1 /* encrypt.c - Main encryption driver
2 * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
3 * 2006, 2009 Free Software Foundation, Inc.
4 * Copyright (C) 2016 g10 Code GmbH
6 * This file is part of GnuPG.
8 * GnuPG is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
13 * GnuPG is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <https://www.gnu.org/licenses/>.
43 static int encrypt_simple( const char *filename, int mode, int use_seskey );
44 static int write_pubkey_enc_from_list( PK_LIST pk_list, DEK *dek, iobuf_t out );
47 * Encrypt FILENAME with only the symmetric cipher. Take input from
48 * stdin if FILENAME is NULL.
51 encrypt_symmetric (const char *filename)
53 return encrypt_simple( filename, 1, 0 );
58 * Encrypt FILENAME as a literal data packet only. Take input from
59 * stdin if FILENAME is NULL.
62 encrypt_store (const char *filename)
64 return encrypt_simple( filename, 0, 0 );
68 /* *SESKEY contains the unencrypted session key ((*SESKEY)->KEY) and
69 the algorithm that will be used to encrypt the contents of the SED
70 packet ((*SESKEY)->ALGO). If *SESKEY is NULL, then a random
71 session key that is appropriate for DEK->ALGO is generated and
74 Encrypt that session key using DEK and store the result in ENCKEY,
75 which must be large enough to hold (*SESKEY)->KEYLEN + 1 bytes. */
77 encrypt_seskey (DEK *dek, DEK **seskey, byte *enckey)
82 log_assert ( dek->keylen <= 32 );
85 *seskey=xmalloc_clear(sizeof(DEK));
86 (*seskey)->algo=dek->algo;
87 make_session_key(*seskey);
88 /*log_hexdump( "thekey", c->key, c->keylen );*/
91 /* The encrypted session key is prefixed with a one-octet algorithm id. */
92 buf[0] = (*seskey)->algo;
93 memcpy( buf + 1, (*seskey)->key, (*seskey)->keylen );
95 /* We only pass already checked values to the following function,
96 thus we consider any failure as fatal. */
97 if (openpgp_cipher_open (&hd, dek->algo, GCRY_CIPHER_MODE_CFB, 1))
99 if (gcry_cipher_setkey (hd, dek->key, dek->keylen))
101 gcry_cipher_setiv (hd, NULL, 0);
102 gcry_cipher_encrypt (hd, buf, (*seskey)->keylen + 1, NULL, 0);
103 gcry_cipher_close (hd);
105 memcpy( enckey, buf, (*seskey)->keylen + 1 );
106 wipememory( buf, sizeof buf ); /* burn key */
110 /* We try very hard to use a MDC */
112 use_mdc (pk_list_t pk_list,int algo)
114 /* RFC-2440 don't has MDC */
118 /* --force-mdc overrides --disable-mdc */
125 /* Do the keys really support MDC? */
127 if(select_mdc_from_pklist(pk_list))
130 /* The keys don't support MDC, so now we do a bit of a hack - if any
131 of the AESes or TWOFISH are in the prefs, we assume that the user
132 can handle a MDC. This is valid for PGP 7, which can handle MDCs
133 though it will not generate them. 2440bis allows this, by the
136 if(select_algo_from_prefs(pk_list,PREFTYPE_SYM,
137 CIPHER_ALGO_AES,NULL)==CIPHER_ALGO_AES)
140 if(select_algo_from_prefs(pk_list,PREFTYPE_SYM,
141 CIPHER_ALGO_AES192,NULL)==CIPHER_ALGO_AES192)
144 if(select_algo_from_prefs(pk_list,PREFTYPE_SYM,
145 CIPHER_ALGO_AES256,NULL)==CIPHER_ALGO_AES256)
148 if(select_algo_from_prefs(pk_list,PREFTYPE_SYM,
149 CIPHER_ALGO_TWOFISH,NULL)==CIPHER_ALGO_TWOFISH)
152 /* Last try. Use MDC for the modern ciphers. */
154 if (openpgp_cipher_get_algo_blklen (algo) != 8)
158 warn_missing_mdc_from_pklist (pk_list);
160 return 0; /* No MDC */
164 /* We don't want to use use_seskey yet because older gnupg versions
165 can't handle it, and there isn't really any point unless we're
166 making a message that can be decrypted by a public key or
169 encrypt_simple (const char *filename, int mode, int use_seskey)
173 PKT_plaintext *pt = NULL;
174 STRING2KEY *s2k = NULL;
179 cipher_filter_context_t cfx;
180 armor_filter_context_t *afx = NULL;
181 compress_filter_context_t zfx;
182 text_filter_context_t tfx;
183 progress_filter_context_t *pfx;
184 int do_compress = !!default_compress_algo();
186 pfx = new_progress_context ();
187 memset( &cfx, 0, sizeof cfx);
188 memset( &zfx, 0, sizeof zfx);
189 memset( &tfx, 0, sizeof tfx);
192 /* Prepare iobufs. */
193 inp = iobuf_open(filename);
195 iobuf_ioctl (inp, IOBUF_IOCTL_NO_CACHE, 1, NULL);
196 if (inp && is_secured_file (iobuf_get_fd (inp)))
200 gpg_err_set_errno (EPERM);
204 rc = gpg_error_from_syserror ();
205 log_error(_("can't open '%s': %s\n"), filename? filename: "[stdin]",
207 release_progress_context (pfx);
211 handle_progress (pfx, inp, filename);
214 iobuf_push_filter( inp, text_filter, &tfx );
221 s2k = xmalloc_clear( sizeof *s2k );
222 s2k->mode = opt.s2k_mode;
223 s2k->hash_algo = S2K_DIGEST_ALGO;
224 cfx.dek = passphrase_to_dek (default_cipher_algo (), s2k, 1, 0,
226 if ( !cfx.dek || !cfx.dek->keylen )
228 rc = gpg_error (canceled? GPG_ERR_CANCELED:GPG_ERR_INV_PASSPHRASE);
232 log_error (_("error creating passphrase: %s\n"), gpg_strerror (rc));
233 release_progress_context (pfx);
236 if (use_seskey && s2k->mode != 1 && s2k->mode != 3)
239 log_info (_("can't use a symmetric ESK packet "
240 "due to the S2K mode\n"));
247 seskeylen = openpgp_cipher_get_algo_keylen (default_cipher_algo ());
248 encrypt_seskey( cfx.dek, &dek, enckey );
249 xfree( cfx.dek ); cfx.dek = dek;
253 log_info(_("using cipher %s\n"),
254 openpgp_cipher_algo_name (cfx.dek->algo));
256 cfx.dek->use_mdc=use_mdc(NULL,cfx.dek->algo);
259 if (do_compress && cfx.dek && cfx.dek->use_mdc
260 && is_file_compressed(filename, &rc))
263 log_info(_("'%s' already compressed\n"), filename);
267 if ( rc || (rc = open_outfile (-1, filename, opt.armor? 1:0, 0, &out )))
272 release_progress_context (pfx);
278 afx = new_armor_context ();
279 push_armor_filter (afx, out);
284 PKT_symkey_enc *enc = xmalloc_clear( sizeof *enc + seskeylen + 1 );
286 enc->cipher_algo = cfx.dek->algo;
288 if ( use_seskey && seskeylen )
290 enc->seskeylen = seskeylen + 1; /* algo id */
291 memcpy (enc->seskey, enckey, seskeylen + 1 );
293 pkt.pkttype = PKT_SYMKEY_ENC;
294 pkt.pkt.symkey_enc = enc;
295 if ((rc = build_packet( out, &pkt )))
296 log_error("build symkey packet failed: %s\n", gpg_strerror (rc) );
301 pt = setup_plaintext_name (filename, inp);
303 /* Note that PGP 5 has problems decrypting symmetrically encrypted
304 data if the file length is in the inner packet. It works when
305 only partial length headers are use. In the past, we always used
306 partial body length here, but since PGP 2, PGP 6, and PGP 7 need
307 the file length, and nobody should be using PGP 5 nowadays
308 anyway, this is now set to the file length. Note also that this
309 only applies to the RFC-1991 style symmetric messages, and not
310 the RFC-2440 style. PGP 6 and 7 work with either partial length
311 or fixed length with the new style messages. */
313 if ( !iobuf_is_pipe_filename (filename) && *filename && !opt.textmode )
318 if ( !(tmpsize = iobuf_get_filelength(inp, &overflow))
319 && !overflow && opt.verbose)
320 log_info(_("WARNING: '%s' is an empty file\n"), filename );
321 /* We can't encode the length of very large files because
322 OpenPGP uses only 32 bit for file sizes. So if the the
323 size of a file is larger than 2^32 minus some bytes for
324 packet headers, we switch to partial length encoding. */
325 if ( tmpsize < (IOBUF_FILELENGTH_LIMIT - 65536) )
331 filesize = opt.set_filesize ? opt.set_filesize : 0; /* stdin */
335 /* Note that PT has been initialized above in !no_literal mode. */
336 pt->timestamp = make_timestamp();
337 pt->mode = opt.mimemode? 'm' : opt.textmode? 't' : 'b';
339 pt->new_ctb = !pt->len;
341 pkt.pkttype = PKT_PLAINTEXT;
342 pkt.pkt.plaintext = pt;
343 cfx.datalen = filesize && !do_compress ? calc_packet_length( &pkt ) : 0;
347 cfx.datalen = filesize && !do_compress ? filesize : 0;
349 pkt.pkt.generic = NULL;
352 /* Register the cipher filter. */
354 iobuf_push_filter ( out, cipher_filter, &cfx );
356 /* Register the compress filter. */
359 if (cfx.dek && cfx.dek->use_mdc)
361 push_compress_filter (out, &zfx, default_compress_algo());
367 if ( (rc = build_packet( out, &pkt )) )
368 log_error("build_packet failed: %s\n", gpg_strerror (rc) );
372 /* User requested not to create a literal packet, so we copy the
374 byte copy_buffer[4096];
376 while ((bytes_copied = iobuf_read(inp, copy_buffer, 4096)) != -1)
377 if ( (rc=iobuf_write(out, copy_buffer, bytes_copied)) ) {
378 log_error ("copying input to output failed: %s\n",
382 wipememory (copy_buffer, 4096); /* burn buffer */
385 /* Finish the stuff. */
391 iobuf_close (out); /* fixme: check returncode */
393 write_status ( STATUS_END_ENCRYPTION );
400 release_armor_context (afx);
401 release_progress_context (pfx);
407 setup_symkey (STRING2KEY **symkey_s2k,DEK **symkey_dek)
411 *symkey_s2k=xmalloc_clear(sizeof(STRING2KEY));
412 (*symkey_s2k)->mode = opt.s2k_mode;
413 (*symkey_s2k)->hash_algo = S2K_DIGEST_ALGO;
415 *symkey_dek = passphrase_to_dek (opt.s2k_cipher_algo,
416 *symkey_s2k, 1, 0, NULL, &canceled);
417 if(!*symkey_dek || !(*symkey_dek)->keylen)
421 return gpg_error (canceled?GPG_ERR_CANCELED:GPG_ERR_BAD_PASSPHRASE);
429 write_symkey_enc (STRING2KEY *symkey_s2k, DEK *symkey_dek, DEK *dek,
432 int rc, seskeylen = openpgp_cipher_get_algo_keylen (dek->algo);
438 enc=xmalloc_clear(sizeof(PKT_symkey_enc)+seskeylen+1);
439 encrypt_seskey(symkey_dek,&dek,enckey);
442 enc->cipher_algo = opt.s2k_cipher_algo;
443 enc->s2k = *symkey_s2k;
444 enc->seskeylen = seskeylen + 1; /* algo id */
445 memcpy( enc->seskey, enckey, seskeylen + 1 );
447 pkt.pkttype = PKT_SYMKEY_ENC;
448 pkt.pkt.symkey_enc = enc;
450 if ((rc=build_packet(out,&pkt)))
451 log_error("build symkey_enc packet failed: %s\n",gpg_strerror (rc));
459 * Encrypt the file with the given userids (or ask if none is
460 * supplied). Either FILENAME or FILEFD must be given, but not both.
461 * The caller may provide a checked list of public keys in
462 * PROVIDED_PKS; if not the function builds a list of keys on its own.
464 * Note that FILEFD is currently only used by cmd_encrypt in the the
465 * not yet finished server.c.
468 encrypt_crypt (ctrl_t ctrl, int filefd, const char *filename,
469 strlist_t remusr, int use_symkey, pk_list_t provided_keys,
475 PKT_plaintext *pt = NULL;
476 DEK *symkey_dek = NULL;
477 STRING2KEY *symkey_s2k = NULL;
480 cipher_filter_context_t cfx;
481 armor_filter_context_t *afx = NULL;
482 compress_filter_context_t zfx;
483 text_filter_context_t tfx;
484 progress_filter_context_t *pfx;
488 if (filefd != -1 && filename)
489 return gpg_error (GPG_ERR_INV_ARG); /* Both given. */
491 do_compress = !!opt.compress_algo;
493 pfx = new_progress_context ();
494 memset( &cfx, 0, sizeof cfx);
495 memset( &zfx, 0, sizeof zfx);
496 memset( &tfx, 0, sizeof tfx);
500 && (rc=setup_symkey(&symkey_s2k,&symkey_dek)))
502 release_progress_context (pfx);
507 pk_list = provided_keys;
510 if ((rc = build_pk_list (ctrl, remusr, &pk_list)))
512 release_progress_context (pfx);
517 /* Prepare iobufs. */
518 #ifdef HAVE_W32_SYSTEM
520 inp = iobuf_open (filename);
524 gpg_err_set_errno (ENOSYS);
527 if (filefd == GNUPG_INVALID_FD)
528 inp = iobuf_open (filename);
530 inp = iobuf_fdopen_nc (FD2INT(filefd), "rb");
533 iobuf_ioctl (inp, IOBUF_IOCTL_NO_CACHE, 1, NULL);
534 if (inp && is_secured_file (iobuf_get_fd (inp)))
538 gpg_err_set_errno (EPERM);
544 rc = gpg_error_from_syserror ();
546 snprintf (xname, sizeof xname, "[fd %d]", filefd);
548 strcpy (xname, "[stdin]");
551 log_error (_("can't open '%s': %s\n"),
552 *xname? xname : filename, gpg_strerror (rc) );
557 log_info (_("reading from '%s'\n"), iobuf_get_fname_nonnull (inp));
559 handle_progress (pfx, inp, filename);
562 iobuf_push_filter (inp, text_filter, &tfx);
564 rc = open_outfile (outputfd, filename, opt.armor? 1:0, 0, &out);
570 afx = new_armor_context ();
571 push_armor_filter (afx, out);
574 /* Create a session key. */
575 cfx.dek = xmalloc_secure_clear (sizeof *cfx.dek);
576 if (!opt.def_cipher_algo)
578 /* Try to get it from the prefs. */
579 cfx.dek->algo = select_algo_from_prefs (pk_list, PREFTYPE_SYM, -1, NULL);
580 /* The only way select_algo_from_prefs can fail here is when
581 mixing v3 and v4 keys, as v4 keys have an implicit preference
582 entry for 3DES, and the pk_list cannot be empty. In this
583 case, use 3DES anyway as it's the safest choice - perhaps the
584 v3 key is being used in an OpenPGP implementation and we know
585 that the implementation behind any v4 key can handle 3DES. */
586 if (cfx.dek->algo == -1)
588 cfx.dek->algo = CIPHER_ALGO_3DES;
591 /* In case 3DES has been selected, print a warning if any key
592 does not have a preference for AES. This should help to
593 indentify why encrypting to several recipients falls back to
595 if (opt.verbose && cfx.dek->algo == CIPHER_ALGO_3DES)
596 warn_missing_aes_from_pklist (pk_list);
601 && (select_algo_from_prefs (pk_list, PREFTYPE_SYM,
602 opt.def_cipher_algo, NULL)
603 != opt.def_cipher_algo))
605 log_info(_("WARNING: forcing symmetric cipher %s (%d)"
606 " violates recipient preferences\n"),
607 openpgp_cipher_algo_name (opt.def_cipher_algo),
608 opt.def_cipher_algo);
611 cfx.dek->algo = opt.def_cipher_algo;
614 cfx.dek->use_mdc = use_mdc (pk_list,cfx.dek->algo);
616 /* Only do the is-file-already-compressed check if we are using a
617 MDC. This forces compressed files to be re-compressed if we do
618 not have a MDC to give some protection against chosen ciphertext
621 if (do_compress && cfx.dek->use_mdc && is_file_compressed(filename, &rc2))
624 log_info(_("'%s' already compressed\n"), filename);
633 make_session_key (cfx.dek);
635 log_printhex ("DEK is: ", cfx.dek->key, cfx.dek->keylen );
637 rc = write_pubkey_enc_from_list (pk_list, cfx.dek, out);
641 /* We put the passphrase (if any) after any public keys as this
642 seems to be the most useful on the recipient side - there is no
643 point in prompting a user for a passphrase if they have the
644 secret key needed to decrypt. */
645 if(use_symkey && (rc = write_symkey_enc(symkey_s2k,symkey_dek,cfx.dek,out)))
649 pt = setup_plaintext_name (filename, inp);
651 /* Get the size of the file if possible, i.e., if it is a real file. */
652 if (filename && *filename
653 && !iobuf_is_pipe_filename (filename) && !opt.textmode )
658 if ( !(tmpsize = iobuf_get_filelength(inp, &overflow))
659 && !overflow && opt.verbose)
660 log_info(_("WARNING: '%s' is an empty file\n"), filename );
661 /* We can't encode the length of very large files because
662 OpenPGP uses only 32 bit for file sizes. So if the the size
663 of a file is larger than 2^32 minus some bytes for packet
664 headers, we switch to partial length encoding. */
665 if (tmpsize < (IOBUF_FILELENGTH_LIMIT - 65536) )
671 filesize = opt.set_filesize ? opt.set_filesize : 0; /* stdin */
675 pt->timestamp = make_timestamp();
676 pt->mode = opt.mimemode? 'm' : opt.textmode ? 't' : 'b';
678 pt->new_ctb = !pt->len;
680 pkt.pkttype = PKT_PLAINTEXT;
681 pkt.pkt.plaintext = pt;
682 cfx.datalen = filesize && !do_compress? calc_packet_length( &pkt ) : 0;
685 cfx.datalen = filesize && !do_compress ? filesize : 0;
687 /* Register the cipher filter. */
688 iobuf_push_filter (out, cipher_filter, &cfx);
690 /* Register the compress filter. */
693 int compr_algo = opt.compress_algo;
695 if (compr_algo == -1)
697 compr_algo = select_algo_from_prefs (pk_list, PREFTYPE_ZIP, -1, NULL);
698 if (compr_algo == -1)
699 compr_algo = DEFAULT_COMPRESS_ALGO;
700 /* Theoretically impossible to get here since uncompressed
704 && select_algo_from_prefs(pk_list, PREFTYPE_ZIP,
705 compr_algo, NULL) != compr_algo)
707 log_info (_("WARNING: forcing compression algorithm %s (%d)"
708 " violates recipient preferences\n"),
709 compress_algo_to_string(compr_algo), compr_algo);
712 /* Algo 0 means no compression. */
715 if (cfx.dek && cfx.dek->use_mdc)
717 push_compress_filter (out,&zfx,compr_algo);
724 if ((rc = build_packet( out, &pkt )))
725 log_error ("build_packet failed: %s\n", gpg_strerror (rc));
729 /* User requested not to create a literal packet, so we copy the
731 byte copy_buffer[4096];
733 while ((bytes_copied = iobuf_read (inp, copy_buffer, 4096)) != -1)
735 rc = iobuf_write (out, copy_buffer, bytes_copied);
738 log_error ("copying input to output failed: %s\n",
743 wipememory (copy_buffer, 4096); /* Burn the buffer. */
746 /* Finish the stuff. */
753 iobuf_close (out); /* fixme: check returncode */
754 write_status (STATUS_END_ENCRYPTION);
763 release_pk_list (pk_list);
764 release_armor_context (afx);
765 release_progress_context (pfx);
771 * Filter to do a complete public key encryption.
774 encrypt_filter (void *opaque, int control,
775 iobuf_t a, byte *buf, size_t *ret_len)
777 size_t size = *ret_len;
778 encrypt_filter_context_t *efx = opaque;
781 if (control == IOBUFCTRL_UNDERFLOW) /* decrypt */
783 BUG(); /* not used */
785 else if ( control == IOBUFCTRL_FLUSH ) /* encrypt */
787 if ( !efx->header_okay )
789 efx->cfx.dek = xmalloc_secure_clear ( sizeof *efx->cfx.dek );
790 if ( !opt.def_cipher_algo )
792 /* Try to get it from the prefs. */
794 select_algo_from_prefs (efx->pk_list, PREFTYPE_SYM, -1, NULL);
795 if (efx->cfx.dek->algo == -1 )
797 /* Because 3DES is implicitly in the prefs, this can
798 only happen if we do not have any public keys in
800 efx->cfx.dek->algo = DEFAULT_CIPHER_ALGO;
803 /* In case 3DES has been selected, print a warning if
804 any key does not have a preference for AES. This
805 should help to indentify why encrypting to several
806 recipients falls back to 3DES. */
808 && efx->cfx.dek->algo == CIPHER_ALGO_3DES)
809 warn_missing_aes_from_pklist (efx->pk_list);
814 && select_algo_from_prefs (efx->pk_list,PREFTYPE_SYM,
816 NULL) != opt.def_cipher_algo)
817 log_info(_("forcing symmetric cipher %s (%d) "
818 "violates recipient preferences\n"),
819 openpgp_cipher_algo_name (opt.def_cipher_algo),
820 opt.def_cipher_algo);
822 efx->cfx.dek->algo = opt.def_cipher_algo;
825 efx->cfx.dek->use_mdc = use_mdc (efx->pk_list,efx->cfx.dek->algo);
827 make_session_key ( efx->cfx.dek );
829 log_printhex ("DEK is: ", efx->cfx.dek->key, efx->cfx.dek->keylen);
831 rc = write_pubkey_enc_from_list (efx->pk_list, efx->cfx.dek, a);
835 if(efx->symkey_s2k && efx->symkey_dek)
837 rc=write_symkey_enc(efx->symkey_s2k,efx->symkey_dek,
843 iobuf_push_filter (a, cipher_filter, &efx->cfx);
845 efx->header_okay = 1;
847 rc = iobuf_write (a, buf, size);
850 else if (control == IOBUFCTRL_FREE)
852 xfree (efx->symkey_dek);
853 xfree (efx->symkey_s2k);
855 else if ( control == IOBUFCTRL_DESC )
857 mem2str (buf, "encrypt_filter", *ret_len);
864 * Write a pubkey-enc packet for the public key PK to OUT.
867 write_pubkey_enc (PKT_public_key *pk, int throw_keyid, DEK *dek, iobuf_t out)
874 print_pubkey_algo_note ( pk->pubkey_algo );
875 enc = xmalloc_clear ( sizeof *enc );
876 enc->pubkey_algo = pk->pubkey_algo;
877 keyid_from_pk( pk, enc->keyid );
878 enc->throw_keyid = throw_keyid;
880 /* Okay, what's going on: We have the session key somewhere in
881 * the structure DEK and want to encode this session key in an
882 * integer value of n bits. pubkey_nbits gives us the number of
883 * bits we have to use. We then encode the session key in some
884 * way and we get it back in the big intger value FRAME. Then
885 * we use FRAME, the public key PK->PKEY and the algorithm
886 * number PK->PUBKEY_ALGO and pass it to pubkey_encrypt which
887 * returns the encrypted value in the array ENC->DATA. This
888 * array has a size which depends on the used algorithm (e.g. 2
889 * for Elgamal). We don't need frame anymore because we have
890 * everything now in enc->data which is the passed to
892 frame = encode_session_key (pk->pubkey_algo, dek,
893 pubkey_nbits (pk->pubkey_algo, pk->pkey));
894 rc = pk_encrypt (pk->pubkey_algo, enc->data, frame, pk, pk->pkey);
895 gcry_mpi_release (frame);
897 log_error ("pubkey_encrypt failed: %s\n", gpg_strerror (rc) );
902 char *ustr = get_user_id_string_native (enc->keyid);
903 log_info (_("%s/%s encrypted for: \"%s\"\n"),
904 openpgp_pk_algo_name (enc->pubkey_algo),
905 openpgp_cipher_algo_name (dek->algo),
911 pkt.pkttype = PKT_PUBKEY_ENC;
912 pkt.pkt.pubkey_enc = enc;
913 rc = build_packet (out, &pkt);
915 log_error ("build_packet(pubkey_enc) failed: %s\n",
918 free_pubkey_enc(enc);
924 * Write pubkey-enc packets from the list of PKs to OUT.
927 write_pubkey_enc_from_list (PK_LIST pk_list, DEK *dek, iobuf_t out)
929 if (opt.throw_keyids && (PGP6 || PGP7 || PGP8))
931 log_info(_("you may not use %s while in %s mode\n"),
932 "--throw-keyids",compliance_option_string());
933 compliance_failure();
936 for ( ; pk_list; pk_list = pk_list->next )
938 PKT_public_key *pk = pk_list->pk;
939 int throw_keyid = (opt.throw_keyids || (pk_list->flags&1));
940 int rc = write_pubkey_enc (pk, throw_keyid, dek, out);
949 encrypt_crypt_files (ctrl_t ctrl, int nfiles, char **files, strlist_t remusr)
955 log_error(_("--output doesn't work for this command\n"));
962 unsigned int lno = 0;
963 while ( fgets(line, DIM(line), stdin) )
966 if (!*line || line[strlen(line)-1] != '\n')
968 log_error("input line %u too long or missing LF\n", lno);
971 line[strlen(line)-1] = '\0';
972 print_file_status(STATUS_FILE_START, line, 2);
973 rc = encrypt_crypt (ctrl, -1, line, remusr, 0, NULL, -1);
975 log_error ("encryption of '%s' failed: %s\n",
976 print_fname_stdin(line), gpg_strerror (rc) );
977 write_status( STATUS_FILE_DONE );
984 print_file_status(STATUS_FILE_START, *files, 2);
985 if ( (rc = encrypt_crypt (ctrl, -1, *files, remusr, 0, NULL, -1)) )
986 log_error("encryption of '%s' failed: %s\n",
987 print_fname_stdin(*files), gpg_strerror (rc) );
988 write_status( STATUS_FILE_DONE );