paranoid option - use /dev/random as random source for key generation on *nix systems

git-svn-id: svn://localhost/project_picapica/trunk@284 fb96df88-216d-11de-830c-f3023f12d8ac

4 files changed, 63 insertions, 18 deletions

diff --git a/pica-client/dialogs/registeraccountdialog.cpp b/pica-client/dialogs/registeraccountdialog.cpp
index a545286..f705bb2 100644
--- a/pica-client/dialogs/registeraccountdialog.cpp
+++ b/pica-client/dialogs/registeraccountdialog.cpp
@@ -11,11 +11,16 @@ RegisterAccountDialog::RegisterAccountDialog(QWidget *parent) :
     QVBoxLayout *layout = new QVBoxLayout(this);
 
     QLabel *lbNickname = new QLabel(tr("Name:"));
-    QLabel *lbPassword = new QLabel(tr("Password:"));
-    QLabel *lbRepeatPassword = new QLabel(tr("Repeat password:"));
+    lbPassword = new QLabel(tr("Password:"));
+    lbRepeatPassword = new QLabel(tr("Repeat password:"));
 
     nickname = new QLineEdit();
     btRegister = new QPushButton(tr("Create"));
+
+    #ifndef WIN32
+    cbUseDevRandom = new QCheckBox(tr("Use /dev/random as random data source"));
+    #endif
+
     cbSetPassword = new QCheckBox(tr("Set password for secret key"));
     password = new QLineEdit();
     repeatPassword = new QLineEdit();
@@ -34,6 +39,9 @@ RegisterAccountDialog::RegisterAccountDialog(QWidget *parent) :
 
     layout->addWidget(lbNickname);
     layout->addWidget(nickname);
+    #ifndef WIN32
+    layout->addWidget(cbUseDevRandom);
+    #endif
     layout->addWidget(cbSetPassword);
     layout->addWidget(lbPassword);
     layout->addWidget(password);
@@ -51,10 +59,25 @@ RegisterAccountDialog::RegisterAccountDialog(QWidget *parent) :
     //connect(btOK, SIGNAL(clicked()), this, SLOT(OK()));
     connect(btRegister, SIGNAL(clicked()), this, SLOT(Register()));
     connect(cbSetPassword, SIGNAL(clicked()), this, SLOT(setPasswordClick()));
+    #ifndef WIN32
+    connect(cbUseDevRandom, SIGNAL(clicked()), this, SLOT(useDevRandomClick()));
+    #endif
 
     setPasswordClick();
 }
 
+void RegisterAccountDialog::useDevRandomClick()
+{
+#ifndef WIN32
+    if (cbUseDevRandom->isChecked())
+    {
+        QMessageBox mbx;
+        mbx.setText(tr("Using /dev/random is more preferable for generating long-term high-value cryptographic keys, but it can take 5 - 10 minutes to collect required amount of entropy. You'll have to press random keys on keyboard and move mouse randomly to provide random data. "));
+        mbx.exec();
+    }
+#endif
+}
+
 void RegisterAccountDialog::setPasswordClick()
 {
     if (cbSetPassword->isChecked())
@@ -64,8 +87,8 @@ void RegisterAccountDialog::setPasswordClick()
 
         password->show();
         repeatPassword->show();
-        layout()->itemAt(3)->widget()->show();
-        layout()->itemAt(5)->widget()->show();
+        lbPassword->show();
+        lbRepeatPassword->show();
     }
     else
     {
@@ -74,8 +97,8 @@ void RegisterAccountDialog::setPasswordClick()
 
         password->setHidden(true);
         repeatPassword->setHidden(true);
-        layout()->itemAt(3)->widget()->hide();
-        layout()->itemAt(5)->widget()->hide();
+        lbPassword->hide();
+        lbRepeatPassword->hide();
     }
 
     adjustSize();
@@ -91,6 +114,7 @@ void RegisterAccountDialog::Register()
 {
     //check name
     QString name = nickname->text();
+    QString rand = QString::null;
 
     if (name.toUtf8().size() > 63) //64 bytes - CN length in X509 certificate
     {
@@ -119,6 +143,17 @@ void RegisterAccountDialog::Register()
         }
     }
 
+    #ifndef WIN32
+    if (cbUseDevRandom->isChecked())
+    {
+        rand = "/dev/random";
+    }
+
+    cbUseDevRandom -> setDisabled(true);
+    #endif
+
+    cbSetPassword -> setDisabled(true);
+
     //1
     lbStatus->setText(tr("1) generating RSA keypair..."));
 
@@ -126,7 +161,7 @@ void RegisterAccountDialog::Register()
     btRegister->setEnabled(false);
 
     ost.GenRSAKeySignal(4096, config_dir + QDir::separator() + "privkey.pem", cbSetPassword->isChecked(),
-        password->text(), this, SLOT(stageSignCert(int,QProcess::ExitStatus)));
+        password->text(),rand, this, SLOT(stageSignCert(int,QProcess::ExitStatus)));
 }
 
 void RegisterAccountDialog::stageSignCert(int retval,QProcess::ExitStatus)
diff --git a/pica-client/dialogs/registeraccountdialog.h b/pica-client/dialogs/registeraccountdialog.h
index 5c445d6..550d769 100644
--- a/pica-client/dialogs/registeraccountdialog.h
+++ b/pica-client/dialogs/registeraccountdialog.h
@@ -25,6 +25,9 @@ private:
     QCheckBox *cbSetPassword;
     QLineEdit *password;
     QLineEdit *repeatPassword;
+    QLabel *lbPassword ;
+    QLabel *lbRepeatPassword;
+    QCheckBox *cbUseDevRandom;
 
     QRegExpValidator *vld;
     OpenSSLTool ost;
@@ -34,10 +37,11 @@ private:
     QString PkeyFilename_;
 signals:
     
-public slots:
+private slots:
     //void OK();
     void Register();
     void setPasswordClick();
+    void useDevRandomClick();
 
     void stageSignCert(int retval, QProcess::ExitStatus);
     void stageFinished(int retval, QProcess::ExitStatus);
diff --git a/pica-client/openssltool.cpp b/pica-client/openssltool.cpp
index b9bf6d9..4711713 100644
--- a/pica-client/openssltool.cpp
+++ b/pica-client/openssltool.cpp
@@ -92,16 +92,22 @@ QString OpenSSLTool::CertTextFromString(QString cert_pem)
     return QString::fromUtf8(openssl.readAllStandardOutput().constData());
 }
 
-bool OpenSSLTool::GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpassword, QString password, QObject *receiver, const char *finished_slot)
+bool OpenSSLTool::GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpassword, QString password, QString rand, QObject *receiver, const char *finished_slot)
 {
-    if (!setpassword)
-    {
-        openssl_.start("openssl", QStringList()<<"genrsa"<<"-out"<<keyfile<<QString::number(numbits));
-    }
-    else
-    {
-        openssl_.start("openssl", QStringList()<<"genrsa"<<"-out"<<keyfile<<"-passout"<<"stdin"<<"-idea"<<QString::number(numbits));
-    }
+    QStringList args;
+
+    args <<"genrsa"<<"-out"<<keyfile;
+
+    if (setpassword)
+        args <<"-passout"<<"stdin"<<"-idea";
+
+    if (!rand.isEmpty())
+        args << "-rand"<<rand;
+
+    args <<QString::number(numbits);
+
+    openssl_.start("openssl", args);
+
 
     if (!openssl_.waitForStarted())
         return false;
diff --git a/pica-client/openssltool.h b/pica-client/openssltool.h
index f4a017f..a5714fc 100644
--- a/pica-client/openssltool.h
+++ b/pica-client/openssltool.h
@@ -14,7 +14,7 @@ public:
     static QString CertTextFromString(QString cert_pem);
 
     bool GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpassword,
-        QString password, QObject *receiver, const char *finished_slot);
+        QString password, QString rand,QObject *receiver, const char *finished_slot);
     bool GenCertSignal(QString cert_file, QString keyfile, QString keypassword, QString subject, QObject *receiver, const char *finished_slot);
 
     bool GenDHParamSignal(quint32 numbits, QString output_file, QObject *receiver, const char *finished_slot);