summaryrefslogtreecommitdiff
path: root/Remote/Helper
diff options
context:
space:
mode:
authorGravatar guilhem <guilhem@fripost.org>2013-04-05 21:06:16 +0200
committerGravatar Joey Hess <joey@kitenet.net>2013-04-06 16:09:51 -0400
commita7f50205bb1ccd41d4a9ab4e11d984e643be755f (patch)
tree519c7148a87575896450b7dc43fc58e8b34dfe02 /Remote/Helper
parentf758f6d5cbef989bff75fcd140edb8e0b8899b84 (diff)
Generate ciphers with a better entropy.
Unless highRandomQuality=false (or --fast) is set, use Libgcypt's 'GCRY_VERY_STRONG_RANDOM' level by default for cipher generation, like it's done for OpenPGP key generation. On the assistant side, the random quality is left to the old (lower) level, in order not to scare the user with an enless page load due to the blocking PRNG waiting for IO actions.
Diffstat (limited to 'Remote/Helper')
-rw-r--r--Remote/Helper/Encryptable.hs11
1 files changed, 8 insertions, 3 deletions
diff --git a/Remote/Helper/Encryptable.hs b/Remote/Helper/Encryptable.hs
index f3b6bb787..ff7d4990b 100644
--- a/Remote/Helper/Encryptable.hs
+++ b/Remote/Helper/Encryptable.hs
@@ -31,15 +31,20 @@ encryptionSetup c = case (M.lookup "encryption" c, extractCipher c) of
(Just "none", Just _) -> cannotchange
(Just "shared", Just (EncryptedCipher _ _)) -> cannotchange
(Just _, Just (SharedCipher _)) -> cannotchange
- (Just "shared", Nothing) -> use "encryption setup" $ genSharedCipher
- (Just keyid, Nothing) -> use "encryption setup" $ genEncryptedCipher keyid
+ (Just "shared", Nothing) -> use "encryption setup" . genSharedCipher
+ =<< highRandomQuality
+ (Just keyid, Nothing) -> use "encryption setup" . genEncryptedCipher keyid
+ =<< highRandomQuality
(Just keyid, Just v) -> use "encryption updated" $ updateEncryptedCipher keyid v
where
cannotchange = error "Cannot change encryption type of existing remote."
use m a = do
cipher <- liftIO a
showNote $ m ++ " " ++ describeCipher cipher
- return $ M.delete "encryption" $ storeCipher c cipher
+ return $ M.delete "encryption" $ M.delete "highRandomQuality" $
+ storeCipher c cipher
+ highRandomQuality = (&&) (maybe True (/="false") (M.lookup "highRandomQuality" c))
+ <$> fmap not (Annex.getState Annex.fast)
{- Modifies a Remote to support encryption.
-