	buf_appendl(sig, now);
751	buf_cat(sig, id);
752	buf_appendc(sig, algo);
753	buf_appendc(sig, hashalgo);
754	buf_append(sig, d->data, 2);
755	buf_cat(sig, enc);
756	break;
757
758	case 4:
759	buf_setc(sig, version);
760	buf_appendc(sig, type);
761	buf_appendc(sig, algo);
762	buf_appendc(sig, hashalgo);
763
764	buf_clear(d);
765	buf_appendl(d, now);
766	pgp_subpacket(d, PGP_SUB_CREATIME);
767	buf_cat(sub, d);
768
769	if (self \|\| type == PGP_SIG_BINDSUBKEY) {
770	if (KEYLIFETIME) { /* add key expirtaion time */
771	buf_clear(d);
772	buf_appendl(d, KEYLIFETIME);
773	pgp_subpacket(d, PGP_SUB_KEYEXPIRETIME);
774	buf_cat(sub, d);
775	}
776	}
777
778	if (self) {
779	buf_setc(d, PGP_K_CAST5);
780	#ifdef USE_AES
781	buf_appendc(d, PGP_K_AES128);
782	#endif /* USE_AES */
783	buf_appendc(d, PGP_K_3DES);
784	pgp_subpacket(d, PGP_SUB_PSYMMETRIC);
785	buf_cat(sub, d);
786
787	buf_setc(d, 0x01); /* now we support MDC, so we can add MDC flag */
788	pgp_subpacket(d, PGP_SUB_FEATURES);
789	buf_cat(sub, d);
790	}
791
792	buf_appendi(sig, sub->length); /* hashed subpacket length */
793	buf_cat(sig, sub);
794
795	/* compute message digest */
796	buf_set(d, msg);
797	buf_cat(d, sig);
798	buf_appendc(d, version);
799	buf_appendc(d, 0xff);
800	buf_appendl(d, sig->length);
801	pgp_digest(hashalgo, d, d);
802
803	pgp_subpacket(id, PGP_SUB_ISSUER);
804	buf_appendi(sig, id->length); /* unhashed subpacket length */
805	buf_cat(sig, id);
806
807	buf_append(sig, d->data, 2);
808
809	if (algo == PGP_ES_RSA)
810	asnprefix(enc, hashalgo);
811	buf_cat(enc, d);
812	err = pgp_dosign(algo, enc, key);
813	buf_cat(sig, enc);
814	break;
815	}
816	pgp_packet(sig, PGP_SIG);
817
818	end:
819	buf_free(key);
820	buf_free(id);
821	buf_free(d);
822	buf_free(sub);
823	buf_free(enc);
824	return (err);
825	}
826
827	int pgp_pubkeycert(BUFFER userid, char keyring, BUFFER *pass,
828	BUFFER *out, int remail)
829	{
830	BUFFER *key;
831	KEYRING *r;
832	int err = -1;
833
834	key = buf_new();
835	r = pgpdb_open(keyring, pass, 0);
836	if (r != NULL)
837	while (pgpdb_getnext(r, key, NULL, userid) != -1) {
838	if (pgp_makepubkey(key, NULL, out, pass, 0) != -1)
839	err = 0;
840	}
841	if (err == 0)
842	pgp_armor(out, remail);
843	else
844	buf_clear(out);
845	buf_free(key);
846	return (err);
847	}
848
849	#endif /* USE_PGP */