1 /* $OpenBSD: sshkey.c,v 1.100 2020/02/26 13:40:09 jsg Exp $ */ 2 /* 3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 4 * Copyright (c) 2008 Alexander von Gernler. All rights reserved. 5 * Copyright (c) 2010,2011 Damien Miller. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <sys/types.h> 29 #include <netinet/in.h> 30 31 #ifdef WITH_OPENSSL 32 #include <openssl/evp.h> 33 #include <openssl/err.h> 34 #include <openssl/pem.h> 35 #endif 36 37 #include "crypto_api.h" 38 39 #include <errno.h> 40 #include <stdio.h> 41 #include <string.h> 42 #include <util.h> 43 #include <limits.h> 44 #include <resolv.h> 45 46 #include "ssh2.h" 47 #include "ssherr.h" 48 #include "misc.h" 49 #include "sshbuf.h" 50 #include "cipher.h" 51 #include "digest.h" 52 #define SSHKEY_INTERNAL 53 #include "sshkey.h" 54 #include "match.h" 55 #include "ssh-sk.h" 56 57 #ifdef WITH_XMSS 58 #include "sshkey-xmss.h" 59 #include "xmss_fast.h" 60 #endif 61 62 /* openssh private key file format */ 63 #define MARK_BEGIN "-----BEGIN OPENSSH PRIVATE KEY-----\n" 64 #define MARK_END "-----END OPENSSH PRIVATE KEY-----\n" 65 #define MARK_BEGIN_LEN (sizeof(MARK_BEGIN) - 1) 66 #define MARK_END_LEN (sizeof(MARK_END) - 1) 67 #define KDFNAME "bcrypt" 68 #define AUTH_MAGIC "openssh-key-v1" 69 #define SALT_LEN 16 70 #define DEFAULT_CIPHERNAME "aes256-ctr" 71 #define DEFAULT_ROUNDS 16 72 73 /* Version identification string for SSH v1 identity files. */ 74 #define LEGACY_BEGIN "SSH PRIVATE KEY FILE FORMAT 1.1\n" 75 76 /* 77 * Constants relating to "shielding" support; protection of keys expected 78 * to remain in memory for long durations 79 */ 80 #define SSHKEY_SHIELD_PREKEY_LEN (16 * 1024) 81 #define SSHKEY_SHIELD_CIPHER "aes256-ctr" /* XXX want AES-EME* */ 82 #define SSHKEY_SHIELD_PREKEY_HASH SSH_DIGEST_SHA512 83 84 int sshkey_private_serialize_opt(struct sshkey *key, 85 struct sshbuf *buf, enum sshkey_serialize_rep); 86 static int sshkey_from_blob_internal(struct sshbuf *buf, 87 struct sshkey **keyp, int allow_cert); 88 89 /* Supported key types */ 90 struct keytype { 91 const char *name; 92 const char *shortname; 93 const char *sigalg; 94 int type; 95 int nid; 96 int cert; 97 int sigonly; 98 }; 99 static const struct keytype keytypes[] = { 100 { "ssh-ed25519", "ED25519", NULL, KEY_ED25519, 0, 0, 0 }, 101 { "ssh-ed25519-cert-v01@openssh.com", "ED25519-CERT", NULL, 102 KEY_ED25519_CERT, 0, 1, 0 }, 103 { "sk-ssh-ed25519@openssh.com", "ED25519-SK", NULL, 104 KEY_ED25519_SK, 0, 0, 0 }, 105 { "sk-ssh-ed25519-cert-v01@openssh.com", "ED25519-SK-CERT", NULL, 106 KEY_ED25519_SK_CERT, 0, 1, 0 }, 107 #ifdef WITH_XMSS 108 { "ssh-xmss@openssh.com", "XMSS", NULL, KEY_XMSS, 0, 0, 0 }, 109 { "ssh-xmss-cert-v01@openssh.com", "XMSS-CERT", NULL, 110 KEY_XMSS_CERT, 0, 1, 0 }, 111 #endif /* WITH_XMSS */ 112 #ifdef WITH_OPENSSL 113 { "ssh-rsa", "RSA", NULL, KEY_RSA, 0, 0, 0 }, 114 { "rsa-sha2-256", "RSA", NULL, KEY_RSA, 0, 0, 1 }, 115 { "rsa-sha2-512", "RSA", NULL, KEY_RSA, 0, 0, 1 }, 116 { "ssh-dss", "DSA", NULL, KEY_DSA, 0, 0, 0 }, 117 { "ecdsa-sha2-nistp256", "ECDSA", NULL, 118 KEY_ECDSA, NID_X9_62_prime256v1, 0, 0 }, 119 { "ecdsa-sha2-nistp384", "ECDSA", NULL, 120 KEY_ECDSA, NID_secp384r1, 0, 0 }, 121 { "ecdsa-sha2-nistp521", "ECDSA", NULL, 122 KEY_ECDSA, NID_secp521r1, 0, 0 }, 123 { "sk-ecdsa-sha2-nistp256@openssh.com", "ECDSA-SK", NULL, 124 KEY_ECDSA_SK, NID_X9_62_prime256v1, 0, 0 }, 125 { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", NULL, 126 KEY_RSA_CERT, 0, 1, 0 }, 127 { "rsa-sha2-256-cert-v01@openssh.com", "RSA-CERT", 128 "rsa-sha2-256", KEY_RSA_CERT, 0, 1, 1 }, 129 { "rsa-sha2-512-cert-v01@openssh.com", "RSA-CERT", 130 "rsa-sha2-512", KEY_RSA_CERT, 0, 1, 1 }, 131 { "ssh-dss-cert-v01@openssh.com", "DSA-CERT", NULL, 132 KEY_DSA_CERT, 0, 1, 0 }, 133 { "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-CERT", NULL, 134 KEY_ECDSA_CERT, NID_X9_62_prime256v1, 1, 0 }, 135 { "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ECDSA-CERT", NULL, 136 KEY_ECDSA_CERT, NID_secp384r1, 1, 0 }, 137 { "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ECDSA-CERT", NULL, 138 KEY_ECDSA_CERT, NID_secp521r1, 1, 0 }, 139 { "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-SK-CERT", NULL, 140 KEY_ECDSA_SK_CERT, NID_X9_62_prime256v1, 1, 0 }, 141 #endif /* WITH_OPENSSL */ 142 { NULL, NULL, NULL, -1, -1, 0, 0 } 143 }; 144 145 const char * 146 sshkey_type(const struct sshkey *k) 147 { 148 const struct keytype *kt; 149 150 for (kt = keytypes; kt->type != -1; kt++) { 151 if (kt->type == k->type) 152 return kt->shortname; 153 } 154 return "unknown"; 155 } 156 157 static const char * 158 sshkey_ssh_name_from_type_nid(int type, int nid) 159 { 160 const struct keytype *kt; 161 162 for (kt = keytypes; kt->type != -1; kt++) { 163 if (kt->type == type && (kt->nid == 0 || kt->nid == nid)) 164 return kt->name; 165 } 166 return "ssh-unknown"; 167 } 168 169 int 170 sshkey_type_is_cert(int type) 171 { 172 const struct keytype *kt; 173 174 for (kt = keytypes; kt->type != -1; kt++) { 175 if (kt->type == type) 176 return kt->cert; 177 } 178 return 0; 179 } 180 181 const char * 182 sshkey_ssh_name(const struct sshkey *k) 183 { 184 return sshkey_ssh_name_from_type_nid(k->type, k->ecdsa_nid); 185 } 186 187 const char * 188 sshkey_ssh_name_plain(const struct sshkey *k) 189 { 190 return sshkey_ssh_name_from_type_nid(sshkey_type_plain(k->type), 191 k->ecdsa_nid); 192 } 193 194 int 195 sshkey_type_from_name(const char *name) 196 { 197 const struct keytype *kt; 198 199 for (kt = keytypes; kt->type != -1; kt++) { 200 /* Only allow shortname matches for plain key types */ 201 if ((kt->name != NULL && strcmp(name, kt->name) == 0) || 202 (!kt->cert && strcasecmp(kt->shortname, name) == 0)) 203 return kt->type; 204 } 205 return KEY_UNSPEC; 206 } 207 208 static int 209 key_type_is_ecdsa_variant(int type) 210 { 211 switch (type) { 212 case KEY_ECDSA: 213 case KEY_ECDSA_CERT: 214 case KEY_ECDSA_SK: 215 case KEY_ECDSA_SK_CERT: 216 return 1; 217 } 218 return 0; 219 } 220 221 int 222 sshkey_ecdsa_nid_from_name(const char *name) 223 { 224 const struct keytype *kt; 225 226 for (kt = keytypes; kt->type != -1; kt++) { 227 if (!key_type_is_ecdsa_variant(kt->type)) 228 continue; 229 if (kt->name != NULL && strcmp(name, kt->name) == 0) 230 return kt->nid; 231 } 232 return -1; 233 } 234 235 char * 236 sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep) 237 { 238 char *tmp, *ret = NULL; 239 size_t nlen, rlen = 0; 240 const struct keytype *kt; 241 242 for (kt = keytypes; kt->type != -1; kt++) { 243 if (kt->name == NULL) 244 continue; 245 if (!include_sigonly && kt->sigonly) 246 continue; 247 if ((certs_only && !kt->cert) || (plain_only && kt->cert)) 248 continue; 249 if (ret != NULL) 250 ret[rlen++] = sep; 251 nlen = strlen(kt->name); 252 if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) { 253 free(ret); 254 return NULL; 255 } 256 ret = tmp; 257 memcpy(ret + rlen, kt->name, nlen + 1); 258 rlen += nlen; 259 } 260 return ret; 261 } 262 263 int 264 sshkey_names_valid2(const char *names, int allow_wildcard) 265 { 266 char *s, *cp, *p; 267 const struct keytype *kt; 268 int type; 269 270 if (names == NULL || strcmp(names, "") == 0) 271 return 0; 272 if ((s = cp = strdup(names)) == NULL) 273 return 0; 274 for ((p = strsep(&cp, ",")); p && *p != '\0'; 275 (p = strsep(&cp, ","))) { 276 type = sshkey_type_from_name(p); 277 if (type == KEY_UNSPEC) { 278 if (allow_wildcard) { 279 /* 280 * Try matching key types against the string. 281 * If any has a positive or negative match then 282 * the component is accepted. 283 */ 284 for (kt = keytypes; kt->type != -1; kt++) { 285 if (match_pattern_list(kt->name, 286 p, 0) != 0) 287 break; 288 } 289 if (kt->type != -1) 290 continue; 291 } 292 free(s); 293 return 0; 294 } 295 } 296 free(s); 297 return 1; 298 } 299 300 u_int 301 sshkey_size(const struct sshkey *k) 302 { 303 #ifdef WITH_OPENSSL 304 const BIGNUM *rsa_n, *dsa_p; 305 #endif /* WITH_OPENSSL */ 306 307 switch (k->type) { 308 #ifdef WITH_OPENSSL 309 case KEY_RSA: 310 case KEY_RSA_CERT: 311 if (k->rsa == NULL) 312 return 0; 313 RSA_get0_key(k->rsa, &rsa_n, NULL, NULL); 314 return BN_num_bits(rsa_n); 315 case KEY_DSA: 316 case KEY_DSA_CERT: 317 if (k->dsa == NULL) 318 return 0; 319 DSA_get0_pqg(k->dsa, &dsa_p, NULL, NULL); 320 return BN_num_bits(dsa_p); 321 case KEY_ECDSA: 322 case KEY_ECDSA_CERT: 323 case KEY_ECDSA_SK: 324 case KEY_ECDSA_SK_CERT: 325 return sshkey_curve_nid_to_bits(k->ecdsa_nid); 326 #endif /* WITH_OPENSSL */ 327 case KEY_ED25519: 328 case KEY_ED25519_CERT: 329 case KEY_ED25519_SK: 330 case KEY_ED25519_SK_CERT: 331 case KEY_XMSS: 332 case KEY_XMSS_CERT: 333 return 256; /* XXX */ 334 } 335 return 0; 336 } 337 338 static int 339 sshkey_type_is_valid_ca(int type) 340 { 341 switch (type) { 342 case KEY_RSA: 343 case KEY_DSA: 344 case KEY_ECDSA: 345 case KEY_ECDSA_SK: 346 case KEY_ED25519: 347 case KEY_ED25519_SK: 348 case KEY_XMSS: 349 return 1; 350 default: 351 return 0; 352 } 353 } 354 355 int 356 sshkey_is_cert(const struct sshkey *k) 357 { 358 if (k == NULL) 359 return 0; 360 return sshkey_type_is_cert(k->type); 361 } 362 363 int 364 sshkey_is_sk(const struct sshkey *k) 365 { 366 if (k == NULL) 367 return 0; 368 switch (sshkey_type_plain(k->type)) { 369 case KEY_ECDSA_SK: 370 case KEY_ED25519_SK: 371 return 1; 372 default: 373 return 0; 374 } 375 } 376 377 /* Return the cert-less equivalent to a certified key type */ 378 int 379 sshkey_type_plain(int type) 380 { 381 switch (type) { 382 case KEY_RSA_CERT: 383 return KEY_RSA; 384 case KEY_DSA_CERT: 385 return KEY_DSA; 386 case KEY_ECDSA_CERT: 387 return KEY_ECDSA; 388 case KEY_ECDSA_SK_CERT: 389 return KEY_ECDSA_SK; 390 case KEY_ED25519_CERT: 391 return KEY_ED25519; 392 case KEY_ED25519_SK_CERT: 393 return KEY_ED25519_SK; 394 case KEY_XMSS_CERT: 395 return KEY_XMSS; 396 default: 397 return type; 398 } 399 } 400 401 #ifdef WITH_OPENSSL 402 /* XXX: these are really begging for a table-driven approach */ 403 int 404 sshkey_curve_name_to_nid(const char *name) 405 { 406 if (strcmp(name, "nistp256") == 0) 407 return NID_X9_62_prime256v1; 408 else if (strcmp(name, "nistp384") == 0) 409 return NID_secp384r1; 410 else if (strcmp(name, "nistp521") == 0) 411 return NID_secp521r1; 412 else 413 return -1; 414 } 415 416 u_int 417 sshkey_curve_nid_to_bits(int nid) 418 { 419 switch (nid) { 420 case NID_X9_62_prime256v1: 421 return 256; 422 case NID_secp384r1: 423 return 384; 424 case NID_secp521r1: 425 return 521; 426 default: 427 return 0; 428 } 429 } 430 431 int 432 sshkey_ecdsa_bits_to_nid(int bits) 433 { 434 switch (bits) { 435 case 256: 436 return NID_X9_62_prime256v1; 437 case 384: 438 return NID_secp384r1; 439 case 521: 440 return NID_secp521r1; 441 default: 442 return -1; 443 } 444 } 445 446 const char * 447 sshkey_curve_nid_to_name(int nid) 448 { 449 switch (nid) { 450 case NID_X9_62_prime256v1: 451 return "nistp256"; 452 case NID_secp384r1: 453 return "nistp384"; 454 case NID_secp521r1: 455 return "nistp521"; 456 default: 457 return NULL; 458 } 459 } 460 461 int 462 sshkey_ec_nid_to_hash_alg(int nid) 463 { 464 int kbits = sshkey_curve_nid_to_bits(nid); 465 466 if (kbits <= 0) 467 return -1; 468 469 /* RFC5656 section 6.2.1 */ 470 if (kbits <= 256) 471 return SSH_DIGEST_SHA256; 472 else if (kbits <= 384) 473 return SSH_DIGEST_SHA384; 474 else 475 return SSH_DIGEST_SHA512; 476 } 477 #endif /* WITH_OPENSSL */ 478 479 static void 480 cert_free(struct sshkey_cert *cert) 481 { 482 u_int i; 483 484 if (cert == NULL) 485 return; 486 sshbuf_free(cert->certblob); 487 sshbuf_free(cert->critical); 488 sshbuf_free(cert->extensions); 489 free(cert->key_id); 490 for (i = 0; i < cert->nprincipals; i++) 491 free(cert->principals[i]); 492 free(cert->principals); 493 sshkey_free(cert->signature_key); 494 free(cert->signature_type); 495 freezero(cert, sizeof(*cert)); 496 } 497 498 static struct sshkey_cert * 499 cert_new(void) 500 { 501 struct sshkey_cert *cert; 502 503 if ((cert = calloc(1, sizeof(*cert))) == NULL) 504 return NULL; 505 if ((cert->certblob = sshbuf_new()) == NULL || 506 (cert->critical = sshbuf_new()) == NULL || 507 (cert->extensions = sshbuf_new()) == NULL) { 508 cert_free(cert); 509 return NULL; 510 } 511 cert->key_id = NULL; 512 cert->principals = NULL; 513 cert->signature_key = NULL; 514 cert->signature_type = NULL; 515 return cert; 516 } 517 518 struct sshkey * 519 sshkey_new(int type) 520 { 521 struct sshkey *k; 522 #ifdef WITH_OPENSSL 523 RSA *rsa; 524 DSA *dsa; 525 #endif /* WITH_OPENSSL */ 526 527 if ((k = calloc(1, sizeof(*k))) == NULL) 528 return NULL; 529 k->type = type; 530 k->ecdsa = NULL; 531 k->ecdsa_nid = -1; 532 k->dsa = NULL; 533 k->rsa = NULL; 534 k->cert = NULL; 535 k->ed25519_sk = NULL; 536 k->ed25519_pk = NULL; 537 k->xmss_sk = NULL; 538 k->xmss_pk = NULL; 539 switch (k->type) { 540 #ifdef WITH_OPENSSL 541 case KEY_RSA: 542 case KEY_RSA_CERT: 543 if ((rsa = RSA_new()) == NULL) { 544 free(k); 545 return NULL; 546 } 547 k->rsa = rsa; 548 break; 549 case KEY_DSA: 550 case KEY_DSA_CERT: 551 if ((dsa = DSA_new()) == NULL) { 552 free(k); 553 return NULL; 554 } 555 k->dsa = dsa; 556 break; 557 case KEY_ECDSA: 558 case KEY_ECDSA_CERT: 559 case KEY_ECDSA_SK: 560 case KEY_ECDSA_SK_CERT: 561 /* Cannot do anything until we know the group */ 562 break; 563 #endif /* WITH_OPENSSL */ 564 case KEY_ED25519: 565 case KEY_ED25519_CERT: 566 case KEY_ED25519_SK: 567 case KEY_ED25519_SK_CERT: 568 case KEY_XMSS: 569 case KEY_XMSS_CERT: 570 /* no need to prealloc */ 571 break; 572 case KEY_UNSPEC: 573 break; 574 default: 575 free(k); 576 return NULL; 577 } 578 579 if (sshkey_is_cert(k)) { 580 if ((k->cert = cert_new()) == NULL) { 581 sshkey_free(k); 582 return NULL; 583 } 584 } 585 586 return k; 587 } 588 589 void 590 sshkey_free(struct sshkey *k) 591 { 592 if (k == NULL) 593 return; 594 switch (k->type) { 595 #ifdef WITH_OPENSSL 596 case KEY_RSA: 597 case KEY_RSA_CERT: 598 RSA_free(k->rsa); 599 k->rsa = NULL; 600 break; 601 case KEY_DSA: 602 case KEY_DSA_CERT: 603 DSA_free(k->dsa); 604 k->dsa = NULL; 605 break; 606 case KEY_ECDSA_SK: 607 case KEY_ECDSA_SK_CERT: 608 free(k->sk_application); 609 sshbuf_free(k->sk_key_handle); 610 sshbuf_free(k->sk_reserved); 611 /* FALLTHROUGH */ 612 case KEY_ECDSA: 613 case KEY_ECDSA_CERT: 614 EC_KEY_free(k->ecdsa); 615 k->ecdsa = NULL; 616 break; 617 #endif /* WITH_OPENSSL */ 618 case KEY_ED25519_SK: 619 case KEY_ED25519_SK_CERT: 620 free(k->sk_application); 621 sshbuf_free(k->sk_key_handle); 622 sshbuf_free(k->sk_reserved); 623 /* FALLTHROUGH */ 624 case KEY_ED25519: 625 case KEY_ED25519_CERT: 626 freezero(k->ed25519_pk, ED25519_PK_SZ); 627 k->ed25519_pk = NULL; 628 freezero(k->ed25519_sk, ED25519_SK_SZ); 629 k->ed25519_sk = NULL; 630 break; 631 #ifdef WITH_XMSS 632 case KEY_XMSS: 633 case KEY_XMSS_CERT: 634 freezero(k->xmss_pk, sshkey_xmss_pklen(k)); 635 k->xmss_pk = NULL; 636 freezero(k->xmss_sk, sshkey_xmss_sklen(k)); 637 k->xmss_sk = NULL; 638 sshkey_xmss_free_state(k); 639 free(k->xmss_name); 640 k->xmss_name = NULL; 641 free(k->xmss_filename); 642 k->xmss_filename = NULL; 643 break; 644 #endif /* WITH_XMSS */ 645 case KEY_UNSPEC: 646 break; 647 default: 648 break; 649 } 650 if (sshkey_is_cert(k)) 651 cert_free(k->cert); 652 freezero(k->shielded_private, k->shielded_len); 653 freezero(k->shield_prekey, k->shield_prekey_len); 654 freezero(k, sizeof(*k)); 655 } 656 657 static int 658 cert_compare(struct sshkey_cert *a, struct sshkey_cert *b) 659 { 660 if (a == NULL && b == NULL) 661 return 1; 662 if (a == NULL || b == NULL) 663 return 0; 664 if (sshbuf_len(a->certblob) != sshbuf_len(b->certblob)) 665 return 0; 666 if (timingsafe_bcmp(sshbuf_ptr(a->certblob), sshbuf_ptr(b->certblob), 667 sshbuf_len(a->certblob)) != 0) 668 return 0; 669 return 1; 670 } 671 672 /* 673 * Compare public portions of key only, allowing comparisons between 674 * certificates and plain keys too. 675 */ 676 int 677 sshkey_equal_public(const struct sshkey *a, const struct sshkey *b) 678 { 679 #ifdef WITH_OPENSSL 680 const BIGNUM *rsa_e_a, *rsa_n_a; 681 const BIGNUM *rsa_e_b, *rsa_n_b; 682 const BIGNUM *dsa_p_a, *dsa_q_a, *dsa_g_a, *dsa_pub_key_a; 683 const BIGNUM *dsa_p_b, *dsa_q_b, *dsa_g_b, *dsa_pub_key_b; 684 #endif /* WITH_OPENSSL */ 685 686 if (a == NULL || b == NULL || 687 sshkey_type_plain(a->type) != sshkey_type_plain(b->type)) 688 return 0; 689 690 switch (a->type) { 691 #ifdef WITH_OPENSSL 692 case KEY_RSA_CERT: 693 case KEY_RSA: 694 if (a->rsa == NULL || b->rsa == NULL) 695 return 0; 696 RSA_get0_key(a->rsa, &rsa_n_a, &rsa_e_a, NULL); 697 RSA_get0_key(b->rsa, &rsa_n_b, &rsa_e_b, NULL); 698 return BN_cmp(rsa_e_a, rsa_e_b) == 0 && 699 BN_cmp(rsa_n_a, rsa_n_b) == 0; 700 case KEY_DSA_CERT: 701 case KEY_DSA: 702 if (a->dsa == NULL || b->dsa == NULL) 703 return 0; 704 DSA_get0_pqg(a->dsa, &dsa_p_a, &dsa_q_a, &dsa_g_a); 705 DSA_get0_pqg(b->dsa, &dsa_p_b, &dsa_q_b, &dsa_g_b); 706 DSA_get0_key(a->dsa, &dsa_pub_key_a, NULL); 707 DSA_get0_key(b->dsa, &dsa_pub_key_b, NULL); 708 return BN_cmp(dsa_p_a, dsa_p_b) == 0 && 709 BN_cmp(dsa_q_a, dsa_q_b) == 0 && 710 BN_cmp(dsa_g_a, dsa_g_b) == 0 && 711 BN_cmp(dsa_pub_key_a, dsa_pub_key_b) == 0; 712 case KEY_ECDSA_SK: 713 case KEY_ECDSA_SK_CERT: 714 if (a->sk_application == NULL || b->sk_application == NULL) 715 return 0; 716 if (strcmp(a->sk_application, b->sk_application) != 0) 717 return 0; 718 /* FALLTHROUGH */ 719 case KEY_ECDSA_CERT: 720 case KEY_ECDSA: 721 if (a->ecdsa == NULL || b->ecdsa == NULL || 722 EC_KEY_get0_public_key(a->ecdsa) == NULL || 723 EC_KEY_get0_public_key(b->ecdsa) == NULL) 724 return 0; 725 if (EC_GROUP_cmp(EC_KEY_get0_group(a->ecdsa), 726 EC_KEY_get0_group(b->ecdsa), NULL) != 0 || 727 EC_POINT_cmp(EC_KEY_get0_group(a->ecdsa), 728 EC_KEY_get0_public_key(a->ecdsa), 729 EC_KEY_get0_public_key(b->ecdsa), NULL) != 0) 730 return 0; 731 return 1; 732 #endif /* WITH_OPENSSL */ 733 case KEY_ED25519_SK: 734 case KEY_ED25519_SK_CERT: 735 if (a->sk_application == NULL || b->sk_application == NULL) 736 return 0; 737 if (strcmp(a->sk_application, b->sk_application) != 0) 738 return 0; 739 /* FALLTHROUGH */ 740 case KEY_ED25519: 741 case KEY_ED25519_CERT: 742 return a->ed25519_pk != NULL && b->ed25519_pk != NULL && 743 memcmp(a->ed25519_pk, b->ed25519_pk, ED25519_PK_SZ) == 0; 744 #ifdef WITH_XMSS 745 case KEY_XMSS: 746 case KEY_XMSS_CERT: 747 return a->xmss_pk != NULL && b->xmss_pk != NULL && 748 sshkey_xmss_pklen(a) == sshkey_xmss_pklen(b) && 749 memcmp(a->xmss_pk, b->xmss_pk, sshkey_xmss_pklen(a)) == 0; 750 #endif /* WITH_XMSS */ 751 default: 752 return 0; 753 } 754 /* NOTREACHED */ 755 } 756 757 int 758 sshkey_equal(const struct sshkey *a, const struct sshkey *b) 759 { 760 if (a == NULL || b == NULL || a->type != b->type) 761 return 0; 762 if (sshkey_is_cert(a)) { 763 if (!cert_compare(a->cert, b->cert)) 764 return 0; 765 } 766 return sshkey_equal_public(a, b); 767 } 768 769 static int 770 to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain, 771 enum sshkey_serialize_rep opts) 772 { 773 int type, ret = SSH_ERR_INTERNAL_ERROR; 774 const char *typename; 775 #ifdef WITH_OPENSSL 776 const BIGNUM *rsa_n, *rsa_e, *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key; 777 #endif /* WITH_OPENSSL */ 778 779 if (key == NULL) 780 return SSH_ERR_INVALID_ARGUMENT; 781 782 if (sshkey_is_cert(key)) { 783 if (key->cert == NULL) 784 return SSH_ERR_EXPECTED_CERT; 785 if (sshbuf_len(key->cert->certblob) == 0) 786 return SSH_ERR_KEY_LACKS_CERTBLOB; 787 } 788 type = force_plain ? sshkey_type_plain(key->type) : key->type; 789 typename = sshkey_ssh_name_from_type_nid(type, key->ecdsa_nid); 790 791 switch (type) { 792 #ifdef WITH_OPENSSL 793 case KEY_DSA_CERT: 794 case KEY_ECDSA_CERT: 795 case KEY_ECDSA_SK_CERT: 796 case KEY_RSA_CERT: 797 #endif /* WITH_OPENSSL */ 798 case KEY_ED25519_CERT: 799 case KEY_ED25519_SK_CERT: 800 #ifdef WITH_XMSS 801 case KEY_XMSS_CERT: 802 #endif /* WITH_XMSS */ 803 /* Use the existing blob */ 804 /* XXX modified flag? */ 805 if ((ret = sshbuf_putb(b, key->cert->certblob)) != 0) 806 return ret; 807 break; 808 #ifdef WITH_OPENSSL 809 case KEY_DSA: 810 if (key->dsa == NULL) 811 return SSH_ERR_INVALID_ARGUMENT; 812 DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g); 813 DSA_get0_key(key->dsa, &dsa_pub_key, NULL); 814 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 815 (ret = sshbuf_put_bignum2(b, dsa_p)) != 0 || 816 (ret = sshbuf_put_bignum2(b, dsa_q)) != 0 || 817 (ret = sshbuf_put_bignum2(b, dsa_g)) != 0 || 818 (ret = sshbuf_put_bignum2(b, dsa_pub_key)) != 0) 819 return ret; 820 break; 821 case KEY_ECDSA: 822 case KEY_ECDSA_SK: 823 if (key->ecdsa == NULL) 824 return SSH_ERR_INVALID_ARGUMENT; 825 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 826 (ret = sshbuf_put_cstring(b, 827 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 828 (ret = sshbuf_put_eckey(b, key->ecdsa)) != 0) 829 return ret; 830 if (type == KEY_ECDSA_SK) { 831 if ((ret = sshbuf_put_cstring(b, 832 key->sk_application)) != 0) 833 return ret; 834 } 835 break; 836 case KEY_RSA: 837 if (key->rsa == NULL) 838 return SSH_ERR_INVALID_ARGUMENT; 839 RSA_get0_key(key->rsa, &rsa_n, &rsa_e, NULL); 840 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 841 (ret = sshbuf_put_bignum2(b, rsa_e)) != 0 || 842 (ret = sshbuf_put_bignum2(b, rsa_n)) != 0) 843 return ret; 844 break; 845 #endif /* WITH_OPENSSL */ 846 case KEY_ED25519: 847 case KEY_ED25519_SK: 848 if (key->ed25519_pk == NULL) 849 return SSH_ERR_INVALID_ARGUMENT; 850 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 851 (ret = sshbuf_put_string(b, 852 key->ed25519_pk, ED25519_PK_SZ)) != 0) 853 return ret; 854 if (type == KEY_ED25519_SK) { 855 if ((ret = sshbuf_put_cstring(b, 856 key->sk_application)) != 0) 857 return ret; 858 } 859 break; 860 #ifdef WITH_XMSS 861 case KEY_XMSS: 862 if (key->xmss_name == NULL || key->xmss_pk == NULL || 863 sshkey_xmss_pklen(key) == 0) 864 return SSH_ERR_INVALID_ARGUMENT; 865 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 866 (ret = sshbuf_put_cstring(b, key->xmss_name)) != 0 || 867 (ret = sshbuf_put_string(b, 868 key->xmss_pk, sshkey_xmss_pklen(key))) != 0 || 869 (ret = sshkey_xmss_serialize_pk_info(key, b, opts)) != 0) 870 return ret; 871 break; 872 #endif /* WITH_XMSS */ 873 default: 874 return SSH_ERR_KEY_TYPE_UNKNOWN; 875 } 876 return 0; 877 } 878 879 int 880 sshkey_putb(const struct sshkey *key, struct sshbuf *b) 881 { 882 return to_blob_buf(key, b, 0, SSHKEY_SERIALIZE_DEFAULT); 883 } 884 885 int 886 sshkey_puts_opts(const struct sshkey *key, struct sshbuf *b, 887 enum sshkey_serialize_rep opts) 888 { 889 struct sshbuf *tmp; 890 int r; 891 892 if ((tmp = sshbuf_new()) == NULL) 893 return SSH_ERR_ALLOC_FAIL; 894 r = to_blob_buf(key, tmp, 0, opts); 895 if (r == 0) 896 r = sshbuf_put_stringb(b, tmp); 897 sshbuf_free(tmp); 898 return r; 899 } 900 901 int 902 sshkey_puts(const struct sshkey *key, struct sshbuf *b) 903 { 904 return sshkey_puts_opts(key, b, SSHKEY_SERIALIZE_DEFAULT); 905 } 906 907 int 908 sshkey_putb_plain(const struct sshkey *key, struct sshbuf *b) 909 { 910 return to_blob_buf(key, b, 1, SSHKEY_SERIALIZE_DEFAULT); 911 } 912 913 static int 914 to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp, int force_plain, 915 enum sshkey_serialize_rep opts) 916 { 917 int ret = SSH_ERR_INTERNAL_ERROR; 918 size_t len; 919 struct sshbuf *b = NULL; 920 921 if (lenp != NULL) 922 *lenp = 0; 923 if (blobp != NULL) 924 *blobp = NULL; 925 if ((b = sshbuf_new()) == NULL) 926 return SSH_ERR_ALLOC_FAIL; 927 if ((ret = to_blob_buf(key, b, force_plain, opts)) != 0) 928 goto out; 929 len = sshbuf_len(b); 930 if (lenp != NULL) 931 *lenp = len; 932 if (blobp != NULL) { 933 if ((*blobp = malloc(len)) == NULL) { 934 ret = SSH_ERR_ALLOC_FAIL; 935 goto out; 936 } 937 memcpy(*blobp, sshbuf_ptr(b), len); 938 } 939 ret = 0; 940 out: 941 sshbuf_free(b); 942 return ret; 943 } 944 945 int 946 sshkey_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 947 { 948 return to_blob(key, blobp, lenp, 0, SSHKEY_SERIALIZE_DEFAULT); 949 } 950 951 int 952 sshkey_plain_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 953 { 954 return to_blob(key, blobp, lenp, 1, SSHKEY_SERIALIZE_DEFAULT); 955 } 956 957 int 958 sshkey_fingerprint_raw(const struct sshkey *k, int dgst_alg, 959 u_char **retp, size_t *lenp) 960 { 961 u_char *blob = NULL, *ret = NULL; 962 size_t blob_len = 0; 963 int r = SSH_ERR_INTERNAL_ERROR; 964 965 if (retp != NULL) 966 *retp = NULL; 967 if (lenp != NULL) 968 *lenp = 0; 969 if (ssh_digest_bytes(dgst_alg) == 0) { 970 r = SSH_ERR_INVALID_ARGUMENT; 971 goto out; 972 } 973 if ((r = to_blob(k, &blob, &blob_len, 1, SSHKEY_SERIALIZE_DEFAULT)) 974 != 0) 975 goto out; 976 if ((ret = calloc(1, SSH_DIGEST_MAX_LENGTH)) == NULL) { 977 r = SSH_ERR_ALLOC_FAIL; 978 goto out; 979 } 980 if ((r = ssh_digest_memory(dgst_alg, blob, blob_len, 981 ret, SSH_DIGEST_MAX_LENGTH)) != 0) 982 goto out; 983 /* success */ 984 if (retp != NULL) { 985 *retp = ret; 986 ret = NULL; 987 } 988 if (lenp != NULL) 989 *lenp = ssh_digest_bytes(dgst_alg); 990 r = 0; 991 out: 992 free(ret); 993 if (blob != NULL) 994 freezero(blob, blob_len); 995 return r; 996 } 997 998 static char * 999 fingerprint_b64(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 1000 { 1001 char *ret; 1002 size_t plen = strlen(alg) + 1; 1003 size_t rlen = ((dgst_raw_len + 2) / 3) * 4 + plen + 1; 1004 1005 if (dgst_raw_len > 65536 || (ret = calloc(1, rlen)) == NULL) 1006 return NULL; 1007 strlcpy(ret, alg, rlen); 1008 strlcat(ret, ":", rlen); 1009 if (dgst_raw_len == 0) 1010 return ret; 1011 if (b64_ntop(dgst_raw, dgst_raw_len, ret + plen, rlen - plen) == -1) { 1012 freezero(ret, rlen); 1013 return NULL; 1014 } 1015 /* Trim padding characters from end */ 1016 ret[strcspn(ret, "=")] = '\0'; 1017 return ret; 1018 } 1019 1020 static char * 1021 fingerprint_hex(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 1022 { 1023 char *retval, hex[5]; 1024 size_t i, rlen = dgst_raw_len * 3 + strlen(alg) + 2; 1025 1026 if (dgst_raw_len > 65536 || (retval = calloc(1, rlen)) == NULL) 1027 return NULL; 1028 strlcpy(retval, alg, rlen); 1029 strlcat(retval, ":", rlen); 1030 for (i = 0; i < dgst_raw_len; i++) { 1031 snprintf(hex, sizeof(hex), "%s%02x", 1032 i > 0 ? ":" : "", dgst_raw[i]); 1033 strlcat(retval, hex, rlen); 1034 } 1035 return retval; 1036 } 1037 1038 static char * 1039 fingerprint_bubblebabble(u_char *dgst_raw, size_t dgst_raw_len) 1040 { 1041 char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' }; 1042 char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm', 1043 'n', 'p', 'r', 's', 't', 'v', 'z', 'x' }; 1044 u_int i, j = 0, rounds, seed = 1; 1045 char *retval; 1046 1047 rounds = (dgst_raw_len / 2) + 1; 1048 if ((retval = calloc(rounds, 6)) == NULL) 1049 return NULL; 1050 retval[j++] = 'x'; 1051 for (i = 0; i < rounds; i++) { 1052 u_int idx0, idx1, idx2, idx3, idx4; 1053 if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) { 1054 idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) + 1055 seed) % 6; 1056 idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15; 1057 idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) + 1058 (seed / 6)) % 6; 1059 retval[j++] = vowels[idx0]; 1060 retval[j++] = consonants[idx1]; 1061 retval[j++] = vowels[idx2]; 1062 if ((i + 1) < rounds) { 1063 idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15; 1064 idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15; 1065 retval[j++] = consonants[idx3]; 1066 retval[j++] = '-'; 1067 retval[j++] = consonants[idx4]; 1068 seed = ((seed * 5) + 1069 ((((u_int)(dgst_raw[2 * i])) * 7) + 1070 ((u_int)(dgst_raw[(2 * i) + 1])))) % 36; 1071 } 1072 } else { 1073 idx0 = seed % 6; 1074 idx1 = 16; 1075 idx2 = seed / 6; 1076 retval[j++] = vowels[idx0]; 1077 retval[j++] = consonants[idx1]; 1078 retval[j++] = vowels[idx2]; 1079 } 1080 } 1081 retval[j++] = 'x'; 1082 retval[j++] = '\0'; 1083 return retval; 1084 } 1085 1086 /* 1087 * Draw an ASCII-Art representing the fingerprint so human brain can 1088 * profit from its built-in pattern recognition ability. 1089 * This technique is called "random art" and can be found in some 1090 * scientific publications like this original paper: 1091 * 1092 * "Hash Visualization: a New Technique to improve Real-World Security", 1093 * Perrig A. and Song D., 1999, International Workshop on Cryptographic 1094 * Techniques and E-Commerce (CrypTEC '99) 1095 * sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf 1096 * 1097 * The subject came up in a talk by Dan Kaminsky, too. 1098 * 1099 * If you see the picture is different, the key is different. 1100 * If the picture looks the same, you still know nothing. 1101 * 1102 * The algorithm used here is a worm crawling over a discrete plane, 1103 * leaving a trace (augmenting the field) everywhere it goes. 1104 * Movement is taken from dgst_raw 2bit-wise. Bumping into walls 1105 * makes the respective movement vector be ignored for this turn. 1106 * Graphs are not unambiguous, because circles in graphs can be 1107 * walked in either direction. 1108 */ 1109 1110 /* 1111 * Field sizes for the random art. Have to be odd, so the starting point 1112 * can be in the exact middle of the picture, and FLDBASE should be >=8 . 1113 * Else pictures would be too dense, and drawing the frame would 1114 * fail, too, because the key type would not fit in anymore. 1115 */ 1116 #define FLDBASE 8 1117 #define FLDSIZE_Y (FLDBASE + 1) 1118 #define FLDSIZE_X (FLDBASE * 2 + 1) 1119 static char * 1120 fingerprint_randomart(const char *alg, u_char *dgst_raw, size_t dgst_raw_len, 1121 const struct sshkey *k) 1122 { 1123 /* 1124 * Chars to be used after each other every time the worm 1125 * intersects with itself. Matter of taste. 1126 */ 1127 char *augmentation_string = " .o+=*BOX@%&#/^SE"; 1128 char *retval, *p, title[FLDSIZE_X], hash[FLDSIZE_X]; 1129 u_char field[FLDSIZE_X][FLDSIZE_Y]; 1130 size_t i, tlen, hlen; 1131 u_int b; 1132 int x, y, r; 1133 size_t len = strlen(augmentation_string) - 1; 1134 1135 if ((retval = calloc((FLDSIZE_X + 3), (FLDSIZE_Y + 2))) == NULL) 1136 return NULL; 1137 1138 /* initialize field */ 1139 memset(field, 0, FLDSIZE_X * FLDSIZE_Y * sizeof(char)); 1140 x = FLDSIZE_X / 2; 1141 y = FLDSIZE_Y / 2; 1142 1143 /* process raw key */ 1144 for (i = 0; i < dgst_raw_len; i++) { 1145 int input; 1146 /* each byte conveys four 2-bit move commands */ 1147 input = dgst_raw[i]; 1148 for (b = 0; b < 4; b++) { 1149 /* evaluate 2 bit, rest is shifted later */ 1150 x += (input & 0x1) ? 1 : -1; 1151 y += (input & 0x2) ? 1 : -1; 1152 1153 /* assure we are still in bounds */ 1154 x = MAXIMUM(x, 0); 1155 y = MAXIMUM(y, 0); 1156 x = MINIMUM(x, FLDSIZE_X - 1); 1157 y = MINIMUM(y, FLDSIZE_Y - 1); 1158 1159 /* augment the field */ 1160 if (field[x][y] < len - 2) 1161 field[x][y]++; 1162 input = input >> 2; 1163 } 1164 } 1165 1166 /* mark starting point and end point*/ 1167 field[FLDSIZE_X / 2][FLDSIZE_Y / 2] = len - 1; 1168 field[x][y] = len; 1169 1170 /* assemble title */ 1171 r = snprintf(title, sizeof(title), "[%s %u]", 1172 sshkey_type(k), sshkey_size(k)); 1173 /* If [type size] won't fit, then try [type]; fits "[ED25519-CERT]" */ 1174 if (r < 0 || r > (int)sizeof(title)) 1175 r = snprintf(title, sizeof(title), "[%s]", sshkey_type(k)); 1176 tlen = (r <= 0) ? 0 : strlen(title); 1177 1178 /* assemble hash ID. */ 1179 r = snprintf(hash, sizeof(hash), "[%s]", alg); 1180 hlen = (r <= 0) ? 0 : strlen(hash); 1181 1182 /* output upper border */ 1183 p = retval; 1184 *p++ = '+'; 1185 for (i = 0; i < (FLDSIZE_X - tlen) / 2; i++) 1186 *p++ = '-'; 1187 memcpy(p, title, tlen); 1188 p += tlen; 1189 for (i += tlen; i < FLDSIZE_X; i++) 1190 *p++ = '-'; 1191 *p++ = '+'; 1192 *p++ = '\n'; 1193 1194 /* output content */ 1195 for (y = 0; y < FLDSIZE_Y; y++) { 1196 *p++ = '|'; 1197 for (x = 0; x < FLDSIZE_X; x++) 1198 *p++ = augmentation_string[MINIMUM(field[x][y], len)]; 1199 *p++ = '|'; 1200 *p++ = '\n'; 1201 } 1202 1203 /* output lower border */ 1204 *p++ = '+'; 1205 for (i = 0; i < (FLDSIZE_X - hlen) / 2; i++) 1206 *p++ = '-'; 1207 memcpy(p, hash, hlen); 1208 p += hlen; 1209 for (i += hlen; i < FLDSIZE_X; i++) 1210 *p++ = '-'; 1211 *p++ = '+'; 1212 1213 return retval; 1214 } 1215 1216 char * 1217 sshkey_fingerprint(const struct sshkey *k, int dgst_alg, 1218 enum sshkey_fp_rep dgst_rep) 1219 { 1220 char *retval = NULL; 1221 u_char *dgst_raw; 1222 size_t dgst_raw_len; 1223 1224 if (sshkey_fingerprint_raw(k, dgst_alg, &dgst_raw, &dgst_raw_len) != 0) 1225 return NULL; 1226 switch (dgst_rep) { 1227 case SSH_FP_DEFAULT: 1228 if (dgst_alg == SSH_DIGEST_MD5) { 1229 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1230 dgst_raw, dgst_raw_len); 1231 } else { 1232 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1233 dgst_raw, dgst_raw_len); 1234 } 1235 break; 1236 case SSH_FP_HEX: 1237 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1238 dgst_raw, dgst_raw_len); 1239 break; 1240 case SSH_FP_BASE64: 1241 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1242 dgst_raw, dgst_raw_len); 1243 break; 1244 case SSH_FP_BUBBLEBABBLE: 1245 retval = fingerprint_bubblebabble(dgst_raw, dgst_raw_len); 1246 break; 1247 case SSH_FP_RANDOMART: 1248 retval = fingerprint_randomart(ssh_digest_alg_name(dgst_alg), 1249 dgst_raw, dgst_raw_len, k); 1250 break; 1251 default: 1252 freezero(dgst_raw, dgst_raw_len); 1253 return NULL; 1254 } 1255 freezero(dgst_raw, dgst_raw_len); 1256 return retval; 1257 } 1258 1259 static int 1260 peek_type_nid(const char *s, size_t l, int *nid) 1261 { 1262 const struct keytype *kt; 1263 1264 for (kt = keytypes; kt->type != -1; kt++) { 1265 if (kt->name == NULL || strlen(kt->name) != l) 1266 continue; 1267 if (memcmp(s, kt->name, l) == 0) { 1268 *nid = -1; 1269 if (key_type_is_ecdsa_variant(kt->type)) 1270 *nid = kt->nid; 1271 return kt->type; 1272 } 1273 } 1274 return KEY_UNSPEC; 1275 } 1276 1277 1278 /* XXX this can now be made const char * */ 1279 int 1280 sshkey_read(struct sshkey *ret, char **cpp) 1281 { 1282 struct sshkey *k; 1283 char *cp, *blobcopy; 1284 size_t space; 1285 int r, type, curve_nid = -1; 1286 struct sshbuf *blob; 1287 1288 if (ret == NULL) 1289 return SSH_ERR_INVALID_ARGUMENT; 1290 1291 switch (ret->type) { 1292 case KEY_UNSPEC: 1293 case KEY_RSA: 1294 case KEY_DSA: 1295 case KEY_ECDSA: 1296 case KEY_ECDSA_SK: 1297 case KEY_ED25519: 1298 case KEY_ED25519_SK: 1299 case KEY_DSA_CERT: 1300 case KEY_ECDSA_CERT: 1301 case KEY_ECDSA_SK_CERT: 1302 case KEY_RSA_CERT: 1303 case KEY_ED25519_CERT: 1304 case KEY_ED25519_SK_CERT: 1305 #ifdef WITH_XMSS 1306 case KEY_XMSS: 1307 case KEY_XMSS_CERT: 1308 #endif /* WITH_XMSS */ 1309 break; /* ok */ 1310 default: 1311 return SSH_ERR_INVALID_ARGUMENT; 1312 } 1313 1314 /* Decode type */ 1315 cp = *cpp; 1316 space = strcspn(cp, " \t"); 1317 if (space == strlen(cp)) 1318 return SSH_ERR_INVALID_FORMAT; 1319 if ((type = peek_type_nid(cp, space, &curve_nid)) == KEY_UNSPEC) 1320 return SSH_ERR_INVALID_FORMAT; 1321 1322 /* skip whitespace */ 1323 for (cp += space; *cp == ' ' || *cp == '\t'; cp++) 1324 ; 1325 if (*cp == '\0') 1326 return SSH_ERR_INVALID_FORMAT; 1327 if (ret->type != KEY_UNSPEC && ret->type != type) 1328 return SSH_ERR_KEY_TYPE_MISMATCH; 1329 if ((blob = sshbuf_new()) == NULL) 1330 return SSH_ERR_ALLOC_FAIL; 1331 1332 /* find end of keyblob and decode */ 1333 space = strcspn(cp, " \t"); 1334 if ((blobcopy = strndup(cp, space)) == NULL) { 1335 sshbuf_free(blob); 1336 return SSH_ERR_ALLOC_FAIL; 1337 } 1338 if ((r = sshbuf_b64tod(blob, blobcopy)) != 0) { 1339 free(blobcopy); 1340 sshbuf_free(blob); 1341 return r; 1342 } 1343 free(blobcopy); 1344 if ((r = sshkey_fromb(blob, &k)) != 0) { 1345 sshbuf_free(blob); 1346 return r; 1347 } 1348 sshbuf_free(blob); 1349 1350 /* skip whitespace and leave cp at start of comment */ 1351 for (cp += space; *cp == ' ' || *cp == '\t'; cp++) 1352 ; 1353 1354 /* ensure type of blob matches type at start of line */ 1355 if (k->type != type) { 1356 sshkey_free(k); 1357 return SSH_ERR_KEY_TYPE_MISMATCH; 1358 } 1359 if (key_type_is_ecdsa_variant(type) && curve_nid != k->ecdsa_nid) { 1360 sshkey_free(k); 1361 return SSH_ERR_EC_CURVE_MISMATCH; 1362 } 1363 1364 /* Fill in ret from parsed key */ 1365 ret->type = type; 1366 if (sshkey_is_cert(ret)) { 1367 if (!sshkey_is_cert(k)) { 1368 sshkey_free(k); 1369 return SSH_ERR_EXPECTED_CERT; 1370 } 1371 if (ret->cert != NULL) 1372 cert_free(ret->cert); 1373 ret->cert = k->cert; 1374 k->cert = NULL; 1375 } 1376 switch (sshkey_type_plain(ret->type)) { 1377 #ifdef WITH_OPENSSL 1378 case KEY_RSA: 1379 RSA_free(ret->rsa); 1380 ret->rsa = k->rsa; 1381 k->rsa = NULL; 1382 #ifdef DEBUG_PK 1383 RSA_print_fp(stderr, ret->rsa, 8); 1384 #endif 1385 break; 1386 case KEY_DSA: 1387 DSA_free(ret->dsa); 1388 ret->dsa = k->dsa; 1389 k->dsa = NULL; 1390 #ifdef DEBUG_PK 1391 DSA_print_fp(stderr, ret->dsa, 8); 1392 #endif 1393 break; 1394 case KEY_ECDSA: 1395 EC_KEY_free(ret->ecdsa); 1396 ret->ecdsa = k->ecdsa; 1397 ret->ecdsa_nid = k->ecdsa_nid; 1398 k->ecdsa = NULL; 1399 k->ecdsa_nid = -1; 1400 #ifdef DEBUG_PK 1401 sshkey_dump_ec_key(ret->ecdsa); 1402 #endif 1403 break; 1404 case KEY_ECDSA_SK: 1405 EC_KEY_free(ret->ecdsa); 1406 ret->ecdsa = k->ecdsa; 1407 ret->ecdsa_nid = k->ecdsa_nid; 1408 ret->sk_application = k->sk_application; 1409 k->ecdsa = NULL; 1410 k->ecdsa_nid = -1; 1411 k->sk_application = NULL; 1412 #ifdef DEBUG_PK 1413 sshkey_dump_ec_key(ret->ecdsa); 1414 fprintf(stderr, "App: %s\n", ret->sk_application); 1415 #endif 1416 break; 1417 #endif /* WITH_OPENSSL */ 1418 case KEY_ED25519: 1419 freezero(ret->ed25519_pk, ED25519_PK_SZ); 1420 ret->ed25519_pk = k->ed25519_pk; 1421 k->ed25519_pk = NULL; 1422 #ifdef DEBUG_PK 1423 /* XXX */ 1424 #endif 1425 break; 1426 case KEY_ED25519_SK: 1427 freezero(ret->ed25519_pk, ED25519_PK_SZ); 1428 ret->ed25519_pk = k->ed25519_pk; 1429 ret->sk_application = k->sk_application; 1430 k->ed25519_pk = NULL; 1431 k->sk_application = NULL; 1432 break; 1433 #ifdef WITH_XMSS 1434 case KEY_XMSS: 1435 free(ret->xmss_pk); 1436 ret->xmss_pk = k->xmss_pk; 1437 k->xmss_pk = NULL; 1438 free(ret->xmss_state); 1439 ret->xmss_state = k->xmss_state; 1440 k->xmss_state = NULL; 1441 free(ret->xmss_name); 1442 ret->xmss_name = k->xmss_name; 1443 k->xmss_name = NULL; 1444 free(ret->xmss_filename); 1445 ret->xmss_filename = k->xmss_filename; 1446 k->xmss_filename = NULL; 1447 #ifdef DEBUG_PK 1448 /* XXX */ 1449 #endif 1450 break; 1451 #endif /* WITH_XMSS */ 1452 default: 1453 sshkey_free(k); 1454 return SSH_ERR_INTERNAL_ERROR; 1455 } 1456 sshkey_free(k); 1457 1458 /* success */ 1459 *cpp = cp; 1460 return 0; 1461 } 1462 1463 int 1464 sshkey_to_base64(const struct sshkey *key, char **b64p) 1465 { 1466 int r = SSH_ERR_INTERNAL_ERROR; 1467 struct sshbuf *b = NULL; 1468 char *uu = NULL; 1469 1470 if (b64p != NULL) 1471 *b64p = NULL; 1472 if ((b = sshbuf_new()) == NULL) 1473 return SSH_ERR_ALLOC_FAIL; 1474 if ((r = sshkey_putb(key, b)) != 0) 1475 goto out; 1476 if ((uu = sshbuf_dtob64_string(b, 0)) == NULL) { 1477 r = SSH_ERR_ALLOC_FAIL; 1478 goto out; 1479 } 1480 /* Success */ 1481 if (b64p != NULL) { 1482 *b64p = uu; 1483 uu = NULL; 1484 } 1485 r = 0; 1486 out: 1487 sshbuf_free(b); 1488 free(uu); 1489 return r; 1490 } 1491 1492 int 1493 sshkey_format_text(const struct sshkey *key, struct sshbuf *b) 1494 { 1495 int r = SSH_ERR_INTERNAL_ERROR; 1496 char *uu = NULL; 1497 1498 if ((r = sshkey_to_base64(key, &uu)) != 0) 1499 goto out; 1500 if ((r = sshbuf_putf(b, "%s %s", 1501 sshkey_ssh_name(key), uu)) != 0) 1502 goto out; 1503 r = 0; 1504 out: 1505 free(uu); 1506 return r; 1507 } 1508 1509 int 1510 sshkey_write(const struct sshkey *key, FILE *f) 1511 { 1512 struct sshbuf *b = NULL; 1513 int r = SSH_ERR_INTERNAL_ERROR; 1514 1515 if ((b = sshbuf_new()) == NULL) 1516 return SSH_ERR_ALLOC_FAIL; 1517 if ((r = sshkey_format_text(key, b)) != 0) 1518 goto out; 1519 if (fwrite(sshbuf_ptr(b), sshbuf_len(b), 1, f) != 1) { 1520 if (feof(f)) 1521 errno = EPIPE; 1522 r = SSH_ERR_SYSTEM_ERROR; 1523 goto out; 1524 } 1525 /* Success */ 1526 r = 0; 1527 out: 1528 sshbuf_free(b); 1529 return r; 1530 } 1531 1532 const char * 1533 sshkey_cert_type(const struct sshkey *k) 1534 { 1535 switch (k->cert->type) { 1536 case SSH2_CERT_TYPE_USER: 1537 return "user"; 1538 case SSH2_CERT_TYPE_HOST: 1539 return "host"; 1540 default: 1541 return "unknown"; 1542 } 1543 } 1544 1545 #ifdef WITH_OPENSSL 1546 static int 1547 rsa_generate_private_key(u_int bits, RSA **rsap) 1548 { 1549 RSA *private = NULL; 1550 BIGNUM *f4 = NULL; 1551 int ret = SSH_ERR_INTERNAL_ERROR; 1552 1553 if (rsap == NULL) 1554 return SSH_ERR_INVALID_ARGUMENT; 1555 if (bits < SSH_RSA_MINIMUM_MODULUS_SIZE || 1556 bits > SSHBUF_MAX_BIGNUM * 8) 1557 return SSH_ERR_KEY_LENGTH; 1558 *rsap = NULL; 1559 if ((private = RSA_new()) == NULL || (f4 = BN_new()) == NULL) { 1560 ret = SSH_ERR_ALLOC_FAIL; 1561 goto out; 1562 } 1563 if (!BN_set_word(f4, RSA_F4) || 1564 !RSA_generate_key_ex(private, bits, f4, NULL)) { 1565 ret = SSH_ERR_LIBCRYPTO_ERROR; 1566 goto out; 1567 } 1568 *rsap = private; 1569 private = NULL; 1570 ret = 0; 1571 out: 1572 RSA_free(private); 1573 BN_free(f4); 1574 return ret; 1575 } 1576 1577 static int 1578 dsa_generate_private_key(u_int bits, DSA **dsap) 1579 { 1580 DSA *private; 1581 int ret = SSH_ERR_INTERNAL_ERROR; 1582 1583 if (dsap == NULL) 1584 return SSH_ERR_INVALID_ARGUMENT; 1585 if (bits != 1024) 1586 return SSH_ERR_KEY_LENGTH; 1587 if ((private = DSA_new()) == NULL) { 1588 ret = SSH_ERR_ALLOC_FAIL; 1589 goto out; 1590 } 1591 *dsap = NULL; 1592 if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL, 1593 NULL, NULL) || !DSA_generate_key(private)) { 1594 ret = SSH_ERR_LIBCRYPTO_ERROR; 1595 goto out; 1596 } 1597 *dsap = private; 1598 private = NULL; 1599 ret = 0; 1600 out: 1601 DSA_free(private); 1602 return ret; 1603 } 1604 1605 int 1606 sshkey_ecdsa_key_to_nid(EC_KEY *k) 1607 { 1608 EC_GROUP *eg; 1609 int nids[] = { 1610 NID_X9_62_prime256v1, 1611 NID_secp384r1, 1612 NID_secp521r1, 1613 -1 1614 }; 1615 int nid; 1616 u_int i; 1617 const EC_GROUP *g = EC_KEY_get0_group(k); 1618 1619 /* 1620 * The group may be stored in a ASN.1 encoded private key in one of two 1621 * ways: as a "named group", which is reconstituted by ASN.1 object ID 1622 * or explicit group parameters encoded into the key blob. Only the 1623 * "named group" case sets the group NID for us, but we can figure 1624 * it out for the other case by comparing against all the groups that 1625 * are supported. 1626 */ 1627 if ((nid = EC_GROUP_get_curve_name(g)) > 0) 1628 return nid; 1629 for (i = 0; nids[i] != -1; i++) { 1630 if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL) 1631 return -1; 1632 if (EC_GROUP_cmp(g, eg, NULL) == 0) 1633 break; 1634 EC_GROUP_free(eg); 1635 } 1636 if (nids[i] != -1) { 1637 /* Use the group with the NID attached */ 1638 EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE); 1639 if (EC_KEY_set_group(k, eg) != 1) { 1640 EC_GROUP_free(eg); 1641 return -1; 1642 } 1643 } 1644 return nids[i]; 1645 } 1646 1647 static int 1648 ecdsa_generate_private_key(u_int bits, int *nid, EC_KEY **ecdsap) 1649 { 1650 EC_KEY *private; 1651 int ret = SSH_ERR_INTERNAL_ERROR; 1652 1653 if (nid == NULL || ecdsap == NULL) 1654 return SSH_ERR_INVALID_ARGUMENT; 1655 if ((*nid = sshkey_ecdsa_bits_to_nid(bits)) == -1) 1656 return SSH_ERR_KEY_LENGTH; 1657 *ecdsap = NULL; 1658 if ((private = EC_KEY_new_by_curve_name(*nid)) == NULL) { 1659 ret = SSH_ERR_ALLOC_FAIL; 1660 goto out; 1661 } 1662 if (EC_KEY_generate_key(private) != 1) { 1663 ret = SSH_ERR_LIBCRYPTO_ERROR; 1664 goto out; 1665 } 1666 EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE); 1667 *ecdsap = private; 1668 private = NULL; 1669 ret = 0; 1670 out: 1671 EC_KEY_free(private); 1672 return ret; 1673 } 1674 #endif /* WITH_OPENSSL */ 1675 1676 int 1677 sshkey_generate(int type, u_int bits, struct sshkey **keyp) 1678 { 1679 struct sshkey *k; 1680 int ret = SSH_ERR_INTERNAL_ERROR; 1681 1682 if (keyp == NULL) 1683 return SSH_ERR_INVALID_ARGUMENT; 1684 *keyp = NULL; 1685 if ((k = sshkey_new(KEY_UNSPEC)) == NULL) 1686 return SSH_ERR_ALLOC_FAIL; 1687 switch (type) { 1688 case KEY_ED25519: 1689 if ((k->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL || 1690 (k->ed25519_sk = malloc(ED25519_SK_SZ)) == NULL) { 1691 ret = SSH_ERR_ALLOC_FAIL; 1692 break; 1693 } 1694 crypto_sign_ed25519_keypair(k->ed25519_pk, k->ed25519_sk); 1695 ret = 0; 1696 break; 1697 #ifdef WITH_XMSS 1698 case KEY_XMSS: 1699 ret = sshkey_xmss_generate_private_key(k, bits); 1700 break; 1701 #endif /* WITH_XMSS */ 1702 #ifdef WITH_OPENSSL 1703 case KEY_DSA: 1704 ret = dsa_generate_private_key(bits, &k->dsa); 1705 break; 1706 case KEY_ECDSA: 1707 ret = ecdsa_generate_private_key(bits, &k->ecdsa_nid, 1708 &k->ecdsa); 1709 break; 1710 case KEY_RSA: 1711 ret = rsa_generate_private_key(bits, &k->rsa); 1712 break; 1713 #endif /* WITH_OPENSSL */ 1714 default: 1715 ret = SSH_ERR_INVALID_ARGUMENT; 1716 } 1717 if (ret == 0) { 1718 k->type = type; 1719 *keyp = k; 1720 } else 1721 sshkey_free(k); 1722 return ret; 1723 } 1724 1725 int 1726 sshkey_cert_copy(const struct sshkey *from_key, struct sshkey *to_key) 1727 { 1728 u_int i; 1729 const struct sshkey_cert *from; 1730 struct sshkey_cert *to; 1731 int r = SSH_ERR_INTERNAL_ERROR; 1732 1733 if (to_key == NULL || (from = from_key->cert) == NULL) 1734 return SSH_ERR_INVALID_ARGUMENT; 1735 1736 if ((to = cert_new()) == NULL) 1737 return SSH_ERR_ALLOC_FAIL; 1738 1739 if ((r = sshbuf_putb(to->certblob, from->certblob)) != 0 || 1740 (r = sshbuf_putb(to->critical, from->critical)) != 0 || 1741 (r = sshbuf_putb(to->extensions, from->extensions)) != 0) 1742 goto out; 1743 1744 to->serial = from->serial; 1745 to->type = from->type; 1746 if (from->key_id == NULL) 1747 to->key_id = NULL; 1748 else if ((to->key_id = strdup(from->key_id)) == NULL) { 1749 r = SSH_ERR_ALLOC_FAIL; 1750 goto out; 1751 } 1752 to->valid_after = from->valid_after; 1753 to->valid_before = from->valid_before; 1754 if (from->signature_key == NULL) 1755 to->signature_key = NULL; 1756 else if ((r = sshkey_from_private(from->signature_key, 1757 &to->signature_key)) != 0) 1758 goto out; 1759 if (from->signature_type != NULL && 1760 (to->signature_type = strdup(from->signature_type)) == NULL) { 1761 r = SSH_ERR_ALLOC_FAIL; 1762 goto out; 1763 } 1764 if (from->nprincipals > SSHKEY_CERT_MAX_PRINCIPALS) { 1765 r = SSH_ERR_INVALID_ARGUMENT; 1766 goto out; 1767 } 1768 if (from->nprincipals > 0) { 1769 if ((to->principals = calloc(from->nprincipals, 1770 sizeof(*to->principals))) == NULL) { 1771 r = SSH_ERR_ALLOC_FAIL; 1772 goto out; 1773 } 1774 for (i = 0; i < from->nprincipals; i++) { 1775 to->principals[i] = strdup(from->principals[i]); 1776 if (to->principals[i] == NULL) { 1777 to->nprincipals = i; 1778 r = SSH_ERR_ALLOC_FAIL; 1779 goto out; 1780 } 1781 } 1782 } 1783 to->nprincipals = from->nprincipals; 1784 1785 /* success */ 1786 cert_free(to_key->cert); 1787 to_key->cert = to; 1788 to = NULL; 1789 r = 0; 1790 out: 1791 cert_free(to); 1792 return r; 1793 } 1794 1795 int 1796 sshkey_from_private(const struct sshkey *k, struct sshkey **pkp) 1797 { 1798 struct sshkey *n = NULL; 1799 int r = SSH_ERR_INTERNAL_ERROR; 1800 #ifdef WITH_OPENSSL 1801 const BIGNUM *rsa_n, *rsa_e; 1802 BIGNUM *rsa_n_dup = NULL, *rsa_e_dup = NULL; 1803 const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key; 1804 BIGNUM *dsa_p_dup = NULL, *dsa_q_dup = NULL, *dsa_g_dup = NULL; 1805 BIGNUM *dsa_pub_key_dup = NULL; 1806 #endif /* WITH_OPENSSL */ 1807 1808 *pkp = NULL; 1809 if ((n = sshkey_new(k->type)) == NULL) { 1810 r = SSH_ERR_ALLOC_FAIL; 1811 goto out; 1812 } 1813 switch (k->type) { 1814 #ifdef WITH_OPENSSL 1815 case KEY_DSA: 1816 case KEY_DSA_CERT: 1817 DSA_get0_pqg(k->dsa, &dsa_p, &dsa_q, &dsa_g); 1818 DSA_get0_key(k->dsa, &dsa_pub_key, NULL); 1819 if ((dsa_p_dup = BN_dup(dsa_p)) == NULL || 1820 (dsa_q_dup = BN_dup(dsa_q)) == NULL || 1821 (dsa_g_dup = BN_dup(dsa_g)) == NULL || 1822 (dsa_pub_key_dup = BN_dup(dsa_pub_key)) == NULL) { 1823 r = SSH_ERR_ALLOC_FAIL; 1824 goto out; 1825 } 1826 if (!DSA_set0_pqg(n->dsa, dsa_p_dup, dsa_q_dup, dsa_g_dup)) { 1827 r = SSH_ERR_LIBCRYPTO_ERROR; 1828 goto out; 1829 } 1830 dsa_p_dup = dsa_q_dup = dsa_g_dup = NULL; /* transferred */ 1831 if (!DSA_set0_key(n->dsa, dsa_pub_key_dup, NULL)) { 1832 r = SSH_ERR_LIBCRYPTO_ERROR; 1833 goto out; 1834 } 1835 dsa_pub_key_dup = NULL; /* transferred */ 1836 1837 break; 1838 case KEY_ECDSA: 1839 case KEY_ECDSA_CERT: 1840 case KEY_ECDSA_SK: 1841 case KEY_ECDSA_SK_CERT: 1842 n->ecdsa_nid = k->ecdsa_nid; 1843 n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 1844 if (n->ecdsa == NULL) { 1845 r = SSH_ERR_ALLOC_FAIL; 1846 goto out; 1847 } 1848 if (EC_KEY_set_public_key(n->ecdsa, 1849 EC_KEY_get0_public_key(k->ecdsa)) != 1) { 1850 r = SSH_ERR_LIBCRYPTO_ERROR; 1851 goto out; 1852 } 1853 if (k->type != KEY_ECDSA_SK && k->type != KEY_ECDSA_SK_CERT) 1854 break; 1855 /* Append security-key application string */ 1856 if ((n->sk_application = strdup(k->sk_application)) == NULL) 1857 goto out; 1858 break; 1859 case KEY_RSA: 1860 case KEY_RSA_CERT: 1861 RSA_get0_key(k->rsa, &rsa_n, &rsa_e, NULL); 1862 if ((rsa_n_dup = BN_dup(rsa_n)) == NULL || 1863 (rsa_e_dup = BN_dup(rsa_e)) == NULL) { 1864 r = SSH_ERR_ALLOC_FAIL; 1865 goto out; 1866 } 1867 if (!RSA_set0_key(n->rsa, rsa_n_dup, rsa_e_dup, NULL)) { 1868 r = SSH_ERR_LIBCRYPTO_ERROR; 1869 goto out; 1870 } 1871 rsa_n_dup = rsa_e_dup = NULL; /* transferred */ 1872 break; 1873 #endif /* WITH_OPENSSL */ 1874 case KEY_ED25519: 1875 case KEY_ED25519_CERT: 1876 case KEY_ED25519_SK: 1877 case KEY_ED25519_SK_CERT: 1878 if (k->ed25519_pk != NULL) { 1879 if ((n->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) { 1880 r = SSH_ERR_ALLOC_FAIL; 1881 goto out; 1882 } 1883 memcpy(n->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ); 1884 } 1885 if (k->type != KEY_ED25519_SK && 1886 k->type != KEY_ED25519_SK_CERT) 1887 break; 1888 /* Append security-key application string */ 1889 if ((n->sk_application = strdup(k->sk_application)) == NULL) 1890 goto out; 1891 break; 1892 #ifdef WITH_XMSS 1893 case KEY_XMSS: 1894 case KEY_XMSS_CERT: 1895 if ((r = sshkey_xmss_init(n, k->xmss_name)) != 0) 1896 goto out; 1897 if (k->xmss_pk != NULL) { 1898 u_int32_t left; 1899 size_t pklen = sshkey_xmss_pklen(k); 1900 if (pklen == 0 || sshkey_xmss_pklen(n) != pklen) { 1901 r = SSH_ERR_INTERNAL_ERROR; 1902 goto out; 1903 } 1904 if ((n->xmss_pk = malloc(pklen)) == NULL) { 1905 r = SSH_ERR_ALLOC_FAIL; 1906 goto out; 1907 } 1908 memcpy(n->xmss_pk, k->xmss_pk, pklen); 1909 /* simulate number of signatures left on pubkey */ 1910 left = sshkey_xmss_signatures_left(k); 1911 if (left) 1912 sshkey_xmss_enable_maxsign(n, left); 1913 } 1914 break; 1915 #endif /* WITH_XMSS */ 1916 default: 1917 r = SSH_ERR_KEY_TYPE_UNKNOWN; 1918 goto out; 1919 } 1920 if (sshkey_is_cert(k) && (r = sshkey_cert_copy(k, n)) != 0) 1921 goto out; 1922 /* success */ 1923 *pkp = n; 1924 n = NULL; 1925 r = 0; 1926 out: 1927 sshkey_free(n); 1928 #ifdef WITH_OPENSSL 1929 BN_clear_free(rsa_n_dup); 1930 BN_clear_free(rsa_e_dup); 1931 BN_clear_free(dsa_p_dup); 1932 BN_clear_free(dsa_q_dup); 1933 BN_clear_free(dsa_g_dup); 1934 BN_clear_free(dsa_pub_key_dup); 1935 #endif /* WITH_OPENSSL */ 1936 1937 return r; 1938 } 1939 1940 int 1941 sshkey_is_shielded(struct sshkey *k) 1942 { 1943 return k != NULL && k->shielded_private != NULL; 1944 } 1945 1946 int 1947 sshkey_shield_private(struct sshkey *k) 1948 { 1949 struct sshbuf *prvbuf = NULL; 1950 u_char *prekey = NULL, *enc = NULL, keyiv[SSH_DIGEST_MAX_LENGTH]; 1951 struct sshcipher_ctx *cctx = NULL; 1952 const struct sshcipher *cipher; 1953 size_t i, enclen = 0; 1954 struct sshkey *kswap = NULL, tmp; 1955 int r = SSH_ERR_INTERNAL_ERROR; 1956 1957 #ifdef DEBUG_PK 1958 fprintf(stderr, "%s: entering for %s\n", __func__, sshkey_ssh_name(k)); 1959 #endif 1960 if ((cipher = cipher_by_name(SSHKEY_SHIELD_CIPHER)) == NULL) { 1961 r = SSH_ERR_INVALID_ARGUMENT; 1962 goto out; 1963 } 1964 if (cipher_keylen(cipher) + cipher_ivlen(cipher) > 1965 ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH)) { 1966 r = SSH_ERR_INTERNAL_ERROR; 1967 goto out; 1968 } 1969 1970 /* Prepare a random pre-key, and from it an ephemeral key */ 1971 if ((prekey = malloc(SSHKEY_SHIELD_PREKEY_LEN)) == NULL) { 1972 r = SSH_ERR_ALLOC_FAIL; 1973 goto out; 1974 } 1975 arc4random_buf(prekey, SSHKEY_SHIELD_PREKEY_LEN); 1976 if ((r = ssh_digest_memory(SSHKEY_SHIELD_PREKEY_HASH, 1977 prekey, SSHKEY_SHIELD_PREKEY_LEN, 1978 keyiv, SSH_DIGEST_MAX_LENGTH)) != 0) 1979 goto out; 1980 #ifdef DEBUG_PK 1981 fprintf(stderr, "%s: key+iv\n", __func__); 1982 sshbuf_dump_data(keyiv, ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH), 1983 stderr); 1984 #endif 1985 if ((r = cipher_init(&cctx, cipher, keyiv, cipher_keylen(cipher), 1986 keyiv + cipher_keylen(cipher), cipher_ivlen(cipher), 1)) != 0) 1987 goto out; 1988 1989 /* Serialise and encrypt the private key using the ephemeral key */ 1990 if ((prvbuf = sshbuf_new()) == NULL) { 1991 r = SSH_ERR_ALLOC_FAIL; 1992 goto out; 1993 } 1994 if (sshkey_is_shielded(k) && (r = sshkey_unshield_private(k)) != 0) 1995 goto out; 1996 if ((r = sshkey_private_serialize_opt(k, prvbuf, 1997 SSHKEY_SERIALIZE_SHIELD)) != 0) 1998 goto out; 1999 /* pad to cipher blocksize */ 2000 i = 0; 2001 while (sshbuf_len(prvbuf) % cipher_blocksize(cipher)) { 2002 if ((r = sshbuf_put_u8(prvbuf, ++i & 0xff)) != 0) 2003 goto out; 2004 } 2005 #ifdef DEBUG_PK 2006 fprintf(stderr, "%s: serialised\n", __func__); 2007 sshbuf_dump(prvbuf, stderr); 2008 #endif 2009 /* encrypt */ 2010 enclen = sshbuf_len(prvbuf); 2011 if ((enc = malloc(enclen)) == NULL) { 2012 r = SSH_ERR_ALLOC_FAIL; 2013 goto out; 2014 } 2015 if ((r = cipher_crypt(cctx, 0, enc, 2016 sshbuf_ptr(prvbuf), sshbuf_len(prvbuf), 0, 0)) != 0) 2017 goto out; 2018 #ifdef DEBUG_PK 2019 fprintf(stderr, "%s: encrypted\n", __func__); 2020 sshbuf_dump_data(enc, enclen, stderr); 2021 #endif 2022 2023 /* Make a scrubbed, public-only copy of our private key argument */ 2024 if ((r = sshkey_from_private(k, &kswap)) != 0) 2025 goto out; 2026 2027 /* Swap the private key out (it will be destroyed below) */ 2028 tmp = *kswap; 2029 *kswap = *k; 2030 *k = tmp; 2031 2032 /* Insert the shielded key into our argument */ 2033 k->shielded_private = enc; 2034 k->shielded_len = enclen; 2035 k->shield_prekey = prekey; 2036 k->shield_prekey_len = SSHKEY_SHIELD_PREKEY_LEN; 2037 enc = prekey = NULL; /* transferred */ 2038 enclen = 0; 2039 2040 /* preserve key fields that are required for correct operation */ 2041 k->sk_flags = kswap->sk_flags; 2042 2043 /* success */ 2044 r = 0; 2045 2046 out: 2047 /* XXX behaviour on error - invalidate original private key? */ 2048 cipher_free(cctx); 2049 explicit_bzero(keyiv, sizeof(keyiv)); 2050 explicit_bzero(&tmp, sizeof(tmp)); 2051 freezero(enc, enclen); 2052 freezero(prekey, SSHKEY_SHIELD_PREKEY_LEN); 2053 sshkey_free(kswap); 2054 sshbuf_free(prvbuf); 2055 return r; 2056 } 2057 2058 int 2059 sshkey_unshield_private(struct sshkey *k) 2060 { 2061 struct sshbuf *prvbuf = NULL; 2062 u_char pad, *cp, keyiv[SSH_DIGEST_MAX_LENGTH]; 2063 struct sshcipher_ctx *cctx = NULL; 2064 const struct sshcipher *cipher; 2065 size_t i; 2066 struct sshkey *kswap = NULL, tmp; 2067 int r = SSH_ERR_INTERNAL_ERROR; 2068 2069 #ifdef DEBUG_PK 2070 fprintf(stderr, "%s: entering for %s\n", __func__, sshkey_ssh_name(k)); 2071 #endif 2072 if (!sshkey_is_shielded(k)) 2073 return 0; /* nothing to do */ 2074 2075 if ((cipher = cipher_by_name(SSHKEY_SHIELD_CIPHER)) == NULL) { 2076 r = SSH_ERR_INVALID_ARGUMENT; 2077 goto out; 2078 } 2079 if (cipher_keylen(cipher) + cipher_ivlen(cipher) > 2080 ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH)) { 2081 r = SSH_ERR_INTERNAL_ERROR; 2082 goto out; 2083 } 2084 /* check size of shielded key blob */ 2085 if (k->shielded_len < cipher_blocksize(cipher) || 2086 (k->shielded_len % cipher_blocksize(cipher)) != 0) { 2087 r = SSH_ERR_INVALID_FORMAT; 2088 goto out; 2089 } 2090 2091 /* Calculate the ephemeral key from the prekey */ 2092 if ((r = ssh_digest_memory(SSHKEY_SHIELD_PREKEY_HASH, 2093 k->shield_prekey, k->shield_prekey_len, 2094 keyiv, SSH_DIGEST_MAX_LENGTH)) != 0) 2095 goto out; 2096 if ((r = cipher_init(&cctx, cipher, keyiv, cipher_keylen(cipher), 2097 keyiv + cipher_keylen(cipher), cipher_ivlen(cipher), 0)) != 0) 2098 goto out; 2099 #ifdef DEBUG_PK 2100 fprintf(stderr, "%s: key+iv\n", __func__); 2101 sshbuf_dump_data(keyiv, ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH), 2102 stderr); 2103 #endif 2104 2105 /* Decrypt and parse the shielded private key using the ephemeral key */ 2106 if ((prvbuf = sshbuf_new()) == NULL) { 2107 r = SSH_ERR_ALLOC_FAIL; 2108 goto out; 2109 } 2110 if ((r = sshbuf_reserve(prvbuf, k->shielded_len, &cp)) != 0) 2111 goto out; 2112 /* decrypt */ 2113 #ifdef DEBUG_PK 2114 fprintf(stderr, "%s: encrypted\n", __func__); 2115 sshbuf_dump_data(k->shielded_private, k->shielded_len, stderr); 2116 #endif 2117 if ((r = cipher_crypt(cctx, 0, cp, 2118 k->shielded_private, k->shielded_len, 0, 0)) != 0) 2119 goto out; 2120 #ifdef DEBUG_PK 2121 fprintf(stderr, "%s: serialised\n", __func__); 2122 sshbuf_dump(prvbuf, stderr); 2123 #endif 2124 /* Parse private key */ 2125 if ((r = sshkey_private_deserialize(prvbuf, &kswap)) != 0) 2126 goto out; 2127 /* Check deterministic padding */ 2128 i = 0; 2129 while (sshbuf_len(prvbuf)) { 2130 if ((r = sshbuf_get_u8(prvbuf, &pad)) != 0) 2131 goto out; 2132 if (pad != (++i & 0xff)) { 2133 r = SSH_ERR_INVALID_FORMAT; 2134 goto out; 2135 } 2136 } 2137 2138 /* Swap the parsed key back into place */ 2139 tmp = *kswap; 2140 *kswap = *k; 2141 *k = tmp; 2142 2143 /* success */ 2144 r = 0; 2145 2146 out: 2147 cipher_free(cctx); 2148 explicit_bzero(keyiv, sizeof(keyiv)); 2149 explicit_bzero(&tmp, sizeof(tmp)); 2150 sshkey_free(kswap); 2151 sshbuf_free(prvbuf); 2152 return r; 2153 } 2154 2155 static int 2156 cert_parse(struct sshbuf *b, struct sshkey *key, struct sshbuf *certbuf) 2157 { 2158 struct sshbuf *principals = NULL, *crit = NULL; 2159 struct sshbuf *exts = NULL, *ca = NULL; 2160 u_char *sig = NULL; 2161 size_t signed_len = 0, slen = 0, kidlen = 0; 2162 int ret = SSH_ERR_INTERNAL_ERROR; 2163 2164 /* Copy the entire key blob for verification and later serialisation */ 2165 if ((ret = sshbuf_putb(key->cert->certblob, certbuf)) != 0) 2166 return ret; 2167 2168 /* Parse body of certificate up to signature */ 2169 if ((ret = sshbuf_get_u64(b, &key->cert->serial)) != 0 || 2170 (ret = sshbuf_get_u32(b, &key->cert->type)) != 0 || 2171 (ret = sshbuf_get_cstring(b, &key->cert->key_id, &kidlen)) != 0 || 2172 (ret = sshbuf_froms(b, &principals)) != 0 || 2173 (ret = sshbuf_get_u64(b, &key->cert->valid_after)) != 0 || 2174 (ret = sshbuf_get_u64(b, &key->cert->valid_before)) != 0 || 2175 (ret = sshbuf_froms(b, &crit)) != 0 || 2176 (ret = sshbuf_froms(b, &exts)) != 0 || 2177 (ret = sshbuf_get_string_direct(b, NULL, NULL)) != 0 || 2178 (ret = sshbuf_froms(b, &ca)) != 0) { 2179 /* XXX debug print error for ret */ 2180 ret = SSH_ERR_INVALID_FORMAT; 2181 goto out; 2182 } 2183 2184 /* Signature is left in the buffer so we can calculate this length */ 2185 signed_len = sshbuf_len(key->cert->certblob) - sshbuf_len(b); 2186 2187 if ((ret = sshbuf_get_string(b, &sig, &slen)) != 0) { 2188 ret = SSH_ERR_INVALID_FORMAT; 2189 goto out; 2190 } 2191 2192 if (key->cert->type != SSH2_CERT_TYPE_USER && 2193 key->cert->type != SSH2_CERT_TYPE_HOST) { 2194 ret = SSH_ERR_KEY_CERT_UNKNOWN_TYPE; 2195 goto out; 2196 } 2197 2198 /* Parse principals section */ 2199 while (sshbuf_len(principals) > 0) { 2200 char *principal = NULL; 2201 char **oprincipals = NULL; 2202 2203 if (key->cert->nprincipals >= SSHKEY_CERT_MAX_PRINCIPALS) { 2204 ret = SSH_ERR_INVALID_FORMAT; 2205 goto out; 2206 } 2207 if ((ret = sshbuf_get_cstring(principals, &principal, 2208 NULL)) != 0) { 2209 ret = SSH_ERR_INVALID_FORMAT; 2210 goto out; 2211 } 2212 oprincipals = key->cert->principals; 2213 key->cert->principals = recallocarray(key->cert->principals, 2214 key->cert->nprincipals, key->cert->nprincipals + 1, 2215 sizeof(*key->cert->principals)); 2216 if (key->cert->principals == NULL) { 2217 free(principal); 2218 key->cert->principals = oprincipals; 2219 ret = SSH_ERR_ALLOC_FAIL; 2220 goto out; 2221 } 2222 key->cert->principals[key->cert->nprincipals++] = principal; 2223 } 2224 2225 /* 2226 * Stash a copies of the critical options and extensions sections 2227 * for later use. 2228 */ 2229 if ((ret = sshbuf_putb(key->cert->critical, crit)) != 0 || 2230 (exts != NULL && 2231 (ret = sshbuf_putb(key->cert->extensions, exts)) != 0)) 2232 goto out; 2233 2234 /* 2235 * Validate critical options and extensions sections format. 2236 */ 2237 while (sshbuf_len(crit) != 0) { 2238 if ((ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0 || 2239 (ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0) { 2240 sshbuf_reset(key->cert->critical); 2241 ret = SSH_ERR_INVALID_FORMAT; 2242 goto out; 2243 } 2244 } 2245 while (exts != NULL && sshbuf_len(exts) != 0) { 2246 if ((ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0 || 2247 (ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0) { 2248 sshbuf_reset(key->cert->extensions); 2249 ret = SSH_ERR_INVALID_FORMAT; 2250 goto out; 2251 } 2252 } 2253 2254 /* Parse CA key and check signature */ 2255 if (sshkey_from_blob_internal(ca, &key->cert->signature_key, 0) != 0) { 2256 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2257 goto out; 2258 } 2259 if (!sshkey_type_is_valid_ca(key->cert->signature_key->type)) { 2260 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2261 goto out; 2262 } 2263 if ((ret = sshkey_verify(key->cert->signature_key, sig, slen, 2264 sshbuf_ptr(key->cert->certblob), signed_len, NULL, 0, NULL)) != 0) 2265 goto out; 2266 if ((ret = sshkey_get_sigtype(sig, slen, 2267 &key->cert->signature_type)) != 0) 2268 goto out; 2269 2270 /* Success */ 2271 ret = 0; 2272 out: 2273 sshbuf_free(ca); 2274 sshbuf_free(crit); 2275 sshbuf_free(exts); 2276 sshbuf_free(principals); 2277 free(sig); 2278 return ret; 2279 } 2280 2281 #ifdef WITH_OPENSSL 2282 static int 2283 check_rsa_length(const RSA *rsa) 2284 { 2285 const BIGNUM *rsa_n; 2286 2287 RSA_get0_key(rsa, &rsa_n, NULL, NULL); 2288 if (BN_num_bits(rsa_n) < SSH_RSA_MINIMUM_MODULUS_SIZE) 2289 return SSH_ERR_KEY_LENGTH; 2290 return 0; 2291 } 2292 #endif /* WITH_OPENSSL */ 2293 2294 static int 2295 sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp, 2296 int allow_cert) 2297 { 2298 int type, ret = SSH_ERR_INTERNAL_ERROR; 2299 char *ktype = NULL, *curve = NULL, *xmss_name = NULL; 2300 struct sshkey *key = NULL; 2301 size_t len; 2302 u_char *pk = NULL; 2303 struct sshbuf *copy; 2304 #ifdef WITH_OPENSSL 2305 EC_POINT *q = NULL; 2306 BIGNUM *rsa_n = NULL, *rsa_e = NULL; 2307 BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL, *dsa_pub_key = NULL; 2308 #endif /* WITH_OPENSSL */ 2309 2310 #ifdef DEBUG_PK /* XXX */ 2311 sshbuf_dump(b, stderr); 2312 #endif 2313 if (keyp != NULL) 2314 *keyp = NULL; 2315 if ((copy = sshbuf_fromb(b)) == NULL) { 2316 ret = SSH_ERR_ALLOC_FAIL; 2317 goto out; 2318 } 2319 if (sshbuf_get_cstring(b, &ktype, NULL) != 0) { 2320 ret = SSH_ERR_INVALID_FORMAT; 2321 goto out; 2322 } 2323 2324 type = sshkey_type_from_name(ktype); 2325 if (!allow_cert && sshkey_type_is_cert(type)) { 2326 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2327 goto out; 2328 } 2329 switch (type) { 2330 #ifdef WITH_OPENSSL 2331 case KEY_RSA_CERT: 2332 /* Skip nonce */ 2333 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2334 ret = SSH_ERR_INVALID_FORMAT; 2335 goto out; 2336 } 2337 /* FALLTHROUGH */ 2338 case KEY_RSA: 2339 if ((key = sshkey_new(type)) == NULL) { 2340 ret = SSH_ERR_ALLOC_FAIL; 2341 goto out; 2342 } 2343 if (sshbuf_get_bignum2(b, &rsa_e) != 0 || 2344 sshbuf_get_bignum2(b, &rsa_n) != 0) { 2345 ret = SSH_ERR_INVALID_FORMAT; 2346 goto out; 2347 } 2348 if (!RSA_set0_key(key->rsa, rsa_n, rsa_e, NULL)) { 2349 ret = SSH_ERR_LIBCRYPTO_ERROR; 2350 goto out; 2351 } 2352 rsa_n = rsa_e = NULL; /* transferred */ 2353 if ((ret = check_rsa_length(key->rsa)) != 0) 2354 goto out; 2355 #ifdef DEBUG_PK 2356 RSA_print_fp(stderr, key->rsa, 8); 2357 #endif 2358 break; 2359 case KEY_DSA_CERT: 2360 /* Skip nonce */ 2361 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2362 ret = SSH_ERR_INVALID_FORMAT; 2363 goto out; 2364 } 2365 /* FALLTHROUGH */ 2366 case KEY_DSA: 2367 if ((key = sshkey_new(type)) == NULL) { 2368 ret = SSH_ERR_ALLOC_FAIL; 2369 goto out; 2370 } 2371 if (sshbuf_get_bignum2(b, &dsa_p) != 0 || 2372 sshbuf_get_bignum2(b, &dsa_q) != 0 || 2373 sshbuf_get_bignum2(b, &dsa_g) != 0 || 2374 sshbuf_get_bignum2(b, &dsa_pub_key) != 0) { 2375 ret = SSH_ERR_INVALID_FORMAT; 2376 goto out; 2377 } 2378 if (!DSA_set0_pqg(key->dsa, dsa_p, dsa_q, dsa_g)) { 2379 ret = SSH_ERR_LIBCRYPTO_ERROR; 2380 goto out; 2381 } 2382 dsa_p = dsa_q = dsa_g = NULL; /* transferred */ 2383 if (!DSA_set0_key(key->dsa, dsa_pub_key, NULL)) { 2384 ret = SSH_ERR_LIBCRYPTO_ERROR; 2385 goto out; 2386 } 2387 dsa_pub_key = NULL; /* transferred */ 2388 #ifdef DEBUG_PK 2389 DSA_print_fp(stderr, key->dsa, 8); 2390 #endif 2391 break; 2392 case KEY_ECDSA_CERT: 2393 case KEY_ECDSA_SK_CERT: 2394 /* Skip nonce */ 2395 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2396 ret = SSH_ERR_INVALID_FORMAT; 2397 goto out; 2398 } 2399 /* FALLTHROUGH */ 2400 case KEY_ECDSA: 2401 case KEY_ECDSA_SK: 2402 if ((key = sshkey_new(type)) == NULL) { 2403 ret = SSH_ERR_ALLOC_FAIL; 2404 goto out; 2405 } 2406 key->ecdsa_nid = sshkey_ecdsa_nid_from_name(ktype); 2407 if (sshbuf_get_cstring(b, &curve, NULL) != 0) { 2408 ret = SSH_ERR_INVALID_FORMAT; 2409 goto out; 2410 } 2411 if (key->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 2412 ret = SSH_ERR_EC_CURVE_MISMATCH; 2413 goto out; 2414 } 2415 EC_KEY_free(key->ecdsa); 2416 if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid)) 2417 == NULL) { 2418 ret = SSH_ERR_EC_CURVE_INVALID; 2419 goto out; 2420 } 2421 if ((q = EC_POINT_new(EC_KEY_get0_group(key->ecdsa))) == NULL) { 2422 ret = SSH_ERR_ALLOC_FAIL; 2423 goto out; 2424 } 2425 if (sshbuf_get_ec(b, q, EC_KEY_get0_group(key->ecdsa)) != 0) { 2426 ret = SSH_ERR_INVALID_FORMAT; 2427 goto out; 2428 } 2429 if (sshkey_ec_validate_public(EC_KEY_get0_group(key->ecdsa), 2430 q) != 0) { 2431 ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2432 goto out; 2433 } 2434 if (EC_KEY_set_public_key(key->ecdsa, q) != 1) { 2435 /* XXX assume it is a allocation error */ 2436 ret = SSH_ERR_ALLOC_FAIL; 2437 goto out; 2438 } 2439 #ifdef DEBUG_PK 2440 sshkey_dump_ec_point(EC_KEY_get0_group(key->ecdsa), q); 2441 #endif 2442 if (type == KEY_ECDSA_SK || type == KEY_ECDSA_SK_CERT) { 2443 /* Parse additional security-key application string */ 2444 if (sshbuf_get_cstring(b, &key->sk_application, 2445 NULL) != 0) { 2446 ret = SSH_ERR_INVALID_FORMAT; 2447 goto out; 2448 } 2449 #ifdef DEBUG_PK 2450 fprintf(stderr, "App: %s\n", key->sk_application); 2451 #endif 2452 } 2453 break; 2454 #endif /* WITH_OPENSSL */ 2455 case KEY_ED25519_CERT: 2456 case KEY_ED25519_SK_CERT: 2457 /* Skip nonce */ 2458 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2459 ret = SSH_ERR_INVALID_FORMAT; 2460 goto out; 2461 } 2462 /* FALLTHROUGH */ 2463 case KEY_ED25519: 2464 case KEY_ED25519_SK: 2465 if ((ret = sshbuf_get_string(b, &pk, &len)) != 0) 2466 goto out; 2467 if (len != ED25519_PK_SZ) { 2468 ret = SSH_ERR_INVALID_FORMAT; 2469 goto out; 2470 } 2471 if ((key = sshkey_new(type)) == NULL) { 2472 ret = SSH_ERR_ALLOC_FAIL; 2473 goto out; 2474 } 2475 if (type == KEY_ED25519_SK || type == KEY_ED25519_SK_CERT) { 2476 /* Parse additional security-key application string */ 2477 if (sshbuf_get_cstring(b, &key->sk_application, 2478 NULL) != 0) { 2479 ret = SSH_ERR_INVALID_FORMAT; 2480 goto out; 2481 } 2482 #ifdef DEBUG_PK 2483 fprintf(stderr, "App: %s\n", key->sk_application); 2484 #endif 2485 } 2486 key->ed25519_pk = pk; 2487 pk = NULL; 2488 break; 2489 #ifdef WITH_XMSS 2490 case KEY_XMSS_CERT: 2491 /* Skip nonce */ 2492 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2493 ret = SSH_ERR_INVALID_FORMAT; 2494 goto out; 2495 } 2496 /* FALLTHROUGH */ 2497 case KEY_XMSS: 2498 if ((ret = sshbuf_get_cstring(b, &xmss_name, NULL)) != 0) 2499 goto out; 2500 if ((key = sshkey_new(type)) == NULL) { 2501 ret = SSH_ERR_ALLOC_FAIL; 2502 goto out; 2503 } 2504 if ((ret = sshkey_xmss_init(key, xmss_name)) != 0) 2505 goto out; 2506 if ((ret = sshbuf_get_string(b, &pk, &len)) != 0) 2507 goto out; 2508 if (len == 0 || len != sshkey_xmss_pklen(key)) { 2509 ret = SSH_ERR_INVALID_FORMAT; 2510 goto out; 2511 } 2512 key->xmss_pk = pk; 2513 pk = NULL; 2514 if (type != KEY_XMSS_CERT && 2515 (ret = sshkey_xmss_deserialize_pk_info(key, b)) != 0) 2516 goto out; 2517 break; 2518 #endif /* WITH_XMSS */ 2519 case KEY_UNSPEC: 2520 default: 2521 ret = SSH_ERR_KEY_TYPE_UNKNOWN; 2522 goto out; 2523 } 2524 2525 /* Parse certificate potion */ 2526 if (sshkey_is_cert(key) && (ret = cert_parse(b, key, copy)) != 0) 2527 goto out; 2528 2529 if (key != NULL && sshbuf_len(b) != 0) { 2530 ret = SSH_ERR_INVALID_FORMAT; 2531 goto out; 2532 } 2533 ret = 0; 2534 if (keyp != NULL) { 2535 *keyp = key; 2536 key = NULL; 2537 } 2538 out: 2539 sshbuf_free(copy); 2540 sshkey_free(key); 2541 free(xmss_name); 2542 free(ktype); 2543 free(curve); 2544 free(pk); 2545 #ifdef WITH_OPENSSL 2546 EC_POINT_free(q); 2547 BN_clear_free(rsa_n); 2548 BN_clear_free(rsa_e); 2549 BN_clear_free(dsa_p); 2550 BN_clear_free(dsa_q); 2551 BN_clear_free(dsa_g); 2552 BN_clear_free(dsa_pub_key); 2553 #endif /* WITH_OPENSSL */ 2554 return ret; 2555 } 2556 2557 int 2558 sshkey_from_blob(const u_char *blob, size_t blen, struct sshkey **keyp) 2559 { 2560 struct sshbuf *b; 2561 int r; 2562 2563 if ((b = sshbuf_from(blob, blen)) == NULL) 2564 return SSH_ERR_ALLOC_FAIL; 2565 r = sshkey_from_blob_internal(b, keyp, 1); 2566 sshbuf_free(b); 2567 return r; 2568 } 2569 2570 int 2571 sshkey_fromb(struct sshbuf *b, struct sshkey **keyp) 2572 { 2573 return sshkey_from_blob_internal(b, keyp, 1); 2574 } 2575 2576 int 2577 sshkey_froms(struct sshbuf *buf, struct sshkey **keyp) 2578 { 2579 struct sshbuf *b; 2580 int r; 2581 2582 if ((r = sshbuf_froms(buf, &b)) != 0) 2583 return r; 2584 r = sshkey_from_blob_internal(b, keyp, 1); 2585 sshbuf_free(b); 2586 return r; 2587 } 2588 2589 int 2590 sshkey_get_sigtype(const u_char *sig, size_t siglen, char **sigtypep) 2591 { 2592 int r; 2593 struct sshbuf *b = NULL; 2594 char *sigtype = NULL; 2595 2596 if (sigtypep != NULL) 2597 *sigtypep = NULL; 2598 if ((b = sshbuf_from(sig, siglen)) == NULL) 2599 return SSH_ERR_ALLOC_FAIL; 2600 if ((r = sshbuf_get_cstring(b, &sigtype, NULL)) != 0) 2601 goto out; 2602 /* success */ 2603 if (sigtypep != NULL) { 2604 *sigtypep = sigtype; 2605 sigtype = NULL; 2606 } 2607 r = 0; 2608 out: 2609 free(sigtype); 2610 sshbuf_free(b); 2611 return r; 2612 } 2613 2614 /* 2615 * 2616 * Checks whether a certificate's signature type is allowed. 2617 * Returns 0 (success) if the certificate signature type appears in the 2618 * "allowed" pattern-list, or the key is not a certificate to begin with. 2619 * Otherwise returns a ssherr.h code. 2620 */ 2621 int 2622 sshkey_check_cert_sigtype(const struct sshkey *key, const char *allowed) 2623 { 2624 if (key == NULL || allowed == NULL) 2625 return SSH_ERR_INVALID_ARGUMENT; 2626 if (!sshkey_type_is_cert(key->type)) 2627 return 0; 2628 if (key->cert == NULL || key->cert->signature_type == NULL) 2629 return SSH_ERR_INVALID_ARGUMENT; 2630 if (match_pattern_list(key->cert->signature_type, allowed, 0) != 1) 2631 return SSH_ERR_SIGN_ALG_UNSUPPORTED; 2632 return 0; 2633 } 2634 2635 /* 2636 * Returns the expected signature algorithm for a given public key algorithm. 2637 */ 2638 const char * 2639 sshkey_sigalg_by_name(const char *name) 2640 { 2641 const struct keytype *kt; 2642 2643 for (kt = keytypes; kt->type != -1; kt++) { 2644 if (strcmp(kt->name, name) != 0) 2645 continue; 2646 if (kt->sigalg != NULL) 2647 return kt->sigalg; 2648 if (!kt->cert) 2649 return kt->name; 2650 return sshkey_ssh_name_from_type_nid( 2651 sshkey_type_plain(kt->type), kt->nid); 2652 } 2653 return NULL; 2654 } 2655 2656 /* 2657 * Verifies that the signature algorithm appearing inside the signature blob 2658 * matches that which was requested. 2659 */ 2660 int 2661 sshkey_check_sigtype(const u_char *sig, size_t siglen, 2662 const char *requested_alg) 2663 { 2664 const char *expected_alg; 2665 char *sigtype = NULL; 2666 int r; 2667 2668 if (requested_alg == NULL) 2669 return 0; 2670 if ((expected_alg = sshkey_sigalg_by_name(requested_alg)) == NULL) 2671 return SSH_ERR_INVALID_ARGUMENT; 2672 if ((r = sshkey_get_sigtype(sig, siglen, &sigtype)) != 0) 2673 return r; 2674 r = strcmp(expected_alg, sigtype) == 0; 2675 free(sigtype); 2676 return r ? 0 : SSH_ERR_SIGN_ALG_UNSUPPORTED; 2677 } 2678 2679 int 2680 sshkey_sign(struct sshkey *key, 2681 u_char **sigp, size_t *lenp, 2682 const u_char *data, size_t datalen, 2683 const char *alg, const char *sk_provider, u_int compat) 2684 { 2685 int was_shielded = sshkey_is_shielded(key); 2686 int r2, r = SSH_ERR_INTERNAL_ERROR; 2687 2688 if (sigp != NULL) 2689 *sigp = NULL; 2690 if (lenp != NULL) 2691 *lenp = 0; 2692 if (datalen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2693 return SSH_ERR_INVALID_ARGUMENT; 2694 if ((r = sshkey_unshield_private(key)) != 0) 2695 return r; 2696 switch (key->type) { 2697 #ifdef WITH_OPENSSL 2698 case KEY_DSA_CERT: 2699 case KEY_DSA: 2700 r = ssh_dss_sign(key, sigp, lenp, data, datalen, compat); 2701 break; 2702 case KEY_ECDSA_CERT: 2703 case KEY_ECDSA: 2704 r = ssh_ecdsa_sign(key, sigp, lenp, data, datalen, compat); 2705 break; 2706 case KEY_RSA_CERT: 2707 case KEY_RSA: 2708 r = ssh_rsa_sign(key, sigp, lenp, data, datalen, alg); 2709 break; 2710 #endif /* WITH_OPENSSL */ 2711 case KEY_ED25519: 2712 case KEY_ED25519_CERT: 2713 r = ssh_ed25519_sign(key, sigp, lenp, data, datalen, compat); 2714 break; 2715 case KEY_ED25519_SK: 2716 case KEY_ED25519_SK_CERT: 2717 case KEY_ECDSA_SK_CERT: 2718 case KEY_ECDSA_SK: 2719 r = sshsk_sign(sk_provider, key, sigp, lenp, data, 2720 datalen, compat, /* XXX PIN */ NULL); 2721 break; 2722 #ifdef WITH_XMSS 2723 case KEY_XMSS: 2724 case KEY_XMSS_CERT: 2725 r = ssh_xmss_sign(key, sigp, lenp, data, datalen, compat); 2726 break; 2727 #endif /* WITH_XMSS */ 2728 default: 2729 r = SSH_ERR_KEY_TYPE_UNKNOWN; 2730 break; 2731 } 2732 if (was_shielded && (r2 = sshkey_shield_private(key)) != 0) 2733 return r2; 2734 return r; 2735 } 2736 2737 /* 2738 * ssh_key_verify returns 0 for a correct signature and < 0 on error. 2739 * If "alg" specified, then the signature must use that algorithm. 2740 */ 2741 int 2742 sshkey_verify(const struct sshkey *key, 2743 const u_char *sig, size_t siglen, 2744 const u_char *data, size_t dlen, const char *alg, u_int compat, 2745 struct sshkey_sig_details **detailsp) 2746 { 2747 if (detailsp != NULL) 2748 *detailsp = NULL; 2749 if (siglen == 0 || dlen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2750 return SSH_ERR_INVALID_ARGUMENT; 2751 switch (key->type) { 2752 #ifdef WITH_OPENSSL 2753 case KEY_DSA_CERT: 2754 case KEY_DSA: 2755 return ssh_dss_verify(key, sig, siglen, data, dlen, compat); 2756 case KEY_ECDSA_CERT: 2757 case KEY_ECDSA: 2758 return ssh_ecdsa_verify(key, sig, siglen, data, dlen, compat); 2759 case KEY_ECDSA_SK_CERT: 2760 case KEY_ECDSA_SK: 2761 return ssh_ecdsa_sk_verify(key, sig, siglen, data, dlen, 2762 compat, detailsp); 2763 case KEY_RSA_CERT: 2764 case KEY_RSA: 2765 return ssh_rsa_verify(key, sig, siglen, data, dlen, alg); 2766 #endif /* WITH_OPENSSL */ 2767 case KEY_ED25519: 2768 case KEY_ED25519_CERT: 2769 return ssh_ed25519_verify(key, sig, siglen, data, dlen, compat); 2770 case KEY_ED25519_SK: 2771 case KEY_ED25519_SK_CERT: 2772 return ssh_ed25519_sk_verify(key, sig, siglen, data, dlen, 2773 compat, detailsp); 2774 #ifdef WITH_XMSS 2775 case KEY_XMSS: 2776 case KEY_XMSS_CERT: 2777 return ssh_xmss_verify(key, sig, siglen, data, dlen, compat); 2778 #endif /* WITH_XMSS */ 2779 default: 2780 return SSH_ERR_KEY_TYPE_UNKNOWN; 2781 } 2782 } 2783 2784 /* Convert a plain key to their _CERT equivalent */ 2785 int 2786 sshkey_to_certified(struct sshkey *k) 2787 { 2788 int newtype; 2789 2790 switch (k->type) { 2791 #ifdef WITH_OPENSSL 2792 case KEY_RSA: 2793 newtype = KEY_RSA_CERT; 2794 break; 2795 case KEY_DSA: 2796 newtype = KEY_DSA_CERT; 2797 break; 2798 case KEY_ECDSA: 2799 newtype = KEY_ECDSA_CERT; 2800 break; 2801 case KEY_ECDSA_SK: 2802 newtype = KEY_ECDSA_SK_CERT; 2803 break; 2804 #endif /* WITH_OPENSSL */ 2805 case KEY_ED25519_SK: 2806 newtype = KEY_ED25519_SK_CERT; 2807 break; 2808 case KEY_ED25519: 2809 newtype = KEY_ED25519_CERT; 2810 break; 2811 #ifdef WITH_XMSS 2812 case KEY_XMSS: 2813 newtype = KEY_XMSS_CERT; 2814 break; 2815 #endif /* WITH_XMSS */ 2816 default: 2817 return SSH_ERR_INVALID_ARGUMENT; 2818 } 2819 if ((k->cert = cert_new()) == NULL) 2820 return SSH_ERR_ALLOC_FAIL; 2821 k->type = newtype; 2822 return 0; 2823 } 2824 2825 /* Convert a certificate to its raw key equivalent */ 2826 int 2827 sshkey_drop_cert(struct sshkey *k) 2828 { 2829 if (!sshkey_type_is_cert(k->type)) 2830 return SSH_ERR_KEY_TYPE_UNKNOWN; 2831 cert_free(k->cert); 2832 k->cert = NULL; 2833 k->type = sshkey_type_plain(k->type); 2834 return 0; 2835 } 2836 2837 /* Sign a certified key, (re-)generating the signed certblob. */ 2838 int 2839 sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg, 2840 const char *sk_provider, sshkey_certify_signer *signer, void *signer_ctx) 2841 { 2842 struct sshbuf *principals = NULL; 2843 u_char *ca_blob = NULL, *sig_blob = NULL, nonce[32]; 2844 size_t i, ca_len, sig_len; 2845 int ret = SSH_ERR_INTERNAL_ERROR; 2846 struct sshbuf *cert = NULL; 2847 char *sigtype = NULL; 2848 #ifdef WITH_OPENSSL 2849 const BIGNUM *rsa_n, *rsa_e, *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key; 2850 #endif /* WITH_OPENSSL */ 2851 2852 if (k == NULL || k->cert == NULL || 2853 k->cert->certblob == NULL || ca == NULL) 2854 return SSH_ERR_INVALID_ARGUMENT; 2855 if (!sshkey_is_cert(k)) 2856 return SSH_ERR_KEY_TYPE_UNKNOWN; 2857 if (!sshkey_type_is_valid_ca(ca->type)) 2858 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2859 2860 /* 2861 * If no alg specified as argument but a signature_type was set, 2862 * then prefer that. If both were specified, then they must match. 2863 */ 2864 if (alg == NULL) 2865 alg = k->cert->signature_type; 2866 else if (k->cert->signature_type != NULL && 2867 strcmp(alg, k->cert->signature_type) != 0) 2868 return SSH_ERR_INVALID_ARGUMENT; 2869 2870 /* 2871 * If no signing algorithm or signature_type was specified and we're 2872 * using a RSA key, then default to a good signature algorithm. 2873 */ 2874 if (alg == NULL && ca->type == KEY_RSA) 2875 alg = "rsa-sha2-512"; 2876 2877 if ((ret = sshkey_to_blob(ca, &ca_blob, &ca_len)) != 0) 2878 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2879 2880 cert = k->cert->certblob; /* for readability */ 2881 sshbuf_reset(cert); 2882 if ((ret = sshbuf_put_cstring(cert, sshkey_ssh_name(k))) != 0) 2883 goto out; 2884 2885 /* -v01 certs put nonce first */ 2886 arc4random_buf(&nonce, sizeof(nonce)); 2887 if ((ret = sshbuf_put_string(cert, nonce, sizeof(nonce))) != 0) 2888 goto out; 2889 2890 /* XXX this substantially duplicates to_blob(); refactor */ 2891 switch (k->type) { 2892 #ifdef WITH_OPENSSL 2893 case KEY_DSA_CERT: 2894 DSA_get0_pqg(k->dsa, &dsa_p, &dsa_q, &dsa_g); 2895 DSA_get0_key(k->dsa, &dsa_pub_key, NULL); 2896 if ((ret = sshbuf_put_bignum2(cert, dsa_p)) != 0 || 2897 (ret = sshbuf_put_bignum2(cert, dsa_q)) != 0 || 2898 (ret = sshbuf_put_bignum2(cert, dsa_g)) != 0 || 2899 (ret = sshbuf_put_bignum2(cert, dsa_pub_key)) != 0) 2900 goto out; 2901 break; 2902 case KEY_ECDSA_CERT: 2903 case KEY_ECDSA_SK_CERT: 2904 if ((ret = sshbuf_put_cstring(cert, 2905 sshkey_curve_nid_to_name(k->ecdsa_nid))) != 0 || 2906 (ret = sshbuf_put_ec(cert, 2907 EC_KEY_get0_public_key(k->ecdsa), 2908 EC_KEY_get0_group(k->ecdsa))) != 0) 2909 goto out; 2910 if (k->type == KEY_ECDSA_SK_CERT) { 2911 if ((ret = sshbuf_put_cstring(cert, 2912 k->sk_application)) != 0) 2913 goto out; 2914 } 2915 break; 2916 case KEY_RSA_CERT: 2917 RSA_get0_key(k->rsa, &rsa_n, &rsa_e, NULL); 2918 if ((ret = sshbuf_put_bignum2(cert, rsa_e)) != 0 || 2919 (ret = sshbuf_put_bignum2(cert, rsa_n)) != 0) 2920 goto out; 2921 break; 2922 #endif /* WITH_OPENSSL */ 2923 case KEY_ED25519_CERT: 2924 case KEY_ED25519_SK_CERT: 2925 if ((ret = sshbuf_put_string(cert, 2926 k->ed25519_pk, ED25519_PK_SZ)) != 0) 2927 goto out; 2928 if (k->type == KEY_ED25519_SK_CERT) { 2929 if ((ret = sshbuf_put_cstring(cert, 2930 k->sk_application)) != 0) 2931 goto out; 2932 } 2933 break; 2934 #ifdef WITH_XMSS 2935 case KEY_XMSS_CERT: 2936 if (k->xmss_name == NULL) { 2937 ret = SSH_ERR_INVALID_ARGUMENT; 2938 goto out; 2939 } 2940 if ((ret = sshbuf_put_cstring(cert, k->xmss_name)) || 2941 (ret = sshbuf_put_string(cert, 2942 k->xmss_pk, sshkey_xmss_pklen(k))) != 0) 2943 goto out; 2944 break; 2945 #endif /* WITH_XMSS */ 2946 default: 2947 ret = SSH_ERR_INVALID_ARGUMENT; 2948 goto out; 2949 } 2950 2951 if ((ret = sshbuf_put_u64(cert, k->cert->serial)) != 0 || 2952 (ret = sshbuf_put_u32(cert, k->cert->type)) != 0 || 2953 (ret = sshbuf_put_cstring(cert, k->cert->key_id)) != 0) 2954 goto out; 2955 2956 if ((principals = sshbuf_new()) == NULL) { 2957 ret = SSH_ERR_ALLOC_FAIL; 2958 goto out; 2959 } 2960 for (i = 0; i < k->cert->nprincipals; i++) { 2961 if ((ret = sshbuf_put_cstring(principals, 2962 k->cert->principals[i])) != 0) 2963 goto out; 2964 } 2965 if ((ret = sshbuf_put_stringb(cert, principals)) != 0 || 2966 (ret = sshbuf_put_u64(cert, k->cert->valid_after)) != 0 || 2967 (ret = sshbuf_put_u64(cert, k->cert->valid_before)) != 0 || 2968 (ret = sshbuf_put_stringb(cert, k->cert->critical)) != 0 || 2969 (ret = sshbuf_put_stringb(cert, k->cert->extensions)) != 0 || 2970 (ret = sshbuf_put_string(cert, NULL, 0)) != 0 || /* Reserved */ 2971 (ret = sshbuf_put_string(cert, ca_blob, ca_len)) != 0) 2972 goto out; 2973 2974 /* Sign the whole mess */ 2975 if ((ret = signer(ca, &sig_blob, &sig_len, sshbuf_ptr(cert), 2976 sshbuf_len(cert), alg, sk_provider, 0, signer_ctx)) != 0) 2977 goto out; 2978 /* Check and update signature_type against what was actually used */ 2979 if ((ret = sshkey_get_sigtype(sig_blob, sig_len, &sigtype)) != 0) 2980 goto out; 2981 if (alg != NULL && strcmp(alg, sigtype) != 0) { 2982 ret = SSH_ERR_SIGN_ALG_UNSUPPORTED; 2983 goto out; 2984 } 2985 if (k->cert->signature_type == NULL) { 2986 k->cert->signature_type = sigtype; 2987 sigtype = NULL; 2988 } 2989 /* Append signature and we are done */ 2990 if ((ret = sshbuf_put_string(cert, sig_blob, sig_len)) != 0) 2991 goto out; 2992 ret = 0; 2993 out: 2994 if (ret != 0) 2995 sshbuf_reset(cert); 2996 free(sig_blob); 2997 free(ca_blob); 2998 free(sigtype); 2999 sshbuf_free(principals); 3000 return ret; 3001 } 3002 3003 static int 3004 default_key_sign(struct sshkey *key, u_char **sigp, size_t *lenp, 3005 const u_char *data, size_t datalen, 3006 const char *alg, const char *sk_provider, u_int compat, void *ctx) 3007 { 3008 if (ctx != NULL) 3009 return SSH_ERR_INVALID_ARGUMENT; 3010 return sshkey_sign(key, sigp, lenp, data, datalen, alg, 3011 sk_provider, compat); 3012 } 3013 3014 int 3015 sshkey_certify(struct sshkey *k, struct sshkey *ca, const char *alg, 3016 const char *sk_provider) 3017 { 3018 return sshkey_certify_custom(k, ca, alg, sk_provider, 3019 default_key_sign, NULL); 3020 } 3021 3022 int 3023 sshkey_cert_check_authority(const struct sshkey *k, 3024 int want_host, int require_principal, 3025 const char *name, const char **reason) 3026 { 3027 u_int i, principal_matches; 3028 time_t now = time(NULL); 3029 3030 if (reason != NULL) 3031 *reason = NULL; 3032 3033 if (want_host) { 3034 if (k->cert->type != SSH2_CERT_TYPE_HOST) { 3035 *reason = "Certificate invalid: not a host certificate"; 3036 return SSH_ERR_KEY_CERT_INVALID; 3037 } 3038 } else { 3039 if (k->cert->type != SSH2_CERT_TYPE_USER) { 3040 *reason = "Certificate invalid: not a user certificate"; 3041 return SSH_ERR_KEY_CERT_INVALID; 3042 } 3043 } 3044 if (now < 0) { 3045 /* yikes - system clock before epoch! */ 3046 *reason = "Certificate invalid: not yet valid"; 3047 return SSH_ERR_KEY_CERT_INVALID; 3048 } 3049 if ((u_int64_t)now < k->cert->valid_after) { 3050 *reason = "Certificate invalid: not yet valid"; 3051 return SSH_ERR_KEY_CERT_INVALID; 3052 } 3053 if ((u_int64_t)now >= k->cert->valid_before) { 3054 *reason = "Certificate invalid: expired"; 3055 return SSH_ERR_KEY_CERT_INVALID; 3056 } 3057 if (k->cert->nprincipals == 0) { 3058 if (require_principal) { 3059 *reason = "Certificate lacks principal list"; 3060 return SSH_ERR_KEY_CERT_INVALID; 3061 } 3062 } else if (name != NULL) { 3063 principal_matches = 0; 3064 for (i = 0; i < k->cert->nprincipals; i++) { 3065 if (strcmp(name, k->cert->principals[i]) == 0) { 3066 principal_matches = 1; 3067 break; 3068 } 3069 } 3070 if (!principal_matches) { 3071 *reason = "Certificate invalid: name is not a listed " 3072 "principal"; 3073 return SSH_ERR_KEY_CERT_INVALID; 3074 } 3075 } 3076 return 0; 3077 } 3078 3079 size_t 3080 sshkey_format_cert_validity(const struct sshkey_cert *cert, char *s, size_t l) 3081 { 3082 char from[32], to[32], ret[64]; 3083 time_t tt; 3084 struct tm *tm; 3085 3086 *from = *to = '\0'; 3087 if (cert->valid_after == 0 && 3088 cert->valid_before == 0xffffffffffffffffULL) 3089 return strlcpy(s, "forever", l); 3090 3091 if (cert->valid_after != 0) { 3092 /* XXX revisit INT_MAX in 2038 :) */ 3093 tt = cert->valid_after > INT_MAX ? 3094 INT_MAX : cert->valid_after; 3095 tm = localtime(&tt); 3096 strftime(from, sizeof(from), "%Y-%m-%dT%H:%M:%S", tm); 3097 } 3098 if (cert->valid_before != 0xffffffffffffffffULL) { 3099 /* XXX revisit INT_MAX in 2038 :) */ 3100 tt = cert->valid_before > INT_MAX ? 3101 INT_MAX : cert->valid_before; 3102 tm = localtime(&tt); 3103 strftime(to, sizeof(to), "%Y-%m-%dT%H:%M:%S", tm); 3104 } 3105 3106 if (cert->valid_after == 0) 3107 snprintf(ret, sizeof(ret), "before %s", to); 3108 else if (cert->valid_before == 0xffffffffffffffffULL) 3109 snprintf(ret, sizeof(ret), "after %s", from); 3110 else 3111 snprintf(ret, sizeof(ret), "from %s to %s", from, to); 3112 3113 return strlcpy(s, ret, l); 3114 } 3115 3116 int 3117 sshkey_private_serialize_opt(struct sshkey *key, struct sshbuf *buf, 3118 enum sshkey_serialize_rep opts) 3119 { 3120 int r = SSH_ERR_INTERNAL_ERROR; 3121 int was_shielded = sshkey_is_shielded(key); 3122 struct sshbuf *b = NULL; 3123 #ifdef WITH_OPENSSL 3124 const BIGNUM *rsa_n, *rsa_e, *rsa_d, *rsa_iqmp, *rsa_p, *rsa_q; 3125 const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key, *dsa_priv_key; 3126 #endif /* WITH_OPENSSL */ 3127 3128 if ((r = sshkey_unshield_private(key)) != 0) 3129 return r; 3130 if ((b = sshbuf_new()) == NULL) 3131 return SSH_ERR_ALLOC_FAIL; 3132 if ((r = sshbuf_put_cstring(b, sshkey_ssh_name(key))) != 0) 3133 goto out; 3134 switch (key->type) { 3135 #ifdef WITH_OPENSSL 3136 case KEY_RSA: 3137 RSA_get0_key(key->rsa, &rsa_n, &rsa_e, &rsa_d); 3138 RSA_get0_factors(key->rsa, &rsa_p, &rsa_q); 3139 RSA_get0_crt_params(key->rsa, NULL, NULL, &rsa_iqmp); 3140 if ((r = sshbuf_put_bignum2(b, rsa_n)) != 0 || 3141 (r = sshbuf_put_bignum2(b, rsa_e)) != 0 || 3142 (r = sshbuf_put_bignum2(b, rsa_d)) != 0 || 3143 (r = sshbuf_put_bignum2(b, rsa_iqmp)) != 0 || 3144 (r = sshbuf_put_bignum2(b, rsa_p)) != 0 || 3145 (r = sshbuf_put_bignum2(b, rsa_q)) != 0) 3146 goto out; 3147 break; 3148 case KEY_RSA_CERT: 3149 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3150 r = SSH_ERR_INVALID_ARGUMENT; 3151 goto out; 3152 } 3153 RSA_get0_key(key->rsa, NULL, NULL, &rsa_d); 3154 RSA_get0_factors(key->rsa, &rsa_p, &rsa_q); 3155 RSA_get0_crt_params(key->rsa, NULL, NULL, &rsa_iqmp); 3156 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3157 (r = sshbuf_put_bignum2(b, rsa_d)) != 0 || 3158 (r = sshbuf_put_bignum2(b, rsa_iqmp)) != 0 || 3159 (r = sshbuf_put_bignum2(b, rsa_p)) != 0 || 3160 (r = sshbuf_put_bignum2(b, rsa_q)) != 0) 3161 goto out; 3162 break; 3163 case KEY_DSA: 3164 DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g); 3165 DSA_get0_key(key->dsa, &dsa_pub_key, &dsa_priv_key); 3166 if ((r = sshbuf_put_bignum2(b, dsa_p)) != 0 || 3167 (r = sshbuf_put_bignum2(b, dsa_q)) != 0 || 3168 (r = sshbuf_put_bignum2(b, dsa_g)) != 0 || 3169 (r = sshbuf_put_bignum2(b, dsa_pub_key)) != 0 || 3170 (r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0) 3171 goto out; 3172 break; 3173 case KEY_DSA_CERT: 3174 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3175 r = SSH_ERR_INVALID_ARGUMENT; 3176 goto out; 3177 } 3178 DSA_get0_key(key->dsa, NULL, &dsa_priv_key); 3179 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3180 (r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0) 3181 goto out; 3182 break; 3183 case KEY_ECDSA: 3184 if ((r = sshbuf_put_cstring(b, 3185 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 3186 (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 || 3187 (r = sshbuf_put_bignum2(b, 3188 EC_KEY_get0_private_key(key->ecdsa))) != 0) 3189 goto out; 3190 break; 3191 case KEY_ECDSA_CERT: 3192 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3193 r = SSH_ERR_INVALID_ARGUMENT; 3194 goto out; 3195 } 3196 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3197 (r = sshbuf_put_bignum2(b, 3198 EC_KEY_get0_private_key(key->ecdsa))) != 0) 3199 goto out; 3200 break; 3201 case KEY_ECDSA_SK: 3202 if ((r = sshbuf_put_cstring(b, 3203 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 3204 (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 || 3205 (r = sshbuf_put_cstring(b, key->sk_application)) != 0 || 3206 (r = sshbuf_put_u8(b, key->sk_flags)) != 0 || 3207 (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 || 3208 (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0) 3209 goto out; 3210 break; 3211 case KEY_ECDSA_SK_CERT: 3212 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3213 r = SSH_ERR_INVALID_ARGUMENT; 3214 goto out; 3215 } 3216 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3217 (r = sshbuf_put_cstring(b, key->sk_application)) != 0 || 3218 (r = sshbuf_put_u8(b, key->sk_flags)) != 0 || 3219 (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 || 3220 (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0) 3221 goto out; 3222 break; 3223 #endif /* WITH_OPENSSL */ 3224 case KEY_ED25519: 3225 if ((r = sshbuf_put_string(b, key->ed25519_pk, 3226 ED25519_PK_SZ)) != 0 || 3227 (r = sshbuf_put_string(b, key->ed25519_sk, 3228 ED25519_SK_SZ)) != 0) 3229 goto out; 3230 break; 3231 case KEY_ED25519_CERT: 3232 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3233 r = SSH_ERR_INVALID_ARGUMENT; 3234 goto out; 3235 } 3236 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3237 (r = sshbuf_put_string(b, key->ed25519_pk, 3238 ED25519_PK_SZ)) != 0 || 3239 (r = sshbuf_put_string(b, key->ed25519_sk, 3240 ED25519_SK_SZ)) != 0) 3241 goto out; 3242 break; 3243 case KEY_ED25519_SK: 3244 if ((r = sshbuf_put_string(b, key->ed25519_pk, 3245 ED25519_PK_SZ)) != 0 || 3246 (r = sshbuf_put_cstring(b, key->sk_application)) != 0 || 3247 (r = sshbuf_put_u8(b, key->sk_flags)) != 0 || 3248 (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 || 3249 (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0) 3250 goto out; 3251 break; 3252 case KEY_ED25519_SK_CERT: 3253 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3254 r = SSH_ERR_INVALID_ARGUMENT; 3255 goto out; 3256 } 3257 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3258 (r = sshbuf_put_string(b, key->ed25519_pk, 3259 ED25519_PK_SZ)) != 0 || 3260 (r = sshbuf_put_cstring(b, key->sk_application)) != 0 || 3261 (r = sshbuf_put_u8(b, key->sk_flags)) != 0 || 3262 (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 || 3263 (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0) 3264 goto out; 3265 break; 3266 #ifdef WITH_XMSS 3267 case KEY_XMSS: 3268 if (key->xmss_name == NULL) { 3269 r = SSH_ERR_INVALID_ARGUMENT; 3270 goto out; 3271 } 3272 if ((r = sshbuf_put_cstring(b, key->xmss_name)) != 0 || 3273 (r = sshbuf_put_string(b, key->xmss_pk, 3274 sshkey_xmss_pklen(key))) != 0 || 3275 (r = sshbuf_put_string(b, key->xmss_sk, 3276 sshkey_xmss_sklen(key))) != 0 || 3277 (r = sshkey_xmss_serialize_state_opt(key, b, opts)) != 0) 3278 goto out; 3279 break; 3280 case KEY_XMSS_CERT: 3281 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0 || 3282 key->xmss_name == NULL) { 3283 r = SSH_ERR_INVALID_ARGUMENT; 3284 goto out; 3285 } 3286 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3287 (r = sshbuf_put_cstring(b, key->xmss_name)) != 0 || 3288 (r = sshbuf_put_string(b, key->xmss_pk, 3289 sshkey_xmss_pklen(key))) != 0 || 3290 (r = sshbuf_put_string(b, key->xmss_sk, 3291 sshkey_xmss_sklen(key))) != 0 || 3292 (r = sshkey_xmss_serialize_state_opt(key, b, opts)) != 0) 3293 goto out; 3294 break; 3295 #endif /* WITH_XMSS */ 3296 default: 3297 r = SSH_ERR_INVALID_ARGUMENT; 3298 goto out; 3299 } 3300 /* 3301 * success (but we still need to append the output to buf after 3302 * possibly re-shielding the private key) 3303 */ 3304 r = 0; 3305 out: 3306 if (was_shielded) 3307 r = sshkey_shield_private(key); 3308 if (r == 0) 3309 r = sshbuf_putb(buf, b); 3310 sshbuf_free(b); 3311 3312 return r; 3313 } 3314 3315 int 3316 sshkey_private_serialize(struct sshkey *key, struct sshbuf *b) 3317 { 3318 return sshkey_private_serialize_opt(key, b, 3319 SSHKEY_SERIALIZE_DEFAULT); 3320 } 3321 3322 int 3323 sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) 3324 { 3325 char *tname = NULL, *curve = NULL, *xmss_name = NULL; 3326 struct sshkey *k = NULL; 3327 size_t pklen = 0, sklen = 0; 3328 int type, r = SSH_ERR_INTERNAL_ERROR; 3329 u_char *ed25519_pk = NULL, *ed25519_sk = NULL; 3330 u_char *xmss_pk = NULL, *xmss_sk = NULL; 3331 #ifdef WITH_OPENSSL 3332 BIGNUM *exponent = NULL; 3333 BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL; 3334 BIGNUM *rsa_iqmp = NULL, *rsa_p = NULL, *rsa_q = NULL; 3335 BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL; 3336 BIGNUM *dsa_pub_key = NULL, *dsa_priv_key = NULL; 3337 #endif /* WITH_OPENSSL */ 3338 3339 if (kp != NULL) 3340 *kp = NULL; 3341 if ((r = sshbuf_get_cstring(buf, &tname, NULL)) != 0) 3342 goto out; 3343 type = sshkey_type_from_name(tname); 3344 switch (type) { 3345 #ifdef WITH_OPENSSL 3346 case KEY_DSA: 3347 if ((k = sshkey_new(type)) == NULL) { 3348 r = SSH_ERR_ALLOC_FAIL; 3349 goto out; 3350 } 3351 if ((r = sshbuf_get_bignum2(buf, &dsa_p)) != 0 || 3352 (r = sshbuf_get_bignum2(buf, &dsa_q)) != 0 || 3353 (r = sshbuf_get_bignum2(buf, &dsa_g)) != 0 || 3354 (r = sshbuf_get_bignum2(buf, &dsa_pub_key)) != 0 || 3355 (r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0) 3356 goto out; 3357 if (!DSA_set0_pqg(k->dsa, dsa_p, dsa_q, dsa_g)) { 3358 r = SSH_ERR_LIBCRYPTO_ERROR; 3359 goto out; 3360 } 3361 dsa_p = dsa_q = dsa_g = NULL; /* transferred */ 3362 if (!DSA_set0_key(k->dsa, dsa_pub_key, dsa_priv_key)) { 3363 r = SSH_ERR_LIBCRYPTO_ERROR; 3364 goto out; 3365 } 3366 dsa_pub_key = dsa_priv_key = NULL; /* transferred */ 3367 break; 3368 case KEY_DSA_CERT: 3369 if ((r = sshkey_froms(buf, &k)) != 0 || 3370 (r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0) 3371 goto out; 3372 if (k->type != type) { 3373 r = SSH_ERR_INVALID_FORMAT; 3374 goto out; 3375 } 3376 if (!DSA_set0_key(k->dsa, NULL, dsa_priv_key)) { 3377 r = SSH_ERR_LIBCRYPTO_ERROR; 3378 goto out; 3379 } 3380 dsa_priv_key = NULL; /* transferred */ 3381 break; 3382 case KEY_ECDSA: 3383 if ((k = sshkey_new(type)) == NULL) { 3384 r = SSH_ERR_ALLOC_FAIL; 3385 goto out; 3386 } 3387 if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) { 3388 r = SSH_ERR_INVALID_ARGUMENT; 3389 goto out; 3390 } 3391 if ((r = sshbuf_get_cstring(buf, &curve, NULL)) != 0) 3392 goto out; 3393 if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 3394 r = SSH_ERR_EC_CURVE_MISMATCH; 3395 goto out; 3396 } 3397 k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 3398 if (k->ecdsa == NULL) { 3399 r = SSH_ERR_LIBCRYPTO_ERROR; 3400 goto out; 3401 } 3402 if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 || 3403 (r = sshbuf_get_bignum2(buf, &exponent))) 3404 goto out; 3405 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { 3406 r = SSH_ERR_LIBCRYPTO_ERROR; 3407 goto out; 3408 } 3409 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 3410 EC_KEY_get0_public_key(k->ecdsa))) != 0 || 3411 (r = sshkey_ec_validate_private(k->ecdsa)) != 0) 3412 goto out; 3413 break; 3414 case KEY_ECDSA_CERT: 3415 if ((r = sshkey_froms(buf, &k)) != 0 || 3416 (r = sshbuf_get_bignum2(buf, &exponent)) != 0) 3417 goto out; 3418 if (k->type != type || 3419 k->ecdsa_nid != sshkey_ecdsa_nid_from_name(tname)) { 3420 r = SSH_ERR_INVALID_FORMAT; 3421 goto out; 3422 } 3423 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { 3424 r = SSH_ERR_LIBCRYPTO_ERROR; 3425 goto out; 3426 } 3427 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 3428 EC_KEY_get0_public_key(k->ecdsa))) != 0 || 3429 (r = sshkey_ec_validate_private(k->ecdsa)) != 0) 3430 goto out; 3431 break; 3432 case KEY_ECDSA_SK: 3433 if ((k = sshkey_new(type)) == NULL) { 3434 r = SSH_ERR_ALLOC_FAIL; 3435 goto out; 3436 } 3437 if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) { 3438 r = SSH_ERR_INVALID_ARGUMENT; 3439 goto out; 3440 } 3441 if ((r = sshbuf_get_cstring(buf, &curve, NULL)) != 0) 3442 goto out; 3443 if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 3444 r = SSH_ERR_EC_CURVE_MISMATCH; 3445 goto out; 3446 } 3447 if ((k->sk_key_handle = sshbuf_new()) == NULL || 3448 (k->sk_reserved = sshbuf_new()) == NULL) { 3449 r = SSH_ERR_ALLOC_FAIL; 3450 goto out; 3451 } 3452 k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 3453 if (k->ecdsa == NULL) { 3454 r = SSH_ERR_LIBCRYPTO_ERROR; 3455 goto out; 3456 } 3457 if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 || 3458 (r = sshbuf_get_cstring(buf, &k->sk_application, 3459 NULL)) != 0 || 3460 (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 || 3461 (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 || 3462 (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0) 3463 goto out; 3464 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 3465 EC_KEY_get0_public_key(k->ecdsa))) != 0) 3466 goto out; 3467 break; 3468 case KEY_ECDSA_SK_CERT: 3469 if ((r = sshkey_froms(buf, &k)) != 0) 3470 goto out; 3471 if ((k->sk_key_handle = sshbuf_new()) == NULL || 3472 (k->sk_reserved = sshbuf_new()) == NULL) { 3473 r = SSH_ERR_ALLOC_FAIL; 3474 goto out; 3475 } 3476 if ((r = sshbuf_get_cstring(buf, &k->sk_application, 3477 NULL)) != 0 || 3478 (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 || 3479 (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 || 3480 (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0) 3481 goto out; 3482 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 3483 EC_KEY_get0_public_key(k->ecdsa))) != 0) 3484 goto out; 3485 break; 3486 case KEY_RSA: 3487 if ((k = sshkey_new(type)) == NULL) { 3488 r = SSH_ERR_ALLOC_FAIL; 3489 goto out; 3490 } 3491 if ((r = sshbuf_get_bignum2(buf, &rsa_n)) != 0 || 3492 (r = sshbuf_get_bignum2(buf, &rsa_e)) != 0 || 3493 (r = sshbuf_get_bignum2(buf, &rsa_d)) != 0 || 3494 (r = sshbuf_get_bignum2(buf, &rsa_iqmp)) != 0 || 3495 (r = sshbuf_get_bignum2(buf, &rsa_p)) != 0 || 3496 (r = sshbuf_get_bignum2(buf, &rsa_q)) != 0) 3497 goto out; 3498 if (!RSA_set0_key(k->rsa, rsa_n, rsa_e, rsa_d)) { 3499 r = SSH_ERR_LIBCRYPTO_ERROR; 3500 goto out; 3501 } 3502 rsa_n = rsa_e = rsa_d = NULL; /* transferred */ 3503 if (!RSA_set0_factors(k->rsa, rsa_p, rsa_q)) { 3504 r = SSH_ERR_LIBCRYPTO_ERROR; 3505 goto out; 3506 } 3507 rsa_p = rsa_q = NULL; /* transferred */ 3508 if ((r = check_rsa_length(k->rsa)) != 0) 3509 goto out; 3510 if ((r = ssh_rsa_complete_crt_parameters(k, rsa_iqmp)) != 0) 3511 goto out; 3512 break; 3513 case KEY_RSA_CERT: 3514 if ((r = sshkey_froms(buf, &k)) != 0 || 3515 (r = sshbuf_get_bignum2(buf, &rsa_d)) != 0 || 3516 (r = sshbuf_get_bignum2(buf, &rsa_iqmp)) != 0 || 3517 (r = sshbuf_get_bignum2(buf, &rsa_p)) != 0 || 3518 (r = sshbuf_get_bignum2(buf, &rsa_q)) != 0) 3519 goto out; 3520 if (k->type != type) { 3521 r = SSH_ERR_INVALID_FORMAT; 3522 goto out; 3523 } 3524 if (!RSA_set0_key(k->rsa, NULL, NULL, rsa_d)) { 3525 r = SSH_ERR_LIBCRYPTO_ERROR; 3526 goto out; 3527 } 3528 rsa_d = NULL; /* transferred */ 3529 if (!RSA_set0_factors(k->rsa, rsa_p, rsa_q)) { 3530 r = SSH_ERR_LIBCRYPTO_ERROR; 3531 goto out; 3532 } 3533 rsa_p = rsa_q = NULL; /* transferred */ 3534 if ((r = check_rsa_length(k->rsa)) != 0) 3535 goto out; 3536 if ((r = ssh_rsa_complete_crt_parameters(k, rsa_iqmp)) != 0) 3537 goto out; 3538 break; 3539 #endif /* WITH_OPENSSL */ 3540 case KEY_ED25519: 3541 if ((k = sshkey_new(type)) == NULL) { 3542 r = SSH_ERR_ALLOC_FAIL; 3543 goto out; 3544 } 3545 if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || 3546 (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) 3547 goto out; 3548 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { 3549 r = SSH_ERR_INVALID_FORMAT; 3550 goto out; 3551 } 3552 k->ed25519_pk = ed25519_pk; 3553 k->ed25519_sk = ed25519_sk; 3554 ed25519_pk = ed25519_sk = NULL; 3555 break; 3556 case KEY_ED25519_CERT: 3557 if ((r = sshkey_froms(buf, &k)) != 0 || 3558 (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || 3559 (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) 3560 goto out; 3561 if (k->type != type) { 3562 r = SSH_ERR_INVALID_FORMAT; 3563 goto out; 3564 } 3565 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { 3566 r = SSH_ERR_INVALID_FORMAT; 3567 goto out; 3568 } 3569 k->ed25519_pk = ed25519_pk; 3570 k->ed25519_sk = ed25519_sk; 3571 ed25519_pk = ed25519_sk = NULL; /* transferred */ 3572 break; 3573 case KEY_ED25519_SK: 3574 if ((k = sshkey_new(type)) == NULL) { 3575 r = SSH_ERR_ALLOC_FAIL; 3576 goto out; 3577 } 3578 if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0) 3579 goto out; 3580 if (pklen != ED25519_PK_SZ) { 3581 r = SSH_ERR_INVALID_FORMAT; 3582 goto out; 3583 } 3584 if ((k->sk_key_handle = sshbuf_new()) == NULL || 3585 (k->sk_reserved = sshbuf_new()) == NULL) { 3586 r = SSH_ERR_ALLOC_FAIL; 3587 goto out; 3588 } 3589 if ((r = sshbuf_get_cstring(buf, &k->sk_application, 3590 NULL)) != 0 || 3591 (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 || 3592 (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 || 3593 (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0) 3594 goto out; 3595 k->ed25519_pk = ed25519_pk; 3596 ed25519_pk = NULL; 3597 break; 3598 case KEY_ED25519_SK_CERT: 3599 if ((r = sshkey_froms(buf, &k)) != 0 || 3600 (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0) 3601 goto out; 3602 if (k->type != type) { 3603 r = SSH_ERR_INVALID_FORMAT; 3604 goto out; 3605 } 3606 if (pklen != ED25519_PK_SZ) { 3607 r = SSH_ERR_INVALID_FORMAT; 3608 goto out; 3609 } 3610 if ((k->sk_key_handle = sshbuf_new()) == NULL || 3611 (k->sk_reserved = sshbuf_new()) == NULL) { 3612 r = SSH_ERR_ALLOC_FAIL; 3613 goto out; 3614 } 3615 if ((r = sshbuf_get_cstring(buf, &k->sk_application, 3616 NULL)) != 0 || 3617 (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 || 3618 (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 || 3619 (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0) 3620 goto out; 3621 k->ed25519_pk = ed25519_pk; 3622 ed25519_pk = NULL; /* transferred */ 3623 break; 3624 #ifdef WITH_XMSS 3625 case KEY_XMSS: 3626 if ((k = sshkey_new(type)) == NULL) { 3627 r = SSH_ERR_ALLOC_FAIL; 3628 goto out; 3629 } 3630 if ((r = sshbuf_get_cstring(buf, &xmss_name, NULL)) != 0 || 3631 (r = sshkey_xmss_init(k, xmss_name)) != 0 || 3632 (r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 || 3633 (r = sshbuf_get_string(buf, &xmss_sk, &sklen)) != 0) 3634 goto out; 3635 if (pklen != sshkey_xmss_pklen(k) || 3636 sklen != sshkey_xmss_sklen(k)) { 3637 r = SSH_ERR_INVALID_FORMAT; 3638 goto out; 3639 } 3640 k->xmss_pk = xmss_pk; 3641 k->xmss_sk = xmss_sk; 3642 xmss_pk = xmss_sk = NULL; 3643 /* optional internal state */ 3644 if ((r = sshkey_xmss_deserialize_state_opt(k, buf)) != 0) 3645 goto out; 3646 break; 3647 case KEY_XMSS_CERT: 3648 if ((r = sshkey_froms(buf, &k)) != 0 || 3649 (r = sshbuf_get_cstring(buf, &xmss_name, NULL)) != 0 || 3650 (r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 || 3651 (r = sshbuf_get_string(buf, &xmss_sk, &sklen)) != 0) 3652 goto out; 3653 if (k->type != type || strcmp(xmss_name, k->xmss_name) != 0) { 3654 r = SSH_ERR_INVALID_FORMAT; 3655 goto out; 3656 } 3657 if (pklen != sshkey_xmss_pklen(k) || 3658 sklen != sshkey_xmss_sklen(k)) { 3659 r = SSH_ERR_INVALID_FORMAT; 3660 goto out; 3661 } 3662 k->xmss_pk = xmss_pk; 3663 k->xmss_sk = xmss_sk; 3664 xmss_pk = xmss_sk = NULL; 3665 /* optional internal state */ 3666 if ((r = sshkey_xmss_deserialize_state_opt(k, buf)) != 0) 3667 goto out; 3668 break; 3669 #endif /* WITH_XMSS */ 3670 default: 3671 r = SSH_ERR_KEY_TYPE_UNKNOWN; 3672 goto out; 3673 } 3674 #ifdef WITH_OPENSSL 3675 /* enable blinding */ 3676 switch (k->type) { 3677 case KEY_RSA: 3678 case KEY_RSA_CERT: 3679 if (RSA_blinding_on(k->rsa, NULL) != 1) { 3680 r = SSH_ERR_LIBCRYPTO_ERROR; 3681 goto out; 3682 } 3683 break; 3684 } 3685 #endif /* WITH_OPENSSL */ 3686 /* success */ 3687 r = 0; 3688 if (kp != NULL) { 3689 *kp = k; 3690 k = NULL; 3691 } 3692 out: 3693 free(tname); 3694 free(curve); 3695 #ifdef WITH_OPENSSL 3696 BN_clear_free(exponent); 3697 BN_clear_free(dsa_p); 3698 BN_clear_free(dsa_q); 3699 BN_clear_free(dsa_g); 3700 BN_clear_free(dsa_pub_key); 3701 BN_clear_free(dsa_priv_key); 3702 BN_clear_free(rsa_n); 3703 BN_clear_free(rsa_e); 3704 BN_clear_free(rsa_d); 3705 BN_clear_free(rsa_p); 3706 BN_clear_free(rsa_q); 3707 BN_clear_free(rsa_iqmp); 3708 #endif /* WITH_OPENSSL */ 3709 sshkey_free(k); 3710 freezero(ed25519_pk, pklen); 3711 freezero(ed25519_sk, sklen); 3712 free(xmss_name); 3713 freezero(xmss_pk, pklen); 3714 freezero(xmss_sk, sklen); 3715 return r; 3716 } 3717 3718 #ifdef WITH_OPENSSL 3719 int 3720 sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public) 3721 { 3722 EC_POINT *nq = NULL; 3723 BIGNUM *order = NULL, *x = NULL, *y = NULL, *tmp = NULL; 3724 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 3725 3726 /* 3727 * NB. This assumes OpenSSL has already verified that the public 3728 * point lies on the curve. This is done by EC_POINT_oct2point() 3729 * implicitly calling EC_POINT_is_on_curve(). If this code is ever 3730 * reachable with public points not unmarshalled using 3731 * EC_POINT_oct2point then the caller will need to explicitly check. 3732 */ 3733 3734 /* 3735 * We shouldn't ever hit this case because bignum_get_ecpoint() 3736 * refuses to load GF2m points. 3737 */ 3738 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 3739 NID_X9_62_prime_field) 3740 goto out; 3741 3742 /* Q != infinity */ 3743 if (EC_POINT_is_at_infinity(group, public)) 3744 goto out; 3745 3746 if ((x = BN_new()) == NULL || 3747 (y = BN_new()) == NULL || 3748 (order = BN_new()) == NULL || 3749 (tmp = BN_new()) == NULL) { 3750 ret = SSH_ERR_ALLOC_FAIL; 3751 goto out; 3752 } 3753 3754 /* log2(x) > log2(order)/2, log2(y) > log2(order)/2 */ 3755 if (EC_GROUP_get_order(group, order, NULL) != 1 || 3756 EC_POINT_get_affine_coordinates_GFp(group, public, 3757 x, y, NULL) != 1) { 3758 ret = SSH_ERR_LIBCRYPTO_ERROR; 3759 goto out; 3760 } 3761 if (BN_num_bits(x) <= BN_num_bits(order) / 2 || 3762 BN_num_bits(y) <= BN_num_bits(order) / 2) 3763 goto out; 3764 3765 /* nQ == infinity (n == order of subgroup) */ 3766 if ((nq = EC_POINT_new(group)) == NULL) { 3767 ret = SSH_ERR_ALLOC_FAIL; 3768 goto out; 3769 } 3770 if (EC_POINT_mul(group, nq, NULL, public, order, NULL) != 1) { 3771 ret = SSH_ERR_LIBCRYPTO_ERROR; 3772 goto out; 3773 } 3774 if (EC_POINT_is_at_infinity(group, nq) != 1) 3775 goto out; 3776 3777 /* x < order - 1, y < order - 1 */ 3778 if (!BN_sub(tmp, order, BN_value_one())) { 3779 ret = SSH_ERR_LIBCRYPTO_ERROR; 3780 goto out; 3781 } 3782 if (BN_cmp(x, tmp) >= 0 || BN_cmp(y, tmp) >= 0) 3783 goto out; 3784 ret = 0; 3785 out: 3786 BN_clear_free(x); 3787 BN_clear_free(y); 3788 BN_clear_free(order); 3789 BN_clear_free(tmp); 3790 EC_POINT_free(nq); 3791 return ret; 3792 } 3793 3794 int 3795 sshkey_ec_validate_private(const EC_KEY *key) 3796 { 3797 BIGNUM *order = NULL, *tmp = NULL; 3798 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 3799 3800 if ((order = BN_new()) == NULL || (tmp = BN_new()) == NULL) { 3801 ret = SSH_ERR_ALLOC_FAIL; 3802 goto out; 3803 } 3804 3805 /* log2(private) > log2(order)/2 */ 3806 if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, NULL) != 1) { 3807 ret = SSH_ERR_LIBCRYPTO_ERROR; 3808 goto out; 3809 } 3810 if (BN_num_bits(EC_KEY_get0_private_key(key)) <= 3811 BN_num_bits(order) / 2) 3812 goto out; 3813 3814 /* private < order - 1 */ 3815 if (!BN_sub(tmp, order, BN_value_one())) { 3816 ret = SSH_ERR_LIBCRYPTO_ERROR; 3817 goto out; 3818 } 3819 if (BN_cmp(EC_KEY_get0_private_key(key), tmp) >= 0) 3820 goto out; 3821 ret = 0; 3822 out: 3823 BN_clear_free(order); 3824 BN_clear_free(tmp); 3825 return ret; 3826 } 3827 3828 void 3829 sshkey_dump_ec_point(const EC_GROUP *group, const EC_POINT *point) 3830 { 3831 BIGNUM *x = NULL, *y = NULL; 3832 3833 if (point == NULL) { 3834 fputs("point=(NULL)\n", stderr); 3835 return; 3836 } 3837 if ((x = BN_new()) == NULL || (y = BN_new()) == NULL) { 3838 fprintf(stderr, "%s: BN_new failed\n", __func__); 3839 goto out; 3840 } 3841 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 3842 NID_X9_62_prime_field) { 3843 fprintf(stderr, "%s: group is not a prime field\n", __func__); 3844 goto out; 3845 } 3846 if (EC_POINT_get_affine_coordinates_GFp(group, point, 3847 x, y, NULL) != 1) { 3848 fprintf(stderr, "%s: EC_POINT_get_affine_coordinates_GFp\n", 3849 __func__); 3850 goto out; 3851 } 3852 fputs("x=", stderr); 3853 BN_print_fp(stderr, x); 3854 fputs("\ny=", stderr); 3855 BN_print_fp(stderr, y); 3856 fputs("\n", stderr); 3857 out: 3858 BN_clear_free(x); 3859 BN_clear_free(y); 3860 } 3861 3862 void 3863 sshkey_dump_ec_key(const EC_KEY *key) 3864 { 3865 const BIGNUM *exponent; 3866 3867 sshkey_dump_ec_point(EC_KEY_get0_group(key), 3868 EC_KEY_get0_public_key(key)); 3869 fputs("exponent=", stderr); 3870 if ((exponent = EC_KEY_get0_private_key(key)) == NULL) 3871 fputs("(NULL)", stderr); 3872 else 3873 BN_print_fp(stderr, EC_KEY_get0_private_key(key)); 3874 fputs("\n", stderr); 3875 } 3876 #endif /* WITH_OPENSSL */ 3877 3878 static int 3879 sshkey_private_to_blob2(struct sshkey *prv, struct sshbuf *blob, 3880 const char *passphrase, const char *comment, const char *ciphername, 3881 int rounds) 3882 { 3883 u_char *cp, *key = NULL, *pubkeyblob = NULL; 3884 u_char salt[SALT_LEN]; 3885 char *b64 = NULL; 3886 size_t i, pubkeylen, keylen, ivlen, blocksize, authlen; 3887 u_int check; 3888 int r = SSH_ERR_INTERNAL_ERROR; 3889 struct sshcipher_ctx *ciphercontext = NULL; 3890 const struct sshcipher *cipher; 3891 const char *kdfname = KDFNAME; 3892 struct sshbuf *encoded = NULL, *encrypted = NULL, *kdf = NULL; 3893 3894 if (rounds <= 0) 3895 rounds = DEFAULT_ROUNDS; 3896 if (passphrase == NULL || !strlen(passphrase)) { 3897 ciphername = "none"; 3898 kdfname = "none"; 3899 } else if (ciphername == NULL) 3900 ciphername = DEFAULT_CIPHERNAME; 3901 if ((cipher = cipher_by_name(ciphername)) == NULL) { 3902 r = SSH_ERR_INVALID_ARGUMENT; 3903 goto out; 3904 } 3905 3906 if ((kdf = sshbuf_new()) == NULL || 3907 (encoded = sshbuf_new()) == NULL || 3908 (encrypted = sshbuf_new()) == NULL) { 3909 r = SSH_ERR_ALLOC_FAIL; 3910 goto out; 3911 } 3912 blocksize = cipher_blocksize(cipher); 3913 keylen = cipher_keylen(cipher); 3914 ivlen = cipher_ivlen(cipher); 3915 authlen = cipher_authlen(cipher); 3916 if ((key = calloc(1, keylen + ivlen)) == NULL) { 3917 r = SSH_ERR_ALLOC_FAIL; 3918 goto out; 3919 } 3920 if (strcmp(kdfname, "bcrypt") == 0) { 3921 arc4random_buf(salt, SALT_LEN); 3922 if (bcrypt_pbkdf(passphrase, strlen(passphrase), 3923 salt, SALT_LEN, key, keylen + ivlen, rounds) < 0) { 3924 r = SSH_ERR_INVALID_ARGUMENT; 3925 goto out; 3926 } 3927 if ((r = sshbuf_put_string(kdf, salt, SALT_LEN)) != 0 || 3928 (r = sshbuf_put_u32(kdf, rounds)) != 0) 3929 goto out; 3930 } else if (strcmp(kdfname, "none") != 0) { 3931 /* Unsupported KDF type */ 3932 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3933 goto out; 3934 } 3935 if ((r = cipher_init(&ciphercontext, cipher, key, keylen, 3936 key + keylen, ivlen, 1)) != 0) 3937 goto out; 3938 3939 if ((r = sshbuf_put(encoded, AUTH_MAGIC, sizeof(AUTH_MAGIC))) != 0 || 3940 (r = sshbuf_put_cstring(encoded, ciphername)) != 0 || 3941 (r = sshbuf_put_cstring(encoded, kdfname)) != 0 || 3942 (r = sshbuf_put_stringb(encoded, kdf)) != 0 || 3943 (r = sshbuf_put_u32(encoded, 1)) != 0 || /* number of keys */ 3944 (r = sshkey_to_blob(prv, &pubkeyblob, &pubkeylen)) != 0 || 3945 (r = sshbuf_put_string(encoded, pubkeyblob, pubkeylen)) != 0) 3946 goto out; 3947 3948 /* set up the buffer that will be encrypted */ 3949 3950 /* Random check bytes */ 3951 check = arc4random(); 3952 if ((r = sshbuf_put_u32(encrypted, check)) != 0 || 3953 (r = sshbuf_put_u32(encrypted, check)) != 0) 3954 goto out; 3955 3956 /* append private key and comment*/ 3957 if ((r = sshkey_private_serialize_opt(prv, encrypted, 3958 SSHKEY_SERIALIZE_FULL)) != 0 || 3959 (r = sshbuf_put_cstring(encrypted, comment)) != 0) 3960 goto out; 3961 3962 /* padding */ 3963 i = 0; 3964 while (sshbuf_len(encrypted) % blocksize) { 3965 if ((r = sshbuf_put_u8(encrypted, ++i & 0xff)) != 0) 3966 goto out; 3967 } 3968 3969 /* length in destination buffer */ 3970 if ((r = sshbuf_put_u32(encoded, sshbuf_len(encrypted))) != 0) 3971 goto out; 3972 3973 /* encrypt */ 3974 if ((r = sshbuf_reserve(encoded, 3975 sshbuf_len(encrypted) + authlen, &cp)) != 0) 3976 goto out; 3977 if ((r = cipher_crypt(ciphercontext, 0, cp, 3978 sshbuf_ptr(encrypted), sshbuf_len(encrypted), 0, authlen)) != 0) 3979 goto out; 3980 3981 sshbuf_reset(blob); 3982 3983 /* assemble uuencoded key */ 3984 if ((r = sshbuf_put(blob, MARK_BEGIN, MARK_BEGIN_LEN)) != 0 || 3985 (r = sshbuf_dtob64(encoded, blob, 1)) != 0 || 3986 (r = sshbuf_put(blob, MARK_END, MARK_END_LEN)) != 0) 3987 goto out; 3988 3989 /* success */ 3990 r = 0; 3991 3992 out: 3993 sshbuf_free(kdf); 3994 sshbuf_free(encoded); 3995 sshbuf_free(encrypted); 3996 cipher_free(ciphercontext); 3997 explicit_bzero(salt, sizeof(salt)); 3998 if (key != NULL) 3999 freezero(key, keylen + ivlen); 4000 if (pubkeyblob != NULL) 4001 freezero(pubkeyblob, pubkeylen); 4002 if (b64 != NULL) 4003 freezero(b64, strlen(b64)); 4004 return r; 4005 } 4006 4007 static int 4008 sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase, 4009 struct sshkey **keyp, char **commentp) 4010 { 4011 char *comment = NULL, *ciphername = NULL, *kdfname = NULL; 4012 const struct sshcipher *cipher = NULL; 4013 const u_char *cp; 4014 int r = SSH_ERR_INTERNAL_ERROR; 4015 size_t encoded_len; 4016 size_t i, keylen = 0, ivlen = 0, authlen = 0, slen = 0; 4017 struct sshbuf *encoded = NULL, *decoded = NULL; 4018 struct sshbuf *kdf = NULL, *decrypted = NULL; 4019 struct sshcipher_ctx *ciphercontext = NULL; 4020 struct sshkey *k = NULL; 4021 u_char *key = NULL, *salt = NULL, *dp, pad, last; 4022 u_int blocksize, rounds, nkeys, encrypted_len, check1, check2; 4023 4024 if (keyp != NULL) 4025 *keyp = NULL; 4026 if (commentp != NULL) 4027 *commentp = NULL; 4028 4029 if ((encoded = sshbuf_new()) == NULL || 4030 (decoded = sshbuf_new()) == NULL || 4031 (decrypted = sshbuf_new()) == NULL) { 4032 r = SSH_ERR_ALLOC_FAIL; 4033 goto out; 4034 } 4035 4036 /* check preamble */ 4037 cp = sshbuf_ptr(blob); 4038 encoded_len = sshbuf_len(blob); 4039 if (encoded_len < (MARK_BEGIN_LEN + MARK_END_LEN) || 4040 memcmp(cp, MARK_BEGIN, MARK_BEGIN_LEN) != 0) { 4041 r = SSH_ERR_INVALID_FORMAT; 4042 goto out; 4043 } 4044 cp += MARK_BEGIN_LEN; 4045 encoded_len -= MARK_BEGIN_LEN; 4046 4047 /* Look for end marker, removing whitespace as we go */ 4048 while (encoded_len > 0) { 4049 if (*cp != '\n' && *cp != '\r') { 4050 if ((r = sshbuf_put_u8(encoded, *cp)) != 0) 4051 goto out; 4052 } 4053 last = *cp; 4054 encoded_len--; 4055 cp++; 4056 if (last == '\n') { 4057 if (encoded_len >= MARK_END_LEN && 4058 memcmp(cp, MARK_END, MARK_END_LEN) == 0) { 4059 /* \0 terminate */ 4060 if ((r = sshbuf_put_u8(encoded, 0)) != 0) 4061 goto out; 4062 break; 4063 } 4064 } 4065 } 4066 if (encoded_len == 0) { 4067 r = SSH_ERR_INVALID_FORMAT; 4068 goto out; 4069 } 4070 4071 /* decode base64 */ 4072 if ((r = sshbuf_b64tod(decoded, (char *)sshbuf_ptr(encoded))) != 0) 4073 goto out; 4074 4075 /* check magic */ 4076 if (sshbuf_len(decoded) < sizeof(AUTH_MAGIC) || 4077 memcmp(sshbuf_ptr(decoded), AUTH_MAGIC, sizeof(AUTH_MAGIC))) { 4078 r = SSH_ERR_INVALID_FORMAT; 4079 goto out; 4080 } 4081 /* parse public portion of key */ 4082 if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC))) != 0 || 4083 (r = sshbuf_get_cstring(decoded, &ciphername, NULL)) != 0 || 4084 (r = sshbuf_get_cstring(decoded, &kdfname, NULL)) != 0 || 4085 (r = sshbuf_froms(decoded, &kdf)) != 0 || 4086 (r = sshbuf_get_u32(decoded, &nkeys)) != 0 || 4087 (r = sshbuf_skip_string(decoded)) != 0 || /* pubkey */ 4088 (r = sshbuf_get_u32(decoded, &encrypted_len)) != 0) 4089 goto out; 4090 4091 if ((cipher = cipher_by_name(ciphername)) == NULL) { 4092 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 4093 goto out; 4094 } 4095 if ((passphrase == NULL || strlen(passphrase) == 0) && 4096 strcmp(ciphername, "none") != 0) { 4097 /* passphrase required */ 4098 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 4099 goto out; 4100 } 4101 if (strcmp(kdfname, "none") != 0 && strcmp(kdfname, "bcrypt") != 0) { 4102 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 4103 goto out; 4104 } 4105 if (!strcmp(kdfname, "none") && strcmp(ciphername, "none") != 0) { 4106 r = SSH_ERR_INVALID_FORMAT; 4107 goto out; 4108 } 4109 if (nkeys != 1) { 4110 /* XXX only one key supported */ 4111 r = SSH_ERR_INVALID_FORMAT; 4112 goto out; 4113 } 4114 4115 /* check size of encrypted key blob */ 4116 blocksize = cipher_blocksize(cipher); 4117 if (encrypted_len < blocksize || (encrypted_len % blocksize) != 0) { 4118 r = SSH_ERR_INVALID_FORMAT; 4119 goto out; 4120 } 4121 4122 /* setup key */ 4123 keylen = cipher_keylen(cipher); 4124 ivlen = cipher_ivlen(cipher); 4125 authlen = cipher_authlen(cipher); 4126 if ((key = calloc(1, keylen + ivlen)) == NULL) { 4127 r = SSH_ERR_ALLOC_FAIL; 4128 goto out; 4129 } 4130 if (strcmp(kdfname, "bcrypt") == 0) { 4131 if ((r = sshbuf_get_string(kdf, &salt, &slen)) != 0 || 4132 (r = sshbuf_get_u32(kdf, &rounds)) != 0) 4133 goto out; 4134 if (bcrypt_pbkdf(passphrase, strlen(passphrase), salt, slen, 4135 key, keylen + ivlen, rounds) < 0) { 4136 r = SSH_ERR_INVALID_FORMAT; 4137 goto out; 4138 } 4139 } 4140 4141 /* check that an appropriate amount of auth data is present */ 4142 if (sshbuf_len(decoded) < authlen || 4143 sshbuf_len(decoded) - authlen < encrypted_len) { 4144 r = SSH_ERR_INVALID_FORMAT; 4145 goto out; 4146 } 4147 4148 /* decrypt private portion of key */ 4149 if ((r = sshbuf_reserve(decrypted, encrypted_len, &dp)) != 0 || 4150 (r = cipher_init(&ciphercontext, cipher, key, keylen, 4151 key + keylen, ivlen, 0)) != 0) 4152 goto out; 4153 if ((r = cipher_crypt(ciphercontext, 0, dp, sshbuf_ptr(decoded), 4154 encrypted_len, 0, authlen)) != 0) { 4155 /* an integrity error here indicates an incorrect passphrase */ 4156 if (r == SSH_ERR_MAC_INVALID) 4157 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 4158 goto out; 4159 } 4160 if ((r = sshbuf_consume(decoded, encrypted_len + authlen)) != 0) 4161 goto out; 4162 /* there should be no trailing data */ 4163 if (sshbuf_len(decoded) != 0) { 4164 r = SSH_ERR_INVALID_FORMAT; 4165 goto out; 4166 } 4167 4168 /* check check bytes */ 4169 if ((r = sshbuf_get_u32(decrypted, &check1)) != 0 || 4170 (r = sshbuf_get_u32(decrypted, &check2)) != 0) 4171 goto out; 4172 if (check1 != check2) { 4173 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 4174 goto out; 4175 } 4176 4177 /* Load the private key and comment */ 4178 if ((r = sshkey_private_deserialize(decrypted, &k)) != 0 || 4179 (r = sshbuf_get_cstring(decrypted, &comment, NULL)) != 0) 4180 goto out; 4181 4182 /* Check deterministic padding */ 4183 i = 0; 4184 while (sshbuf_len(decrypted)) { 4185 if ((r = sshbuf_get_u8(decrypted, &pad)) != 0) 4186 goto out; 4187 if (pad != (++i & 0xff)) { 4188 r = SSH_ERR_INVALID_FORMAT; 4189 goto out; 4190 } 4191 } 4192 4193 /* XXX decode pubkey and check against private */ 4194 4195 /* success */ 4196 r = 0; 4197 if (keyp != NULL) { 4198 *keyp = k; 4199 k = NULL; 4200 } 4201 if (commentp != NULL) { 4202 *commentp = comment; 4203 comment = NULL; 4204 } 4205 out: 4206 pad = 0; 4207 cipher_free(ciphercontext); 4208 free(ciphername); 4209 free(kdfname); 4210 free(comment); 4211 if (salt != NULL) 4212 freezero(salt, slen); 4213 if (key != NULL) 4214 freezero(key, keylen + ivlen); 4215 sshbuf_free(encoded); 4216 sshbuf_free(decoded); 4217 sshbuf_free(kdf); 4218 sshbuf_free(decrypted); 4219 sshkey_free(k); 4220 return r; 4221 } 4222 4223 4224 #ifdef WITH_OPENSSL 4225 /* convert SSH v2 key to PEM or PKCS#8 format */ 4226 static int 4227 sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf, 4228 int format, const char *_passphrase, const char *comment) 4229 { 4230 int was_shielded = sshkey_is_shielded(key); 4231 int success, r; 4232 int blen, len = strlen(_passphrase); 4233 u_char *passphrase = (len > 0) ? (u_char *)_passphrase : NULL; 4234 const EVP_CIPHER *cipher = (len > 0) ? EVP_aes_128_cbc() : NULL; 4235 char *bptr; 4236 BIO *bio = NULL; 4237 struct sshbuf *blob; 4238 EVP_PKEY *pkey = NULL; 4239 4240 if (len > 0 && len <= 4) 4241 return SSH_ERR_PASSPHRASE_TOO_SHORT; 4242 if ((blob = sshbuf_new()) == NULL) 4243 return SSH_ERR_ALLOC_FAIL; 4244 if ((bio = BIO_new(BIO_s_mem())) == NULL) { 4245 r = SSH_ERR_ALLOC_FAIL; 4246 goto out; 4247 } 4248 if (format == SSHKEY_PRIVATE_PKCS8 && (pkey = EVP_PKEY_new()) == NULL) { 4249 r = SSH_ERR_ALLOC_FAIL; 4250 goto out; 4251 } 4252 if ((r = sshkey_unshield_private(key)) != 0) 4253 goto out; 4254 4255 switch (key->type) { 4256 case KEY_DSA: 4257 if (format == SSHKEY_PRIVATE_PEM) { 4258 success = PEM_write_bio_DSAPrivateKey(bio, key->dsa, 4259 cipher, passphrase, len, NULL, NULL); 4260 } else { 4261 success = EVP_PKEY_set1_DSA(pkey, key->dsa); 4262 } 4263 break; 4264 case KEY_ECDSA: 4265 if (format == SSHKEY_PRIVATE_PEM) { 4266 success = PEM_write_bio_ECPrivateKey(bio, key->ecdsa, 4267 cipher, passphrase, len, NULL, NULL); 4268 } else { 4269 success = EVP_PKEY_set1_EC_KEY(pkey, key->ecdsa); 4270 } 4271 break; 4272 case KEY_RSA: 4273 if (format == SSHKEY_PRIVATE_PEM) { 4274 success = PEM_write_bio_RSAPrivateKey(bio, key->rsa, 4275 cipher, passphrase, len, NULL, NULL); 4276 } else { 4277 success = EVP_PKEY_set1_RSA(pkey, key->rsa); 4278 } 4279 break; 4280 default: 4281 success = 0; 4282 break; 4283 } 4284 if (success == 0) { 4285 r = SSH_ERR_LIBCRYPTO_ERROR; 4286 goto out; 4287 } 4288 if (format == SSHKEY_PRIVATE_PKCS8) { 4289 if ((success = PEM_write_bio_PrivateKey(bio, pkey, cipher, 4290 passphrase, len, NULL, NULL)) == 0) { 4291 r = SSH_ERR_LIBCRYPTO_ERROR; 4292 goto out; 4293 } 4294 } 4295 if ((blen = BIO_get_mem_data(bio, &bptr)) <= 0) { 4296 r = SSH_ERR_INTERNAL_ERROR; 4297 goto out; 4298 } 4299 if ((r = sshbuf_put(blob, bptr, blen)) != 0) 4300 goto out; 4301 r = 0; 4302 out: 4303 if (was_shielded) 4304 r = sshkey_shield_private(key); 4305 if (r == 0) 4306 r = sshbuf_putb(buf, blob); 4307 4308 EVP_PKEY_free(pkey); 4309 sshbuf_free(blob); 4310 BIO_free(bio); 4311 return r; 4312 } 4313 #endif /* WITH_OPENSSL */ 4314 4315 /* Serialise "key" to buffer "blob" */ 4316 int 4317 sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob, 4318 const char *passphrase, const char *comment, 4319 int format, const char *openssh_format_cipher, int openssh_format_rounds) 4320 { 4321 switch (key->type) { 4322 #ifdef WITH_OPENSSL 4323 case KEY_DSA: 4324 case KEY_ECDSA: 4325 case KEY_RSA: 4326 break; /* see below */ 4327 #endif /* WITH_OPENSSL */ 4328 case KEY_ED25519: 4329 case KEY_ED25519_SK: 4330 #ifdef WITH_XMSS 4331 case KEY_XMSS: 4332 #endif /* WITH_XMSS */ 4333 #ifdef WITH_OPENSSL 4334 case KEY_ECDSA_SK: 4335 #endif /* WITH_OPENSSL */ 4336 return sshkey_private_to_blob2(key, blob, passphrase, 4337 comment, openssh_format_cipher, openssh_format_rounds); 4338 default: 4339 return SSH_ERR_KEY_TYPE_UNKNOWN; 4340 } 4341 4342 #ifdef WITH_OPENSSL 4343 switch (format) { 4344 case SSHKEY_PRIVATE_OPENSSH: 4345 return sshkey_private_to_blob2(key, blob, passphrase, 4346 comment, openssh_format_cipher, openssh_format_rounds); 4347 case SSHKEY_PRIVATE_PEM: 4348 case SSHKEY_PRIVATE_PKCS8: 4349 return sshkey_private_to_blob_pem_pkcs8(key, blob, 4350 format, passphrase, comment); 4351 default: 4352 return SSH_ERR_INVALID_ARGUMENT; 4353 } 4354 #endif /* WITH_OPENSSL */ 4355 } 4356 4357 #ifdef WITH_OPENSSL 4358 static int 4359 translate_libcrypto_error(unsigned long pem_err) 4360 { 4361 int pem_reason = ERR_GET_REASON(pem_err); 4362 4363 switch (ERR_GET_LIB(pem_err)) { 4364 case ERR_LIB_PEM: 4365 switch (pem_reason) { 4366 case PEM_R_BAD_PASSWORD_READ: 4367 case PEM_R_PROBLEMS_GETTING_PASSWORD: 4368 case PEM_R_BAD_DECRYPT: 4369 return SSH_ERR_KEY_WRONG_PASSPHRASE; 4370 default: 4371 return SSH_ERR_INVALID_FORMAT; 4372 } 4373 case ERR_LIB_EVP: 4374 switch (pem_reason) { 4375 case EVP_R_BAD_DECRYPT: 4376 return SSH_ERR_KEY_WRONG_PASSPHRASE; 4377 #ifdef EVP_R_BN_DECODE_ERROR 4378 case EVP_R_BN_DECODE_ERROR: 4379 #endif 4380 case EVP_R_DECODE_ERROR: 4381 #ifdef EVP_R_PRIVATE_KEY_DECODE_ERROR 4382 case EVP_R_PRIVATE_KEY_DECODE_ERROR: 4383 #endif 4384 return SSH_ERR_INVALID_FORMAT; 4385 default: 4386 return SSH_ERR_LIBCRYPTO_ERROR; 4387 } 4388 case ERR_LIB_ASN1: 4389 return SSH_ERR_INVALID_FORMAT; 4390 } 4391 return SSH_ERR_LIBCRYPTO_ERROR; 4392 } 4393 4394 static void 4395 clear_libcrypto_errors(void) 4396 { 4397 while (ERR_get_error() != 0) 4398 ; 4399 } 4400 4401 /* 4402 * Translate OpenSSL error codes to determine whether 4403 * passphrase is required/incorrect. 4404 */ 4405 static int 4406 convert_libcrypto_error(void) 4407 { 4408 /* 4409 * Some password errors are reported at the beginning 4410 * of the error queue. 4411 */ 4412 if (translate_libcrypto_error(ERR_peek_error()) == 4413 SSH_ERR_KEY_WRONG_PASSPHRASE) 4414 return SSH_ERR_KEY_WRONG_PASSPHRASE; 4415 return translate_libcrypto_error(ERR_peek_last_error()); 4416 } 4417 4418 static int 4419 sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, 4420 const char *passphrase, struct sshkey **keyp) 4421 { 4422 EVP_PKEY *pk = NULL; 4423 struct sshkey *prv = NULL; 4424 BIO *bio = NULL; 4425 int r; 4426 4427 if (keyp != NULL) 4428 *keyp = NULL; 4429 4430 if ((bio = BIO_new(BIO_s_mem())) == NULL || sshbuf_len(blob) > INT_MAX) 4431 return SSH_ERR_ALLOC_FAIL; 4432 if (BIO_write(bio, sshbuf_ptr(blob), sshbuf_len(blob)) != 4433 (int)sshbuf_len(blob)) { 4434 r = SSH_ERR_ALLOC_FAIL; 4435 goto out; 4436 } 4437 4438 clear_libcrypto_errors(); 4439 if ((pk = PEM_read_bio_PrivateKey(bio, NULL, NULL, 4440 (char *)passphrase)) == NULL) { 4441 /* 4442 * libcrypto may return various ASN.1 errors when attempting 4443 * to parse a key with an incorrect passphrase. 4444 * Treat all format errors as "incorrect passphrase" if a 4445 * passphrase was supplied. 4446 */ 4447 if (passphrase != NULL && *passphrase != '\0') 4448 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 4449 else 4450 r = convert_libcrypto_error(); 4451 goto out; 4452 } 4453 if (EVP_PKEY_base_id(pk) == EVP_PKEY_RSA && 4454 (type == KEY_UNSPEC || type == KEY_RSA)) { 4455 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 4456 r = SSH_ERR_ALLOC_FAIL; 4457 goto out; 4458 } 4459 prv->rsa = EVP_PKEY_get1_RSA(pk); 4460 prv->type = KEY_RSA; 4461 #ifdef DEBUG_PK 4462 RSA_print_fp(stderr, prv->rsa, 8); 4463 #endif 4464 if (RSA_blinding_on(prv->rsa, NULL) != 1) { 4465 r = SSH_ERR_LIBCRYPTO_ERROR; 4466 goto out; 4467 } 4468 if ((r = check_rsa_length(prv->rsa)) != 0) 4469 goto out; 4470 } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_DSA && 4471 (type == KEY_UNSPEC || type == KEY_DSA)) { 4472 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 4473 r = SSH_ERR_ALLOC_FAIL; 4474 goto out; 4475 } 4476 prv->dsa = EVP_PKEY_get1_DSA(pk); 4477 prv->type = KEY_DSA; 4478 #ifdef DEBUG_PK 4479 DSA_print_fp(stderr, prv->dsa, 8); 4480 #endif 4481 } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC && 4482 (type == KEY_UNSPEC || type == KEY_ECDSA)) { 4483 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 4484 r = SSH_ERR_ALLOC_FAIL; 4485 goto out; 4486 } 4487 prv->ecdsa = EVP_PKEY_get1_EC_KEY(pk); 4488 prv->type = KEY_ECDSA; 4489 prv->ecdsa_nid = sshkey_ecdsa_key_to_nid(prv->ecdsa); 4490 if (prv->ecdsa_nid == -1 || 4491 sshkey_curve_nid_to_name(prv->ecdsa_nid) == NULL || 4492 sshkey_ec_validate_public(EC_KEY_get0_group(prv->ecdsa), 4493 EC_KEY_get0_public_key(prv->ecdsa)) != 0 || 4494 sshkey_ec_validate_private(prv->ecdsa) != 0) { 4495 r = SSH_ERR_INVALID_FORMAT; 4496 goto out; 4497 } 4498 #ifdef DEBUG_PK 4499 if (prv != NULL && prv->ecdsa != NULL) 4500 sshkey_dump_ec_key(prv->ecdsa); 4501 #endif 4502 } else { 4503 r = SSH_ERR_INVALID_FORMAT; 4504 goto out; 4505 } 4506 r = 0; 4507 if (keyp != NULL) { 4508 *keyp = prv; 4509 prv = NULL; 4510 } 4511 out: 4512 BIO_free(bio); 4513 EVP_PKEY_free(pk); 4514 sshkey_free(prv); 4515 return r; 4516 } 4517 #endif /* WITH_OPENSSL */ 4518 4519 int 4520 sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type, 4521 const char *passphrase, struct sshkey **keyp, char **commentp) 4522 { 4523 int r = SSH_ERR_INTERNAL_ERROR; 4524 4525 if (keyp != NULL) 4526 *keyp = NULL; 4527 if (commentp != NULL) 4528 *commentp = NULL; 4529 4530 switch (type) { 4531 #ifdef WITH_OPENSSL 4532 case KEY_DSA: 4533 case KEY_ECDSA: 4534 case KEY_RSA: 4535 return sshkey_parse_private_pem_fileblob(blob, type, 4536 passphrase, keyp); 4537 #endif /* WITH_OPENSSL */ 4538 case KEY_ED25519: 4539 #ifdef WITH_XMSS 4540 case KEY_XMSS: 4541 #endif /* WITH_XMSS */ 4542 return sshkey_parse_private2(blob, type, passphrase, 4543 keyp, commentp); 4544 case KEY_UNSPEC: 4545 r = sshkey_parse_private2(blob, type, passphrase, keyp, 4546 commentp); 4547 /* Do not fallback to PEM parser if only passphrase is wrong. */ 4548 if (r == 0 || r == SSH_ERR_KEY_WRONG_PASSPHRASE) 4549 return r; 4550 #ifdef WITH_OPENSSL 4551 return sshkey_parse_private_pem_fileblob(blob, type, 4552 passphrase, keyp); 4553 #else 4554 return SSH_ERR_INVALID_FORMAT; 4555 #endif /* WITH_OPENSSL */ 4556 default: 4557 return SSH_ERR_KEY_TYPE_UNKNOWN; 4558 } 4559 } 4560 4561 int 4562 sshkey_parse_private_fileblob(struct sshbuf *buffer, const char *passphrase, 4563 struct sshkey **keyp, char **commentp) 4564 { 4565 if (keyp != NULL) 4566 *keyp = NULL; 4567 if (commentp != NULL) 4568 *commentp = NULL; 4569 4570 return sshkey_parse_private_fileblob_type(buffer, KEY_UNSPEC, 4571 passphrase, keyp, commentp); 4572 } 4573 4574 void 4575 sshkey_sig_details_free(struct sshkey_sig_details *details) 4576 { 4577 freezero(details, sizeof(*details)); 4578 } 4579 4580 #ifdef WITH_XMSS 4581 /* 4582 * serialize the key with the current state and forward the state 4583 * maxsign times. 4584 */ 4585 int 4586 sshkey_private_serialize_maxsign(struct sshkey *k, struct sshbuf *b, 4587 u_int32_t maxsign, sshkey_printfn *pr) 4588 { 4589 int r, rupdate; 4590 4591 if (maxsign == 0 || 4592 sshkey_type_plain(k->type) != KEY_XMSS) 4593 return sshkey_private_serialize_opt(k, b, 4594 SSHKEY_SERIALIZE_DEFAULT); 4595 if ((r = sshkey_xmss_get_state(k, pr)) != 0 || 4596 (r = sshkey_private_serialize_opt(k, b, 4597 SSHKEY_SERIALIZE_STATE)) != 0 || 4598 (r = sshkey_xmss_forward_state(k, maxsign)) != 0) 4599 goto out; 4600 r = 0; 4601 out: 4602 if ((rupdate = sshkey_xmss_update_state(k, pr)) != 0) { 4603 if (r == 0) 4604 r = rupdate; 4605 } 4606 return r; 4607 } 4608 4609 u_int32_t 4610 sshkey_signatures_left(const struct sshkey *k) 4611 { 4612 if (sshkey_type_plain(k->type) == KEY_XMSS) 4613 return sshkey_xmss_signatures_left(k); 4614 return 0; 4615 } 4616 4617 int 4618 sshkey_enable_maxsign(struct sshkey *k, u_int32_t maxsign) 4619 { 4620 if (sshkey_type_plain(k->type) != KEY_XMSS) 4621 return SSH_ERR_INVALID_ARGUMENT; 4622 return sshkey_xmss_enable_maxsign(k, maxsign); 4623 } 4624 4625 int 4626 sshkey_set_filename(struct sshkey *k, const char *filename) 4627 { 4628 if (k == NULL) 4629 return SSH_ERR_INVALID_ARGUMENT; 4630 if (sshkey_type_plain(k->type) != KEY_XMSS) 4631 return 0; 4632 if (filename == NULL) 4633 return SSH_ERR_INVALID_ARGUMENT; 4634 if ((k->xmss_filename = strdup(filename)) == NULL) 4635 return SSH_ERR_ALLOC_FAIL; 4636 return 0; 4637 } 4638 #else 4639 int 4640 sshkey_private_serialize_maxsign(struct sshkey *k, struct sshbuf *b, 4641 u_int32_t maxsign, sshkey_printfn *pr) 4642 { 4643 return sshkey_private_serialize_opt(k, b, SSHKEY_SERIALIZE_DEFAULT); 4644 } 4645 4646 u_int32_t 4647 sshkey_signatures_left(const struct sshkey *k) 4648 { 4649 return 0; 4650 } 4651 4652 int 4653 sshkey_enable_maxsign(struct sshkey *k, u_int32_t maxsign) 4654 { 4655 return SSH_ERR_INVALID_ARGUMENT; 4656 } 4657 4658 int 4659 sshkey_set_filename(struct sshkey *k, const char *filename) 4660 { 4661 if (k == NULL) 4662 return SSH_ERR_INVALID_ARGUMENT; 4663 return 0; 4664 } 4665 #endif /* WITH_XMSS */ 4666