c++ - Why does GPGME / GnuPG use pinentry for password input? -

-

gpgme uses passphrase_cb method fetch password user operations, require access private keys. callback can overwritten symmetric encryption, in other cases default pinentry used.

all effort seems pretty uncomfortable, because gpgme api shall used programming c/c++/... applications. might easier (for programmer use gpgme) in cases if passphrase passed encrypt/sign functions directly. saw other implementations of openpgp (to more precise netpgp) use callback.

so wonder if there security specific reason so?

gnupg starting 2.1 removed critical private key functionality gpg-agent, reduce attack surface on intimate secrets -- private keys.

such callback not expose passphrase application you're writing (which means larger attack surface gnupg be), gnupg gets aware of passphrase.

if need control entry of passphrase application, have several choices.

implementing pinentry

the information flow be: application calls gnupg through gpgme, gnupg requests private key operation gpg-agent, again asks application passphrase. aware work if started gpg-agent appropriate pinentry configuration (you might have start instance, separate 1 running on system).

gpg-preset-passphrase

the important use case of passing passphrase directly in headless daemons, no humans waits entering passphrase. gnupg brings small utility gpg-preset-passphrase (on debian , derivatives, installed /usr/lib/gnupg2/gpg-preset-passphrase), can used precache passphrase (so not queried configurable time).

pinentry loopback

with gnupg 2.1, option added: in gpg-agent, can allow pinentry loopback allow-loopback-pinentry option. additional parameter pinentry-mode set loopback in gnupg/gpgme should allow handle passphrase interaction using passphrase_cb again.

but: consider exposes passphrase not both application , gnupg, , might prove (possibly minor existing , maybe unnecessary) security risk. also, gnupg 2.1 not yet spread, might problem if not control environment.


Comments

Post a Comment

Popular posts from this blog

Hatching array of circles in AutoCAD using c# -

-
i beginner in autocad plugins .i have created array of circle using following code. now, have hatch circles in array .how that??how hatch circles @ once? moreover, how can return hatch method , use hatch objects.sorry language.thanks in advance. [assembly: commandclass(typeof(beamsection.class1))] namespace beamsection { public class class1 { //class1 obj = new class1(); [commandmethod("beamatsupport")] public void addlightweightpolyline() { // current document , database document acdoc = application.documentmanager.mdiactivedocument; database accurdb = acdoc.database; promptpointresult ppr = acdoc.editor.getpoint("\nselect starting point "); var ucs = acdoc.editor.currentusercoordinatesystem; point3d startingpt = ppr.value.transformby(ucs); list<double> radius = new list<double>(); radius.add(0.5);
Read more

ios - UITEXTFIELD InputView Uipicker not working in swift -

-
hello trying pop uipickerview view programmatically when user clicks on textfield. have tried doesn't doing anything. isn't working. nothing happening when click textfield class userprofiletableviewcontroller: uitableviewcontroller,uitextfielddelegate,uipickerviewdelegate,uipickerviewdatasource { var itempicker: uipickerview! = uipickerview() @iboutlet weak var gendertxtfield: uitextfield! var gender = ["male","female"] override func viewdidload() { super.viewdidload() gendertxtfield.delegate = self itempicker!.delegate = self itempicker!.datasource = self itempicker!.backgroundcolor = uicolor.blackcolor() self.gendertxtfield.inputview = itempicker } func numberofcomponentsinpickerview(pickerview: uipickerview) -> int{ return 1 } // returns # of rows in each component.. func pickerview(pickerview: uipickerview, numberofrowsincomponent component:
Read more

Python Pig Latin Translator -

-
so have been working on @ codecademy.com while trying learn python. don't know if blind , can't see why won't work or what. here's code won't let me use. function print variable if had typed in , print "empty" if didn't type anything. print "welcome english pig latin translator!" original = raw_input("what's name?") if len(original) > 0 print original else print "empty" if len(original) > 0 else the above lines contains syntax errors. try: if len(original) > 0: else: note added colons, ( : ).
Read more