/src/gnupg/g10/pubkey-enc.c

Source
/* pubkey-enc.c - Process a public key encoded packet.
 * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2006, 2009,
 *               2010 Free Software Foundation, Inc.
 *
 * This file is part of GnuPG.
 *
 * GnuPG is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * GnuPG is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <https://www.gnu.org/licenses/>.
 */

#include <config.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "gpg.h"
#include "../common/util.h"
#include "packet.h"
#include "keydb.h"
#include "trustdb.h"
#include "../common/status.h"
#include "options.h"
#include "main.h"
#include "../common/i18n.h"
#include "pkglue.h"
#include "call-agent.h"
#include "../common/host2net.h"
#include "../common/compliance.h"


static gpg_error_t get_it (ctrl_t ctrl, struct seskey_enc_list *k,
                           DEK *dek, PKT_public_key *sk, u32 *keyid,
                           int seipdv2_cipher_algo);


/* Check that the given algo is mentioned in one of the valid user-ids. */
static int
is_algo_in_prefs (kbnode_t keyblock, preftype_t type, int algo)
{
  kbnode_t k;
  prefitem_t *prefs;

  for (k = keyblock; k; k = k->next)
    {
      if (k->pkt->pkttype == PKT_USER_ID)
        {
          PKT_user_id *uid = k->pkt->pkt.user_id;

          prefs = uid->prefs;
          if (uid->created && prefs
              && !uid->flags.revoked && !uid->flags.expired)
            {
              for (; prefs->type; prefs++)
                if (prefs->type == type && prefs->value == algo)
                  return 1;
            }
        }
    }
  /* In rfc-9980 mode also check direct key signature prefs.  */
  if (RFC9980 && (k = keyblock) && k->pkt->pkttype == PKT_PUBLIC_KEY
      && (prefs = k->pkt->pkt.public_key->dks_prefs))
    {
      for (; prefs->type; prefs++)
        if (prefs->type == type && prefs->value == algo)
          return 1;
    }
  return 0;
}


/*
 * Get the session key from a pubkey enc packet and return it in DEK,
 * which should have been allocated in secure memory by the caller.
 * SEIPDV2_CIPHER_ALGO may be passed from the encrypted packet in case
 * of a SEIPDv2 packet.
 */
gpg_error_t
get_session_key (ctrl_t ctrl, struct seskey_enc_list *list, DEK *dek,
                 int seipdv2_cipher_algo)
{
  PKT_public_key *sk = NULL;
  gpg_error_t err;
  void *enum_context = NULL;
  u32 keyid[2];
  int search_for_secret_keys = 1;
  struct seskey_enc_list *k;

  if (DBG_CLOCK)
    log_clock ("get_session_key enter");

  while (search_for_secret_keys)
    {
      sk = xmalloc_clear (sizeof *sk);
      err = enum_secret_keys (ctrl, &enum_context, sk);
      if (err)
        break;

      /* Check compliance.  */
      if (! gnupg_pk_is_allowed (opt.compliance, PK_USE_DECRYPTION,
                                 sk->pubkey_algo, 0,
                                 sk->pkey, nbits_from_pk (sk), NULL))
        {
          log_info (_("key %s is not suitable for decryption"
                      " in %s mode\n"),
                    keystr_from_pk (sk),
                    gnupg_compliance_option_string (opt.compliance));
          continue;
        }

      /* FIXME: The list needs to be sorted so that we try the keys in
       * an appropriate order.  For example:
       * - On-disk keys w/o protection
       * - On-disk keys with a cached passphrase
       * - On-card keys of an active card
       * - On-disk keys with protection
       * - On-card keys from cards which are not plugged it.  Here a
       *   cancel-all button should stop asking for other cards.
       * Without any anonymous keys the sorting can be skipped.
       */
      for (k = list; k; k = k->next)
        {
          if (k->u_sym)
            continue;
          if (!(k->u.pub.pubkey_algo == PUBKEY_ALGO_ELGAMAL_E
                || k->u.pub.pubkey_algo == PUBKEY_ALGO_ECDH
                || k->u.pub.pubkey_algo == PUBKEY_ALGO_KYBER
                || k->u.pub.pubkey_algo == PUBKEY_ALGO_RSA
                || k->u.pub.pubkey_algo == PUBKEY_ALGO_RSA_E
                || k->u.pub.pubkey_algo == PUBKEY_ALGO_ELGAMAL
                || k->u.pub.pubkey_algo == PUBKEY_ALGO_X25519
                || IS_PUBKEY_ALGO_MLK (k->u.pub.pubkey_algo)))
            continue;

          if (openpgp_pk_test_algo2 (k->u.pub.pubkey_algo, PUBKEY_USAGE_ENC))
            continue;

          if (sk->pubkey_algo != k->u.pub.pubkey_algo)
            continue;

          keyid_from_pk (sk, keyid);

          if (!k->u.pub.keyid[0] && !k->u.pub.keyid[1])
            {
              if (opt.skip_hidden_recipients)
                continue;

              if (!opt.quiet)
                log_info (_("anonymous recipient; trying secret key %s ...\n"),
                          keystr (keyid));
            }
          else if (opt.try_all_secrets
                   || (k->u.pub.keyid[0] == keyid[0]
                       && k->u.pub.keyid[1] == keyid[1]))
            {
              if (!opt.quiet && !(sk->pubkey_usage & PUBKEY_USAGE_XENC_MASK))
                log_info (_("used key is not marked for encryption use.\n"));
            }
          else
            continue;

          err = get_it (ctrl, k, dek, sk, keyid, seipdv2_cipher_algo);
          k->result = err;
          if (!err)
            {
              if (!opt.quiet && !k->u.pub.keyid[0] && !k->u.pub.keyid[1])
                {
                  log_info (_("okay, we are the anonymous recipient.\n"));
                  if (!(sk->pubkey_usage & PUBKEY_USAGE_XENC_MASK))
                    log_info (_("used key is not marked for encryption use.\n")
                              );
                }
              search_for_secret_keys = 0;
              break;
            }
          else if (gpg_err_code (err) == GPG_ERR_FULLY_CANCELED)
            {
              search_for_secret_keys = 0;
              break; /* Don't try any more secret keys.  */
            }
        }
    }
  enum_secret_keys (ctrl, &enum_context, NULL);  /* free context */

  if (gpg_err_code (err) == GPG_ERR_EOF)
    {
      err = gpg_error (GPG_ERR_NO_SECKEY);

      /* Return the last specific error, if any.  */
      for (k = list; k; k = k->next)
        if (k->result != -1)
          err = k->result;
    }

  if (DBG_CLOCK)
    log_clock ("get_session_key leave");
  return err;
}


/* Build an SEXP to gpg-agent, for PKDECRYPT command.  */
static gpg_error_t
ecdh_sexp_build (gcry_sexp_t *r_s_data, struct seskey_enc_list *enc,
                 PKT_public_key *sk)
{
  gpg_error_t err;
  const unsigned char *kdf_params_spec;
  byte fp[MAX_FINGERPRINT_LEN];
  int keywrap_cipher_algo;
  int kdf_hash_algo;
  unsigned char *kdf_params = NULL;
  size_t kdf_params_len = 0;

  fingerprint_from_pk (sk, fp, NULL);

  err = ecc_build_kdf_params (&kdf_params, &kdf_params_len,
                              &kdf_params_spec, sk->pkey, fp);
  if (err)
    return err;

  keywrap_cipher_algo = kdf_params_spec[3];
  kdf_hash_algo = kdf_params_spec[2];

  if (!enc->u.pub.data[0] || !enc->u.pub.data[1])
    {
      xfree (kdf_params);
      return gpg_error (GPG_ERR_BAD_MPI);
    }

  err = gcry_sexp_build (r_s_data, NULL,
                         "(enc-val(ecc(c%d)(h%d)(e%m)(s%m)(kdf-params%b)))",
                         keywrap_cipher_algo, kdf_hash_algo,
                         enc->u.pub.data[0], enc->u.pub.data[1],
                         (int)kdf_params_len, kdf_params);
  xfree (kdf_params);
  return err;
}


static gpg_error_t
get_it (ctrl_t ctrl, struct seskey_enc_list *enc, DEK *dek,
        PKT_public_key *sk, u32 *keyid, int seipdv2_cipher_algo)
{
  gpg_error_t err;
  byte *frame = NULL;
  unsigned int frameidx;
  size_t nframe;
  u16 csum, csum2;
  int padding;
  gcry_sexp_t s_data;
  char *desc;
  char *keygrip;

  if (DBG_CLOCK)
    log_clock ("decryption start");

  log_assert (!enc->u_sym);

  /* Get the keygrip.  */
  err = hexkeygrip_from_pk (sk, &keygrip);
  if (err)
    goto leave;

  if (enc->u.pub.version == 6 && !enc->u.pub.seskey_algo && RFC9980
      && (sk->pubkey_algo == PUBKEY_ALGO_X25519
          || IS_PUBKEY_ALGO_MLK (sk->pubkey_algo)))
    {
      if (seipdv2_cipher_algo)
        dek->algo = seipdv2_cipher_algo;
      else
        {
          log_info ("Warning: No symmetric algo yet known - assuming AES256\n");
          dek->algo = CIPHER_ALGO_AES256;
        }
    }

  /* Convert the data to an S-expression.  */
  if (sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL
      || sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL_E)
    {
      if (!enc->u.pub.data[0] || !enc->u.pub.data[1])
        err = gpg_error (GPG_ERR_BAD_MPI);
      else
        err = gcry_sexp_build (&s_data, NULL, "(enc-val(elg(a%m)(b%m)))",
                               enc->u.pub.data[0], enc->u.pub.data[1]);
    }
  else if (sk->pubkey_algo == PUBKEY_ALGO_RSA
           || sk->pubkey_algo == PUBKEY_ALGO_RSA_E)
    {
      if (!enc->u.pub.data[0])
        err = gpg_error (GPG_ERR_BAD_MPI);
      else
        err = gcry_sexp_build (&s_data, NULL, "(enc-val(rsa(a%m)))",
                               enc->u.pub.data[0]);
    }
   else if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
    err = ecdh_sexp_build (&s_data, enc, sk);
   else if (sk->pubkey_algo == PUBKEY_ALGO_X25519)
     {
      if (!enc->u.pub.data[0] || !enc->u.pub.data[1])
        err = gpg_error (GPG_ERR_BAD_MPI);
      else
        err = gcry_sexp_build (&s_data, NULL,
                               "(enc-val(ecc(t%d)(c%d)(h%d)(e%m)(s%m)"
                               "(kdf-params%s)))",
                               9580, dek->algo,
                               GCRY_MAC_HMAC_SHA256,
                               enc->u.pub.data[0], enc->u.pub.data[1],
                               "OpenPGP X25519");
     }
  else if (sk->pubkey_algo == PUBKEY_ALGO_KYBER)
    {
      char fixedinfo[1+MAX_FINGERPRINT_LEN];
      int fixedlen;

      if ((opt.compat_flags & COMPAT_T7014_OLD))
        {
          /* Temporary use for tests with original test vectors.  */
          fixedinfo[0] = 0x69;
          fixedlen = 1;
        }
      else
        {
          fixedinfo[0] = enc->u.pub.seskey_algo;
          v5_fingerprint_from_pk (sk, fixedinfo+1, NULL);
          fixedlen = 33;
        }

      if (!enc->u.pub.data[0] || !enc->u.pub.data[1] || !enc->u.pub.data[2])
        err = gpg_error (GPG_ERR_BAD_MPI);
      else
        err = gcry_sexp_build (&s_data, NULL,
                           "(enc-val(pqc(e%m)(k%m)(s%m)(c%d)(fixed-info%b)))",
                               enc->u.pub.data[0],
                               enc->u.pub.data[1],
                               enc->u.pub.data[2],
                               enc->u.pub.seskey_algo, fixedlen, fixedinfo);
    }
  else if (IS_PUBKEY_ALGO_MLK (sk->pubkey_algo))
    {
      char fixedinfo[1+22]; /* algid || domSep || len(domSep) */

      fixedinfo[0] = sk->pubkey_algo;
      memcpy (fixedinfo+1, "OpenPGPCompositeKDFv1\x15", 22);

      if (!enc->u.pub.data[0] || !enc->u.pub.data[1] || !enc->u.pub.data[2])
        err = gpg_error (GPG_ERR_BAD_MPI);
      else
        err = gcry_sexp_build (&s_data, NULL,
                      "(enc-val(pqc(t%d)(e%m)(k%m)(s%m)(c%d)(fixed-info%b)))",
                               2,  /* Use key combiner sha3-256 */
                               enc->u.pub.data[0],
                               enc->u.pub.data[1],
                               enc->u.pub.data[2],
                               enc->u.pub.seskey_algo,
                               (int)sizeof fixedinfo, fixedinfo);
    }
  else
    err = gpg_error (GPG_ERR_BUG);

  if (err)
    goto leave;

  /* Decrypt. */
  desc = gpg_format_keydesc (ctrl, sk, FORMAT_KEYDESC_NORMAL, 1);
  err = agent_pkdecrypt (NULL, keygrip,
                         desc, sk->keyid, sk->main_keyid, sk->pubkey_algo,
                         s_data, &frame, &nframe, &padding);
  xfree (desc);
  gcry_sexp_release (s_data);
  if (err)
    goto leave;

  /* Now get the DEK (data encryption key) from the frame
   *
   * Old versions encode the DEK in this format (msb is left):
   *
   *     0  1  DEK(16 bytes)  CSUM(2 bytes)  0  RND(n bytes) 2
   *
   * Later versions encode the DEK like this:
   *
   *     0  2  RND(n bytes)  0  A  DEK(k bytes)  CSUM(2 bytes)
   *
   * (mpi_get_buffer already removed the leading zero).
   *
   * RND are non-zero randow bytes.
   * A   is the cipher algorithm
   * DEK is the encryption key (session key) with length k
   * CSUM
   */
  if (DBG_CRYPTO)
    log_printhex (frame, nframe, "DEK frame:");
  frameidx = 0;

  if (sk->pubkey_algo == PUBKEY_ALGO_KYBER
      || IS_PUBKEY_ALGO_MLK (sk->pubkey_algo))
    {
      if (nframe != 32 && opt.flags.require_pqc_encryption)
        {
          log_info (_("WARNING: session key is not quantum-resistant\n"));
        }
      dek->keylen = nframe;
      if (!dek->algo)
        dek->algo = enc->u.pub.seskey_algo;
    }
  else if (sk->pubkey_algo == PUBKEY_ALGO_X25519)
    {
      dek->keylen = nframe;
    }
  else if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
    {
      /* Now the frame are the bytes decrypted but padded session key.  */
      if (!nframe || nframe <= 8
          || frame[nframe-1] > nframe)
        {
          err = gpg_error (GPG_ERR_WRONG_SECKEY);
          goto leave;
        }
      nframe -= frame[nframe-1]; /* Remove padding.  */
      if (4 > nframe)
        {
          err = gpg_error (GPG_ERR_WRONG_SECKEY);
          goto leave;
        }

      dek->keylen = nframe - 3;
      dek->algo = frame[0];
      frameidx = 1;
    }
  else
    {
      if (padding)
        {
          if (7 > nframe)
            {
              err = gpg_error (GPG_ERR_WRONG_SECKEY);
              goto leave;
            }

          /* FIXME: Actually the leading zero is required but due to
           * the way we encode the output in libgcrypt as an MPI we
           * are not able to encode that leading zero.  However, when
           * using a Smartcard we are doing it the right way and
           * therefore we have to skip the zero.  This should be fixed
           * in gpg-agent of course. */
          frameidx = 0;
          if (!frame[frameidx])
            frameidx++;

          if (frame[frameidx] == 1 && frame[nframe - 1] == 2)
            {
              log_info (_("old encoding of the DEK is not supported\n"));
              err = gpg_error (GPG_ERR_CIPHER_ALGO);
              goto leave;
            }
          if (frame[frameidx] != 2) /* Something went wrong.  */
            {
              err = gpg_error (GPG_ERR_WRONG_SECKEY);
              goto leave;
            }
          /* Skip the random bytes.  */
          for (frameidx++; frameidx < nframe && frame[frameidx]; frameidx++)
            ;
          frameidx++; /* Skip the zero byte.  */
        }

      if (frameidx + 4 > nframe)
        {
          err = gpg_error (GPG_ERR_WRONG_SECKEY);
          goto leave;
        }

      dek->keylen = nframe - (frameidx + 1) - 2;
      dek->algo = frame[frameidx++];
    }

  /* Check whether we support the ago.  */
  err = openpgp_cipher_test_algo (dek->algo);
  if (err)
    {
      if (!opt.quiet && gpg_err_code (err) == GPG_ERR_CIPHER_ALGO)
        {
          log_info (_("cipher algorithm %d%s is unknown or disabled\n"),
                    dek->algo,
                    dek->algo == CIPHER_ALGO_IDEA ? " (IDEA)" : "");
        }
      dek->algo = 0;
      goto leave;
    }
  if (dek->keylen != openpgp_cipher_get_algo_keylen (dek->algo))
    {
      err = gpg_error (GPG_ERR_WRONG_SECKEY);
      goto leave;
    }

  /* Copy the key to DEK and compare the checksum if needed.  */
  /* We use the frameidx as flag for the need of a checksum.  */
  memcpy (dek->key, frame + frameidx, dek->keylen);
  if (frameidx)
    {
      csum = buf16_to_u16 (frame+nframe-2);
      for (csum2 = 0, frameidx = 0; frameidx < dek->keylen; frameidx++)
        csum2 += dek->key[frameidx];
      if (csum != csum2)
        {
          err = gpg_error (GPG_ERR_WRONG_SECKEY);
          goto leave;
        }
    }

  if (DBG_CLOCK)
    log_clock ("decryption ready");
  if (DBG_CRYPTO)
    log_printhex (dek->key, dek->keylen, "DEK is:");

  /* Check that the algo is in the preferences and whether it has
   * expired.  Also print a status line with the key's fingerprint.  */
  {
    PKT_public_key *pk = NULL;
    PKT_public_key *mainpk = NULL;
    kbnode_t pkb = get_pubkeyblock_ext (ctrl, keyid, GETKEY_ALLOW_ADSK);

    if (!pkb)
      {
        err = gpg_error (GPG_ERR_UNEXPECTED);
        log_info ("oops: public key not found for preference check\n");
      }
    else if (pkb->pkt->pkt.public_key->selfsigversion > 3
             && dek->algo != CIPHER_ALGO_3DES
             && !opt.quiet
             && !is_algo_in_prefs (pkb, PREFTYPE_SYM, dek->algo))
      log_info (_("WARNING: cipher algorithm %s not found in recipient"
                  " preferences\n"), openpgp_cipher_algo_name (dek->algo));

    /* if (!err && 25519 && openpgp_oidbuf_is_ed25519 (curve, len)) */
    /*   log_info ("Note: legacy OID was used for cv25519\n"); */

    if (!err)
      {
        kbnode_t k;
        int first = 1;

        for (k = pkb; k; k = k->next)
          {
            if (k->pkt->pkttype == PKT_PUBLIC_KEY
                || k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
              {
                u32 aki[2];

                if (first)
                  {
                    first = 0;
                    mainpk = k->pkt->pkt.public_key;
                  }

                keyid_from_pk (k->pkt->pkt.public_key, aki);
                if (aki[0] == keyid[0] && aki[1] == keyid[1])
                  {
                    pk = k->pkt->pkt.public_key;
                    break;
                  }
              }
          }
        if (!pk)
          BUG ();
        if (pk->expiredate && pk->expiredate <= make_timestamp ())
          {
            log_info (_("Note: secret key %s expired at %s\n"),
                      keystr (keyid), asctimestamp (pk->expiredate));
          }
      }

    if (pk && !(pk->pubkey_usage & PUBKEY_USAGE_ENC)
        && (pk->pubkey_usage & PUBKEY_USAGE_RENC))
      {
        log_info (_("Note: ADSK key has been used for decryption"));
        log_printf ("\n");
      }

    if (pk && pk->flags.revoked)
      {
        log_info (_("Note: key has been revoked"));
        log_printf ("\n");
        show_revocation_reason (ctrl, pk, 1);
      }

    if (is_status_enabled () && pk && mainpk)
      {
        char pkhex[MAX_FINGERPRINT_LEN*2+1];
        char mainpkhex[MAX_FINGERPRINT_LEN*2+1];

        hexfingerprint (pk, pkhex, sizeof pkhex);
        hexfingerprint (mainpk, mainpkhex, sizeof mainpkhex);

        /* Note that we do not want to create a trustdb just for
         * getting the ownertrust: If there is no trustdb there can't
         * be an ultimately trusted key anyway and thus the ownertrust
         * value is irrelevant.  */
        write_status_printf (STATUS_DECRYPTION_KEY, "%s %s %c",
                             pkhex, mainpkhex,
                             get_ownertrust_info (ctrl, mainpk, 1));

      }

    release_kbnode (pkb);
    err = 0;
  }

 leave:
  xfree (frame);
  xfree (keygrip);
  return err;
}


/*
 * Get the session key from the given string.
 * String is supposed to be formatted as this:
 *  <algo-id>:<even-number-of-hex-digits>
 */
gpg_error_t
get_override_session_key (DEK *dek, const char *string)
{
  const char *s;
  int i;

  if (!string)
    return GPG_ERR_BAD_KEY;
  dek->algo = atoi (string);
  if (dek->algo < 1)
    return GPG_ERR_BAD_KEY;
  if (!(s = strchr (string, ':')))
    return GPG_ERR_BAD_KEY;
  s++;
  for (i = 0; i < DIM (dek->key) && *s; i++, s += 2)
    {
      int c = hextobyte (s);
      if (c == -1)
        return GPG_ERR_BAD_KEY;
      dek->key[i] = c;
    }
  if (*s)
    return GPG_ERR_BAD_KEY;
  dek->keylen = i;
  return 0;
}

Coverage Report

Created: 2026-09-14 07:15

Line	Count	Source
1		/* pubkey-enc.c - Process a public key encoded packet.
2		* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2006, 2009,
3		* 2010 Free Software Foundation, Inc.
4		*
5		* This file is part of GnuPG.
6		*
7		* GnuPG is free software; you can redistribute it and/or modify
8		* it under the terms of the GNU General Public License as published by
9		* the Free Software Foundation; either version 3 of the License, or
10		* (at your option) any later version.
11		*
12		* GnuPG is distributed in the hope that it will be useful,
13		* but WITHOUT ANY WARRANTY; without even the implied warranty of
14		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15		* GNU General Public License for more details.
16		*
17		* You should have received a copy of the GNU General Public License
18		* along with this program; if not, see <https://www.gnu.org/licenses/>.
19		*/
20
21		#include <config.h>
22		#include <stdio.h>
23		#include <stdlib.h>
24		#include <string.h>
25
26		#include "gpg.h"
27		#include "../common/util.h"
28		#include "packet.h"
29		#include "keydb.h"
30		#include "trustdb.h"
31		#include "../common/status.h"
32		#include "options.h"
33		#include "main.h"
34		#include "../common/i18n.h"
35		#include "pkglue.h"
36		#include "call-agent.h"
37		#include "../common/host2net.h"
38		#include "../common/compliance.h"
39
40
41		static gpg_error_t get_it (ctrl_t ctrl, struct seskey_enc_list *k,
42		DEK dek, PKT_public_key sk, u32 *keyid,
43		int seipdv2_cipher_algo);
44
45
46		/* Check that the given algo is mentioned in one of the valid user-ids. */
47		static int
48		is_algo_in_prefs (kbnode_t keyblock, preftype_t type, int algo)
49	0	{
50	0	kbnode_t k;
51	0	prefitem_t *prefs;
52
53	0	for (k = keyblock; k; k = k->next)
54	0	{
55	0	if (k->pkt->pkttype == PKT_USER_ID)
56	0	{
57	0	PKT_user_id *uid = k->pkt->pkt.user_id;
58
59	0	prefs = uid->prefs;
60	0	if (uid->created && prefs
61	0	&& !uid->flags.revoked && !uid->flags.expired)
62	0	{
63	0	for (; prefs->type; prefs++)
64	0	if (prefs->type == type && prefs->value == algo)
65	0	return 1;
66	0	}
67	0	}
68	0	}
69		/* In rfc-9980 mode also check direct key signature prefs. */
70	0	if (RFC9980 && (k = keyblock) && k->pkt->pkttype == PKT_PUBLIC_KEY
71	0	&& (prefs = k->pkt->pkt.public_key->dks_prefs))
72	0	{
73	0	for (; prefs->type; prefs++)
74	0	if (prefs->type == type && prefs->value == algo)
75	0	return 1;
76	0	}
77	0	return 0;
78	0	}
79
80
81		/*
82		* Get the session key from a pubkey enc packet and return it in DEK,
83		* which should have been allocated in secure memory by the caller.
84		* SEIPDV2_CIPHER_ALGO may be passed from the encrypted packet in case
85		* of a SEIPDv2 packet.
86		*/
87		gpg_error_t
88		get_session_key (ctrl_t ctrl, struct seskey_enc_list list, DEK dek,
89		int seipdv2_cipher_algo)
90	28.0k	{
91	28.0k	PKT_public_key *sk = NULL;
92	28.0k	gpg_error_t err;
93	28.0k	void *enum_context = NULL;
94	28.0k	u32 keyid[2];
95	28.0k	int search_for_secret_keys = 1;
96	28.0k	struct seskey_enc_list *k;
97
98	28.0k	if (DBG_CLOCK)
99	28.0k	log_clock ("get_session_key enter");
100
101	28.0k	while (search_for_secret_keys)
102	28.0k	{
103	28.0k	sk = xmalloc_clear (sizeof *sk);
104	28.0k	err = enum_secret_keys (ctrl, &enum_context, sk);
105	28.0k	if (err)
106	28.0k	break;
107
108		/* Check compliance. */
109	0	if (! gnupg_pk_is_allowed (opt.compliance, PK_USE_DECRYPTION,
110	0	sk->pubkey_algo, 0,
111	0	sk->pkey, nbits_from_pk (sk), NULL))
112	0	{
113	0	log_info (_("key %s is not suitable for decryption"
114	0	" in %s mode\n"),
115	0	keystr_from_pk (sk),
116	0	gnupg_compliance_option_string (opt.compliance));
117	0	continue;
118	0	}
119
120		/* FIXME: The list needs to be sorted so that we try the keys in
121		* an appropriate order. For example:
122		* - On-disk keys w/o protection
123		* - On-disk keys with a cached passphrase
124		* - On-card keys of an active card
125		* - On-disk keys with protection
126		* - On-card keys from cards which are not plugged it. Here a
127		* cancel-all button should stop asking for other cards.
128		* Without any anonymous keys the sorting can be skipped.
129		*/
130	0	for (k = list; k; k = k->next)
131	0	{
132	0	if (k->u_sym)
133	0	continue;
134	0	if (!(k->u.pub.pubkey_algo == PUBKEY_ALGO_ELGAMAL_E
135	0	\|\| k->u.pub.pubkey_algo == PUBKEY_ALGO_ECDH
136	0	\|\| k->u.pub.pubkey_algo == PUBKEY_ALGO_KYBER
137	0	\|\| k->u.pub.pubkey_algo == PUBKEY_ALGO_RSA
138	0	\|\| k->u.pub.pubkey_algo == PUBKEY_ALGO_RSA_E
139	0	\|\| k->u.pub.pubkey_algo == PUBKEY_ALGO_ELGAMAL
140	0	\|\| k->u.pub.pubkey_algo == PUBKEY_ALGO_X25519
141	0	\|\| IS_PUBKEY_ALGO_MLK (k->u.pub.pubkey_algo)))
142	0	continue;
143
144	0	if (openpgp_pk_test_algo2 (k->u.pub.pubkey_algo, PUBKEY_USAGE_ENC))
145	0	continue;
146
147	0	if (sk->pubkey_algo != k->u.pub.pubkey_algo)
148	0	continue;
149
150	0	keyid_from_pk (sk, keyid);
151
152	0	if (!k->u.pub.keyid[0] && !k->u.pub.keyid[1])
153	0	{
154	0	if (opt.skip_hidden_recipients)
155	0	continue;
156
157	0	if (!opt.quiet)
158	0	log_info (_("anonymous recipient; trying secret key %s ...\n"),
159	0	keystr (keyid));
160	0	}
161	0	else if (opt.try_all_secrets
162	0	\|\| (k->u.pub.keyid[0] == keyid[0]
163	0	&& k->u.pub.keyid[1] == keyid[1]))
164	0	{
165	0	if (!opt.quiet && !(sk->pubkey_usage & PUBKEY_USAGE_XENC_MASK))
166	0	log_info (_("used key is not marked for encryption use.\n"));
167	0	}
168	0	else
169	0	continue;
170
171	0	err = get_it (ctrl, k, dek, sk, keyid, seipdv2_cipher_algo);
172	0	k->result = err;
173	0	if (!err)
174	0	{
175	0	if (!opt.quiet && !k->u.pub.keyid[0] && !k->u.pub.keyid[1])
176	0	{
177	0	log_info (_("okay, we are the anonymous recipient.\n"));
178	0	if (!(sk->pubkey_usage & PUBKEY_USAGE_XENC_MASK))
179	0	log_info (_("used key is not marked for encryption use.\n")
180	0	);
181	0	}
182	0	search_for_secret_keys = 0;
183	0	break;
184	0	}
185	0	else if (gpg_err_code (err) == GPG_ERR_FULLY_CANCELED)
186	0	{
187	0	search_for_secret_keys = 0;
188	0	break; /* Don't try any more secret keys. */
189	0	}
190	0	}
191	0	}
192	28.0k	enum_secret_keys (ctrl, &enum_context, NULL); /* free context */
193
194	28.0k	if (gpg_err_code (err) == GPG_ERR_EOF)
195	28.0k	{
196	28.0k	err = gpg_error (GPG_ERR_NO_SECKEY);
197
198		/* Return the last specific error, if any. */
199	504k	for (k = list; k; k = k->next)
200	476k	if (k->result != -1)
201	0	err = k->result;
202	28.0k	}
203
204	28.0k	if (DBG_CLOCK)
205	28.0k	log_clock ("get_session_key leave");
206	28.0k	return err;
207	28.0k	}
208
209
210		/* Build an SEXP to gpg-agent, for PKDECRYPT command. */
211		static gpg_error_t
212		ecdh_sexp_build (gcry_sexp_t r_s_data, struct seskey_enc_list enc,
213		PKT_public_key *sk)
214	0	{
215	0	gpg_error_t err;
216	0	const unsigned char *kdf_params_spec;
217	0	byte fp[MAX_FINGERPRINT_LEN];
218	0	int keywrap_cipher_algo;
219	0	int kdf_hash_algo;
220	0	unsigned char *kdf_params = NULL;
221	0	size_t kdf_params_len = 0;
222
223	0	fingerprint_from_pk (sk, fp, NULL);
224
225	0	err = ecc_build_kdf_params (&kdf_params, &kdf_params_len,
226	0	&kdf_params_spec, sk->pkey, fp);
227	0	if (err)
228	0	return err;
229
230	0	keywrap_cipher_algo = kdf_params_spec[3];
231	0	kdf_hash_algo = kdf_params_spec[2];
232
233	0	if (!enc->u.pub.data[0] \|\| !enc->u.pub.data[1])
234	0	{
235	0	xfree (kdf_params);
236	0	return gpg_error (GPG_ERR_BAD_MPI);
237	0	}
238
239	0	err = gcry_sexp_build (r_s_data, NULL,
240	0	"(enc-val(ecc(c%d)(h%d)(e%m)(s%m)(kdf-params%b)))",
241	0	keywrap_cipher_algo, kdf_hash_algo,
242	0	enc->u.pub.data[0], enc->u.pub.data[1],
243	0	(int)kdf_params_len, kdf_params);
244	0	xfree (kdf_params);
245	0	return err;
246	0	}
247
248
249		static gpg_error_t
250		get_it (ctrl_t ctrl, struct seskey_enc_list enc, DEK dek,
251		PKT_public_key sk, u32 keyid, int seipdv2_cipher_algo)
252	0	{
253	0	gpg_error_t err;
254	0	byte *frame = NULL;
255	0	unsigned int frameidx;
256	0	size_t nframe;
257	0	u16 csum, csum2;
258	0	int padding;
259	0	gcry_sexp_t s_data;
260	0	char *desc;
261	0	char *keygrip;
262
263	0	if (DBG_CLOCK)
264	0	log_clock ("decryption start");
265
266	0	log_assert (!enc->u_sym);
267
268		/* Get the keygrip. */
269	0	err = hexkeygrip_from_pk (sk, &keygrip);
270	0	if (err)
271	0	goto leave;
272
273	0	if (enc->u.pub.version == 6 && !enc->u.pub.seskey_algo && RFC9980
274	0	&& (sk->pubkey_algo == PUBKEY_ALGO_X25519
275	0	\|\| IS_PUBKEY_ALGO_MLK (sk->pubkey_algo)))
276	0	{
277	0	if (seipdv2_cipher_algo)
278	0	dek->algo = seipdv2_cipher_algo;
279	0	else
280	0	{
281	0	log_info ("Warning: No symmetric algo yet known - assuming AES256\n");
282	0	dek->algo = CIPHER_ALGO_AES256;
283	0	}
284	0	}
285
286		/* Convert the data to an S-expression. */
287	0	if (sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL
288	0	\|\| sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL_E)
289	0	{
290	0	if (!enc->u.pub.data[0] \|\| !enc->u.pub.data[1])
291	0	err = gpg_error (GPG_ERR_BAD_MPI);
292	0	else
293	0	err = gcry_sexp_build (&s_data, NULL, "(enc-val(elg(a%m)(b%m)))",
294	0	enc->u.pub.data[0], enc->u.pub.data[1]);
295	0	}
296	0	else if (sk->pubkey_algo == PUBKEY_ALGO_RSA
297	0	\|\| sk->pubkey_algo == PUBKEY_ALGO_RSA_E)
298	0	{
299	0	if (!enc->u.pub.data[0])
300	0	err = gpg_error (GPG_ERR_BAD_MPI);
301	0	else
302	0	err = gcry_sexp_build (&s_data, NULL, "(enc-val(rsa(a%m)))",
303	0	enc->u.pub.data[0]);
304	0	}
305	0	else if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
306	0	err = ecdh_sexp_build (&s_data, enc, sk);
307	0	else if (sk->pubkey_algo == PUBKEY_ALGO_X25519)
308	0	{
309	0	if (!enc->u.pub.data[0] \|\| !enc->u.pub.data[1])
310	0	err = gpg_error (GPG_ERR_BAD_MPI);
311	0	else
312	0	err = gcry_sexp_build (&s_data, NULL,
313	0	"(enc-val(ecc(t%d)(c%d)(h%d)(e%m)(s%m)"
314	0	"(kdf-params%s)))",
315	0	9580, dek->algo,
316	0	GCRY_MAC_HMAC_SHA256,
317	0	enc->u.pub.data[0], enc->u.pub.data[1],
318	0	"OpenPGP X25519");
319	0	}
320	0	else if (sk->pubkey_algo == PUBKEY_ALGO_KYBER)
321	0	{
322	0	char fixedinfo[1+MAX_FINGERPRINT_LEN];
323	0	int fixedlen;
324
325	0	if ((opt.compat_flags & COMPAT_T7014_OLD))
326	0	{
327		/* Temporary use for tests with original test vectors. */
328	0	fixedinfo[0] = 0x69;
329	0	fixedlen = 1;
330	0	}
331	0	else
332	0	{
333	0	fixedinfo[0] = enc->u.pub.seskey_algo;
334	0	v5_fingerprint_from_pk (sk, fixedinfo+1, NULL);
335	0	fixedlen = 33;
336	0	}
337
338	0	if (!enc->u.pub.data[0] \|\| !enc->u.pub.data[1] \|\| !enc->u.pub.data[2])
339	0	err = gpg_error (GPG_ERR_BAD_MPI);
340	0	else
341	0	err = gcry_sexp_build (&s_data, NULL,
342	0	"(enc-val(pqc(e%m)(k%m)(s%m)(c%d)(fixed-info%b)))",
343	0	enc->u.pub.data[0],
344	0	enc->u.pub.data[1],
345	0	enc->u.pub.data[2],
346	0	enc->u.pub.seskey_algo, fixedlen, fixedinfo);
347	0	}
348	0	else if (IS_PUBKEY_ALGO_MLK (sk->pubkey_algo))
349	0	{
350	0	char fixedinfo[1+22]; /* algid \|\| domSep \|\| len(domSep) */
351
352	0	fixedinfo[0] = sk->pubkey_algo;
353	0	memcpy (fixedinfo+1, "OpenPGPCompositeKDFv1\x15", 22);
354
355	0	if (!enc->u.pub.data[0] \|\| !enc->u.pub.data[1] \|\| !enc->u.pub.data[2])
356	0	err = gpg_error (GPG_ERR_BAD_MPI);
357	0	else
358	0	err = gcry_sexp_build (&s_data, NULL,
359	0	"(enc-val(pqc(t%d)(e%m)(k%m)(s%m)(c%d)(fixed-info%b)))",
360	0	2, /* Use key combiner sha3-256 */
361	0	enc->u.pub.data[0],
362	0	enc->u.pub.data[1],
363	0	enc->u.pub.data[2],
364	0	enc->u.pub.seskey_algo,
365	0	(int)sizeof fixedinfo, fixedinfo);
366	0	}
367	0	else
368	0	err = gpg_error (GPG_ERR_BUG);
369
370	0	if (err)
371	0	goto leave;
372
373		/* Decrypt. */
374	0	desc = gpg_format_keydesc (ctrl, sk, FORMAT_KEYDESC_NORMAL, 1);
375	0	err = agent_pkdecrypt (NULL, keygrip,
376	0	desc, sk->keyid, sk->main_keyid, sk->pubkey_algo,
377	0	s_data, &frame, &nframe, &padding);
378	0	xfree (desc);
379	0	gcry_sexp_release (s_data);
380	0	if (err)
381	0	goto leave;
382
383		/* Now get the DEK (data encryption key) from the frame
384		*
385		* Old versions encode the DEK in this format (msb is left):
386		*
387		* 0 1 DEK(16 bytes) CSUM(2 bytes) 0 RND(n bytes) 2
388		*
389		* Later versions encode the DEK like this:
390		*
391		* 0 2 RND(n bytes) 0 A DEK(k bytes) CSUM(2 bytes)
392		*
393		* (mpi_get_buffer already removed the leading zero).
394		*
395		* RND are non-zero randow bytes.
396		* A is the cipher algorithm
397		* DEK is the encryption key (session key) with length k
398		* CSUM
399		*/
400	0	if (DBG_CRYPTO)
401	0	log_printhex (frame, nframe, "DEK frame:");
402	0	frameidx = 0;
403
404	0	if (sk->pubkey_algo == PUBKEY_ALGO_KYBER
405	0	\|\| IS_PUBKEY_ALGO_MLK (sk->pubkey_algo))
406	0	{
407	0	if (nframe != 32 && opt.flags.require_pqc_encryption)
408	0	{
409	0	log_info (_("WARNING: session key is not quantum-resistant\n"));
410	0	}
411	0	dek->keylen = nframe;
412	0	if (!dek->algo)
413	0	dek->algo = enc->u.pub.seskey_algo;
414	0	}
415	0	else if (sk->pubkey_algo == PUBKEY_ALGO_X25519)
416	0	{
417	0	dek->keylen = nframe;
418	0	}
419	0	else if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
420	0	{
421		/* Now the frame are the bytes decrypted but padded session key. */
422	0	if (!nframe \|\| nframe <= 8
423	0	\|\| frame[nframe-1] > nframe)
424	0	{
425	0	err = gpg_error (GPG_ERR_WRONG_SECKEY);
426	0	goto leave;
427	0	}
428	0	nframe -= frame[nframe-1]; /* Remove padding. */
429	0	if (4 > nframe)
430	0	{
431	0	err = gpg_error (GPG_ERR_WRONG_SECKEY);
432	0	goto leave;
433	0	}
434
435	0	dek->keylen = nframe - 3;
436	0	dek->algo = frame[0];
437	0	frameidx = 1;
438	0	}
439	0	else
440	0	{
441	0	if (padding)
442	0	{
443	0	if (7 > nframe)
444	0	{
445	0	err = gpg_error (GPG_ERR_WRONG_SECKEY);
446	0	goto leave;
447	0	}
448
449		/* FIXME: Actually the leading zero is required but due to
450		* the way we encode the output in libgcrypt as an MPI we
451		* are not able to encode that leading zero. However, when
452		* using a Smartcard we are doing it the right way and
453		* therefore we have to skip the zero. This should be fixed
454		* in gpg-agent of course. */
455	0	frameidx = 0;
456	0	if (!frame[frameidx])
457	0	frameidx++;
458
459	0	if (frame[frameidx] == 1 && frame[nframe - 1] == 2)
460	0	{
461	0	log_info (_("old encoding of the DEK is not supported\n"));
462	0	err = gpg_error (GPG_ERR_CIPHER_ALGO);
463	0	goto leave;
464	0	}
465	0	if (frame[frameidx] != 2) /* Something went wrong. */
466	0	{
467	0	err = gpg_error (GPG_ERR_WRONG_SECKEY);
468	0	goto leave;
469	0	}
470		/* Skip the random bytes. */
471	0	for (frameidx++; frameidx < nframe && frame[frameidx]; frameidx++)
472	0	;
473	0	frameidx++; /* Skip the zero byte. */
474	0	}
475
476	0	if (frameidx + 4 > nframe)
477	0	{
478	0	err = gpg_error (GPG_ERR_WRONG_SECKEY);
479	0	goto leave;
480	0	}
481
482	0	dek->keylen = nframe - (frameidx + 1) - 2;
483	0	dek->algo = frame[frameidx++];
484	0	}
485
486		/* Check whether we support the ago. */
487	0	err = openpgp_cipher_test_algo (dek->algo);
488	0	if (err)
489	0	{
490	0	if (!opt.quiet && gpg_err_code (err) == GPG_ERR_CIPHER_ALGO)
491	0	{
492	0	log_info (_("cipher algorithm %d%s is unknown or disabled\n"),
493	0	dek->algo,
494	0	dek->algo == CIPHER_ALGO_IDEA ? " (IDEA)" : "");
495	0	}
496	0	dek->algo = 0;
497	0	goto leave;
498	0	}
499	0	if (dek->keylen != openpgp_cipher_get_algo_keylen (dek->algo))
500	0	{
501	0	err = gpg_error (GPG_ERR_WRONG_SECKEY);
502	0	goto leave;
503	0	}
504
505		/* Copy the key to DEK and compare the checksum if needed. */
506		/* We use the frameidx as flag for the need of a checksum. */
507	0	memcpy (dek->key, frame + frameidx, dek->keylen);
508	0	if (frameidx)
509	0	{
510	0	csum = buf16_to_u16 (frame+nframe-2);
511	0	for (csum2 = 0, frameidx = 0; frameidx < dek->keylen; frameidx++)
512	0	csum2 += dek->key[frameidx];
513	0	if (csum != csum2)
514	0	{
515	0	err = gpg_error (GPG_ERR_WRONG_SECKEY);
516	0	goto leave;
517	0	}
518	0	}
519
520	0	if (DBG_CLOCK)
521	0	log_clock ("decryption ready");
522	0	if (DBG_CRYPTO)
523	0	log_printhex (dek->key, dek->keylen, "DEK is:");
524
525		/* Check that the algo is in the preferences and whether it has
526		* expired. Also print a status line with the key's fingerprint. */
527	0	{
528	0	PKT_public_key *pk = NULL;
529	0	PKT_public_key *mainpk = NULL;
530	0	kbnode_t pkb = get_pubkeyblock_ext (ctrl, keyid, GETKEY_ALLOW_ADSK);
531
532	0	if (!pkb)
533	0	{
534	0	err = gpg_error (GPG_ERR_UNEXPECTED);
535	0	log_info ("oops: public key not found for preference check\n");
536	0	}
537	0	else if (pkb->pkt->pkt.public_key->selfsigversion > 3
538	0	&& dek->algo != CIPHER_ALGO_3DES
539	0	&& !opt.quiet
540	0	&& !is_algo_in_prefs (pkb, PREFTYPE_SYM, dek->algo))
541	0	log_info (_("WARNING: cipher algorithm %s not found in recipient"
542	0	" preferences\n"), openpgp_cipher_algo_name (dek->algo));
543
544		/* if (!err && 25519 && openpgp_oidbuf_is_ed25519 (curve, len)) */
545		/* log_info ("Note: legacy OID was used for cv25519\n"); */
546
547	0	if (!err)
548	0	{
549	0	kbnode_t k;
550	0	int first = 1;
551
552	0	for (k = pkb; k; k = k->next)
553	0	{
554	0	if (k->pkt->pkttype == PKT_PUBLIC_KEY
555	0	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
556	0	{
557	0	u32 aki[2];
558
559	0	if (first)
560	0	{
561	0	first = 0;
562	0	mainpk = k->pkt->pkt.public_key;
563	0	}
564
565	0	keyid_from_pk (k->pkt->pkt.public_key, aki);
566	0	if (aki[0] == keyid[0] && aki[1] == keyid[1])
567	0	{
568	0	pk = k->pkt->pkt.public_key;
569	0	break;
570	0	}
571	0	}
572	0	}
573	0	if (!pk)
574	0	BUG ();
575	0	if (pk->expiredate && pk->expiredate <= make_timestamp ())
576	0	{
577	0	log_info (_("Note: secret key %s expired at %s\n"),
578	0	keystr (keyid), asctimestamp (pk->expiredate));
579	0	}
580	0	}
581
582	0	if (pk && !(pk->pubkey_usage & PUBKEY_USAGE_ENC)
583	0	&& (pk->pubkey_usage & PUBKEY_USAGE_RENC))
584	0	{
585	0	log_info (_("Note: ADSK key has been used for decryption"));
586	0	log_printf ("\n");
587	0	}
588
589	0	if (pk && pk->flags.revoked)
590	0	{
591	0	log_info (_("Note: key has been revoked"));
592	0	log_printf ("\n");
593	0	show_revocation_reason (ctrl, pk, 1);
594	0	}
595
596	0	if (is_status_enabled () && pk && mainpk)
597	0	{
598	0	char pkhex[MAX_FINGERPRINT_LEN*2+1];
599	0	char mainpkhex[MAX_FINGERPRINT_LEN*2+1];
600
601	0	hexfingerprint (pk, pkhex, sizeof pkhex);
602	0	hexfingerprint (mainpk, mainpkhex, sizeof mainpkhex);
603
604		/* Note that we do not want to create a trustdb just for
605		* getting the ownertrust: If there is no trustdb there can't
606		* be an ultimately trusted key anyway and thus the ownertrust
607		* value is irrelevant. */
608	0	write_status_printf (STATUS_DECRYPTION_KEY, "%s %s %c",
609	0	pkhex, mainpkhex,
610	0	get_ownertrust_info (ctrl, mainpk, 1));
611
612	0	}
613
614	0	release_kbnode (pkb);
615	0	err = 0;
616	0	}
617
618	0	leave:
619	0	xfree (frame);
620	0	xfree (keygrip);
621	0	return err;
622	0	}
623
624
625		/*
626		* Get the session key from the given string.
627		* String is supposed to be formatted as this:
628		* <algo-id>:<even-number-of-hex-digits>
629		*/
630		gpg_error_t
631		get_override_session_key (DEK dek, const char string)
632	0	{
633	0	const char *s;
634	0	int i;
635
636	0	if (!string)
637	0	return GPG_ERR_BAD_KEY;
638	0	dek->algo = atoi (string);
639	0	if (dek->algo < 1)
640	0	return GPG_ERR_BAD_KEY;
641	0	if (!(s = strchr (string, ':')))
642	0	return GPG_ERR_BAD_KEY;
643	0	s++;
644	0	for (i = 0; i < DIM (dek->key) && *s; i++, s += 2)
645	0	{
646	0	int c = hextobyte (s);
647	0	if (c == -1)
648	0	return GPG_ERR_BAD_KEY;
649	0	dek->key[i] = c;
650	0	}
651	0	if (*s)
652	0	return GPG_ERR_BAD_KEY;
653	0	dek->keylen = i;
654	0	return 0;
655	0	}