New upstream release (7.9p1)

1 files changed, 467 insertions, 349 deletions

diff --git a/sshkey.c b/sshkey.c
index 91e99a262..a85c185fc 100644
--- a/sshkey.c
+++ b/sshkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshkey.c,v 1.66 2018/07/03 13:20:25 djm Exp $ */
+/* $OpenBSD: sshkey.c,v 1.72 2018/10/11 00:52:46 djm Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Alexander von Gernler.  All rights reserved.
@@ -60,6 +60,8 @@
 
 #include "xmss_fast.h"
 
+#include "openbsd-compat/openssl-compat.h"
+
 /* openssh private key file format */
 #define MARK_BEGIN              "-----BEGIN OPENSSH PRIVATE KEY-----\n"
 #define MARK_END                "-----END OPENSSH PRIVATE KEY-----\n"
@@ -78,6 +80,7 @@ int	sshkey_private_serialize_opt(const struct sshkey *key,
     struct sshbuf *buf, enum sshkey_serialize_rep);
 static int sshkey_from_blob_internal(struct sshbuf *buf,
     struct sshkey **keyp, int allow_cert);
+static int get_sigtype(const u_char *sig, size_t siglen, char **sigtypep);
 
 /* Supported key types */
 struct keytype {
@@ -116,17 +119,9 @@ static const struct keytype keytypes[] = {
         { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", NULL,
             KEY_RSA_CERT, 0, 1, 0 },
         { "rsa-sha2-256-cert-v01@openssh.com", "RSA-CERT",
-            "ssh-rsa-sha2-256", KEY_RSA_CERT, 0, 1, 1 },
-        { "rsa-sha2-512-cert-v01@openssh.com", "RSA-CERT",
-            "ssh-rsa-sha2-512", KEY_RSA_CERT, 0, 1, 1 },
-        { "ssh-dss-cert-v01@openssh.com", "DSA-CERT", NULL,
-            KEY_DSA_CERT, 0, 1, 0 },
-        { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", NULL,
-            KEY_RSA_CERT, 0, 1, 0 },
-        { "rsa-sha2-256-cert-v01@openssh.com", "RSA-CERT",
-            "ssh-rsa-sha2-256", KEY_RSA_CERT, 0, 1, 1 },
+            "rsa-sha2-256", KEY_RSA_CERT, 0, 1, 1 },
         { "rsa-sha2-512-cert-v01@openssh.com", "RSA-CERT",
-            "ssh-rsa-sha2-512", KEY_RSA_CERT, 0, 1, 1 },
+            "rsa-sha2-512", KEY_RSA_CERT, 0, 1, 1 },
         { "ssh-dss-cert-v01@openssh.com", "DSA-CERT", NULL,
             KEY_DSA_CERT, 0, 1, 0 },
 # ifdef OPENSSL_HAS_ECC
@@ -289,14 +284,24 @@ sshkey_names_valid2(const char *names, int allow_wildcard)
 u_int
 sshkey_size(const struct sshkey *k)
 {
+#ifdef WITH_OPENSSL
+        const BIGNUM *rsa_n, *dsa_p;
+#endif /* WITH_OPENSSL */
+
         switch (k->type) {
 #ifdef WITH_OPENSSL
         case KEY_RSA:
         case KEY_RSA_CERT:
-                return BN_num_bits(k->rsa->n);
+                if (k->rsa == NULL)
+                        return 0;
+                RSA_get0_key(k->rsa, &rsa_n, NULL, NULL);
+                return BN_num_bits(rsa_n);
         case KEY_DSA:
         case KEY_DSA_CERT:
-                return BN_num_bits(k->dsa->p);
+                if (k->dsa == NULL)
+                        return 0;
+                DSA_get0_pqg(k->dsa, &dsa_p, NULL, NULL);
+                return BN_num_bits(dsa_p);
         case KEY_ECDSA:
         case KEY_ECDSA_CERT:
                 return sshkey_curve_nid_to_bits(k->ecdsa_nid);
@@ -454,6 +459,7 @@ cert_free(struct sshkey_cert *cert)
                 free(cert->principals[i]);
         free(cert->principals);
         sshkey_free(cert->signature_key);
+        free(cert->signature_type);
         freezero(cert, sizeof(*cert));
 }
 
@@ -473,6 +479,7 @@ cert_new(void)
         cert->key_id = NULL;
         cert->principals = NULL;
         cert->signature_key = NULL;
+        cert->signature_type = NULL;
         return cert;
 }
 
@@ -501,10 +508,7 @@ sshkey_new(int type)
 #ifdef WITH_OPENSSL
         case KEY_RSA:
         case KEY_RSA_CERT:
-                if ((rsa = RSA_new()) == NULL ||
-                    (rsa->n = BN_new()) == NULL ||
-                    (rsa->e = BN_new()) == NULL) {
-                        RSA_free(rsa);
+                if ((rsa = RSA_new()) == NULL) {
                         free(k);
                         return NULL;
                 }
@@ -512,12 +516,7 @@ sshkey_new(int type)
                 break;
         case KEY_DSA:
         case KEY_DSA_CERT:
-                if ((dsa = DSA_new()) == NULL ||
-                    (dsa->p = BN_new()) == NULL ||
-                    (dsa->q = BN_new()) == NULL ||
-                    (dsa->g = BN_new()) == NULL ||
-                    (dsa->pub_key = BN_new()) == NULL) {
-                        DSA_free(dsa);
+                if ((dsa = DSA_new()) == NULL) {
                         free(k);
                         return NULL;
                 }
@@ -551,61 +550,6 @@ sshkey_new(int type)
         return k;
 }
 
-int
-sshkey_add_private(struct sshkey *k)
-{
-        switch (k->type) {
-#ifdef WITH_OPENSSL
-        case KEY_RSA:
-        case KEY_RSA_CERT:
-#define bn_maybe_alloc_failed(p) (p == NULL && (p = BN_new()) == NULL)
-                if (bn_maybe_alloc_failed(k->rsa->d) ||
-                    bn_maybe_alloc_failed(k->rsa->iqmp) ||
-                    bn_maybe_alloc_failed(k->rsa->q) ||
-                    bn_maybe_alloc_failed(k->rsa->p) ||
-                    bn_maybe_alloc_failed(k->rsa->dmq1) ||
-                    bn_maybe_alloc_failed(k->rsa->dmp1))
-                        return SSH_ERR_ALLOC_FAIL;
-                break;
-        case KEY_DSA:
-        case KEY_DSA_CERT:
-                if (bn_maybe_alloc_failed(k->dsa->priv_key))
-                        return SSH_ERR_ALLOC_FAIL;
-                break;
-#undef bn_maybe_alloc_failed
-        case KEY_ECDSA:
-        case KEY_ECDSA_CERT:
-                /* Cannot do anything until we know the group */
-                break;
-#endif /* WITH_OPENSSL */
-        case KEY_ED25519:
-        case KEY_ED25519_CERT:
-        case KEY_XMSS:
-        case KEY_XMSS_CERT:
-                /* no need to prealloc */
-                break;
-        case KEY_UNSPEC:
-                break;
-        default:
-                return SSH_ERR_INVALID_ARGUMENT;
-        }
-        return 0;
-}
-
-struct sshkey *
-sshkey_new_private(int type)
-{
-        struct sshkey *k = sshkey_new(type);
-
-        if (k == NULL)
-                return NULL;
-        if (sshkey_add_private(k) != 0) {
-                sshkey_free(k);
-                return NULL;
-        }
-        return k;
-}
-
 void
 sshkey_free(struct sshkey *k)
 {
@@ -684,9 +628,15 @@ cert_compare(struct sshkey_cert *a, struct sshkey_cert *b)
 int
 sshkey_equal_public(const struct sshkey *a, const struct sshkey *b)
 {
-#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
+#if defined(WITH_OPENSSL)
+        const BIGNUM *rsa_e_a, *rsa_n_a;
+        const BIGNUM *rsa_e_b, *rsa_n_b;
+        const BIGNUM *dsa_p_a, *dsa_q_a, *dsa_g_a, *dsa_pub_key_a;
+        const BIGNUM *dsa_p_b, *dsa_q_b, *dsa_g_b, *dsa_pub_key_b;
+# if defined(OPENSSL_HAS_ECC)
         BN_CTX *bnctx;
-#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
 
         if (a == NULL || b == NULL ||
             sshkey_type_plain(a->type) != sshkey_type_plain(b->type))
@@ -696,16 +646,24 @@ sshkey_equal_public(const struct sshkey *a, const struct sshkey *b)
 #ifdef WITH_OPENSSL
         case KEY_RSA_CERT:
         case KEY_RSA:
-                return a->rsa != NULL && b->rsa != NULL &&
-                    BN_cmp(a->rsa->e, b->rsa->e) == 0 &&
-                    BN_cmp(a->rsa->n, b->rsa->n) == 0;
+                if (a->rsa == NULL || b->rsa == NULL)
+                        return 0;
+                RSA_get0_key(a->rsa, &rsa_n_a, &rsa_e_a, NULL);
+                RSA_get0_key(b->rsa, &rsa_n_b, &rsa_e_b, NULL);
+                return BN_cmp(rsa_e_a, rsa_e_b) == 0 &&
+                    BN_cmp(rsa_n_a, rsa_n_b) == 0;
         case KEY_DSA_CERT:
         case KEY_DSA:
-                return a->dsa != NULL && b->dsa != NULL &&
-                    BN_cmp(a->dsa->p, b->dsa->p) == 0 &&
-                    BN_cmp(a->dsa->q, b->dsa->q) == 0 &&
-                    BN_cmp(a->dsa->g, b->dsa->g) == 0 &&
-                    BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0;
+                if (a->dsa == NULL || b->dsa == NULL)
+                        return 0;
+                DSA_get0_pqg(a->dsa, &dsa_p_a, &dsa_q_a, &dsa_g_a);
+                DSA_get0_pqg(b->dsa, &dsa_p_b, &dsa_q_b, &dsa_g_b);
+                DSA_get0_key(a->dsa, &dsa_pub_key_a, NULL);
+                DSA_get0_key(b->dsa, &dsa_pub_key_b, NULL);
+                return BN_cmp(dsa_p_a, dsa_p_b) == 0 &&
+                    BN_cmp(dsa_q_a, dsa_q_b) == 0 &&
+                    BN_cmp(dsa_g_a, dsa_g_b) == 0 &&
+                    BN_cmp(dsa_pub_key_a, dsa_pub_key_b) == 0;
 # ifdef OPENSSL_HAS_ECC
         case KEY_ECDSA_CERT:
         case KEY_ECDSA:
@@ -762,6 +720,9 @@ to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain,
 {
         int type, ret = SSH_ERR_INTERNAL_ERROR;
         const char *typename;
+#ifdef WITH_OPENSSL
+        const BIGNUM *rsa_n, *rsa_e, *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key;
+#endif /* WITH_OPENSSL */
 
         if (key == NULL)
                 return SSH_ERR_INVALID_ARGUMENT;
@@ -794,11 +755,13 @@ to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain,
         case KEY_DSA:
                 if (key->dsa == NULL)
                         return SSH_ERR_INVALID_ARGUMENT;
+                DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g);
+                DSA_get0_key(key->dsa, &dsa_pub_key, NULL);
                 if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
-                    (ret = sshbuf_put_bignum2(b, key->dsa->p)) != 0 ||
-                    (ret = sshbuf_put_bignum2(b, key->dsa->q)) != 0 ||
-                    (ret = sshbuf_put_bignum2(b, key->dsa->g)) != 0 ||
-                    (ret = sshbuf_put_bignum2(b, key->dsa->pub_key)) != 0)
+                    (ret = sshbuf_put_bignum2(b, dsa_p)) != 0 ||
+                    (ret = sshbuf_put_bignum2(b, dsa_q)) != 0 ||
+                    (ret = sshbuf_put_bignum2(b, dsa_g)) != 0 ||
+                    (ret = sshbuf_put_bignum2(b, dsa_pub_key)) != 0)
                         return ret;
                 break;
 # ifdef OPENSSL_HAS_ECC
@@ -815,9 +778,10 @@ to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain,
         case KEY_RSA:
                 if (key->rsa == NULL)
                         return SSH_ERR_INVALID_ARGUMENT;
+                RSA_get0_key(key->rsa, &rsa_n, &rsa_e, NULL);
                 if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
-                    (ret = sshbuf_put_bignum2(b, key->rsa->e)) != 0 ||
-                    (ret = sshbuf_put_bignum2(b, key->rsa->n)) != 0)
+                    (ret = sshbuf_put_bignum2(b, rsa_e)) != 0 ||
+                    (ret = sshbuf_put_bignum2(b, rsa_n)) != 0)
                         return ret;
                 break;
 #endif /* WITH_OPENSSL */
@@ -1696,114 +1660,163 @@ sshkey_cert_copy(const struct sshkey *from_key, struct sshkey *to_key)
         u_int i;
         const struct sshkey_cert *from;
         struct sshkey_cert *to;
-        int ret = SSH_ERR_INTERNAL_ERROR;
-
-        if (to_key->cert != NULL) {
-                cert_free(to_key->cert);
-                to_key->cert = NULL;
-        }
+        int r = SSH_ERR_INTERNAL_ERROR;
 
-        if ((from = from_key->cert) == NULL)
+        if (to_key == NULL || (from = from_key->cert) == NULL)
                 return SSH_ERR_INVALID_ARGUMENT;
 
-        if ((to = to_key->cert = cert_new()) == NULL)
+        if ((to = cert_new()) == NULL)
                 return SSH_ERR_ALLOC_FAIL;
 
-        if ((ret = sshbuf_putb(to->certblob, from->certblob)) != 0 ||
-            (ret = sshbuf_putb(to->critical, from->critical)) != 0 ||
-            (ret = sshbuf_putb(to->extensions, from->extensions)) != 0)
-                return ret;
+        if ((r = sshbuf_putb(to->certblob, from->certblob)) != 0 ||
+            (r = sshbuf_putb(to->critical, from->critical)) != 0 ||
+            (r = sshbuf_putb(to->extensions, from->extensions)) != 0)
+                goto out;
 
         to->serial = from->serial;
         to->type = from->type;
         if (from->key_id == NULL)
                 to->key_id = NULL;
-        else if ((to->key_id = strdup(from->key_id)) == NULL)
-                return SSH_ERR_ALLOC_FAIL;
+        else if ((to->key_id = strdup(from->key_id)) == NULL) {
+                r = SSH_ERR_ALLOC_FAIL;
+                goto out;
+        }
         to->valid_after = from->valid_after;
         to->valid_before = from->valid_before;
         if (from->signature_key == NULL)
                 to->signature_key = NULL;
-        else if ((ret = sshkey_from_private(from->signature_key,
+        else if ((r = sshkey_from_private(from->signature_key,
             &to->signature_key)) != 0)
-                return ret;
-
-        if (from->nprincipals > SSHKEY_CERT_MAX_PRINCIPALS)
-                return SSH_ERR_INVALID_ARGUMENT;
+                goto out;
+        if (from->signature_type != NULL &&
+            (to->signature_type = strdup(from->signature_type)) == NULL) {
+                r = SSH_ERR_ALLOC_FAIL;
+                goto out;
+        }
+        if (from->nprincipals > SSHKEY_CERT_MAX_PRINCIPALS) {
+                r = SSH_ERR_INVALID_ARGUMENT;
+                goto out;
+        }
         if (from->nprincipals > 0) {
                 if ((to->principals = calloc(from->nprincipals,
-                    sizeof(*to->principals))) == NULL)
-                        return SSH_ERR_ALLOC_FAIL;
+                    sizeof(*to->principals))) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
                 for (i = 0; i < from->nprincipals; i++) {
                         to->principals[i] = strdup(from->principals[i]);
                         if (to->principals[i] == NULL) {
                                 to->nprincipals = i;
-                                return SSH_ERR_ALLOC_FAIL;
+                                r = SSH_ERR_ALLOC_FAIL;
+                                goto out;
                         }
                 }
         }
         to->nprincipals = from->nprincipals;
-        return 0;
+
+        /* success */
+        cert_free(to_key->cert);
+        to_key->cert = to;
+        to = NULL;
+        r = 0;
+ out:
+        cert_free(to);
+        return r;
 }
 
 int
 sshkey_from_private(const struct sshkey *k, struct sshkey **pkp)
 {
         struct sshkey *n = NULL;
-        int ret = SSH_ERR_INTERNAL_ERROR;
+        int r = SSH_ERR_INTERNAL_ERROR;
+#ifdef WITH_OPENSSL
+        const BIGNUM *rsa_n, *rsa_e;
+        BIGNUM *rsa_n_dup = NULL, *rsa_e_dup = NULL;
+        const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key;
+        BIGNUM *dsa_p_dup = NULL, *dsa_q_dup = NULL, *dsa_g_dup = NULL;
+        BIGNUM *dsa_pub_key_dup = NULL;
+#endif /* WITH_OPENSSL */
 
         *pkp = NULL;
         switch (k->type) {
 #ifdef WITH_OPENSSL
         case KEY_DSA:
         case KEY_DSA_CERT:
-                if ((n = sshkey_new(k->type)) == NULL)
-                        return SSH_ERR_ALLOC_FAIL;
-                if ((BN_copy(n->dsa->p, k->dsa->p) == NULL) ||
-                    (BN_copy(n->dsa->q, k->dsa->q) == NULL) ||
-                    (BN_copy(n->dsa->g, k->dsa->g) == NULL) ||
-                    (BN_copy(n->dsa->pub_key, k->dsa->pub_key) == NULL)) {
-                        sshkey_free(n);
-                        return SSH_ERR_ALLOC_FAIL;
+                if ((n = sshkey_new(k->type)) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
                 }
+
+                DSA_get0_pqg(k->dsa, &dsa_p, &dsa_q, &dsa_g);
+                DSA_get0_key(k->dsa, &dsa_pub_key, NULL);
+                if ((dsa_p_dup = BN_dup(dsa_p)) == NULL ||
+                    (dsa_q_dup = BN_dup(dsa_q)) == NULL ||
+                    (dsa_g_dup = BN_dup(dsa_g)) == NULL ||
+                    (dsa_pub_key_dup = BN_dup(dsa_pub_key)) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
+                if (!DSA_set0_pqg(n->dsa, dsa_p_dup, dsa_q_dup, dsa_g_dup)) {
+                        r = SSH_ERR_LIBCRYPTO_ERROR;
+                        goto out;
+                }
+                dsa_p_dup = dsa_q_dup = dsa_g_dup = NULL; /* transferred */
+                if (!DSA_set0_key(n->dsa, dsa_pub_key_dup, NULL)) {
+                        r = SSH_ERR_LIBCRYPTO_ERROR;
+                        goto out;
+                }
+                dsa_pub_key_dup = NULL; /* transferred */
+
                 break;
 # ifdef OPENSSL_HAS_ECC
         case KEY_ECDSA:
         case KEY_ECDSA_CERT:
-                if ((n = sshkey_new(k->type)) == NULL)
-                        return SSH_ERR_ALLOC_FAIL;
+                if ((n = sshkey_new(k->type)) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
                 n->ecdsa_nid = k->ecdsa_nid;
                 n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid);
                 if (n->ecdsa == NULL) {
-                        sshkey_free(n);
-                        return SSH_ERR_ALLOC_FAIL;
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
                 }
                 if (EC_KEY_set_public_key(n->ecdsa,
                     EC_KEY_get0_public_key(k->ecdsa)) != 1) {
-                        sshkey_free(n);
-                        return SSH_ERR_LIBCRYPTO_ERROR;
+                        r = SSH_ERR_LIBCRYPTO_ERROR;
+                        goto out;
                 }
                 break;
 # endif /* OPENSSL_HAS_ECC */
         case KEY_RSA:
         case KEY_RSA_CERT:
-                if ((n = sshkey_new(k->type)) == NULL)
-                        return SSH_ERR_ALLOC_FAIL;
-                if ((BN_copy(n->rsa->n, k->rsa->n) == NULL) ||
-                    (BN_copy(n->rsa->e, k->rsa->e) == NULL)) {
-                        sshkey_free(n);
-                        return SSH_ERR_ALLOC_FAIL;
+                if ((n = sshkey_new(k->type)) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
                 }
+                RSA_get0_key(k->rsa, &rsa_n, &rsa_e, NULL);
+                if ((rsa_n_dup = BN_dup(rsa_n)) == NULL ||
+                    (rsa_e_dup = BN_dup(rsa_e)) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
+                if (!RSA_set0_key(n->rsa, rsa_n_dup, rsa_e_dup, NULL)) {
+                        r = SSH_ERR_LIBCRYPTO_ERROR;
+                        goto out;
+                }
+                rsa_n_dup = rsa_e_dup = NULL; /* transferred */
                 break;
 #endif /* WITH_OPENSSL */
         case KEY_ED25519:
         case KEY_ED25519_CERT:
-                if ((n = sshkey_new(k->type)) == NULL)
-                        return SSH_ERR_ALLOC_FAIL;
+                if ((n = sshkey_new(k->type)) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
                 if (k->ed25519_pk != NULL) {
                         if ((n->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) {
-                                sshkey_free(n);
-                                return SSH_ERR_ALLOC_FAIL;
+                                r = SSH_ERR_ALLOC_FAIL;
+                                goto out;
                         }
                         memcpy(n->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ);
                 }
@@ -1811,37 +1824,48 @@ sshkey_from_private(const struct sshkey *k, struct sshkey **pkp)
 #ifdef WITH_XMSS
         case KEY_XMSS:
         case KEY_XMSS_CERT:
-                if ((n = sshkey_new(k->type)) == NULL)
-                        return SSH_ERR_ALLOC_FAIL;
-                if ((ret = sshkey_xmss_init(n, k->xmss_name)) != 0) {
-                        sshkey_free(n);
-                        return ret;
+                if ((n = sshkey_new(k->type)) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
                 }
+                if ((r = sshkey_xmss_init(n, k->xmss_name)) != 0)
+                        goto out;
                 if (k->xmss_pk != NULL) {
                         size_t pklen = sshkey_xmss_pklen(k);
                         if (pklen == 0 || sshkey_xmss_pklen(n) != pklen) {
-                                sshkey_free(n);
-                                return SSH_ERR_INTERNAL_ERROR;
+                                r = SSH_ERR_INTERNAL_ERROR;
+                                goto out;
                         }
                         if ((n->xmss_pk = malloc(pklen)) == NULL) {
-                                sshkey_free(n);
-                                return SSH_ERR_ALLOC_FAIL;
+                                r = SSH_ERR_ALLOC_FAIL;
+                                goto out;
                         }
                         memcpy(n->xmss_pk, k->xmss_pk, pklen);
                 }
                 break;
 #endif /* WITH_XMSS */
         default:
-                return SSH_ERR_KEY_TYPE_UNKNOWN;
-        }
-        if (sshkey_is_cert(k)) {
-                if ((ret = sshkey_cert_copy(k, n)) != 0) {
-                        sshkey_free(n);
-                        return ret;
-                }
+                r = SSH_ERR_KEY_TYPE_UNKNOWN;
+                goto out;
         }
+        if (sshkey_is_cert(k) && (r = sshkey_cert_copy(k, n)) != 0)
+                goto out;
+        /* success */
         *pkp = n;
-        return 0;
+        n = NULL;
+        r = 0;
+ out:
+        sshkey_free(n);
+#ifdef WITH_OPENSSL
+        BN_clear_free(rsa_n_dup);
+        BN_clear_free(rsa_e_dup);
+        BN_clear_free(dsa_p_dup);
+        BN_clear_free(dsa_q_dup);
+        BN_clear_free(dsa_g_dup);
+        BN_clear_free(dsa_pub_key_dup);
+#endif
+
+        return r;
 }
 
 static int
@@ -1955,6 +1979,8 @@ cert_parse(struct sshbuf *b, struct sshkey *key, struct sshbuf *certbuf)
         if ((ret = sshkey_verify(key->cert->signature_key, sig, slen,
             sshbuf_ptr(key->cert->certblob), signed_len, NULL, 0)) != 0)
                 goto out;
+        if ((ret = get_sigtype(sig, slen, &key->cert->signature_type)) != 0)
+                goto out;
 
         /* Success */
         ret = 0;
@@ -1967,6 +1993,19 @@ cert_parse(struct sshbuf *b, struct sshkey *key, struct sshbuf *certbuf)
         return ret;
 }
 
+#ifdef WITH_OPENSSL
+static int
+check_rsa_length(const RSA *rsa)
+{
+        const BIGNUM *rsa_n;
+
+        RSA_get0_key(rsa, &rsa_n, NULL, NULL);
+        if (BN_num_bits(rsa_n) < SSH_RSA_MINIMUM_MODULUS_SIZE)
+                return SSH_ERR_KEY_LENGTH;
+        return 0;
+}
+#endif
+
 static int
 sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp,
     int allow_cert)
@@ -1977,9 +2016,13 @@ sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp,
         size_t len;
         u_char *pk = NULL;
         struct sshbuf *copy;
-#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
+#if defined(WITH_OPENSSL)
+        BIGNUM *rsa_n = NULL, *rsa_e = NULL;
+        BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL, *dsa_pub_key = NULL;
+# if defined(OPENSSL_HAS_ECC)
         EC_POINT *q = NULL;
-#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
 
 #ifdef DEBUG_PK /* XXX */
         sshbuf_dump(b, stderr);
@@ -2014,15 +2057,23 @@ sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp,
                         ret = SSH_ERR_ALLOC_FAIL;
                         goto out;
                 }
-                if (sshbuf_get_bignum2(b, key->rsa->e) != 0 ||
-                    sshbuf_get_bignum2(b, key->rsa->n) != 0) {
+                if ((rsa_e = BN_new()) == NULL ||
+                    (rsa_n = BN_new()) == NULL) {
+                        ret = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
+                if (sshbuf_get_bignum2(b, rsa_e) != 0 ||
+                    sshbuf_get_bignum2(b, rsa_n) != 0) {
                         ret = SSH_ERR_INVALID_FORMAT;
                         goto out;
                 }
-                if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
-                        ret = SSH_ERR_KEY_LENGTH;
+                if (!RSA_set0_key(key->rsa, rsa_n, rsa_e, NULL)) {
+                        ret = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
                 }
+                rsa_n = rsa_e = NULL; /* transferred */
+                if ((ret = check_rsa_length(key->rsa)) != 0)
+                        goto out;
 #ifdef DEBUG_PK
                 RSA_print_fp(stderr, key->rsa, 8);
 #endif
@@ -2039,13 +2090,30 @@ sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp,
                         ret = SSH_ERR_ALLOC_FAIL;
                         goto out;
                 }
-                if (sshbuf_get_bignum2(b, key->dsa->p) != 0 ||
-                    sshbuf_get_bignum2(b, key->dsa->q) != 0 ||
-                    sshbuf_get_bignum2(b, key->dsa->g) != 0 ||
-                    sshbuf_get_bignum2(b, key->dsa->pub_key) != 0) {
+                if ((dsa_p = BN_new()) == NULL ||
+                    (dsa_q = BN_new()) == NULL ||
+                    (dsa_g = BN_new()) == NULL ||
+                    (dsa_pub_key = BN_new()) == NULL) {
+                        ret = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
+                if (sshbuf_get_bignum2(b, dsa_p) != 0 ||
+                    sshbuf_get_bignum2(b, dsa_q) != 0 ||
+                    sshbuf_get_bignum2(b, dsa_g) != 0 ||
+                    sshbuf_get_bignum2(b, dsa_pub_key) != 0) {
                         ret = SSH_ERR_INVALID_FORMAT;
                         goto out;
                 }
+                if (!DSA_set0_pqg(key->dsa, dsa_p, dsa_q, dsa_g)) {
+                        ret = SSH_ERR_LIBCRYPTO_ERROR;
+                        goto out;
+                }
+                dsa_p = dsa_q = dsa_g = NULL; /* transferred */
+                if (!DSA_set0_key(key->dsa, dsa_pub_key, NULL)) {
+                        ret = SSH_ERR_LIBCRYPTO_ERROR;
+                        goto out;
+                }
+                dsa_pub_key = NULL; /* transferred */
 #ifdef DEBUG_PK
                 DSA_print_fp(stderr, key->dsa, 8);
 #endif
@@ -2179,9 +2247,17 @@ sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp,
         free(ktype);
         free(curve);
         free(pk);
-#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
+#if defined(WITH_OPENSSL)
+        BN_clear_free(rsa_n);
+        BN_clear_free(rsa_e);
+        BN_clear_free(dsa_p);
+        BN_clear_free(dsa_q);
+        BN_clear_free(dsa_g);
+        BN_clear_free(dsa_pub_key);
+# if defined(OPENSSL_HAS_ECC)
         EC_POINT_free(q);
-#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
         return ret;
 }
 
@@ -2243,6 +2319,27 @@ get_sigtype(const u_char *sig, size_t siglen, char **sigtypep)
 }
 
 /*
+ *
+ * Checks whether a certificate's signature type is allowed.
+ * Returns 0 (success) if the certificate signature type appears in the
+ * "allowed" pattern-list, or the key is not a certificate to begin with.
+ * Otherwise returns a ssherr.h code.
+ */
+int
+sshkey_check_cert_sigtype(const struct sshkey *key, const char *allowed)
+{
+        if (key == NULL || allowed == NULL)
+                return SSH_ERR_INVALID_ARGUMENT;
+        if (!sshkey_type_is_cert(key->type))
+                return 0;
+        if (key->cert == NULL || key->cert->signature_type == NULL)
+                return SSH_ERR_INVALID_ARGUMENT;
+        if (match_pattern_list(key->cert->signature_type, allowed, 0) != 1)
+                return SSH_ERR_SIGN_ALG_UNSUPPORTED;
+        return 0;
+}
+
+/*
  * Returns the expected signature algorithm for a given public key algorithm.
  */
 const char *
@@ -2362,120 +2459,6 @@ sshkey_verify(const struct sshkey *key,
         }
 }
 
-/* Converts a private to a public key */
-int
-sshkey_demote(const struct sshkey *k, struct sshkey **dkp)
-{
-        struct sshkey *pk;
-        int ret = SSH_ERR_INTERNAL_ERROR;
-
-        *dkp = NULL;
-        if ((pk = calloc(1, sizeof(*pk))) == NULL)
-                return SSH_ERR_ALLOC_FAIL;
-        pk->type = k->type;
-        pk->flags = k->flags;
-        pk->ecdsa_nid = k->ecdsa_nid;
-        pk->dsa = NULL;
-        pk->ecdsa = NULL;
-        pk->rsa = NULL;
-        pk->ed25519_pk = NULL;
-        pk->ed25519_sk = NULL;
-        pk->xmss_pk = NULL;
-        pk->xmss_sk = NULL;
-
-        switch (k->type) {
-#ifdef WITH_OPENSSL
-        case KEY_RSA_CERT:
-                if ((ret = sshkey_cert_copy(k, pk)) != 0)
-                        goto fail;
-                /* FALLTHROUGH */
-        case KEY_RSA:
-                if ((pk->rsa = RSA_new()) == NULL ||
-                    (pk->rsa->e = BN_dup(k->rsa->e)) == NULL ||
-                    (pk->rsa->n = BN_dup(k->rsa->n)) == NULL) {
-                        ret = SSH_ERR_ALLOC_FAIL;
-                        goto fail;
-                        }
-                break;
-        case KEY_DSA_CERT:
-                if ((ret = sshkey_cert_copy(k, pk)) != 0)
-                        goto fail;
-                /* FALLTHROUGH */
-        case KEY_DSA:
-                if ((pk->dsa = DSA_new()) == NULL ||
-                    (pk->dsa->p = BN_dup(k->dsa->p)) == NULL ||
-                    (pk->dsa->q = BN_dup(k->dsa->q)) == NULL ||
-                    (pk->dsa->g = BN_dup(k->dsa->g)) == NULL ||
-                    (pk->dsa->pub_key = BN_dup(k->dsa->pub_key)) == NULL) {
-                        ret = SSH_ERR_ALLOC_FAIL;
-                        goto fail;
-                }
-                break;
-        case KEY_ECDSA_CERT:
-                if ((ret = sshkey_cert_copy(k, pk)) != 0)
-                        goto fail;
-                /* FALLTHROUGH */
-# ifdef OPENSSL_HAS_ECC
-        case KEY_ECDSA:
-                pk->ecdsa = EC_KEY_new_by_curve_name(pk->ecdsa_nid);
-                if (pk->ecdsa == NULL) {
-                        ret = SSH_ERR_ALLOC_FAIL;
-                        goto fail;
-                }
-                if (EC_KEY_set_public_key(pk->ecdsa,
-                    EC_KEY_get0_public_key(k->ecdsa)) != 1) {
-                        ret = SSH_ERR_LIBCRYPTO_ERROR;
-                        goto fail;
-                }
-                break;
-# endif /* OPENSSL_HAS_ECC */
-#endif /* WITH_OPENSSL */
-        case KEY_ED25519_CERT:
-                if ((ret = sshkey_cert_copy(k, pk)) != 0)
-                        goto fail;
-                /* FALLTHROUGH */
-        case KEY_ED25519:
-                if (k->ed25519_pk != NULL) {
-                        if ((pk->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) {
-                                ret = SSH_ERR_ALLOC_FAIL;
-                                goto fail;
-                        }
-                        memcpy(pk->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ);
-                }
-                break;
-#ifdef WITH_XMSS
-        case KEY_XMSS_CERT:
-                if ((ret = sshkey_cert_copy(k, pk)) != 0)
-                        goto fail;
-                /* FALLTHROUGH */
-        case KEY_XMSS:
-                if ((ret = sshkey_xmss_init(pk, k->xmss_name)) != 0)
-                        goto fail;
-                if (k->xmss_pk != NULL) {
-                        size_t pklen = sshkey_xmss_pklen(k);
-
-                        if (pklen == 0 || sshkey_xmss_pklen(pk) != pklen) {
-                                ret = SSH_ERR_INTERNAL_ERROR;
-                                goto fail;
-                        }
-                        if ((pk->xmss_pk = malloc(pklen)) == NULL) {
-                                ret = SSH_ERR_ALLOC_FAIL;
-                                goto fail;
-                        }
-                        memcpy(pk->xmss_pk, k->xmss_pk, pklen);
-                }
-                break;
-#endif /* WITH_XMSS */
-        default:
-                ret = SSH_ERR_KEY_TYPE_UNKNOWN;
- fail:
-                sshkey_free(pk);
-                return ret;
-        }
-        *dkp = pk;
-        return 0;
-}
-
 /* Convert a plain key to their _CERT equivalent */
 int
 sshkey_to_certified(struct sshkey *k)
@@ -2532,7 +2515,11 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg,
         u_char *ca_blob = NULL, *sig_blob = NULL, nonce[32];
         size_t i, ca_len, sig_len;
         int ret = SSH_ERR_INTERNAL_ERROR;
-        struct sshbuf *cert;
+        struct sshbuf *cert = NULL;
+        char *sigtype = NULL;
+#ifdef WITH_OPENSSL
+        const BIGNUM *rsa_n, *rsa_e, *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key;
+#endif /* WITH_OPENSSL */
 
         if (k == NULL || k->cert == NULL ||
             k->cert->certblob == NULL || ca == NULL)
@@ -2542,6 +2529,16 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg,
         if (!sshkey_type_is_valid_ca(ca->type))
                 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY;
 
+        /*
+         * If no alg specified as argument but a signature_type was set,
+         * then prefer that. If both were specified, then they must match.
+         */
+        if (alg == NULL)
+                alg = k->cert->signature_type;
+        else if (k->cert->signature_type != NULL &&
+            strcmp(alg, k->cert->signature_type) != 0)
+                return SSH_ERR_INVALID_ARGUMENT;
+
         if ((ret = sshkey_to_blob(ca, &ca_blob, &ca_len)) != 0)
                 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY;
 
@@ -2559,10 +2556,12 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg,
         switch (k->type) {
 #ifdef WITH_OPENSSL
         case KEY_DSA_CERT:
-                if ((ret = sshbuf_put_bignum2(cert, k->dsa->p)) != 0 ||
-                    (ret = sshbuf_put_bignum2(cert, k->dsa->q)) != 0 ||
-                    (ret = sshbuf_put_bignum2(cert, k->dsa->g)) != 0 ||
-                    (ret = sshbuf_put_bignum2(cert, k->dsa->pub_key)) != 0)
+                DSA_get0_pqg(k->dsa, &dsa_p, &dsa_q, &dsa_g);
+                DSA_get0_key(k->dsa, &dsa_pub_key, NULL);
+                if ((ret = sshbuf_put_bignum2(cert, dsa_p)) != 0 ||
+                    (ret = sshbuf_put_bignum2(cert, dsa_q)) != 0 ||
+                    (ret = sshbuf_put_bignum2(cert, dsa_g)) != 0 ||
+                    (ret = sshbuf_put_bignum2(cert, dsa_pub_key)) != 0)
                         goto out;
                 break;
 # ifdef OPENSSL_HAS_ECC
@@ -2576,8 +2575,9 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg,
                 break;
 # endif /* OPENSSL_HAS_ECC */
         case KEY_RSA_CERT:
-                if ((ret = sshbuf_put_bignum2(cert, k->rsa->e)) != 0 ||
-                    (ret = sshbuf_put_bignum2(cert, k->rsa->n)) != 0)
+                RSA_get0_key(k->rsa, &rsa_n, &rsa_e, NULL);
+                if ((ret = sshbuf_put_bignum2(cert, rsa_e)) != 0 ||
+                    (ret = sshbuf_put_bignum2(cert, rsa_n)) != 0)
                         goto out;
                 break;
 #endif /* WITH_OPENSSL */
@@ -2630,7 +2630,17 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg,
         if ((ret = signer(ca, &sig_blob, &sig_len, sshbuf_ptr(cert),
             sshbuf_len(cert), alg, 0, signer_ctx)) != 0)
                 goto out;
-
+        /* Check and update signature_type against what was actually used */
+        if ((ret = get_sigtype(sig_blob, sig_len, &sigtype)) != 0)
+                goto out;
+        if (alg != NULL && strcmp(alg, sigtype) != 0) {
+                ret = SSH_ERR_SIGN_ALG_UNSUPPORTED;
+                goto out;
+        }
+        if (k->cert->signature_type == NULL) {
+                k->cert->signature_type = sigtype;
+                sigtype = NULL;
+        }
         /* Append signature and we are done */
         if ((ret = sshbuf_put_string(cert, sig_blob, sig_len)) != 0)
                 goto out;
@@ -2640,6 +2650,7 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg,
                 sshbuf_reset(cert);
         free(sig_blob);
         free(ca_blob);
+        free(sigtype);
         sshbuf_free(principals);
         return ret;
 }
@@ -2759,18 +2770,25 @@ sshkey_private_serialize_opt(const struct sshkey *key, struct sshbuf *b,
     enum sshkey_serialize_rep opts)
 {
         int r = SSH_ERR_INTERNAL_ERROR;
+#ifdef WITH_OPENSSL
+        const BIGNUM *rsa_n, *rsa_e, *rsa_d, *rsa_iqmp, *rsa_p, *rsa_q;
+        const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key, *dsa_priv_key;
+#endif /* WITH_OPENSSL */
 
         if ((r = sshbuf_put_cstring(b, sshkey_ssh_name(key))) != 0)
                 goto out;
         switch (key->type) {
 #ifdef WITH_OPENSSL
         case KEY_RSA:
-                if ((r = sshbuf_put_bignum2(b, key->rsa->n)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->rsa->e)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->rsa->d)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->rsa->iqmp)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->rsa->p)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->rsa->q)) != 0)
+                RSA_get0_key(key->rsa, &rsa_n, &rsa_e, &rsa_d);
+                RSA_get0_factors(key->rsa, &rsa_p, &rsa_q);
+                RSA_get0_crt_params(key->rsa, NULL, NULL, &rsa_iqmp);
+                if ((r = sshbuf_put_bignum2(b, rsa_n)) != 0 ||
+                    (r = sshbuf_put_bignum2(b, rsa_e)) != 0 ||
+                    (r = sshbuf_put_bignum2(b, rsa_d)) != 0 ||
+                    (r = sshbuf_put_bignum2(b, rsa_iqmp)) != 0 ||
+                    (r = sshbuf_put_bignum2(b, rsa_p)) != 0 ||
+                    (r = sshbuf_put_bignum2(b, rsa_q)) != 0)
                         goto out;
                 break;
         case KEY_RSA_CERT:
@@ -2778,19 +2796,24 @@ sshkey_private_serialize_opt(const struct sshkey *key, struct sshbuf *b,
                         r = SSH_ERR_INVALID_ARGUMENT;
                         goto out;
                 }
+                RSA_get0_key(key->rsa, NULL, NULL, &rsa_d);
+                RSA_get0_factors(key->rsa, &rsa_p, &rsa_q);
+                RSA_get0_crt_params(key->rsa, NULL, NULL, &rsa_iqmp);
                 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->rsa->d)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->rsa->iqmp)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->rsa->p)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->rsa->q)) != 0)
+                    (r = sshbuf_put_bignum2(b, rsa_d)) != 0 ||
+                    (r = sshbuf_put_bignum2(b, rsa_iqmp)) != 0 ||
+                    (r = sshbuf_put_bignum2(b, rsa_p)) != 0 ||
+                    (r = sshbuf_put_bignum2(b, rsa_q)) != 0)
                         goto out;
                 break;
         case KEY_DSA:
-                if ((r = sshbuf_put_bignum2(b, key->dsa->p)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->dsa->q)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->dsa->g)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->dsa->pub_key)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->dsa->priv_key)) != 0)
+                DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g);
+                DSA_get0_key(key->dsa, &dsa_pub_key, &dsa_priv_key);
+                if ((r = sshbuf_put_bignum2(b, dsa_p)) != 0 ||
+                    (r = sshbuf_put_bignum2(b, dsa_q)) != 0 ||
+                    (r = sshbuf_put_bignum2(b, dsa_g)) != 0 ||
+                    (r = sshbuf_put_bignum2(b, dsa_pub_key)) != 0 ||
+                    (r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0)
                         goto out;
                 break;
         case KEY_DSA_CERT:
@@ -2798,8 +2821,9 @@ sshkey_private_serialize_opt(const struct sshkey *key, struct sshbuf *b,
                         r = SSH_ERR_INVALID_ARGUMENT;
                         goto out;
                 }
+                DSA_get0_key(key->dsa, NULL, &dsa_priv_key);
                 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
-                    (r = sshbuf_put_bignum2(b, key->dsa->priv_key)) != 0)
+                    (r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0)
                         goto out;
                 break;
 # ifdef OPENSSL_HAS_ECC
@@ -2900,6 +2924,10 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
         u_char *xmss_pk = NULL, *xmss_sk = NULL;
 #ifdef WITH_OPENSSL
         BIGNUM *exponent = NULL;
+        BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL;
+        BIGNUM *rsa_iqmp = NULL, *rsa_p = NULL, *rsa_q = NULL;
+        BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL;
+        BIGNUM *dsa_pub_key = NULL, *dsa_priv_key = NULL;
 #endif /* WITH_OPENSSL */
 
         if (kp != NULL)
@@ -2910,26 +2938,52 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
         switch (type) {
 #ifdef WITH_OPENSSL
         case KEY_DSA:
-                if ((k = sshkey_new_private(type)) == NULL) {
+                if ((k = sshkey_new(type)) == NULL) {
                         r = SSH_ERR_ALLOC_FAIL;
                         goto out;
                 }
-                if ((r = sshbuf_get_bignum2(buf, k->dsa->p)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->dsa->q)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->dsa->g)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->dsa->pub_key)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->dsa->priv_key)) != 0)
+                if ((dsa_p = BN_new()) == NULL ||
+                    (dsa_q = BN_new()) == NULL ||
+                    (dsa_g = BN_new()) == NULL ||
+                    (dsa_pub_key = BN_new()) == NULL ||
+                    (dsa_priv_key = BN_new()) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
                         goto out;
+                }
+                if ((r = sshbuf_get_bignum2(buf, dsa_p)) != 0 ||
+                    (r = sshbuf_get_bignum2(buf, dsa_q)) != 0 ||
+                    (r = sshbuf_get_bignum2(buf, dsa_g)) != 0 ||
+                    (r = sshbuf_get_bignum2(buf, dsa_pub_key)) != 0 ||
+                    (r = sshbuf_get_bignum2(buf, dsa_priv_key)) != 0)
+                        goto out;
+                if (!DSA_set0_pqg(k->dsa, dsa_p, dsa_q, dsa_g)) {
+                        r = SSH_ERR_LIBCRYPTO_ERROR;
+                        goto out;
+                }
+                dsa_p = dsa_q = dsa_g = NULL; /* transferred */
+                if (!DSA_set0_key(k->dsa, dsa_pub_key, dsa_priv_key)) {
+                        r = SSH_ERR_LIBCRYPTO_ERROR;
+                        goto out;
+                }
+                dsa_pub_key = dsa_priv_key = NULL; /* transferred */
                 break;
         case KEY_DSA_CERT:
+                if ((dsa_priv_key = BN_new()) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
                 if ((r = sshkey_froms(buf, &k)) != 0 ||
-                    (r = sshkey_add_private(k)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->dsa->priv_key)) != 0)
+                    (r = sshbuf_get_bignum2(buf, dsa_priv_key)) != 0)
+                        goto out;
+                if (!DSA_set0_key(k->dsa, NULL, dsa_priv_key)) {
+                        r = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
+                }
+                dsa_priv_key = NULL; /* transferred */
                 break;
 # ifdef OPENSSL_HAS_ECC
         case KEY_ECDSA:
-                if ((k = sshkey_new_private(type)) == NULL) {
+                if ((k = sshkey_new(type)) == NULL) {
                         r = SSH_ERR_ALLOC_FAIL;
                         goto out;
                 }
@@ -2966,7 +3020,6 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                         goto out;
                 }
                 if ((r = sshkey_froms(buf, &k)) != 0 ||
-                    (r = sshkey_add_private(k)) != 0 ||
                     (r = sshbuf_get_bignum2(buf, exponent)) != 0)
                         goto out;
                 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) {
@@ -2980,40 +3033,73 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                 break;
 # endif /* OPENSSL_HAS_ECC */
         case KEY_RSA:
-                if ((k = sshkey_new_private(type)) == NULL) {
+                if ((k = sshkey_new(type)) == NULL) {
                         r = SSH_ERR_ALLOC_FAIL;
                         goto out;
                 }
-                if ((r = sshbuf_get_bignum2(buf, k->rsa->n)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->rsa->e)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->rsa->d)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->rsa->iqmp)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->rsa->p)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->rsa->q)) != 0 ||
-                    (r = ssh_rsa_generate_additional_parameters(k)) != 0)
+                if ((rsa_n = BN_new()) == NULL ||
+                    (rsa_e = BN_new()) == NULL ||
+                    (rsa_d = BN_new()) == NULL ||
+                    (rsa_iqmp = BN_new()) == NULL ||
+                    (rsa_p = BN_new()) == NULL ||
+                    (rsa_q = BN_new()) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
                         goto out;
-                if (BN_num_bits(k->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
-                        r = SSH_ERR_KEY_LENGTH;
+                }
+                if ((r = sshbuf_get_bignum2(buf, rsa_n)) != 0 ||
+                    (r = sshbuf_get_bignum2(buf, rsa_e)) != 0 ||
+                    (r = sshbuf_get_bignum2(buf, rsa_d)) != 0 ||
+                    (r = sshbuf_get_bignum2(buf, rsa_iqmp)) != 0 ||
+                    (r = sshbuf_get_bignum2(buf, rsa_p)) != 0 ||
+                    (r = sshbuf_get_bignum2(buf, rsa_q)) != 0)
+                        goto out;
+                if (!RSA_set0_key(k->rsa, rsa_n, rsa_e, rsa_d)) {
+                        r = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
                 }
+                rsa_n = rsa_e = rsa_d = NULL; /* transferred */
+                if (!RSA_set0_factors(k->rsa, rsa_p, rsa_q)) {
+                        r = SSH_ERR_LIBCRYPTO_ERROR;
+                        goto out;
+                }
+                rsa_p = rsa_q = NULL; /* transferred */
+                if ((r = check_rsa_length(k->rsa)) != 0)
+                        goto out;
+                if ((r = ssh_rsa_complete_crt_parameters(k, rsa_iqmp)) != 0)
+                        goto out;
                 break;
         case KEY_RSA_CERT:
+                if ((rsa_d = BN_new()) == NULL ||
+                    (rsa_iqmp = BN_new()) == NULL ||
+                    (rsa_p = BN_new()) == NULL ||
+                    (rsa_q = BN_new()) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
                 if ((r = sshkey_froms(buf, &k)) != 0 ||
-                    (r = sshkey_add_private(k)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->rsa->d)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->rsa->iqmp)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->rsa->p)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, k->rsa->q)) != 0 ||
-                    (r = ssh_rsa_generate_additional_parameters(k)) != 0)
+                    (r = sshbuf_get_bignum2(buf, rsa_d)) != 0 ||
+                    (r = sshbuf_get_bignum2(buf, rsa_iqmp)) != 0 ||
+                    (r = sshbuf_get_bignum2(buf, rsa_p)) != 0 ||
+                    (r = sshbuf_get_bignum2(buf, rsa_q)) != 0)
                         goto out;
-                if (BN_num_bits(k->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
-                        r = SSH_ERR_KEY_LENGTH;
+                if (!RSA_set0_key(k->rsa, NULL, NULL, rsa_d)) {
+                        r = SSH_ERR_LIBCRYPTO_ERROR;
+                        goto out;
+                }
+                rsa_d = NULL; /* transferred */
+                if (!RSA_set0_factors(k->rsa, rsa_p, rsa_q)) {
+                        r = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
                 }
+                rsa_p = rsa_q = NULL; /* transferred */
+                if ((r = check_rsa_length(k->rsa)) != 0)
+                        goto out;
+                if ((r = ssh_rsa_complete_crt_parameters(k, rsa_iqmp)) != 0)
+                        goto out;
                 break;
 #endif /* WITH_OPENSSL */
         case KEY_ED25519:
-                if ((k = sshkey_new_private(type)) == NULL) {
+                if ((k = sshkey_new(type)) == NULL) {
                         r = SSH_ERR_ALLOC_FAIL;
                         goto out;
                 }
@@ -3030,7 +3116,6 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                 break;
         case KEY_ED25519_CERT:
                 if ((r = sshkey_froms(buf, &k)) != 0 ||
-                    (r = sshkey_add_private(k)) != 0 ||
                     (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 ||
                     (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0)
                         goto out;
@@ -3044,7 +3129,7 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                 break;
 #ifdef WITH_XMSS
         case KEY_XMSS:
-                if ((k = sshkey_new_private(type)) == NULL) {
+                if ((k = sshkey_new(type)) == NULL) {
                         r = SSH_ERR_ALLOC_FAIL;
                         goto out;
                 }
@@ -3067,7 +3152,6 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                 break;
         case KEY_XMSS_CERT:
                 if ((r = sshkey_froms(buf, &k)) != 0 ||
-                    (r = sshkey_add_private(k)) != 0 ||
                     (r = sshbuf_get_cstring(buf, &xmss_name, NULL)) != 0 ||
                     (r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 ||
                     (r = sshbuf_get_string(buf, &xmss_sk, &sklen)) != 0)
@@ -3116,6 +3200,17 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
         free(curve);
 #ifdef WITH_OPENSSL
         BN_clear_free(exponent);
+        BN_clear_free(dsa_p);
+        BN_clear_free(dsa_q);
+        BN_clear_free(dsa_g);
+        BN_clear_free(dsa_pub_key);
+        BN_clear_free(dsa_priv_key);
+        BN_clear_free(rsa_n);
+        BN_clear_free(rsa_e);
+        BN_clear_free(rsa_d);
+        BN_clear_free(rsa_p);
+        BN_clear_free(rsa_q);
+        BN_clear_free(rsa_iqmp);
 #endif /* WITH_OPENSSL */
         sshkey_free(k);
         freezero(ed25519_pk, pklen);
@@ -3770,7 +3865,9 @@ translate_libcrypto_error(unsigned long pem_err)
                 switch (pem_reason) {
                 case EVP_R_BAD_DECRYPT:
                         return SSH_ERR_KEY_WRONG_PASSPHRASE;
+#ifdef EVP_R_BN_DECODE_ERROR
                 case EVP_R_BN_DECODE_ERROR:
+#endif
                 case EVP_R_DECODE_ERROR:
 #ifdef EVP_R_PRIVATE_KEY_DECODE_ERROR
                 case EVP_R_PRIVATE_KEY_DECODE_ERROR:
@@ -3810,6 +3907,20 @@ convert_libcrypto_error(void)
 }
 
 static int
+pem_passphrase_cb(char *buf, int size, int rwflag, void *u)
+{
+        char *p = (char *)u;
+        size_t len;
+
+        if (p == NULL || (len = strlen(p)) == 0)
+                return -1;
+        if (size < 0 || len > (size_t)size)
+                return -1;
+        memcpy(buf, p, len);
+        return (int)len;
+}
+
+static int
 sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
     const char *passphrase, struct sshkey **keyp)
 {
@@ -3830,12 +3941,21 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
         }
 
         clear_libcrypto_errors();
-        if ((pk = PEM_read_bio_PrivateKey(bio, NULL, NULL,
+        if ((pk = PEM_read_bio_PrivateKey(bio, NULL, pem_passphrase_cb,
             (char *)passphrase)) == NULL) {
-                r = convert_libcrypto_error();
+               /*
+                * libcrypto may return various ASN.1 errors when attempting
+                * to parse a key with an incorrect passphrase.
+                * Treat all format errors as "incorrect passphrase" if a
+                * passphrase was supplied.
+                */
+                if (passphrase != NULL && *passphrase != '\0')
+                        r = SSH_ERR_KEY_WRONG_PASSPHRASE;
+                else
+                        r = convert_libcrypto_error();
                 goto out;
         }
-        if (pk->type == EVP_PKEY_RSA &&
+        if (EVP_PKEY_base_id(pk) == EVP_PKEY_RSA &&
             (type == KEY_UNSPEC || type == KEY_RSA)) {
                 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) {
                         r = SSH_ERR_ALLOC_FAIL;
@@ -3850,11 +3970,9 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
                         r = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
                 }
-                if (BN_num_bits(prv->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
-                        r = SSH_ERR_KEY_LENGTH;
+                if ((r = check_rsa_length(prv->rsa)) != 0)
                         goto out;
-                }
-        } else if (pk->type == EVP_PKEY_DSA &&
+        } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_DSA &&
             (type == KEY_UNSPEC || type == KEY_DSA)) {
                 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) {
                         r = SSH_ERR_ALLOC_FAIL;
@@ -3866,7 +3984,7 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
                 DSA_print_fp(stderr, prv->dsa, 8);
 #endif
 #ifdef OPENSSL_HAS_ECC
-        } else if (pk->type == EVP_PKEY_EC &&
+        } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC &&
             (type == KEY_UNSPEC || type == KEY_ECDSA)) {
                 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) {
                         r = SSH_ERR_ALLOC_FAIL;