* call to gcry_check_version() initializes the gcrypt library and checks that
* we have at least the minimal required version.
*/
-void init_random_seed_or_die(void)
+void crypt_init(void)
{
const char *req_ver = "1.5.0";
int seed;
req_ver, gcry_check_version(NULL));
exit(EXIT_FAILURE);
}
+
+ /*
+ * Allocate a pool of secure memory. This also drops privileges where
+ * needed.
+ */
+ gcry_control(GCRYCTL_INIT_SECMEM, 65536, 0);
+
+ /* Tell Libgcrypt that initialization has completed. */
+ gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
+
get_random_bytes_or_die((unsigned char *)&seed, sizeof(seed));
srandom(seed);
}
+void crypt_shutdown(void)
+{
+ /*
+ * WK does not see a way to apply a patch for the sake of Valgrind, so
+ * as of 2018 libgrypt has no deinitialization routine to free the
+ * resources on exit.
+ */
+}
+
/** S-expression for the public part of an RSA key. */
#define RSA_PUBKEY_SEXP "(public-key (rsa (n %m) (e %m)))"
/** S-expression for a private RSA key. */
ret = -E_SEXP_BUILD;
goto release_n;
}
- ret = nr_scanned / 32 * 32;
+ ret = ROUND_DOWN(nr_scanned, 32);
PARA_INFO_LOG("successfully read %d bit ssh public key\n", ret * 8);
key = para_malloc(sizeof(*key));
key->num_bytes = ret;