keygen is configure option

src/Makefile.in

@@ -175,7 +175,7 @@ DLIBS =
 #
 
 # List all user C define here, like -D_DEBUG=1
-UDEFS =
+UDEFS = @KEYGEN_SUPPORT@
 
 # Define ASM defines here
 UADEFS =

src/call-rsa.c

@@ -214,6 +214,7 @@ rsa_verify (const uint8_t *pubkey, const uint8_t *hash, const uint8_t *sig)
 
 #define RSA_EXPONENT 0x10001
 
+#ifdef KEYGEN_SUPPORT
 const uint8_t *
 rsa_genkey (void)
 {
@@ -243,3 +244,4 @@ rsa_genkey (void)
   rsa_free (&rsa_ctx);
   return p_q_modulus;
 }
+#endif

src/configure

@@ -28,6 +28,7 @@ with_dfu=default
 debug=no
 pinpad=no
 certdo=no
+keygen=no
 
 # Process each option
 for option; do
@@ -59,6 +60,10 @@ for option; do
     certdo=yes ;;
   --disable-certdo)
     certdo=no ;;
+  --enable-keygen)
+    keygen=yes ;;
+  --disable-keygen)
+    keygen=no ;;
   --with-dfu)
     with_dfu=yes ;;
   --without-dfu)
@@ -93,6 +98,7 @@ Configuration:
   --enable-pinpad={dnd,cir,dial}
 			PIN entry support		[no]
   --enable-certdo	support CERT.3 data object	[no]
+  --enable-keygen	support key generation		[no]
   --with-dfu		build image for DFU 		[<target specific>]
 EOF
   exit 0
@@ -188,11 +194,20 @@ if test "$certdo" = "yes"; then
   echo "CERT.3 Data Object is supported"
 else
   CERTDO_DEFINE="#undef CERTDO_SUPPORT"
-  echo "CERT.3 Data Object is not supported"
+  echo "CERT.3 Data Object is NOT supported"
+fi
+
+# --enable-keygen option
+if test "$keygen" = "yes"; then
+  KEYGEN_SUPPORT="-DKEYGEN_SUPPORT"
+  echo "Key generation on device is supported"
+else
+  KEYGEN_SUPPORT=""
+  echo "Key generation on device is NOT supported"
 fi
 
 REVISION=`git describe --dirty="-modified"` 
-CONFIG="$target:dfu=$with_dfu:debug=$debug:pinpad=$pinpad:certdo=$certdo"
+CONFIG="$target:dfu=$with_dfu:debug=$debug:pinpad=$pinpad:certdo=$certdo:keygen=$keygen"
 
 if !(IFS="	"
   while read VIDPID VERSION PRODUCT VENDOR; do
@@ -242,6 +257,7 @@ fi
 sed -e "s%@BOARD_DIR@%$BOARD_DIR%" \
     -e "s%@DEBUG_MAKE_OPTION@%$DEBUG_MAKE_OPTION%" \
     -e "s%@PINPAD_MAKE_OPTION@%$PINPAD_MAKE_OPTION%" \
+    -e "s%@KEYGEN_SUPPORT@%$KEYGEN_SUPPORT%" \
 	< Makefile.in > Makefile
 if test "$certdo" = "yes"; then
   sed -e "/^@CERTDO_SUPPORT_START@$/ d" -e "/^@CERTDO_SUPPORT_END@$/ d" \

src/openpgp-do.c

@@ -1481,6 +1481,7 @@ gpg_do_write_simple (uint8_t nr, const uint8_t *data, int size)
     *do_data_p = NULL;
 }
 
+#ifdef KEYGEN_SUPPORT
 void
 gpg_do_keygen (uint8_t kk_byte)
 {
@@ -1554,3 +1555,4 @@ gpg_do_keygen (uint8_t kk_byte)
 
   gpg_do_public_key (kk_byte);
 }
+#endif

src/openpgp.c

@@ -483,8 +483,12 @@ cmd_pgp_gakp (void)
     {
       if (!ac_check_status (AC_ADMIN_AUTHORIZED))
 	GPG_SECURITY_FAILURE ();
+#ifdef KEYGEN_SUPPORT
       /* Generate key pair */
       gpg_do_keygen (apdu.cmd_apdu_data[0]);
+#else
+      GPG_FUNCTION_NOT_SUPPORTED ();
+#endif
     }
 }
 

src/random.c

@@ -72,8 +72,9 @@ get_salt (void)
 }
 
 
+#ifdef KEYGEN_SUPPORT
 /*
- * Rundom byte iterator
+ * Random byte iterator
  */
 uint8_t
 random_byte (void *arg)
@@ -97,3 +98,4 @@ random_byte (void *arg)
 
   return v;
 }
+#endif