diff options
author | markus@openbsd.org <markus@openbsd.org> | 2018-02-23 15:58:37 +0000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2018-02-26 11:40:41 +1100 |
commit | 1b11ea7c58cd5c59838b5fa574cd456d6047b2d4 (patch) | |
tree | 7e96cb41b5234b9d327f7c8f41392f09aed0994e /sshkey.h | |
parent | 7d330a1ac02076de98cfc8fda05353d57b603755 (diff) |
upstream: Add experimental support for PQC XMSS keys (Extended
Hash-Based Signatures) The code is not compiled in by default (see WITH_XMSS
in Makefile.inc) Joint work with stefan-lukas_gazdag at genua.eu See
https://tools.ietf.org/html/draft-irtf-cfrg-xmss-hash-based-signatures-12 ok
djm@
OpenBSD-Commit-ID: ef3eccb96762a5d6f135d7daeef608df7776a7ac
Diffstat (limited to 'sshkey.h')
-rw-r--r-- | sshkey.h | 35 |
1 files changed, 34 insertions, 1 deletions
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: sshkey.h,v 1.23 2017/12/18 02:25:15 djm Exp $ */ | 1 | /* $OpenBSD: sshkey.h,v 1.24 2018/02/23 15:58:38 markus Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. | 4 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. |
@@ -61,6 +61,8 @@ enum sshkey_types { | |||
61 | KEY_DSA_CERT, | 61 | KEY_DSA_CERT, |
62 | KEY_ECDSA_CERT, | 62 | KEY_ECDSA_CERT, |
63 | KEY_ED25519_CERT, | 63 | KEY_ED25519_CERT, |
64 | KEY_XMSS, | ||
65 | KEY_XMSS_CERT, | ||
64 | KEY_UNSPEC | 66 | KEY_UNSPEC |
65 | }; | 67 | }; |
66 | 68 | ||
@@ -76,6 +78,14 @@ enum sshkey_fp_rep { | |||
76 | SSH_FP_RANDOMART | 78 | SSH_FP_RANDOMART |
77 | }; | 79 | }; |
78 | 80 | ||
81 | /* Private key serialisation formats, used on the wire */ | ||
82 | enum sshkey_serialize_rep { | ||
83 | SSHKEY_SERIALIZE_DEFAULT = 0, | ||
84 | SSHKEY_SERIALIZE_STATE = 1, | ||
85 | SSHKEY_SERIALIZE_FULL = 2, | ||
86 | SSHKEY_SERIALIZE_INFO = 254, | ||
87 | }; | ||
88 | |||
79 | /* key is stored in external hardware */ | 89 | /* key is stored in external hardware */ |
80 | #define SSHKEY_FLAG_EXT 0x0001 | 90 | #define SSHKEY_FLAG_EXT 0x0001 |
81 | 91 | ||
@@ -104,6 +114,11 @@ struct sshkey { | |||
104 | EC_KEY *ecdsa; | 114 | EC_KEY *ecdsa; |
105 | u_char *ed25519_sk; | 115 | u_char *ed25519_sk; |
106 | u_char *ed25519_pk; | 116 | u_char *ed25519_pk; |
117 | char *xmss_name; | ||
118 | char *xmss_filename; /* for state file updates */ | ||
119 | void *xmss_state; /* depends on xmss_name, opaque */ | ||
120 | u_char *xmss_sk; | ||
121 | u_char *xmss_pk; | ||
107 | struct sshkey_cert *cert; | 122 | struct sshkey_cert *cert; |
108 | }; | 123 | }; |
109 | 124 | ||
@@ -171,6 +186,8 @@ int sshkey_to_blob(const struct sshkey *, u_char **, size_t *); | |||
171 | int sshkey_to_base64(const struct sshkey *, char **); | 186 | int sshkey_to_base64(const struct sshkey *, char **); |
172 | int sshkey_putb(const struct sshkey *, struct sshbuf *); | 187 | int sshkey_putb(const struct sshkey *, struct sshbuf *); |
173 | int sshkey_puts(const struct sshkey *, struct sshbuf *); | 188 | int sshkey_puts(const struct sshkey *, struct sshbuf *); |
189 | int sshkey_puts_opts(const struct sshkey *, struct sshbuf *, | ||
190 | enum sshkey_serialize_rep); | ||
174 | int sshkey_plain_to_blob(const struct sshkey *, u_char **, size_t *); | 191 | int sshkey_plain_to_blob(const struct sshkey *, u_char **, size_t *); |
175 | int sshkey_putb_plain(const struct sshkey *, struct sshbuf *); | 192 | int sshkey_putb_plain(const struct sshkey *, struct sshbuf *); |
176 | 193 | ||
@@ -186,6 +203,8 @@ void sshkey_dump_ec_key(const EC_KEY *); | |||
186 | 203 | ||
187 | /* private key parsing and serialisation */ | 204 | /* private key parsing and serialisation */ |
188 | int sshkey_private_serialize(const struct sshkey *key, struct sshbuf *buf); | 205 | int sshkey_private_serialize(const struct sshkey *key, struct sshbuf *buf); |
206 | int sshkey_private_serialize_opt(const struct sshkey *key, struct sshbuf *buf, | ||
207 | enum sshkey_serialize_rep); | ||
189 | int sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **keyp); | 208 | int sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **keyp); |
190 | 209 | ||
191 | /* private key file format parsing and serialisation */ | 210 | /* private key file format parsing and serialisation */ |
@@ -200,6 +219,15 @@ int sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type, | |||
200 | /* XXX should be internal, but used by ssh-keygen */ | 219 | /* XXX should be internal, but used by ssh-keygen */ |
201 | int ssh_rsa_generate_additional_parameters(struct sshkey *); | 220 | int ssh_rsa_generate_additional_parameters(struct sshkey *); |
202 | 221 | ||
222 | /* stateful keys (e.g. XMSS) */ | ||
223 | typedef void sshkey_printfn(const char *, ...) __attribute__((format(printf, 1, 2))); | ||
224 | int sshkey_set_filename(struct sshkey *, const char *); | ||
225 | int sshkey_enable_maxsign(struct sshkey *, u_int32_t); | ||
226 | u_int32_t sshkey_signatures_left(const struct sshkey *); | ||
227 | int sshkey_forward_state(const struct sshkey *, u_int32_t, sshkey_printfn *); | ||
228 | int sshkey_private_serialize_maxsign(const struct sshkey *key, struct sshbuf *buf, | ||
229 | u_int32_t maxsign, sshkey_printfn *pr); | ||
230 | |||
203 | #ifdef SSHKEY_INTERNAL | 231 | #ifdef SSHKEY_INTERNAL |
204 | int ssh_rsa_sign(const struct sshkey *key, | 232 | int ssh_rsa_sign(const struct sshkey *key, |
205 | u_char **sigp, size_t *lenp, const u_char *data, size_t datalen, | 233 | u_char **sigp, size_t *lenp, const u_char *data, size_t datalen, |
@@ -222,6 +250,11 @@ int ssh_ed25519_sign(const struct sshkey *key, u_char **sigp, size_t *lenp, | |||
222 | int ssh_ed25519_verify(const struct sshkey *key, | 250 | int ssh_ed25519_verify(const struct sshkey *key, |
223 | const u_char *signature, size_t signaturelen, | 251 | const u_char *signature, size_t signaturelen, |
224 | const u_char *data, size_t datalen, u_int compat); | 252 | const u_char *data, size_t datalen, u_int compat); |
253 | int ssh_xmss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp, | ||
254 | const u_char *data, size_t datalen, u_int compat); | ||
255 | int ssh_xmss_verify(const struct sshkey *key, | ||
256 | const u_char *signature, size_t signaturelen, | ||
257 | const u_char *data, size_t datalen, u_int compat); | ||
225 | #endif | 258 | #endif |
226 | 259 | ||
227 | #if !defined(WITH_OPENSSL) | 260 | #if !defined(WITH_OPENSSL) |