1*4fe47877Sdjm /* $OpenBSD: sk-api.h,v 1.15 2022/07/20 03:29:14 djm Exp $ */ 277045ccdSdjm /* 377045ccdSdjm * Copyright (c) 2019 Google LLC 477045ccdSdjm * 577045ccdSdjm * Permission to use, copy, modify, and distribute this software for any 677045ccdSdjm * purpose with or without fee is hereby granted, provided that the above 777045ccdSdjm * copyright notice and this permission notice appear in all copies. 877045ccdSdjm * 977045ccdSdjm * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 1077045ccdSdjm * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 1177045ccdSdjm * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 1277045ccdSdjm * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 1377045ccdSdjm * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 1477045ccdSdjm * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 1577045ccdSdjm * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 1677045ccdSdjm */ 1777045ccdSdjm 1877045ccdSdjm #ifndef _SK_API_H 1977045ccdSdjm #define _SK_API_H 1 2077045ccdSdjm 2177045ccdSdjm #include <stddef.h> 2277045ccdSdjm #include <stdint.h> 2377045ccdSdjm 2477045ccdSdjm /* Flags */ 2577045ccdSdjm #define SSH_SK_USER_PRESENCE_REQD 0x01 268908bc36Sdjm #define SSH_SK_USER_VERIFICATION_REQD 0x04 27*4fe47877Sdjm #define SSH_SK_FORCE_OPERATION 0x10 288908bc36Sdjm #define SSH_SK_RESIDENT_KEY 0x20 2977045ccdSdjm 30a3dd6837Smarkus /* Algs */ 31a3dd6837Smarkus #define SSH_SK_ECDSA 0x00 32a3dd6837Smarkus #define SSH_SK_ED25519 0x01 33a3dd6837Smarkus 34480af03fSdjm /* Error codes */ 35480af03fSdjm #define SSH_SK_ERR_GENERAL -1 36480af03fSdjm #define SSH_SK_ERR_UNSUPPORTED -2 37480af03fSdjm #define SSH_SK_ERR_PIN_REQUIRED -3 38b0297854Sdjm #define SSH_SK_ERR_DEVICE_NOT_FOUND -4 39*4fe47877Sdjm #define SSH_SK_ERR_CREDENTIAL_EXISTS -5 40480af03fSdjm 4177045ccdSdjm struct sk_enroll_response { 4218b3d906Sdjm uint8_t flags; 4377045ccdSdjm uint8_t *public_key; 4477045ccdSdjm size_t public_key_len; 4577045ccdSdjm uint8_t *key_handle; 4677045ccdSdjm size_t key_handle_len; 4777045ccdSdjm uint8_t *signature; 4877045ccdSdjm size_t signature_len; 4977045ccdSdjm uint8_t *attestation_cert; 5077045ccdSdjm size_t attestation_cert_len; 51ee0a8761Sdjm uint8_t *authdata; 52ee0a8761Sdjm size_t authdata_len; 5377045ccdSdjm }; 5477045ccdSdjm 5577045ccdSdjm struct sk_sign_response { 5677045ccdSdjm uint8_t flags; 5777045ccdSdjm uint32_t counter; 5877045ccdSdjm uint8_t *sig_r; 5977045ccdSdjm size_t sig_r_len; 6077045ccdSdjm uint8_t *sig_s; 6177045ccdSdjm size_t sig_s_len; 6277045ccdSdjm }; 6377045ccdSdjm 641ac4a90aSdjm struct sk_resident_key { 65a0caf565Sdjm uint32_t alg; 661ac4a90aSdjm size_t slot; 671ac4a90aSdjm char *application; 681ac4a90aSdjm struct sk_enroll_response key; 6915a2cdb6Sdjm uint8_t flags; 70991d5a20Sdjm uint8_t *user_id; 71991d5a20Sdjm size_t user_id_len; 721ac4a90aSdjm }; 731ac4a90aSdjm 74a0caf565Sdjm struct sk_option { 75a0caf565Sdjm char *name; 76a0caf565Sdjm char *value; 77a0caf565Sdjm uint8_t required; 78a0caf565Sdjm }; 79a0caf565Sdjm 80*4fe47877Sdjm #define SSH_SK_VERSION_MAJOR 0x000a0000 /* current API version */ 8177045ccdSdjm #define SSH_SK_VERSION_MAJOR_MASK 0xffff0000 8277045ccdSdjm 8377045ccdSdjm /* Return the version of the middleware API */ 8477045ccdSdjm uint32_t sk_api_version(void); 8577045ccdSdjm 8677045ccdSdjm /* Enroll a U2F key (private key generation) */ 87a0caf565Sdjm int sk_enroll(uint32_t alg, const uint8_t *challenge, size_t challenge_len, 882db06755Sdjm const char *application, uint8_t flags, const char *pin, 89a0caf565Sdjm struct sk_option **options, struct sk_enroll_response **enroll_response); 9077045ccdSdjm 9177045ccdSdjm /* Sign a challenge */ 9274d7b7bdSdjm int sk_sign(uint32_t alg, const uint8_t *data, size_t data_len, 9377045ccdSdjm const char *application, const uint8_t *key_handle, size_t key_handle_len, 94a0caf565Sdjm uint8_t flags, const char *pin, struct sk_option **options, 95a0caf565Sdjm struct sk_sign_response **sign_response); 9677045ccdSdjm 971ac4a90aSdjm /* Enumerate all resident keys */ 98a0caf565Sdjm int sk_load_resident_keys(const char *pin, struct sk_option **options, 991ac4a90aSdjm struct sk_resident_key ***rks, size_t *nrks); 1001ac4a90aSdjm 10177045ccdSdjm #endif /* _SK_API_H */ 102