1 /* $NetBSD: sshkey.c,v 1.23 2020/05/28 17:05:49 christos Exp $ */ 2 /* $OpenBSD: sshkey.c,v 1.108 2020/04/11 10:16:11 djm Exp $ */ 3 /* 4 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 5 * Copyright (c) 2008 Alexander von Gernler. All rights reserved. 6 * Copyright (c) 2010,2011 Damien Miller. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 #include "includes.h" 29 __RCSID("$NetBSD: sshkey.c,v 1.23 2020/05/28 17:05:49 christos Exp $"); 30 31 #include <sys/types.h> 32 #include <netinet/in.h> 33 34 #ifdef WITH_OPENSSL 35 #include <openssl/evp.h> 36 #include <openssl/err.h> 37 #include <openssl/pem.h> 38 #endif 39 40 #include "crypto_api.h" 41 42 #include <errno.h> 43 #include <stdio.h> 44 #include <string.h> 45 #include <util.h> 46 #include <limits.h> 47 #include <resolv.h> 48 49 #include "ssh2.h" 50 #include "ssherr.h" 51 #include "misc.h" 52 #include "sshbuf.h" 53 #include "cipher.h" 54 #include "digest.h" 55 #define SSHKEY_INTERNAL 56 #include "sshkey.h" 57 #include "match.h" 58 #include "ssh-sk.h" 59 60 #ifdef WITH_XMSS 61 #include "sshkey-xmss.h" 62 #include "xmss_fast.h" 63 #endif 64 65 /* openssh private key file format */ 66 #define MARK_BEGIN "-----BEGIN OPENSSH PRIVATE KEY-----\n" 67 #define MARK_END "-----END OPENSSH PRIVATE KEY-----\n" 68 #define MARK_BEGIN_LEN (sizeof(MARK_BEGIN) - 1) 69 #define MARK_END_LEN (sizeof(MARK_END) - 1) 70 #define KDFNAME "bcrypt" 71 #define AUTH_MAGIC "openssh-key-v1" 72 #define SALT_LEN 16 73 #define DEFAULT_CIPHERNAME "aes256-ctr" 74 #define DEFAULT_ROUNDS 16 75 76 /* Version identification string for SSH v1 identity files. */ 77 #define LEGACY_BEGIN "SSH PRIVATE KEY FILE FORMAT 1.1\n" 78 79 /* 80 * Constants relating to "shielding" support; protection of keys expected 81 * to remain in memory for long durations 82 */ 83 #define SSHKEY_SHIELD_PREKEY_LEN (16 * 1024) 84 #define SSHKEY_SHIELD_CIPHER "aes256-ctr" /* XXX want AES-EME* */ 85 #define SSHKEY_SHIELD_PREKEY_HASH SSH_DIGEST_SHA512 86 87 int sshkey_private_serialize_opt(struct sshkey *key, 88 struct sshbuf *buf, enum sshkey_serialize_rep); 89 static int sshkey_from_blob_internal(struct sshbuf *buf, 90 struct sshkey **keyp, int allow_cert); 91 92 /* Supported key types */ 93 struct keytype { 94 const char *name; 95 const char *shortname; 96 const char *sigalg; 97 int type; 98 int nid; 99 int cert; 100 int sigonly; 101 }; 102 static const struct keytype keytypes[] = { 103 { "ssh-ed25519", "ED25519", NULL, KEY_ED25519, 0, 0, 0 }, 104 { "ssh-ed25519-cert-v01@openssh.com", "ED25519-CERT", NULL, 105 KEY_ED25519_CERT, 0, 1, 0 }, 106 { "sk-ssh-ed25519@openssh.com", "ED25519-SK", NULL, 107 KEY_ED25519_SK, 0, 0, 0 }, 108 { "sk-ssh-ed25519-cert-v01@openssh.com", "ED25519-SK-CERT", NULL, 109 KEY_ED25519_SK_CERT, 0, 1, 0 }, 110 #ifdef WITH_XMSS 111 { "ssh-xmss@openssh.com", "XMSS", NULL, KEY_XMSS, 0, 0, 0 }, 112 { "ssh-xmss-cert-v01@openssh.com", "XMSS-CERT", NULL, 113 KEY_XMSS_CERT, 0, 1, 0 }, 114 #endif /* WITH_XMSS */ 115 #ifdef WITH_OPENSSL 116 { "ssh-rsa", "RSA", NULL, KEY_RSA, 0, 0, 0 }, 117 { "rsa-sha2-256", "RSA", NULL, KEY_RSA, 0, 0, 1 }, 118 { "rsa-sha2-512", "RSA", NULL, KEY_RSA, 0, 0, 1 }, 119 { "ssh-dss", "DSA", NULL, KEY_DSA, 0, 0, 0 }, 120 { "ecdsa-sha2-nistp256", "ECDSA", NULL, 121 KEY_ECDSA, NID_X9_62_prime256v1, 0, 0 }, 122 { "ecdsa-sha2-nistp384", "ECDSA", NULL, 123 KEY_ECDSA, NID_secp384r1, 0, 0 }, 124 { "ecdsa-sha2-nistp521", "ECDSA", NULL, 125 KEY_ECDSA, NID_secp521r1, 0, 0 }, 126 { "sk-ecdsa-sha2-nistp256@openssh.com", "ECDSA-SK", NULL, 127 KEY_ECDSA_SK, NID_X9_62_prime256v1, 0, 0 }, 128 { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", NULL, 129 KEY_RSA_CERT, 0, 1, 0 }, 130 { "rsa-sha2-256-cert-v01@openssh.com", "RSA-CERT", 131 "rsa-sha2-256", KEY_RSA_CERT, 0, 1, 1 }, 132 { "rsa-sha2-512-cert-v01@openssh.com", "RSA-CERT", 133 "rsa-sha2-512", KEY_RSA_CERT, 0, 1, 1 }, 134 { "ssh-dss-cert-v01@openssh.com", "DSA-CERT", NULL, 135 KEY_DSA_CERT, 0, 1, 0 }, 136 { "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-CERT", NULL, 137 KEY_ECDSA_CERT, NID_X9_62_prime256v1, 1, 0 }, 138 { "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ECDSA-CERT", NULL, 139 KEY_ECDSA_CERT, NID_secp384r1, 1, 0 }, 140 { "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ECDSA-CERT", NULL, 141 KEY_ECDSA_CERT, NID_secp521r1, 1, 0 }, 142 { "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-SK-CERT", NULL, 143 KEY_ECDSA_SK_CERT, NID_X9_62_prime256v1, 1, 0 }, 144 #endif /* WITH_OPENSSL */ 145 { NULL, NULL, NULL, -1, -1, 0, 0 } 146 }; 147 148 const char * 149 sshkey_type(const struct sshkey *k) 150 { 151 const struct keytype *kt; 152 153 for (kt = keytypes; kt->type != -1; kt++) { 154 if (kt->type == k->type) 155 return kt->shortname; 156 } 157 return "unknown"; 158 } 159 160 static const char * 161 sshkey_ssh_name_from_type_nid(int type, int nid) 162 { 163 const struct keytype *kt; 164 165 for (kt = keytypes; kt->type != -1; kt++) { 166 if (kt->type == type && (kt->nid == 0 || kt->nid == nid)) 167 return kt->name; 168 } 169 return "ssh-unknown"; 170 } 171 172 int 173 sshkey_type_is_cert(int type) 174 { 175 const struct keytype *kt; 176 177 for (kt = keytypes; kt->type != -1; kt++) { 178 if (kt->type == type) 179 return kt->cert; 180 } 181 return 0; 182 } 183 184 const char * 185 sshkey_ssh_name(const struct sshkey *k) 186 { 187 return sshkey_ssh_name_from_type_nid(k->type, k->ecdsa_nid); 188 } 189 190 const char * 191 sshkey_ssh_name_plain(const struct sshkey *k) 192 { 193 return sshkey_ssh_name_from_type_nid(sshkey_type_plain(k->type), 194 k->ecdsa_nid); 195 } 196 197 int 198 sshkey_type_from_name(const char *name) 199 { 200 const struct keytype *kt; 201 202 for (kt = keytypes; kt->type != -1; kt++) { 203 /* Only allow shortname matches for plain key types */ 204 if ((kt->name != NULL && strcmp(name, kt->name) == 0) || 205 (!kt->cert && strcasecmp(kt->shortname, name) == 0)) 206 return kt->type; 207 } 208 return KEY_UNSPEC; 209 } 210 211 static int 212 key_type_is_ecdsa_variant(int type) 213 { 214 switch (type) { 215 case KEY_ECDSA: 216 case KEY_ECDSA_CERT: 217 case KEY_ECDSA_SK: 218 case KEY_ECDSA_SK_CERT: 219 return 1; 220 } 221 return 0; 222 } 223 224 int 225 sshkey_ecdsa_nid_from_name(const char *name) 226 { 227 const struct keytype *kt; 228 229 for (kt = keytypes; kt->type != -1; kt++) { 230 if (!key_type_is_ecdsa_variant(kt->type)) 231 continue; 232 if (kt->name != NULL && strcmp(name, kt->name) == 0) 233 return kt->nid; 234 } 235 return -1; 236 } 237 238 char * 239 sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep) 240 { 241 char *tmp, *ret = NULL; 242 size_t nlen, rlen = 0; 243 const struct keytype *kt; 244 245 for (kt = keytypes; kt->type != -1; kt++) { 246 if (kt->name == NULL) 247 continue; 248 if (!include_sigonly && kt->sigonly) 249 continue; 250 if ((certs_only && !kt->cert) || (plain_only && kt->cert)) 251 continue; 252 if (ret != NULL) 253 ret[rlen++] = sep; 254 nlen = strlen(kt->name); 255 if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) { 256 free(ret); 257 return NULL; 258 } 259 ret = tmp; 260 memcpy(ret + rlen, kt->name, nlen + 1); 261 rlen += nlen; 262 } 263 return ret; 264 } 265 266 int 267 sshkey_names_valid2(const char *names, int allow_wildcard) 268 { 269 char *s, *cp, *p; 270 const struct keytype *kt; 271 int type; 272 273 if (names == NULL || strcmp(names, "") == 0) 274 return 0; 275 if ((s = cp = strdup(names)) == NULL) 276 return 0; 277 for ((p = strsep(&cp, ",")); p && *p != '\0'; 278 (p = strsep(&cp, ","))) { 279 type = sshkey_type_from_name(p); 280 if (type == KEY_UNSPEC) { 281 if (allow_wildcard) { 282 /* 283 * Try matching key types against the string. 284 * If any has a positive or negative match then 285 * the component is accepted. 286 */ 287 for (kt = keytypes; kt->type != -1; kt++) { 288 if (match_pattern_list(kt->name, 289 p, 0) != 0) 290 break; 291 } 292 if (kt->type != -1) 293 continue; 294 } 295 free(s); 296 return 0; 297 } 298 } 299 free(s); 300 return 1; 301 } 302 303 u_int 304 sshkey_size(const struct sshkey *k) 305 { 306 #ifdef WITH_OPENSSL 307 const BIGNUM *rsa_n, *dsa_p; 308 #endif /* WITH_OPENSSL */ 309 310 switch (k->type) { 311 #ifdef WITH_OPENSSL 312 case KEY_RSA: 313 case KEY_RSA_CERT: 314 if (k->rsa == NULL) 315 return 0; 316 RSA_get0_key(k->rsa, &rsa_n, NULL, NULL); 317 return BN_num_bits(rsa_n); 318 case KEY_DSA: 319 case KEY_DSA_CERT: 320 if (k->dsa == NULL) 321 return 0; 322 DSA_get0_pqg(k->dsa, &dsa_p, NULL, NULL); 323 return BN_num_bits(dsa_p); 324 case KEY_ECDSA: 325 case KEY_ECDSA_CERT: 326 case KEY_ECDSA_SK: 327 case KEY_ECDSA_SK_CERT: 328 return sshkey_curve_nid_to_bits(k->ecdsa_nid); 329 #endif /* WITH_OPENSSL */ 330 case KEY_ED25519: 331 case KEY_ED25519_CERT: 332 case KEY_ED25519_SK: 333 case KEY_ED25519_SK_CERT: 334 case KEY_XMSS: 335 case KEY_XMSS_CERT: 336 return 256; /* XXX */ 337 } 338 return 0; 339 } 340 341 static int 342 sshkey_type_is_valid_ca(int type) 343 { 344 switch (type) { 345 case KEY_RSA: 346 case KEY_DSA: 347 case KEY_ECDSA: 348 case KEY_ECDSA_SK: 349 case KEY_ED25519: 350 case KEY_ED25519_SK: 351 case KEY_XMSS: 352 return 1; 353 default: 354 return 0; 355 } 356 } 357 358 int 359 sshkey_is_cert(const struct sshkey *k) 360 { 361 if (k == NULL) 362 return 0; 363 return sshkey_type_is_cert(k->type); 364 } 365 366 int 367 sshkey_is_sk(const struct sshkey *k) 368 { 369 if (k == NULL) 370 return 0; 371 switch (sshkey_type_plain(k->type)) { 372 case KEY_ECDSA_SK: 373 case KEY_ED25519_SK: 374 return 1; 375 default: 376 return 0; 377 } 378 } 379 380 /* Return the cert-less equivalent to a certified key type */ 381 int 382 sshkey_type_plain(int type) 383 { 384 switch (type) { 385 case KEY_RSA_CERT: 386 return KEY_RSA; 387 case KEY_DSA_CERT: 388 return KEY_DSA; 389 case KEY_ECDSA_CERT: 390 return KEY_ECDSA; 391 case KEY_ECDSA_SK_CERT: 392 return KEY_ECDSA_SK; 393 case KEY_ED25519_CERT: 394 return KEY_ED25519; 395 case KEY_ED25519_SK_CERT: 396 return KEY_ED25519_SK; 397 case KEY_XMSS_CERT: 398 return KEY_XMSS; 399 default: 400 return type; 401 } 402 } 403 404 #ifdef WITH_OPENSSL 405 /* XXX: these are really begging for a table-driven approach */ 406 int 407 sshkey_curve_name_to_nid(const char *name) 408 { 409 if (strcmp(name, "nistp256") == 0) 410 return NID_X9_62_prime256v1; 411 else if (strcmp(name, "nistp384") == 0) 412 return NID_secp384r1; 413 else if (strcmp(name, "nistp521") == 0) 414 return NID_secp521r1; 415 else 416 return -1; 417 } 418 419 u_int 420 sshkey_curve_nid_to_bits(int nid) 421 { 422 switch (nid) { 423 case NID_X9_62_prime256v1: 424 return 256; 425 case NID_secp384r1: 426 return 384; 427 case NID_secp521r1: 428 return 521; 429 default: 430 return 0; 431 } 432 } 433 434 int 435 sshkey_ecdsa_bits_to_nid(int bits) 436 { 437 switch (bits) { 438 case 256: 439 return NID_X9_62_prime256v1; 440 case 384: 441 return NID_secp384r1; 442 case 521: 443 return NID_secp521r1; 444 default: 445 return -1; 446 } 447 } 448 449 const char * 450 sshkey_curve_nid_to_name(int nid) 451 { 452 switch (nid) { 453 case NID_X9_62_prime256v1: 454 return "nistp256"; 455 case NID_secp384r1: 456 return "nistp384"; 457 case NID_secp521r1: 458 return "nistp521"; 459 default: 460 return NULL; 461 } 462 } 463 464 int 465 sshkey_ec_nid_to_hash_alg(int nid) 466 { 467 int kbits = sshkey_curve_nid_to_bits(nid); 468 469 if (kbits <= 0) 470 return -1; 471 472 /* RFC5656 section 6.2.1 */ 473 if (kbits <= 256) 474 return SSH_DIGEST_SHA256; 475 else if (kbits <= 384) 476 return SSH_DIGEST_SHA384; 477 else 478 return SSH_DIGEST_SHA512; 479 } 480 #endif /* WITH_OPENSSL */ 481 482 static void 483 cert_free(struct sshkey_cert *cert) 484 { 485 u_int i; 486 487 if (cert == NULL) 488 return; 489 sshbuf_free(cert->certblob); 490 sshbuf_free(cert->critical); 491 sshbuf_free(cert->extensions); 492 free(cert->key_id); 493 for (i = 0; i < cert->nprincipals; i++) 494 free(cert->principals[i]); 495 free(cert->principals); 496 sshkey_free(cert->signature_key); 497 free(cert->signature_type); 498 freezero(cert, sizeof(*cert)); 499 } 500 501 static struct sshkey_cert * 502 cert_new(void) 503 { 504 struct sshkey_cert *cert; 505 506 if ((cert = calloc(1, sizeof(*cert))) == NULL) 507 return NULL; 508 if ((cert->certblob = sshbuf_new()) == NULL || 509 (cert->critical = sshbuf_new()) == NULL || 510 (cert->extensions = sshbuf_new()) == NULL) { 511 cert_free(cert); 512 return NULL; 513 } 514 cert->key_id = NULL; 515 cert->principals = NULL; 516 cert->signature_key = NULL; 517 cert->signature_type = NULL; 518 return cert; 519 } 520 521 struct sshkey * 522 sshkey_new(int type) 523 { 524 struct sshkey *k; 525 #ifdef WITH_OPENSSL 526 RSA *rsa; 527 DSA *dsa; 528 #endif /* WITH_OPENSSL */ 529 530 if ((k = calloc(1, sizeof(*k))) == NULL) 531 return NULL; 532 k->type = type; 533 k->ecdsa = NULL; 534 k->ecdsa_nid = -1; 535 k->dsa = NULL; 536 k->rsa = NULL; 537 k->cert = NULL; 538 k->ed25519_sk = NULL; 539 k->ed25519_pk = NULL; 540 k->xmss_sk = NULL; 541 k->xmss_pk = NULL; 542 switch (k->type) { 543 #ifdef WITH_OPENSSL 544 case KEY_RSA: 545 case KEY_RSA_CERT: 546 if ((rsa = RSA_new()) == NULL) { 547 free(k); 548 return NULL; 549 } 550 k->rsa = rsa; 551 break; 552 case KEY_DSA: 553 case KEY_DSA_CERT: 554 if ((dsa = DSA_new()) == NULL) { 555 free(k); 556 return NULL; 557 } 558 k->dsa = dsa; 559 break; 560 case KEY_ECDSA: 561 case KEY_ECDSA_CERT: 562 case KEY_ECDSA_SK: 563 case KEY_ECDSA_SK_CERT: 564 /* Cannot do anything until we know the group */ 565 break; 566 #endif /* WITH_OPENSSL */ 567 case KEY_ED25519: 568 case KEY_ED25519_CERT: 569 case KEY_ED25519_SK: 570 case KEY_ED25519_SK_CERT: 571 case KEY_XMSS: 572 case KEY_XMSS_CERT: 573 /* no need to prealloc */ 574 break; 575 case KEY_UNSPEC: 576 break; 577 default: 578 free(k); 579 return NULL; 580 } 581 582 if (sshkey_is_cert(k)) { 583 if ((k->cert = cert_new()) == NULL) { 584 sshkey_free(k); 585 return NULL; 586 } 587 } 588 589 return k; 590 } 591 592 void 593 sshkey_free(struct sshkey *k) 594 { 595 if (k == NULL) 596 return; 597 switch (k->type) { 598 #ifdef WITH_OPENSSL 599 case KEY_RSA: 600 case KEY_RSA_CERT: 601 RSA_free(k->rsa); 602 k->rsa = NULL; 603 break; 604 case KEY_DSA: 605 case KEY_DSA_CERT: 606 DSA_free(k->dsa); 607 k->dsa = NULL; 608 break; 609 case KEY_ECDSA_SK: 610 case KEY_ECDSA_SK_CERT: 611 free(k->sk_application); 612 sshbuf_free(k->sk_key_handle); 613 sshbuf_free(k->sk_reserved); 614 /* FALLTHROUGH */ 615 case KEY_ECDSA: 616 case KEY_ECDSA_CERT: 617 EC_KEY_free(k->ecdsa); 618 k->ecdsa = NULL; 619 break; 620 #endif /* WITH_OPENSSL */ 621 case KEY_ED25519_SK: 622 case KEY_ED25519_SK_CERT: 623 free(k->sk_application); 624 sshbuf_free(k->sk_key_handle); 625 sshbuf_free(k->sk_reserved); 626 /* FALLTHROUGH */ 627 case KEY_ED25519: 628 case KEY_ED25519_CERT: 629 freezero(k->ed25519_pk, ED25519_PK_SZ); 630 k->ed25519_pk = NULL; 631 freezero(k->ed25519_sk, ED25519_SK_SZ); 632 k->ed25519_sk = NULL; 633 break; 634 #ifdef WITH_XMSS 635 case KEY_XMSS: 636 case KEY_XMSS_CERT: 637 freezero(k->xmss_pk, sshkey_xmss_pklen(k)); 638 k->xmss_pk = NULL; 639 freezero(k->xmss_sk, sshkey_xmss_sklen(k)); 640 k->xmss_sk = NULL; 641 sshkey_xmss_free_state(k); 642 free(k->xmss_name); 643 k->xmss_name = NULL; 644 free(k->xmss_filename); 645 k->xmss_filename = NULL; 646 break; 647 #endif /* WITH_XMSS */ 648 case KEY_UNSPEC: 649 break; 650 default: 651 break; 652 } 653 if (sshkey_is_cert(k)) 654 cert_free(k->cert); 655 freezero(k->shielded_private, k->shielded_len); 656 freezero(k->shield_prekey, k->shield_prekey_len); 657 freezero(k, sizeof(*k)); 658 } 659 660 static int 661 cert_compare(struct sshkey_cert *a, struct sshkey_cert *b) 662 { 663 if (a == NULL && b == NULL) 664 return 1; 665 if (a == NULL || b == NULL) 666 return 0; 667 if (sshbuf_len(a->certblob) != sshbuf_len(b->certblob)) 668 return 0; 669 if (timingsafe_bcmp(sshbuf_ptr(a->certblob), sshbuf_ptr(b->certblob), 670 sshbuf_len(a->certblob)) != 0) 671 return 0; 672 return 1; 673 } 674 675 /* 676 * Compare public portions of key only, allowing comparisons between 677 * certificates and plain keys too. 678 */ 679 int 680 sshkey_equal_public(const struct sshkey *a, const struct sshkey *b) 681 { 682 #ifdef WITH_OPENSSL 683 const BIGNUM *rsa_e_a, *rsa_n_a; 684 const BIGNUM *rsa_e_b, *rsa_n_b; 685 const BIGNUM *dsa_p_a, *dsa_q_a, *dsa_g_a, *dsa_pub_key_a; 686 const BIGNUM *dsa_p_b, *dsa_q_b, *dsa_g_b, *dsa_pub_key_b; 687 #endif /* WITH_OPENSSL */ 688 689 if (a == NULL || b == NULL || 690 sshkey_type_plain(a->type) != sshkey_type_plain(b->type)) 691 return 0; 692 693 switch (a->type) { 694 #ifdef WITH_OPENSSL 695 case KEY_RSA_CERT: 696 case KEY_RSA: 697 if (a->rsa == NULL || b->rsa == NULL) 698 return 0; 699 RSA_get0_key(a->rsa, &rsa_n_a, &rsa_e_a, NULL); 700 RSA_get0_key(b->rsa, &rsa_n_b, &rsa_e_b, NULL); 701 return BN_cmp(rsa_e_a, rsa_e_b) == 0 && 702 BN_cmp(rsa_n_a, rsa_n_b) == 0; 703 case KEY_DSA_CERT: 704 case KEY_DSA: 705 if (a->dsa == NULL || b->dsa == NULL) 706 return 0; 707 DSA_get0_pqg(a->dsa, &dsa_p_a, &dsa_q_a, &dsa_g_a); 708 DSA_get0_pqg(b->dsa, &dsa_p_b, &dsa_q_b, &dsa_g_b); 709 DSA_get0_key(a->dsa, &dsa_pub_key_a, NULL); 710 DSA_get0_key(b->dsa, &dsa_pub_key_b, NULL); 711 return BN_cmp(dsa_p_a, dsa_p_b) == 0 && 712 BN_cmp(dsa_q_a, dsa_q_b) == 0 && 713 BN_cmp(dsa_g_a, dsa_g_b) == 0 && 714 BN_cmp(dsa_pub_key_a, dsa_pub_key_b) == 0; 715 case KEY_ECDSA_SK: 716 case KEY_ECDSA_SK_CERT: 717 if (a->sk_application == NULL || b->sk_application == NULL) 718 return 0; 719 if (strcmp(a->sk_application, b->sk_application) != 0) 720 return 0; 721 /* FALLTHROUGH */ 722 case KEY_ECDSA_CERT: 723 case KEY_ECDSA: 724 if (a->ecdsa == NULL || b->ecdsa == NULL || 725 EC_KEY_get0_public_key(a->ecdsa) == NULL || 726 EC_KEY_get0_public_key(b->ecdsa) == NULL) 727 return 0; 728 if (EC_GROUP_cmp(EC_KEY_get0_group(a->ecdsa), 729 EC_KEY_get0_group(b->ecdsa), NULL) != 0 || 730 EC_POINT_cmp(EC_KEY_get0_group(a->ecdsa), 731 EC_KEY_get0_public_key(a->ecdsa), 732 EC_KEY_get0_public_key(b->ecdsa), NULL) != 0) 733 return 0; 734 return 1; 735 #endif /* WITH_OPENSSL */ 736 case KEY_ED25519_SK: 737 case KEY_ED25519_SK_CERT: 738 if (a->sk_application == NULL || b->sk_application == NULL) 739 return 0; 740 if (strcmp(a->sk_application, b->sk_application) != 0) 741 return 0; 742 /* FALLTHROUGH */ 743 case KEY_ED25519: 744 case KEY_ED25519_CERT: 745 return a->ed25519_pk != NULL && b->ed25519_pk != NULL && 746 memcmp(a->ed25519_pk, b->ed25519_pk, ED25519_PK_SZ) == 0; 747 #ifdef WITH_XMSS 748 case KEY_XMSS: 749 case KEY_XMSS_CERT: 750 return a->xmss_pk != NULL && b->xmss_pk != NULL && 751 sshkey_xmss_pklen(a) == sshkey_xmss_pklen(b) && 752 memcmp(a->xmss_pk, b->xmss_pk, sshkey_xmss_pklen(a)) == 0; 753 #endif /* WITH_XMSS */ 754 default: 755 return 0; 756 } 757 /* NOTREACHED */ 758 } 759 760 int 761 sshkey_equal(const struct sshkey *a, const struct sshkey *b) 762 { 763 if (a == NULL || b == NULL || a->type != b->type) 764 return 0; 765 if (sshkey_is_cert(a)) { 766 if (!cert_compare(a->cert, b->cert)) 767 return 0; 768 } 769 return sshkey_equal_public(a, b); 770 } 771 772 static int 773 to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain, 774 enum sshkey_serialize_rep opts) 775 { 776 int type, ret = SSH_ERR_INTERNAL_ERROR; 777 const char *typename; 778 #ifdef WITH_OPENSSL 779 const BIGNUM *rsa_n, *rsa_e, *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key; 780 #endif /* WITH_OPENSSL */ 781 782 if (key == NULL) 783 return SSH_ERR_INVALID_ARGUMENT; 784 785 if (sshkey_is_cert(key)) { 786 if (key->cert == NULL) 787 return SSH_ERR_EXPECTED_CERT; 788 if (sshbuf_len(key->cert->certblob) == 0) 789 return SSH_ERR_KEY_LACKS_CERTBLOB; 790 } 791 type = force_plain ? sshkey_type_plain(key->type) : key->type; 792 typename = sshkey_ssh_name_from_type_nid(type, key->ecdsa_nid); 793 794 switch (type) { 795 #ifdef WITH_OPENSSL 796 case KEY_DSA_CERT: 797 case KEY_ECDSA_CERT: 798 case KEY_ECDSA_SK_CERT: 799 case KEY_RSA_CERT: 800 #endif /* WITH_OPENSSL */ 801 case KEY_ED25519_CERT: 802 case KEY_ED25519_SK_CERT: 803 #ifdef WITH_XMSS 804 case KEY_XMSS_CERT: 805 #endif /* WITH_XMSS */ 806 /* Use the existing blob */ 807 /* XXX modified flag? */ 808 if ((ret = sshbuf_putb(b, key->cert->certblob)) != 0) 809 return ret; 810 break; 811 #ifdef WITH_OPENSSL 812 case KEY_DSA: 813 if (key->dsa == NULL) 814 return SSH_ERR_INVALID_ARGUMENT; 815 DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g); 816 DSA_get0_key(key->dsa, &dsa_pub_key, NULL); 817 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 818 (ret = sshbuf_put_bignum2(b, dsa_p)) != 0 || 819 (ret = sshbuf_put_bignum2(b, dsa_q)) != 0 || 820 (ret = sshbuf_put_bignum2(b, dsa_g)) != 0 || 821 (ret = sshbuf_put_bignum2(b, dsa_pub_key)) != 0) 822 return ret; 823 break; 824 case KEY_ECDSA: 825 case KEY_ECDSA_SK: 826 if (key->ecdsa == NULL) 827 return SSH_ERR_INVALID_ARGUMENT; 828 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 829 (ret = sshbuf_put_cstring(b, 830 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 831 (ret = sshbuf_put_eckey(b, key->ecdsa)) != 0) 832 return ret; 833 if (type == KEY_ECDSA_SK) { 834 if ((ret = sshbuf_put_cstring(b, 835 key->sk_application)) != 0) 836 return ret; 837 } 838 break; 839 case KEY_RSA: 840 if (key->rsa == NULL) 841 return SSH_ERR_INVALID_ARGUMENT; 842 RSA_get0_key(key->rsa, &rsa_n, &rsa_e, NULL); 843 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 844 (ret = sshbuf_put_bignum2(b, rsa_e)) != 0 || 845 (ret = sshbuf_put_bignum2(b, rsa_n)) != 0) 846 return ret; 847 break; 848 #endif /* WITH_OPENSSL */ 849 case KEY_ED25519: 850 case KEY_ED25519_SK: 851 if (key->ed25519_pk == NULL) 852 return SSH_ERR_INVALID_ARGUMENT; 853 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 854 (ret = sshbuf_put_string(b, 855 key->ed25519_pk, ED25519_PK_SZ)) != 0) 856 return ret; 857 if (type == KEY_ED25519_SK) { 858 if ((ret = sshbuf_put_cstring(b, 859 key->sk_application)) != 0) 860 return ret; 861 } 862 break; 863 #ifdef WITH_XMSS 864 case KEY_XMSS: 865 if (key->xmss_name == NULL || key->xmss_pk == NULL || 866 sshkey_xmss_pklen(key) == 0) 867 return SSH_ERR_INVALID_ARGUMENT; 868 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 869 (ret = sshbuf_put_cstring(b, key->xmss_name)) != 0 || 870 (ret = sshbuf_put_string(b, 871 key->xmss_pk, sshkey_xmss_pklen(key))) != 0 || 872 (ret = sshkey_xmss_serialize_pk_info(key, b, opts)) != 0) 873 return ret; 874 break; 875 #endif /* WITH_XMSS */ 876 default: 877 return SSH_ERR_KEY_TYPE_UNKNOWN; 878 } 879 return 0; 880 } 881 882 int 883 sshkey_putb(const struct sshkey *key, struct sshbuf *b) 884 { 885 return to_blob_buf(key, b, 0, SSHKEY_SERIALIZE_DEFAULT); 886 } 887 888 int 889 sshkey_puts_opts(const struct sshkey *key, struct sshbuf *b, 890 enum sshkey_serialize_rep opts) 891 { 892 struct sshbuf *tmp; 893 int r; 894 895 if ((tmp = sshbuf_new()) == NULL) 896 return SSH_ERR_ALLOC_FAIL; 897 r = to_blob_buf(key, tmp, 0, opts); 898 if (r == 0) 899 r = sshbuf_put_stringb(b, tmp); 900 sshbuf_free(tmp); 901 return r; 902 } 903 904 int 905 sshkey_puts(const struct sshkey *key, struct sshbuf *b) 906 { 907 return sshkey_puts_opts(key, b, SSHKEY_SERIALIZE_DEFAULT); 908 } 909 910 int 911 sshkey_putb_plain(const struct sshkey *key, struct sshbuf *b) 912 { 913 return to_blob_buf(key, b, 1, SSHKEY_SERIALIZE_DEFAULT); 914 } 915 916 static int 917 to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp, int force_plain, 918 enum sshkey_serialize_rep opts) 919 { 920 int ret = SSH_ERR_INTERNAL_ERROR; 921 size_t len; 922 struct sshbuf *b = NULL; 923 924 if (lenp != NULL) 925 *lenp = 0; 926 if (blobp != NULL) 927 *blobp = NULL; 928 if ((b = sshbuf_new()) == NULL) 929 return SSH_ERR_ALLOC_FAIL; 930 if ((ret = to_blob_buf(key, b, force_plain, opts)) != 0) 931 goto out; 932 len = sshbuf_len(b); 933 if (lenp != NULL) 934 *lenp = len; 935 if (blobp != NULL) { 936 if ((*blobp = malloc(len)) == NULL) { 937 ret = SSH_ERR_ALLOC_FAIL; 938 goto out; 939 } 940 memcpy(*blobp, sshbuf_ptr(b), len); 941 } 942 ret = 0; 943 out: 944 sshbuf_free(b); 945 return ret; 946 } 947 948 int 949 sshkey_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 950 { 951 return to_blob(key, blobp, lenp, 0, SSHKEY_SERIALIZE_DEFAULT); 952 } 953 954 int 955 sshkey_plain_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 956 { 957 return to_blob(key, blobp, lenp, 1, SSHKEY_SERIALIZE_DEFAULT); 958 } 959 960 int 961 sshkey_fingerprint_raw(const struct sshkey *k, int dgst_alg, 962 u_char **retp, size_t *lenp) 963 { 964 u_char *blob = NULL, *ret = NULL; 965 size_t blob_len = 0; 966 int r = SSH_ERR_INTERNAL_ERROR; 967 968 if (retp != NULL) 969 *retp = NULL; 970 if (lenp != NULL) 971 *lenp = 0; 972 if (ssh_digest_bytes(dgst_alg) == 0) { 973 r = SSH_ERR_INVALID_ARGUMENT; 974 goto out; 975 } 976 if ((r = to_blob(k, &blob, &blob_len, 1, SSHKEY_SERIALIZE_DEFAULT)) 977 != 0) 978 goto out; 979 if ((ret = calloc(1, SSH_DIGEST_MAX_LENGTH)) == NULL) { 980 r = SSH_ERR_ALLOC_FAIL; 981 goto out; 982 } 983 if ((r = ssh_digest_memory(dgst_alg, blob, blob_len, 984 ret, SSH_DIGEST_MAX_LENGTH)) != 0) 985 goto out; 986 /* success */ 987 if (retp != NULL) { 988 *retp = ret; 989 ret = NULL; 990 } 991 if (lenp != NULL) 992 *lenp = ssh_digest_bytes(dgst_alg); 993 r = 0; 994 out: 995 free(ret); 996 if (blob != NULL) 997 freezero(blob, blob_len); 998 return r; 999 } 1000 1001 static char * 1002 fingerprint_b64(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 1003 { 1004 char *ret; 1005 size_t plen = strlen(alg) + 1; 1006 size_t rlen = ((dgst_raw_len + 2) / 3) * 4 + plen + 1; 1007 1008 if (dgst_raw_len > 65536 || (ret = calloc(1, rlen)) == NULL) 1009 return NULL; 1010 strlcpy(ret, alg, rlen); 1011 strlcat(ret, ":", rlen); 1012 if (dgst_raw_len == 0) 1013 return ret; 1014 if (b64_ntop(dgst_raw, dgst_raw_len, ret + plen, rlen - plen) == -1) { 1015 freezero(ret, rlen); 1016 return NULL; 1017 } 1018 /* Trim padding characters from end */ 1019 ret[strcspn(ret, "=")] = '\0'; 1020 return ret; 1021 } 1022 1023 static char * 1024 fingerprint_hex(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 1025 { 1026 char *retval, hex[5]; 1027 size_t i, rlen = dgst_raw_len * 3 + strlen(alg) + 2; 1028 1029 if (dgst_raw_len > 65536 || (retval = calloc(1, rlen)) == NULL) 1030 return NULL; 1031 strlcpy(retval, alg, rlen); 1032 strlcat(retval, ":", rlen); 1033 for (i = 0; i < dgst_raw_len; i++) { 1034 snprintf(hex, sizeof(hex), "%s%02x", 1035 i > 0 ? ":" : "", dgst_raw[i]); 1036 strlcat(retval, hex, rlen); 1037 } 1038 return retval; 1039 } 1040 1041 static char * 1042 fingerprint_bubblebabble(u_char *dgst_raw, size_t dgst_raw_len) 1043 { 1044 char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' }; 1045 char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm', 1046 'n', 'p', 'r', 's', 't', 'v', 'z', 'x' }; 1047 u_int i, j = 0, rounds, seed = 1; 1048 char *retval; 1049 1050 rounds = (dgst_raw_len / 2) + 1; 1051 if ((retval = calloc(rounds, 6)) == NULL) 1052 return NULL; 1053 retval[j++] = 'x'; 1054 for (i = 0; i < rounds; i++) { 1055 u_int idx0, idx1, idx2, idx3, idx4; 1056 if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) { 1057 idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) + 1058 seed) % 6; 1059 idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15; 1060 idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) + 1061 (seed / 6)) % 6; 1062 retval[j++] = vowels[idx0]; 1063 retval[j++] = consonants[idx1]; 1064 retval[j++] = vowels[idx2]; 1065 if ((i + 1) < rounds) { 1066 idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15; 1067 idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15; 1068 retval[j++] = consonants[idx3]; 1069 retval[j++] = '-'; 1070 retval[j++] = consonants[idx4]; 1071 seed = ((seed * 5) + 1072 ((((u_int)(dgst_raw[2 * i])) * 7) + 1073 ((u_int)(dgst_raw[(2 * i) + 1])))) % 36; 1074 } 1075 } else { 1076 idx0 = seed % 6; 1077 idx1 = 16; 1078 idx2 = seed / 6; 1079 retval[j++] = vowels[idx0]; 1080 retval[j++] = consonants[idx1]; 1081 retval[j++] = vowels[idx2]; 1082 } 1083 } 1084 retval[j++] = 'x'; 1085 retval[j++] = '\0'; 1086 return retval; 1087 } 1088 1089 /* 1090 * Draw an ASCII-Art representing the fingerprint so human brain can 1091 * profit from its built-in pattern recognition ability. 1092 * This technique is called "random art" and can be found in some 1093 * scientific publications like this original paper: 1094 * 1095 * "Hash Visualization: a New Technique to improve Real-World Security", 1096 * Perrig A. and Song D., 1999, International Workshop on Cryptographic 1097 * Techniques and E-Commerce (CrypTEC '99) 1098 * sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf 1099 * 1100 * The subject came up in a talk by Dan Kaminsky, too. 1101 * 1102 * If you see the picture is different, the key is different. 1103 * If the picture looks the same, you still know nothing. 1104 * 1105 * The algorithm used here is a worm crawling over a discrete plane, 1106 * leaving a trace (augmenting the field) everywhere it goes. 1107 * Movement is taken from dgst_raw 2bit-wise. Bumping into walls 1108 * makes the respective movement vector be ignored for this turn. 1109 * Graphs are not unambiguous, because circles in graphs can be 1110 * walked in either direction. 1111 */ 1112 1113 /* 1114 * Field sizes for the random art. Have to be odd, so the starting point 1115 * can be in the exact middle of the picture, and FLDBASE should be >=8 . 1116 * Else pictures would be too dense, and drawing the frame would 1117 * fail, too, because the key type would not fit in anymore. 1118 */ 1119 #define FLDBASE 8 1120 #define FLDSIZE_Y (FLDBASE + 1) 1121 #define FLDSIZE_X (FLDBASE * 2 + 1) 1122 static char * 1123 fingerprint_randomart(const char *alg, u_char *dgst_raw, size_t dgst_raw_len, 1124 const struct sshkey *k) 1125 { 1126 /* 1127 * Chars to be used after each other every time the worm 1128 * intersects with itself. Matter of taste. 1129 */ 1130 const char *augmentation_string = " .o+=*BOX@%&#/^SE"; 1131 char *retval, *p, title[FLDSIZE_X], hash[FLDSIZE_X]; 1132 u_char field[FLDSIZE_X][FLDSIZE_Y]; 1133 size_t i, tlen, hlen; 1134 u_int b; 1135 int x, y, r; 1136 size_t len = strlen(augmentation_string) - 1; 1137 1138 if ((retval = calloc((FLDSIZE_X + 3), (FLDSIZE_Y + 2))) == NULL) 1139 return NULL; 1140 1141 /* initialize field */ 1142 memset(field, 0, FLDSIZE_X * FLDSIZE_Y * sizeof(char)); 1143 x = FLDSIZE_X / 2; 1144 y = FLDSIZE_Y / 2; 1145 1146 /* process raw key */ 1147 for (i = 0; i < dgst_raw_len; i++) { 1148 int input; 1149 /* each byte conveys four 2-bit move commands */ 1150 input = dgst_raw[i]; 1151 for (b = 0; b < 4; b++) { 1152 /* evaluate 2 bit, rest is shifted later */ 1153 x += (input & 0x1) ? 1 : -1; 1154 y += (input & 0x2) ? 1 : -1; 1155 1156 /* assure we are still in bounds */ 1157 x = MAXIMUM(x, 0); 1158 y = MAXIMUM(y, 0); 1159 x = MINIMUM(x, FLDSIZE_X - 1); 1160 y = MINIMUM(y, FLDSIZE_Y - 1); 1161 1162 /* augment the field */ 1163 if (field[x][y] < len - 2) 1164 field[x][y]++; 1165 input = input >> 2; 1166 } 1167 } 1168 1169 /* mark starting point and end point*/ 1170 field[FLDSIZE_X / 2][FLDSIZE_Y / 2] = len - 1; 1171 field[x][y] = len; 1172 1173 /* assemble title */ 1174 r = snprintf(title, sizeof(title), "[%s %u]", 1175 sshkey_type(k), sshkey_size(k)); 1176 /* If [type size] won't fit, then try [type]; fits "[ED25519-CERT]" */ 1177 if (r < 0 || r > (int)sizeof(title)) 1178 r = snprintf(title, sizeof(title), "[%s]", sshkey_type(k)); 1179 tlen = (r <= 0) ? 0 : strlen(title); 1180 1181 /* assemble hash ID. */ 1182 r = snprintf(hash, sizeof(hash), "[%s]", alg); 1183 hlen = (r <= 0) ? 0 : strlen(hash); 1184 1185 /* output upper border */ 1186 p = retval; 1187 *p++ = '+'; 1188 for (i = 0; i < (FLDSIZE_X - tlen) / 2; i++) 1189 *p++ = '-'; 1190 memcpy(p, title, tlen); 1191 p += tlen; 1192 for (i += tlen; i < FLDSIZE_X; i++) 1193 *p++ = '-'; 1194 *p++ = '+'; 1195 *p++ = '\n'; 1196 1197 /* output content */ 1198 for (y = 0; y < FLDSIZE_Y; y++) { 1199 *p++ = '|'; 1200 for (x = 0; x < FLDSIZE_X; x++) 1201 *p++ = augmentation_string[MINIMUM(field[x][y], len)]; 1202 *p++ = '|'; 1203 *p++ = '\n'; 1204 } 1205 1206 /* output lower border */ 1207 *p++ = '+'; 1208 for (i = 0; i < (FLDSIZE_X - hlen) / 2; i++) 1209 *p++ = '-'; 1210 memcpy(p, hash, hlen); 1211 p += hlen; 1212 for (i += hlen; i < FLDSIZE_X; i++) 1213 *p++ = '-'; 1214 *p++ = '+'; 1215 1216 return retval; 1217 } 1218 1219 char * 1220 sshkey_fingerprint(const struct sshkey *k, int dgst_alg, 1221 enum sshkey_fp_rep dgst_rep) 1222 { 1223 char *retval = NULL; 1224 u_char *dgst_raw; 1225 size_t dgst_raw_len; 1226 1227 if (sshkey_fingerprint_raw(k, dgst_alg, &dgst_raw, &dgst_raw_len) != 0) 1228 return NULL; 1229 switch (dgst_rep) { 1230 case SSH_FP_DEFAULT: 1231 if (dgst_alg == SSH_DIGEST_MD5) { 1232 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1233 dgst_raw, dgst_raw_len); 1234 } else { 1235 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1236 dgst_raw, dgst_raw_len); 1237 } 1238 break; 1239 case SSH_FP_HEX: 1240 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1241 dgst_raw, dgst_raw_len); 1242 break; 1243 case SSH_FP_BASE64: 1244 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1245 dgst_raw, dgst_raw_len); 1246 break; 1247 case SSH_FP_BUBBLEBABBLE: 1248 retval = fingerprint_bubblebabble(dgst_raw, dgst_raw_len); 1249 break; 1250 case SSH_FP_RANDOMART: 1251 retval = fingerprint_randomart(ssh_digest_alg_name(dgst_alg), 1252 dgst_raw, dgst_raw_len, k); 1253 break; 1254 default: 1255 freezero(dgst_raw, dgst_raw_len); 1256 return NULL; 1257 } 1258 freezero(dgst_raw, dgst_raw_len); 1259 return retval; 1260 } 1261 1262 static int 1263 peek_type_nid(const char *s, size_t l, int *nid) 1264 { 1265 const struct keytype *kt; 1266 1267 for (kt = keytypes; kt->type != -1; kt++) { 1268 if (kt->name == NULL || strlen(kt->name) != l) 1269 continue; 1270 if (memcmp(s, kt->name, l) == 0) { 1271 *nid = -1; 1272 if (key_type_is_ecdsa_variant(kt->type)) 1273 *nid = kt->nid; 1274 return kt->type; 1275 } 1276 } 1277 return KEY_UNSPEC; 1278 } 1279 1280 1281 /* XXX this can now be made const char * */ 1282 int 1283 sshkey_read(struct sshkey *ret, char **cpp) 1284 { 1285 struct sshkey *k; 1286 char *cp, *blobcopy; 1287 size_t space; 1288 int r, type, curve_nid = -1; 1289 struct sshbuf *blob; 1290 1291 if (ret == NULL) 1292 return SSH_ERR_INVALID_ARGUMENT; 1293 1294 switch (ret->type) { 1295 case KEY_UNSPEC: 1296 case KEY_RSA: 1297 case KEY_DSA: 1298 case KEY_ECDSA: 1299 case KEY_ECDSA_SK: 1300 case KEY_ED25519: 1301 case KEY_ED25519_SK: 1302 case KEY_DSA_CERT: 1303 case KEY_ECDSA_CERT: 1304 case KEY_ECDSA_SK_CERT: 1305 case KEY_RSA_CERT: 1306 case KEY_ED25519_CERT: 1307 case KEY_ED25519_SK_CERT: 1308 #ifdef WITH_XMSS 1309 case KEY_XMSS: 1310 case KEY_XMSS_CERT: 1311 #endif /* WITH_XMSS */ 1312 break; /* ok */ 1313 default: 1314 return SSH_ERR_INVALID_ARGUMENT; 1315 } 1316 1317 /* Decode type */ 1318 cp = *cpp; 1319 space = strcspn(cp, " \t"); 1320 if (space == strlen(cp)) 1321 return SSH_ERR_INVALID_FORMAT; 1322 if ((type = peek_type_nid(cp, space, &curve_nid)) == KEY_UNSPEC) 1323 return SSH_ERR_INVALID_FORMAT; 1324 1325 /* skip whitespace */ 1326 for (cp += space; *cp == ' ' || *cp == '\t'; cp++) 1327 ; 1328 if (*cp == '\0') 1329 return SSH_ERR_INVALID_FORMAT; 1330 if (ret->type != KEY_UNSPEC && ret->type != type) 1331 return SSH_ERR_KEY_TYPE_MISMATCH; 1332 if ((blob = sshbuf_new()) == NULL) 1333 return SSH_ERR_ALLOC_FAIL; 1334 1335 /* find end of keyblob and decode */ 1336 space = strcspn(cp, " \t"); 1337 if ((blobcopy = strndup(cp, space)) == NULL) { 1338 sshbuf_free(blob); 1339 return SSH_ERR_ALLOC_FAIL; 1340 } 1341 if ((r = sshbuf_b64tod(blob, blobcopy)) != 0) { 1342 free(blobcopy); 1343 sshbuf_free(blob); 1344 return r; 1345 } 1346 free(blobcopy); 1347 if ((r = sshkey_fromb(blob, &k)) != 0) { 1348 sshbuf_free(blob); 1349 return r; 1350 } 1351 sshbuf_free(blob); 1352 1353 /* skip whitespace and leave cp at start of comment */ 1354 for (cp += space; *cp == ' ' || *cp == '\t'; cp++) 1355 ; 1356 1357 /* ensure type of blob matches type at start of line */ 1358 if (k->type != type) { 1359 sshkey_free(k); 1360 return SSH_ERR_KEY_TYPE_MISMATCH; 1361 } 1362 if (key_type_is_ecdsa_variant(type) && curve_nid != k->ecdsa_nid) { 1363 sshkey_free(k); 1364 return SSH_ERR_EC_CURVE_MISMATCH; 1365 } 1366 1367 /* Fill in ret from parsed key */ 1368 ret->type = type; 1369 if (sshkey_is_cert(ret)) { 1370 if (!sshkey_is_cert(k)) { 1371 sshkey_free(k); 1372 return SSH_ERR_EXPECTED_CERT; 1373 } 1374 if (ret->cert != NULL) 1375 cert_free(ret->cert); 1376 ret->cert = k->cert; 1377 k->cert = NULL; 1378 } 1379 switch (sshkey_type_plain(ret->type)) { 1380 #ifdef WITH_OPENSSL 1381 case KEY_RSA: 1382 RSA_free(ret->rsa); 1383 ret->rsa = k->rsa; 1384 k->rsa = NULL; 1385 #ifdef DEBUG_PK 1386 RSA_print_fp(stderr, ret->rsa, 8); 1387 #endif 1388 break; 1389 case KEY_DSA: 1390 DSA_free(ret->dsa); 1391 ret->dsa = k->dsa; 1392 k->dsa = NULL; 1393 #ifdef DEBUG_PK 1394 DSA_print_fp(stderr, ret->dsa, 8); 1395 #endif 1396 break; 1397 case KEY_ECDSA: 1398 EC_KEY_free(ret->ecdsa); 1399 ret->ecdsa = k->ecdsa; 1400 ret->ecdsa_nid = k->ecdsa_nid; 1401 k->ecdsa = NULL; 1402 k->ecdsa_nid = -1; 1403 #ifdef DEBUG_PK 1404 sshkey_dump_ec_key(ret->ecdsa); 1405 #endif 1406 break; 1407 case KEY_ECDSA_SK: 1408 EC_KEY_free(ret->ecdsa); 1409 ret->ecdsa = k->ecdsa; 1410 ret->ecdsa_nid = k->ecdsa_nid; 1411 ret->sk_application = k->sk_application; 1412 k->ecdsa = NULL; 1413 k->ecdsa_nid = -1; 1414 k->sk_application = NULL; 1415 #ifdef DEBUG_PK 1416 sshkey_dump_ec_key(ret->ecdsa); 1417 fprintf(stderr, "App: %s\n", ret->sk_application); 1418 #endif 1419 break; 1420 #endif /* WITH_OPENSSL */ 1421 case KEY_ED25519: 1422 freezero(ret->ed25519_pk, ED25519_PK_SZ); 1423 ret->ed25519_pk = k->ed25519_pk; 1424 k->ed25519_pk = NULL; 1425 #ifdef DEBUG_PK 1426 /* XXX */ 1427 #endif 1428 break; 1429 case KEY_ED25519_SK: 1430 freezero(ret->ed25519_pk, ED25519_PK_SZ); 1431 ret->ed25519_pk = k->ed25519_pk; 1432 ret->sk_application = k->sk_application; 1433 k->ed25519_pk = NULL; 1434 k->sk_application = NULL; 1435 break; 1436 #ifdef WITH_XMSS 1437 case KEY_XMSS: 1438 free(ret->xmss_pk); 1439 ret->xmss_pk = k->xmss_pk; 1440 k->xmss_pk = NULL; 1441 free(ret->xmss_state); 1442 ret->xmss_state = k->xmss_state; 1443 k->xmss_state = NULL; 1444 free(ret->xmss_name); 1445 ret->xmss_name = k->xmss_name; 1446 k->xmss_name = NULL; 1447 free(ret->xmss_filename); 1448 ret->xmss_filename = k->xmss_filename; 1449 k->xmss_filename = NULL; 1450 #ifdef DEBUG_PK 1451 /* XXX */ 1452 #endif 1453 break; 1454 #endif /* WITH_XMSS */ 1455 default: 1456 sshkey_free(k); 1457 return SSH_ERR_INTERNAL_ERROR; 1458 } 1459 sshkey_free(k); 1460 1461 /* success */ 1462 *cpp = cp; 1463 return 0; 1464 } 1465 1466 int 1467 sshkey_to_base64(const struct sshkey *key, char **b64p) 1468 { 1469 int r = SSH_ERR_INTERNAL_ERROR; 1470 struct sshbuf *b = NULL; 1471 char *uu = NULL; 1472 1473 if (b64p != NULL) 1474 *b64p = NULL; 1475 if ((b = sshbuf_new()) == NULL) 1476 return SSH_ERR_ALLOC_FAIL; 1477 if ((r = sshkey_putb(key, b)) != 0) 1478 goto out; 1479 if ((uu = sshbuf_dtob64_string(b, 0)) == NULL) { 1480 r = SSH_ERR_ALLOC_FAIL; 1481 goto out; 1482 } 1483 /* Success */ 1484 if (b64p != NULL) { 1485 *b64p = uu; 1486 uu = NULL; 1487 } 1488 r = 0; 1489 out: 1490 sshbuf_free(b); 1491 free(uu); 1492 return r; 1493 } 1494 1495 int 1496 sshkey_format_text(const struct sshkey *key, struct sshbuf *b) 1497 { 1498 int r = SSH_ERR_INTERNAL_ERROR; 1499 char *uu = NULL; 1500 1501 if ((r = sshkey_to_base64(key, &uu)) != 0) 1502 goto out; 1503 if ((r = sshbuf_putf(b, "%s %s", 1504 sshkey_ssh_name(key), uu)) != 0) 1505 goto out; 1506 r = 0; 1507 out: 1508 free(uu); 1509 return r; 1510 } 1511 1512 int 1513 sshkey_write(const struct sshkey *key, FILE *f) 1514 { 1515 struct sshbuf *b = NULL; 1516 int r = SSH_ERR_INTERNAL_ERROR; 1517 1518 if ((b = sshbuf_new()) == NULL) 1519 return SSH_ERR_ALLOC_FAIL; 1520 if ((r = sshkey_format_text(key, b)) != 0) 1521 goto out; 1522 if (fwrite(sshbuf_ptr(b), sshbuf_len(b), 1, f) != 1) { 1523 if (feof(f)) 1524 errno = EPIPE; 1525 r = SSH_ERR_SYSTEM_ERROR; 1526 goto out; 1527 } 1528 /* Success */ 1529 r = 0; 1530 out: 1531 sshbuf_free(b); 1532 return r; 1533 } 1534 1535 const char * 1536 sshkey_cert_type(const struct sshkey *k) 1537 { 1538 switch (k->cert->type) { 1539 case SSH2_CERT_TYPE_USER: 1540 return "user"; 1541 case SSH2_CERT_TYPE_HOST: 1542 return "host"; 1543 default: 1544 return "unknown"; 1545 } 1546 } 1547 1548 #ifdef WITH_OPENSSL 1549 static int 1550 rsa_generate_private_key(u_int bits, RSA **rsap) 1551 { 1552 RSA *private = NULL; 1553 BIGNUM *f4 = NULL; 1554 int ret = SSH_ERR_INTERNAL_ERROR; 1555 1556 if (rsap == NULL) 1557 return SSH_ERR_INVALID_ARGUMENT; 1558 if (bits < SSH_RSA_MINIMUM_MODULUS_SIZE || 1559 bits > SSHBUF_MAX_BIGNUM * 8) 1560 return SSH_ERR_KEY_LENGTH; 1561 *rsap = NULL; 1562 if ((private = RSA_new()) == NULL || (f4 = BN_new()) == NULL) { 1563 ret = SSH_ERR_ALLOC_FAIL; 1564 goto out; 1565 } 1566 if (!BN_set_word(f4, RSA_F4) || 1567 !RSA_generate_key_ex(private, bits, f4, NULL)) { 1568 ret = SSH_ERR_LIBCRYPTO_ERROR; 1569 goto out; 1570 } 1571 *rsap = private; 1572 private = NULL; 1573 ret = 0; 1574 out: 1575 RSA_free(private); 1576 BN_free(f4); 1577 return ret; 1578 } 1579 1580 static int 1581 dsa_generate_private_key(u_int bits, DSA **dsap) 1582 { 1583 DSA *private; 1584 int ret = SSH_ERR_INTERNAL_ERROR; 1585 1586 if (dsap == NULL) 1587 return SSH_ERR_INVALID_ARGUMENT; 1588 if (bits != 1024) 1589 return SSH_ERR_KEY_LENGTH; 1590 if ((private = DSA_new()) == NULL) { 1591 ret = SSH_ERR_ALLOC_FAIL; 1592 goto out; 1593 } 1594 *dsap = NULL; 1595 if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL, 1596 NULL, NULL) || !DSA_generate_key(private)) { 1597 ret = SSH_ERR_LIBCRYPTO_ERROR; 1598 goto out; 1599 } 1600 *dsap = private; 1601 private = NULL; 1602 ret = 0; 1603 out: 1604 DSA_free(private); 1605 return ret; 1606 } 1607 1608 int 1609 sshkey_ecdsa_key_to_nid(EC_KEY *k) 1610 { 1611 EC_GROUP *eg = NULL; /* XXXGCC: unneeded init */ 1612 int nids[] = { 1613 NID_X9_62_prime256v1, 1614 NID_secp384r1, 1615 NID_secp521r1, 1616 -1 1617 }; 1618 int nid; 1619 u_int i; 1620 const EC_GROUP *g = EC_KEY_get0_group(k); 1621 1622 /* 1623 * The group may be stored in a ASN.1 encoded private key in one of two 1624 * ways: as a "named group", which is reconstituted by ASN.1 object ID 1625 * or explicit group parameters encoded into the key blob. Only the 1626 * "named group" case sets the group NID for us, but we can figure 1627 * it out for the other case by comparing against all the groups that 1628 * are supported. 1629 */ 1630 if ((nid = EC_GROUP_get_curve_name(g)) > 0) 1631 return nid; 1632 for (i = 0; nids[i] != -1; i++) { 1633 if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL) 1634 return -1; 1635 if (EC_GROUP_cmp(g, eg, NULL) == 0) 1636 break; 1637 EC_GROUP_free(eg); 1638 } 1639 if (nids[i] != -1) { 1640 /* Use the group with the NID attached */ 1641 EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE); 1642 if (EC_KEY_set_group(k, eg) != 1) { 1643 EC_GROUP_free(eg); 1644 return -1; 1645 } 1646 } 1647 return nids[i]; 1648 } 1649 1650 static int 1651 ecdsa_generate_private_key(u_int bits, int *nid, EC_KEY **ecdsap) 1652 { 1653 EC_KEY *private; 1654 int ret = SSH_ERR_INTERNAL_ERROR; 1655 1656 if (nid == NULL || ecdsap == NULL) 1657 return SSH_ERR_INVALID_ARGUMENT; 1658 if ((*nid = sshkey_ecdsa_bits_to_nid(bits)) == -1) 1659 return SSH_ERR_KEY_LENGTH; 1660 *ecdsap = NULL; 1661 if ((private = EC_KEY_new_by_curve_name(*nid)) == NULL) { 1662 ret = SSH_ERR_ALLOC_FAIL; 1663 goto out; 1664 } 1665 if (EC_KEY_generate_key(private) != 1) { 1666 ret = SSH_ERR_LIBCRYPTO_ERROR; 1667 goto out; 1668 } 1669 EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE); 1670 *ecdsap = private; 1671 private = NULL; 1672 ret = 0; 1673 out: 1674 EC_KEY_free(private); 1675 return ret; 1676 } 1677 #endif /* WITH_OPENSSL */ 1678 1679 int 1680 sshkey_generate(int type, u_int bits, struct sshkey **keyp) 1681 { 1682 struct sshkey *k; 1683 int ret = SSH_ERR_INTERNAL_ERROR; 1684 1685 if (keyp == NULL) 1686 return SSH_ERR_INVALID_ARGUMENT; 1687 *keyp = NULL; 1688 if ((k = sshkey_new(KEY_UNSPEC)) == NULL) 1689 return SSH_ERR_ALLOC_FAIL; 1690 switch (type) { 1691 case KEY_ED25519: 1692 if ((k->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL || 1693 (k->ed25519_sk = malloc(ED25519_SK_SZ)) == NULL) { 1694 ret = SSH_ERR_ALLOC_FAIL; 1695 break; 1696 } 1697 crypto_sign_ed25519_keypair(k->ed25519_pk, k->ed25519_sk); 1698 ret = 0; 1699 break; 1700 #ifdef WITH_XMSS 1701 case KEY_XMSS: 1702 ret = sshkey_xmss_generate_private_key(k, bits); 1703 break; 1704 #endif /* WITH_XMSS */ 1705 #ifdef WITH_OPENSSL 1706 case KEY_DSA: 1707 ret = dsa_generate_private_key(bits, &k->dsa); 1708 break; 1709 case KEY_ECDSA: 1710 ret = ecdsa_generate_private_key(bits, &k->ecdsa_nid, 1711 &k->ecdsa); 1712 break; 1713 case KEY_RSA: 1714 ret = rsa_generate_private_key(bits, &k->rsa); 1715 break; 1716 #endif /* WITH_OPENSSL */ 1717 default: 1718 ret = SSH_ERR_INVALID_ARGUMENT; 1719 } 1720 if (ret == 0) { 1721 k->type = type; 1722 *keyp = k; 1723 } else 1724 sshkey_free(k); 1725 return ret; 1726 } 1727 1728 int 1729 sshkey_cert_copy(const struct sshkey *from_key, struct sshkey *to_key) 1730 { 1731 u_int i; 1732 const struct sshkey_cert *from; 1733 struct sshkey_cert *to; 1734 int r = SSH_ERR_INTERNAL_ERROR; 1735 1736 if (to_key == NULL || (from = from_key->cert) == NULL) 1737 return SSH_ERR_INVALID_ARGUMENT; 1738 1739 if ((to = cert_new()) == NULL) 1740 return SSH_ERR_ALLOC_FAIL; 1741 1742 if ((r = sshbuf_putb(to->certblob, from->certblob)) != 0 || 1743 (r = sshbuf_putb(to->critical, from->critical)) != 0 || 1744 (r = sshbuf_putb(to->extensions, from->extensions)) != 0) 1745 goto out; 1746 1747 to->serial = from->serial; 1748 to->type = from->type; 1749 if (from->key_id == NULL) 1750 to->key_id = NULL; 1751 else if ((to->key_id = strdup(from->key_id)) == NULL) { 1752 r = SSH_ERR_ALLOC_FAIL; 1753 goto out; 1754 } 1755 to->valid_after = from->valid_after; 1756 to->valid_before = from->valid_before; 1757 if (from->signature_key == NULL) 1758 to->signature_key = NULL; 1759 else if ((r = sshkey_from_private(from->signature_key, 1760 &to->signature_key)) != 0) 1761 goto out; 1762 if (from->signature_type != NULL && 1763 (to->signature_type = strdup(from->signature_type)) == NULL) { 1764 r = SSH_ERR_ALLOC_FAIL; 1765 goto out; 1766 } 1767 if (from->nprincipals > SSHKEY_CERT_MAX_PRINCIPALS) { 1768 r = SSH_ERR_INVALID_ARGUMENT; 1769 goto out; 1770 } 1771 if (from->nprincipals > 0) { 1772 if ((to->principals = calloc(from->nprincipals, 1773 sizeof(*to->principals))) == NULL) { 1774 r = SSH_ERR_ALLOC_FAIL; 1775 goto out; 1776 } 1777 for (i = 0; i < from->nprincipals; i++) { 1778 to->principals[i] = strdup(from->principals[i]); 1779 if (to->principals[i] == NULL) { 1780 to->nprincipals = i; 1781 r = SSH_ERR_ALLOC_FAIL; 1782 goto out; 1783 } 1784 } 1785 } 1786 to->nprincipals = from->nprincipals; 1787 1788 /* success */ 1789 cert_free(to_key->cert); 1790 to_key->cert = to; 1791 to = NULL; 1792 r = 0; 1793 out: 1794 cert_free(to); 1795 return r; 1796 } 1797 1798 int 1799 sshkey_from_private(const struct sshkey *k, struct sshkey **pkp) 1800 { 1801 struct sshkey *n = NULL; 1802 int r = SSH_ERR_INTERNAL_ERROR; 1803 #ifdef WITH_OPENSSL 1804 const BIGNUM *rsa_n, *rsa_e; 1805 BIGNUM *rsa_n_dup = NULL, *rsa_e_dup = NULL; 1806 const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key; 1807 BIGNUM *dsa_p_dup = NULL, *dsa_q_dup = NULL, *dsa_g_dup = NULL; 1808 BIGNUM *dsa_pub_key_dup = NULL; 1809 #endif /* WITH_OPENSSL */ 1810 1811 *pkp = NULL; 1812 if ((n = sshkey_new(k->type)) == NULL) { 1813 r = SSH_ERR_ALLOC_FAIL; 1814 goto out; 1815 } 1816 switch (k->type) { 1817 #ifdef WITH_OPENSSL 1818 case KEY_DSA: 1819 case KEY_DSA_CERT: 1820 DSA_get0_pqg(k->dsa, &dsa_p, &dsa_q, &dsa_g); 1821 DSA_get0_key(k->dsa, &dsa_pub_key, NULL); 1822 if ((dsa_p_dup = BN_dup(dsa_p)) == NULL || 1823 (dsa_q_dup = BN_dup(dsa_q)) == NULL || 1824 (dsa_g_dup = BN_dup(dsa_g)) == NULL || 1825 (dsa_pub_key_dup = BN_dup(dsa_pub_key)) == NULL) { 1826 r = SSH_ERR_ALLOC_FAIL; 1827 goto out; 1828 } 1829 if (!DSA_set0_pqg(n->dsa, dsa_p_dup, dsa_q_dup, dsa_g_dup)) { 1830 r = SSH_ERR_LIBCRYPTO_ERROR; 1831 goto out; 1832 } 1833 dsa_p_dup = dsa_q_dup = dsa_g_dup = NULL; /* transferred */ 1834 if (!DSA_set0_key(n->dsa, dsa_pub_key_dup, NULL)) { 1835 r = SSH_ERR_LIBCRYPTO_ERROR; 1836 goto out; 1837 } 1838 dsa_pub_key_dup = NULL; /* transferred */ 1839 1840 break; 1841 case KEY_ECDSA: 1842 case KEY_ECDSA_CERT: 1843 case KEY_ECDSA_SK: 1844 case KEY_ECDSA_SK_CERT: 1845 n->ecdsa_nid = k->ecdsa_nid; 1846 n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 1847 if (n->ecdsa == NULL) { 1848 r = SSH_ERR_ALLOC_FAIL; 1849 goto out; 1850 } 1851 if (EC_KEY_set_public_key(n->ecdsa, 1852 EC_KEY_get0_public_key(k->ecdsa)) != 1) { 1853 r = SSH_ERR_LIBCRYPTO_ERROR; 1854 goto out; 1855 } 1856 if (k->type != KEY_ECDSA_SK && k->type != KEY_ECDSA_SK_CERT) 1857 break; 1858 /* Append security-key application string */ 1859 if ((n->sk_application = strdup(k->sk_application)) == NULL) 1860 goto out; 1861 break; 1862 case KEY_RSA: 1863 case KEY_RSA_CERT: 1864 RSA_get0_key(k->rsa, &rsa_n, &rsa_e, NULL); 1865 if ((rsa_n_dup = BN_dup(rsa_n)) == NULL || 1866 (rsa_e_dup = BN_dup(rsa_e)) == NULL) { 1867 r = SSH_ERR_ALLOC_FAIL; 1868 goto out; 1869 } 1870 if (!RSA_set0_key(n->rsa, rsa_n_dup, rsa_e_dup, NULL)) { 1871 r = SSH_ERR_LIBCRYPTO_ERROR; 1872 goto out; 1873 } 1874 rsa_n_dup = rsa_e_dup = NULL; /* transferred */ 1875 break; 1876 #endif /* WITH_OPENSSL */ 1877 case KEY_ED25519: 1878 case KEY_ED25519_CERT: 1879 case KEY_ED25519_SK: 1880 case KEY_ED25519_SK_CERT: 1881 if (k->ed25519_pk != NULL) { 1882 if ((n->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) { 1883 r = SSH_ERR_ALLOC_FAIL; 1884 goto out; 1885 } 1886 memcpy(n->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ); 1887 } 1888 if (k->type != KEY_ED25519_SK && 1889 k->type != KEY_ED25519_SK_CERT) 1890 break; 1891 /* Append security-key application string */ 1892 if ((n->sk_application = strdup(k->sk_application)) == NULL) 1893 goto out; 1894 break; 1895 #ifdef WITH_XMSS 1896 case KEY_XMSS: 1897 case KEY_XMSS_CERT: 1898 if ((r = sshkey_xmss_init(n, k->xmss_name)) != 0) 1899 goto out; 1900 if (k->xmss_pk != NULL) { 1901 u_int32_t left; 1902 size_t pklen = sshkey_xmss_pklen(k); 1903 if (pklen == 0 || sshkey_xmss_pklen(n) != pklen) { 1904 r = SSH_ERR_INTERNAL_ERROR; 1905 goto out; 1906 } 1907 if ((n->xmss_pk = malloc(pklen)) == NULL) { 1908 r = SSH_ERR_ALLOC_FAIL; 1909 goto out; 1910 } 1911 memcpy(n->xmss_pk, k->xmss_pk, pklen); 1912 /* simulate number of signatures left on pubkey */ 1913 left = sshkey_xmss_signatures_left(k); 1914 if (left) 1915 sshkey_xmss_enable_maxsign(n, left); 1916 } 1917 break; 1918 #endif /* WITH_XMSS */ 1919 default: 1920 r = SSH_ERR_KEY_TYPE_UNKNOWN; 1921 goto out; 1922 } 1923 if (sshkey_is_cert(k) && (r = sshkey_cert_copy(k, n)) != 0) 1924 goto out; 1925 /* success */ 1926 *pkp = n; 1927 n = NULL; 1928 r = 0; 1929 out: 1930 sshkey_free(n); 1931 #ifdef WITH_OPENSSL 1932 BN_clear_free(rsa_n_dup); 1933 BN_clear_free(rsa_e_dup); 1934 BN_clear_free(dsa_p_dup); 1935 BN_clear_free(dsa_q_dup); 1936 BN_clear_free(dsa_g_dup); 1937 BN_clear_free(dsa_pub_key_dup); 1938 #endif /* WITH_OPENSSL */ 1939 1940 return r; 1941 } 1942 1943 int 1944 sshkey_is_shielded(struct sshkey *k) 1945 { 1946 return k != NULL && k->shielded_private != NULL; 1947 } 1948 1949 int 1950 sshkey_shield_private(struct sshkey *k) 1951 { 1952 struct sshbuf *prvbuf = NULL; 1953 u_char *prekey = NULL, *enc = NULL, keyiv[SSH_DIGEST_MAX_LENGTH]; 1954 struct sshcipher_ctx *cctx = NULL; 1955 const struct sshcipher *cipher; 1956 size_t i, enclen = 0; 1957 struct sshkey *kswap = NULL, tmp; 1958 int r = SSH_ERR_INTERNAL_ERROR; 1959 1960 #ifdef DEBUG_PK 1961 fprintf(stderr, "%s: entering for %s\n", __func__, sshkey_ssh_name(k)); 1962 #endif 1963 if ((cipher = cipher_by_name(SSHKEY_SHIELD_CIPHER)) == NULL) { 1964 r = SSH_ERR_INVALID_ARGUMENT; 1965 goto out; 1966 } 1967 if (cipher_keylen(cipher) + cipher_ivlen(cipher) > 1968 ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH)) { 1969 r = SSH_ERR_INTERNAL_ERROR; 1970 goto out; 1971 } 1972 1973 /* Prepare a random pre-key, and from it an ephemeral key */ 1974 if ((prekey = malloc(SSHKEY_SHIELD_PREKEY_LEN)) == NULL) { 1975 r = SSH_ERR_ALLOC_FAIL; 1976 goto out; 1977 } 1978 arc4random_buf(prekey, SSHKEY_SHIELD_PREKEY_LEN); 1979 if ((r = ssh_digest_memory(SSHKEY_SHIELD_PREKEY_HASH, 1980 prekey, SSHKEY_SHIELD_PREKEY_LEN, 1981 keyiv, SSH_DIGEST_MAX_LENGTH)) != 0) 1982 goto out; 1983 #ifdef DEBUG_PK 1984 fprintf(stderr, "%s: key+iv\n", __func__); 1985 sshbuf_dump_data(keyiv, ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH), 1986 stderr); 1987 #endif 1988 if ((r = cipher_init(&cctx, cipher, keyiv, cipher_keylen(cipher), 1989 keyiv + cipher_keylen(cipher), cipher_ivlen(cipher), 1)) != 0) 1990 goto out; 1991 1992 /* Serialise and encrypt the private key using the ephemeral key */ 1993 if ((prvbuf = sshbuf_new()) == NULL) { 1994 r = SSH_ERR_ALLOC_FAIL; 1995 goto out; 1996 } 1997 if (sshkey_is_shielded(k) && (r = sshkey_unshield_private(k)) != 0) 1998 goto out; 1999 if ((r = sshkey_private_serialize_opt(k, prvbuf, 2000 SSHKEY_SERIALIZE_SHIELD)) != 0) 2001 goto out; 2002 /* pad to cipher blocksize */ 2003 i = 0; 2004 while (sshbuf_len(prvbuf) % cipher_blocksize(cipher)) { 2005 if ((r = sshbuf_put_u8(prvbuf, ++i & 0xff)) != 0) 2006 goto out; 2007 } 2008 #ifdef DEBUG_PK 2009 fprintf(stderr, "%s: serialised\n", __func__); 2010 sshbuf_dump(prvbuf, stderr); 2011 #endif 2012 /* encrypt */ 2013 enclen = sshbuf_len(prvbuf); 2014 if ((enc = malloc(enclen)) == NULL) { 2015 r = SSH_ERR_ALLOC_FAIL; 2016 goto out; 2017 } 2018 if ((r = cipher_crypt(cctx, 0, enc, 2019 sshbuf_ptr(prvbuf), sshbuf_len(prvbuf), 0, 0)) != 0) 2020 goto out; 2021 #ifdef DEBUG_PK 2022 fprintf(stderr, "%s: encrypted\n", __func__); 2023 sshbuf_dump_data(enc, enclen, stderr); 2024 #endif 2025 2026 /* Make a scrubbed, public-only copy of our private key argument */ 2027 if ((r = sshkey_from_private(k, &kswap)) != 0) 2028 goto out; 2029 2030 /* Swap the private key out (it will be destroyed below) */ 2031 tmp = *kswap; 2032 *kswap = *k; 2033 *k = tmp; 2034 2035 /* Insert the shielded key into our argument */ 2036 k->shielded_private = enc; 2037 k->shielded_len = enclen; 2038 k->shield_prekey = prekey; 2039 k->shield_prekey_len = SSHKEY_SHIELD_PREKEY_LEN; 2040 enc = prekey = NULL; /* transferred */ 2041 enclen = 0; 2042 2043 /* preserve key fields that are required for correct operation */ 2044 k->sk_flags = kswap->sk_flags; 2045 2046 /* success */ 2047 r = 0; 2048 2049 out: 2050 /* XXX behaviour on error - invalidate original private key? */ 2051 cipher_free(cctx); 2052 explicit_bzero(keyiv, sizeof(keyiv)); 2053 explicit_bzero(&tmp, sizeof(tmp)); 2054 freezero(enc, enclen); 2055 freezero(prekey, SSHKEY_SHIELD_PREKEY_LEN); 2056 sshkey_free(kswap); 2057 sshbuf_free(prvbuf); 2058 return r; 2059 } 2060 2061 int 2062 sshkey_unshield_private(struct sshkey *k) 2063 { 2064 struct sshbuf *prvbuf = NULL; 2065 u_char pad, *cp, keyiv[SSH_DIGEST_MAX_LENGTH]; 2066 struct sshcipher_ctx *cctx = NULL; 2067 const struct sshcipher *cipher; 2068 size_t i; 2069 struct sshkey *kswap = NULL, tmp; 2070 int r = SSH_ERR_INTERNAL_ERROR; 2071 2072 #ifdef DEBUG_PK 2073 fprintf(stderr, "%s: entering for %s\n", __func__, sshkey_ssh_name(k)); 2074 #endif 2075 if (!sshkey_is_shielded(k)) 2076 return 0; /* nothing to do */ 2077 2078 if ((cipher = cipher_by_name(SSHKEY_SHIELD_CIPHER)) == NULL) { 2079 r = SSH_ERR_INVALID_ARGUMENT; 2080 goto out; 2081 } 2082 if (cipher_keylen(cipher) + cipher_ivlen(cipher) > 2083 ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH)) { 2084 r = SSH_ERR_INTERNAL_ERROR; 2085 goto out; 2086 } 2087 /* check size of shielded key blob */ 2088 if (k->shielded_len < cipher_blocksize(cipher) || 2089 (k->shielded_len % cipher_blocksize(cipher)) != 0) { 2090 r = SSH_ERR_INVALID_FORMAT; 2091 goto out; 2092 } 2093 2094 /* Calculate the ephemeral key from the prekey */ 2095 if ((r = ssh_digest_memory(SSHKEY_SHIELD_PREKEY_HASH, 2096 k->shield_prekey, k->shield_prekey_len, 2097 keyiv, SSH_DIGEST_MAX_LENGTH)) != 0) 2098 goto out; 2099 if ((r = cipher_init(&cctx, cipher, keyiv, cipher_keylen(cipher), 2100 keyiv + cipher_keylen(cipher), cipher_ivlen(cipher), 0)) != 0) 2101 goto out; 2102 #ifdef DEBUG_PK 2103 fprintf(stderr, "%s: key+iv\n", __func__); 2104 sshbuf_dump_data(keyiv, ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH), 2105 stderr); 2106 #endif 2107 2108 /* Decrypt and parse the shielded private key using the ephemeral key */ 2109 if ((prvbuf = sshbuf_new()) == NULL) { 2110 r = SSH_ERR_ALLOC_FAIL; 2111 goto out; 2112 } 2113 if ((r = sshbuf_reserve(prvbuf, k->shielded_len, &cp)) != 0) 2114 goto out; 2115 /* decrypt */ 2116 #ifdef DEBUG_PK 2117 fprintf(stderr, "%s: encrypted\n", __func__); 2118 sshbuf_dump_data(k->shielded_private, k->shielded_len, stderr); 2119 #endif 2120 if ((r = cipher_crypt(cctx, 0, cp, 2121 k->shielded_private, k->shielded_len, 0, 0)) != 0) 2122 goto out; 2123 #ifdef DEBUG_PK 2124 fprintf(stderr, "%s: serialised\n", __func__); 2125 sshbuf_dump(prvbuf, stderr); 2126 #endif 2127 /* Parse private key */ 2128 if ((r = sshkey_private_deserialize(prvbuf, &kswap)) != 0) 2129 goto out; 2130 /* Check deterministic padding */ 2131 i = 0; 2132 while (sshbuf_len(prvbuf)) { 2133 if ((r = sshbuf_get_u8(prvbuf, &pad)) != 0) 2134 goto out; 2135 if (pad != (++i & 0xff)) { 2136 r = SSH_ERR_INVALID_FORMAT; 2137 goto out; 2138 } 2139 } 2140 2141 /* Swap the parsed key back into place */ 2142 tmp = *kswap; 2143 *kswap = *k; 2144 *k = tmp; 2145 2146 /* success */ 2147 r = 0; 2148 2149 out: 2150 cipher_free(cctx); 2151 explicit_bzero(keyiv, sizeof(keyiv)); 2152 explicit_bzero(&tmp, sizeof(tmp)); 2153 sshkey_free(kswap); 2154 sshbuf_free(prvbuf); 2155 return r; 2156 } 2157 2158 static int 2159 cert_parse(struct sshbuf *b, struct sshkey *key, struct sshbuf *certbuf) 2160 { 2161 struct sshbuf *principals = NULL, *crit = NULL; 2162 struct sshbuf *exts = NULL, *ca = NULL; 2163 u_char *sig = NULL; 2164 size_t signed_len = 0, slen = 0, kidlen = 0; 2165 int ret = SSH_ERR_INTERNAL_ERROR; 2166 2167 /* Copy the entire key blob for verification and later serialisation */ 2168 if ((ret = sshbuf_putb(key->cert->certblob, certbuf)) != 0) 2169 return ret; 2170 2171 /* Parse body of certificate up to signature */ 2172 if ((ret = sshbuf_get_u64(b, &key->cert->serial)) != 0 || 2173 (ret = sshbuf_get_u32(b, &key->cert->type)) != 0 || 2174 (ret = sshbuf_get_cstring(b, &key->cert->key_id, &kidlen)) != 0 || 2175 (ret = sshbuf_froms(b, &principals)) != 0 || 2176 (ret = sshbuf_get_u64(b, &key->cert->valid_after)) != 0 || 2177 (ret = sshbuf_get_u64(b, &key->cert->valid_before)) != 0 || 2178 (ret = sshbuf_froms(b, &crit)) != 0 || 2179 (ret = sshbuf_froms(b, &exts)) != 0 || 2180 (ret = sshbuf_get_string_direct(b, NULL, NULL)) != 0 || 2181 (ret = sshbuf_froms(b, &ca)) != 0) { 2182 /* XXX debug print error for ret */ 2183 ret = SSH_ERR_INVALID_FORMAT; 2184 goto out; 2185 } 2186 2187 /* Signature is left in the buffer so we can calculate this length */ 2188 signed_len = sshbuf_len(key->cert->certblob) - sshbuf_len(b); 2189 2190 if ((ret = sshbuf_get_string(b, &sig, &slen)) != 0) { 2191 ret = SSH_ERR_INVALID_FORMAT; 2192 goto out; 2193 } 2194 2195 if (key->cert->type != SSH2_CERT_TYPE_USER && 2196 key->cert->type != SSH2_CERT_TYPE_HOST) { 2197 ret = SSH_ERR_KEY_CERT_UNKNOWN_TYPE; 2198 goto out; 2199 } 2200 2201 /* Parse principals section */ 2202 while (sshbuf_len(principals) > 0) { 2203 char *principal = NULL; 2204 char **oprincipals = NULL; 2205 2206 if (key->cert->nprincipals >= SSHKEY_CERT_MAX_PRINCIPALS) { 2207 ret = SSH_ERR_INVALID_FORMAT; 2208 goto out; 2209 } 2210 if ((ret = sshbuf_get_cstring(principals, &principal, 2211 NULL)) != 0) { 2212 ret = SSH_ERR_INVALID_FORMAT; 2213 goto out; 2214 } 2215 oprincipals = key->cert->principals; 2216 key->cert->principals = recallocarray(key->cert->principals, 2217 key->cert->nprincipals, key->cert->nprincipals + 1, 2218 sizeof(*key->cert->principals)); 2219 if (key->cert->principals == NULL) { 2220 free(principal); 2221 key->cert->principals = oprincipals; 2222 ret = SSH_ERR_ALLOC_FAIL; 2223 goto out; 2224 } 2225 key->cert->principals[key->cert->nprincipals++] = principal; 2226 } 2227 2228 /* 2229 * Stash a copies of the critical options and extensions sections 2230 * for later use. 2231 */ 2232 if ((ret = sshbuf_putb(key->cert->critical, crit)) != 0 || 2233 (exts != NULL && 2234 (ret = sshbuf_putb(key->cert->extensions, exts)) != 0)) 2235 goto out; 2236 2237 /* 2238 * Validate critical options and extensions sections format. 2239 */ 2240 while (sshbuf_len(crit) != 0) { 2241 if ((ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0 || 2242 (ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0) { 2243 sshbuf_reset(key->cert->critical); 2244 ret = SSH_ERR_INVALID_FORMAT; 2245 goto out; 2246 } 2247 } 2248 while (exts != NULL && sshbuf_len(exts) != 0) { 2249 if ((ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0 || 2250 (ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0) { 2251 sshbuf_reset(key->cert->extensions); 2252 ret = SSH_ERR_INVALID_FORMAT; 2253 goto out; 2254 } 2255 } 2256 2257 /* Parse CA key and check signature */ 2258 if (sshkey_from_blob_internal(ca, &key->cert->signature_key, 0) != 0) { 2259 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2260 goto out; 2261 } 2262 if (!sshkey_type_is_valid_ca(key->cert->signature_key->type)) { 2263 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2264 goto out; 2265 } 2266 if ((ret = sshkey_verify(key->cert->signature_key, sig, slen, 2267 sshbuf_ptr(key->cert->certblob), signed_len, NULL, 0, NULL)) != 0) 2268 goto out; 2269 if ((ret = sshkey_get_sigtype(sig, slen, 2270 &key->cert->signature_type)) != 0) 2271 goto out; 2272 2273 /* Success */ 2274 ret = 0; 2275 out: 2276 sshbuf_free(ca); 2277 sshbuf_free(crit); 2278 sshbuf_free(exts); 2279 sshbuf_free(principals); 2280 free(sig); 2281 return ret; 2282 } 2283 2284 #ifdef WITH_OPENSSL 2285 static int 2286 check_rsa_length(const RSA *rsa) 2287 { 2288 const BIGNUM *rsa_n; 2289 2290 RSA_get0_key(rsa, &rsa_n, NULL, NULL); 2291 if (BN_num_bits(rsa_n) < SSH_RSA_MINIMUM_MODULUS_SIZE) 2292 return SSH_ERR_KEY_LENGTH; 2293 return 0; 2294 } 2295 #endif /* WITH_OPENSSL */ 2296 2297 static int 2298 sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp, 2299 int allow_cert) 2300 { 2301 int type, ret = SSH_ERR_INTERNAL_ERROR; 2302 char *ktype = NULL, *curve = NULL, *xmss_name = NULL; 2303 struct sshkey *key = NULL; 2304 size_t len; 2305 u_char *pk = NULL; 2306 struct sshbuf *copy; 2307 #ifdef WITH_OPENSSL 2308 EC_POINT *q = NULL, *qq = NULL; 2309 BIGNUM *rsa_n = NULL, *rsa_e = NULL; 2310 BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL, *dsa_pub_key = NULL; 2311 #endif /* WITH_OPENSSL */ 2312 2313 #ifdef DEBUG_PK /* XXX */ 2314 sshbuf_dump(b, stderr); 2315 #endif 2316 if (keyp != NULL) 2317 *keyp = NULL; 2318 if ((copy = sshbuf_fromb(b)) == NULL) { 2319 ret = SSH_ERR_ALLOC_FAIL; 2320 goto out; 2321 } 2322 if (sshbuf_get_cstring(b, &ktype, NULL) != 0) { 2323 ret = SSH_ERR_INVALID_FORMAT; 2324 goto out; 2325 } 2326 2327 type = sshkey_type_from_name(ktype); 2328 if (!allow_cert && sshkey_type_is_cert(type)) { 2329 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2330 goto out; 2331 } 2332 switch (type) { 2333 #ifdef WITH_OPENSSL 2334 case KEY_RSA_CERT: 2335 /* Skip nonce */ 2336 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2337 ret = SSH_ERR_INVALID_FORMAT; 2338 goto out; 2339 } 2340 /* FALLTHROUGH */ 2341 case KEY_RSA: 2342 if ((key = sshkey_new(type)) == NULL) { 2343 ret = SSH_ERR_ALLOC_FAIL; 2344 goto out; 2345 } 2346 if (sshbuf_get_bignum2(b, &rsa_e) != 0 || 2347 sshbuf_get_bignum2(b, &rsa_n) != 0) { 2348 ret = SSH_ERR_INVALID_FORMAT; 2349 goto out; 2350 } 2351 if (!RSA_set0_key(key->rsa, rsa_n, rsa_e, NULL)) { 2352 ret = SSH_ERR_LIBCRYPTO_ERROR; 2353 goto out; 2354 } 2355 rsa_n = rsa_e = NULL; /* transferred */ 2356 if ((ret = check_rsa_length(key->rsa)) != 0) 2357 goto out; 2358 #ifdef DEBUG_PK 2359 RSA_print_fp(stderr, key->rsa, 8); 2360 #endif 2361 break; 2362 case KEY_DSA_CERT: 2363 /* Skip nonce */ 2364 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2365 ret = SSH_ERR_INVALID_FORMAT; 2366 goto out; 2367 } 2368 /* FALLTHROUGH */ 2369 case KEY_DSA: 2370 if ((key = sshkey_new(type)) == NULL) { 2371 ret = SSH_ERR_ALLOC_FAIL; 2372 goto out; 2373 } 2374 if (sshbuf_get_bignum2(b, &dsa_p) != 0 || 2375 sshbuf_get_bignum2(b, &dsa_q) != 0 || 2376 sshbuf_get_bignum2(b, &dsa_g) != 0 || 2377 sshbuf_get_bignum2(b, &dsa_pub_key) != 0) { 2378 ret = SSH_ERR_INVALID_FORMAT; 2379 goto out; 2380 } 2381 if (!DSA_set0_pqg(key->dsa, dsa_p, dsa_q, dsa_g)) { 2382 ret = SSH_ERR_LIBCRYPTO_ERROR; 2383 goto out; 2384 } 2385 dsa_p = dsa_q = dsa_g = NULL; /* transferred */ 2386 if (!DSA_set0_key(key->dsa, dsa_pub_key, NULL)) { 2387 ret = SSH_ERR_LIBCRYPTO_ERROR; 2388 goto out; 2389 } 2390 dsa_pub_key = NULL; /* transferred */ 2391 #ifdef DEBUG_PK 2392 DSA_print_fp(stderr, key->dsa, 8); 2393 #endif 2394 break; 2395 case KEY_ECDSA_CERT: 2396 case KEY_ECDSA_SK_CERT: 2397 /* Skip nonce */ 2398 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2399 ret = SSH_ERR_INVALID_FORMAT; 2400 goto out; 2401 } 2402 /* FALLTHROUGH */ 2403 case KEY_ECDSA: 2404 case KEY_ECDSA_SK: 2405 if ((key = sshkey_new(type)) == NULL) { 2406 ret = SSH_ERR_ALLOC_FAIL; 2407 goto out; 2408 } 2409 key->ecdsa_nid = sshkey_ecdsa_nid_from_name(ktype); 2410 if (sshbuf_get_cstring(b, &curve, NULL) != 0) { 2411 ret = SSH_ERR_INVALID_FORMAT; 2412 goto out; 2413 } 2414 if (key->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 2415 ret = SSH_ERR_EC_CURVE_MISMATCH; 2416 goto out; 2417 } 2418 EC_KEY_free(key->ecdsa); 2419 if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid)) 2420 == NULL) { 2421 ret = SSH_ERR_EC_CURVE_INVALID; 2422 goto out; 2423 } 2424 if ((qq = EC_POINT_new(EC_KEY_get0_group(key->ecdsa))) == NULL) { 2425 ret = SSH_ERR_ALLOC_FAIL; 2426 goto out; 2427 } 2428 if (sshbuf_get_ec(b, qq, EC_KEY_get0_group(key->ecdsa)) != 0) { 2429 ret = SSH_ERR_INVALID_FORMAT; 2430 goto out; 2431 } 2432 if (sshkey_ec_validate_public(EC_KEY_get0_group(key->ecdsa), 2433 qq) != 0) { 2434 ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2435 goto out; 2436 } 2437 if (EC_KEY_set_public_key(key->ecdsa, qq) != 1) { 2438 /* XXX assume it is a allocation error */ 2439 ret = SSH_ERR_ALLOC_FAIL; 2440 goto out; 2441 } 2442 #ifdef DEBUG_PK 2443 sshkey_dump_ec_point(EC_KEY_get0_group(key->ecdsa), qq); 2444 #endif 2445 if (type == KEY_ECDSA_SK || type == KEY_ECDSA_SK_CERT) { 2446 /* Parse additional security-key application string */ 2447 if (sshbuf_get_cstring(b, &key->sk_application, 2448 NULL) != 0) { 2449 ret = SSH_ERR_INVALID_FORMAT; 2450 goto out; 2451 } 2452 #ifdef DEBUG_PK 2453 fprintf(stderr, "App: %s\n", key->sk_application); 2454 #endif 2455 } 2456 break; 2457 #endif /* WITH_OPENSSL */ 2458 case KEY_ED25519_CERT: 2459 case KEY_ED25519_SK_CERT: 2460 /* Skip nonce */ 2461 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2462 ret = SSH_ERR_INVALID_FORMAT; 2463 goto out; 2464 } 2465 /* FALLTHROUGH */ 2466 case KEY_ED25519: 2467 case KEY_ED25519_SK: 2468 if ((ret = sshbuf_get_string(b, &pk, &len)) != 0) 2469 goto out; 2470 if (len != ED25519_PK_SZ) { 2471 ret = SSH_ERR_INVALID_FORMAT; 2472 goto out; 2473 } 2474 if ((key = sshkey_new(type)) == NULL) { 2475 ret = SSH_ERR_ALLOC_FAIL; 2476 goto out; 2477 } 2478 if (type == KEY_ED25519_SK || type == KEY_ED25519_SK_CERT) { 2479 /* Parse additional security-key application string */ 2480 if (sshbuf_get_cstring(b, &key->sk_application, 2481 NULL) != 0) { 2482 ret = SSH_ERR_INVALID_FORMAT; 2483 goto out; 2484 } 2485 #ifdef DEBUG_PK 2486 fprintf(stderr, "App: %s\n", key->sk_application); 2487 #endif 2488 } 2489 key->ed25519_pk = pk; 2490 pk = NULL; 2491 break; 2492 #ifdef WITH_XMSS 2493 case KEY_XMSS_CERT: 2494 /* Skip nonce */ 2495 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2496 ret = SSH_ERR_INVALID_FORMAT; 2497 goto out; 2498 } 2499 /* FALLTHROUGH */ 2500 case KEY_XMSS: 2501 if ((ret = sshbuf_get_cstring(b, &xmss_name, NULL)) != 0) 2502 goto out; 2503 if ((key = sshkey_new(type)) == NULL) { 2504 ret = SSH_ERR_ALLOC_FAIL; 2505 goto out; 2506 } 2507 if ((ret = sshkey_xmss_init(key, xmss_name)) != 0) 2508 goto out; 2509 if ((ret = sshbuf_get_string(b, &pk, &len)) != 0) 2510 goto out; 2511 if (len == 0 || len != sshkey_xmss_pklen(key)) { 2512 ret = SSH_ERR_INVALID_FORMAT; 2513 goto out; 2514 } 2515 key->xmss_pk = pk; 2516 pk = NULL; 2517 if (type != KEY_XMSS_CERT && 2518 (ret = sshkey_xmss_deserialize_pk_info(key, b)) != 0) 2519 goto out; 2520 break; 2521 #endif /* WITH_XMSS */ 2522 case KEY_UNSPEC: 2523 default: 2524 ret = SSH_ERR_KEY_TYPE_UNKNOWN; 2525 goto out; 2526 } 2527 2528 /* Parse certificate potion */ 2529 if (sshkey_is_cert(key) && (ret = cert_parse(b, key, copy)) != 0) 2530 goto out; 2531 2532 if (key != NULL && sshbuf_len(b) != 0) { 2533 ret = SSH_ERR_INVALID_FORMAT; 2534 goto out; 2535 } 2536 ret = 0; 2537 if (keyp != NULL) { 2538 *keyp = key; 2539 key = NULL; 2540 } 2541 out: 2542 sshbuf_free(copy); 2543 sshkey_free(key); 2544 free(xmss_name); 2545 free(ktype); 2546 free(curve); 2547 free(pk); 2548 #ifdef WITH_OPENSSL 2549 EC_POINT_free(q); 2550 BN_clear_free(rsa_n); 2551 BN_clear_free(rsa_e); 2552 BN_clear_free(dsa_p); 2553 BN_clear_free(dsa_q); 2554 BN_clear_free(dsa_g); 2555 BN_clear_free(dsa_pub_key); 2556 #endif /* WITH_OPENSSL */ 2557 return ret; 2558 } 2559 2560 int 2561 sshkey_from_blob(const u_char *blob, size_t blen, struct sshkey **keyp) 2562 { 2563 struct sshbuf *b; 2564 int r; 2565 2566 if ((b = sshbuf_from(blob, blen)) == NULL) 2567 return SSH_ERR_ALLOC_FAIL; 2568 r = sshkey_from_blob_internal(b, keyp, 1); 2569 sshbuf_free(b); 2570 return r; 2571 } 2572 2573 int 2574 sshkey_fromb(struct sshbuf *b, struct sshkey **keyp) 2575 { 2576 return sshkey_from_blob_internal(b, keyp, 1); 2577 } 2578 2579 int 2580 sshkey_froms(struct sshbuf *buf, struct sshkey **keyp) 2581 { 2582 struct sshbuf *b; 2583 int r; 2584 2585 if ((r = sshbuf_froms(buf, &b)) != 0) 2586 return r; 2587 r = sshkey_from_blob_internal(b, keyp, 1); 2588 sshbuf_free(b); 2589 return r; 2590 } 2591 2592 int 2593 sshkey_get_sigtype(const u_char *sig, size_t siglen, char **sigtypep) 2594 { 2595 int r; 2596 struct sshbuf *b = NULL; 2597 char *sigtype = NULL; 2598 2599 if (sigtypep != NULL) 2600 *sigtypep = NULL; 2601 if ((b = sshbuf_from(sig, siglen)) == NULL) 2602 return SSH_ERR_ALLOC_FAIL; 2603 if ((r = sshbuf_get_cstring(b, &sigtype, NULL)) != 0) 2604 goto out; 2605 /* success */ 2606 if (sigtypep != NULL) { 2607 *sigtypep = sigtype; 2608 sigtype = NULL; 2609 } 2610 r = 0; 2611 out: 2612 free(sigtype); 2613 sshbuf_free(b); 2614 return r; 2615 } 2616 2617 /* 2618 * 2619 * Checks whether a certificate's signature type is allowed. 2620 * Returns 0 (success) if the certificate signature type appears in the 2621 * "allowed" pattern-list, or the key is not a certificate to begin with. 2622 * Otherwise returns a ssherr.h code. 2623 */ 2624 int 2625 sshkey_check_cert_sigtype(const struct sshkey *key, const char *allowed) 2626 { 2627 if (key == NULL || allowed == NULL) 2628 return SSH_ERR_INVALID_ARGUMENT; 2629 if (!sshkey_type_is_cert(key->type)) 2630 return 0; 2631 if (key->cert == NULL || key->cert->signature_type == NULL) 2632 return SSH_ERR_INVALID_ARGUMENT; 2633 if (match_pattern_list(key->cert->signature_type, allowed, 0) != 1) 2634 return SSH_ERR_SIGN_ALG_UNSUPPORTED; 2635 return 0; 2636 } 2637 2638 /* 2639 * Returns the expected signature algorithm for a given public key algorithm. 2640 */ 2641 const char * 2642 sshkey_sigalg_by_name(const char *name) 2643 { 2644 const struct keytype *kt; 2645 2646 for (kt = keytypes; kt->type != -1; kt++) { 2647 if (strcmp(kt->name, name) != 0) 2648 continue; 2649 if (kt->sigalg != NULL) 2650 return kt->sigalg; 2651 if (!kt->cert) 2652 return kt->name; 2653 return sshkey_ssh_name_from_type_nid( 2654 sshkey_type_plain(kt->type), kt->nid); 2655 } 2656 return NULL; 2657 } 2658 2659 /* 2660 * Verifies that the signature algorithm appearing inside the signature blob 2661 * matches that which was requested. 2662 */ 2663 int 2664 sshkey_check_sigtype(const u_char *sig, size_t siglen, 2665 const char *requested_alg) 2666 { 2667 const char *expected_alg; 2668 char *sigtype = NULL; 2669 int r; 2670 2671 if (requested_alg == NULL) 2672 return 0; 2673 if ((expected_alg = sshkey_sigalg_by_name(requested_alg)) == NULL) 2674 return SSH_ERR_INVALID_ARGUMENT; 2675 if ((r = sshkey_get_sigtype(sig, siglen, &sigtype)) != 0) 2676 return r; 2677 r = strcmp(expected_alg, sigtype) == 0; 2678 free(sigtype); 2679 return r ? 0 : SSH_ERR_SIGN_ALG_UNSUPPORTED; 2680 } 2681 2682 int 2683 sshkey_sign(struct sshkey *key, 2684 u_char **sigp, size_t *lenp, 2685 const u_char *data, size_t datalen, 2686 const char *alg, const char *sk_provider, u_int compat) 2687 { 2688 int was_shielded = sshkey_is_shielded(key); 2689 int r2, r = SSH_ERR_INTERNAL_ERROR; 2690 2691 if (sigp != NULL) 2692 *sigp = NULL; 2693 if (lenp != NULL) 2694 *lenp = 0; 2695 if (datalen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2696 return SSH_ERR_INVALID_ARGUMENT; 2697 if ((r = sshkey_unshield_private(key)) != 0) 2698 return r; 2699 switch (key->type) { 2700 #ifdef WITH_OPENSSL 2701 case KEY_DSA_CERT: 2702 case KEY_DSA: 2703 r = ssh_dss_sign(key, sigp, lenp, data, datalen, compat); 2704 break; 2705 case KEY_ECDSA_CERT: 2706 case KEY_ECDSA: 2707 r = ssh_ecdsa_sign(key, sigp, lenp, data, datalen, compat); 2708 break; 2709 case KEY_RSA_CERT: 2710 case KEY_RSA: 2711 r = ssh_rsa_sign(key, sigp, lenp, data, datalen, alg); 2712 break; 2713 #endif /* WITH_OPENSSL */ 2714 case KEY_ED25519: 2715 case KEY_ED25519_CERT: 2716 r = ssh_ed25519_sign(key, sigp, lenp, data, datalen, compat); 2717 break; 2718 case KEY_ED25519_SK: 2719 case KEY_ED25519_SK_CERT: 2720 case KEY_ECDSA_SK_CERT: 2721 case KEY_ECDSA_SK: 2722 r = sshsk_sign(sk_provider, key, sigp, lenp, data, 2723 datalen, compat, /* XXX PIN */ NULL); 2724 break; 2725 #ifdef WITH_XMSS 2726 case KEY_XMSS: 2727 case KEY_XMSS_CERT: 2728 r = ssh_xmss_sign(key, sigp, lenp, data, datalen, compat); 2729 break; 2730 #endif /* WITH_XMSS */ 2731 default: 2732 r = SSH_ERR_KEY_TYPE_UNKNOWN; 2733 break; 2734 } 2735 if (was_shielded && (r2 = sshkey_shield_private(key)) != 0) 2736 return r2; 2737 return r; 2738 } 2739 2740 /* 2741 * ssh_key_verify returns 0 for a correct signature and < 0 on error. 2742 * If "alg" specified, then the signature must use that algorithm. 2743 */ 2744 int 2745 sshkey_verify(const struct sshkey *key, 2746 const u_char *sig, size_t siglen, 2747 const u_char *data, size_t dlen, const char *alg, u_int compat, 2748 struct sshkey_sig_details **detailsp) 2749 { 2750 if (detailsp != NULL) 2751 *detailsp = NULL; 2752 if (siglen == 0 || dlen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2753 return SSH_ERR_INVALID_ARGUMENT; 2754 switch (key->type) { 2755 #ifdef WITH_OPENSSL 2756 case KEY_DSA_CERT: 2757 case KEY_DSA: 2758 return ssh_dss_verify(key, sig, siglen, data, dlen, compat); 2759 case KEY_ECDSA_CERT: 2760 case KEY_ECDSA: 2761 return ssh_ecdsa_verify(key, sig, siglen, data, dlen, compat); 2762 case KEY_ECDSA_SK_CERT: 2763 case KEY_ECDSA_SK: 2764 return ssh_ecdsa_sk_verify(key, sig, siglen, data, dlen, 2765 compat, detailsp); 2766 case KEY_RSA_CERT: 2767 case KEY_RSA: 2768 return ssh_rsa_verify(key, sig, siglen, data, dlen, alg); 2769 #endif /* WITH_OPENSSL */ 2770 case KEY_ED25519: 2771 case KEY_ED25519_CERT: 2772 return ssh_ed25519_verify(key, sig, siglen, data, dlen, compat); 2773 case KEY_ED25519_SK: 2774 case KEY_ED25519_SK_CERT: 2775 return ssh_ed25519_sk_verify(key, sig, siglen, data, dlen, 2776 compat, detailsp); 2777 #ifdef WITH_XMSS 2778 case KEY_XMSS: 2779 case KEY_XMSS_CERT: 2780 return ssh_xmss_verify(key, sig, siglen, data, dlen, compat); 2781 #endif /* WITH_XMSS */ 2782 default: 2783 return SSH_ERR_KEY_TYPE_UNKNOWN; 2784 } 2785 } 2786 2787 /* Convert a plain key to their _CERT equivalent */ 2788 int 2789 sshkey_to_certified(struct sshkey *k) 2790 { 2791 int newtype; 2792 2793 switch (k->type) { 2794 #ifdef WITH_OPENSSL 2795 case KEY_RSA: 2796 newtype = KEY_RSA_CERT; 2797 break; 2798 case KEY_DSA: 2799 newtype = KEY_DSA_CERT; 2800 break; 2801 case KEY_ECDSA: 2802 newtype = KEY_ECDSA_CERT; 2803 break; 2804 case KEY_ECDSA_SK: 2805 newtype = KEY_ECDSA_SK_CERT; 2806 break; 2807 #endif /* WITH_OPENSSL */ 2808 case KEY_ED25519_SK: 2809 newtype = KEY_ED25519_SK_CERT; 2810 break; 2811 case KEY_ED25519: 2812 newtype = KEY_ED25519_CERT; 2813 break; 2814 #ifdef WITH_XMSS 2815 case KEY_XMSS: 2816 newtype = KEY_XMSS_CERT; 2817 break; 2818 #endif /* WITH_XMSS */ 2819 default: 2820 return SSH_ERR_INVALID_ARGUMENT; 2821 } 2822 if ((k->cert = cert_new()) == NULL) 2823 return SSH_ERR_ALLOC_FAIL; 2824 k->type = newtype; 2825 return 0; 2826 } 2827 2828 /* Convert a certificate to its raw key equivalent */ 2829 int 2830 sshkey_drop_cert(struct sshkey *k) 2831 { 2832 if (!sshkey_type_is_cert(k->type)) 2833 return SSH_ERR_KEY_TYPE_UNKNOWN; 2834 cert_free(k->cert); 2835 k->cert = NULL; 2836 k->type = sshkey_type_plain(k->type); 2837 return 0; 2838 } 2839 2840 /* Sign a certified key, (re-)generating the signed certblob. */ 2841 int 2842 sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg, 2843 const char *sk_provider, sshkey_certify_signer *signer, void *signer_ctx) 2844 { 2845 struct sshbuf *principals = NULL; 2846 u_char *ca_blob = NULL, *sig_blob = NULL, nonce[32]; 2847 size_t i, ca_len, sig_len; 2848 int ret = SSH_ERR_INTERNAL_ERROR; 2849 struct sshbuf *cert = NULL; 2850 char *sigtype = NULL; 2851 #ifdef WITH_OPENSSL 2852 const BIGNUM *rsa_n, *rsa_e, *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key; 2853 #endif /* WITH_OPENSSL */ 2854 2855 if (k == NULL || k->cert == NULL || 2856 k->cert->certblob == NULL || ca == NULL) 2857 return SSH_ERR_INVALID_ARGUMENT; 2858 if (!sshkey_is_cert(k)) 2859 return SSH_ERR_KEY_TYPE_UNKNOWN; 2860 if (!sshkey_type_is_valid_ca(ca->type)) 2861 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2862 2863 /* 2864 * If no alg specified as argument but a signature_type was set, 2865 * then prefer that. If both were specified, then they must match. 2866 */ 2867 if (alg == NULL) 2868 alg = k->cert->signature_type; 2869 else if (k->cert->signature_type != NULL && 2870 strcmp(alg, k->cert->signature_type) != 0) 2871 return SSH_ERR_INVALID_ARGUMENT; 2872 2873 /* 2874 * If no signing algorithm or signature_type was specified and we're 2875 * using a RSA key, then default to a good signature algorithm. 2876 */ 2877 if (alg == NULL && ca->type == KEY_RSA) 2878 alg = "rsa-sha2-512"; 2879 2880 if ((ret = sshkey_to_blob(ca, &ca_blob, &ca_len)) != 0) 2881 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2882 2883 cert = k->cert->certblob; /* for readability */ 2884 sshbuf_reset(cert); 2885 if ((ret = sshbuf_put_cstring(cert, sshkey_ssh_name(k))) != 0) 2886 goto out; 2887 2888 /* -v01 certs put nonce first */ 2889 arc4random_buf(&nonce, sizeof(nonce)); 2890 if ((ret = sshbuf_put_string(cert, nonce, sizeof(nonce))) != 0) 2891 goto out; 2892 2893 /* XXX this substantially duplicates to_blob(); refactor */ 2894 switch (k->type) { 2895 #ifdef WITH_OPENSSL 2896 case KEY_DSA_CERT: 2897 DSA_get0_pqg(k->dsa, &dsa_p, &dsa_q, &dsa_g); 2898 DSA_get0_key(k->dsa, &dsa_pub_key, NULL); 2899 if ((ret = sshbuf_put_bignum2(cert, dsa_p)) != 0 || 2900 (ret = sshbuf_put_bignum2(cert, dsa_q)) != 0 || 2901 (ret = sshbuf_put_bignum2(cert, dsa_g)) != 0 || 2902 (ret = sshbuf_put_bignum2(cert, dsa_pub_key)) != 0) 2903 goto out; 2904 break; 2905 case KEY_ECDSA_CERT: 2906 case KEY_ECDSA_SK_CERT: 2907 if ((ret = sshbuf_put_cstring(cert, 2908 sshkey_curve_nid_to_name(k->ecdsa_nid))) != 0 || 2909 (ret = sshbuf_put_ec(cert, 2910 EC_KEY_get0_public_key(k->ecdsa), 2911 EC_KEY_get0_group(k->ecdsa))) != 0) 2912 goto out; 2913 if (k->type == KEY_ECDSA_SK_CERT) { 2914 if ((ret = sshbuf_put_cstring(cert, 2915 k->sk_application)) != 0) 2916 goto out; 2917 } 2918 break; 2919 case KEY_RSA_CERT: 2920 RSA_get0_key(k->rsa, &rsa_n, &rsa_e, NULL); 2921 if ((ret = sshbuf_put_bignum2(cert, rsa_e)) != 0 || 2922 (ret = sshbuf_put_bignum2(cert, rsa_n)) != 0) 2923 goto out; 2924 break; 2925 #endif /* WITH_OPENSSL */ 2926 case KEY_ED25519_CERT: 2927 case KEY_ED25519_SK_CERT: 2928 if ((ret = sshbuf_put_string(cert, 2929 k->ed25519_pk, ED25519_PK_SZ)) != 0) 2930 goto out; 2931 if (k->type == KEY_ED25519_SK_CERT) { 2932 if ((ret = sshbuf_put_cstring(cert, 2933 k->sk_application)) != 0) 2934 goto out; 2935 } 2936 break; 2937 #ifdef WITH_XMSS 2938 case KEY_XMSS_CERT: 2939 if (k->xmss_name == NULL) { 2940 ret = SSH_ERR_INVALID_ARGUMENT; 2941 goto out; 2942 } 2943 if ((ret = sshbuf_put_cstring(cert, k->xmss_name)) || 2944 (ret = sshbuf_put_string(cert, 2945 k->xmss_pk, sshkey_xmss_pklen(k))) != 0) 2946 goto out; 2947 break; 2948 #endif /* WITH_XMSS */ 2949 default: 2950 ret = SSH_ERR_INVALID_ARGUMENT; 2951 goto out; 2952 } 2953 2954 if ((ret = sshbuf_put_u64(cert, k->cert->serial)) != 0 || 2955 (ret = sshbuf_put_u32(cert, k->cert->type)) != 0 || 2956 (ret = sshbuf_put_cstring(cert, k->cert->key_id)) != 0) 2957 goto out; 2958 2959 if ((principals = sshbuf_new()) == NULL) { 2960 ret = SSH_ERR_ALLOC_FAIL; 2961 goto out; 2962 } 2963 for (i = 0; i < k->cert->nprincipals; i++) { 2964 if ((ret = sshbuf_put_cstring(principals, 2965 k->cert->principals[i])) != 0) 2966 goto out; 2967 } 2968 if ((ret = sshbuf_put_stringb(cert, principals)) != 0 || 2969 (ret = sshbuf_put_u64(cert, k->cert->valid_after)) != 0 || 2970 (ret = sshbuf_put_u64(cert, k->cert->valid_before)) != 0 || 2971 (ret = sshbuf_put_stringb(cert, k->cert->critical)) != 0 || 2972 (ret = sshbuf_put_stringb(cert, k->cert->extensions)) != 0 || 2973 (ret = sshbuf_put_string(cert, NULL, 0)) != 0 || /* Reserved */ 2974 (ret = sshbuf_put_string(cert, ca_blob, ca_len)) != 0) 2975 goto out; 2976 2977 /* Sign the whole mess */ 2978 if ((ret = signer(ca, &sig_blob, &sig_len, sshbuf_ptr(cert), 2979 sshbuf_len(cert), alg, sk_provider, 0, signer_ctx)) != 0) 2980 goto out; 2981 /* Check and update signature_type against what was actually used */ 2982 if ((ret = sshkey_get_sigtype(sig_blob, sig_len, &sigtype)) != 0) 2983 goto out; 2984 if (alg != NULL && strcmp(alg, sigtype) != 0) { 2985 ret = SSH_ERR_SIGN_ALG_UNSUPPORTED; 2986 goto out; 2987 } 2988 if (k->cert->signature_type == NULL) { 2989 k->cert->signature_type = sigtype; 2990 sigtype = NULL; 2991 } 2992 /* Append signature and we are done */ 2993 if ((ret = sshbuf_put_string(cert, sig_blob, sig_len)) != 0) 2994 goto out; 2995 ret = 0; 2996 out: 2997 if (ret != 0) 2998 sshbuf_reset(cert); 2999 free(sig_blob); 3000 free(ca_blob); 3001 free(sigtype); 3002 sshbuf_free(principals); 3003 return ret; 3004 } 3005 3006 static int 3007 default_key_sign(struct sshkey *key, u_char **sigp, size_t *lenp, 3008 const u_char *data, size_t datalen, 3009 const char *alg, const char *sk_provider, u_int compat, void *ctx) 3010 { 3011 if (ctx != NULL) 3012 return SSH_ERR_INVALID_ARGUMENT; 3013 return sshkey_sign(key, sigp, lenp, data, datalen, alg, 3014 sk_provider, compat); 3015 } 3016 3017 int 3018 sshkey_certify(struct sshkey *k, struct sshkey *ca, const char *alg, 3019 const char *sk_provider) 3020 { 3021 return sshkey_certify_custom(k, ca, alg, sk_provider, 3022 default_key_sign, NULL); 3023 } 3024 3025 int 3026 sshkey_cert_check_authority(const struct sshkey *k, 3027 int want_host, int require_principal, 3028 const char *name, const char **reason) 3029 { 3030 u_int i, principal_matches; 3031 time_t now = time(NULL); 3032 3033 if (reason == NULL) 3034 return SSH_ERR_INVALID_ARGUMENT; 3035 3036 if (want_host) { 3037 if (k->cert->type != SSH2_CERT_TYPE_HOST) { 3038 *reason = "Certificate invalid: not a host certificate"; 3039 return SSH_ERR_KEY_CERT_INVALID; 3040 } 3041 } else { 3042 if (k->cert->type != SSH2_CERT_TYPE_USER) { 3043 *reason = "Certificate invalid: not a user certificate"; 3044 return SSH_ERR_KEY_CERT_INVALID; 3045 } 3046 } 3047 if (now < 0) { 3048 /* yikes - system clock before epoch! */ 3049 *reason = "Certificate invalid: not yet valid"; 3050 return SSH_ERR_KEY_CERT_INVALID; 3051 } 3052 if ((u_int64_t)now < k->cert->valid_after) { 3053 *reason = "Certificate invalid: not yet valid"; 3054 return SSH_ERR_KEY_CERT_INVALID; 3055 } 3056 if ((u_int64_t)now >= k->cert->valid_before) { 3057 *reason = "Certificate invalid: expired"; 3058 return SSH_ERR_KEY_CERT_INVALID; 3059 } 3060 if (k->cert->nprincipals == 0) { 3061 if (require_principal) { 3062 *reason = "Certificate lacks principal list"; 3063 return SSH_ERR_KEY_CERT_INVALID; 3064 } 3065 } else if (name != NULL) { 3066 principal_matches = 0; 3067 for (i = 0; i < k->cert->nprincipals; i++) { 3068 if (strcmp(name, k->cert->principals[i]) == 0) { 3069 principal_matches = 1; 3070 break; 3071 } 3072 } 3073 if (!principal_matches) { 3074 *reason = "Certificate invalid: name is not a listed " 3075 "principal"; 3076 return SSH_ERR_KEY_CERT_INVALID; 3077 } 3078 } 3079 return 0; 3080 } 3081 3082 size_t 3083 sshkey_format_cert_validity(const struct sshkey_cert *cert, char *s, size_t l) 3084 { 3085 char from[32], to[32], ret[128]; 3086 time_t tt; 3087 struct tm *tm; 3088 3089 *from = *to = '\0'; 3090 if (cert->valid_after == 0 && 3091 cert->valid_before == 0xffffffffffffffffULL) 3092 return strlcpy(s, "forever", l); 3093 3094 if (cert->valid_after != 0) { 3095 /* XXX revisit INT_MAX in 2038 :) */ 3096 tt = cert->valid_after > INT_MAX ? 3097 INT_MAX : cert->valid_after; 3098 tm = localtime(&tt); 3099 strftime(from, sizeof(from), "%Y-%m-%dT%H:%M:%S", tm); 3100 } 3101 if (cert->valid_before != 0xffffffffffffffffULL) { 3102 /* XXX revisit INT_MAX in 2038 :) */ 3103 tt = cert->valid_before > INT_MAX ? 3104 INT_MAX : cert->valid_before; 3105 tm = localtime(&tt); 3106 strftime(to, sizeof(to), "%Y-%m-%dT%H:%M:%S", tm); 3107 } 3108 3109 if (cert->valid_after == 0) 3110 snprintf(ret, sizeof(ret), "before %s", to); 3111 else if (cert->valid_before == 0xffffffffffffffffULL) 3112 snprintf(ret, sizeof(ret), "after %s", from); 3113 else 3114 snprintf(ret, sizeof(ret), "from %s to %s", from, to); 3115 3116 return strlcpy(s, ret, l); 3117 } 3118 3119 int 3120 sshkey_private_serialize_opt(struct sshkey *key, struct sshbuf *buf, 3121 enum sshkey_serialize_rep opts) 3122 { 3123 int r = SSH_ERR_INTERNAL_ERROR; 3124 int was_shielded = sshkey_is_shielded(key); 3125 struct sshbuf *b = NULL; 3126 #ifdef WITH_OPENSSL 3127 const BIGNUM *rsa_n, *rsa_e, *rsa_d, *rsa_iqmp, *rsa_p, *rsa_q; 3128 const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key, *dsa_priv_key; 3129 #endif /* WITH_OPENSSL */ 3130 3131 if ((r = sshkey_unshield_private(key)) != 0) 3132 return r; 3133 if ((b = sshbuf_new()) == NULL) 3134 return SSH_ERR_ALLOC_FAIL; 3135 if ((r = sshbuf_put_cstring(b, sshkey_ssh_name(key))) != 0) 3136 goto out; 3137 switch (key->type) { 3138 #ifdef WITH_OPENSSL 3139 case KEY_RSA: 3140 RSA_get0_key(key->rsa, &rsa_n, &rsa_e, &rsa_d); 3141 RSA_get0_factors(key->rsa, &rsa_p, &rsa_q); 3142 RSA_get0_crt_params(key->rsa, NULL, NULL, &rsa_iqmp); 3143 if ((r = sshbuf_put_bignum2(b, rsa_n)) != 0 || 3144 (r = sshbuf_put_bignum2(b, rsa_e)) != 0 || 3145 (r = sshbuf_put_bignum2(b, rsa_d)) != 0 || 3146 (r = sshbuf_put_bignum2(b, rsa_iqmp)) != 0 || 3147 (r = sshbuf_put_bignum2(b, rsa_p)) != 0 || 3148 (r = sshbuf_put_bignum2(b, rsa_q)) != 0) 3149 goto out; 3150 break; 3151 case KEY_RSA_CERT: 3152 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3153 r = SSH_ERR_INVALID_ARGUMENT; 3154 goto out; 3155 } 3156 RSA_get0_key(key->rsa, NULL, NULL, &rsa_d); 3157 RSA_get0_factors(key->rsa, &rsa_p, &rsa_q); 3158 RSA_get0_crt_params(key->rsa, NULL, NULL, &rsa_iqmp); 3159 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3160 (r = sshbuf_put_bignum2(b, rsa_d)) != 0 || 3161 (r = sshbuf_put_bignum2(b, rsa_iqmp)) != 0 || 3162 (r = sshbuf_put_bignum2(b, rsa_p)) != 0 || 3163 (r = sshbuf_put_bignum2(b, rsa_q)) != 0) 3164 goto out; 3165 break; 3166 case KEY_DSA: 3167 DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g); 3168 DSA_get0_key(key->dsa, &dsa_pub_key, &dsa_priv_key); 3169 if ((r = sshbuf_put_bignum2(b, dsa_p)) != 0 || 3170 (r = sshbuf_put_bignum2(b, dsa_q)) != 0 || 3171 (r = sshbuf_put_bignum2(b, dsa_g)) != 0 || 3172 (r = sshbuf_put_bignum2(b, dsa_pub_key)) != 0 || 3173 (r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0) 3174 goto out; 3175 break; 3176 case KEY_DSA_CERT: 3177 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3178 r = SSH_ERR_INVALID_ARGUMENT; 3179 goto out; 3180 } 3181 DSA_get0_key(key->dsa, NULL, &dsa_priv_key); 3182 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3183 (r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0) 3184 goto out; 3185 break; 3186 case KEY_ECDSA: 3187 if ((r = sshbuf_put_cstring(b, 3188 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 3189 (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 || 3190 (r = sshbuf_put_bignum2(b, 3191 EC_KEY_get0_private_key(key->ecdsa))) != 0) 3192 goto out; 3193 break; 3194 case KEY_ECDSA_CERT: 3195 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3196 r = SSH_ERR_INVALID_ARGUMENT; 3197 goto out; 3198 } 3199 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3200 (r = sshbuf_put_bignum2(b, 3201 EC_KEY_get0_private_key(key->ecdsa))) != 0) 3202 goto out; 3203 break; 3204 case KEY_ECDSA_SK: 3205 if ((r = sshbuf_put_cstring(b, 3206 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 3207 (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 || 3208 (r = sshbuf_put_cstring(b, key->sk_application)) != 0 || 3209 (r = sshbuf_put_u8(b, key->sk_flags)) != 0 || 3210 (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 || 3211 (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0) 3212 goto out; 3213 break; 3214 case KEY_ECDSA_SK_CERT: 3215 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3216 r = SSH_ERR_INVALID_ARGUMENT; 3217 goto out; 3218 } 3219 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3220 (r = sshbuf_put_cstring(b, key->sk_application)) != 0 || 3221 (r = sshbuf_put_u8(b, key->sk_flags)) != 0 || 3222 (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 || 3223 (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0) 3224 goto out; 3225 break; 3226 #endif /* WITH_OPENSSL */ 3227 case KEY_ED25519: 3228 if ((r = sshbuf_put_string(b, key->ed25519_pk, 3229 ED25519_PK_SZ)) != 0 || 3230 (r = sshbuf_put_string(b, key->ed25519_sk, 3231 ED25519_SK_SZ)) != 0) 3232 goto out; 3233 break; 3234 case KEY_ED25519_CERT: 3235 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3236 r = SSH_ERR_INVALID_ARGUMENT; 3237 goto out; 3238 } 3239 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3240 (r = sshbuf_put_string(b, key->ed25519_pk, 3241 ED25519_PK_SZ)) != 0 || 3242 (r = sshbuf_put_string(b, key->ed25519_sk, 3243 ED25519_SK_SZ)) != 0) 3244 goto out; 3245 break; 3246 case KEY_ED25519_SK: 3247 if ((r = sshbuf_put_string(b, key->ed25519_pk, 3248 ED25519_PK_SZ)) != 0 || 3249 (r = sshbuf_put_cstring(b, key->sk_application)) != 0 || 3250 (r = sshbuf_put_u8(b, key->sk_flags)) != 0 || 3251 (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 || 3252 (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0) 3253 goto out; 3254 break; 3255 case KEY_ED25519_SK_CERT: 3256 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3257 r = SSH_ERR_INVALID_ARGUMENT; 3258 goto out; 3259 } 3260 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3261 (r = sshbuf_put_string(b, key->ed25519_pk, 3262 ED25519_PK_SZ)) != 0 || 3263 (r = sshbuf_put_cstring(b, key->sk_application)) != 0 || 3264 (r = sshbuf_put_u8(b, key->sk_flags)) != 0 || 3265 (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 || 3266 (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0) 3267 goto out; 3268 break; 3269 #ifdef WITH_XMSS 3270 case KEY_XMSS: 3271 if (key->xmss_name == NULL) { 3272 r = SSH_ERR_INVALID_ARGUMENT; 3273 goto out; 3274 } 3275 if ((r = sshbuf_put_cstring(b, key->xmss_name)) != 0 || 3276 (r = sshbuf_put_string(b, key->xmss_pk, 3277 sshkey_xmss_pklen(key))) != 0 || 3278 (r = sshbuf_put_string(b, key->xmss_sk, 3279 sshkey_xmss_sklen(key))) != 0 || 3280 (r = sshkey_xmss_serialize_state_opt(key, b, opts)) != 0) 3281 goto out; 3282 break; 3283 case KEY_XMSS_CERT: 3284 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0 || 3285 key->xmss_name == NULL) { 3286 r = SSH_ERR_INVALID_ARGUMENT; 3287 goto out; 3288 } 3289 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3290 (r = sshbuf_put_cstring(b, key->xmss_name)) != 0 || 3291 (r = sshbuf_put_string(b, key->xmss_pk, 3292 sshkey_xmss_pklen(key))) != 0 || 3293 (r = sshbuf_put_string(b, key->xmss_sk, 3294 sshkey_xmss_sklen(key))) != 0 || 3295 (r = sshkey_xmss_serialize_state_opt(key, b, opts)) != 0) 3296 goto out; 3297 break; 3298 #endif /* WITH_XMSS */ 3299 default: 3300 r = SSH_ERR_INVALID_ARGUMENT; 3301 goto out; 3302 } 3303 /* 3304 * success (but we still need to append the output to buf after 3305 * possibly re-shielding the private key) 3306 */ 3307 r = 0; 3308 out: 3309 if (was_shielded) 3310 r = sshkey_shield_private(key); 3311 if (r == 0) 3312 r = sshbuf_putb(buf, b); 3313 sshbuf_free(b); 3314 3315 return r; 3316 } 3317 3318 int 3319 sshkey_private_serialize(struct sshkey *key, struct sshbuf *b) 3320 { 3321 return sshkey_private_serialize_opt(key, b, 3322 SSHKEY_SERIALIZE_DEFAULT); 3323 } 3324 3325 int 3326 sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) 3327 { 3328 char *tname = NULL, *curve = NULL, *xmss_name = NULL; 3329 struct sshkey *k = NULL; 3330 size_t pklen = 0, sklen = 0; 3331 int type, r = SSH_ERR_INTERNAL_ERROR; 3332 u_char *ed25519_pk = NULL, *ed25519_sk = NULL; 3333 u_char *xmss_pk = NULL, *xmss_sk = NULL; 3334 #ifdef WITH_OPENSSL 3335 BIGNUM *exponent = NULL; 3336 BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL; 3337 BIGNUM *rsa_iqmp = NULL, *rsa_p = NULL, *rsa_q = NULL; 3338 BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL; 3339 BIGNUM *dsa_pub_key = NULL, *dsa_priv_key = NULL; 3340 #endif /* WITH_OPENSSL */ 3341 3342 if (kp != NULL) 3343 *kp = NULL; 3344 if ((r = sshbuf_get_cstring(buf, &tname, NULL)) != 0) 3345 goto out; 3346 type = sshkey_type_from_name(tname); 3347 if (sshkey_type_is_cert(type)) { 3348 /* 3349 * Certificate key private keys begin with the certificate 3350 * itself. Make sure this matches the type of the enclosing 3351 * private key. 3352 */ 3353 if ((r = sshkey_froms(buf, &k)) != 0) 3354 goto out; 3355 if (k->type != type) { 3356 r = SSH_ERR_KEY_CERT_MISMATCH; 3357 goto out; 3358 } 3359 /* For ECDSA keys, the group must match too */ 3360 if (k->type == KEY_ECDSA && 3361 k->ecdsa_nid != sshkey_ecdsa_nid_from_name(tname)) { 3362 r = SSH_ERR_KEY_CERT_MISMATCH; 3363 goto out; 3364 } 3365 } else { 3366 if ((k = sshkey_new(type)) == NULL) { 3367 r = SSH_ERR_ALLOC_FAIL; 3368 goto out; 3369 } 3370 } 3371 switch (type) { 3372 #ifdef WITH_OPENSSL 3373 case KEY_DSA: 3374 if ((r = sshbuf_get_bignum2(buf, &dsa_p)) != 0 || 3375 (r = sshbuf_get_bignum2(buf, &dsa_q)) != 0 || 3376 (r = sshbuf_get_bignum2(buf, &dsa_g)) != 0 || 3377 (r = sshbuf_get_bignum2(buf, &dsa_pub_key)) != 0) 3378 goto out; 3379 if (!DSA_set0_pqg(k->dsa, dsa_p, dsa_q, dsa_g)) { 3380 r = SSH_ERR_LIBCRYPTO_ERROR; 3381 goto out; 3382 } 3383 dsa_p = dsa_q = dsa_g = NULL; /* transferred */ 3384 if (!DSA_set0_key(k->dsa, dsa_pub_key, NULL)) { 3385 r = SSH_ERR_LIBCRYPTO_ERROR; 3386 goto out; 3387 } 3388 dsa_pub_key = NULL; /* transferred */ 3389 /* FALLTHROUGH */ 3390 case KEY_DSA_CERT: 3391 if ((r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0) 3392 goto out; 3393 if (!DSA_set0_key(k->dsa, NULL, dsa_priv_key)) { 3394 r = SSH_ERR_LIBCRYPTO_ERROR; 3395 goto out; 3396 } 3397 dsa_priv_key = NULL; /* transferred */ 3398 break; 3399 case KEY_ECDSA: 3400 if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) { 3401 r = SSH_ERR_INVALID_ARGUMENT; 3402 goto out; 3403 } 3404 if ((r = sshbuf_get_cstring(buf, &curve, NULL)) != 0) 3405 goto out; 3406 if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 3407 r = SSH_ERR_EC_CURVE_MISMATCH; 3408 goto out; 3409 } 3410 k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 3411 if (k->ecdsa == NULL) { 3412 r = SSH_ERR_LIBCRYPTO_ERROR; 3413 goto out; 3414 } 3415 if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0) 3416 goto out; 3417 /* FALLTHROUGH */ 3418 case KEY_ECDSA_CERT: 3419 if ((r = sshbuf_get_bignum2(buf, &exponent)) != 0) 3420 goto out; 3421 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { 3422 r = SSH_ERR_LIBCRYPTO_ERROR; 3423 goto out; 3424 } 3425 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 3426 EC_KEY_get0_public_key(k->ecdsa))) != 0 || 3427 (r = sshkey_ec_validate_private(k->ecdsa)) != 0) 3428 goto out; 3429 break; 3430 case KEY_ECDSA_SK: 3431 if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) { 3432 r = SSH_ERR_INVALID_ARGUMENT; 3433 goto out; 3434 } 3435 if ((r = sshbuf_get_cstring(buf, &curve, NULL)) != 0) 3436 goto out; 3437 if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 3438 r = SSH_ERR_EC_CURVE_MISMATCH; 3439 goto out; 3440 } 3441 if ((k->sk_key_handle = sshbuf_new()) == NULL || 3442 (k->sk_reserved = sshbuf_new()) == NULL) { 3443 r = SSH_ERR_ALLOC_FAIL; 3444 goto out; 3445 } 3446 k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 3447 if (k->ecdsa == NULL) { 3448 r = SSH_ERR_LIBCRYPTO_ERROR; 3449 goto out; 3450 } 3451 if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 || 3452 (r = sshbuf_get_cstring(buf, &k->sk_application, 3453 NULL)) != 0 || 3454 (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 || 3455 (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 || 3456 (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0) 3457 goto out; 3458 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 3459 EC_KEY_get0_public_key(k->ecdsa))) != 0) 3460 goto out; 3461 break; 3462 case KEY_ECDSA_SK_CERT: 3463 if ((k->sk_key_handle = sshbuf_new()) == NULL || 3464 (k->sk_reserved = sshbuf_new()) == NULL) { 3465 r = SSH_ERR_ALLOC_FAIL; 3466 goto out; 3467 } 3468 if ((r = sshbuf_get_cstring(buf, &k->sk_application, 3469 NULL)) != 0 || 3470 (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 || 3471 (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 || 3472 (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0) 3473 goto out; 3474 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 3475 EC_KEY_get0_public_key(k->ecdsa))) != 0) 3476 goto out; 3477 break; 3478 case KEY_RSA: 3479 if ((r = sshbuf_get_bignum2(buf, &rsa_n)) != 0 || 3480 (r = sshbuf_get_bignum2(buf, &rsa_e)) != 0) 3481 goto out; 3482 if (!RSA_set0_key(k->rsa, rsa_n, rsa_e, NULL)) { 3483 r = SSH_ERR_LIBCRYPTO_ERROR; 3484 goto out; 3485 } 3486 rsa_n = rsa_e = NULL; /* transferred */ 3487 /* FALLTHROUGH */ 3488 case KEY_RSA_CERT: 3489 if ((r = sshbuf_get_bignum2(buf, &rsa_d)) != 0 || 3490 (r = sshbuf_get_bignum2(buf, &rsa_iqmp)) != 0 || 3491 (r = sshbuf_get_bignum2(buf, &rsa_p)) != 0 || 3492 (r = sshbuf_get_bignum2(buf, &rsa_q)) != 0) 3493 goto out; 3494 if (!RSA_set0_key(k->rsa, NULL, NULL, rsa_d)) { 3495 r = SSH_ERR_LIBCRYPTO_ERROR; 3496 goto out; 3497 } 3498 rsa_d = NULL; /* transferred */ 3499 if (!RSA_set0_factors(k->rsa, rsa_p, rsa_q)) { 3500 r = SSH_ERR_LIBCRYPTO_ERROR; 3501 goto out; 3502 } 3503 rsa_p = rsa_q = NULL; /* transferred */ 3504 if ((r = check_rsa_length(k->rsa)) != 0) 3505 goto out; 3506 if ((r = ssh_rsa_complete_crt_parameters(k, rsa_iqmp)) != 0) 3507 goto out; 3508 break; 3509 #endif /* WITH_OPENSSL */ 3510 case KEY_ED25519: 3511 case KEY_ED25519_CERT: 3512 if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || 3513 (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) 3514 goto out; 3515 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { 3516 r = SSH_ERR_INVALID_FORMAT; 3517 goto out; 3518 } 3519 k->ed25519_pk = ed25519_pk; 3520 k->ed25519_sk = ed25519_sk; 3521 ed25519_pk = ed25519_sk = NULL; /* transferred */ 3522 break; 3523 case KEY_ED25519_SK: 3524 case KEY_ED25519_SK_CERT: 3525 if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0) 3526 goto out; 3527 if (pklen != ED25519_PK_SZ) { 3528 r = SSH_ERR_INVALID_FORMAT; 3529 goto out; 3530 } 3531 if ((k->sk_key_handle = sshbuf_new()) == NULL || 3532 (k->sk_reserved = sshbuf_new()) == NULL) { 3533 r = SSH_ERR_ALLOC_FAIL; 3534 goto out; 3535 } 3536 if ((r = sshbuf_get_cstring(buf, &k->sk_application, 3537 NULL)) != 0 || 3538 (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 || 3539 (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 || 3540 (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0) 3541 goto out; 3542 k->ed25519_pk = ed25519_pk; 3543 ed25519_pk = NULL; /* transferred */ 3544 break; 3545 #ifdef WITH_XMSS 3546 case KEY_XMSS: 3547 case KEY_XMSS_CERT: 3548 if ((r = sshbuf_get_cstring(buf, &xmss_name, NULL)) != 0 || 3549 (r = sshkey_xmss_init(k, xmss_name)) != 0 || 3550 (r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 || 3551 (r = sshbuf_get_string(buf, &xmss_sk, &sklen)) != 0) 3552 goto out; 3553 if (pklen != sshkey_xmss_pklen(k) || 3554 sklen != sshkey_xmss_sklen(k)) { 3555 r = SSH_ERR_INVALID_FORMAT; 3556 goto out; 3557 } 3558 k->xmss_pk = xmss_pk; 3559 k->xmss_sk = xmss_sk; 3560 xmss_pk = xmss_sk = NULL; 3561 /* optional internal state */ 3562 if ((r = sshkey_xmss_deserialize_state_opt(k, buf)) != 0) 3563 goto out; 3564 break; 3565 #endif /* WITH_XMSS */ 3566 default: 3567 r = SSH_ERR_KEY_TYPE_UNKNOWN; 3568 goto out; 3569 } 3570 #ifdef WITH_OPENSSL 3571 /* enable blinding */ 3572 switch (k->type) { 3573 case KEY_RSA: 3574 case KEY_RSA_CERT: 3575 if (RSA_blinding_on(k->rsa, NULL) != 1) { 3576 r = SSH_ERR_LIBCRYPTO_ERROR; 3577 goto out; 3578 } 3579 break; 3580 } 3581 #endif /* WITH_OPENSSL */ 3582 /* success */ 3583 r = 0; 3584 if (kp != NULL) { 3585 *kp = k; 3586 k = NULL; 3587 } 3588 out: 3589 free(tname); 3590 free(curve); 3591 #ifdef WITH_OPENSSL 3592 BN_clear_free(exponent); 3593 BN_clear_free(dsa_p); 3594 BN_clear_free(dsa_q); 3595 BN_clear_free(dsa_g); 3596 BN_clear_free(dsa_pub_key); 3597 BN_clear_free(dsa_priv_key); 3598 BN_clear_free(rsa_n); 3599 BN_clear_free(rsa_e); 3600 BN_clear_free(rsa_d); 3601 BN_clear_free(rsa_p); 3602 BN_clear_free(rsa_q); 3603 BN_clear_free(rsa_iqmp); 3604 #endif /* WITH_OPENSSL */ 3605 sshkey_free(k); 3606 freezero(ed25519_pk, pklen); 3607 freezero(ed25519_sk, sklen); 3608 free(xmss_name); 3609 freezero(xmss_pk, pklen); 3610 freezero(xmss_sk, sklen); 3611 return r; 3612 } 3613 3614 #ifdef WITH_OPENSSL 3615 int 3616 sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public) 3617 { 3618 EC_POINT *nq = NULL; 3619 BIGNUM *order = NULL, *x = NULL, *y = NULL, *tmp = NULL; 3620 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 3621 3622 /* 3623 * NB. This assumes OpenSSL has already verified that the public 3624 * point lies on the curve. This is done by EC_POINT_oct2point() 3625 * implicitly calling EC_POINT_is_on_curve(). If this code is ever 3626 * reachable with public points not unmarshalled using 3627 * EC_POINT_oct2point then the caller will need to explicitly check. 3628 */ 3629 3630 /* 3631 * We shouldn't ever hit this case because bignum_get_ecpoint() 3632 * refuses to load GF2m points. 3633 */ 3634 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 3635 NID_X9_62_prime_field) 3636 goto out; 3637 3638 /* Q != infinity */ 3639 if (EC_POINT_is_at_infinity(group, public)) 3640 goto out; 3641 3642 if ((x = BN_new()) == NULL || 3643 (y = BN_new()) == NULL || 3644 (order = BN_new()) == NULL || 3645 (tmp = BN_new()) == NULL) { 3646 ret = SSH_ERR_ALLOC_FAIL; 3647 goto out; 3648 } 3649 3650 /* log2(x) > log2(order)/2, log2(y) > log2(order)/2 */ 3651 if (EC_GROUP_get_order(group, order, NULL) != 1 || 3652 EC_POINT_get_affine_coordinates_GFp(group, public, 3653 x, y, NULL) != 1) { 3654 ret = SSH_ERR_LIBCRYPTO_ERROR; 3655 goto out; 3656 } 3657 if (BN_num_bits(x) <= BN_num_bits(order) / 2 || 3658 BN_num_bits(y) <= BN_num_bits(order) / 2) 3659 goto out; 3660 3661 /* nQ == infinity (n == order of subgroup) */ 3662 if ((nq = EC_POINT_new(group)) == NULL) { 3663 ret = SSH_ERR_ALLOC_FAIL; 3664 goto out; 3665 } 3666 if (EC_POINT_mul(group, nq, NULL, public, order, NULL) != 1) { 3667 ret = SSH_ERR_LIBCRYPTO_ERROR; 3668 goto out; 3669 } 3670 if (EC_POINT_is_at_infinity(group, nq) != 1) 3671 goto out; 3672 3673 /* x < order - 1, y < order - 1 */ 3674 if (!BN_sub(tmp, order, BN_value_one())) { 3675 ret = SSH_ERR_LIBCRYPTO_ERROR; 3676 goto out; 3677 } 3678 if (BN_cmp(x, tmp) >= 0 || BN_cmp(y, tmp) >= 0) 3679 goto out; 3680 ret = 0; 3681 out: 3682 BN_clear_free(x); 3683 BN_clear_free(y); 3684 BN_clear_free(order); 3685 BN_clear_free(tmp); 3686 EC_POINT_free(nq); 3687 return ret; 3688 } 3689 3690 int 3691 sshkey_ec_validate_private(const EC_KEY *key) 3692 { 3693 BIGNUM *order = NULL, *tmp = NULL; 3694 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 3695 3696 if ((order = BN_new()) == NULL || (tmp = BN_new()) == NULL) { 3697 ret = SSH_ERR_ALLOC_FAIL; 3698 goto out; 3699 } 3700 3701 /* log2(private) > log2(order)/2 */ 3702 if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, NULL) != 1) { 3703 ret = SSH_ERR_LIBCRYPTO_ERROR; 3704 goto out; 3705 } 3706 if (BN_num_bits(EC_KEY_get0_private_key(key)) <= 3707 BN_num_bits(order) / 2) 3708 goto out; 3709 3710 /* private < order - 1 */ 3711 if (!BN_sub(tmp, order, BN_value_one())) { 3712 ret = SSH_ERR_LIBCRYPTO_ERROR; 3713 goto out; 3714 } 3715 if (BN_cmp(EC_KEY_get0_private_key(key), tmp) >= 0) 3716 goto out; 3717 ret = 0; 3718 out: 3719 BN_clear_free(order); 3720 BN_clear_free(tmp); 3721 return ret; 3722 } 3723 3724 void 3725 sshkey_dump_ec_point(const EC_GROUP *group, const EC_POINT *point) 3726 { 3727 BIGNUM *x = NULL, *y = NULL; 3728 3729 if (point == NULL) { 3730 fputs("point=(NULL)\n", stderr); 3731 return; 3732 } 3733 if ((x = BN_new()) == NULL || (y = BN_new()) == NULL) { 3734 fprintf(stderr, "%s: BN_new failed\n", __func__); 3735 goto out; 3736 } 3737 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 3738 NID_X9_62_prime_field) { 3739 fprintf(stderr, "%s: group is not a prime field\n", __func__); 3740 goto out; 3741 } 3742 if (EC_POINT_get_affine_coordinates_GFp(group, point, 3743 x, y, NULL) != 1) { 3744 fprintf(stderr, "%s: EC_POINT_get_affine_coordinates_GFp\n", 3745 __func__); 3746 goto out; 3747 } 3748 fputs("x=", stderr); 3749 BN_print_fp(stderr, x); 3750 fputs("\ny=", stderr); 3751 BN_print_fp(stderr, y); 3752 fputs("\n", stderr); 3753 out: 3754 BN_clear_free(x); 3755 BN_clear_free(y); 3756 } 3757 3758 void 3759 sshkey_dump_ec_key(const EC_KEY *key) 3760 { 3761 const BIGNUM *exponent; 3762 3763 sshkey_dump_ec_point(EC_KEY_get0_group(key), 3764 EC_KEY_get0_public_key(key)); 3765 fputs("exponent=", stderr); 3766 if ((exponent = EC_KEY_get0_private_key(key)) == NULL) 3767 fputs("(NULL)", stderr); 3768 else 3769 BN_print_fp(stderr, EC_KEY_get0_private_key(key)); 3770 fputs("\n", stderr); 3771 } 3772 #endif /* WITH_OPENSSL */ 3773 3774 static int 3775 sshkey_private_to_blob2(struct sshkey *prv, struct sshbuf *blob, 3776 const char *passphrase, const char *comment, const char *ciphername, 3777 int rounds) 3778 { 3779 u_char *cp, *key = NULL, *pubkeyblob = NULL; 3780 u_char salt[SALT_LEN]; 3781 char *b64 = NULL; 3782 size_t i, pubkeylen, keylen, ivlen, blocksize, authlen; 3783 u_int check; 3784 int r = SSH_ERR_INTERNAL_ERROR; 3785 struct sshcipher_ctx *ciphercontext = NULL; 3786 const struct sshcipher *cipher; 3787 const char *kdfname = KDFNAME; 3788 struct sshbuf *encoded = NULL, *encrypted = NULL, *kdf = NULL; 3789 3790 if (rounds <= 0) 3791 rounds = DEFAULT_ROUNDS; 3792 if (passphrase == NULL || !strlen(passphrase)) { 3793 ciphername = "none"; 3794 kdfname = "none"; 3795 } else if (ciphername == NULL) 3796 ciphername = DEFAULT_CIPHERNAME; 3797 if ((cipher = cipher_by_name(ciphername)) == NULL) { 3798 r = SSH_ERR_INVALID_ARGUMENT; 3799 goto out; 3800 } 3801 3802 if ((kdf = sshbuf_new()) == NULL || 3803 (encoded = sshbuf_new()) == NULL || 3804 (encrypted = sshbuf_new()) == NULL) { 3805 r = SSH_ERR_ALLOC_FAIL; 3806 goto out; 3807 } 3808 blocksize = cipher_blocksize(cipher); 3809 keylen = cipher_keylen(cipher); 3810 ivlen = cipher_ivlen(cipher); 3811 authlen = cipher_authlen(cipher); 3812 if ((key = calloc(1, keylen + ivlen)) == NULL) { 3813 r = SSH_ERR_ALLOC_FAIL; 3814 goto out; 3815 } 3816 if (strcmp(kdfname, "bcrypt") == 0) { 3817 arc4random_buf(salt, SALT_LEN); 3818 if (bcrypt_pbkdf(passphrase, strlen(passphrase), 3819 salt, SALT_LEN, key, keylen + ivlen, rounds) < 0) { 3820 r = SSH_ERR_INVALID_ARGUMENT; 3821 goto out; 3822 } 3823 if ((r = sshbuf_put_string(kdf, salt, SALT_LEN)) != 0 || 3824 (r = sshbuf_put_u32(kdf, rounds)) != 0) 3825 goto out; 3826 } else if (strcmp(kdfname, "none") != 0) { 3827 /* Unsupported KDF type */ 3828 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3829 goto out; 3830 } 3831 if ((r = cipher_init(&ciphercontext, cipher, key, keylen, 3832 key + keylen, ivlen, 1)) != 0) 3833 goto out; 3834 3835 if ((r = sshbuf_put(encoded, AUTH_MAGIC, sizeof(AUTH_MAGIC))) != 0 || 3836 (r = sshbuf_put_cstring(encoded, ciphername)) != 0 || 3837 (r = sshbuf_put_cstring(encoded, kdfname)) != 0 || 3838 (r = sshbuf_put_stringb(encoded, kdf)) != 0 || 3839 (r = sshbuf_put_u32(encoded, 1)) != 0 || /* number of keys */ 3840 (r = sshkey_to_blob(prv, &pubkeyblob, &pubkeylen)) != 0 || 3841 (r = sshbuf_put_string(encoded, pubkeyblob, pubkeylen)) != 0) 3842 goto out; 3843 3844 /* set up the buffer that will be encrypted */ 3845 3846 /* Random check bytes */ 3847 check = arc4random(); 3848 if ((r = sshbuf_put_u32(encrypted, check)) != 0 || 3849 (r = sshbuf_put_u32(encrypted, check)) != 0) 3850 goto out; 3851 3852 /* append private key and comment*/ 3853 if ((r = sshkey_private_serialize_opt(prv, encrypted, 3854 SSHKEY_SERIALIZE_FULL)) != 0 || 3855 (r = sshbuf_put_cstring(encrypted, comment)) != 0) 3856 goto out; 3857 3858 /* padding */ 3859 i = 0; 3860 while (sshbuf_len(encrypted) % blocksize) { 3861 if ((r = sshbuf_put_u8(encrypted, ++i & 0xff)) != 0) 3862 goto out; 3863 } 3864 3865 /* length in destination buffer */ 3866 if ((r = sshbuf_put_u32(encoded, sshbuf_len(encrypted))) != 0) 3867 goto out; 3868 3869 /* encrypt */ 3870 if ((r = sshbuf_reserve(encoded, 3871 sshbuf_len(encrypted) + authlen, &cp)) != 0) 3872 goto out; 3873 if ((r = cipher_crypt(ciphercontext, 0, cp, 3874 sshbuf_ptr(encrypted), sshbuf_len(encrypted), 0, authlen)) != 0) 3875 goto out; 3876 3877 sshbuf_reset(blob); 3878 3879 /* assemble uuencoded key */ 3880 if ((r = sshbuf_put(blob, MARK_BEGIN, MARK_BEGIN_LEN)) != 0 || 3881 (r = sshbuf_dtob64(encoded, blob, 1)) != 0 || 3882 (r = sshbuf_put(blob, MARK_END, MARK_END_LEN)) != 0) 3883 goto out; 3884 3885 /* success */ 3886 r = 0; 3887 3888 out: 3889 sshbuf_free(kdf); 3890 sshbuf_free(encoded); 3891 sshbuf_free(encrypted); 3892 cipher_free(ciphercontext); 3893 explicit_bzero(salt, sizeof(salt)); 3894 if (key != NULL) 3895 freezero(key, keylen + ivlen); 3896 if (pubkeyblob != NULL) 3897 freezero(pubkeyblob, pubkeylen); 3898 if (b64 != NULL) 3899 freezero(b64, strlen(b64)); 3900 return r; 3901 } 3902 3903 static int 3904 private2_uudecode(struct sshbuf *blob, struct sshbuf **decodedp) 3905 { 3906 const u_char *cp; 3907 size_t encoded_len; 3908 int r; 3909 u_char last; 3910 struct sshbuf *encoded = NULL, *decoded = NULL; 3911 3912 if (blob == NULL || decodedp == NULL) 3913 return SSH_ERR_INVALID_ARGUMENT; 3914 3915 *decodedp = NULL; 3916 3917 if ((encoded = sshbuf_new()) == NULL || 3918 (decoded = sshbuf_new()) == NULL) { 3919 r = SSH_ERR_ALLOC_FAIL; 3920 goto out; 3921 } 3922 3923 /* check preamble */ 3924 cp = sshbuf_ptr(blob); 3925 encoded_len = sshbuf_len(blob); 3926 if (encoded_len < (MARK_BEGIN_LEN + MARK_END_LEN) || 3927 memcmp(cp, MARK_BEGIN, MARK_BEGIN_LEN) != 0) { 3928 r = SSH_ERR_INVALID_FORMAT; 3929 goto out; 3930 } 3931 cp += MARK_BEGIN_LEN; 3932 encoded_len -= MARK_BEGIN_LEN; 3933 3934 /* Look for end marker, removing whitespace as we go */ 3935 while (encoded_len > 0) { 3936 if (*cp != '\n' && *cp != '\r') { 3937 if ((r = sshbuf_put_u8(encoded, *cp)) != 0) 3938 goto out; 3939 } 3940 last = *cp; 3941 encoded_len--; 3942 cp++; 3943 if (last == '\n') { 3944 if (encoded_len >= MARK_END_LEN && 3945 memcmp(cp, MARK_END, MARK_END_LEN) == 0) { 3946 /* \0 terminate */ 3947 if ((r = sshbuf_put_u8(encoded, 0)) != 0) 3948 goto out; 3949 break; 3950 } 3951 } 3952 } 3953 if (encoded_len == 0) { 3954 r = SSH_ERR_INVALID_FORMAT; 3955 goto out; 3956 } 3957 3958 /* decode base64 */ 3959 if ((r = sshbuf_b64tod(decoded, (const char *)sshbuf_ptr(encoded))) != 0) 3960 goto out; 3961 3962 /* check magic */ 3963 if (sshbuf_len(decoded) < sizeof(AUTH_MAGIC) || 3964 memcmp(sshbuf_ptr(decoded), AUTH_MAGIC, sizeof(AUTH_MAGIC))) { 3965 r = SSH_ERR_INVALID_FORMAT; 3966 goto out; 3967 } 3968 /* success */ 3969 *decodedp = decoded; 3970 decoded = NULL; 3971 r = 0; 3972 out: 3973 sshbuf_free(encoded); 3974 sshbuf_free(decoded); 3975 return r; 3976 } 3977 3978 static int 3979 private2_decrypt(struct sshbuf *decoded, const char *passphrase, 3980 struct sshbuf **decryptedp, struct sshkey **pubkeyp) 3981 { 3982 char *ciphername = NULL, *kdfname = NULL; 3983 const struct sshcipher *cipher = NULL; 3984 int r = SSH_ERR_INTERNAL_ERROR; 3985 size_t keylen = 0, ivlen = 0, authlen = 0, slen = 0; 3986 struct sshbuf *kdf = NULL, *decrypted = NULL; 3987 struct sshcipher_ctx *ciphercontext = NULL; 3988 struct sshkey *pubkey = NULL; 3989 u_char *key = NULL, *salt = NULL, *dp; 3990 u_int blocksize, rounds, nkeys, encrypted_len, check1, check2; 3991 3992 if (decoded == NULL || decryptedp == NULL || pubkeyp == NULL) 3993 return SSH_ERR_INVALID_ARGUMENT; 3994 3995 *decryptedp = NULL; 3996 *pubkeyp = NULL; 3997 3998 if ((decrypted = sshbuf_new()) == NULL) { 3999 r = SSH_ERR_ALLOC_FAIL; 4000 goto out; 4001 } 4002 4003 /* parse public portion of key */ 4004 if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC))) != 0 || 4005 (r = sshbuf_get_cstring(decoded, &ciphername, NULL)) != 0 || 4006 (r = sshbuf_get_cstring(decoded, &kdfname, NULL)) != 0 || 4007 (r = sshbuf_froms(decoded, &kdf)) != 0 || 4008 (r = sshbuf_get_u32(decoded, &nkeys)) != 0) 4009 goto out; 4010 4011 if (nkeys != 1) { 4012 /* XXX only one key supported at present */ 4013 r = SSH_ERR_INVALID_FORMAT; 4014 goto out; 4015 } 4016 4017 if ((r = sshkey_froms(decoded, &pubkey)) != 0 || 4018 (r = sshbuf_get_u32(decoded, &encrypted_len)) != 0) 4019 goto out; 4020 4021 if ((cipher = cipher_by_name(ciphername)) == NULL) { 4022 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 4023 goto out; 4024 } 4025 if (strcmp(kdfname, "none") != 0 && strcmp(kdfname, "bcrypt") != 0) { 4026 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 4027 goto out; 4028 } 4029 if (strcmp(kdfname, "none") == 0 && strcmp(ciphername, "none") != 0) { 4030 r = SSH_ERR_INVALID_FORMAT; 4031 goto out; 4032 } 4033 if ((passphrase == NULL || strlen(passphrase) == 0) && 4034 strcmp(kdfname, "none") != 0) { 4035 /* passphrase required */ 4036 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 4037 goto out; 4038 } 4039 4040 /* check size of encrypted key blob */ 4041 blocksize = cipher_blocksize(cipher); 4042 if (encrypted_len < blocksize || (encrypted_len % blocksize) != 0) { 4043 r = SSH_ERR_INVALID_FORMAT; 4044 goto out; 4045 } 4046 4047 /* setup key */ 4048 keylen = cipher_keylen(cipher); 4049 ivlen = cipher_ivlen(cipher); 4050 authlen = cipher_authlen(cipher); 4051 if ((key = calloc(1, keylen + ivlen)) == NULL) { 4052 r = SSH_ERR_ALLOC_FAIL; 4053 goto out; 4054 } 4055 if (strcmp(kdfname, "bcrypt") == 0) { 4056 if ((r = sshbuf_get_string(kdf, &salt, &slen)) != 0 || 4057 (r = sshbuf_get_u32(kdf, &rounds)) != 0) 4058 goto out; 4059 if (bcrypt_pbkdf(passphrase, strlen(passphrase), salt, slen, 4060 key, keylen + ivlen, rounds) < 0) { 4061 r = SSH_ERR_INVALID_FORMAT; 4062 goto out; 4063 } 4064 } 4065 4066 /* check that an appropriate amount of auth data is present */ 4067 if (sshbuf_len(decoded) < authlen || 4068 sshbuf_len(decoded) - authlen < encrypted_len) { 4069 r = SSH_ERR_INVALID_FORMAT; 4070 goto out; 4071 } 4072 4073 /* decrypt private portion of key */ 4074 if ((r = sshbuf_reserve(decrypted, encrypted_len, &dp)) != 0 || 4075 (r = cipher_init(&ciphercontext, cipher, key, keylen, 4076 key + keylen, ivlen, 0)) != 0) 4077 goto out; 4078 if ((r = cipher_crypt(ciphercontext, 0, dp, sshbuf_ptr(decoded), 4079 encrypted_len, 0, authlen)) != 0) { 4080 /* an integrity error here indicates an incorrect passphrase */ 4081 if (r == SSH_ERR_MAC_INVALID) 4082 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 4083 goto out; 4084 } 4085 if ((r = sshbuf_consume(decoded, encrypted_len + authlen)) != 0) 4086 goto out; 4087 /* there should be no trailing data */ 4088 if (sshbuf_len(decoded) != 0) { 4089 r = SSH_ERR_INVALID_FORMAT; 4090 goto out; 4091 } 4092 4093 /* check check bytes */ 4094 if ((r = sshbuf_get_u32(decrypted, &check1)) != 0 || 4095 (r = sshbuf_get_u32(decrypted, &check2)) != 0) 4096 goto out; 4097 if (check1 != check2) { 4098 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 4099 goto out; 4100 } 4101 /* success */ 4102 *decryptedp = decrypted; 4103 decrypted = NULL; 4104 *pubkeyp = pubkey; 4105 pubkey = NULL; 4106 r = 0; 4107 out: 4108 cipher_free(ciphercontext); 4109 free(ciphername); 4110 free(kdfname); 4111 sshkey_free(pubkey); 4112 if (salt != NULL) { 4113 explicit_bzero(salt, slen); 4114 free(salt); 4115 } 4116 if (key != NULL) { 4117 explicit_bzero(key, keylen + ivlen); 4118 free(key); 4119 } 4120 sshbuf_free(kdf); 4121 sshbuf_free(decrypted); 4122 return r; 4123 } 4124 4125 /* Check deterministic padding after private key */ 4126 static int 4127 private2_check_padding(struct sshbuf *decrypted) 4128 { 4129 u_char pad; 4130 size_t i; 4131 int r = SSH_ERR_INTERNAL_ERROR; 4132 4133 i = 0; 4134 while (sshbuf_len(decrypted)) { 4135 if ((r = sshbuf_get_u8(decrypted, &pad)) != 0) 4136 goto out; 4137 if (pad != (++i & 0xff)) { 4138 r = SSH_ERR_INVALID_FORMAT; 4139 goto out; 4140 } 4141 } 4142 /* success */ 4143 r = 0; 4144 out: 4145 explicit_bzero(&pad, sizeof(pad)); 4146 explicit_bzero(&i, sizeof(i)); 4147 return r; 4148 } 4149 4150 static int 4151 sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase, 4152 struct sshkey **keyp, char **commentp) 4153 { 4154 char *comment = NULL; 4155 int r = SSH_ERR_INTERNAL_ERROR; 4156 struct sshbuf *decoded = NULL, *decrypted = NULL; 4157 struct sshkey *k = NULL, *pubkey = NULL; 4158 4159 if (keyp != NULL) 4160 *keyp = NULL; 4161 if (commentp != NULL) 4162 *commentp = NULL; 4163 4164 /* Undo base64 encoding and decrypt the private section */ 4165 if ((r = private2_uudecode(blob, &decoded)) != 0 || 4166 (r = private2_decrypt(decoded, passphrase, 4167 &decrypted, &pubkey)) != 0) 4168 goto out; 4169 4170 if (type != KEY_UNSPEC && 4171 sshkey_type_plain(type) != sshkey_type_plain(pubkey->type)) { 4172 r = SSH_ERR_KEY_TYPE_MISMATCH; 4173 goto out; 4174 } 4175 4176 /* Load the private key and comment */ 4177 if ((r = sshkey_private_deserialize(decrypted, &k)) != 0 || 4178 (r = sshbuf_get_cstring(decrypted, &comment, NULL)) != 0) 4179 goto out; 4180 4181 /* Check deterministic padding after private section */ 4182 if ((r = private2_check_padding(decrypted)) != 0) 4183 goto out; 4184 4185 /* Check that the public key in the envelope matches the private key */ 4186 if (!sshkey_equal(pubkey, k)) { 4187 r = SSH_ERR_INVALID_FORMAT; 4188 goto out; 4189 } 4190 4191 /* success */ 4192 r = 0; 4193 if (keyp != NULL) { 4194 *keyp = k; 4195 k = NULL; 4196 } 4197 if (commentp != NULL) { 4198 *commentp = comment; 4199 comment = NULL; 4200 } 4201 out: 4202 free(comment); 4203 sshbuf_free(decoded); 4204 sshbuf_free(decrypted); 4205 sshkey_free(k); 4206 sshkey_free(pubkey); 4207 return r; 4208 } 4209 4210 static int 4211 sshkey_parse_private2_pubkey(struct sshbuf *blob, int type, 4212 struct sshkey **keyp) 4213 { 4214 int r = SSH_ERR_INTERNAL_ERROR; 4215 struct sshbuf *decoded = NULL; 4216 struct sshkey *pubkey = NULL; 4217 u_int nkeys = 0; 4218 4219 if (keyp != NULL) 4220 *keyp = NULL; 4221 4222 if ((r = private2_uudecode(blob, &decoded)) != 0) 4223 goto out; 4224 /* parse public key from unencrypted envelope */ 4225 if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC))) != 0 || 4226 (r = sshbuf_skip_string(decoded)) != 0 || /* cipher */ 4227 (r = sshbuf_skip_string(decoded)) != 0 || /* KDF alg */ 4228 (r = sshbuf_skip_string(decoded)) != 0 || /* KDF hint */ 4229 (r = sshbuf_get_u32(decoded, &nkeys)) != 0) 4230 goto out; 4231 4232 if (nkeys != 1) { 4233 /* XXX only one key supported at present */ 4234 r = SSH_ERR_INVALID_FORMAT; 4235 goto out; 4236 } 4237 4238 /* Parse the public key */ 4239 if ((r = sshkey_froms(decoded, &pubkey)) != 0) 4240 goto out; 4241 4242 if (type != KEY_UNSPEC && 4243 sshkey_type_plain(type) != sshkey_type_plain(pubkey->type)) { 4244 r = SSH_ERR_KEY_TYPE_MISMATCH; 4245 goto out; 4246 } 4247 4248 /* success */ 4249 r = 0; 4250 if (keyp != NULL) { 4251 *keyp = pubkey; 4252 pubkey = NULL; 4253 } 4254 out: 4255 sshbuf_free(decoded); 4256 sshkey_free(pubkey); 4257 return r; 4258 } 4259 4260 #ifdef WITH_OPENSSL 4261 /* convert SSH v2 key to PEM or PKCS#8 format */ 4262 static int 4263 sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf, 4264 int format, const char *_passphrase, const char *comment) 4265 { 4266 int was_shielded = sshkey_is_shielded(key); 4267 int success, r; 4268 int blen, len = strlen(_passphrase); 4269 u_char *passphrase = (len > 0) ? __UNCONST(_passphrase) : NULL; 4270 const EVP_CIPHER *cipher = (len > 0) ? EVP_aes_128_cbc() : NULL; 4271 char *bptr; 4272 BIO *bio = NULL; 4273 struct sshbuf *blob; 4274 EVP_PKEY *pkey = NULL; 4275 4276 if (len > 0 && len <= 4) 4277 return SSH_ERR_PASSPHRASE_TOO_SHORT; 4278 if ((blob = sshbuf_new()) == NULL) 4279 return SSH_ERR_ALLOC_FAIL; 4280 if ((bio = BIO_new(BIO_s_mem())) == NULL) { 4281 r = SSH_ERR_ALLOC_FAIL; 4282 goto out; 4283 } 4284 if (format == SSHKEY_PRIVATE_PKCS8 && (pkey = EVP_PKEY_new()) == NULL) { 4285 r = SSH_ERR_ALLOC_FAIL; 4286 goto out; 4287 } 4288 if ((r = sshkey_unshield_private(key)) != 0) 4289 goto out; 4290 4291 switch (key->type) { 4292 case KEY_DSA: 4293 if (format == SSHKEY_PRIVATE_PEM) { 4294 success = PEM_write_bio_DSAPrivateKey(bio, key->dsa, 4295 cipher, passphrase, len, NULL, NULL); 4296 } else { 4297 success = EVP_PKEY_set1_DSA(pkey, key->dsa); 4298 } 4299 break; 4300 case KEY_ECDSA: 4301 if (format == SSHKEY_PRIVATE_PEM) { 4302 success = PEM_write_bio_ECPrivateKey(bio, key->ecdsa, 4303 cipher, passphrase, len, NULL, NULL); 4304 } else { 4305 success = EVP_PKEY_set1_EC_KEY(pkey, key->ecdsa); 4306 } 4307 break; 4308 case KEY_RSA: 4309 if (format == SSHKEY_PRIVATE_PEM) { 4310 success = PEM_write_bio_RSAPrivateKey(bio, key->rsa, 4311 cipher, passphrase, len, NULL, NULL); 4312 } else { 4313 success = EVP_PKEY_set1_RSA(pkey, key->rsa); 4314 } 4315 break; 4316 default: 4317 success = 0; 4318 break; 4319 } 4320 if (success == 0) { 4321 r = SSH_ERR_LIBCRYPTO_ERROR; 4322 goto out; 4323 } 4324 if (format == SSHKEY_PRIVATE_PKCS8) { 4325 if ((success = PEM_write_bio_PrivateKey(bio, pkey, cipher, 4326 passphrase, len, NULL, NULL)) == 0) { 4327 r = SSH_ERR_LIBCRYPTO_ERROR; 4328 goto out; 4329 } 4330 } 4331 if ((blen = BIO_get_mem_data(bio, &bptr)) <= 0) { 4332 r = SSH_ERR_INTERNAL_ERROR; 4333 goto out; 4334 } 4335 if ((r = sshbuf_put(blob, bptr, blen)) != 0) 4336 goto out; 4337 r = 0; 4338 out: 4339 if (was_shielded) 4340 r = sshkey_shield_private(key); 4341 if (r == 0) 4342 r = sshbuf_putb(buf, blob); 4343 4344 EVP_PKEY_free(pkey); 4345 sshbuf_free(blob); 4346 BIO_free(bio); 4347 return r; 4348 } 4349 #endif /* WITH_OPENSSL */ 4350 4351 /* Serialise "key" to buffer "blob" */ 4352 int 4353 sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob, 4354 const char *passphrase, const char *comment, 4355 int format, const char *openssh_format_cipher, int openssh_format_rounds) 4356 { 4357 switch (key->type) { 4358 #ifdef WITH_OPENSSL 4359 case KEY_DSA: 4360 case KEY_ECDSA: 4361 case KEY_RSA: 4362 break; /* see below */ 4363 #endif /* WITH_OPENSSL */ 4364 case KEY_ED25519: 4365 case KEY_ED25519_SK: 4366 #ifdef WITH_XMSS 4367 case KEY_XMSS: 4368 #endif /* WITH_XMSS */ 4369 #ifdef WITH_OPENSSL 4370 case KEY_ECDSA_SK: 4371 #endif /* WITH_OPENSSL */ 4372 return sshkey_private_to_blob2(key, blob, passphrase, 4373 comment, openssh_format_cipher, openssh_format_rounds); 4374 default: 4375 return SSH_ERR_KEY_TYPE_UNKNOWN; 4376 } 4377 4378 #ifdef WITH_OPENSSL 4379 switch (format) { 4380 case SSHKEY_PRIVATE_OPENSSH: 4381 return sshkey_private_to_blob2(key, blob, passphrase, 4382 comment, openssh_format_cipher, openssh_format_rounds); 4383 case SSHKEY_PRIVATE_PEM: 4384 case SSHKEY_PRIVATE_PKCS8: 4385 return sshkey_private_to_blob_pem_pkcs8(key, blob, 4386 format, passphrase, comment); 4387 default: 4388 return SSH_ERR_INVALID_ARGUMENT; 4389 } 4390 #endif /* WITH_OPENSSL */ 4391 } 4392 4393 #ifdef WITH_OPENSSL 4394 static int 4395 translate_libcrypto_error(unsigned long pem_err) 4396 { 4397 int pem_reason = ERR_GET_REASON(pem_err); 4398 4399 switch (ERR_GET_LIB(pem_err)) { 4400 case ERR_LIB_PEM: 4401 switch (pem_reason) { 4402 case PEM_R_BAD_PASSWORD_READ: 4403 case PEM_R_PROBLEMS_GETTING_PASSWORD: 4404 case PEM_R_BAD_DECRYPT: 4405 return SSH_ERR_KEY_WRONG_PASSPHRASE; 4406 default: 4407 return SSH_ERR_INVALID_FORMAT; 4408 } 4409 case ERR_LIB_EVP: 4410 switch (pem_reason) { 4411 case EVP_R_BAD_DECRYPT: 4412 return SSH_ERR_KEY_WRONG_PASSPHRASE; 4413 #ifdef EVP_R_BN_DECODE_ERROR 4414 case EVP_R_BN_DECODE_ERROR: 4415 #endif 4416 case EVP_R_DECODE_ERROR: 4417 #ifdef EVP_R_PRIVATE_KEY_DECODE_ERROR 4418 case EVP_R_PRIVATE_KEY_DECODE_ERROR: 4419 #endif 4420 return SSH_ERR_INVALID_FORMAT; 4421 default: 4422 return SSH_ERR_LIBCRYPTO_ERROR; 4423 } 4424 case ERR_LIB_ASN1: 4425 return SSH_ERR_INVALID_FORMAT; 4426 } 4427 return SSH_ERR_LIBCRYPTO_ERROR; 4428 } 4429 4430 static void 4431 clear_libcrypto_errors(void) 4432 { 4433 while (ERR_get_error() != 0) 4434 ; 4435 } 4436 4437 /* 4438 * Translate OpenSSL error codes to determine whether 4439 * passphrase is required/incorrect. 4440 */ 4441 static int 4442 convert_libcrypto_error(void) 4443 { 4444 /* 4445 * Some password errors are reported at the beginning 4446 * of the error queue. 4447 */ 4448 if (translate_libcrypto_error(ERR_peek_error()) == 4449 SSH_ERR_KEY_WRONG_PASSPHRASE) 4450 return SSH_ERR_KEY_WRONG_PASSPHRASE; 4451 return translate_libcrypto_error(ERR_peek_last_error()); 4452 } 4453 4454 static int 4455 pem_passphrase_cb(char *buf, int size, int rwflag, void *u) 4456 { 4457 char *p = (char *)u; 4458 size_t len; 4459 4460 if (p == NULL || (len = strlen(p)) == 0) 4461 return -1; 4462 if (size < 0 || len > (size_t)size) 4463 return -1; 4464 memcpy(buf, p, len); 4465 return (int)len; 4466 } 4467 4468 static int 4469 sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, 4470 const char *passphrase, struct sshkey **keyp) 4471 { 4472 EVP_PKEY *pk = NULL; 4473 struct sshkey *prv = NULL; 4474 BIO *bio = NULL; 4475 int r; 4476 4477 if (keyp != NULL) 4478 *keyp = NULL; 4479 4480 if ((bio = BIO_new(BIO_s_mem())) == NULL || sshbuf_len(blob) > INT_MAX) 4481 return SSH_ERR_ALLOC_FAIL; 4482 if (BIO_write(bio, sshbuf_ptr(blob), sshbuf_len(blob)) != 4483 (int)sshbuf_len(blob)) { 4484 r = SSH_ERR_ALLOC_FAIL; 4485 goto out; 4486 } 4487 4488 clear_libcrypto_errors(); 4489 if ((pk = PEM_read_bio_PrivateKey(bio, NULL, pem_passphrase_cb, 4490 __UNCONST(passphrase))) == NULL) { 4491 /* 4492 * libcrypto may return various ASN.1 errors when attempting 4493 * to parse a key with an incorrect passphrase. 4494 * Treat all format errors as "incorrect passphrase" if a 4495 * passphrase was supplied. 4496 */ 4497 if (passphrase != NULL && *passphrase != '\0') 4498 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 4499 else 4500 r = convert_libcrypto_error(); 4501 goto out; 4502 } 4503 if (EVP_PKEY_base_id(pk) == EVP_PKEY_RSA && 4504 (type == KEY_UNSPEC || type == KEY_RSA)) { 4505 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 4506 r = SSH_ERR_ALLOC_FAIL; 4507 goto out; 4508 } 4509 prv->rsa = EVP_PKEY_get1_RSA(pk); 4510 prv->type = KEY_RSA; 4511 #ifdef DEBUG_PK 4512 RSA_print_fp(stderr, prv->rsa, 8); 4513 #endif 4514 if (RSA_blinding_on(prv->rsa, NULL) != 1) { 4515 r = SSH_ERR_LIBCRYPTO_ERROR; 4516 goto out; 4517 } 4518 if ((r = check_rsa_length(prv->rsa)) != 0) 4519 goto out; 4520 } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_DSA && 4521 (type == KEY_UNSPEC || type == KEY_DSA)) { 4522 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 4523 r = SSH_ERR_ALLOC_FAIL; 4524 goto out; 4525 } 4526 prv->dsa = EVP_PKEY_get1_DSA(pk); 4527 prv->type = KEY_DSA; 4528 #ifdef DEBUG_PK 4529 DSA_print_fp(stderr, prv->dsa, 8); 4530 #endif 4531 } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC && 4532 (type == KEY_UNSPEC || type == KEY_ECDSA)) { 4533 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 4534 r = SSH_ERR_ALLOC_FAIL; 4535 goto out; 4536 } 4537 prv->ecdsa = EVP_PKEY_get1_EC_KEY(pk); 4538 prv->type = KEY_ECDSA; 4539 prv->ecdsa_nid = sshkey_ecdsa_key_to_nid(prv->ecdsa); 4540 if (prv->ecdsa_nid == -1 || 4541 sshkey_curve_nid_to_name(prv->ecdsa_nid) == NULL || 4542 sshkey_ec_validate_public(EC_KEY_get0_group(prv->ecdsa), 4543 EC_KEY_get0_public_key(prv->ecdsa)) != 0 || 4544 sshkey_ec_validate_private(prv->ecdsa) != 0) { 4545 r = SSH_ERR_INVALID_FORMAT; 4546 goto out; 4547 } 4548 #ifdef DEBUG_PK 4549 if (prv != NULL && prv->ecdsa != NULL) 4550 sshkey_dump_ec_key(prv->ecdsa); 4551 #endif 4552 } else { 4553 r = SSH_ERR_INVALID_FORMAT; 4554 goto out; 4555 } 4556 r = 0; 4557 if (keyp != NULL) { 4558 *keyp = prv; 4559 prv = NULL; 4560 } 4561 out: 4562 BIO_free(bio); 4563 EVP_PKEY_free(pk); 4564 sshkey_free(prv); 4565 return r; 4566 } 4567 #endif /* WITH_OPENSSL */ 4568 4569 int 4570 sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type, 4571 const char *passphrase, struct sshkey **keyp, char **commentp) 4572 { 4573 int r = SSH_ERR_INTERNAL_ERROR; 4574 4575 if (keyp != NULL) 4576 *keyp = NULL; 4577 if (commentp != NULL) 4578 *commentp = NULL; 4579 4580 switch (type) { 4581 case KEY_ED25519: 4582 case KEY_XMSS: 4583 /* No fallback for new-format-only keys */ 4584 return sshkey_parse_private2(blob, type, passphrase, 4585 keyp, commentp); 4586 default: 4587 r = sshkey_parse_private2(blob, type, passphrase, keyp, 4588 commentp); 4589 /* Only fallback to PEM parser if a format error occurred. */ 4590 if (r != SSH_ERR_INVALID_FORMAT) 4591 return r; 4592 #ifdef WITH_OPENSSL 4593 return sshkey_parse_private_pem_fileblob(blob, type, 4594 passphrase, keyp); 4595 #else 4596 return SSH_ERR_INVALID_FORMAT; 4597 #endif /* WITH_OPENSSL */ 4598 } 4599 } 4600 4601 int 4602 sshkey_parse_private_fileblob(struct sshbuf *buffer, const char *passphrase, 4603 struct sshkey **keyp, char **commentp) 4604 { 4605 if (keyp != NULL) 4606 *keyp = NULL; 4607 if (commentp != NULL) 4608 *commentp = NULL; 4609 4610 return sshkey_parse_private_fileblob_type(buffer, KEY_UNSPEC, 4611 passphrase, keyp, commentp); 4612 } 4613 4614 void 4615 sshkey_sig_details_free(struct sshkey_sig_details *details) 4616 { 4617 freezero(details, sizeof(*details)); 4618 } 4619 4620 int 4621 sshkey_parse_pubkey_from_private_fileblob_type(struct sshbuf *blob, int type, 4622 struct sshkey **pubkeyp) 4623 { 4624 int r = SSH_ERR_INTERNAL_ERROR; 4625 4626 if (pubkeyp != NULL) 4627 *pubkeyp = NULL; 4628 /* only new-format private keys bundle a public key inside */ 4629 if ((r = sshkey_parse_private2_pubkey(blob, type, pubkeyp)) != 0) 4630 return r; 4631 return 0; 4632 } 4633 4634 #ifdef WITH_XMSS 4635 /* 4636 * serialize the key with the current state and forward the state 4637 * maxsign times. 4638 */ 4639 int 4640 sshkey_private_serialize_maxsign(struct sshkey *k, struct sshbuf *b, 4641 u_int32_t maxsign, sshkey_printfn *pr) 4642 { 4643 int r, rupdate; 4644 4645 if (maxsign == 0 || 4646 sshkey_type_plain(k->type) != KEY_XMSS) 4647 return sshkey_private_serialize_opt(k, b, 4648 SSHKEY_SERIALIZE_DEFAULT); 4649 if ((r = sshkey_xmss_get_state(k, pr)) != 0 || 4650 (r = sshkey_private_serialize_opt(k, b, 4651 SSHKEY_SERIALIZE_STATE)) != 0 || 4652 (r = sshkey_xmss_forward_state(k, maxsign)) != 0) 4653 goto out; 4654 r = 0; 4655 out: 4656 if ((rupdate = sshkey_xmss_update_state(k, pr)) != 0) { 4657 if (r == 0) 4658 r = rupdate; 4659 } 4660 return r; 4661 } 4662 4663 u_int32_t 4664 sshkey_signatures_left(const struct sshkey *k) 4665 { 4666 if (sshkey_type_plain(k->type) == KEY_XMSS) 4667 return sshkey_xmss_signatures_left(k); 4668 return 0; 4669 } 4670 4671 int 4672 sshkey_enable_maxsign(struct sshkey *k, u_int32_t maxsign) 4673 { 4674 if (sshkey_type_plain(k->type) != KEY_XMSS) 4675 return SSH_ERR_INVALID_ARGUMENT; 4676 return sshkey_xmss_enable_maxsign(k, maxsign); 4677 } 4678 4679 int 4680 sshkey_set_filename(struct sshkey *k, const char *filename) 4681 { 4682 if (k == NULL) 4683 return SSH_ERR_INVALID_ARGUMENT; 4684 if (sshkey_type_plain(k->type) != KEY_XMSS) 4685 return 0; 4686 if (filename == NULL) 4687 return SSH_ERR_INVALID_ARGUMENT; 4688 if ((k->xmss_filename = strdup(filename)) == NULL) 4689 return SSH_ERR_ALLOC_FAIL; 4690 return 0; 4691 } 4692 #else 4693 int 4694 sshkey_private_serialize_maxsign(struct sshkey *k, struct sshbuf *b, 4695 u_int32_t maxsign, sshkey_printfn *pr) 4696 { 4697 return sshkey_private_serialize_opt(k, b, SSHKEY_SERIALIZE_DEFAULT); 4698 } 4699 4700 u_int32_t 4701 sshkey_signatures_left(const struct sshkey *k) 4702 { 4703 return 0; 4704 } 4705 4706 int 4707 sshkey_enable_maxsign(struct sshkey *k, u_int32_t maxsign) 4708 { 4709 return SSH_ERR_INVALID_ARGUMENT; 4710 } 4711 4712 int 4713 sshkey_set_filename(struct sshkey *k, const char *filename) 4714 { 4715 if (k == NULL) 4716 return SSH_ERR_INVALID_ARGUMENT; 4717 return 0; 4718 } 4719 #endif /* WITH_XMSS */ 4720