bugfix for gpg algo choices, further plans?

Alexander Zangerl <[email protected]> Fri, 20 Jan 2012 00:47:22 +1000
Newsgroups gmane.mail.exmh.devel
Message-ID <[email protected]> 
i've just found a problem where exmh doesn't accept a valid 
key passphrase as valid if the digest/cipher preferences are unsuitable.

exmh only lists a few of gpg's cipher/digest/compression algorithms
as choice on the gnupg preference page. 
furthermore, it doesn't offer an option to *not* override gpg's choice
of algorithms.

this means that with digest algo sha1 (the default) and a newish/largish 
(sub)key exmh will never accept the correct passphrase: 
it runs gpg --sign --digest-algo sha1 ... to test the 
passphrase, but gpg refuses that combo with the error 
message 'gpg: DSA key xxxxx requires a 256 bit or larger hash'.

solution: don't use --digest-algo but rather --personal-digest-preferences
(ditto for cipher and compression)
which is softer in the sense of overriding gpg's choices only if possible;
second, add an option to exmh for not setting any explicit algos at all,
and third, update the list of available algorithms.

the attached patch does all that, and unless somebody objects i'll
commit that to cvs on the weekend.

however, i'd very much like to modernize the gpg options set altogether:
. add support for gpg's compatibility options (--pgp2, --pgp6...8, 
  --rfc1991, --rfc2440, --rfc4880 ) and  remove the messy pgp5 compat fiddling,
. get rid of the gpg module loading (as it's marked deprecated in the gpg
  docs, and one should do that preferrably from ~/.gnupg/gpg.conf anyway 
  - there is nothing exmh-specific about gpg modules),	
. and get rid of the fine-tuned cipher/hash/compression overrides 
  (because the general backwards-compat options do take care of oddball 
  situations, gpg usually makes sensible default choices and 
  has cipher prefs attached to the keys anyway.

any comments or objections to this plan of action?

regards
az

-- 
Alexander Zangerl + GnuPG Keys 0x42BD645D or 0x5B586291 + http://snafu.priv.at/
Saying that XP is the most stable MS OS is like saying that 
asparagus is the most articulate vegetable. -- Dave Barry

_______________________________________________
Exmh-workers mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/exmh-workers
gpgprefs.patch (application/octet-stream, 2.7 KB) 
--- lib/pgpGpg.tcl	2011-12-14 15:37:49.000000000 +1000
+++ /home/az/pgpGpg.tcl	2012-01-20 00:21:43.000000000 +1000
@@ -181,25 +181,23 @@
     Preferences_Add "$label interface" {} [list \
                 [list pgp(gpg,cipheralgo) gpgCipherAlgo \
 [concat CHOICE $pgp(gpg,cipheralgos)] "Default Cipher Algo" \
-"Your preferred cipher algorithm."] \
+"Your preferred cipher algorithm. Select 'default' to leave the choice to GnuPG."] \
                 [list pgp(gpg,digestalgo) gpgDigestAlgo \
 [concat CHOICE $pgp(gpg,digestalgos)] "Default Digest Algo" \
-"Your preferred digest algorithm."] \
+"Your preferred digest algorithm. Select 'default' to leave the choice to GnuPG."] \
                 [list pgp(gpg,compressalgo) gpgCompressAlgo \
 [concat CHOICE $pgp(gpg,compressalgos)] "Default Compress Algo" \
 "The algorithm, GnuPG uses to compress the text before encrypting.
-You have the choice between the ZIP (RFC1951)
-and the ZLIB (RFC1950) algo. ZIP is used by PGP(2/5).
-If you choose none, the text is left uncompressed." ] ]
+Select 'default' to leave the choice to GnuPG, or 'none' to leave text uncompressed." ] ]
     } 
 
 
 #######################################################################
 # GPG BASIC CONFIG
 # builtin gpg algos
-set pgp(gpg,cipheralgos) {3des cast5 blowfish twofish}
-set pgp(gpg,digestalgos) {sha1 md5 ripemd160}
-set pgp(gpg,compressalgos) {zip zlib none}
+set pgp(gpg,cipheralgos) {default cast5 idea 3des blowfish aes aes192 aes256 twofish camellia128 camellia192 camellia256}
+set pgp(gpg,digestalgos) {default md5 sha1 ripemd160 sha224 sha256 sha384 sha512}
+set pgp(gpg,compressalgos) {default zip zlib bzip2 none}
 set pgp(gpg,pubkeyalgos) {}
 # module files
 set pgp(gpg,ciphermodfiles) {}
@@ -319,14 +317,19 @@
         set arglist [concat $arglist [list \
                      --load-extension $modfile] ]
     }
-    set arglist [concat $arglist [list \
-                     --cipher-algo $pgp(gpg,cipheralgo) \
-                     --digest-algo $pgp(gpg,digestalgo) ] ]
+    if {$pgp(gpg,cipheralgo) != "default"} {
+	lappend arglist --personal-cipher-preferences $pgp(gpg,cipheralgo)
+    }
+    if {$pgp(gpg,digestalgo) != "default"} {
+	lappend arglist --personal-digest-preferences $pgp(gpg,digestalgo)
+    }
     # compressalgo
-    switch $pgp(gpg,compressalgo) {
-        zip  { set arglist [concat $arglist --compress-algo 1] }
-        zlib { set arglist [concat $arglist --compress-algo 2] }
-        none { set arglist [concat $arglist -z 0] }
+    if {$pgp(gpg,compressalgo) != "default" } {
+	if {$pgp(gpg,compressalgo) == "none"} {
+	    lappend arglist -z 0
+	} else {
+	    lappend arglist --personal-compress-preferences $pgp(gpg,compressalgo)
+	} 
     }
     ldelete arglist {}
     return $arglist
signature.asc (application/pgp-signature, 230 B) 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iF4EAREIAAYFAk8YLQ0ACgkQ+bKELRvb2DzanQEA1A1MIs0izjYBY3ISt4YaouDC
L593T9Qw6ji+8VvksFcBAMFvoVOxo6OHzal1yipAUfENEgORwRm5I0phtVLhEHkO
=eQ6n
-----END PGP SIGNATURE-----