- markus@cvs.openbsd.org 2001/06/26 02:47:07

     [ssh-keygen.c]
     allow loading a private RSA key to a cyberflex card.

2 files changed, 103 insertions, 20 deletions

diff --git a/ChangeLog b/ChangeLog
index 5507cab0d..2d9df43b5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -16,6 +16,9 @@
    - stevesk@cvs.openbsd.org 2001/06/25 20:26:37
      [auth2.c sshconnect2.c]
      prototype cleanup; ok markus@
+   - markus@cvs.openbsd.org 2001/06/26 02:47:07
+     [ssh-keygen.c]
+     allow loading a private RSA key to a cyberflex card.
 
 20010629
  - (bal) Removed net_aton() since we don't use it any more
@@ -5843,4 +5846,4 @@
  - Wrote replacements for strlcpy and mkdtemp
  - Released 1.0pre1
 
-$Id: ChangeLog,v 1.1348 2001/07/04 03:42:30 mouring Exp $
+$Id: ChangeLog,v 1.1349 2001/07/04 03:44:03 mouring Exp $
diff --git a/ssh-keygen.c b/ssh-keygen.c
index 95fcd6521..8ae261193 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -12,11 +12,15 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keygen.c,v 1.65 2001/06/24 05:35:33 markus Exp $");
+RCSID("$OpenBSD: ssh-keygen.c,v 1.66 2001/06/26 02:47:07 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/pem.h>
 
+#ifdef SMARTCARD
+#include <sectok.h>
+#endif
+
 #include "xmalloc.h"
 #include "key.h"
 #include "rsa.h"
@@ -28,6 +32,7 @@ RCSID("$OpenBSD: ssh-keygen.c,v 1.65 2001/06/24 05:35:33 markus Exp $");
 #include "log.h"
 #include "readpass.h"
 
+
 /* Number of bits in the RSA/DSA key.  This value can be changed on the command line. */
 int bits = 1024;
 
@@ -375,6 +380,92 @@ do_print_public(struct passwd *pw)
         exit(0);
 }
 
+#define NUM_RSA_KEY_ELEMENTS 5+1
+#define COPY_RSA_KEY(x, i) \
+        do { \
+                len = BN_num_bytes(prv->rsa->x); \
+                elements[i] = xmalloc(len); \
+error("#bytes %d", len); \
+                if (BN_bn2bin(prv->rsa->x, elements[i]) < 0) \
+                        goto done; \
+        } while(0)
+
+static void
+do_upload(struct passwd *pw, int reader)
+{
+#ifndef SMARTCARD
+        fatal("no support for smartcards.");
+#else
+        Key *prv = NULL;
+        struct stat st;
+        u_char *elements[NUM_RSA_KEY_ELEMENTS];
+        u_char key_fid[2];
+        u_char atr[256];
+        u_char AUT0[] = {0xad, 0x9f, 0x61, 0xfe, 0xfa, 0x20, 0xce, 0x63};
+        int len, status = 1, i, fd = -1, ret;
+        int cla = 0x00;
+
+        if (!have_identity)
+                ask_filename(pw, "Enter file in which the key is");
+        if (stat(identity_file, &st) < 0) {
+                perror(identity_file);
+                goto done;
+        }
+        prv = load_identity(identity_file);
+        if (prv == NULL) {
+                error("load failed");
+                goto done;
+        }
+{
+        prv->type = KEY_RSA;
+        key_write(prv, stderr);
+}
+        for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
+                elements[i] = NULL;
+        COPY_RSA_KEY(q, 0);
+        COPY_RSA_KEY(p, 1);
+        COPY_RSA_KEY(iqmp, 2);
+        COPY_RSA_KEY(dmq1, 3);
+        COPY_RSA_KEY(dmp1, 4);
+        COPY_RSA_KEY(n, 5);
+        len = BN_num_bytes(prv->rsa->n);
+        fd = scopen(reader, 0, NULL);
+        if (fd < 0) {
+                error("scopen failed %d.", fd);
+                goto done;
+        }
+        ret = screset(fd, atr, NULL);
+        if (ret <= 0) {
+                error("screset failed.");
+                goto done;
+        }
+        if (cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(AUT0)) < 0) {
+                error("cyberflex_verify_AUT0 failed");
+                goto done;
+        }
+        key_fid[0] = 0x00;
+        key_fid[1] = 0x12;
+        if (cyberflex_load_rsa_priv(fd, cla, key_fid, 5, 8*len, elements) < 0)
+                goto done;
+        log("cyberflex_load_rsa_priv done");
+        key_fid[0] = 0x73;
+        key_fid[1] = 0x68;
+        if (cyberflex_load_rsa_pub(fd, cla, key_fid, len, elements[5]) < 0)
+                goto done;
+        log("cyberflex_load_rsa_pub done");
+        status = 0;
+        log("loading key done");
+done:
+        if (prv)
+                key_free(prv);
+        for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
+                xfree(elements[i]);
+        if (fd != -1)
+                scclose(fd);
+        exit(status);
+#endif
+}
+
 static void
 do_fingerprint(struct passwd *pw)
 {
@@ -664,7 +755,7 @@ main(int ac, char **av)
         char dotsshdir[16 * 1024], comment[1024], *passphrase1, *passphrase2;
         Key *private, *public;
         struct passwd *pw;
-        int opt, type, fd;
+        int opt, type, fd, reader = -1;
         struct stat st;
         FILE *f;
 
@@ -688,7 +779,7 @@ main(int ac, char **av)
                 exit(1);
         }
 
-        while ((opt = getopt(ac, av, "deiqpclBRxXyb:f:t:P:N:C:")) != -1) {
+        while ((opt = getopt(ac, av, "deiqpclBRxXyb:f:t:u:P:N:C:")) != -1) {
                 switch (opt) {
                 case 'b':
                         bits = atoi(optarg);
@@ -697,73 +788,60 @@ main(int ac, char **av)
                                 exit(1);
                         }
                         break;
-
                 case 'l':
                         print_fingerprint = 1;
                         break;
-
                 case 'B':
                         print_bubblebabble = 1;
                         break;
-
                 case 'p':
                         change_passphrase = 1;
                         break;
-
                 case 'c':
                         change_comment = 1;
                         break;
-
                 case 'f':
                         strlcpy(identity_file, optarg, sizeof(identity_file));
                         have_identity = 1;
                         break;
-
                 case 'P':
                         identity_passphrase = optarg;
                         break;
-
                 case 'N':
                         identity_new_passphrase = optarg;
                         break;
-
                 case 'C':
                         identity_comment = optarg;
                         break;
-
                 case 'q':
                         quiet = 1;
                         break;
-
                 case 'R':
                         /* unused */
                         exit(0);
                         break;
-
                 case 'e':
                 case 'x':
                         /* export key */
                         convert_to_ssh2 = 1;
                         break;
-
                 case 'i':
                 case 'X':
                         /* import key */
                         convert_from_ssh2 = 1;
                         break;
-
                 case 'y':
                         print_public = 1;
                         break;
-
                 case 'd':
                         key_type_name = "dsa";
                         break;
-
                 case 't':
                         key_type_name = optarg;
                         break;
-
+                case 'u':
+                        reader = atoi(optarg); /*XXX*/
+                        break;
                 case '?':
                 default:
                         usage();
@@ -789,6 +867,8 @@ main(int ac, char **av)
                 do_convert_from_ssh2(pw);
         if (print_public)
                 do_print_public(pw);
+        if (reader != -1)
+                do_upload(pw, reader);
 
         arc4random_stir();