29 #include <sys/types.h>
32 #include <openssl/rsa.h>
33 #include <openssl/dsa.h>
34 # ifdef OPENSSL_HAS_ECC
35 # include <openssl/ec.h>
36 # include <openssl/ecdsa.h>
39 # define EC_GROUP void
40 # define EC_POINT void
42 #define SSH_OPENSSL_VERSION OpenSSL_version(OPENSSL_VERSION)
48 # define EC_GROUP void
49 # define EC_POINT void
50 #define SSH_OPENSSL_VERSION "without OpenSSL"
53 #define SSH_RSA_MINIMUM_MODULUS_SIZE 1024
54 #define SSH_KEY_MAX_SIGN_DATA_SIZE (1 << 20)
79 #define SSH_FP_HASH_DEFAULT SSH_DIGEST_SHA256
91 enum sshkey_serialize_rep {
92 SSHKEY_SERIALIZE_DEFAULT = 0,
93 SSHKEY_SERIALIZE_STATE = 1,
94 SSHKEY_SERIALIZE_FULL = 2,
95 SSHKEY_SERIALIZE_SHIELD = 3,
96 SSHKEY_SERIALIZE_INFO = 254,
100 enum sshkey_private_format {
101 SSHKEY_PRIVATE_OPENSSH = 0,
102 SSHKEY_PRIVATE_PEM = 1,
103 SSHKEY_PRIVATE_PKCS8 = 2,
107 #define SSHKEY_FLAG_EXT 0x0001
109 #define SSHKEY_CERT_MAX_PRINCIPALS 256
112 struct sshbuf *certblob;
118 u_int64_t valid_after, valid_before;
119 struct sshbuf *critical;
120 struct sshbuf *extensions;
121 struct sshkey *signature_key;
122 char *signature_type;
146 char *sk_application;
148 struct sshbuf *sk_key_handle;
149 struct sshbuf *sk_reserved;
151 struct sshkey_cert *cert;
153 u_char *shielded_private;
155 u_char *shield_prekey;
156 size_t shield_prekey_len;
159 #define ED25519_SK_SZ crypto_sign_ed25519_SECRETKEYBYTES
160 #define ED25519_PK_SZ crypto_sign_ed25519_PUBLICKEYBYTES
163 struct sshkey_sig_details {
168 struct sshkey *sshkey_new(
int);
169 void sshkey_free(
struct sshkey *);
170 int sshkey_equal_public(
const struct sshkey *,
171 const struct sshkey *);
172 int sshkey_equal(
const struct sshkey *,
const struct sshkey *);
173 char *sshkey_fingerprint(
const struct sshkey *,
174 int,
enum sshkey_fp_rep);
175 int sshkey_fingerprint_raw(
const struct sshkey *k,
176 int, u_char **retp,
size_t *lenp);
177 const char *sshkey_type(
const struct sshkey *);
178 const char *sshkey_cert_type(
const struct sshkey *);
179 int sshkey_format_text(
const struct sshkey *,
struct sshbuf *);
180 int sshkey_write(
const struct sshkey *, FILE *);
181 int sshkey_read(
struct sshkey *,
char **);
182 u_int sshkey_size(
const struct sshkey *);
184 int sshkey_generate(
int type, u_int bits,
struct sshkey **keyp);
185 int sshkey_from_private(
const struct sshkey *,
struct sshkey **);
187 int sshkey_is_shielded(
struct sshkey *);
188 int sshkey_shield_private(
struct sshkey *);
189 int sshkey_unshield_private(
struct sshkey *);
191 int sshkey_type_from_name(
const char *);
192 int sshkey_is_private(
const struct sshkey *);
193 int sshkey_is_cert(
const struct sshkey *);
194 int sshkey_is_sk(
const struct sshkey *);
195 int sshkey_type_is_cert(
int);
196 int sshkey_type_plain(
int);
197 int sshkey_to_certified(
struct sshkey *);
198 int sshkey_drop_cert(
struct sshkey *);
199 int sshkey_cert_copy(
const struct sshkey *,
struct sshkey *);
200 int sshkey_cert_check_authority(
const struct sshkey *,
int,
int,
int,
201 uint64_t,
const char *,
const char **);
202 int sshkey_cert_check_authority_now(
const struct sshkey *,
int,
int,
int,
203 const char *,
const char **);
204 int sshkey_cert_check_host(
const struct sshkey *,
const char *,
205 int ,
const char *,
const char **);
206 size_t sshkey_format_cert_validity(
const struct sshkey_cert *,
207 char *,
size_t) __attribute__((__bounded__(__string__, 2, 3)));
208 int sshkey_check_cert_sigtype(const struct sshkey *, const
char *);
210 int sshkey_certify(struct sshkey *, struct sshkey *,
211 const
char *, const
char *, const
char *);
213 typedef
int sshkey_certify_signer(struct sshkey *, u_char **,
size_t *,
214 const u_char *,
size_t, const
char *, const
char *, const
char *,
216 int sshkey_certify_custom(struct sshkey *, struct sshkey *, const
char *,
217 const
char *, const
char *, sshkey_certify_signer *,
void *);
219 int sshkey_ecdsa_nid_from_name(const
char *);
220 int sshkey_curve_name_to_nid(const
char *);
221 const
char * sshkey_curve_nid_to_name(
int);
222 u_int sshkey_curve_nid_to_bits(
int);
223 int sshkey_ecdsa_bits_to_nid(
int);
224 int sshkey_ecdsa_key_to_nid(EC_KEY *);
225 int sshkey_ec_nid_to_hash_alg(
int nid);
226 int sshkey_ec_validate_public(const EC_GROUP *, const EC_POINT *);
227 int sshkey_ec_validate_private(const EC_KEY *);
228 const
char *sshkey_ssh_name(const struct sshkey *);
229 const
char *sshkey_ssh_name_plain(const struct sshkey *);
230 int sshkey_names_valid2(const
char *,
int);
231 char *sshkey_alg_list(
int,
int,
int,
char);
232 int sshkey_calculate_signature(EVP_PKEY*,
int, u_char **,
233 int *, const u_char *,
size_t);
234 int sshkey_verify_signature(EVP_PKEY *,
int, const u_char *,
235 size_t, u_char *,
int);
237 int sshkey_from_blob(const u_char *,
size_t, struct sshkey **);
238 int sshkey_fromb(struct sshbuf *, struct sshkey **);
239 int sshkey_froms(struct sshbuf *, struct sshkey **);
240 int sshkey_to_blob(const struct sshkey *, u_char **,
size_t *);
241 int sshkey_to_base64(const struct sshkey *,
char **);
242 int sshkey_putb(const struct sshkey *, struct sshbuf *);
243 int sshkey_puts(const struct sshkey *, struct sshbuf *);
244 int sshkey_puts_opts(const struct sshkey *, struct sshbuf *,
245 enum sshkey_serialize_rep);
246 int sshkey_plain_to_blob(const struct sshkey *, u_char **,
size_t *);
247 int sshkey_putb_plain(const struct sshkey *, struct sshbuf *);
249 int sshkey_sign(struct sshkey *, u_char **,
size_t *,
250 const u_char *,
size_t, const
char *, const
char *, const
char *, u_int);
251 int sshkey_verify(const struct sshkey *, const u_char *,
size_t,
252 const u_char *,
size_t, const
char *, u_int, struct sshkey_sig_details **);
253 int sshkey_check_sigtype(const u_char *,
size_t, const
char *);
254 const
char *sshkey_sigalg_by_name(const
char *);
255 int sshkey_get_sigtype(const u_char *,
size_t,
char **);
258 void sshkey_dump_ec_point(const EC_GROUP *, const EC_POINT *);
259 void sshkey_dump_ec_key(const EC_KEY *);
262 int sshkey_private_serialize(struct sshkey *key, struct sshbuf *buf);
263 int sshkey_private_serialize_opt(struct sshkey *key, struct sshbuf *buf,
264 enum sshkey_serialize_rep);
265 int sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **keyp);
268 int sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob,
269 const
char *passphrase, const
char *comment,
270 int format, const
char *openssh_format_cipher,
int openssh_format_rounds);
271 int sshkey_parse_private_fileblob(struct sshbuf *buffer,
272 const
char *passphrase, struct sshkey **keyp,
char **commentp);
273 int sshkey_parse_private_fileblob_type(struct sshbuf *blob,
int type,
274 const
char *passphrase, struct sshkey **keyp,
char **commentp);
275 int sshkey_parse_pubkey_from_private_fileblob_type(struct sshbuf *blob,
276 int type, struct sshkey **pubkeyp);
279 int ssh_rsa_complete_crt_parameters(struct sshkey *, const BIGNUM *);
282 int sshkey_set_filename(struct sshkey *, const
char *);
283 int sshkey_enable_maxsign(struct sshkey *, u_int32_t);
284 u_int32_t sshkey_signatures_left(const struct sshkey *);
285 int sshkey_forward_state(const struct sshkey *, u_int32_t,
int);
286 int sshkey_private_serialize_maxsign(struct sshkey *key,
287 struct sshbuf *buf, u_int32_t maxsign,
int);
289 void sshkey_sig_details_free(struct sshkey_sig_details *);
291 #ifdef SSHKEY_INTERNAL
292 int ssh_rsa_sign(
const struct sshkey *key,
293 u_char **sigp,
size_t *lenp,
const u_char *data,
size_t datalen,
295 int ssh_rsa_verify(
const struct sshkey *key,
296 const u_char *sig,
size_t siglen,
const u_char *data,
size_t datalen,
298 int ssh_dss_sign(
const struct sshkey *key, u_char **sigp,
size_t *lenp,
299 const u_char *data,
size_t datalen, u_int compat);
300 int ssh_dss_verify(
const struct sshkey *key,
301 const u_char *signature,
size_t signaturelen,
302 const u_char *data,
size_t datalen, u_int compat);
303 int ssh_ecdsa_sign(
const struct sshkey *key, u_char **sigp,
size_t *lenp,
304 const u_char *data,
size_t datalen, u_int compat);
305 int ssh_ecdsa_verify(
const struct sshkey *key,
306 const u_char *signature,
size_t signaturelen,
307 const u_char *data,
size_t datalen, u_int compat);
308 int ssh_ecdsa_sk_verify(
const struct sshkey *key,
309 const u_char *signature,
size_t signaturelen,
310 const u_char *data,
size_t datalen, u_int compat,
311 struct sshkey_sig_details **detailsp);
312 int ssh_ed25519_sign(
const struct sshkey *key, u_char **sigp,
size_t *lenp,
313 const u_char *data,
size_t datalen, u_int compat);
314 int ssh_ed25519_verify(
const struct sshkey *key,
315 const u_char *signature,
size_t signaturelen,
316 const u_char *data,
size_t datalen, u_int compat);
317 int ssh_ed25519_sk_verify(
const struct sshkey *key,
318 const u_char *signature,
size_t signaturelen,
319 const u_char *data,
size_t datalen, u_int compat,
320 struct sshkey_sig_details **detailsp);
321 int ssh_xmss_sign(
const struct sshkey *key, u_char **sigp,
size_t *lenp,
322 const u_char *data,
size_t datalen, u_int compat);
323 int ssh_xmss_verify(
const struct sshkey *key,
324 const u_char *signature,
size_t signaturelen,
325 const u_char *data,
size_t datalen, u_int compat);
328 #if !defined(WITH_OPENSSL)
334 #elif !defined(OPENSSL_HAS_ECC)