summaryrefslogtreecommitdiff
path: root/ssh-sk.c
diff options
context:
space:
mode:
Diffstat (limited to 'ssh-sk.c')
-rw-r--r--ssh-sk.c21
1 files changed, 14 insertions, 7 deletions
diff --git a/ssh-sk.c b/ssh-sk.c
index 43f808efc..a9da765eb 100644
--- a/ssh-sk.c
+++ b/ssh-sk.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssh-sk.c,v 1.6 2019/11/12 19:31:45 markus Exp $ */ 1/* $OpenBSD: ssh-sk.c,v 1.7 2019/11/12 19:32:30 markus Exp $ */
2/* 2/*
3 * Copyright (c) 2019 Google LLC 3 * Copyright (c) 2019 Google LLC
4 * 4 *
@@ -49,12 +49,12 @@ struct sshsk_provider {
49 uint32_t (*sk_api_version)(void); 49 uint32_t (*sk_api_version)(void);
50 50
51 /* Enroll a U2F key (private key generation) */ 51 /* Enroll a U2F key (private key generation) */
52 int (*sk_enroll)(const uint8_t *challenge, size_t challenge_len, 52 int (*sk_enroll)(int alg, const uint8_t *challenge,
53 const char *application, uint8_t flags, 53 size_t challenge_len, const char *application, uint8_t flags,
54 struct sk_enroll_response **enroll_response); 54 struct sk_enroll_response **enroll_response);
55 55
56 /* Sign a challenge */ 56 /* Sign a challenge */
57 int (*sk_sign)(const uint8_t *message, size_t message_len, 57 int (*sk_sign)(int alg, const uint8_t *message, size_t message_len,
58 const char *application, 58 const char *application,
59 const uint8_t *key_handle, size_t key_handle_len, 59 const uint8_t *key_handle, size_t key_handle_len,
60 uint8_t flags, struct sk_sign_response **sign_response); 60 uint8_t flags, struct sk_sign_response **sign_response);
@@ -243,13 +243,17 @@ sshsk_enroll(int type, const char *provider_path, const char *application,
243 size_t challenge_len; 243 size_t challenge_len;
244 struct sk_enroll_response *resp = NULL; 244 struct sk_enroll_response *resp = NULL;
245 int r = SSH_ERR_INTERNAL_ERROR; 245 int r = SSH_ERR_INTERNAL_ERROR;
246 int alg;
246 247
247 *keyp = NULL; 248 *keyp = NULL;
248 if (attest) 249 if (attest)
249 sshbuf_reset(attest); 250 sshbuf_reset(attest);
250 switch (type) { 251 switch (type) {
251 case KEY_ECDSA_SK: 252 case KEY_ECDSA_SK:
253 alg = SSH_SK_ECDSA;
254 break;
252 case KEY_ED25519_SK: 255 case KEY_ED25519_SK:
256 alg = SSH_SK_ED25519;
253 break; 257 break;
254 default: 258 default:
255 error("%s: unsupported key type", __func__); 259 error("%s: unsupported key type", __func__);
@@ -287,7 +291,7 @@ sshsk_enroll(int type, const char *provider_path, const char *application,
287 } 291 }
288 /* XXX validate flags? */ 292 /* XXX validate flags? */
289 /* enroll key */ 293 /* enroll key */
290 if ((r = skp->sk_enroll(challenge, challenge_len, application, 294 if ((r = skp->sk_enroll(alg, challenge, challenge_len, application,
291 flags, &resp)) != 0) { 295 flags, &resp)) != 0) {
292 error("Security key provider %s returned failure %d", 296 error("Security key provider %s returned failure %d",
293 provider_path, r); 297 provider_path, r);
@@ -427,7 +431,7 @@ sshsk_sign(const char *provider_path, const struct sshkey *key,
427{ 431{
428 struct sshsk_provider *skp = NULL; 432 struct sshsk_provider *skp = NULL;
429 int r = SSH_ERR_INTERNAL_ERROR; 433 int r = SSH_ERR_INTERNAL_ERROR;
430 int type; 434 int type, alg;
431 struct sk_sign_response *resp = NULL; 435 struct sk_sign_response *resp = NULL;
432 struct sshbuf *inner_sig = NULL, *sig = NULL; 436 struct sshbuf *inner_sig = NULL, *sig = NULL;
433 uint8_t message[32]; 437 uint8_t message[32];
@@ -439,7 +443,10 @@ sshsk_sign(const char *provider_path, const struct sshkey *key,
439 type = sshkey_type_plain(key->type); 443 type = sshkey_type_plain(key->type);
440 switch (type) { 444 switch (type) {
441 case KEY_ECDSA_SK: 445 case KEY_ECDSA_SK:
446 alg = SSH_SK_ECDSA;
447 break;
442 case KEY_ED25519_SK: 448 case KEY_ED25519_SK:
449 alg = SSH_SK_ED25519;
443 break; 450 break;
444 default: 451 default:
445 return SSH_ERR_INVALID_ARGUMENT; 452 return SSH_ERR_INVALID_ARGUMENT;
@@ -462,7 +469,7 @@ sshsk_sign(const char *provider_path, const struct sshkey *key,
462 r = SSH_ERR_INTERNAL_ERROR; 469 r = SSH_ERR_INTERNAL_ERROR;
463 goto out; 470 goto out;
464 } 471 }
465 if ((r = skp->sk_sign(message, sizeof(message), 472 if ((r = skp->sk_sign(alg, message, sizeof(message),
466 key->sk_application, 473 key->sk_application,
467 sshbuf_ptr(key->sk_key_handle), sshbuf_len(key->sk_key_handle), 474 sshbuf_ptr(key->sk_key_handle), sshbuf_len(key->sk_key_handle),
468 key->sk_flags, &resp)) != 0) { 475 key->sk_flags, &resp)) != 0) {