1 /* $OpenBSD: sshkey.c,v 1.122 2022/09/17 10:30:45 djm Exp $ */ 2 /* 3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 4 * Copyright (c) 2008 Alexander von Gernler. All rights reserved. 5 * Copyright (c) 2010,2011 Damien Miller. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <sys/types.h> 29 #include <netinet/in.h> 30 31 #ifdef WITH_OPENSSL 32 #include <openssl/evp.h> 33 #include <openssl/err.h> 34 #include <openssl/pem.h> 35 #endif 36 37 #include "crypto_api.h" 38 39 #include <errno.h> 40 #include <stdio.h> 41 #include <string.h> 42 #include <util.h> 43 #include <limits.h> 44 #include <resolv.h> 45 46 #include "ssh2.h" 47 #include "ssherr.h" 48 #include "misc.h" 49 #include "sshbuf.h" 50 #include "cipher.h" 51 #include "digest.h" 52 #define SSHKEY_INTERNAL 53 #include "sshkey.h" 54 #include "match.h" 55 #include "ssh-sk.h" 56 57 #ifdef WITH_XMSS 58 #include "sshkey-xmss.h" 59 #include "xmss_fast.h" 60 #endif 61 62 /* openssh private key file format */ 63 #define MARK_BEGIN "-----BEGIN OPENSSH PRIVATE KEY-----\n" 64 #define MARK_END "-----END OPENSSH PRIVATE KEY-----\n" 65 #define MARK_BEGIN_LEN (sizeof(MARK_BEGIN) - 1) 66 #define MARK_END_LEN (sizeof(MARK_END) - 1) 67 #define KDFNAME "bcrypt" 68 #define AUTH_MAGIC "openssh-key-v1" 69 #define SALT_LEN 16 70 #define DEFAULT_CIPHERNAME "aes256-ctr" 71 #define DEFAULT_ROUNDS 16 72 73 /* Version identification string for SSH v1 identity files. */ 74 #define LEGACY_BEGIN "SSH PRIVATE KEY FILE FORMAT 1.1\n" 75 76 /* 77 * Constants relating to "shielding" support; protection of keys expected 78 * to remain in memory for long durations 79 */ 80 #define SSHKEY_SHIELD_PREKEY_LEN (16 * 1024) 81 #define SSHKEY_SHIELD_CIPHER "aes256-ctr" /* XXX want AES-EME* */ 82 #define SSHKEY_SHIELD_PREKEY_HASH SSH_DIGEST_SHA512 83 84 int sshkey_private_serialize_opt(struct sshkey *key, 85 struct sshbuf *buf, enum sshkey_serialize_rep); 86 static int sshkey_from_blob_internal(struct sshbuf *buf, 87 struct sshkey **keyp, int allow_cert); 88 89 /* Supported key types */ 90 struct keytype { 91 const char *name; 92 const char *shortname; 93 const char *sigalg; 94 int type; 95 int nid; 96 int cert; 97 int sigonly; 98 }; 99 static const struct keytype keytypes[] = { 100 { "ssh-ed25519", "ED25519", NULL, KEY_ED25519, 0, 0, 0 }, 101 { "ssh-ed25519-cert-v01@openssh.com", "ED25519-CERT", NULL, 102 KEY_ED25519_CERT, 0, 1, 0 }, 103 { "sk-ssh-ed25519@openssh.com", "ED25519-SK", NULL, 104 KEY_ED25519_SK, 0, 0, 0 }, 105 { "sk-ssh-ed25519-cert-v01@openssh.com", "ED25519-SK-CERT", NULL, 106 KEY_ED25519_SK_CERT, 0, 1, 0 }, 107 #ifdef WITH_XMSS 108 { "ssh-xmss@openssh.com", "XMSS", NULL, KEY_XMSS, 0, 0, 0 }, 109 { "ssh-xmss-cert-v01@openssh.com", "XMSS-CERT", NULL, 110 KEY_XMSS_CERT, 0, 1, 0 }, 111 #endif /* WITH_XMSS */ 112 #ifdef WITH_OPENSSL 113 { "ssh-rsa", "RSA", NULL, KEY_RSA, 0, 0, 0 }, 114 { "rsa-sha2-256", "RSA", NULL, KEY_RSA, 0, 0, 1 }, 115 { "rsa-sha2-512", "RSA", NULL, KEY_RSA, 0, 0, 1 }, 116 { "ssh-dss", "DSA", NULL, KEY_DSA, 0, 0, 0 }, 117 { "ecdsa-sha2-nistp256", "ECDSA", NULL, 118 KEY_ECDSA, NID_X9_62_prime256v1, 0, 0 }, 119 { "ecdsa-sha2-nistp384", "ECDSA", NULL, 120 KEY_ECDSA, NID_secp384r1, 0, 0 }, 121 { "ecdsa-sha2-nistp521", "ECDSA", NULL, 122 KEY_ECDSA, NID_secp521r1, 0, 0 }, 123 { "sk-ecdsa-sha2-nistp256@openssh.com", "ECDSA-SK", NULL, 124 KEY_ECDSA_SK, NID_X9_62_prime256v1, 0, 0 }, 125 { "webauthn-sk-ecdsa-sha2-nistp256@openssh.com", "ECDSA-SK", NULL, 126 KEY_ECDSA_SK, NID_X9_62_prime256v1, 0, 1 }, 127 { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", NULL, 128 KEY_RSA_CERT, 0, 1, 0 }, 129 { "rsa-sha2-256-cert-v01@openssh.com", "RSA-CERT", 130 "rsa-sha2-256", KEY_RSA_CERT, 0, 1, 1 }, 131 { "rsa-sha2-512-cert-v01@openssh.com", "RSA-CERT", 132 "rsa-sha2-512", KEY_RSA_CERT, 0, 1, 1 }, 133 { "ssh-dss-cert-v01@openssh.com", "DSA-CERT", NULL, 134 KEY_DSA_CERT, 0, 1, 0 }, 135 { "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-CERT", NULL, 136 KEY_ECDSA_CERT, NID_X9_62_prime256v1, 1, 0 }, 137 { "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ECDSA-CERT", NULL, 138 KEY_ECDSA_CERT, NID_secp384r1, 1, 0 }, 139 { "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ECDSA-CERT", NULL, 140 KEY_ECDSA_CERT, NID_secp521r1, 1, 0 }, 141 { "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-SK-CERT", NULL, 142 KEY_ECDSA_SK_CERT, NID_X9_62_prime256v1, 1, 0 }, 143 #endif /* WITH_OPENSSL */ 144 { NULL, NULL, NULL, -1, -1, 0, 0 } 145 }; 146 147 const char * 148 sshkey_type(const struct sshkey *k) 149 { 150 const struct keytype *kt; 151 152 for (kt = keytypes; kt->type != -1; kt++) { 153 if (kt->type == k->type) 154 return kt->shortname; 155 } 156 return "unknown"; 157 } 158 159 static const char * 160 sshkey_ssh_name_from_type_nid(int type, int nid) 161 { 162 const struct keytype *kt; 163 164 for (kt = keytypes; kt->type != -1; kt++) { 165 if (kt->type == type && (kt->nid == 0 || kt->nid == nid)) 166 return kt->name; 167 } 168 return "ssh-unknown"; 169 } 170 171 int 172 sshkey_type_is_cert(int type) 173 { 174 const struct keytype *kt; 175 176 for (kt = keytypes; kt->type != -1; kt++) { 177 if (kt->type == type) 178 return kt->cert; 179 } 180 return 0; 181 } 182 183 const char * 184 sshkey_ssh_name(const struct sshkey *k) 185 { 186 return sshkey_ssh_name_from_type_nid(k->type, k->ecdsa_nid); 187 } 188 189 const char * 190 sshkey_ssh_name_plain(const struct sshkey *k) 191 { 192 return sshkey_ssh_name_from_type_nid(sshkey_type_plain(k->type), 193 k->ecdsa_nid); 194 } 195 196 int 197 sshkey_type_from_name(const char *name) 198 { 199 const struct keytype *kt; 200 201 for (kt = keytypes; kt->type != -1; kt++) { 202 /* Only allow shortname matches for plain key types */ 203 if ((kt->name != NULL && strcmp(name, kt->name) == 0) || 204 (!kt->cert && strcasecmp(kt->shortname, name) == 0)) 205 return kt->type; 206 } 207 return KEY_UNSPEC; 208 } 209 210 static int 211 key_type_is_ecdsa_variant(int type) 212 { 213 switch (type) { 214 case KEY_ECDSA: 215 case KEY_ECDSA_CERT: 216 case KEY_ECDSA_SK: 217 case KEY_ECDSA_SK_CERT: 218 return 1; 219 } 220 return 0; 221 } 222 223 int 224 sshkey_ecdsa_nid_from_name(const char *name) 225 { 226 const struct keytype *kt; 227 228 for (kt = keytypes; kt->type != -1; kt++) { 229 if (!key_type_is_ecdsa_variant(kt->type)) 230 continue; 231 if (kt->name != NULL && strcmp(name, kt->name) == 0) 232 return kt->nid; 233 } 234 return -1; 235 } 236 237 int 238 sshkey_match_keyname_to_sigalgs(const char *keyname, const char *sigalgs) 239 { 240 int ktype; 241 242 if (sigalgs == NULL || *sigalgs == '\0' || 243 (ktype = sshkey_type_from_name(keyname)) == KEY_UNSPEC) 244 return 0; 245 else if (ktype == KEY_RSA) { 246 return match_pattern_list("ssh-rsa", sigalgs, 0) == 1 || 247 match_pattern_list("rsa-sha2-256", sigalgs, 0) == 1 || 248 match_pattern_list("rsa-sha2-512", sigalgs, 0) == 1; 249 } else if (ktype == KEY_RSA_CERT) { 250 return match_pattern_list("ssh-rsa-cert-v01@openssh.com", 251 sigalgs, 0) == 1 || 252 match_pattern_list("rsa-sha2-256-cert-v01@openssh.com", 253 sigalgs, 0) == 1 || 254 match_pattern_list("rsa-sha2-512-cert-v01@openssh.com", 255 sigalgs, 0) == 1; 256 } else 257 return match_pattern_list(keyname, sigalgs, 0) == 1; 258 } 259 260 char * 261 sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep) 262 { 263 char *tmp, *ret = NULL; 264 size_t nlen, rlen = 0; 265 const struct keytype *kt; 266 267 for (kt = keytypes; kt->type != -1; kt++) { 268 if (kt->name == NULL) 269 continue; 270 if (!include_sigonly && kt->sigonly) 271 continue; 272 if ((certs_only && !kt->cert) || (plain_only && kt->cert)) 273 continue; 274 if (ret != NULL) 275 ret[rlen++] = sep; 276 nlen = strlen(kt->name); 277 if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) { 278 free(ret); 279 return NULL; 280 } 281 ret = tmp; 282 memcpy(ret + rlen, kt->name, nlen + 1); 283 rlen += nlen; 284 } 285 return ret; 286 } 287 288 int 289 sshkey_names_valid2(const char *names, int allow_wildcard) 290 { 291 char *s, *cp, *p; 292 const struct keytype *kt; 293 int type; 294 295 if (names == NULL || strcmp(names, "") == 0) 296 return 0; 297 if ((s = cp = strdup(names)) == NULL) 298 return 0; 299 for ((p = strsep(&cp, ",")); p && *p != '\0'; 300 (p = strsep(&cp, ","))) { 301 type = sshkey_type_from_name(p); 302 if (type == KEY_UNSPEC) { 303 if (allow_wildcard) { 304 /* 305 * Try matching key types against the string. 306 * If any has a positive or negative match then 307 * the component is accepted. 308 */ 309 for (kt = keytypes; kt->type != -1; kt++) { 310 if (match_pattern_list(kt->name, 311 p, 0) != 0) 312 break; 313 } 314 if (kt->type != -1) 315 continue; 316 } 317 free(s); 318 return 0; 319 } 320 } 321 free(s); 322 return 1; 323 } 324 325 u_int 326 sshkey_size(const struct sshkey *k) 327 { 328 #ifdef WITH_OPENSSL 329 const BIGNUM *rsa_n, *dsa_p; 330 #endif /* WITH_OPENSSL */ 331 332 switch (k->type) { 333 #ifdef WITH_OPENSSL 334 case KEY_RSA: 335 case KEY_RSA_CERT: 336 if (k->rsa == NULL) 337 return 0; 338 RSA_get0_key(k->rsa, &rsa_n, NULL, NULL); 339 return BN_num_bits(rsa_n); 340 case KEY_DSA: 341 case KEY_DSA_CERT: 342 if (k->dsa == NULL) 343 return 0; 344 DSA_get0_pqg(k->dsa, &dsa_p, NULL, NULL); 345 return BN_num_bits(dsa_p); 346 case KEY_ECDSA: 347 case KEY_ECDSA_CERT: 348 case KEY_ECDSA_SK: 349 case KEY_ECDSA_SK_CERT: 350 return sshkey_curve_nid_to_bits(k->ecdsa_nid); 351 #endif /* WITH_OPENSSL */ 352 case KEY_ED25519: 353 case KEY_ED25519_CERT: 354 case KEY_ED25519_SK: 355 case KEY_ED25519_SK_CERT: 356 case KEY_XMSS: 357 case KEY_XMSS_CERT: 358 return 256; /* XXX */ 359 } 360 return 0; 361 } 362 363 static int 364 sshkey_type_is_valid_ca(int type) 365 { 366 switch (type) { 367 case KEY_RSA: 368 case KEY_DSA: 369 case KEY_ECDSA: 370 case KEY_ECDSA_SK: 371 case KEY_ED25519: 372 case KEY_ED25519_SK: 373 case KEY_XMSS: 374 return 1; 375 default: 376 return 0; 377 } 378 } 379 380 int 381 sshkey_is_cert(const struct sshkey *k) 382 { 383 if (k == NULL) 384 return 0; 385 return sshkey_type_is_cert(k->type); 386 } 387 388 int 389 sshkey_is_sk(const struct sshkey *k) 390 { 391 if (k == NULL) 392 return 0; 393 switch (sshkey_type_plain(k->type)) { 394 case KEY_ECDSA_SK: 395 case KEY_ED25519_SK: 396 return 1; 397 default: 398 return 0; 399 } 400 } 401 402 /* Return the cert-less equivalent to a certified key type */ 403 int 404 sshkey_type_plain(int type) 405 { 406 switch (type) { 407 case KEY_RSA_CERT: 408 return KEY_RSA; 409 case KEY_DSA_CERT: 410 return KEY_DSA; 411 case KEY_ECDSA_CERT: 412 return KEY_ECDSA; 413 case KEY_ECDSA_SK_CERT: 414 return KEY_ECDSA_SK; 415 case KEY_ED25519_CERT: 416 return KEY_ED25519; 417 case KEY_ED25519_SK_CERT: 418 return KEY_ED25519_SK; 419 case KEY_XMSS_CERT: 420 return KEY_XMSS; 421 default: 422 return type; 423 } 424 } 425 426 #ifdef WITH_OPENSSL 427 /* XXX: these are really begging for a table-driven approach */ 428 int 429 sshkey_curve_name_to_nid(const char *name) 430 { 431 if (strcmp(name, "nistp256") == 0) 432 return NID_X9_62_prime256v1; 433 else if (strcmp(name, "nistp384") == 0) 434 return NID_secp384r1; 435 else if (strcmp(name, "nistp521") == 0) 436 return NID_secp521r1; 437 else 438 return -1; 439 } 440 441 u_int 442 sshkey_curve_nid_to_bits(int nid) 443 { 444 switch (nid) { 445 case NID_X9_62_prime256v1: 446 return 256; 447 case NID_secp384r1: 448 return 384; 449 case NID_secp521r1: 450 return 521; 451 default: 452 return 0; 453 } 454 } 455 456 int 457 sshkey_ecdsa_bits_to_nid(int bits) 458 { 459 switch (bits) { 460 case 256: 461 return NID_X9_62_prime256v1; 462 case 384: 463 return NID_secp384r1; 464 case 521: 465 return NID_secp521r1; 466 default: 467 return -1; 468 } 469 } 470 471 const char * 472 sshkey_curve_nid_to_name(int nid) 473 { 474 switch (nid) { 475 case NID_X9_62_prime256v1: 476 return "nistp256"; 477 case NID_secp384r1: 478 return "nistp384"; 479 case NID_secp521r1: 480 return "nistp521"; 481 default: 482 return NULL; 483 } 484 } 485 486 int 487 sshkey_ec_nid_to_hash_alg(int nid) 488 { 489 int kbits = sshkey_curve_nid_to_bits(nid); 490 491 if (kbits <= 0) 492 return -1; 493 494 /* RFC5656 section 6.2.1 */ 495 if (kbits <= 256) 496 return SSH_DIGEST_SHA256; 497 else if (kbits <= 384) 498 return SSH_DIGEST_SHA384; 499 else 500 return SSH_DIGEST_SHA512; 501 } 502 #endif /* WITH_OPENSSL */ 503 504 static void 505 cert_free(struct sshkey_cert *cert) 506 { 507 u_int i; 508 509 if (cert == NULL) 510 return; 511 sshbuf_free(cert->certblob); 512 sshbuf_free(cert->critical); 513 sshbuf_free(cert->extensions); 514 free(cert->key_id); 515 for (i = 0; i < cert->nprincipals; i++) 516 free(cert->principals[i]); 517 free(cert->principals); 518 sshkey_free(cert->signature_key); 519 free(cert->signature_type); 520 freezero(cert, sizeof(*cert)); 521 } 522 523 static struct sshkey_cert * 524 cert_new(void) 525 { 526 struct sshkey_cert *cert; 527 528 if ((cert = calloc(1, sizeof(*cert))) == NULL) 529 return NULL; 530 if ((cert->certblob = sshbuf_new()) == NULL || 531 (cert->critical = sshbuf_new()) == NULL || 532 (cert->extensions = sshbuf_new()) == NULL) { 533 cert_free(cert); 534 return NULL; 535 } 536 cert->key_id = NULL; 537 cert->principals = NULL; 538 cert->signature_key = NULL; 539 cert->signature_type = NULL; 540 return cert; 541 } 542 543 struct sshkey * 544 sshkey_new(int type) 545 { 546 struct sshkey *k; 547 #ifdef WITH_OPENSSL 548 RSA *rsa; 549 DSA *dsa; 550 #endif /* WITH_OPENSSL */ 551 552 if ((k = calloc(1, sizeof(*k))) == NULL) 553 return NULL; 554 k->type = type; 555 k->ecdsa = NULL; 556 k->ecdsa_nid = -1; 557 k->dsa = NULL; 558 k->rsa = NULL; 559 k->cert = NULL; 560 k->ed25519_sk = NULL; 561 k->ed25519_pk = NULL; 562 k->xmss_sk = NULL; 563 k->xmss_pk = NULL; 564 switch (k->type) { 565 #ifdef WITH_OPENSSL 566 case KEY_RSA: 567 case KEY_RSA_CERT: 568 if ((rsa = RSA_new()) == NULL) { 569 free(k); 570 return NULL; 571 } 572 k->rsa = rsa; 573 break; 574 case KEY_DSA: 575 case KEY_DSA_CERT: 576 if ((dsa = DSA_new()) == NULL) { 577 free(k); 578 return NULL; 579 } 580 k->dsa = dsa; 581 break; 582 case KEY_ECDSA: 583 case KEY_ECDSA_CERT: 584 case KEY_ECDSA_SK: 585 case KEY_ECDSA_SK_CERT: 586 /* Cannot do anything until we know the group */ 587 break; 588 #endif /* WITH_OPENSSL */ 589 case KEY_ED25519: 590 case KEY_ED25519_CERT: 591 case KEY_ED25519_SK: 592 case KEY_ED25519_SK_CERT: 593 case KEY_XMSS: 594 case KEY_XMSS_CERT: 595 /* no need to prealloc */ 596 break; 597 case KEY_UNSPEC: 598 break; 599 default: 600 free(k); 601 return NULL; 602 } 603 604 if (sshkey_is_cert(k)) { 605 if ((k->cert = cert_new()) == NULL) { 606 sshkey_free(k); 607 return NULL; 608 } 609 } 610 611 return k; 612 } 613 614 void 615 sshkey_free(struct sshkey *k) 616 { 617 if (k == NULL) 618 return; 619 switch (k->type) { 620 #ifdef WITH_OPENSSL 621 case KEY_RSA: 622 case KEY_RSA_CERT: 623 RSA_free(k->rsa); 624 k->rsa = NULL; 625 break; 626 case KEY_DSA: 627 case KEY_DSA_CERT: 628 DSA_free(k->dsa); 629 k->dsa = NULL; 630 break; 631 case KEY_ECDSA_SK: 632 case KEY_ECDSA_SK_CERT: 633 free(k->sk_application); 634 sshbuf_free(k->sk_key_handle); 635 sshbuf_free(k->sk_reserved); 636 /* FALLTHROUGH */ 637 case KEY_ECDSA: 638 case KEY_ECDSA_CERT: 639 EC_KEY_free(k->ecdsa); 640 k->ecdsa = NULL; 641 break; 642 #endif /* WITH_OPENSSL */ 643 case KEY_ED25519_SK: 644 case KEY_ED25519_SK_CERT: 645 free(k->sk_application); 646 sshbuf_free(k->sk_key_handle); 647 sshbuf_free(k->sk_reserved); 648 /* FALLTHROUGH */ 649 case KEY_ED25519: 650 case KEY_ED25519_CERT: 651 freezero(k->ed25519_pk, ED25519_PK_SZ); 652 k->ed25519_pk = NULL; 653 freezero(k->ed25519_sk, ED25519_SK_SZ); 654 k->ed25519_sk = NULL; 655 break; 656 #ifdef WITH_XMSS 657 case KEY_XMSS: 658 case KEY_XMSS_CERT: 659 freezero(k->xmss_pk, sshkey_xmss_pklen(k)); 660 k->xmss_pk = NULL; 661 freezero(k->xmss_sk, sshkey_xmss_sklen(k)); 662 k->xmss_sk = NULL; 663 sshkey_xmss_free_state(k); 664 free(k->xmss_name); 665 k->xmss_name = NULL; 666 free(k->xmss_filename); 667 k->xmss_filename = NULL; 668 break; 669 #endif /* WITH_XMSS */ 670 case KEY_UNSPEC: 671 break; 672 default: 673 break; 674 } 675 if (sshkey_is_cert(k)) 676 cert_free(k->cert); 677 freezero(k->shielded_private, k->shielded_len); 678 freezero(k->shield_prekey, k->shield_prekey_len); 679 freezero(k, sizeof(*k)); 680 } 681 682 static int 683 cert_compare(struct sshkey_cert *a, struct sshkey_cert *b) 684 { 685 if (a == NULL && b == NULL) 686 return 1; 687 if (a == NULL || b == NULL) 688 return 0; 689 if (sshbuf_len(a->certblob) != sshbuf_len(b->certblob)) 690 return 0; 691 if (timingsafe_bcmp(sshbuf_ptr(a->certblob), sshbuf_ptr(b->certblob), 692 sshbuf_len(a->certblob)) != 0) 693 return 0; 694 return 1; 695 } 696 697 /* 698 * Compare public portions of key only, allowing comparisons between 699 * certificates and plain keys too. 700 */ 701 int 702 sshkey_equal_public(const struct sshkey *a, const struct sshkey *b) 703 { 704 #ifdef WITH_OPENSSL 705 const BIGNUM *rsa_e_a, *rsa_n_a; 706 const BIGNUM *rsa_e_b, *rsa_n_b; 707 const BIGNUM *dsa_p_a, *dsa_q_a, *dsa_g_a, *dsa_pub_key_a; 708 const BIGNUM *dsa_p_b, *dsa_q_b, *dsa_g_b, *dsa_pub_key_b; 709 #endif /* WITH_OPENSSL */ 710 711 if (a == NULL || b == NULL || 712 sshkey_type_plain(a->type) != sshkey_type_plain(b->type)) 713 return 0; 714 715 switch (a->type) { 716 #ifdef WITH_OPENSSL 717 case KEY_RSA_CERT: 718 case KEY_RSA: 719 if (a->rsa == NULL || b->rsa == NULL) 720 return 0; 721 RSA_get0_key(a->rsa, &rsa_n_a, &rsa_e_a, NULL); 722 RSA_get0_key(b->rsa, &rsa_n_b, &rsa_e_b, NULL); 723 return BN_cmp(rsa_e_a, rsa_e_b) == 0 && 724 BN_cmp(rsa_n_a, rsa_n_b) == 0; 725 case KEY_DSA_CERT: 726 case KEY_DSA: 727 if (a->dsa == NULL || b->dsa == NULL) 728 return 0; 729 DSA_get0_pqg(a->dsa, &dsa_p_a, &dsa_q_a, &dsa_g_a); 730 DSA_get0_pqg(b->dsa, &dsa_p_b, &dsa_q_b, &dsa_g_b); 731 DSA_get0_key(a->dsa, &dsa_pub_key_a, NULL); 732 DSA_get0_key(b->dsa, &dsa_pub_key_b, NULL); 733 return BN_cmp(dsa_p_a, dsa_p_b) == 0 && 734 BN_cmp(dsa_q_a, dsa_q_b) == 0 && 735 BN_cmp(dsa_g_a, dsa_g_b) == 0 && 736 BN_cmp(dsa_pub_key_a, dsa_pub_key_b) == 0; 737 case KEY_ECDSA_SK: 738 case KEY_ECDSA_SK_CERT: 739 if (a->sk_application == NULL || b->sk_application == NULL) 740 return 0; 741 if (strcmp(a->sk_application, b->sk_application) != 0) 742 return 0; 743 /* FALLTHROUGH */ 744 case KEY_ECDSA_CERT: 745 case KEY_ECDSA: 746 if (a->ecdsa == NULL || b->ecdsa == NULL || 747 EC_KEY_get0_public_key(a->ecdsa) == NULL || 748 EC_KEY_get0_public_key(b->ecdsa) == NULL) 749 return 0; 750 if (EC_GROUP_cmp(EC_KEY_get0_group(a->ecdsa), 751 EC_KEY_get0_group(b->ecdsa), NULL) != 0 || 752 EC_POINT_cmp(EC_KEY_get0_group(a->ecdsa), 753 EC_KEY_get0_public_key(a->ecdsa), 754 EC_KEY_get0_public_key(b->ecdsa), NULL) != 0) 755 return 0; 756 return 1; 757 #endif /* WITH_OPENSSL */ 758 case KEY_ED25519_SK: 759 case KEY_ED25519_SK_CERT: 760 if (a->sk_application == NULL || b->sk_application == NULL) 761 return 0; 762 if (strcmp(a->sk_application, b->sk_application) != 0) 763 return 0; 764 /* FALLTHROUGH */ 765 case KEY_ED25519: 766 case KEY_ED25519_CERT: 767 return a->ed25519_pk != NULL && b->ed25519_pk != NULL && 768 memcmp(a->ed25519_pk, b->ed25519_pk, ED25519_PK_SZ) == 0; 769 #ifdef WITH_XMSS 770 case KEY_XMSS: 771 case KEY_XMSS_CERT: 772 return a->xmss_pk != NULL && b->xmss_pk != NULL && 773 sshkey_xmss_pklen(a) == sshkey_xmss_pklen(b) && 774 memcmp(a->xmss_pk, b->xmss_pk, sshkey_xmss_pklen(a)) == 0; 775 #endif /* WITH_XMSS */ 776 default: 777 return 0; 778 } 779 /* NOTREACHED */ 780 } 781 782 int 783 sshkey_equal(const struct sshkey *a, const struct sshkey *b) 784 { 785 if (a == NULL || b == NULL || a->type != b->type) 786 return 0; 787 if (sshkey_is_cert(a)) { 788 if (!cert_compare(a->cert, b->cert)) 789 return 0; 790 } 791 return sshkey_equal_public(a, b); 792 } 793 794 static int 795 to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain, 796 enum sshkey_serialize_rep opts) 797 { 798 int type, ret = SSH_ERR_INTERNAL_ERROR; 799 const char *typename; 800 #ifdef WITH_OPENSSL 801 const BIGNUM *rsa_n, *rsa_e, *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key; 802 #endif /* WITH_OPENSSL */ 803 804 if (key == NULL) 805 return SSH_ERR_INVALID_ARGUMENT; 806 807 if (sshkey_is_cert(key)) { 808 if (key->cert == NULL) 809 return SSH_ERR_EXPECTED_CERT; 810 if (sshbuf_len(key->cert->certblob) == 0) 811 return SSH_ERR_KEY_LACKS_CERTBLOB; 812 } 813 type = force_plain ? sshkey_type_plain(key->type) : key->type; 814 typename = sshkey_ssh_name_from_type_nid(type, key->ecdsa_nid); 815 816 switch (type) { 817 #ifdef WITH_OPENSSL 818 case KEY_DSA_CERT: 819 case KEY_ECDSA_CERT: 820 case KEY_ECDSA_SK_CERT: 821 case KEY_RSA_CERT: 822 #endif /* WITH_OPENSSL */ 823 case KEY_ED25519_CERT: 824 case KEY_ED25519_SK_CERT: 825 #ifdef WITH_XMSS 826 case KEY_XMSS_CERT: 827 #endif /* WITH_XMSS */ 828 /* Use the existing blob */ 829 /* XXX modified flag? */ 830 if ((ret = sshbuf_putb(b, key->cert->certblob)) != 0) 831 return ret; 832 break; 833 #ifdef WITH_OPENSSL 834 case KEY_DSA: 835 if (key->dsa == NULL) 836 return SSH_ERR_INVALID_ARGUMENT; 837 DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g); 838 DSA_get0_key(key->dsa, &dsa_pub_key, NULL); 839 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 840 (ret = sshbuf_put_bignum2(b, dsa_p)) != 0 || 841 (ret = sshbuf_put_bignum2(b, dsa_q)) != 0 || 842 (ret = sshbuf_put_bignum2(b, dsa_g)) != 0 || 843 (ret = sshbuf_put_bignum2(b, dsa_pub_key)) != 0) 844 return ret; 845 break; 846 case KEY_ECDSA: 847 case KEY_ECDSA_SK: 848 if (key->ecdsa == NULL) 849 return SSH_ERR_INVALID_ARGUMENT; 850 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 851 (ret = sshbuf_put_cstring(b, 852 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 853 (ret = sshbuf_put_eckey(b, key->ecdsa)) != 0) 854 return ret; 855 if (type == KEY_ECDSA_SK) { 856 if ((ret = sshbuf_put_cstring(b, 857 key->sk_application)) != 0) 858 return ret; 859 } 860 break; 861 case KEY_RSA: 862 if (key->rsa == NULL) 863 return SSH_ERR_INVALID_ARGUMENT; 864 RSA_get0_key(key->rsa, &rsa_n, &rsa_e, NULL); 865 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 866 (ret = sshbuf_put_bignum2(b, rsa_e)) != 0 || 867 (ret = sshbuf_put_bignum2(b, rsa_n)) != 0) 868 return ret; 869 break; 870 #endif /* WITH_OPENSSL */ 871 case KEY_ED25519: 872 case KEY_ED25519_SK: 873 if (key->ed25519_pk == NULL) 874 return SSH_ERR_INVALID_ARGUMENT; 875 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 876 (ret = sshbuf_put_string(b, 877 key->ed25519_pk, ED25519_PK_SZ)) != 0) 878 return ret; 879 if (type == KEY_ED25519_SK) { 880 if ((ret = sshbuf_put_cstring(b, 881 key->sk_application)) != 0) 882 return ret; 883 } 884 break; 885 #ifdef WITH_XMSS 886 case KEY_XMSS: 887 if (key->xmss_name == NULL || key->xmss_pk == NULL || 888 sshkey_xmss_pklen(key) == 0) 889 return SSH_ERR_INVALID_ARGUMENT; 890 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 891 (ret = sshbuf_put_cstring(b, key->xmss_name)) != 0 || 892 (ret = sshbuf_put_string(b, 893 key->xmss_pk, sshkey_xmss_pklen(key))) != 0 || 894 (ret = sshkey_xmss_serialize_pk_info(key, b, opts)) != 0) 895 return ret; 896 break; 897 #endif /* WITH_XMSS */ 898 default: 899 return SSH_ERR_KEY_TYPE_UNKNOWN; 900 } 901 return 0; 902 } 903 904 int 905 sshkey_putb(const struct sshkey *key, struct sshbuf *b) 906 { 907 return to_blob_buf(key, b, 0, SSHKEY_SERIALIZE_DEFAULT); 908 } 909 910 int 911 sshkey_puts_opts(const struct sshkey *key, struct sshbuf *b, 912 enum sshkey_serialize_rep opts) 913 { 914 struct sshbuf *tmp; 915 int r; 916 917 if ((tmp = sshbuf_new()) == NULL) 918 return SSH_ERR_ALLOC_FAIL; 919 r = to_blob_buf(key, tmp, 0, opts); 920 if (r == 0) 921 r = sshbuf_put_stringb(b, tmp); 922 sshbuf_free(tmp); 923 return r; 924 } 925 926 int 927 sshkey_puts(const struct sshkey *key, struct sshbuf *b) 928 { 929 return sshkey_puts_opts(key, b, SSHKEY_SERIALIZE_DEFAULT); 930 } 931 932 int 933 sshkey_putb_plain(const struct sshkey *key, struct sshbuf *b) 934 { 935 return to_blob_buf(key, b, 1, SSHKEY_SERIALIZE_DEFAULT); 936 } 937 938 static int 939 to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp, int force_plain, 940 enum sshkey_serialize_rep opts) 941 { 942 int ret = SSH_ERR_INTERNAL_ERROR; 943 size_t len; 944 struct sshbuf *b = NULL; 945 946 if (lenp != NULL) 947 *lenp = 0; 948 if (blobp != NULL) 949 *blobp = NULL; 950 if ((b = sshbuf_new()) == NULL) 951 return SSH_ERR_ALLOC_FAIL; 952 if ((ret = to_blob_buf(key, b, force_plain, opts)) != 0) 953 goto out; 954 len = sshbuf_len(b); 955 if (lenp != NULL) 956 *lenp = len; 957 if (blobp != NULL) { 958 if ((*blobp = malloc(len)) == NULL) { 959 ret = SSH_ERR_ALLOC_FAIL; 960 goto out; 961 } 962 memcpy(*blobp, sshbuf_ptr(b), len); 963 } 964 ret = 0; 965 out: 966 sshbuf_free(b); 967 return ret; 968 } 969 970 int 971 sshkey_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 972 { 973 return to_blob(key, blobp, lenp, 0, SSHKEY_SERIALIZE_DEFAULT); 974 } 975 976 int 977 sshkey_plain_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 978 { 979 return to_blob(key, blobp, lenp, 1, SSHKEY_SERIALIZE_DEFAULT); 980 } 981 982 int 983 sshkey_fingerprint_raw(const struct sshkey *k, int dgst_alg, 984 u_char **retp, size_t *lenp) 985 { 986 u_char *blob = NULL, *ret = NULL; 987 size_t blob_len = 0; 988 int r = SSH_ERR_INTERNAL_ERROR; 989 990 if (retp != NULL) 991 *retp = NULL; 992 if (lenp != NULL) 993 *lenp = 0; 994 if (ssh_digest_bytes(dgst_alg) == 0) { 995 r = SSH_ERR_INVALID_ARGUMENT; 996 goto out; 997 } 998 if ((r = to_blob(k, &blob, &blob_len, 1, SSHKEY_SERIALIZE_DEFAULT)) 999 != 0) 1000 goto out; 1001 if ((ret = calloc(1, SSH_DIGEST_MAX_LENGTH)) == NULL) { 1002 r = SSH_ERR_ALLOC_FAIL; 1003 goto out; 1004 } 1005 if ((r = ssh_digest_memory(dgst_alg, blob, blob_len, 1006 ret, SSH_DIGEST_MAX_LENGTH)) != 0) 1007 goto out; 1008 /* success */ 1009 if (retp != NULL) { 1010 *retp = ret; 1011 ret = NULL; 1012 } 1013 if (lenp != NULL) 1014 *lenp = ssh_digest_bytes(dgst_alg); 1015 r = 0; 1016 out: 1017 free(ret); 1018 if (blob != NULL) 1019 freezero(blob, blob_len); 1020 return r; 1021 } 1022 1023 static char * 1024 fingerprint_b64(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 1025 { 1026 char *ret; 1027 size_t plen = strlen(alg) + 1; 1028 size_t rlen = ((dgst_raw_len + 2) / 3) * 4 + plen + 1; 1029 1030 if (dgst_raw_len > 65536 || (ret = calloc(1, rlen)) == NULL) 1031 return NULL; 1032 strlcpy(ret, alg, rlen); 1033 strlcat(ret, ":", rlen); 1034 if (dgst_raw_len == 0) 1035 return ret; 1036 if (b64_ntop(dgst_raw, dgst_raw_len, ret + plen, rlen - plen) == -1) { 1037 freezero(ret, rlen); 1038 return NULL; 1039 } 1040 /* Trim padding characters from end */ 1041 ret[strcspn(ret, "=")] = '\0'; 1042 return ret; 1043 } 1044 1045 static char * 1046 fingerprint_hex(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 1047 { 1048 char *retval, hex[5]; 1049 size_t i, rlen = dgst_raw_len * 3 + strlen(alg) + 2; 1050 1051 if (dgst_raw_len > 65536 || (retval = calloc(1, rlen)) == NULL) 1052 return NULL; 1053 strlcpy(retval, alg, rlen); 1054 strlcat(retval, ":", rlen); 1055 for (i = 0; i < dgst_raw_len; i++) { 1056 snprintf(hex, sizeof(hex), "%s%02x", 1057 i > 0 ? ":" : "", dgst_raw[i]); 1058 strlcat(retval, hex, rlen); 1059 } 1060 return retval; 1061 } 1062 1063 static char * 1064 fingerprint_bubblebabble(u_char *dgst_raw, size_t dgst_raw_len) 1065 { 1066 char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' }; 1067 char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm', 1068 'n', 'p', 'r', 's', 't', 'v', 'z', 'x' }; 1069 u_int i, j = 0, rounds, seed = 1; 1070 char *retval; 1071 1072 rounds = (dgst_raw_len / 2) + 1; 1073 if ((retval = calloc(rounds, 6)) == NULL) 1074 return NULL; 1075 retval[j++] = 'x'; 1076 for (i = 0; i < rounds; i++) { 1077 u_int idx0, idx1, idx2, idx3, idx4; 1078 if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) { 1079 idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) + 1080 seed) % 6; 1081 idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15; 1082 idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) + 1083 (seed / 6)) % 6; 1084 retval[j++] = vowels[idx0]; 1085 retval[j++] = consonants[idx1]; 1086 retval[j++] = vowels[idx2]; 1087 if ((i + 1) < rounds) { 1088 idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15; 1089 idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15; 1090 retval[j++] = consonants[idx3]; 1091 retval[j++] = '-'; 1092 retval[j++] = consonants[idx4]; 1093 seed = ((seed * 5) + 1094 ((((u_int)(dgst_raw[2 * i])) * 7) + 1095 ((u_int)(dgst_raw[(2 * i) + 1])))) % 36; 1096 } 1097 } else { 1098 idx0 = seed % 6; 1099 idx1 = 16; 1100 idx2 = seed / 6; 1101 retval[j++] = vowels[idx0]; 1102 retval[j++] = consonants[idx1]; 1103 retval[j++] = vowels[idx2]; 1104 } 1105 } 1106 retval[j++] = 'x'; 1107 retval[j++] = '\0'; 1108 return retval; 1109 } 1110 1111 /* 1112 * Draw an ASCII-Art representing the fingerprint so human brain can 1113 * profit from its built-in pattern recognition ability. 1114 * This technique is called "random art" and can be found in some 1115 * scientific publications like this original paper: 1116 * 1117 * "Hash Visualization: a New Technique to improve Real-World Security", 1118 * Perrig A. and Song D., 1999, International Workshop on Cryptographic 1119 * Techniques and E-Commerce (CrypTEC '99) 1120 * sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf 1121 * 1122 * The subject came up in a talk by Dan Kaminsky, too. 1123 * 1124 * If you see the picture is different, the key is different. 1125 * If the picture looks the same, you still know nothing. 1126 * 1127 * The algorithm used here is a worm crawling over a discrete plane, 1128 * leaving a trace (augmenting the field) everywhere it goes. 1129 * Movement is taken from dgst_raw 2bit-wise. Bumping into walls 1130 * makes the respective movement vector be ignored for this turn. 1131 * Graphs are not unambiguous, because circles in graphs can be 1132 * walked in either direction. 1133 */ 1134 1135 /* 1136 * Field sizes for the random art. Have to be odd, so the starting point 1137 * can be in the exact middle of the picture, and FLDBASE should be >=8 . 1138 * Else pictures would be too dense, and drawing the frame would 1139 * fail, too, because the key type would not fit in anymore. 1140 */ 1141 #define FLDBASE 8 1142 #define FLDSIZE_Y (FLDBASE + 1) 1143 #define FLDSIZE_X (FLDBASE * 2 + 1) 1144 static char * 1145 fingerprint_randomart(const char *alg, u_char *dgst_raw, size_t dgst_raw_len, 1146 const struct sshkey *k) 1147 { 1148 /* 1149 * Chars to be used after each other every time the worm 1150 * intersects with itself. Matter of taste. 1151 */ 1152 char *augmentation_string = " .o+=*BOX@%&#/^SE"; 1153 char *retval, *p, title[FLDSIZE_X], hash[FLDSIZE_X]; 1154 u_char field[FLDSIZE_X][FLDSIZE_Y]; 1155 size_t i, tlen, hlen; 1156 u_int b; 1157 int x, y, r; 1158 size_t len = strlen(augmentation_string) - 1; 1159 1160 if ((retval = calloc((FLDSIZE_X + 3), (FLDSIZE_Y + 2))) == NULL) 1161 return NULL; 1162 1163 /* initialize field */ 1164 memset(field, 0, FLDSIZE_X * FLDSIZE_Y * sizeof(char)); 1165 x = FLDSIZE_X / 2; 1166 y = FLDSIZE_Y / 2; 1167 1168 /* process raw key */ 1169 for (i = 0; i < dgst_raw_len; i++) { 1170 int input; 1171 /* each byte conveys four 2-bit move commands */ 1172 input = dgst_raw[i]; 1173 for (b = 0; b < 4; b++) { 1174 /* evaluate 2 bit, rest is shifted later */ 1175 x += (input & 0x1) ? 1 : -1; 1176 y += (input & 0x2) ? 1 : -1; 1177 1178 /* assure we are still in bounds */ 1179 x = MAXIMUM(x, 0); 1180 y = MAXIMUM(y, 0); 1181 x = MINIMUM(x, FLDSIZE_X - 1); 1182 y = MINIMUM(y, FLDSIZE_Y - 1); 1183 1184 /* augment the field */ 1185 if (field[x][y] < len - 2) 1186 field[x][y]++; 1187 input = input >> 2; 1188 } 1189 } 1190 1191 /* mark starting point and end point*/ 1192 field[FLDSIZE_X / 2][FLDSIZE_Y / 2] = len - 1; 1193 field[x][y] = len; 1194 1195 /* assemble title */ 1196 r = snprintf(title, sizeof(title), "[%s %u]", 1197 sshkey_type(k), sshkey_size(k)); 1198 /* If [type size] won't fit, then try [type]; fits "[ED25519-CERT]" */ 1199 if (r < 0 || r > (int)sizeof(title)) 1200 r = snprintf(title, sizeof(title), "[%s]", sshkey_type(k)); 1201 tlen = (r <= 0) ? 0 : strlen(title); 1202 1203 /* assemble hash ID. */ 1204 r = snprintf(hash, sizeof(hash), "[%s]", alg); 1205 hlen = (r <= 0) ? 0 : strlen(hash); 1206 1207 /* output upper border */ 1208 p = retval; 1209 *p++ = '+'; 1210 for (i = 0; i < (FLDSIZE_X - tlen) / 2; i++) 1211 *p++ = '-'; 1212 memcpy(p, title, tlen); 1213 p += tlen; 1214 for (i += tlen; i < FLDSIZE_X; i++) 1215 *p++ = '-'; 1216 *p++ = '+'; 1217 *p++ = '\n'; 1218 1219 /* output content */ 1220 for (y = 0; y < FLDSIZE_Y; y++) { 1221 *p++ = '|'; 1222 for (x = 0; x < FLDSIZE_X; x++) 1223 *p++ = augmentation_string[MINIMUM(field[x][y], len)]; 1224 *p++ = '|'; 1225 *p++ = '\n'; 1226 } 1227 1228 /* output lower border */ 1229 *p++ = '+'; 1230 for (i = 0; i < (FLDSIZE_X - hlen) / 2; i++) 1231 *p++ = '-'; 1232 memcpy(p, hash, hlen); 1233 p += hlen; 1234 for (i += hlen; i < FLDSIZE_X; i++) 1235 *p++ = '-'; 1236 *p++ = '+'; 1237 1238 return retval; 1239 } 1240 1241 char * 1242 sshkey_fingerprint(const struct sshkey *k, int dgst_alg, 1243 enum sshkey_fp_rep dgst_rep) 1244 { 1245 char *retval = NULL; 1246 u_char *dgst_raw; 1247 size_t dgst_raw_len; 1248 1249 if (sshkey_fingerprint_raw(k, dgst_alg, &dgst_raw, &dgst_raw_len) != 0) 1250 return NULL; 1251 switch (dgst_rep) { 1252 case SSH_FP_DEFAULT: 1253 if (dgst_alg == SSH_DIGEST_MD5) { 1254 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1255 dgst_raw, dgst_raw_len); 1256 } else { 1257 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1258 dgst_raw, dgst_raw_len); 1259 } 1260 break; 1261 case SSH_FP_HEX: 1262 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1263 dgst_raw, dgst_raw_len); 1264 break; 1265 case SSH_FP_BASE64: 1266 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1267 dgst_raw, dgst_raw_len); 1268 break; 1269 case SSH_FP_BUBBLEBABBLE: 1270 retval = fingerprint_bubblebabble(dgst_raw, dgst_raw_len); 1271 break; 1272 case SSH_FP_RANDOMART: 1273 retval = fingerprint_randomart(ssh_digest_alg_name(dgst_alg), 1274 dgst_raw, dgst_raw_len, k); 1275 break; 1276 default: 1277 freezero(dgst_raw, dgst_raw_len); 1278 return NULL; 1279 } 1280 freezero(dgst_raw, dgst_raw_len); 1281 return retval; 1282 } 1283 1284 static int 1285 peek_type_nid(const char *s, size_t l, int *nid) 1286 { 1287 const struct keytype *kt; 1288 1289 for (kt = keytypes; kt->type != -1; kt++) { 1290 if (kt->name == NULL || strlen(kt->name) != l) 1291 continue; 1292 if (memcmp(s, kt->name, l) == 0) { 1293 *nid = -1; 1294 if (key_type_is_ecdsa_variant(kt->type)) 1295 *nid = kt->nid; 1296 return kt->type; 1297 } 1298 } 1299 return KEY_UNSPEC; 1300 } 1301 1302 /* XXX this can now be made const char * */ 1303 int 1304 sshkey_read(struct sshkey *ret, char **cpp) 1305 { 1306 struct sshkey *k; 1307 char *cp, *blobcopy; 1308 size_t space; 1309 int r, type, curve_nid = -1; 1310 struct sshbuf *blob; 1311 1312 if (ret == NULL) 1313 return SSH_ERR_INVALID_ARGUMENT; 1314 1315 switch (ret->type) { 1316 case KEY_UNSPEC: 1317 case KEY_RSA: 1318 case KEY_DSA: 1319 case KEY_ECDSA: 1320 case KEY_ECDSA_SK: 1321 case KEY_ED25519: 1322 case KEY_ED25519_SK: 1323 case KEY_DSA_CERT: 1324 case KEY_ECDSA_CERT: 1325 case KEY_ECDSA_SK_CERT: 1326 case KEY_RSA_CERT: 1327 case KEY_ED25519_CERT: 1328 case KEY_ED25519_SK_CERT: 1329 #ifdef WITH_XMSS 1330 case KEY_XMSS: 1331 case KEY_XMSS_CERT: 1332 #endif /* WITH_XMSS */ 1333 break; /* ok */ 1334 default: 1335 return SSH_ERR_INVALID_ARGUMENT; 1336 } 1337 1338 /* Decode type */ 1339 cp = *cpp; 1340 space = strcspn(cp, " \t"); 1341 if (space == strlen(cp)) 1342 return SSH_ERR_INVALID_FORMAT; 1343 if ((type = peek_type_nid(cp, space, &curve_nid)) == KEY_UNSPEC) 1344 return SSH_ERR_INVALID_FORMAT; 1345 1346 /* skip whitespace */ 1347 for (cp += space; *cp == ' ' || *cp == '\t'; cp++) 1348 ; 1349 if (*cp == '\0') 1350 return SSH_ERR_INVALID_FORMAT; 1351 if (ret->type != KEY_UNSPEC && ret->type != type) 1352 return SSH_ERR_KEY_TYPE_MISMATCH; 1353 if ((blob = sshbuf_new()) == NULL) 1354 return SSH_ERR_ALLOC_FAIL; 1355 1356 /* find end of keyblob and decode */ 1357 space = strcspn(cp, " \t"); 1358 if ((blobcopy = strndup(cp, space)) == NULL) { 1359 sshbuf_free(blob); 1360 return SSH_ERR_ALLOC_FAIL; 1361 } 1362 if ((r = sshbuf_b64tod(blob, blobcopy)) != 0) { 1363 free(blobcopy); 1364 sshbuf_free(blob); 1365 return r; 1366 } 1367 free(blobcopy); 1368 if ((r = sshkey_fromb(blob, &k)) != 0) { 1369 sshbuf_free(blob); 1370 return r; 1371 } 1372 sshbuf_free(blob); 1373 1374 /* skip whitespace and leave cp at start of comment */ 1375 for (cp += space; *cp == ' ' || *cp == '\t'; cp++) 1376 ; 1377 1378 /* ensure type of blob matches type at start of line */ 1379 if (k->type != type) { 1380 sshkey_free(k); 1381 return SSH_ERR_KEY_TYPE_MISMATCH; 1382 } 1383 if (key_type_is_ecdsa_variant(type) && curve_nid != k->ecdsa_nid) { 1384 sshkey_free(k); 1385 return SSH_ERR_EC_CURVE_MISMATCH; 1386 } 1387 1388 /* Fill in ret from parsed key */ 1389 ret->type = type; 1390 if (sshkey_is_cert(ret)) { 1391 if (!sshkey_is_cert(k)) { 1392 sshkey_free(k); 1393 return SSH_ERR_EXPECTED_CERT; 1394 } 1395 if (ret->cert != NULL) 1396 cert_free(ret->cert); 1397 ret->cert = k->cert; 1398 k->cert = NULL; 1399 } 1400 switch (sshkey_type_plain(ret->type)) { 1401 #ifdef WITH_OPENSSL 1402 case KEY_RSA: 1403 RSA_free(ret->rsa); 1404 ret->rsa = k->rsa; 1405 k->rsa = NULL; 1406 #ifdef DEBUG_PK 1407 RSA_print_fp(stderr, ret->rsa, 8); 1408 #endif 1409 break; 1410 case KEY_DSA: 1411 DSA_free(ret->dsa); 1412 ret->dsa = k->dsa; 1413 k->dsa = NULL; 1414 #ifdef DEBUG_PK 1415 DSA_print_fp(stderr, ret->dsa, 8); 1416 #endif 1417 break; 1418 case KEY_ECDSA: 1419 EC_KEY_free(ret->ecdsa); 1420 ret->ecdsa = k->ecdsa; 1421 ret->ecdsa_nid = k->ecdsa_nid; 1422 k->ecdsa = NULL; 1423 k->ecdsa_nid = -1; 1424 #ifdef DEBUG_PK 1425 sshkey_dump_ec_key(ret->ecdsa); 1426 #endif 1427 break; 1428 case KEY_ECDSA_SK: 1429 EC_KEY_free(ret->ecdsa); 1430 ret->ecdsa = k->ecdsa; 1431 ret->ecdsa_nid = k->ecdsa_nid; 1432 ret->sk_application = k->sk_application; 1433 k->ecdsa = NULL; 1434 k->ecdsa_nid = -1; 1435 k->sk_application = NULL; 1436 #ifdef DEBUG_PK 1437 sshkey_dump_ec_key(ret->ecdsa); 1438 fprintf(stderr, "App: %s\n", ret->sk_application); 1439 #endif 1440 break; 1441 #endif /* WITH_OPENSSL */ 1442 case KEY_ED25519: 1443 freezero(ret->ed25519_pk, ED25519_PK_SZ); 1444 ret->ed25519_pk = k->ed25519_pk; 1445 k->ed25519_pk = NULL; 1446 #ifdef DEBUG_PK 1447 /* XXX */ 1448 #endif 1449 break; 1450 case KEY_ED25519_SK: 1451 freezero(ret->ed25519_pk, ED25519_PK_SZ); 1452 ret->ed25519_pk = k->ed25519_pk; 1453 ret->sk_application = k->sk_application; 1454 k->ed25519_pk = NULL; 1455 k->sk_application = NULL; 1456 break; 1457 #ifdef WITH_XMSS 1458 case KEY_XMSS: 1459 free(ret->xmss_pk); 1460 ret->xmss_pk = k->xmss_pk; 1461 k->xmss_pk = NULL; 1462 free(ret->xmss_state); 1463 ret->xmss_state = k->xmss_state; 1464 k->xmss_state = NULL; 1465 free(ret->xmss_name); 1466 ret->xmss_name = k->xmss_name; 1467 k->xmss_name = NULL; 1468 free(ret->xmss_filename); 1469 ret->xmss_filename = k->xmss_filename; 1470 k->xmss_filename = NULL; 1471 #ifdef DEBUG_PK 1472 /* XXX */ 1473 #endif 1474 break; 1475 #endif /* WITH_XMSS */ 1476 default: 1477 sshkey_free(k); 1478 return SSH_ERR_INTERNAL_ERROR; 1479 } 1480 sshkey_free(k); 1481 1482 /* success */ 1483 *cpp = cp; 1484 return 0; 1485 } 1486 1487 int 1488 sshkey_to_base64(const struct sshkey *key, char **b64p) 1489 { 1490 int r = SSH_ERR_INTERNAL_ERROR; 1491 struct sshbuf *b = NULL; 1492 char *uu = NULL; 1493 1494 if (b64p != NULL) 1495 *b64p = NULL; 1496 if ((b = sshbuf_new()) == NULL) 1497 return SSH_ERR_ALLOC_FAIL; 1498 if ((r = sshkey_putb(key, b)) != 0) 1499 goto out; 1500 if ((uu = sshbuf_dtob64_string(b, 0)) == NULL) { 1501 r = SSH_ERR_ALLOC_FAIL; 1502 goto out; 1503 } 1504 /* Success */ 1505 if (b64p != NULL) { 1506 *b64p = uu; 1507 uu = NULL; 1508 } 1509 r = 0; 1510 out: 1511 sshbuf_free(b); 1512 free(uu); 1513 return r; 1514 } 1515 1516 int 1517 sshkey_format_text(const struct sshkey *key, struct sshbuf *b) 1518 { 1519 int r = SSH_ERR_INTERNAL_ERROR; 1520 char *uu = NULL; 1521 1522 if ((r = sshkey_to_base64(key, &uu)) != 0) 1523 goto out; 1524 if ((r = sshbuf_putf(b, "%s %s", 1525 sshkey_ssh_name(key), uu)) != 0) 1526 goto out; 1527 r = 0; 1528 out: 1529 free(uu); 1530 return r; 1531 } 1532 1533 int 1534 sshkey_write(const struct sshkey *key, FILE *f) 1535 { 1536 struct sshbuf *b = NULL; 1537 int r = SSH_ERR_INTERNAL_ERROR; 1538 1539 if ((b = sshbuf_new()) == NULL) 1540 return SSH_ERR_ALLOC_FAIL; 1541 if ((r = sshkey_format_text(key, b)) != 0) 1542 goto out; 1543 if (fwrite(sshbuf_ptr(b), sshbuf_len(b), 1, f) != 1) { 1544 if (feof(f)) 1545 errno = EPIPE; 1546 r = SSH_ERR_SYSTEM_ERROR; 1547 goto out; 1548 } 1549 /* Success */ 1550 r = 0; 1551 out: 1552 sshbuf_free(b); 1553 return r; 1554 } 1555 1556 const char * 1557 sshkey_cert_type(const struct sshkey *k) 1558 { 1559 switch (k->cert->type) { 1560 case SSH2_CERT_TYPE_USER: 1561 return "user"; 1562 case SSH2_CERT_TYPE_HOST: 1563 return "host"; 1564 default: 1565 return "unknown"; 1566 } 1567 } 1568 1569 #ifdef WITH_OPENSSL 1570 static int 1571 rsa_generate_private_key(u_int bits, RSA **rsap) 1572 { 1573 RSA *private = NULL; 1574 BIGNUM *f4 = NULL; 1575 int ret = SSH_ERR_INTERNAL_ERROR; 1576 1577 if (rsap == NULL) 1578 return SSH_ERR_INVALID_ARGUMENT; 1579 if (bits < SSH_RSA_MINIMUM_MODULUS_SIZE || 1580 bits > SSHBUF_MAX_BIGNUM * 8) 1581 return SSH_ERR_KEY_LENGTH; 1582 *rsap = NULL; 1583 if ((private = RSA_new()) == NULL || (f4 = BN_new()) == NULL) { 1584 ret = SSH_ERR_ALLOC_FAIL; 1585 goto out; 1586 } 1587 if (!BN_set_word(f4, RSA_F4) || 1588 !RSA_generate_key_ex(private, bits, f4, NULL)) { 1589 ret = SSH_ERR_LIBCRYPTO_ERROR; 1590 goto out; 1591 } 1592 *rsap = private; 1593 private = NULL; 1594 ret = 0; 1595 out: 1596 RSA_free(private); 1597 BN_free(f4); 1598 return ret; 1599 } 1600 1601 static int 1602 dsa_generate_private_key(u_int bits, DSA **dsap) 1603 { 1604 DSA *private; 1605 int ret = SSH_ERR_INTERNAL_ERROR; 1606 1607 if (dsap == NULL) 1608 return SSH_ERR_INVALID_ARGUMENT; 1609 if (bits != 1024) 1610 return SSH_ERR_KEY_LENGTH; 1611 if ((private = DSA_new()) == NULL) { 1612 ret = SSH_ERR_ALLOC_FAIL; 1613 goto out; 1614 } 1615 *dsap = NULL; 1616 if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL, 1617 NULL, NULL) || !DSA_generate_key(private)) { 1618 ret = SSH_ERR_LIBCRYPTO_ERROR; 1619 goto out; 1620 } 1621 *dsap = private; 1622 private = NULL; 1623 ret = 0; 1624 out: 1625 DSA_free(private); 1626 return ret; 1627 } 1628 1629 int 1630 sshkey_ecdsa_key_to_nid(EC_KEY *k) 1631 { 1632 EC_GROUP *eg; 1633 int nids[] = { 1634 NID_X9_62_prime256v1, 1635 NID_secp384r1, 1636 NID_secp521r1, 1637 -1 1638 }; 1639 int nid; 1640 u_int i; 1641 const EC_GROUP *g = EC_KEY_get0_group(k); 1642 1643 /* 1644 * The group may be stored in a ASN.1 encoded private key in one of two 1645 * ways: as a "named group", which is reconstituted by ASN.1 object ID 1646 * or explicit group parameters encoded into the key blob. Only the 1647 * "named group" case sets the group NID for us, but we can figure 1648 * it out for the other case by comparing against all the groups that 1649 * are supported. 1650 */ 1651 if ((nid = EC_GROUP_get_curve_name(g)) > 0) 1652 return nid; 1653 for (i = 0; nids[i] != -1; i++) { 1654 if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL) 1655 return -1; 1656 if (EC_GROUP_cmp(g, eg, NULL) == 0) 1657 break; 1658 EC_GROUP_free(eg); 1659 } 1660 if (nids[i] != -1) { 1661 /* Use the group with the NID attached */ 1662 EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE); 1663 if (EC_KEY_set_group(k, eg) != 1) { 1664 EC_GROUP_free(eg); 1665 return -1; 1666 } 1667 } 1668 return nids[i]; 1669 } 1670 1671 static int 1672 ecdsa_generate_private_key(u_int bits, int *nid, EC_KEY **ecdsap) 1673 { 1674 EC_KEY *private; 1675 int ret = SSH_ERR_INTERNAL_ERROR; 1676 1677 if (nid == NULL || ecdsap == NULL) 1678 return SSH_ERR_INVALID_ARGUMENT; 1679 if ((*nid = sshkey_ecdsa_bits_to_nid(bits)) == -1) 1680 return SSH_ERR_KEY_LENGTH; 1681 *ecdsap = NULL; 1682 if ((private = EC_KEY_new_by_curve_name(*nid)) == NULL) { 1683 ret = SSH_ERR_ALLOC_FAIL; 1684 goto out; 1685 } 1686 if (EC_KEY_generate_key(private) != 1) { 1687 ret = SSH_ERR_LIBCRYPTO_ERROR; 1688 goto out; 1689 } 1690 EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE); 1691 *ecdsap = private; 1692 private = NULL; 1693 ret = 0; 1694 out: 1695 EC_KEY_free(private); 1696 return ret; 1697 } 1698 #endif /* WITH_OPENSSL */ 1699 1700 int 1701 sshkey_generate(int type, u_int bits, struct sshkey **keyp) 1702 { 1703 struct sshkey *k; 1704 int ret = SSH_ERR_INTERNAL_ERROR; 1705 1706 if (keyp == NULL) 1707 return SSH_ERR_INVALID_ARGUMENT; 1708 *keyp = NULL; 1709 if ((k = sshkey_new(KEY_UNSPEC)) == NULL) 1710 return SSH_ERR_ALLOC_FAIL; 1711 switch (type) { 1712 case KEY_ED25519: 1713 if ((k->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL || 1714 (k->ed25519_sk = malloc(ED25519_SK_SZ)) == NULL) { 1715 ret = SSH_ERR_ALLOC_FAIL; 1716 break; 1717 } 1718 crypto_sign_ed25519_keypair(k->ed25519_pk, k->ed25519_sk); 1719 ret = 0; 1720 break; 1721 #ifdef WITH_XMSS 1722 case KEY_XMSS: 1723 ret = sshkey_xmss_generate_private_key(k, bits); 1724 break; 1725 #endif /* WITH_XMSS */ 1726 #ifdef WITH_OPENSSL 1727 case KEY_DSA: 1728 ret = dsa_generate_private_key(bits, &k->dsa); 1729 break; 1730 case KEY_ECDSA: 1731 ret = ecdsa_generate_private_key(bits, &k->ecdsa_nid, 1732 &k->ecdsa); 1733 break; 1734 case KEY_RSA: 1735 ret = rsa_generate_private_key(bits, &k->rsa); 1736 break; 1737 #endif /* WITH_OPENSSL */ 1738 default: 1739 ret = SSH_ERR_INVALID_ARGUMENT; 1740 } 1741 if (ret == 0) { 1742 k->type = type; 1743 *keyp = k; 1744 } else 1745 sshkey_free(k); 1746 return ret; 1747 } 1748 1749 int 1750 sshkey_cert_copy(const struct sshkey *from_key, struct sshkey *to_key) 1751 { 1752 u_int i; 1753 const struct sshkey_cert *from; 1754 struct sshkey_cert *to; 1755 int r = SSH_ERR_INTERNAL_ERROR; 1756 1757 if (to_key == NULL || (from = from_key->cert) == NULL) 1758 return SSH_ERR_INVALID_ARGUMENT; 1759 1760 if ((to = cert_new()) == NULL) 1761 return SSH_ERR_ALLOC_FAIL; 1762 1763 if ((r = sshbuf_putb(to->certblob, from->certblob)) != 0 || 1764 (r = sshbuf_putb(to->critical, from->critical)) != 0 || 1765 (r = sshbuf_putb(to->extensions, from->extensions)) != 0) 1766 goto out; 1767 1768 to->serial = from->serial; 1769 to->type = from->type; 1770 if (from->key_id == NULL) 1771 to->key_id = NULL; 1772 else if ((to->key_id = strdup(from->key_id)) == NULL) { 1773 r = SSH_ERR_ALLOC_FAIL; 1774 goto out; 1775 } 1776 to->valid_after = from->valid_after; 1777 to->valid_before = from->valid_before; 1778 if (from->signature_key == NULL) 1779 to->signature_key = NULL; 1780 else if ((r = sshkey_from_private(from->signature_key, 1781 &to->signature_key)) != 0) 1782 goto out; 1783 if (from->signature_type != NULL && 1784 (to->signature_type = strdup(from->signature_type)) == NULL) { 1785 r = SSH_ERR_ALLOC_FAIL; 1786 goto out; 1787 } 1788 if (from->nprincipals > SSHKEY_CERT_MAX_PRINCIPALS) { 1789 r = SSH_ERR_INVALID_ARGUMENT; 1790 goto out; 1791 } 1792 if (from->nprincipals > 0) { 1793 if ((to->principals = calloc(from->nprincipals, 1794 sizeof(*to->principals))) == NULL) { 1795 r = SSH_ERR_ALLOC_FAIL; 1796 goto out; 1797 } 1798 for (i = 0; i < from->nprincipals; i++) { 1799 to->principals[i] = strdup(from->principals[i]); 1800 if (to->principals[i] == NULL) { 1801 to->nprincipals = i; 1802 r = SSH_ERR_ALLOC_FAIL; 1803 goto out; 1804 } 1805 } 1806 } 1807 to->nprincipals = from->nprincipals; 1808 1809 /* success */ 1810 cert_free(to_key->cert); 1811 to_key->cert = to; 1812 to = NULL; 1813 r = 0; 1814 out: 1815 cert_free(to); 1816 return r; 1817 } 1818 1819 int 1820 sshkey_from_private(const struct sshkey *k, struct sshkey **pkp) 1821 { 1822 struct sshkey *n = NULL; 1823 int r = SSH_ERR_INTERNAL_ERROR; 1824 #ifdef WITH_OPENSSL 1825 const BIGNUM *rsa_n, *rsa_e; 1826 BIGNUM *rsa_n_dup = NULL, *rsa_e_dup = NULL; 1827 const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key; 1828 BIGNUM *dsa_p_dup = NULL, *dsa_q_dup = NULL, *dsa_g_dup = NULL; 1829 BIGNUM *dsa_pub_key_dup = NULL; 1830 #endif /* WITH_OPENSSL */ 1831 1832 *pkp = NULL; 1833 if ((n = sshkey_new(k->type)) == NULL) { 1834 r = SSH_ERR_ALLOC_FAIL; 1835 goto out; 1836 } 1837 switch (k->type) { 1838 #ifdef WITH_OPENSSL 1839 case KEY_DSA: 1840 case KEY_DSA_CERT: 1841 DSA_get0_pqg(k->dsa, &dsa_p, &dsa_q, &dsa_g); 1842 DSA_get0_key(k->dsa, &dsa_pub_key, NULL); 1843 if ((dsa_p_dup = BN_dup(dsa_p)) == NULL || 1844 (dsa_q_dup = BN_dup(dsa_q)) == NULL || 1845 (dsa_g_dup = BN_dup(dsa_g)) == NULL || 1846 (dsa_pub_key_dup = BN_dup(dsa_pub_key)) == NULL) { 1847 r = SSH_ERR_ALLOC_FAIL; 1848 goto out; 1849 } 1850 if (!DSA_set0_pqg(n->dsa, dsa_p_dup, dsa_q_dup, dsa_g_dup)) { 1851 r = SSH_ERR_LIBCRYPTO_ERROR; 1852 goto out; 1853 } 1854 dsa_p_dup = dsa_q_dup = dsa_g_dup = NULL; /* transferred */ 1855 if (!DSA_set0_key(n->dsa, dsa_pub_key_dup, NULL)) { 1856 r = SSH_ERR_LIBCRYPTO_ERROR; 1857 goto out; 1858 } 1859 dsa_pub_key_dup = NULL; /* transferred */ 1860 1861 break; 1862 case KEY_ECDSA: 1863 case KEY_ECDSA_CERT: 1864 case KEY_ECDSA_SK: 1865 case KEY_ECDSA_SK_CERT: 1866 n->ecdsa_nid = k->ecdsa_nid; 1867 n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 1868 if (n->ecdsa == NULL) { 1869 r = SSH_ERR_ALLOC_FAIL; 1870 goto out; 1871 } 1872 if (EC_KEY_set_public_key(n->ecdsa, 1873 EC_KEY_get0_public_key(k->ecdsa)) != 1) { 1874 r = SSH_ERR_LIBCRYPTO_ERROR; 1875 goto out; 1876 } 1877 if (k->type != KEY_ECDSA_SK && k->type != KEY_ECDSA_SK_CERT) 1878 break; 1879 /* Append security-key application string */ 1880 if ((n->sk_application = strdup(k->sk_application)) == NULL) 1881 goto out; 1882 break; 1883 case KEY_RSA: 1884 case KEY_RSA_CERT: 1885 RSA_get0_key(k->rsa, &rsa_n, &rsa_e, NULL); 1886 if ((rsa_n_dup = BN_dup(rsa_n)) == NULL || 1887 (rsa_e_dup = BN_dup(rsa_e)) == NULL) { 1888 r = SSH_ERR_ALLOC_FAIL; 1889 goto out; 1890 } 1891 if (!RSA_set0_key(n->rsa, rsa_n_dup, rsa_e_dup, NULL)) { 1892 r = SSH_ERR_LIBCRYPTO_ERROR; 1893 goto out; 1894 } 1895 rsa_n_dup = rsa_e_dup = NULL; /* transferred */ 1896 break; 1897 #endif /* WITH_OPENSSL */ 1898 case KEY_ED25519: 1899 case KEY_ED25519_CERT: 1900 case KEY_ED25519_SK: 1901 case KEY_ED25519_SK_CERT: 1902 if (k->ed25519_pk != NULL) { 1903 if ((n->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) { 1904 r = SSH_ERR_ALLOC_FAIL; 1905 goto out; 1906 } 1907 memcpy(n->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ); 1908 } 1909 if (k->type != KEY_ED25519_SK && 1910 k->type != KEY_ED25519_SK_CERT) 1911 break; 1912 /* Append security-key application string */ 1913 if ((n->sk_application = strdup(k->sk_application)) == NULL) 1914 goto out; 1915 break; 1916 #ifdef WITH_XMSS 1917 case KEY_XMSS: 1918 case KEY_XMSS_CERT: 1919 if ((r = sshkey_xmss_init(n, k->xmss_name)) != 0) 1920 goto out; 1921 if (k->xmss_pk != NULL) { 1922 u_int32_t left; 1923 size_t pklen = sshkey_xmss_pklen(k); 1924 if (pklen == 0 || sshkey_xmss_pklen(n) != pklen) { 1925 r = SSH_ERR_INTERNAL_ERROR; 1926 goto out; 1927 } 1928 if ((n->xmss_pk = malloc(pklen)) == NULL) { 1929 r = SSH_ERR_ALLOC_FAIL; 1930 goto out; 1931 } 1932 memcpy(n->xmss_pk, k->xmss_pk, pklen); 1933 /* simulate number of signatures left on pubkey */ 1934 left = sshkey_xmss_signatures_left(k); 1935 if (left) 1936 sshkey_xmss_enable_maxsign(n, left); 1937 } 1938 break; 1939 #endif /* WITH_XMSS */ 1940 default: 1941 r = SSH_ERR_KEY_TYPE_UNKNOWN; 1942 goto out; 1943 } 1944 if (sshkey_is_cert(k) && (r = sshkey_cert_copy(k, n)) != 0) 1945 goto out; 1946 /* success */ 1947 *pkp = n; 1948 n = NULL; 1949 r = 0; 1950 out: 1951 sshkey_free(n); 1952 #ifdef WITH_OPENSSL 1953 BN_clear_free(rsa_n_dup); 1954 BN_clear_free(rsa_e_dup); 1955 BN_clear_free(dsa_p_dup); 1956 BN_clear_free(dsa_q_dup); 1957 BN_clear_free(dsa_g_dup); 1958 BN_clear_free(dsa_pub_key_dup); 1959 #endif /* WITH_OPENSSL */ 1960 1961 return r; 1962 } 1963 1964 int 1965 sshkey_is_shielded(struct sshkey *k) 1966 { 1967 return k != NULL && k->shielded_private != NULL; 1968 } 1969 1970 int 1971 sshkey_shield_private(struct sshkey *k) 1972 { 1973 struct sshbuf *prvbuf = NULL; 1974 u_char *prekey = NULL, *enc = NULL, keyiv[SSH_DIGEST_MAX_LENGTH]; 1975 struct sshcipher_ctx *cctx = NULL; 1976 const struct sshcipher *cipher; 1977 size_t i, enclen = 0; 1978 struct sshkey *kswap = NULL, tmp; 1979 int r = SSH_ERR_INTERNAL_ERROR; 1980 1981 #ifdef DEBUG_PK 1982 fprintf(stderr, "%s: entering for %s\n", __func__, sshkey_ssh_name(k)); 1983 #endif 1984 if ((cipher = cipher_by_name(SSHKEY_SHIELD_CIPHER)) == NULL) { 1985 r = SSH_ERR_INVALID_ARGUMENT; 1986 goto out; 1987 } 1988 if (cipher_keylen(cipher) + cipher_ivlen(cipher) > 1989 ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH)) { 1990 r = SSH_ERR_INTERNAL_ERROR; 1991 goto out; 1992 } 1993 1994 /* Prepare a random pre-key, and from it an ephemeral key */ 1995 if ((prekey = malloc(SSHKEY_SHIELD_PREKEY_LEN)) == NULL) { 1996 r = SSH_ERR_ALLOC_FAIL; 1997 goto out; 1998 } 1999 arc4random_buf(prekey, SSHKEY_SHIELD_PREKEY_LEN); 2000 if ((r = ssh_digest_memory(SSHKEY_SHIELD_PREKEY_HASH, 2001 prekey, SSHKEY_SHIELD_PREKEY_LEN, 2002 keyiv, SSH_DIGEST_MAX_LENGTH)) != 0) 2003 goto out; 2004 #ifdef DEBUG_PK 2005 fprintf(stderr, "%s: key+iv\n", __func__); 2006 sshbuf_dump_data(keyiv, ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH), 2007 stderr); 2008 #endif 2009 if ((r = cipher_init(&cctx, cipher, keyiv, cipher_keylen(cipher), 2010 keyiv + cipher_keylen(cipher), cipher_ivlen(cipher), 1)) != 0) 2011 goto out; 2012 2013 /* Serialise and encrypt the private key using the ephemeral key */ 2014 if ((prvbuf = sshbuf_new()) == NULL) { 2015 r = SSH_ERR_ALLOC_FAIL; 2016 goto out; 2017 } 2018 if (sshkey_is_shielded(k) && (r = sshkey_unshield_private(k)) != 0) 2019 goto out; 2020 if ((r = sshkey_private_serialize_opt(k, prvbuf, 2021 SSHKEY_SERIALIZE_SHIELD)) != 0) 2022 goto out; 2023 /* pad to cipher blocksize */ 2024 i = 0; 2025 while (sshbuf_len(prvbuf) % cipher_blocksize(cipher)) { 2026 if ((r = sshbuf_put_u8(prvbuf, ++i & 0xff)) != 0) 2027 goto out; 2028 } 2029 #ifdef DEBUG_PK 2030 fprintf(stderr, "%s: serialised\n", __func__); 2031 sshbuf_dump(prvbuf, stderr); 2032 #endif 2033 /* encrypt */ 2034 enclen = sshbuf_len(prvbuf); 2035 if ((enc = malloc(enclen)) == NULL) { 2036 r = SSH_ERR_ALLOC_FAIL; 2037 goto out; 2038 } 2039 if ((r = cipher_crypt(cctx, 0, enc, 2040 sshbuf_ptr(prvbuf), sshbuf_len(prvbuf), 0, 0)) != 0) 2041 goto out; 2042 #ifdef DEBUG_PK 2043 fprintf(stderr, "%s: encrypted\n", __func__); 2044 sshbuf_dump_data(enc, enclen, stderr); 2045 #endif 2046 2047 /* Make a scrubbed, public-only copy of our private key argument */ 2048 if ((r = sshkey_from_private(k, &kswap)) != 0) 2049 goto out; 2050 2051 /* Swap the private key out (it will be destroyed below) */ 2052 tmp = *kswap; 2053 *kswap = *k; 2054 *k = tmp; 2055 2056 /* Insert the shielded key into our argument */ 2057 k->shielded_private = enc; 2058 k->shielded_len = enclen; 2059 k->shield_prekey = prekey; 2060 k->shield_prekey_len = SSHKEY_SHIELD_PREKEY_LEN; 2061 enc = prekey = NULL; /* transferred */ 2062 enclen = 0; 2063 2064 /* preserve key fields that are required for correct operation */ 2065 k->sk_flags = kswap->sk_flags; 2066 2067 /* success */ 2068 r = 0; 2069 2070 out: 2071 /* XXX behaviour on error - invalidate original private key? */ 2072 cipher_free(cctx); 2073 explicit_bzero(keyiv, sizeof(keyiv)); 2074 explicit_bzero(&tmp, sizeof(tmp)); 2075 freezero(enc, enclen); 2076 freezero(prekey, SSHKEY_SHIELD_PREKEY_LEN); 2077 sshkey_free(kswap); 2078 sshbuf_free(prvbuf); 2079 return r; 2080 } 2081 2082 /* Check deterministic padding after private key */ 2083 static int 2084 private2_check_padding(struct sshbuf *decrypted) 2085 { 2086 u_char pad; 2087 size_t i; 2088 int r; 2089 2090 i = 0; 2091 while (sshbuf_len(decrypted)) { 2092 if ((r = sshbuf_get_u8(decrypted, &pad)) != 0) 2093 goto out; 2094 if (pad != (++i & 0xff)) { 2095 r = SSH_ERR_INVALID_FORMAT; 2096 goto out; 2097 } 2098 } 2099 /* success */ 2100 r = 0; 2101 out: 2102 explicit_bzero(&pad, sizeof(pad)); 2103 explicit_bzero(&i, sizeof(i)); 2104 return r; 2105 } 2106 2107 int 2108 sshkey_unshield_private(struct sshkey *k) 2109 { 2110 struct sshbuf *prvbuf = NULL; 2111 u_char *cp, keyiv[SSH_DIGEST_MAX_LENGTH]; 2112 struct sshcipher_ctx *cctx = NULL; 2113 const struct sshcipher *cipher; 2114 struct sshkey *kswap = NULL, tmp; 2115 int r = SSH_ERR_INTERNAL_ERROR; 2116 2117 #ifdef DEBUG_PK 2118 fprintf(stderr, "%s: entering for %s\n", __func__, sshkey_ssh_name(k)); 2119 #endif 2120 if (!sshkey_is_shielded(k)) 2121 return 0; /* nothing to do */ 2122 2123 if ((cipher = cipher_by_name(SSHKEY_SHIELD_CIPHER)) == NULL) { 2124 r = SSH_ERR_INVALID_ARGUMENT; 2125 goto out; 2126 } 2127 if (cipher_keylen(cipher) + cipher_ivlen(cipher) > 2128 ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH)) { 2129 r = SSH_ERR_INTERNAL_ERROR; 2130 goto out; 2131 } 2132 /* check size of shielded key blob */ 2133 if (k->shielded_len < cipher_blocksize(cipher) || 2134 (k->shielded_len % cipher_blocksize(cipher)) != 0) { 2135 r = SSH_ERR_INVALID_FORMAT; 2136 goto out; 2137 } 2138 2139 /* Calculate the ephemeral key from the prekey */ 2140 if ((r = ssh_digest_memory(SSHKEY_SHIELD_PREKEY_HASH, 2141 k->shield_prekey, k->shield_prekey_len, 2142 keyiv, SSH_DIGEST_MAX_LENGTH)) != 0) 2143 goto out; 2144 if ((r = cipher_init(&cctx, cipher, keyiv, cipher_keylen(cipher), 2145 keyiv + cipher_keylen(cipher), cipher_ivlen(cipher), 0)) != 0) 2146 goto out; 2147 #ifdef DEBUG_PK 2148 fprintf(stderr, "%s: key+iv\n", __func__); 2149 sshbuf_dump_data(keyiv, ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH), 2150 stderr); 2151 #endif 2152 2153 /* Decrypt and parse the shielded private key using the ephemeral key */ 2154 if ((prvbuf = sshbuf_new()) == NULL) { 2155 r = SSH_ERR_ALLOC_FAIL; 2156 goto out; 2157 } 2158 if ((r = sshbuf_reserve(prvbuf, k->shielded_len, &cp)) != 0) 2159 goto out; 2160 /* decrypt */ 2161 #ifdef DEBUG_PK 2162 fprintf(stderr, "%s: encrypted\n", __func__); 2163 sshbuf_dump_data(k->shielded_private, k->shielded_len, stderr); 2164 #endif 2165 if ((r = cipher_crypt(cctx, 0, cp, 2166 k->shielded_private, k->shielded_len, 0, 0)) != 0) 2167 goto out; 2168 #ifdef DEBUG_PK 2169 fprintf(stderr, "%s: serialised\n", __func__); 2170 sshbuf_dump(prvbuf, stderr); 2171 #endif 2172 /* Parse private key */ 2173 if ((r = sshkey_private_deserialize(prvbuf, &kswap)) != 0) 2174 goto out; 2175 2176 if ((r = private2_check_padding(prvbuf)) != 0) 2177 goto out; 2178 2179 /* Swap the parsed key back into place */ 2180 tmp = *kswap; 2181 *kswap = *k; 2182 *k = tmp; 2183 2184 /* success */ 2185 r = 0; 2186 2187 out: 2188 cipher_free(cctx); 2189 explicit_bzero(keyiv, sizeof(keyiv)); 2190 explicit_bzero(&tmp, sizeof(tmp)); 2191 sshkey_free(kswap); 2192 sshbuf_free(prvbuf); 2193 return r; 2194 } 2195 2196 static int 2197 cert_parse(struct sshbuf *b, struct sshkey *key, struct sshbuf *certbuf) 2198 { 2199 struct sshbuf *principals = NULL, *crit = NULL; 2200 struct sshbuf *exts = NULL, *ca = NULL; 2201 u_char *sig = NULL; 2202 size_t signed_len = 0, slen = 0, kidlen = 0; 2203 int ret = SSH_ERR_INTERNAL_ERROR; 2204 2205 /* Copy the entire key blob for verification and later serialisation */ 2206 if ((ret = sshbuf_putb(key->cert->certblob, certbuf)) != 0) 2207 return ret; 2208 2209 /* Parse body of certificate up to signature */ 2210 if ((ret = sshbuf_get_u64(b, &key->cert->serial)) != 0 || 2211 (ret = sshbuf_get_u32(b, &key->cert->type)) != 0 || 2212 (ret = sshbuf_get_cstring(b, &key->cert->key_id, &kidlen)) != 0 || 2213 (ret = sshbuf_froms(b, &principals)) != 0 || 2214 (ret = sshbuf_get_u64(b, &key->cert->valid_after)) != 0 || 2215 (ret = sshbuf_get_u64(b, &key->cert->valid_before)) != 0 || 2216 (ret = sshbuf_froms(b, &crit)) != 0 || 2217 (ret = sshbuf_froms(b, &exts)) != 0 || 2218 (ret = sshbuf_get_string_direct(b, NULL, NULL)) != 0 || 2219 (ret = sshbuf_froms(b, &ca)) != 0) { 2220 /* XXX debug print error for ret */ 2221 ret = SSH_ERR_INVALID_FORMAT; 2222 goto out; 2223 } 2224 2225 /* Signature is left in the buffer so we can calculate this length */ 2226 signed_len = sshbuf_len(key->cert->certblob) - sshbuf_len(b); 2227 2228 if ((ret = sshbuf_get_string(b, &sig, &slen)) != 0) { 2229 ret = SSH_ERR_INVALID_FORMAT; 2230 goto out; 2231 } 2232 2233 if (key->cert->type != SSH2_CERT_TYPE_USER && 2234 key->cert->type != SSH2_CERT_TYPE_HOST) { 2235 ret = SSH_ERR_KEY_CERT_UNKNOWN_TYPE; 2236 goto out; 2237 } 2238 2239 /* Parse principals section */ 2240 while (sshbuf_len(principals) > 0) { 2241 char *principal = NULL; 2242 char **oprincipals = NULL; 2243 2244 if (key->cert->nprincipals >= SSHKEY_CERT_MAX_PRINCIPALS) { 2245 ret = SSH_ERR_INVALID_FORMAT; 2246 goto out; 2247 } 2248 if ((ret = sshbuf_get_cstring(principals, &principal, 2249 NULL)) != 0) { 2250 ret = SSH_ERR_INVALID_FORMAT; 2251 goto out; 2252 } 2253 oprincipals = key->cert->principals; 2254 key->cert->principals = recallocarray(key->cert->principals, 2255 key->cert->nprincipals, key->cert->nprincipals + 1, 2256 sizeof(*key->cert->principals)); 2257 if (key->cert->principals == NULL) { 2258 free(principal); 2259 key->cert->principals = oprincipals; 2260 ret = SSH_ERR_ALLOC_FAIL; 2261 goto out; 2262 } 2263 key->cert->principals[key->cert->nprincipals++] = principal; 2264 } 2265 2266 /* 2267 * Stash a copies of the critical options and extensions sections 2268 * for later use. 2269 */ 2270 if ((ret = sshbuf_putb(key->cert->critical, crit)) != 0 || 2271 (exts != NULL && 2272 (ret = sshbuf_putb(key->cert->extensions, exts)) != 0)) 2273 goto out; 2274 2275 /* 2276 * Validate critical options and extensions sections format. 2277 */ 2278 while (sshbuf_len(crit) != 0) { 2279 if ((ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0 || 2280 (ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0) { 2281 sshbuf_reset(key->cert->critical); 2282 ret = SSH_ERR_INVALID_FORMAT; 2283 goto out; 2284 } 2285 } 2286 while (exts != NULL && sshbuf_len(exts) != 0) { 2287 if ((ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0 || 2288 (ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0) { 2289 sshbuf_reset(key->cert->extensions); 2290 ret = SSH_ERR_INVALID_FORMAT; 2291 goto out; 2292 } 2293 } 2294 2295 /* Parse CA key and check signature */ 2296 if (sshkey_from_blob_internal(ca, &key->cert->signature_key, 0) != 0) { 2297 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2298 goto out; 2299 } 2300 if (!sshkey_type_is_valid_ca(key->cert->signature_key->type)) { 2301 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2302 goto out; 2303 } 2304 if ((ret = sshkey_verify(key->cert->signature_key, sig, slen, 2305 sshbuf_ptr(key->cert->certblob), signed_len, NULL, 0, NULL)) != 0) 2306 goto out; 2307 if ((ret = sshkey_get_sigtype(sig, slen, 2308 &key->cert->signature_type)) != 0) 2309 goto out; 2310 2311 /* Success */ 2312 ret = 0; 2313 out: 2314 sshbuf_free(ca); 2315 sshbuf_free(crit); 2316 sshbuf_free(exts); 2317 sshbuf_free(principals); 2318 free(sig); 2319 return ret; 2320 } 2321 2322 int 2323 sshkey_check_rsa_length(const struct sshkey *k, int min_size) 2324 { 2325 #ifdef WITH_OPENSSL 2326 const BIGNUM *rsa_n; 2327 int nbits; 2328 2329 if (k == NULL || k->rsa == NULL || 2330 (k->type != KEY_RSA && k->type != KEY_RSA_CERT)) 2331 return 0; 2332 RSA_get0_key(k->rsa, &rsa_n, NULL, NULL); 2333 nbits = BN_num_bits(rsa_n); 2334 if (nbits < SSH_RSA_MINIMUM_MODULUS_SIZE || 2335 (min_size > 0 && nbits < min_size)) 2336 return SSH_ERR_KEY_LENGTH; 2337 #endif /* WITH_OPENSSL */ 2338 return 0; 2339 } 2340 2341 static int 2342 sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp, 2343 int allow_cert) 2344 { 2345 int type, ret = SSH_ERR_INTERNAL_ERROR; 2346 char *ktype = NULL, *curve = NULL, *xmss_name = NULL; 2347 struct sshkey *key = NULL; 2348 size_t len; 2349 u_char *pk = NULL; 2350 struct sshbuf *copy; 2351 #ifdef WITH_OPENSSL 2352 EC_POINT *q = NULL; 2353 BIGNUM *rsa_n = NULL, *rsa_e = NULL; 2354 BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL, *dsa_pub_key = NULL; 2355 #endif /* WITH_OPENSSL */ 2356 2357 #ifdef DEBUG_PK /* XXX */ 2358 sshbuf_dump(b, stderr); 2359 #endif 2360 if (keyp != NULL) 2361 *keyp = NULL; 2362 if ((copy = sshbuf_fromb(b)) == NULL) { 2363 ret = SSH_ERR_ALLOC_FAIL; 2364 goto out; 2365 } 2366 if (sshbuf_get_cstring(b, &ktype, NULL) != 0) { 2367 ret = SSH_ERR_INVALID_FORMAT; 2368 goto out; 2369 } 2370 2371 type = sshkey_type_from_name(ktype); 2372 if (!allow_cert && sshkey_type_is_cert(type)) { 2373 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2374 goto out; 2375 } 2376 switch (type) { 2377 #ifdef WITH_OPENSSL 2378 case KEY_RSA_CERT: 2379 /* Skip nonce */ 2380 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2381 ret = SSH_ERR_INVALID_FORMAT; 2382 goto out; 2383 } 2384 /* FALLTHROUGH */ 2385 case KEY_RSA: 2386 if ((key = sshkey_new(type)) == NULL) { 2387 ret = SSH_ERR_ALLOC_FAIL; 2388 goto out; 2389 } 2390 if (sshbuf_get_bignum2(b, &rsa_e) != 0 || 2391 sshbuf_get_bignum2(b, &rsa_n) != 0) { 2392 ret = SSH_ERR_INVALID_FORMAT; 2393 goto out; 2394 } 2395 if (!RSA_set0_key(key->rsa, rsa_n, rsa_e, NULL)) { 2396 ret = SSH_ERR_LIBCRYPTO_ERROR; 2397 goto out; 2398 } 2399 rsa_n = rsa_e = NULL; /* transferred */ 2400 if ((ret = sshkey_check_rsa_length(key, 0)) != 0) 2401 goto out; 2402 #ifdef DEBUG_PK 2403 RSA_print_fp(stderr, key->rsa, 8); 2404 #endif 2405 break; 2406 case KEY_DSA_CERT: 2407 /* Skip nonce */ 2408 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2409 ret = SSH_ERR_INVALID_FORMAT; 2410 goto out; 2411 } 2412 /* FALLTHROUGH */ 2413 case KEY_DSA: 2414 if ((key = sshkey_new(type)) == NULL) { 2415 ret = SSH_ERR_ALLOC_FAIL; 2416 goto out; 2417 } 2418 if (sshbuf_get_bignum2(b, &dsa_p) != 0 || 2419 sshbuf_get_bignum2(b, &dsa_q) != 0 || 2420 sshbuf_get_bignum2(b, &dsa_g) != 0 || 2421 sshbuf_get_bignum2(b, &dsa_pub_key) != 0) { 2422 ret = SSH_ERR_INVALID_FORMAT; 2423 goto out; 2424 } 2425 if (!DSA_set0_pqg(key->dsa, dsa_p, dsa_q, dsa_g)) { 2426 ret = SSH_ERR_LIBCRYPTO_ERROR; 2427 goto out; 2428 } 2429 dsa_p = dsa_q = dsa_g = NULL; /* transferred */ 2430 if (!DSA_set0_key(key->dsa, dsa_pub_key, NULL)) { 2431 ret = SSH_ERR_LIBCRYPTO_ERROR; 2432 goto out; 2433 } 2434 dsa_pub_key = NULL; /* transferred */ 2435 #ifdef DEBUG_PK 2436 DSA_print_fp(stderr, key->dsa, 8); 2437 #endif 2438 break; 2439 case KEY_ECDSA_CERT: 2440 case KEY_ECDSA_SK_CERT: 2441 /* Skip nonce */ 2442 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2443 ret = SSH_ERR_INVALID_FORMAT; 2444 goto out; 2445 } 2446 /* FALLTHROUGH */ 2447 case KEY_ECDSA: 2448 case KEY_ECDSA_SK: 2449 if ((key = sshkey_new(type)) == NULL) { 2450 ret = SSH_ERR_ALLOC_FAIL; 2451 goto out; 2452 } 2453 key->ecdsa_nid = sshkey_ecdsa_nid_from_name(ktype); 2454 if (sshbuf_get_cstring(b, &curve, NULL) != 0) { 2455 ret = SSH_ERR_INVALID_FORMAT; 2456 goto out; 2457 } 2458 if (key->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 2459 ret = SSH_ERR_EC_CURVE_MISMATCH; 2460 goto out; 2461 } 2462 EC_KEY_free(key->ecdsa); 2463 if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid)) 2464 == NULL) { 2465 ret = SSH_ERR_EC_CURVE_INVALID; 2466 goto out; 2467 } 2468 if ((q = EC_POINT_new(EC_KEY_get0_group(key->ecdsa))) == NULL) { 2469 ret = SSH_ERR_ALLOC_FAIL; 2470 goto out; 2471 } 2472 if (sshbuf_get_ec(b, q, EC_KEY_get0_group(key->ecdsa)) != 0) { 2473 ret = SSH_ERR_INVALID_FORMAT; 2474 goto out; 2475 } 2476 if (sshkey_ec_validate_public(EC_KEY_get0_group(key->ecdsa), 2477 q) != 0) { 2478 ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2479 goto out; 2480 } 2481 if (EC_KEY_set_public_key(key->ecdsa, q) != 1) { 2482 /* XXX assume it is a allocation error */ 2483 ret = SSH_ERR_ALLOC_FAIL; 2484 goto out; 2485 } 2486 #ifdef DEBUG_PK 2487 sshkey_dump_ec_point(EC_KEY_get0_group(key->ecdsa), q); 2488 #endif 2489 if (type == KEY_ECDSA_SK || type == KEY_ECDSA_SK_CERT) { 2490 /* Parse additional security-key application string */ 2491 if (sshbuf_get_cstring(b, &key->sk_application, 2492 NULL) != 0) { 2493 ret = SSH_ERR_INVALID_FORMAT; 2494 goto out; 2495 } 2496 #ifdef DEBUG_PK 2497 fprintf(stderr, "App: %s\n", key->sk_application); 2498 #endif 2499 } 2500 break; 2501 #endif /* WITH_OPENSSL */ 2502 case KEY_ED25519_CERT: 2503 case KEY_ED25519_SK_CERT: 2504 /* Skip nonce */ 2505 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2506 ret = SSH_ERR_INVALID_FORMAT; 2507 goto out; 2508 } 2509 /* FALLTHROUGH */ 2510 case KEY_ED25519: 2511 case KEY_ED25519_SK: 2512 if ((ret = sshbuf_get_string(b, &pk, &len)) != 0) 2513 goto out; 2514 if (len != ED25519_PK_SZ) { 2515 ret = SSH_ERR_INVALID_FORMAT; 2516 goto out; 2517 } 2518 if ((key = sshkey_new(type)) == NULL) { 2519 ret = SSH_ERR_ALLOC_FAIL; 2520 goto out; 2521 } 2522 if (type == KEY_ED25519_SK || type == KEY_ED25519_SK_CERT) { 2523 /* Parse additional security-key application string */ 2524 if (sshbuf_get_cstring(b, &key->sk_application, 2525 NULL) != 0) { 2526 ret = SSH_ERR_INVALID_FORMAT; 2527 goto out; 2528 } 2529 #ifdef DEBUG_PK 2530 fprintf(stderr, "App: %s\n", key->sk_application); 2531 #endif 2532 } 2533 key->ed25519_pk = pk; 2534 pk = NULL; 2535 break; 2536 #ifdef WITH_XMSS 2537 case KEY_XMSS_CERT: 2538 /* Skip nonce */ 2539 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2540 ret = SSH_ERR_INVALID_FORMAT; 2541 goto out; 2542 } 2543 /* FALLTHROUGH */ 2544 case KEY_XMSS: 2545 if ((ret = sshbuf_get_cstring(b, &xmss_name, NULL)) != 0) 2546 goto out; 2547 if ((key = sshkey_new(type)) == NULL) { 2548 ret = SSH_ERR_ALLOC_FAIL; 2549 goto out; 2550 } 2551 if ((ret = sshkey_xmss_init(key, xmss_name)) != 0) 2552 goto out; 2553 if ((ret = sshbuf_get_string(b, &pk, &len)) != 0) 2554 goto out; 2555 if (len == 0 || len != sshkey_xmss_pklen(key)) { 2556 ret = SSH_ERR_INVALID_FORMAT; 2557 goto out; 2558 } 2559 key->xmss_pk = pk; 2560 pk = NULL; 2561 if (type != KEY_XMSS_CERT && 2562 (ret = sshkey_xmss_deserialize_pk_info(key, b)) != 0) 2563 goto out; 2564 break; 2565 #endif /* WITH_XMSS */ 2566 case KEY_UNSPEC: 2567 default: 2568 ret = SSH_ERR_KEY_TYPE_UNKNOWN; 2569 goto out; 2570 } 2571 2572 /* Parse certificate potion */ 2573 if (sshkey_is_cert(key) && (ret = cert_parse(b, key, copy)) != 0) 2574 goto out; 2575 2576 if (key != NULL && sshbuf_len(b) != 0) { 2577 ret = SSH_ERR_INVALID_FORMAT; 2578 goto out; 2579 } 2580 ret = 0; 2581 if (keyp != NULL) { 2582 *keyp = key; 2583 key = NULL; 2584 } 2585 out: 2586 sshbuf_free(copy); 2587 sshkey_free(key); 2588 free(xmss_name); 2589 free(ktype); 2590 free(curve); 2591 free(pk); 2592 #ifdef WITH_OPENSSL 2593 EC_POINT_free(q); 2594 BN_clear_free(rsa_n); 2595 BN_clear_free(rsa_e); 2596 BN_clear_free(dsa_p); 2597 BN_clear_free(dsa_q); 2598 BN_clear_free(dsa_g); 2599 BN_clear_free(dsa_pub_key); 2600 #endif /* WITH_OPENSSL */ 2601 return ret; 2602 } 2603 2604 int 2605 sshkey_from_blob(const u_char *blob, size_t blen, struct sshkey **keyp) 2606 { 2607 struct sshbuf *b; 2608 int r; 2609 2610 if ((b = sshbuf_from(blob, blen)) == NULL) 2611 return SSH_ERR_ALLOC_FAIL; 2612 r = sshkey_from_blob_internal(b, keyp, 1); 2613 sshbuf_free(b); 2614 return r; 2615 } 2616 2617 int 2618 sshkey_fromb(struct sshbuf *b, struct sshkey **keyp) 2619 { 2620 return sshkey_from_blob_internal(b, keyp, 1); 2621 } 2622 2623 int 2624 sshkey_froms(struct sshbuf *buf, struct sshkey **keyp) 2625 { 2626 struct sshbuf *b; 2627 int r; 2628 2629 if ((r = sshbuf_froms(buf, &b)) != 0) 2630 return r; 2631 r = sshkey_from_blob_internal(b, keyp, 1); 2632 sshbuf_free(b); 2633 return r; 2634 } 2635 2636 int 2637 sshkey_get_sigtype(const u_char *sig, size_t siglen, char **sigtypep) 2638 { 2639 int r; 2640 struct sshbuf *b = NULL; 2641 char *sigtype = NULL; 2642 2643 if (sigtypep != NULL) 2644 *sigtypep = NULL; 2645 if ((b = sshbuf_from(sig, siglen)) == NULL) 2646 return SSH_ERR_ALLOC_FAIL; 2647 if ((r = sshbuf_get_cstring(b, &sigtype, NULL)) != 0) 2648 goto out; 2649 /* success */ 2650 if (sigtypep != NULL) { 2651 *sigtypep = sigtype; 2652 sigtype = NULL; 2653 } 2654 r = 0; 2655 out: 2656 free(sigtype); 2657 sshbuf_free(b); 2658 return r; 2659 } 2660 2661 /* 2662 * 2663 * Checks whether a certificate's signature type is allowed. 2664 * Returns 0 (success) if the certificate signature type appears in the 2665 * "allowed" pattern-list, or the key is not a certificate to begin with. 2666 * Otherwise returns a ssherr.h code. 2667 */ 2668 int 2669 sshkey_check_cert_sigtype(const struct sshkey *key, const char *allowed) 2670 { 2671 if (key == NULL || allowed == NULL) 2672 return SSH_ERR_INVALID_ARGUMENT; 2673 if (!sshkey_type_is_cert(key->type)) 2674 return 0; 2675 if (key->cert == NULL || key->cert->signature_type == NULL) 2676 return SSH_ERR_INVALID_ARGUMENT; 2677 if (match_pattern_list(key->cert->signature_type, allowed, 0) != 1) 2678 return SSH_ERR_SIGN_ALG_UNSUPPORTED; 2679 return 0; 2680 } 2681 2682 /* 2683 * Returns the expected signature algorithm for a given public key algorithm. 2684 */ 2685 const char * 2686 sshkey_sigalg_by_name(const char *name) 2687 { 2688 const struct keytype *kt; 2689 2690 for (kt = keytypes; kt->type != -1; kt++) { 2691 if (strcmp(kt->name, name) != 0) 2692 continue; 2693 if (kt->sigalg != NULL) 2694 return kt->sigalg; 2695 if (!kt->cert) 2696 return kt->name; 2697 return sshkey_ssh_name_from_type_nid( 2698 sshkey_type_plain(kt->type), kt->nid); 2699 } 2700 return NULL; 2701 } 2702 2703 /* 2704 * Verifies that the signature algorithm appearing inside the signature blob 2705 * matches that which was requested. 2706 */ 2707 int 2708 sshkey_check_sigtype(const u_char *sig, size_t siglen, 2709 const char *requested_alg) 2710 { 2711 const char *expected_alg; 2712 char *sigtype = NULL; 2713 int r; 2714 2715 if (requested_alg == NULL) 2716 return 0; 2717 if ((expected_alg = sshkey_sigalg_by_name(requested_alg)) == NULL) 2718 return SSH_ERR_INVALID_ARGUMENT; 2719 if ((r = sshkey_get_sigtype(sig, siglen, &sigtype)) != 0) 2720 return r; 2721 r = strcmp(expected_alg, sigtype) == 0; 2722 free(sigtype); 2723 return r ? 0 : SSH_ERR_SIGN_ALG_UNSUPPORTED; 2724 } 2725 2726 int 2727 sshkey_sign(struct sshkey *key, 2728 u_char **sigp, size_t *lenp, 2729 const u_char *data, size_t datalen, 2730 const char *alg, const char *sk_provider, const char *sk_pin, u_int compat) 2731 { 2732 int was_shielded = sshkey_is_shielded(key); 2733 int r2, r = SSH_ERR_INTERNAL_ERROR; 2734 2735 if (sigp != NULL) 2736 *sigp = NULL; 2737 if (lenp != NULL) 2738 *lenp = 0; 2739 if (datalen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2740 return SSH_ERR_INVALID_ARGUMENT; 2741 if ((r = sshkey_unshield_private(key)) != 0) 2742 return r; 2743 switch (key->type) { 2744 #ifdef WITH_OPENSSL 2745 case KEY_DSA_CERT: 2746 case KEY_DSA: 2747 r = ssh_dss_sign(key, sigp, lenp, data, datalen, compat); 2748 break; 2749 case KEY_ECDSA_CERT: 2750 case KEY_ECDSA: 2751 r = ssh_ecdsa_sign(key, sigp, lenp, data, datalen, compat); 2752 break; 2753 case KEY_RSA_CERT: 2754 case KEY_RSA: 2755 r = ssh_rsa_sign(key, sigp, lenp, data, datalen, alg); 2756 break; 2757 #endif /* WITH_OPENSSL */ 2758 case KEY_ED25519: 2759 case KEY_ED25519_CERT: 2760 r = ssh_ed25519_sign(key, sigp, lenp, data, datalen, compat); 2761 break; 2762 case KEY_ED25519_SK: 2763 case KEY_ED25519_SK_CERT: 2764 case KEY_ECDSA_SK_CERT: 2765 case KEY_ECDSA_SK: 2766 r = sshsk_sign(sk_provider, key, sigp, lenp, data, 2767 datalen, compat, sk_pin); 2768 break; 2769 #ifdef WITH_XMSS 2770 case KEY_XMSS: 2771 case KEY_XMSS_CERT: 2772 r = ssh_xmss_sign(key, sigp, lenp, data, datalen, compat); 2773 break; 2774 #endif /* WITH_XMSS */ 2775 default: 2776 r = SSH_ERR_KEY_TYPE_UNKNOWN; 2777 break; 2778 } 2779 if (was_shielded && (r2 = sshkey_shield_private(key)) != 0) 2780 return r2; 2781 return r; 2782 } 2783 2784 /* 2785 * ssh_key_verify returns 0 for a correct signature and < 0 on error. 2786 * If "alg" specified, then the signature must use that algorithm. 2787 */ 2788 int 2789 sshkey_verify(const struct sshkey *key, 2790 const u_char *sig, size_t siglen, 2791 const u_char *data, size_t dlen, const char *alg, u_int compat, 2792 struct sshkey_sig_details **detailsp) 2793 { 2794 if (detailsp != NULL) 2795 *detailsp = NULL; 2796 if (siglen == 0 || dlen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2797 return SSH_ERR_INVALID_ARGUMENT; 2798 switch (key->type) { 2799 #ifdef WITH_OPENSSL 2800 case KEY_DSA_CERT: 2801 case KEY_DSA: 2802 return ssh_dss_verify(key, sig, siglen, data, dlen, compat); 2803 case KEY_ECDSA_CERT: 2804 case KEY_ECDSA: 2805 return ssh_ecdsa_verify(key, sig, siglen, data, dlen, compat); 2806 case KEY_ECDSA_SK_CERT: 2807 case KEY_ECDSA_SK: 2808 return ssh_ecdsa_sk_verify(key, sig, siglen, data, dlen, 2809 compat, detailsp); 2810 case KEY_RSA_CERT: 2811 case KEY_RSA: 2812 return ssh_rsa_verify(key, sig, siglen, data, dlen, alg); 2813 #endif /* WITH_OPENSSL */ 2814 case KEY_ED25519: 2815 case KEY_ED25519_CERT: 2816 return ssh_ed25519_verify(key, sig, siglen, data, dlen, compat); 2817 case KEY_ED25519_SK: 2818 case KEY_ED25519_SK_CERT: 2819 return ssh_ed25519_sk_verify(key, sig, siglen, data, dlen, 2820 compat, detailsp); 2821 #ifdef WITH_XMSS 2822 case KEY_XMSS: 2823 case KEY_XMSS_CERT: 2824 return ssh_xmss_verify(key, sig, siglen, data, dlen, compat); 2825 #endif /* WITH_XMSS */ 2826 default: 2827 return SSH_ERR_KEY_TYPE_UNKNOWN; 2828 } 2829 } 2830 2831 /* Convert a plain key to their _CERT equivalent */ 2832 int 2833 sshkey_to_certified(struct sshkey *k) 2834 { 2835 int newtype; 2836 2837 switch (k->type) { 2838 #ifdef WITH_OPENSSL 2839 case KEY_RSA: 2840 newtype = KEY_RSA_CERT; 2841 break; 2842 case KEY_DSA: 2843 newtype = KEY_DSA_CERT; 2844 break; 2845 case KEY_ECDSA: 2846 newtype = KEY_ECDSA_CERT; 2847 break; 2848 case KEY_ECDSA_SK: 2849 newtype = KEY_ECDSA_SK_CERT; 2850 break; 2851 #endif /* WITH_OPENSSL */ 2852 case KEY_ED25519_SK: 2853 newtype = KEY_ED25519_SK_CERT; 2854 break; 2855 case KEY_ED25519: 2856 newtype = KEY_ED25519_CERT; 2857 break; 2858 #ifdef WITH_XMSS 2859 case KEY_XMSS: 2860 newtype = KEY_XMSS_CERT; 2861 break; 2862 #endif /* WITH_XMSS */ 2863 default: 2864 return SSH_ERR_INVALID_ARGUMENT; 2865 } 2866 if ((k->cert = cert_new()) == NULL) 2867 return SSH_ERR_ALLOC_FAIL; 2868 k->type = newtype; 2869 return 0; 2870 } 2871 2872 /* Convert a certificate to its raw key equivalent */ 2873 int 2874 sshkey_drop_cert(struct sshkey *k) 2875 { 2876 if (!sshkey_type_is_cert(k->type)) 2877 return SSH_ERR_KEY_TYPE_UNKNOWN; 2878 cert_free(k->cert); 2879 k->cert = NULL; 2880 k->type = sshkey_type_plain(k->type); 2881 return 0; 2882 } 2883 2884 /* Sign a certified key, (re-)generating the signed certblob. */ 2885 int 2886 sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg, 2887 const char *sk_provider, const char *sk_pin, 2888 sshkey_certify_signer *signer, void *signer_ctx) 2889 { 2890 struct sshbuf *principals = NULL; 2891 u_char *ca_blob = NULL, *sig_blob = NULL, nonce[32]; 2892 size_t i, ca_len, sig_len; 2893 int ret = SSH_ERR_INTERNAL_ERROR; 2894 struct sshbuf *cert = NULL; 2895 char *sigtype = NULL; 2896 #ifdef WITH_OPENSSL 2897 const BIGNUM *rsa_n, *rsa_e, *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key; 2898 #endif /* WITH_OPENSSL */ 2899 2900 if (k == NULL || k->cert == NULL || 2901 k->cert->certblob == NULL || ca == NULL) 2902 return SSH_ERR_INVALID_ARGUMENT; 2903 if (!sshkey_is_cert(k)) 2904 return SSH_ERR_KEY_TYPE_UNKNOWN; 2905 if (!sshkey_type_is_valid_ca(ca->type)) 2906 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2907 2908 /* 2909 * If no alg specified as argument but a signature_type was set, 2910 * then prefer that. If both were specified, then they must match. 2911 */ 2912 if (alg == NULL) 2913 alg = k->cert->signature_type; 2914 else if (k->cert->signature_type != NULL && 2915 strcmp(alg, k->cert->signature_type) != 0) 2916 return SSH_ERR_INVALID_ARGUMENT; 2917 2918 /* 2919 * If no signing algorithm or signature_type was specified and we're 2920 * using a RSA key, then default to a good signature algorithm. 2921 */ 2922 if (alg == NULL && ca->type == KEY_RSA) 2923 alg = "rsa-sha2-512"; 2924 2925 if ((ret = sshkey_to_blob(ca, &ca_blob, &ca_len)) != 0) 2926 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2927 2928 cert = k->cert->certblob; /* for readability */ 2929 sshbuf_reset(cert); 2930 if ((ret = sshbuf_put_cstring(cert, sshkey_ssh_name(k))) != 0) 2931 goto out; 2932 2933 /* -v01 certs put nonce first */ 2934 arc4random_buf(&nonce, sizeof(nonce)); 2935 if ((ret = sshbuf_put_string(cert, nonce, sizeof(nonce))) != 0) 2936 goto out; 2937 2938 /* XXX this substantially duplicates to_blob(); refactor */ 2939 switch (k->type) { 2940 #ifdef WITH_OPENSSL 2941 case KEY_DSA_CERT: 2942 DSA_get0_pqg(k->dsa, &dsa_p, &dsa_q, &dsa_g); 2943 DSA_get0_key(k->dsa, &dsa_pub_key, NULL); 2944 if ((ret = sshbuf_put_bignum2(cert, dsa_p)) != 0 || 2945 (ret = sshbuf_put_bignum2(cert, dsa_q)) != 0 || 2946 (ret = sshbuf_put_bignum2(cert, dsa_g)) != 0 || 2947 (ret = sshbuf_put_bignum2(cert, dsa_pub_key)) != 0) 2948 goto out; 2949 break; 2950 case KEY_ECDSA_CERT: 2951 case KEY_ECDSA_SK_CERT: 2952 if ((ret = sshbuf_put_cstring(cert, 2953 sshkey_curve_nid_to_name(k->ecdsa_nid))) != 0 || 2954 (ret = sshbuf_put_ec(cert, 2955 EC_KEY_get0_public_key(k->ecdsa), 2956 EC_KEY_get0_group(k->ecdsa))) != 0) 2957 goto out; 2958 if (k->type == KEY_ECDSA_SK_CERT) { 2959 if ((ret = sshbuf_put_cstring(cert, 2960 k->sk_application)) != 0) 2961 goto out; 2962 } 2963 break; 2964 case KEY_RSA_CERT: 2965 RSA_get0_key(k->rsa, &rsa_n, &rsa_e, NULL); 2966 if ((ret = sshbuf_put_bignum2(cert, rsa_e)) != 0 || 2967 (ret = sshbuf_put_bignum2(cert, rsa_n)) != 0) 2968 goto out; 2969 break; 2970 #endif /* WITH_OPENSSL */ 2971 case KEY_ED25519_CERT: 2972 case KEY_ED25519_SK_CERT: 2973 if ((ret = sshbuf_put_string(cert, 2974 k->ed25519_pk, ED25519_PK_SZ)) != 0) 2975 goto out; 2976 if (k->type == KEY_ED25519_SK_CERT) { 2977 if ((ret = sshbuf_put_cstring(cert, 2978 k->sk_application)) != 0) 2979 goto out; 2980 } 2981 break; 2982 #ifdef WITH_XMSS 2983 case KEY_XMSS_CERT: 2984 if (k->xmss_name == NULL) { 2985 ret = SSH_ERR_INVALID_ARGUMENT; 2986 goto out; 2987 } 2988 if ((ret = sshbuf_put_cstring(cert, k->xmss_name)) || 2989 (ret = sshbuf_put_string(cert, 2990 k->xmss_pk, sshkey_xmss_pklen(k))) != 0) 2991 goto out; 2992 break; 2993 #endif /* WITH_XMSS */ 2994 default: 2995 ret = SSH_ERR_INVALID_ARGUMENT; 2996 goto out; 2997 } 2998 2999 if ((ret = sshbuf_put_u64(cert, k->cert->serial)) != 0 || 3000 (ret = sshbuf_put_u32(cert, k->cert->type)) != 0 || 3001 (ret = sshbuf_put_cstring(cert, k->cert->key_id)) != 0) 3002 goto out; 3003 3004 if ((principals = sshbuf_new()) == NULL) { 3005 ret = SSH_ERR_ALLOC_FAIL; 3006 goto out; 3007 } 3008 for (i = 0; i < k->cert->nprincipals; i++) { 3009 if ((ret = sshbuf_put_cstring(principals, 3010 k->cert->principals[i])) != 0) 3011 goto out; 3012 } 3013 if ((ret = sshbuf_put_stringb(cert, principals)) != 0 || 3014 (ret = sshbuf_put_u64(cert, k->cert->valid_after)) != 0 || 3015 (ret = sshbuf_put_u64(cert, k->cert->valid_before)) != 0 || 3016 (ret = sshbuf_put_stringb(cert, k->cert->critical)) != 0 || 3017 (ret = sshbuf_put_stringb(cert, k->cert->extensions)) != 0 || 3018 (ret = sshbuf_put_string(cert, NULL, 0)) != 0 || /* Reserved */ 3019 (ret = sshbuf_put_string(cert, ca_blob, ca_len)) != 0) 3020 goto out; 3021 3022 /* Sign the whole mess */ 3023 if ((ret = signer(ca, &sig_blob, &sig_len, sshbuf_ptr(cert), 3024 sshbuf_len(cert), alg, sk_provider, sk_pin, 0, signer_ctx)) != 0) 3025 goto out; 3026 /* Check and update signature_type against what was actually used */ 3027 if ((ret = sshkey_get_sigtype(sig_blob, sig_len, &sigtype)) != 0) 3028 goto out; 3029 if (alg != NULL && strcmp(alg, sigtype) != 0) { 3030 ret = SSH_ERR_SIGN_ALG_UNSUPPORTED; 3031 goto out; 3032 } 3033 if (k->cert->signature_type == NULL) { 3034 k->cert->signature_type = sigtype; 3035 sigtype = NULL; 3036 } 3037 /* Append signature and we are done */ 3038 if ((ret = sshbuf_put_string(cert, sig_blob, sig_len)) != 0) 3039 goto out; 3040 ret = 0; 3041 out: 3042 if (ret != 0) 3043 sshbuf_reset(cert); 3044 free(sig_blob); 3045 free(ca_blob); 3046 free(sigtype); 3047 sshbuf_free(principals); 3048 return ret; 3049 } 3050 3051 static int 3052 default_key_sign(struct sshkey *key, u_char **sigp, size_t *lenp, 3053 const u_char *data, size_t datalen, 3054 const char *alg, const char *sk_provider, const char *sk_pin, 3055 u_int compat, void *ctx) 3056 { 3057 if (ctx != NULL) 3058 return SSH_ERR_INVALID_ARGUMENT; 3059 return sshkey_sign(key, sigp, lenp, data, datalen, alg, 3060 sk_provider, sk_pin, compat); 3061 } 3062 3063 int 3064 sshkey_certify(struct sshkey *k, struct sshkey *ca, const char *alg, 3065 const char *sk_provider, const char *sk_pin) 3066 { 3067 return sshkey_certify_custom(k, ca, alg, sk_provider, sk_pin, 3068 default_key_sign, NULL); 3069 } 3070 3071 int 3072 sshkey_cert_check_authority(const struct sshkey *k, 3073 int want_host, int require_principal, int wildcard_pattern, 3074 uint64_t verify_time, const char *name, const char **reason) 3075 { 3076 u_int i, principal_matches; 3077 3078 if (reason == NULL) 3079 return SSH_ERR_INVALID_ARGUMENT; 3080 if (!sshkey_is_cert(k)) { 3081 *reason = "Key is not a certificate"; 3082 return SSH_ERR_KEY_CERT_INVALID; 3083 } 3084 if (want_host) { 3085 if (k->cert->type != SSH2_CERT_TYPE_HOST) { 3086 *reason = "Certificate invalid: not a host certificate"; 3087 return SSH_ERR_KEY_CERT_INVALID; 3088 } 3089 } else { 3090 if (k->cert->type != SSH2_CERT_TYPE_USER) { 3091 *reason = "Certificate invalid: not a user certificate"; 3092 return SSH_ERR_KEY_CERT_INVALID; 3093 } 3094 } 3095 if (verify_time < k->cert->valid_after) { 3096 *reason = "Certificate invalid: not yet valid"; 3097 return SSH_ERR_KEY_CERT_INVALID; 3098 } 3099 if (verify_time >= k->cert->valid_before) { 3100 *reason = "Certificate invalid: expired"; 3101 return SSH_ERR_KEY_CERT_INVALID; 3102 } 3103 if (k->cert->nprincipals == 0) { 3104 if (require_principal) { 3105 *reason = "Certificate lacks principal list"; 3106 return SSH_ERR_KEY_CERT_INVALID; 3107 } 3108 } else if (name != NULL) { 3109 principal_matches = 0; 3110 for (i = 0; i < k->cert->nprincipals; i++) { 3111 if (wildcard_pattern) { 3112 if (match_pattern(k->cert->principals[i], 3113 name)) { 3114 principal_matches = 1; 3115 break; 3116 } 3117 } else if (strcmp(name, k->cert->principals[i]) == 0) { 3118 principal_matches = 1; 3119 break; 3120 } 3121 } 3122 if (!principal_matches) { 3123 *reason = "Certificate invalid: name is not a listed " 3124 "principal"; 3125 return SSH_ERR_KEY_CERT_INVALID; 3126 } 3127 } 3128 return 0; 3129 } 3130 3131 int 3132 sshkey_cert_check_authority_now(const struct sshkey *k, 3133 int want_host, int require_principal, int wildcard_pattern, 3134 const char *name, const char **reason) 3135 { 3136 time_t now; 3137 3138 if ((now = time(NULL)) < 0) { 3139 /* yikes - system clock before epoch! */ 3140 *reason = "Certificate invalid: not yet valid"; 3141 return SSH_ERR_KEY_CERT_INVALID; 3142 } 3143 return sshkey_cert_check_authority(k, want_host, require_principal, 3144 wildcard_pattern, (uint64_t)now, name, reason); 3145 } 3146 3147 int 3148 sshkey_cert_check_host(const struct sshkey *key, const char *host, 3149 int wildcard_principals, const char *ca_sign_algorithms, 3150 const char **reason) 3151 { 3152 int r; 3153 3154 if ((r = sshkey_cert_check_authority_now(key, 1, 0, wildcard_principals, 3155 host, reason)) != 0) 3156 return r; 3157 if (sshbuf_len(key->cert->critical) != 0) { 3158 *reason = "Certificate contains unsupported critical options"; 3159 return SSH_ERR_KEY_CERT_INVALID; 3160 } 3161 if (ca_sign_algorithms != NULL && 3162 (r = sshkey_check_cert_sigtype(key, ca_sign_algorithms)) != 0) { 3163 *reason = "Certificate signed with disallowed algorithm"; 3164 return SSH_ERR_KEY_CERT_INVALID; 3165 } 3166 return 0; 3167 } 3168 3169 size_t 3170 sshkey_format_cert_validity(const struct sshkey_cert *cert, char *s, size_t l) 3171 { 3172 char from[32], to[32], ret[128]; 3173 3174 *from = *to = '\0'; 3175 if (cert->valid_after == 0 && 3176 cert->valid_before == 0xffffffffffffffffULL) 3177 return strlcpy(s, "forever", l); 3178 3179 if (cert->valid_after != 0) 3180 format_absolute_time(cert->valid_after, from, sizeof(from)); 3181 if (cert->valid_before != 0xffffffffffffffffULL) 3182 format_absolute_time(cert->valid_before, to, sizeof(to)); 3183 3184 if (cert->valid_after == 0) 3185 snprintf(ret, sizeof(ret), "before %s", to); 3186 else if (cert->valid_before == 0xffffffffffffffffULL) 3187 snprintf(ret, sizeof(ret), "after %s", from); 3188 else 3189 snprintf(ret, sizeof(ret), "from %s to %s", from, to); 3190 3191 return strlcpy(s, ret, l); 3192 } 3193 3194 int 3195 sshkey_private_serialize_opt(struct sshkey *key, struct sshbuf *buf, 3196 enum sshkey_serialize_rep opts) 3197 { 3198 int r = SSH_ERR_INTERNAL_ERROR; 3199 int was_shielded = sshkey_is_shielded(key); 3200 struct sshbuf *b = NULL; 3201 #ifdef WITH_OPENSSL 3202 const BIGNUM *rsa_n, *rsa_e, *rsa_d, *rsa_iqmp, *rsa_p, *rsa_q; 3203 const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key, *dsa_priv_key; 3204 #endif /* WITH_OPENSSL */ 3205 3206 if ((r = sshkey_unshield_private(key)) != 0) 3207 return r; 3208 if ((b = sshbuf_new()) == NULL) 3209 return SSH_ERR_ALLOC_FAIL; 3210 if ((r = sshbuf_put_cstring(b, sshkey_ssh_name(key))) != 0) 3211 goto out; 3212 switch (key->type) { 3213 #ifdef WITH_OPENSSL 3214 case KEY_RSA: 3215 RSA_get0_key(key->rsa, &rsa_n, &rsa_e, &rsa_d); 3216 RSA_get0_factors(key->rsa, &rsa_p, &rsa_q); 3217 RSA_get0_crt_params(key->rsa, NULL, NULL, &rsa_iqmp); 3218 if ((r = sshbuf_put_bignum2(b, rsa_n)) != 0 || 3219 (r = sshbuf_put_bignum2(b, rsa_e)) != 0 || 3220 (r = sshbuf_put_bignum2(b, rsa_d)) != 0 || 3221 (r = sshbuf_put_bignum2(b, rsa_iqmp)) != 0 || 3222 (r = sshbuf_put_bignum2(b, rsa_p)) != 0 || 3223 (r = sshbuf_put_bignum2(b, rsa_q)) != 0) 3224 goto out; 3225 break; 3226 case KEY_RSA_CERT: 3227 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3228 r = SSH_ERR_INVALID_ARGUMENT; 3229 goto out; 3230 } 3231 RSA_get0_key(key->rsa, NULL, NULL, &rsa_d); 3232 RSA_get0_factors(key->rsa, &rsa_p, &rsa_q); 3233 RSA_get0_crt_params(key->rsa, NULL, NULL, &rsa_iqmp); 3234 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3235 (r = sshbuf_put_bignum2(b, rsa_d)) != 0 || 3236 (r = sshbuf_put_bignum2(b, rsa_iqmp)) != 0 || 3237 (r = sshbuf_put_bignum2(b, rsa_p)) != 0 || 3238 (r = sshbuf_put_bignum2(b, rsa_q)) != 0) 3239 goto out; 3240 break; 3241 case KEY_DSA: 3242 DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g); 3243 DSA_get0_key(key->dsa, &dsa_pub_key, &dsa_priv_key); 3244 if ((r = sshbuf_put_bignum2(b, dsa_p)) != 0 || 3245 (r = sshbuf_put_bignum2(b, dsa_q)) != 0 || 3246 (r = sshbuf_put_bignum2(b, dsa_g)) != 0 || 3247 (r = sshbuf_put_bignum2(b, dsa_pub_key)) != 0 || 3248 (r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0) 3249 goto out; 3250 break; 3251 case KEY_DSA_CERT: 3252 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3253 r = SSH_ERR_INVALID_ARGUMENT; 3254 goto out; 3255 } 3256 DSA_get0_key(key->dsa, NULL, &dsa_priv_key); 3257 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3258 (r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0) 3259 goto out; 3260 break; 3261 case KEY_ECDSA: 3262 if ((r = sshbuf_put_cstring(b, 3263 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 3264 (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 || 3265 (r = sshbuf_put_bignum2(b, 3266 EC_KEY_get0_private_key(key->ecdsa))) != 0) 3267 goto out; 3268 break; 3269 case KEY_ECDSA_CERT: 3270 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3271 r = SSH_ERR_INVALID_ARGUMENT; 3272 goto out; 3273 } 3274 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3275 (r = sshbuf_put_bignum2(b, 3276 EC_KEY_get0_private_key(key->ecdsa))) != 0) 3277 goto out; 3278 break; 3279 case KEY_ECDSA_SK: 3280 if ((r = sshbuf_put_cstring(b, 3281 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 3282 (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 || 3283 (r = sshbuf_put_cstring(b, key->sk_application)) != 0 || 3284 (r = sshbuf_put_u8(b, key->sk_flags)) != 0 || 3285 (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 || 3286 (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0) 3287 goto out; 3288 break; 3289 case KEY_ECDSA_SK_CERT: 3290 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3291 r = SSH_ERR_INVALID_ARGUMENT; 3292 goto out; 3293 } 3294 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3295 (r = sshbuf_put_cstring(b, key->sk_application)) != 0 || 3296 (r = sshbuf_put_u8(b, key->sk_flags)) != 0 || 3297 (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 || 3298 (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0) 3299 goto out; 3300 break; 3301 #endif /* WITH_OPENSSL */ 3302 case KEY_ED25519: 3303 if ((r = sshbuf_put_string(b, key->ed25519_pk, 3304 ED25519_PK_SZ)) != 0 || 3305 (r = sshbuf_put_string(b, key->ed25519_sk, 3306 ED25519_SK_SZ)) != 0) 3307 goto out; 3308 break; 3309 case KEY_ED25519_CERT: 3310 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3311 r = SSH_ERR_INVALID_ARGUMENT; 3312 goto out; 3313 } 3314 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3315 (r = sshbuf_put_string(b, key->ed25519_pk, 3316 ED25519_PK_SZ)) != 0 || 3317 (r = sshbuf_put_string(b, key->ed25519_sk, 3318 ED25519_SK_SZ)) != 0) 3319 goto out; 3320 break; 3321 case KEY_ED25519_SK: 3322 if ((r = sshbuf_put_string(b, key->ed25519_pk, 3323 ED25519_PK_SZ)) != 0 || 3324 (r = sshbuf_put_cstring(b, key->sk_application)) != 0 || 3325 (r = sshbuf_put_u8(b, key->sk_flags)) != 0 || 3326 (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 || 3327 (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0) 3328 goto out; 3329 break; 3330 case KEY_ED25519_SK_CERT: 3331 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 3332 r = SSH_ERR_INVALID_ARGUMENT; 3333 goto out; 3334 } 3335 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3336 (r = sshbuf_put_string(b, key->ed25519_pk, 3337 ED25519_PK_SZ)) != 0 || 3338 (r = sshbuf_put_cstring(b, key->sk_application)) != 0 || 3339 (r = sshbuf_put_u8(b, key->sk_flags)) != 0 || 3340 (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 || 3341 (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0) 3342 goto out; 3343 break; 3344 #ifdef WITH_XMSS 3345 case KEY_XMSS: 3346 if (key->xmss_name == NULL) { 3347 r = SSH_ERR_INVALID_ARGUMENT; 3348 goto out; 3349 } 3350 if ((r = sshbuf_put_cstring(b, key->xmss_name)) != 0 || 3351 (r = sshbuf_put_string(b, key->xmss_pk, 3352 sshkey_xmss_pklen(key))) != 0 || 3353 (r = sshbuf_put_string(b, key->xmss_sk, 3354 sshkey_xmss_sklen(key))) != 0 || 3355 (r = sshkey_xmss_serialize_state_opt(key, b, opts)) != 0) 3356 goto out; 3357 break; 3358 case KEY_XMSS_CERT: 3359 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0 || 3360 key->xmss_name == NULL) { 3361 r = SSH_ERR_INVALID_ARGUMENT; 3362 goto out; 3363 } 3364 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 3365 (r = sshbuf_put_cstring(b, key->xmss_name)) != 0 || 3366 (r = sshbuf_put_string(b, key->xmss_pk, 3367 sshkey_xmss_pklen(key))) != 0 || 3368 (r = sshbuf_put_string(b, key->xmss_sk, 3369 sshkey_xmss_sklen(key))) != 0 || 3370 (r = sshkey_xmss_serialize_state_opt(key, b, opts)) != 0) 3371 goto out; 3372 break; 3373 #endif /* WITH_XMSS */ 3374 default: 3375 r = SSH_ERR_INVALID_ARGUMENT; 3376 goto out; 3377 } 3378 /* 3379 * success (but we still need to append the output to buf after 3380 * possibly re-shielding the private key) 3381 */ 3382 r = 0; 3383 out: 3384 if (was_shielded) 3385 r = sshkey_shield_private(key); 3386 if (r == 0) 3387 r = sshbuf_putb(buf, b); 3388 sshbuf_free(b); 3389 3390 return r; 3391 } 3392 3393 int 3394 sshkey_private_serialize(struct sshkey *key, struct sshbuf *b) 3395 { 3396 return sshkey_private_serialize_opt(key, b, 3397 SSHKEY_SERIALIZE_DEFAULT); 3398 } 3399 3400 int 3401 sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) 3402 { 3403 char *tname = NULL, *curve = NULL, *xmss_name = NULL; 3404 char *expect_sk_application = NULL; 3405 struct sshkey *k = NULL; 3406 size_t pklen = 0, sklen = 0; 3407 int type, r = SSH_ERR_INTERNAL_ERROR; 3408 u_char *ed25519_pk = NULL, *ed25519_sk = NULL; 3409 u_char *expect_ed25519_pk = NULL; 3410 u_char *xmss_pk = NULL, *xmss_sk = NULL; 3411 #ifdef WITH_OPENSSL 3412 BIGNUM *exponent = NULL; 3413 BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL; 3414 BIGNUM *rsa_iqmp = NULL, *rsa_p = NULL, *rsa_q = NULL; 3415 BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL; 3416 BIGNUM *dsa_pub_key = NULL, *dsa_priv_key = NULL; 3417 #endif /* WITH_OPENSSL */ 3418 3419 if (kp != NULL) 3420 *kp = NULL; 3421 if ((r = sshbuf_get_cstring(buf, &tname, NULL)) != 0) 3422 goto out; 3423 type = sshkey_type_from_name(tname); 3424 if (sshkey_type_is_cert(type)) { 3425 /* 3426 * Certificate key private keys begin with the certificate 3427 * itself. Make sure this matches the type of the enclosing 3428 * private key. 3429 */ 3430 if ((r = sshkey_froms(buf, &k)) != 0) 3431 goto out; 3432 if (k->type != type) { 3433 r = SSH_ERR_KEY_CERT_MISMATCH; 3434 goto out; 3435 } 3436 /* For ECDSA keys, the group must match too */ 3437 if (k->type == KEY_ECDSA && 3438 k->ecdsa_nid != sshkey_ecdsa_nid_from_name(tname)) { 3439 r = SSH_ERR_KEY_CERT_MISMATCH; 3440 goto out; 3441 } 3442 /* 3443 * Several fields are redundant between certificate and 3444 * private key body, we require these to match. 3445 */ 3446 expect_sk_application = k->sk_application; 3447 expect_ed25519_pk = k->ed25519_pk; 3448 k->sk_application = NULL; 3449 k->ed25519_pk = NULL; 3450 } else { 3451 if ((k = sshkey_new(type)) == NULL) { 3452 r = SSH_ERR_ALLOC_FAIL; 3453 goto out; 3454 } 3455 } 3456 switch (type) { 3457 #ifdef WITH_OPENSSL 3458 case KEY_DSA: 3459 if ((r = sshbuf_get_bignum2(buf, &dsa_p)) != 0 || 3460 (r = sshbuf_get_bignum2(buf, &dsa_q)) != 0 || 3461 (r = sshbuf_get_bignum2(buf, &dsa_g)) != 0 || 3462 (r = sshbuf_get_bignum2(buf, &dsa_pub_key)) != 0) 3463 goto out; 3464 if (!DSA_set0_pqg(k->dsa, dsa_p, dsa_q, dsa_g)) { 3465 r = SSH_ERR_LIBCRYPTO_ERROR; 3466 goto out; 3467 } 3468 dsa_p = dsa_q = dsa_g = NULL; /* transferred */ 3469 if (!DSA_set0_key(k->dsa, dsa_pub_key, NULL)) { 3470 r = SSH_ERR_LIBCRYPTO_ERROR; 3471 goto out; 3472 } 3473 dsa_pub_key = NULL; /* transferred */ 3474 /* FALLTHROUGH */ 3475 case KEY_DSA_CERT: 3476 if ((r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0) 3477 goto out; 3478 if (!DSA_set0_key(k->dsa, NULL, dsa_priv_key)) { 3479 r = SSH_ERR_LIBCRYPTO_ERROR; 3480 goto out; 3481 } 3482 dsa_priv_key = NULL; /* transferred */ 3483 break; 3484 case KEY_ECDSA: 3485 if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) { 3486 r = SSH_ERR_INVALID_ARGUMENT; 3487 goto out; 3488 } 3489 if ((r = sshbuf_get_cstring(buf, &curve, NULL)) != 0) 3490 goto out; 3491 if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 3492 r = SSH_ERR_EC_CURVE_MISMATCH; 3493 goto out; 3494 } 3495 k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 3496 if (k->ecdsa == NULL) { 3497 r = SSH_ERR_LIBCRYPTO_ERROR; 3498 goto out; 3499 } 3500 if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0) 3501 goto out; 3502 /* FALLTHROUGH */ 3503 case KEY_ECDSA_CERT: 3504 if ((r = sshbuf_get_bignum2(buf, &exponent)) != 0) 3505 goto out; 3506 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { 3507 r = SSH_ERR_LIBCRYPTO_ERROR; 3508 goto out; 3509 } 3510 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 3511 EC_KEY_get0_public_key(k->ecdsa))) != 0 || 3512 (r = sshkey_ec_validate_private(k->ecdsa)) != 0) 3513 goto out; 3514 break; 3515 case KEY_ECDSA_SK: 3516 if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) { 3517 r = SSH_ERR_INVALID_ARGUMENT; 3518 goto out; 3519 } 3520 if ((r = sshbuf_get_cstring(buf, &curve, NULL)) != 0) 3521 goto out; 3522 if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 3523 r = SSH_ERR_EC_CURVE_MISMATCH; 3524 goto out; 3525 } 3526 if ((k->sk_key_handle = sshbuf_new()) == NULL || 3527 (k->sk_reserved = sshbuf_new()) == NULL) { 3528 r = SSH_ERR_ALLOC_FAIL; 3529 goto out; 3530 } 3531 k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 3532 if (k->ecdsa == NULL) { 3533 r = SSH_ERR_LIBCRYPTO_ERROR; 3534 goto out; 3535 } 3536 if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 || 3537 (r = sshbuf_get_cstring(buf, &k->sk_application, 3538 NULL)) != 0 || 3539 (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 || 3540 (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 || 3541 (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0) 3542 goto out; 3543 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 3544 EC_KEY_get0_public_key(k->ecdsa))) != 0) 3545 goto out; 3546 break; 3547 case KEY_ECDSA_SK_CERT: 3548 if ((k->sk_key_handle = sshbuf_new()) == NULL || 3549 (k->sk_reserved = sshbuf_new()) == NULL) { 3550 r = SSH_ERR_ALLOC_FAIL; 3551 goto out; 3552 } 3553 if ((r = sshbuf_get_cstring(buf, &k->sk_application, 3554 NULL)) != 0 || 3555 (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 || 3556 (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 || 3557 (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0) 3558 goto out; 3559 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 3560 EC_KEY_get0_public_key(k->ecdsa))) != 0) 3561 goto out; 3562 break; 3563 case KEY_RSA: 3564 if ((r = sshbuf_get_bignum2(buf, &rsa_n)) != 0 || 3565 (r = sshbuf_get_bignum2(buf, &rsa_e)) != 0) 3566 goto out; 3567 if (!RSA_set0_key(k->rsa, rsa_n, rsa_e, NULL)) { 3568 r = SSH_ERR_LIBCRYPTO_ERROR; 3569 goto out; 3570 } 3571 rsa_n = rsa_e = NULL; /* transferred */ 3572 /* FALLTHROUGH */ 3573 case KEY_RSA_CERT: 3574 if ((r = sshbuf_get_bignum2(buf, &rsa_d)) != 0 || 3575 (r = sshbuf_get_bignum2(buf, &rsa_iqmp)) != 0 || 3576 (r = sshbuf_get_bignum2(buf, &rsa_p)) != 0 || 3577 (r = sshbuf_get_bignum2(buf, &rsa_q)) != 0) 3578 goto out; 3579 if (!RSA_set0_key(k->rsa, NULL, NULL, rsa_d)) { 3580 r = SSH_ERR_LIBCRYPTO_ERROR; 3581 goto out; 3582 } 3583 rsa_d = NULL; /* transferred */ 3584 if (!RSA_set0_factors(k->rsa, rsa_p, rsa_q)) { 3585 r = SSH_ERR_LIBCRYPTO_ERROR; 3586 goto out; 3587 } 3588 rsa_p = rsa_q = NULL; /* transferred */ 3589 if ((r = sshkey_check_rsa_length(k, 0)) != 0) 3590 goto out; 3591 if ((r = ssh_rsa_complete_crt_parameters(k, rsa_iqmp)) != 0) 3592 goto out; 3593 break; 3594 #endif /* WITH_OPENSSL */ 3595 case KEY_ED25519: 3596 case KEY_ED25519_CERT: 3597 if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || 3598 (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) 3599 goto out; 3600 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { 3601 r = SSH_ERR_INVALID_FORMAT; 3602 goto out; 3603 } 3604 k->ed25519_pk = ed25519_pk; 3605 k->ed25519_sk = ed25519_sk; 3606 ed25519_pk = ed25519_sk = NULL; /* transferred */ 3607 break; 3608 case KEY_ED25519_SK: 3609 case KEY_ED25519_SK_CERT: 3610 if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0) 3611 goto out; 3612 if (pklen != ED25519_PK_SZ) { 3613 r = SSH_ERR_INVALID_FORMAT; 3614 goto out; 3615 } 3616 if ((k->sk_key_handle = sshbuf_new()) == NULL || 3617 (k->sk_reserved = sshbuf_new()) == NULL) { 3618 r = SSH_ERR_ALLOC_FAIL; 3619 goto out; 3620 } 3621 if ((r = sshbuf_get_cstring(buf, &k->sk_application, 3622 NULL)) != 0 || 3623 (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 || 3624 (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 || 3625 (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0) 3626 goto out; 3627 k->ed25519_pk = ed25519_pk; 3628 ed25519_pk = NULL; /* transferred */ 3629 break; 3630 #ifdef WITH_XMSS 3631 case KEY_XMSS: 3632 case KEY_XMSS_CERT: 3633 if ((r = sshbuf_get_cstring(buf, &xmss_name, NULL)) != 0 || 3634 (r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 || 3635 (r = sshbuf_get_string(buf, &xmss_sk, &sklen)) != 0) 3636 goto out; 3637 if (type == KEY_XMSS && 3638 (r = sshkey_xmss_init(k, xmss_name)) != 0) 3639 goto out; 3640 if (pklen != sshkey_xmss_pklen(k) || 3641 sklen != sshkey_xmss_sklen(k)) { 3642 r = SSH_ERR_INVALID_FORMAT; 3643 goto out; 3644 } 3645 k->xmss_pk = xmss_pk; 3646 k->xmss_sk = xmss_sk; 3647 xmss_pk = xmss_sk = NULL; 3648 /* optional internal state */ 3649 if ((r = sshkey_xmss_deserialize_state_opt(k, buf)) != 0) 3650 goto out; 3651 break; 3652 #endif /* WITH_XMSS */ 3653 default: 3654 r = SSH_ERR_KEY_TYPE_UNKNOWN; 3655 goto out; 3656 } 3657 #ifdef WITH_OPENSSL 3658 /* enable blinding */ 3659 switch (k->type) { 3660 case KEY_RSA: 3661 case KEY_RSA_CERT: 3662 if (RSA_blinding_on(k->rsa, NULL) != 1) { 3663 r = SSH_ERR_LIBCRYPTO_ERROR; 3664 goto out; 3665 } 3666 break; 3667 } 3668 #endif /* WITH_OPENSSL */ 3669 if ((expect_sk_application != NULL && (k->sk_application == NULL || 3670 strcmp(expect_sk_application, k->sk_application) != 0)) || 3671 (expect_ed25519_pk != NULL && (k->ed25519_pk == NULL || 3672 memcmp(expect_ed25519_pk, k->ed25519_pk, ED25519_PK_SZ) != 0))) { 3673 r = SSH_ERR_KEY_CERT_MISMATCH; 3674 goto out; 3675 } 3676 /* success */ 3677 r = 0; 3678 if (kp != NULL) { 3679 *kp = k; 3680 k = NULL; 3681 } 3682 out: 3683 free(tname); 3684 free(curve); 3685 #ifdef WITH_OPENSSL 3686 BN_clear_free(exponent); 3687 BN_clear_free(dsa_p); 3688 BN_clear_free(dsa_q); 3689 BN_clear_free(dsa_g); 3690 BN_clear_free(dsa_pub_key); 3691 BN_clear_free(dsa_priv_key); 3692 BN_clear_free(rsa_n); 3693 BN_clear_free(rsa_e); 3694 BN_clear_free(rsa_d); 3695 BN_clear_free(rsa_p); 3696 BN_clear_free(rsa_q); 3697 BN_clear_free(rsa_iqmp); 3698 #endif /* WITH_OPENSSL */ 3699 sshkey_free(k); 3700 freezero(ed25519_pk, pklen); 3701 freezero(ed25519_sk, sklen); 3702 free(xmss_name); 3703 freezero(xmss_pk, pklen); 3704 freezero(xmss_sk, sklen); 3705 free(expect_sk_application); 3706 free(expect_ed25519_pk); 3707 return r; 3708 } 3709 3710 #ifdef WITH_OPENSSL 3711 int 3712 sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public) 3713 { 3714 EC_POINT *nq = NULL; 3715 BIGNUM *order = NULL, *x = NULL, *y = NULL, *tmp = NULL; 3716 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 3717 3718 /* 3719 * NB. This assumes OpenSSL has already verified that the public 3720 * point lies on the curve. This is done by EC_POINT_oct2point() 3721 * implicitly calling EC_POINT_is_on_curve(). If this code is ever 3722 * reachable with public points not unmarshalled using 3723 * EC_POINT_oct2point then the caller will need to explicitly check. 3724 */ 3725 3726 /* 3727 * We shouldn't ever hit this case because bignum_get_ecpoint() 3728 * refuses to load GF2m points. 3729 */ 3730 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 3731 NID_X9_62_prime_field) 3732 goto out; 3733 3734 /* Q != infinity */ 3735 if (EC_POINT_is_at_infinity(group, public)) 3736 goto out; 3737 3738 if ((x = BN_new()) == NULL || 3739 (y = BN_new()) == NULL || 3740 (order = BN_new()) == NULL || 3741 (tmp = BN_new()) == NULL) { 3742 ret = SSH_ERR_ALLOC_FAIL; 3743 goto out; 3744 } 3745 3746 /* log2(x) > log2(order)/2, log2(y) > log2(order)/2 */ 3747 if (EC_GROUP_get_order(group, order, NULL) != 1 || 3748 EC_POINT_get_affine_coordinates_GFp(group, public, 3749 x, y, NULL) != 1) { 3750 ret = SSH_ERR_LIBCRYPTO_ERROR; 3751 goto out; 3752 } 3753 if (BN_num_bits(x) <= BN_num_bits(order) / 2 || 3754 BN_num_bits(y) <= BN_num_bits(order) / 2) 3755 goto out; 3756 3757 /* nQ == infinity (n == order of subgroup) */ 3758 if ((nq = EC_POINT_new(group)) == NULL) { 3759 ret = SSH_ERR_ALLOC_FAIL; 3760 goto out; 3761 } 3762 if (EC_POINT_mul(group, nq, NULL, public, order, NULL) != 1) { 3763 ret = SSH_ERR_LIBCRYPTO_ERROR; 3764 goto out; 3765 } 3766 if (EC_POINT_is_at_infinity(group, nq) != 1) 3767 goto out; 3768 3769 /* x < order - 1, y < order - 1 */ 3770 if (!BN_sub(tmp, order, BN_value_one())) { 3771 ret = SSH_ERR_LIBCRYPTO_ERROR; 3772 goto out; 3773 } 3774 if (BN_cmp(x, tmp) >= 0 || BN_cmp(y, tmp) >= 0) 3775 goto out; 3776 ret = 0; 3777 out: 3778 BN_clear_free(x); 3779 BN_clear_free(y); 3780 BN_clear_free(order); 3781 BN_clear_free(tmp); 3782 EC_POINT_free(nq); 3783 return ret; 3784 } 3785 3786 int 3787 sshkey_ec_validate_private(const EC_KEY *key) 3788 { 3789 BIGNUM *order = NULL, *tmp = NULL; 3790 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 3791 3792 if ((order = BN_new()) == NULL || (tmp = BN_new()) == NULL) { 3793 ret = SSH_ERR_ALLOC_FAIL; 3794 goto out; 3795 } 3796 3797 /* log2(private) > log2(order)/2 */ 3798 if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, NULL) != 1) { 3799 ret = SSH_ERR_LIBCRYPTO_ERROR; 3800 goto out; 3801 } 3802 if (BN_num_bits(EC_KEY_get0_private_key(key)) <= 3803 BN_num_bits(order) / 2) 3804 goto out; 3805 3806 /* private < order - 1 */ 3807 if (!BN_sub(tmp, order, BN_value_one())) { 3808 ret = SSH_ERR_LIBCRYPTO_ERROR; 3809 goto out; 3810 } 3811 if (BN_cmp(EC_KEY_get0_private_key(key), tmp) >= 0) 3812 goto out; 3813 ret = 0; 3814 out: 3815 BN_clear_free(order); 3816 BN_clear_free(tmp); 3817 return ret; 3818 } 3819 3820 void 3821 sshkey_dump_ec_point(const EC_GROUP *group, const EC_POINT *point) 3822 { 3823 BIGNUM *x = NULL, *y = NULL; 3824 3825 if (point == NULL) { 3826 fputs("point=(NULL)\n", stderr); 3827 return; 3828 } 3829 if ((x = BN_new()) == NULL || (y = BN_new()) == NULL) { 3830 fprintf(stderr, "%s: BN_new failed\n", __func__); 3831 goto out; 3832 } 3833 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 3834 NID_X9_62_prime_field) { 3835 fprintf(stderr, "%s: group is not a prime field\n", __func__); 3836 goto out; 3837 } 3838 if (EC_POINT_get_affine_coordinates_GFp(group, point, 3839 x, y, NULL) != 1) { 3840 fprintf(stderr, "%s: EC_POINT_get_affine_coordinates_GFp\n", 3841 __func__); 3842 goto out; 3843 } 3844 fputs("x=", stderr); 3845 BN_print_fp(stderr, x); 3846 fputs("\ny=", stderr); 3847 BN_print_fp(stderr, y); 3848 fputs("\n", stderr); 3849 out: 3850 BN_clear_free(x); 3851 BN_clear_free(y); 3852 } 3853 3854 void 3855 sshkey_dump_ec_key(const EC_KEY *key) 3856 { 3857 const BIGNUM *exponent; 3858 3859 sshkey_dump_ec_point(EC_KEY_get0_group(key), 3860 EC_KEY_get0_public_key(key)); 3861 fputs("exponent=", stderr); 3862 if ((exponent = EC_KEY_get0_private_key(key)) == NULL) 3863 fputs("(NULL)", stderr); 3864 else 3865 BN_print_fp(stderr, EC_KEY_get0_private_key(key)); 3866 fputs("\n", stderr); 3867 } 3868 #endif /* WITH_OPENSSL */ 3869 3870 static int 3871 sshkey_private_to_blob2(struct sshkey *prv, struct sshbuf *blob, 3872 const char *passphrase, const char *comment, const char *ciphername, 3873 int rounds) 3874 { 3875 u_char *cp, *key = NULL, *pubkeyblob = NULL; 3876 u_char salt[SALT_LEN]; 3877 char *b64 = NULL; 3878 size_t i, pubkeylen, keylen, ivlen, blocksize, authlen; 3879 u_int check; 3880 int r = SSH_ERR_INTERNAL_ERROR; 3881 struct sshcipher_ctx *ciphercontext = NULL; 3882 const struct sshcipher *cipher; 3883 const char *kdfname = KDFNAME; 3884 struct sshbuf *encoded = NULL, *encrypted = NULL, *kdf = NULL; 3885 3886 if (rounds <= 0) 3887 rounds = DEFAULT_ROUNDS; 3888 if (passphrase == NULL || !strlen(passphrase)) { 3889 ciphername = "none"; 3890 kdfname = "none"; 3891 } else if (ciphername == NULL) 3892 ciphername = DEFAULT_CIPHERNAME; 3893 if ((cipher = cipher_by_name(ciphername)) == NULL) { 3894 r = SSH_ERR_INVALID_ARGUMENT; 3895 goto out; 3896 } 3897 3898 if ((kdf = sshbuf_new()) == NULL || 3899 (encoded = sshbuf_new()) == NULL || 3900 (encrypted = sshbuf_new()) == NULL) { 3901 r = SSH_ERR_ALLOC_FAIL; 3902 goto out; 3903 } 3904 blocksize = cipher_blocksize(cipher); 3905 keylen = cipher_keylen(cipher); 3906 ivlen = cipher_ivlen(cipher); 3907 authlen = cipher_authlen(cipher); 3908 if ((key = calloc(1, keylen + ivlen)) == NULL) { 3909 r = SSH_ERR_ALLOC_FAIL; 3910 goto out; 3911 } 3912 if (strcmp(kdfname, "bcrypt") == 0) { 3913 arc4random_buf(salt, SALT_LEN); 3914 if (bcrypt_pbkdf(passphrase, strlen(passphrase), 3915 salt, SALT_LEN, key, keylen + ivlen, rounds) < 0) { 3916 r = SSH_ERR_INVALID_ARGUMENT; 3917 goto out; 3918 } 3919 if ((r = sshbuf_put_string(kdf, salt, SALT_LEN)) != 0 || 3920 (r = sshbuf_put_u32(kdf, rounds)) != 0) 3921 goto out; 3922 } else if (strcmp(kdfname, "none") != 0) { 3923 /* Unsupported KDF type */ 3924 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3925 goto out; 3926 } 3927 if ((r = cipher_init(&ciphercontext, cipher, key, keylen, 3928 key + keylen, ivlen, 1)) != 0) 3929 goto out; 3930 3931 if ((r = sshbuf_put(encoded, AUTH_MAGIC, sizeof(AUTH_MAGIC))) != 0 || 3932 (r = sshbuf_put_cstring(encoded, ciphername)) != 0 || 3933 (r = sshbuf_put_cstring(encoded, kdfname)) != 0 || 3934 (r = sshbuf_put_stringb(encoded, kdf)) != 0 || 3935 (r = sshbuf_put_u32(encoded, 1)) != 0 || /* number of keys */ 3936 (r = sshkey_to_blob(prv, &pubkeyblob, &pubkeylen)) != 0 || 3937 (r = sshbuf_put_string(encoded, pubkeyblob, pubkeylen)) != 0) 3938 goto out; 3939 3940 /* set up the buffer that will be encrypted */ 3941 3942 /* Random check bytes */ 3943 check = arc4random(); 3944 if ((r = sshbuf_put_u32(encrypted, check)) != 0 || 3945 (r = sshbuf_put_u32(encrypted, check)) != 0) 3946 goto out; 3947 3948 /* append private key and comment*/ 3949 if ((r = sshkey_private_serialize_opt(prv, encrypted, 3950 SSHKEY_SERIALIZE_FULL)) != 0 || 3951 (r = sshbuf_put_cstring(encrypted, comment)) != 0) 3952 goto out; 3953 3954 /* padding */ 3955 i = 0; 3956 while (sshbuf_len(encrypted) % blocksize) { 3957 if ((r = sshbuf_put_u8(encrypted, ++i & 0xff)) != 0) 3958 goto out; 3959 } 3960 3961 /* length in destination buffer */ 3962 if ((r = sshbuf_put_u32(encoded, sshbuf_len(encrypted))) != 0) 3963 goto out; 3964 3965 /* encrypt */ 3966 if ((r = sshbuf_reserve(encoded, 3967 sshbuf_len(encrypted) + authlen, &cp)) != 0) 3968 goto out; 3969 if ((r = cipher_crypt(ciphercontext, 0, cp, 3970 sshbuf_ptr(encrypted), sshbuf_len(encrypted), 0, authlen)) != 0) 3971 goto out; 3972 3973 sshbuf_reset(blob); 3974 3975 /* assemble uuencoded key */ 3976 if ((r = sshbuf_put(blob, MARK_BEGIN, MARK_BEGIN_LEN)) != 0 || 3977 (r = sshbuf_dtob64(encoded, blob, 1)) != 0 || 3978 (r = sshbuf_put(blob, MARK_END, MARK_END_LEN)) != 0) 3979 goto out; 3980 3981 /* success */ 3982 r = 0; 3983 3984 out: 3985 sshbuf_free(kdf); 3986 sshbuf_free(encoded); 3987 sshbuf_free(encrypted); 3988 cipher_free(ciphercontext); 3989 explicit_bzero(salt, sizeof(salt)); 3990 if (key != NULL) 3991 freezero(key, keylen + ivlen); 3992 if (pubkeyblob != NULL) 3993 freezero(pubkeyblob, pubkeylen); 3994 if (b64 != NULL) 3995 freezero(b64, strlen(b64)); 3996 return r; 3997 } 3998 3999 static int 4000 private2_uudecode(struct sshbuf *blob, struct sshbuf **decodedp) 4001 { 4002 const u_char *cp; 4003 size_t encoded_len; 4004 int r; 4005 u_char last; 4006 struct sshbuf *encoded = NULL, *decoded = NULL; 4007 4008 if (blob == NULL || decodedp == NULL) 4009 return SSH_ERR_INVALID_ARGUMENT; 4010 4011 *decodedp = NULL; 4012 4013 if ((encoded = sshbuf_new()) == NULL || 4014 (decoded = sshbuf_new()) == NULL) { 4015 r = SSH_ERR_ALLOC_FAIL; 4016 goto out; 4017 } 4018 4019 /* check preamble */ 4020 cp = sshbuf_ptr(blob); 4021 encoded_len = sshbuf_len(blob); 4022 if (encoded_len < (MARK_BEGIN_LEN + MARK_END_LEN) || 4023 memcmp(cp, MARK_BEGIN, MARK_BEGIN_LEN) != 0) { 4024 r = SSH_ERR_INVALID_FORMAT; 4025 goto out; 4026 } 4027 cp += MARK_BEGIN_LEN; 4028 encoded_len -= MARK_BEGIN_LEN; 4029 4030 /* Look for end marker, removing whitespace as we go */ 4031 while (encoded_len > 0) { 4032 if (*cp != '\n' && *cp != '\r') { 4033 if ((r = sshbuf_put_u8(encoded, *cp)) != 0) 4034 goto out; 4035 } 4036 last = *cp; 4037 encoded_len--; 4038 cp++; 4039 if (last == '\n') { 4040 if (encoded_len >= MARK_END_LEN && 4041 memcmp(cp, MARK_END, MARK_END_LEN) == 0) { 4042 /* \0 terminate */ 4043 if ((r = sshbuf_put_u8(encoded, 0)) != 0) 4044 goto out; 4045 break; 4046 } 4047 } 4048 } 4049 if (encoded_len == 0) { 4050 r = SSH_ERR_INVALID_FORMAT; 4051 goto out; 4052 } 4053 4054 /* decode base64 */ 4055 if ((r = sshbuf_b64tod(decoded, (char *)sshbuf_ptr(encoded))) != 0) 4056 goto out; 4057 4058 /* check magic */ 4059 if (sshbuf_len(decoded) < sizeof(AUTH_MAGIC) || 4060 memcmp(sshbuf_ptr(decoded), AUTH_MAGIC, sizeof(AUTH_MAGIC))) { 4061 r = SSH_ERR_INVALID_FORMAT; 4062 goto out; 4063 } 4064 /* success */ 4065 *decodedp = decoded; 4066 decoded = NULL; 4067 r = 0; 4068 out: 4069 sshbuf_free(encoded); 4070 sshbuf_free(decoded); 4071 return r; 4072 } 4073 4074 static int 4075 private2_decrypt(struct sshbuf *decoded, const char *passphrase, 4076 struct sshbuf **decryptedp, struct sshkey **pubkeyp) 4077 { 4078 char *ciphername = NULL, *kdfname = NULL; 4079 const struct sshcipher *cipher = NULL; 4080 int r = SSH_ERR_INTERNAL_ERROR; 4081 size_t keylen = 0, ivlen = 0, authlen = 0, slen = 0; 4082 struct sshbuf *kdf = NULL, *decrypted = NULL; 4083 struct sshcipher_ctx *ciphercontext = NULL; 4084 struct sshkey *pubkey = NULL; 4085 u_char *key = NULL, *salt = NULL, *dp; 4086 u_int blocksize, rounds, nkeys, encrypted_len, check1, check2; 4087 4088 if (decoded == NULL || decryptedp == NULL || pubkeyp == NULL) 4089 return SSH_ERR_INVALID_ARGUMENT; 4090 4091 *decryptedp = NULL; 4092 *pubkeyp = NULL; 4093 4094 if ((decrypted = sshbuf_new()) == NULL) { 4095 r = SSH_ERR_ALLOC_FAIL; 4096 goto out; 4097 } 4098 4099 /* parse public portion of key */ 4100 if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC))) != 0 || 4101 (r = sshbuf_get_cstring(decoded, &ciphername, NULL)) != 0 || 4102 (r = sshbuf_get_cstring(decoded, &kdfname, NULL)) != 0 || 4103 (r = sshbuf_froms(decoded, &kdf)) != 0 || 4104 (r = sshbuf_get_u32(decoded, &nkeys)) != 0) 4105 goto out; 4106 4107 if (nkeys != 1) { 4108 /* XXX only one key supported at present */ 4109 r = SSH_ERR_INVALID_FORMAT; 4110 goto out; 4111 } 4112 4113 if ((r = sshkey_froms(decoded, &pubkey)) != 0 || 4114 (r = sshbuf_get_u32(decoded, &encrypted_len)) != 0) 4115 goto out; 4116 4117 if ((cipher = cipher_by_name(ciphername)) == NULL) { 4118 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 4119 goto out; 4120 } 4121 if (strcmp(kdfname, "none") != 0 && strcmp(kdfname, "bcrypt") != 0) { 4122 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 4123 goto out; 4124 } 4125 if (strcmp(kdfname, "none") == 0 && strcmp(ciphername, "none") != 0) { 4126 r = SSH_ERR_INVALID_FORMAT; 4127 goto out; 4128 } 4129 if ((passphrase == NULL || strlen(passphrase) == 0) && 4130 strcmp(kdfname, "none") != 0) { 4131 /* passphrase required */ 4132 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 4133 goto out; 4134 } 4135 4136 /* check size of encrypted key blob */ 4137 blocksize = cipher_blocksize(cipher); 4138 if (encrypted_len < blocksize || (encrypted_len % blocksize) != 0) { 4139 r = SSH_ERR_INVALID_FORMAT; 4140 goto out; 4141 } 4142 4143 /* setup key */ 4144 keylen = cipher_keylen(cipher); 4145 ivlen = cipher_ivlen(cipher); 4146 authlen = cipher_authlen(cipher); 4147 if ((key = calloc(1, keylen + ivlen)) == NULL) { 4148 r = SSH_ERR_ALLOC_FAIL; 4149 goto out; 4150 } 4151 if (strcmp(kdfname, "bcrypt") == 0) { 4152 if ((r = sshbuf_get_string(kdf, &salt, &slen)) != 0 || 4153 (r = sshbuf_get_u32(kdf, &rounds)) != 0) 4154 goto out; 4155 if (bcrypt_pbkdf(passphrase, strlen(passphrase), salt, slen, 4156 key, keylen + ivlen, rounds) < 0) { 4157 r = SSH_ERR_INVALID_FORMAT; 4158 goto out; 4159 } 4160 } 4161 4162 /* check that an appropriate amount of auth data is present */ 4163 if (sshbuf_len(decoded) < authlen || 4164 sshbuf_len(decoded) - authlen < encrypted_len) { 4165 r = SSH_ERR_INVALID_FORMAT; 4166 goto out; 4167 } 4168 4169 /* decrypt private portion of key */ 4170 if ((r = sshbuf_reserve(decrypted, encrypted_len, &dp)) != 0 || 4171 (r = cipher_init(&ciphercontext, cipher, key, keylen, 4172 key + keylen, ivlen, 0)) != 0) 4173 goto out; 4174 if ((r = cipher_crypt(ciphercontext, 0, dp, sshbuf_ptr(decoded), 4175 encrypted_len, 0, authlen)) != 0) { 4176 /* an integrity error here indicates an incorrect passphrase */ 4177 if (r == SSH_ERR_MAC_INVALID) 4178 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 4179 goto out; 4180 } 4181 if ((r = sshbuf_consume(decoded, encrypted_len + authlen)) != 0) 4182 goto out; 4183 /* there should be no trailing data */ 4184 if (sshbuf_len(decoded) != 0) { 4185 r = SSH_ERR_INVALID_FORMAT; 4186 goto out; 4187 } 4188 4189 /* check check bytes */ 4190 if ((r = sshbuf_get_u32(decrypted, &check1)) != 0 || 4191 (r = sshbuf_get_u32(decrypted, &check2)) != 0) 4192 goto out; 4193 if (check1 != check2) { 4194 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 4195 goto out; 4196 } 4197 /* success */ 4198 *decryptedp = decrypted; 4199 decrypted = NULL; 4200 *pubkeyp = pubkey; 4201 pubkey = NULL; 4202 r = 0; 4203 out: 4204 cipher_free(ciphercontext); 4205 free(ciphername); 4206 free(kdfname); 4207 sshkey_free(pubkey); 4208 if (salt != NULL) { 4209 explicit_bzero(salt, slen); 4210 free(salt); 4211 } 4212 if (key != NULL) { 4213 explicit_bzero(key, keylen + ivlen); 4214 free(key); 4215 } 4216 sshbuf_free(kdf); 4217 sshbuf_free(decrypted); 4218 return r; 4219 } 4220 4221 static int 4222 sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase, 4223 struct sshkey **keyp, char **commentp) 4224 { 4225 char *comment = NULL; 4226 int r = SSH_ERR_INTERNAL_ERROR; 4227 struct sshbuf *decoded = NULL, *decrypted = NULL; 4228 struct sshkey *k = NULL, *pubkey = NULL; 4229 4230 if (keyp != NULL) 4231 *keyp = NULL; 4232 if (commentp != NULL) 4233 *commentp = NULL; 4234 4235 /* Undo base64 encoding and decrypt the private section */ 4236 if ((r = private2_uudecode(blob, &decoded)) != 0 || 4237 (r = private2_decrypt(decoded, passphrase, 4238 &decrypted, &pubkey)) != 0) 4239 goto out; 4240 4241 if (type != KEY_UNSPEC && 4242 sshkey_type_plain(type) != sshkey_type_plain(pubkey->type)) { 4243 r = SSH_ERR_KEY_TYPE_MISMATCH; 4244 goto out; 4245 } 4246 4247 /* Load the private key and comment */ 4248 if ((r = sshkey_private_deserialize(decrypted, &k)) != 0 || 4249 (r = sshbuf_get_cstring(decrypted, &comment, NULL)) != 0) 4250 goto out; 4251 4252 /* Check deterministic padding after private section */ 4253 if ((r = private2_check_padding(decrypted)) != 0) 4254 goto out; 4255 4256 /* Check that the public key in the envelope matches the private key */ 4257 if (!sshkey_equal(pubkey, k)) { 4258 r = SSH_ERR_INVALID_FORMAT; 4259 goto out; 4260 } 4261 4262 /* success */ 4263 r = 0; 4264 if (keyp != NULL) { 4265 *keyp = k; 4266 k = NULL; 4267 } 4268 if (commentp != NULL) { 4269 *commentp = comment; 4270 comment = NULL; 4271 } 4272 out: 4273 free(comment); 4274 sshbuf_free(decoded); 4275 sshbuf_free(decrypted); 4276 sshkey_free(k); 4277 sshkey_free(pubkey); 4278 return r; 4279 } 4280 4281 static int 4282 sshkey_parse_private2_pubkey(struct sshbuf *blob, int type, 4283 struct sshkey **keyp) 4284 { 4285 int r = SSH_ERR_INTERNAL_ERROR; 4286 struct sshbuf *decoded = NULL; 4287 struct sshkey *pubkey = NULL; 4288 u_int nkeys = 0; 4289 4290 if (keyp != NULL) 4291 *keyp = NULL; 4292 4293 if ((r = private2_uudecode(blob, &decoded)) != 0) 4294 goto out; 4295 /* parse public key from unencrypted envelope */ 4296 if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC))) != 0 || 4297 (r = sshbuf_skip_string(decoded)) != 0 || /* cipher */ 4298 (r = sshbuf_skip_string(decoded)) != 0 || /* KDF alg */ 4299 (r = sshbuf_skip_string(decoded)) != 0 || /* KDF hint */ 4300 (r = sshbuf_get_u32(decoded, &nkeys)) != 0) 4301 goto out; 4302 4303 if (nkeys != 1) { 4304 /* XXX only one key supported at present */ 4305 r = SSH_ERR_INVALID_FORMAT; 4306 goto out; 4307 } 4308 4309 /* Parse the public key */ 4310 if ((r = sshkey_froms(decoded, &pubkey)) != 0) 4311 goto out; 4312 4313 if (type != KEY_UNSPEC && 4314 sshkey_type_plain(type) != sshkey_type_plain(pubkey->type)) { 4315 r = SSH_ERR_KEY_TYPE_MISMATCH; 4316 goto out; 4317 } 4318 4319 /* success */ 4320 r = 0; 4321 if (keyp != NULL) { 4322 *keyp = pubkey; 4323 pubkey = NULL; 4324 } 4325 out: 4326 sshbuf_free(decoded); 4327 sshkey_free(pubkey); 4328 return r; 4329 } 4330 4331 #ifdef WITH_OPENSSL 4332 /* convert SSH v2 key to PEM or PKCS#8 format */ 4333 static int 4334 sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf, 4335 int format, const char *_passphrase, const char *comment) 4336 { 4337 int was_shielded = sshkey_is_shielded(key); 4338 int success, r; 4339 int blen, len = strlen(_passphrase); 4340 u_char *passphrase = (len > 0) ? (u_char *)_passphrase : NULL; 4341 const EVP_CIPHER *cipher = (len > 0) ? EVP_aes_128_cbc() : NULL; 4342 char *bptr; 4343 BIO *bio = NULL; 4344 struct sshbuf *blob; 4345 EVP_PKEY *pkey = NULL; 4346 4347 if (len > 0 && len <= 4) 4348 return SSH_ERR_PASSPHRASE_TOO_SHORT; 4349 if ((blob = sshbuf_new()) == NULL) 4350 return SSH_ERR_ALLOC_FAIL; 4351 if ((bio = BIO_new(BIO_s_mem())) == NULL) { 4352 r = SSH_ERR_ALLOC_FAIL; 4353 goto out; 4354 } 4355 if (format == SSHKEY_PRIVATE_PKCS8 && (pkey = EVP_PKEY_new()) == NULL) { 4356 r = SSH_ERR_ALLOC_FAIL; 4357 goto out; 4358 } 4359 if ((r = sshkey_unshield_private(key)) != 0) 4360 goto out; 4361 4362 switch (key->type) { 4363 case KEY_DSA: 4364 if (format == SSHKEY_PRIVATE_PEM) { 4365 success = PEM_write_bio_DSAPrivateKey(bio, key->dsa, 4366 cipher, passphrase, len, NULL, NULL); 4367 } else { 4368 success = EVP_PKEY_set1_DSA(pkey, key->dsa); 4369 } 4370 break; 4371 case KEY_ECDSA: 4372 if (format == SSHKEY_PRIVATE_PEM) { 4373 success = PEM_write_bio_ECPrivateKey(bio, key->ecdsa, 4374 cipher, passphrase, len, NULL, NULL); 4375 } else { 4376 success = EVP_PKEY_set1_EC_KEY(pkey, key->ecdsa); 4377 } 4378 break; 4379 case KEY_RSA: 4380 if (format == SSHKEY_PRIVATE_PEM) { 4381 success = PEM_write_bio_RSAPrivateKey(bio, key->rsa, 4382 cipher, passphrase, len, NULL, NULL); 4383 } else { 4384 success = EVP_PKEY_set1_RSA(pkey, key->rsa); 4385 } 4386 break; 4387 default: 4388 success = 0; 4389 break; 4390 } 4391 if (success == 0) { 4392 r = SSH_ERR_LIBCRYPTO_ERROR; 4393 goto out; 4394 } 4395 if (format == SSHKEY_PRIVATE_PKCS8) { 4396 if ((success = PEM_write_bio_PrivateKey(bio, pkey, cipher, 4397 passphrase, len, NULL, NULL)) == 0) { 4398 r = SSH_ERR_LIBCRYPTO_ERROR; 4399 goto out; 4400 } 4401 } 4402 if ((blen = BIO_get_mem_data(bio, &bptr)) <= 0) { 4403 r = SSH_ERR_INTERNAL_ERROR; 4404 goto out; 4405 } 4406 if ((r = sshbuf_put(blob, bptr, blen)) != 0) 4407 goto out; 4408 r = 0; 4409 out: 4410 if (was_shielded) 4411 r = sshkey_shield_private(key); 4412 if (r == 0) 4413 r = sshbuf_putb(buf, blob); 4414 4415 EVP_PKEY_free(pkey); 4416 sshbuf_free(blob); 4417 BIO_free(bio); 4418 return r; 4419 } 4420 #endif /* WITH_OPENSSL */ 4421 4422 /* Serialise "key" to buffer "blob" */ 4423 int 4424 sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob, 4425 const char *passphrase, const char *comment, 4426 int format, const char *openssh_format_cipher, int openssh_format_rounds) 4427 { 4428 switch (key->type) { 4429 #ifdef WITH_OPENSSL 4430 case KEY_DSA: 4431 case KEY_ECDSA: 4432 case KEY_RSA: 4433 break; /* see below */ 4434 #endif /* WITH_OPENSSL */ 4435 case KEY_ED25519: 4436 case KEY_ED25519_SK: 4437 #ifdef WITH_XMSS 4438 case KEY_XMSS: 4439 #endif /* WITH_XMSS */ 4440 #ifdef WITH_OPENSSL 4441 case KEY_ECDSA_SK: 4442 #endif /* WITH_OPENSSL */ 4443 return sshkey_private_to_blob2(key, blob, passphrase, 4444 comment, openssh_format_cipher, openssh_format_rounds); 4445 default: 4446 return SSH_ERR_KEY_TYPE_UNKNOWN; 4447 } 4448 4449 #ifdef WITH_OPENSSL 4450 switch (format) { 4451 case SSHKEY_PRIVATE_OPENSSH: 4452 return sshkey_private_to_blob2(key, blob, passphrase, 4453 comment, openssh_format_cipher, openssh_format_rounds); 4454 case SSHKEY_PRIVATE_PEM: 4455 case SSHKEY_PRIVATE_PKCS8: 4456 return sshkey_private_to_blob_pem_pkcs8(key, blob, 4457 format, passphrase, comment); 4458 default: 4459 return SSH_ERR_INVALID_ARGUMENT; 4460 } 4461 #endif /* WITH_OPENSSL */ 4462 } 4463 4464 #ifdef WITH_OPENSSL 4465 static int 4466 translate_libcrypto_error(unsigned long pem_err) 4467 { 4468 int pem_reason = ERR_GET_REASON(pem_err); 4469 4470 switch (ERR_GET_LIB(pem_err)) { 4471 case ERR_LIB_PEM: 4472 switch (pem_reason) { 4473 case PEM_R_BAD_PASSWORD_READ: 4474 case PEM_R_PROBLEMS_GETTING_PASSWORD: 4475 case PEM_R_BAD_DECRYPT: 4476 return SSH_ERR_KEY_WRONG_PASSPHRASE; 4477 default: 4478 return SSH_ERR_INVALID_FORMAT; 4479 } 4480 case ERR_LIB_EVP: 4481 switch (pem_reason) { 4482 case EVP_R_BAD_DECRYPT: 4483 return SSH_ERR_KEY_WRONG_PASSPHRASE; 4484 #ifdef EVP_R_BN_DECODE_ERROR 4485 case EVP_R_BN_DECODE_ERROR: 4486 #endif 4487 case EVP_R_DECODE_ERROR: 4488 #ifdef EVP_R_PRIVATE_KEY_DECODE_ERROR 4489 case EVP_R_PRIVATE_KEY_DECODE_ERROR: 4490 #endif 4491 return SSH_ERR_INVALID_FORMAT; 4492 default: 4493 return SSH_ERR_LIBCRYPTO_ERROR; 4494 } 4495 case ERR_LIB_ASN1: 4496 return SSH_ERR_INVALID_FORMAT; 4497 } 4498 return SSH_ERR_LIBCRYPTO_ERROR; 4499 } 4500 4501 static void 4502 clear_libcrypto_errors(void) 4503 { 4504 while (ERR_get_error() != 0) 4505 ; 4506 } 4507 4508 /* 4509 * Translate OpenSSL error codes to determine whether 4510 * passphrase is required/incorrect. 4511 */ 4512 static int 4513 convert_libcrypto_error(void) 4514 { 4515 /* 4516 * Some password errors are reported at the beginning 4517 * of the error queue. 4518 */ 4519 if (translate_libcrypto_error(ERR_peek_error()) == 4520 SSH_ERR_KEY_WRONG_PASSPHRASE) 4521 return SSH_ERR_KEY_WRONG_PASSPHRASE; 4522 return translate_libcrypto_error(ERR_peek_last_error()); 4523 } 4524 4525 static int 4526 sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, 4527 const char *passphrase, struct sshkey **keyp) 4528 { 4529 EVP_PKEY *pk = NULL; 4530 struct sshkey *prv = NULL; 4531 BIO *bio = NULL; 4532 int r; 4533 4534 if (keyp != NULL) 4535 *keyp = NULL; 4536 4537 if ((bio = BIO_new(BIO_s_mem())) == NULL || sshbuf_len(blob) > INT_MAX) 4538 return SSH_ERR_ALLOC_FAIL; 4539 if (BIO_write(bio, sshbuf_ptr(blob), sshbuf_len(blob)) != 4540 (int)sshbuf_len(blob)) { 4541 r = SSH_ERR_ALLOC_FAIL; 4542 goto out; 4543 } 4544 4545 clear_libcrypto_errors(); 4546 if ((pk = PEM_read_bio_PrivateKey(bio, NULL, NULL, 4547 (char *)passphrase)) == NULL) { 4548 /* 4549 * libcrypto may return various ASN.1 errors when attempting 4550 * to parse a key with an incorrect passphrase. 4551 * Treat all format errors as "incorrect passphrase" if a 4552 * passphrase was supplied. 4553 */ 4554 if (passphrase != NULL && *passphrase != '\0') 4555 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 4556 else 4557 r = convert_libcrypto_error(); 4558 goto out; 4559 } 4560 if (EVP_PKEY_base_id(pk) == EVP_PKEY_RSA && 4561 (type == KEY_UNSPEC || type == KEY_RSA)) { 4562 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 4563 r = SSH_ERR_ALLOC_FAIL; 4564 goto out; 4565 } 4566 prv->rsa = EVP_PKEY_get1_RSA(pk); 4567 prv->type = KEY_RSA; 4568 #ifdef DEBUG_PK 4569 RSA_print_fp(stderr, prv->rsa, 8); 4570 #endif 4571 if (RSA_blinding_on(prv->rsa, NULL) != 1) { 4572 r = SSH_ERR_LIBCRYPTO_ERROR; 4573 goto out; 4574 } 4575 if ((r = sshkey_check_rsa_length(prv, 0)) != 0) 4576 goto out; 4577 } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_DSA && 4578 (type == KEY_UNSPEC || type == KEY_DSA)) { 4579 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 4580 r = SSH_ERR_ALLOC_FAIL; 4581 goto out; 4582 } 4583 prv->dsa = EVP_PKEY_get1_DSA(pk); 4584 prv->type = KEY_DSA; 4585 #ifdef DEBUG_PK 4586 DSA_print_fp(stderr, prv->dsa, 8); 4587 #endif 4588 } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC && 4589 (type == KEY_UNSPEC || type == KEY_ECDSA)) { 4590 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 4591 r = SSH_ERR_ALLOC_FAIL; 4592 goto out; 4593 } 4594 prv->ecdsa = EVP_PKEY_get1_EC_KEY(pk); 4595 prv->type = KEY_ECDSA; 4596 prv->ecdsa_nid = sshkey_ecdsa_key_to_nid(prv->ecdsa); 4597 if (prv->ecdsa_nid == -1 || 4598 sshkey_curve_nid_to_name(prv->ecdsa_nid) == NULL || 4599 sshkey_ec_validate_public(EC_KEY_get0_group(prv->ecdsa), 4600 EC_KEY_get0_public_key(prv->ecdsa)) != 0 || 4601 sshkey_ec_validate_private(prv->ecdsa) != 0) { 4602 r = SSH_ERR_INVALID_FORMAT; 4603 goto out; 4604 } 4605 #ifdef DEBUG_PK 4606 if (prv != NULL && prv->ecdsa != NULL) 4607 sshkey_dump_ec_key(prv->ecdsa); 4608 #endif 4609 } else { 4610 r = SSH_ERR_INVALID_FORMAT; 4611 goto out; 4612 } 4613 r = 0; 4614 if (keyp != NULL) { 4615 *keyp = prv; 4616 prv = NULL; 4617 } 4618 out: 4619 BIO_free(bio); 4620 EVP_PKEY_free(pk); 4621 sshkey_free(prv); 4622 return r; 4623 } 4624 #endif /* WITH_OPENSSL */ 4625 4626 int 4627 sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type, 4628 const char *passphrase, struct sshkey **keyp, char **commentp) 4629 { 4630 int r = SSH_ERR_INTERNAL_ERROR; 4631 4632 if (keyp != NULL) 4633 *keyp = NULL; 4634 if (commentp != NULL) 4635 *commentp = NULL; 4636 4637 switch (type) { 4638 case KEY_ED25519: 4639 case KEY_XMSS: 4640 /* No fallback for new-format-only keys */ 4641 return sshkey_parse_private2(blob, type, passphrase, 4642 keyp, commentp); 4643 default: 4644 r = sshkey_parse_private2(blob, type, passphrase, keyp, 4645 commentp); 4646 /* Only fallback to PEM parser if a format error occurred. */ 4647 if (r != SSH_ERR_INVALID_FORMAT) 4648 return r; 4649 #ifdef WITH_OPENSSL 4650 return sshkey_parse_private_pem_fileblob(blob, type, 4651 passphrase, keyp); 4652 #else 4653 return SSH_ERR_INVALID_FORMAT; 4654 #endif /* WITH_OPENSSL */ 4655 } 4656 } 4657 4658 int 4659 sshkey_parse_private_fileblob(struct sshbuf *buffer, const char *passphrase, 4660 struct sshkey **keyp, char **commentp) 4661 { 4662 if (keyp != NULL) 4663 *keyp = NULL; 4664 if (commentp != NULL) 4665 *commentp = NULL; 4666 4667 return sshkey_parse_private_fileblob_type(buffer, KEY_UNSPEC, 4668 passphrase, keyp, commentp); 4669 } 4670 4671 void 4672 sshkey_sig_details_free(struct sshkey_sig_details *details) 4673 { 4674 freezero(details, sizeof(*details)); 4675 } 4676 4677 int 4678 sshkey_parse_pubkey_from_private_fileblob_type(struct sshbuf *blob, int type, 4679 struct sshkey **pubkeyp) 4680 { 4681 int r = SSH_ERR_INTERNAL_ERROR; 4682 4683 if (pubkeyp != NULL) 4684 *pubkeyp = NULL; 4685 /* only new-format private keys bundle a public key inside */ 4686 if ((r = sshkey_parse_private2_pubkey(blob, type, pubkeyp)) != 0) 4687 return r; 4688 return 0; 4689 } 4690 4691 #ifdef WITH_XMSS 4692 /* 4693 * serialize the key with the current state and forward the state 4694 * maxsign times. 4695 */ 4696 int 4697 sshkey_private_serialize_maxsign(struct sshkey *k, struct sshbuf *b, 4698 u_int32_t maxsign, int printerror) 4699 { 4700 int r, rupdate; 4701 4702 if (maxsign == 0 || 4703 sshkey_type_plain(k->type) != KEY_XMSS) 4704 return sshkey_private_serialize_opt(k, b, 4705 SSHKEY_SERIALIZE_DEFAULT); 4706 if ((r = sshkey_xmss_get_state(k, printerror)) != 0 || 4707 (r = sshkey_private_serialize_opt(k, b, 4708 SSHKEY_SERIALIZE_STATE)) != 0 || 4709 (r = sshkey_xmss_forward_state(k, maxsign)) != 0) 4710 goto out; 4711 r = 0; 4712 out: 4713 if ((rupdate = sshkey_xmss_update_state(k, printerror)) != 0) { 4714 if (r == 0) 4715 r = rupdate; 4716 } 4717 return r; 4718 } 4719 4720 u_int32_t 4721 sshkey_signatures_left(const struct sshkey *k) 4722 { 4723 if (sshkey_type_plain(k->type) == KEY_XMSS) 4724 return sshkey_xmss_signatures_left(k); 4725 return 0; 4726 } 4727 4728 int 4729 sshkey_enable_maxsign(struct sshkey *k, u_int32_t maxsign) 4730 { 4731 if (sshkey_type_plain(k->type) != KEY_XMSS) 4732 return SSH_ERR_INVALID_ARGUMENT; 4733 return sshkey_xmss_enable_maxsign(k, maxsign); 4734 } 4735 4736 int 4737 sshkey_set_filename(struct sshkey *k, const char *filename) 4738 { 4739 if (k == NULL) 4740 return SSH_ERR_INVALID_ARGUMENT; 4741 if (sshkey_type_plain(k->type) != KEY_XMSS) 4742 return 0; 4743 if (filename == NULL) 4744 return SSH_ERR_INVALID_ARGUMENT; 4745 if ((k->xmss_filename = strdup(filename)) == NULL) 4746 return SSH_ERR_ALLOC_FAIL; 4747 return 0; 4748 } 4749 #else 4750 int 4751 sshkey_private_serialize_maxsign(struct sshkey *k, struct sshbuf *b, 4752 u_int32_t maxsign, int printerror) 4753 { 4754 return sshkey_private_serialize_opt(k, b, SSHKEY_SERIALIZE_DEFAULT); 4755 } 4756 4757 u_int32_t 4758 sshkey_signatures_left(const struct sshkey *k) 4759 { 4760 return 0; 4761 } 4762 4763 int 4764 sshkey_enable_maxsign(struct sshkey *k, u_int32_t maxsign) 4765 { 4766 return SSH_ERR_INVALID_ARGUMENT; 4767 } 4768 4769 int 4770 sshkey_set_filename(struct sshkey *k, const char *filename) 4771 { 4772 if (k == NULL) 4773 return SSH_ERR_INVALID_ARGUMENT; 4774 return 0; 4775 } 4776 #endif /* WITH_XMSS */ 4777