1 files changed, 7 insertions, 13 deletions

diff --git a/ssh-sk.c b/ssh-sk.c
index 5ff938193..1afb205f8 100644
--- a/ssh-sk.c
+++ b/ssh-sk.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-sk.c,v 1.27 2020/02/06 22:30:54 naddy Exp $ */
+/* $OpenBSD: ssh-sk.c,v 1.30 2020/04/28 04:02:29 djm Exp $ */
 /*
  * Copyright (c) 2019 Google LLC
  *
@@ -100,6 +100,10 @@ sshsk_open(const char *path)
         struct sshsk_provider *ret = NULL;
         uint32_t version;
 
+        if (path == NULL || *path == '\0') {
+                error("No FIDO SecurityKeyProvider specified");
+                return NULL;
+        }
         if ((ret = calloc(1, sizeof(*ret))) == NULL) {
                 error("%s: calloc failed", __func__);
                 return NULL;
@@ -598,7 +602,7 @@ sshsk_ed25519_sig(struct sk_sign_response *resp, struct sshbuf *sig)
 #endif
         r = 0;
  out:
-        return 0;
+        return r;
 }
 
 int
@@ -611,7 +615,6 @@ sshsk_sign(const char *provider_path, struct sshkey *key,
         int type, alg;
         struct sk_sign_response *resp = NULL;
         struct sshbuf *inner_sig = NULL, *sig = NULL;
-        uint8_t message[32];
         struct sk_option **opts = NULL;
 
         debug("%s: provider \"%s\", key %s, flags 0x%02x%s", __func__,
@@ -646,15 +649,7 @@ sshsk_sign(const char *provider_path, struct sshkey *key,
                 goto out;
         }
 
-        /* hash data to be signed before it goes to the security key */
-        if ((r = ssh_digest_memory(SSH_DIGEST_SHA256, data, datalen,
-            message, sizeof(message))) != 0) {
-                error("%s: hash application failed: %s", __func__, ssh_err(r));
-                r = SSH_ERR_INTERNAL_ERROR;
-                goto out;
-        }
-        if ((r = skp->sk_sign(alg, message, sizeof(message),
-            key->sk_application,
+        if ((r = skp->sk_sign(alg, data, datalen, key->sk_application,
             sshbuf_ptr(key->sk_key_handle), sshbuf_len(key->sk_key_handle),
             key->sk_flags, pin, opts, &resp)) != 0) {
                 debug("%s: sk_sign failed with code %d", __func__, r);
@@ -703,7 +698,6 @@ sshsk_sign(const char *provider_path, struct sshkey *key,
         r = 0;
  out:
         sshsk_free_options(opts);
-        explicit_bzero(message, sizeof(message));
         sshsk_free(skp);
         sshsk_free_sign_response(resp);
         sshbuf_free(sig);