1 files changed, 255 insertions, 232 deletions

diff --git a/sshkey.c b/sshkey.c
index 57995ee68..1571e3d93 100644
--- a/sshkey.c
+++ b/sshkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshkey.c,v 1.99 2020/01/21 05:56:56 djm Exp $ */
+/* $OpenBSD: sshkey.c,v 1.108 2020/04/11 10:16:11 djm Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Alexander von Gernler.  All rights reserved.
@@ -1019,10 +1019,8 @@ sshkey_fingerprint_raw(const struct sshkey *k, int dgst_alg,
         r = 0;
  out:
         free(ret);
-        if (blob != NULL) {
-                explicit_bzero(blob, blob_len);
-                free(blob);
-        }
+        if (blob != NULL)
+                freezero(blob, blob_len);
         return r;
 }
 
@@ -1280,12 +1278,10 @@ sshkey_fingerprint(const struct sshkey *k, int dgst_alg,
                     dgst_raw, dgst_raw_len, k);
                 break;
         default:
-                explicit_bzero(dgst_raw, dgst_raw_len);
-                free(dgst_raw);
+                freezero(dgst_raw, dgst_raw_len);
                 return NULL;
         }
-        explicit_bzero(dgst_raw, dgst_raw_len);
-        free(dgst_raw);
+        freezero(dgst_raw, dgst_raw_len);
         return retval;
 }
 
@@ -3082,8 +3078,8 @@ sshkey_cert_check_authority(const struct sshkey *k,
         u_int i, principal_matches;
         time_t now = time(NULL);
 
-        if (reason != NULL)
-                *reason = NULL;
+        if (reason == NULL)
+                return SSH_ERR_INVALID_ARGUMENT;
 
         if (want_host) {
                 if (k->cert->type != SSH2_CERT_TYPE_HOST) {
@@ -3398,38 +3394,52 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
         if ((r = sshbuf_get_cstring(buf, &tname, NULL)) != 0)
                 goto out;
         type = sshkey_type_from_name(tname);
-        switch (type) {
-#ifdef WITH_OPENSSL
-        case KEY_DSA:
+        if (sshkey_type_is_cert(type)) {
+                /*
+                 * Certificate key private keys begin with the certificate
+                 * itself. Make sure this matches the type of the enclosing
+                 * private key.
+                 */
+                if ((r = sshkey_froms(buf, &k)) != 0)
+                        goto out;
+                if (k->type != type) {
+                        r = SSH_ERR_KEY_CERT_MISMATCH;
+                        goto out;
+                }
+                /* For ECDSA keys, the group must match too */
+                if (k->type == KEY_ECDSA &&
+                    k->ecdsa_nid != sshkey_ecdsa_nid_from_name(tname)) {
+                        r = SSH_ERR_KEY_CERT_MISMATCH;
+                        goto out;
+                }
+        } else {
                 if ((k = sshkey_new(type)) == NULL) {
                         r = SSH_ERR_ALLOC_FAIL;
                         goto out;
                 }
+        }
+        switch (type) {
+#ifdef WITH_OPENSSL
+        case KEY_DSA:
                 if ((r = sshbuf_get_bignum2(buf, &dsa_p)) != 0 ||
                     (r = sshbuf_get_bignum2(buf, &dsa_q)) != 0 ||
                     (r = sshbuf_get_bignum2(buf, &dsa_g)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, &dsa_pub_key)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0)
+                    (r = sshbuf_get_bignum2(buf, &dsa_pub_key)) != 0)
                         goto out;
                 if (!DSA_set0_pqg(k->dsa, dsa_p, dsa_q, dsa_g)) {
                         r = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
                 }
                 dsa_p = dsa_q = dsa_g = NULL; /* transferred */
-                if (!DSA_set0_key(k->dsa, dsa_pub_key, dsa_priv_key)) {
+                if (!DSA_set0_key(k->dsa, dsa_pub_key, NULL)) {
                         r = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
                 }
-                dsa_pub_key = dsa_priv_key = NULL; /* transferred */
-                break;
+                dsa_pub_key = NULL; /* transferred */
+                /* FALLTHROUGH */
         case KEY_DSA_CERT:
-                if ((r = sshkey_froms(buf, &k)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0)
+                if ((r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0)
                         goto out;
-                if (k->type != type) {
-                        r = SSH_ERR_INVALID_FORMAT;
-                        goto out;
-                }
                 if (!DSA_set0_key(k->dsa, NULL, dsa_priv_key)) {
                         r = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
@@ -3438,10 +3448,6 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                 break;
 # ifdef OPENSSL_HAS_ECC
         case KEY_ECDSA:
-                if ((k = sshkey_new(type)) == NULL) {
-                        r = SSH_ERR_ALLOC_FAIL;
-                        goto out;
-                }
                 if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) {
                         r = SSH_ERR_INVALID_ARGUMENT;
                         goto out;
@@ -3457,27 +3463,12 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                         r = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
                 }
-                if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, &exponent)))
-                        goto out;
-                if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) {
-                        r = SSH_ERR_LIBCRYPTO_ERROR;
-                        goto out;
-                }
-                if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa),
-                    EC_KEY_get0_public_key(k->ecdsa))) != 0 ||
-                    (r = sshkey_ec_validate_private(k->ecdsa)) != 0)
+                if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0)
                         goto out;
-                break;
+                /* FALLTHROUGH */
         case KEY_ECDSA_CERT:
-                if ((r = sshkey_froms(buf, &k)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, &exponent)) != 0)
-                        goto out;
-                if (k->type != type ||
-                    k->ecdsa_nid != sshkey_ecdsa_nid_from_name(tname)) {
-                        r = SSH_ERR_INVALID_FORMAT;
+                if ((r = sshbuf_get_bignum2(buf, &exponent)) != 0)
                         goto out;
-                }
                 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) {
                         r = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
@@ -3488,10 +3479,6 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                         goto out;
                 break;
         case KEY_ECDSA_SK:
-                if ((k = sshkey_new(type)) == NULL) {
-                        r = SSH_ERR_ALLOC_FAIL;
-                        goto out;
-                }
                 if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) {
                         r = SSH_ERR_INVALID_ARGUMENT;
                         goto out;
@@ -3524,8 +3511,6 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                         goto out;
                 break;
         case KEY_ECDSA_SK_CERT:
-                if ((r = sshkey_froms(buf, &k)) != 0)
-                        goto out;
                 if ((k->sk_key_handle = sshbuf_new()) == NULL ||
                     (k->sk_reserved = sshbuf_new()) == NULL) {
                         r = SSH_ERR_ALLOC_FAIL;
@@ -3543,43 +3528,21 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                 break;
 # endif /* OPENSSL_HAS_ECC */
         case KEY_RSA:
-                if ((k = sshkey_new(type)) == NULL) {
-                        r = SSH_ERR_ALLOC_FAIL;
-                        goto out;
-                }
                 if ((r = sshbuf_get_bignum2(buf, &rsa_n)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, &rsa_e)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, &rsa_d)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, &rsa_iqmp)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, &rsa_p)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, &rsa_q)) != 0)
+                    (r = sshbuf_get_bignum2(buf, &rsa_e)) != 0)
                         goto out;
-                if (!RSA_set0_key(k->rsa, rsa_n, rsa_e, rsa_d)) {
+                if (!RSA_set0_key(k->rsa, rsa_n, rsa_e, NULL)) {
                         r = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
                 }
-                rsa_n = rsa_e = rsa_d = NULL; /* transferred */
-                if (!RSA_set0_factors(k->rsa, rsa_p, rsa_q)) {
-                        r = SSH_ERR_LIBCRYPTO_ERROR;
-                        goto out;
-                }
-                rsa_p = rsa_q = NULL; /* transferred */
-                if ((r = check_rsa_length(k->rsa)) != 0)
-                        goto out;
-                if ((r = ssh_rsa_complete_crt_parameters(k, rsa_iqmp)) != 0)
-                        goto out;
-                break;
+                rsa_n = rsa_e = NULL; /* transferred */
+                /* FALLTHROUGH */
         case KEY_RSA_CERT:
-                if ((r = sshkey_froms(buf, &k)) != 0 ||
-                    (r = sshbuf_get_bignum2(buf, &rsa_d)) != 0 ||
+                if ((r = sshbuf_get_bignum2(buf, &rsa_d)) != 0 ||
                     (r = sshbuf_get_bignum2(buf, &rsa_iqmp)) != 0 ||
                     (r = sshbuf_get_bignum2(buf, &rsa_p)) != 0 ||
                     (r = sshbuf_get_bignum2(buf, &rsa_q)) != 0)
                         goto out;
-                if (k->type != type) {
-                        r = SSH_ERR_INVALID_FORMAT;
-                        goto out;
-                }
                 if (!RSA_set0_key(k->rsa, NULL, NULL, rsa_d)) {
                         r = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
@@ -3597,30 +3560,10 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                 break;
 #endif /* WITH_OPENSSL */
         case KEY_ED25519:
-                if ((k = sshkey_new(type)) == NULL) {
-                        r = SSH_ERR_ALLOC_FAIL;
-                        goto out;
-                }
-                if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 ||
-                    (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0)
-                        goto out;
-                if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) {
-                        r = SSH_ERR_INVALID_FORMAT;
-                        goto out;
-                }
-                k->ed25519_pk = ed25519_pk;
-                k->ed25519_sk = ed25519_sk;
-                ed25519_pk = ed25519_sk = NULL;
-                break;
         case KEY_ED25519_CERT:
-                if ((r = sshkey_froms(buf, &k)) != 0 ||
-                    (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 ||
+                if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 ||
                     (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0)
                         goto out;
-                if (k->type != type) {
-                        r = SSH_ERR_INVALID_FORMAT;
-                        goto out;
-                }
                 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) {
                         r = SSH_ERR_INVALID_FORMAT;
                         goto out;
@@ -3630,38 +3573,9 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                 ed25519_pk = ed25519_sk = NULL; /* transferred */
                 break;
         case KEY_ED25519_SK:
-                if ((k = sshkey_new(type)) == NULL) {
-                        r = SSH_ERR_ALLOC_FAIL;
-                        goto out;
-                }
-                if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0)
-                        goto out;
-                if (pklen != ED25519_PK_SZ) {
-                        r = SSH_ERR_INVALID_FORMAT;
-                        goto out;
-                }
-                if ((k->sk_key_handle = sshbuf_new()) == NULL ||
-                    (k->sk_reserved = sshbuf_new()) == NULL) {
-                        r = SSH_ERR_ALLOC_FAIL;
-                        goto out;
-                }
-                if ((r = sshbuf_get_cstring(buf, &k->sk_application,
-                    NULL)) != 0 ||
-                    (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 ||
-                    (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 ||
-                    (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0)
-                        goto out;
-                k->ed25519_pk = ed25519_pk;
-                ed25519_pk = NULL;
-                break;
         case KEY_ED25519_SK_CERT:
-                if ((r = sshkey_froms(buf, &k)) != 0 ||
-                    (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0)
-                        goto out;
-                if (k->type != type) {
-                        r = SSH_ERR_INVALID_FORMAT;
+                if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0)
                         goto out;
-                }
                 if (pklen != ED25519_PK_SZ) {
                         r = SSH_ERR_INVALID_FORMAT;
                         goto out;
@@ -3682,10 +3596,7 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                 break;
 #ifdef WITH_XMSS
         case KEY_XMSS:
-                if ((k = sshkey_new(type)) == NULL) {
-                        r = SSH_ERR_ALLOC_FAIL;
-                        goto out;
-                }
+        case KEY_XMSS_CERT:
                 if ((r = sshbuf_get_cstring(buf, &xmss_name, NULL)) != 0 ||
                     (r = sshkey_xmss_init(k, xmss_name)) != 0 ||
                     (r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 ||
@@ -3703,28 +3614,6 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                 if ((r = sshkey_xmss_deserialize_state_opt(k, buf)) != 0)
                         goto out;
                 break;
-        case KEY_XMSS_CERT:
-                if ((r = sshkey_froms(buf, &k)) != 0 ||
-                    (r = sshbuf_get_cstring(buf, &xmss_name, NULL)) != 0 ||
-                    (r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 ||
-                    (r = sshbuf_get_string(buf, &xmss_sk, &sklen)) != 0)
-                        goto out;
-                if (k->type != type || strcmp(xmss_name, k->xmss_name) != 0) {
-                        r = SSH_ERR_INVALID_FORMAT;
-                        goto out;
-                }
-                if (pklen != sshkey_xmss_pklen(k) ||
-                    sklen != sshkey_xmss_sklen(k)) {
-                        r = SSH_ERR_INVALID_FORMAT;
-                        goto out;
-                }
-                k->xmss_pk = xmss_pk;
-                k->xmss_sk = xmss_sk;
-                xmss_pk = xmss_sk = NULL;
-                /* optional internal state */
-                if ((r = sshkey_xmss_deserialize_state_opt(k, buf)) != 0)
-                        goto out;
-                break;
 #endif /* WITH_XMSS */
         default:
                 r = SSH_ERR_KEY_TYPE_UNKNOWN;
@@ -4054,46 +3943,31 @@ sshkey_private_to_blob2(struct sshkey *prv, struct sshbuf *blob,
         sshbuf_free(encrypted);
         cipher_free(ciphercontext);
         explicit_bzero(salt, sizeof(salt));
-        if (key != NULL) {
-                explicit_bzero(key, keylen + ivlen);
-                free(key);
-        }
-        if (pubkeyblob != NULL) {
-                explicit_bzero(pubkeyblob, pubkeylen);
-                free(pubkeyblob);
-        }
-        if (b64 != NULL) {
-                explicit_bzero(b64, strlen(b64));
-                free(b64);
-        }
+        if (key != NULL)
+                freezero(key, keylen + ivlen);
+        if (pubkeyblob != NULL) 
+                freezero(pubkeyblob, pubkeylen);
+        if (b64 != NULL) 
+                freezero(b64, strlen(b64));
         return r;
 }
 
 static int
-sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase,
-    struct sshkey **keyp, char **commentp)
+private2_uudecode(struct sshbuf *blob, struct sshbuf **decodedp)
 {
-        char *comment = NULL, *ciphername = NULL, *kdfname = NULL;
-        const struct sshcipher *cipher = NULL;
         const u_char *cp;
-        int r = SSH_ERR_INTERNAL_ERROR;
         size_t encoded_len;
-        size_t i, keylen = 0, ivlen = 0, authlen = 0, slen = 0;
+        int r;
+        u_char last;
         struct sshbuf *encoded = NULL, *decoded = NULL;
-        struct sshbuf *kdf = NULL, *decrypted = NULL;
-        struct sshcipher_ctx *ciphercontext = NULL;
-        struct sshkey *k = NULL;
-        u_char *key = NULL, *salt = NULL, *dp, pad, last;
-        u_int blocksize, rounds, nkeys, encrypted_len, check1, check2;
 
-        if (keyp != NULL)
-                *keyp = NULL;
-        if (commentp != NULL)
-                *commentp = NULL;
+        if (blob == NULL || decodedp == NULL)
+                return SSH_ERR_INVALID_ARGUMENT;
+
+        *decodedp = NULL;
 
         if ((encoded = sshbuf_new()) == NULL ||
-            (decoded = sshbuf_new()) == NULL ||
-            (decrypted = sshbuf_new()) == NULL) {
+            (decoded = sshbuf_new()) == NULL) {
                 r = SSH_ERR_ALLOC_FAIL;
                 goto out;
         }
@@ -4143,13 +4017,56 @@ sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase,
                 r = SSH_ERR_INVALID_FORMAT;
                 goto out;
         }
+        /* success */
+        *decodedp = decoded;
+        decoded = NULL;
+        r = 0;
+ out:
+        sshbuf_free(encoded);
+        sshbuf_free(decoded);
+        return r;
+}
+
+static int
+private2_decrypt(struct sshbuf *decoded, const char *passphrase,
+    struct sshbuf **decryptedp, struct sshkey **pubkeyp)
+{
+        char *ciphername = NULL, *kdfname = NULL;
+        const struct sshcipher *cipher = NULL;
+        int r = SSH_ERR_INTERNAL_ERROR;
+        size_t keylen = 0, ivlen = 0, authlen = 0, slen = 0;
+        struct sshbuf *kdf = NULL, *decrypted = NULL;
+        struct sshcipher_ctx *ciphercontext = NULL;
+        struct sshkey *pubkey = NULL;
+        u_char *key = NULL, *salt = NULL, *dp;
+        u_int blocksize, rounds, nkeys, encrypted_len, check1, check2;
+
+        if (decoded == NULL || decryptedp == NULL || pubkeyp == NULL)
+                return SSH_ERR_INVALID_ARGUMENT;
+
+        *decryptedp = NULL;
+        *pubkeyp = NULL;
+
+        if ((decrypted = sshbuf_new()) == NULL) {
+                r = SSH_ERR_ALLOC_FAIL;
+                goto out;
+        }
+
         /* parse public portion of key */
         if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC))) != 0 ||
             (r = sshbuf_get_cstring(decoded, &ciphername, NULL)) != 0 ||
             (r = sshbuf_get_cstring(decoded, &kdfname, NULL)) != 0 ||
             (r = sshbuf_froms(decoded, &kdf)) != 0 ||
-            (r = sshbuf_get_u32(decoded, &nkeys)) != 0 ||
-            (r = sshbuf_skip_string(decoded)) != 0 || /* pubkey */
+            (r = sshbuf_get_u32(decoded, &nkeys)) != 0)
+                goto out;
+
+        if (nkeys != 1) {
+                /* XXX only one key supported at present */
+                r = SSH_ERR_INVALID_FORMAT;
+                goto out;
+        }
+
+        if ((r = sshkey_froms(decoded, &pubkey)) != 0 ||
             (r = sshbuf_get_u32(decoded, &encrypted_len)) != 0)
                 goto out;
 
@@ -4157,23 +4074,18 @@ sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase,
                 r = SSH_ERR_KEY_UNKNOWN_CIPHER;
                 goto out;
         }
-        if ((passphrase == NULL || strlen(passphrase) == 0) &&
-            strcmp(ciphername, "none") != 0) {
-                /* passphrase required */
-                r = SSH_ERR_KEY_WRONG_PASSPHRASE;
-                goto out;
-        }
         if (strcmp(kdfname, "none") != 0 && strcmp(kdfname, "bcrypt") != 0) {
                 r = SSH_ERR_KEY_UNKNOWN_CIPHER;
                 goto out;
         }
-        if (!strcmp(kdfname, "none") && strcmp(ciphername, "none") != 0) {
+        if (strcmp(kdfname, "none") == 0 && strcmp(ciphername, "none") != 0) {
                 r = SSH_ERR_INVALID_FORMAT;
                 goto out;
         }
-        if (nkeys != 1) {
-                /* XXX only one key supported */
-                r = SSH_ERR_INVALID_FORMAT;
+        if ((passphrase == NULL || strlen(passphrase) == 0) &&
+            strcmp(kdfname, "none") != 0) {
+                /* passphrase required */
+                r = SSH_ERR_KEY_WRONG_PASSPHRASE;
                 goto out;
         }
 
@@ -4238,13 +4150,38 @@ sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase,
                 r = SSH_ERR_KEY_WRONG_PASSPHRASE;
                 goto out;
         }
+        /* success */
+        *decryptedp = decrypted;
+        decrypted = NULL;
+        *pubkeyp = pubkey;
+        pubkey = NULL;
+        r = 0;
+ out:
+        cipher_free(ciphercontext);
+        free(ciphername);
+        free(kdfname);
+        sshkey_free(pubkey);
+        if (salt != NULL) {
+                explicit_bzero(salt, slen);
+                free(salt);
+        }
+        if (key != NULL) {
+                explicit_bzero(key, keylen + ivlen);
+                free(key);
+        }
+        sshbuf_free(kdf);
+        sshbuf_free(decrypted);
+        return r;
+}
 
-        /* Load the private key and comment */
-        if ((r = sshkey_private_deserialize(decrypted, &k)) != 0 ||
-            (r = sshbuf_get_cstring(decrypted, &comment, NULL)) != 0)
-                goto out;
+/* Check deterministic padding after private key */
+static int
+private2_check_padding(struct sshbuf *decrypted)
+{
+        u_char pad;
+        size_t i;
+        int r = SSH_ERR_INTERNAL_ERROR;
 
-        /* Check deterministic padding */
         i = 0;
         while (sshbuf_len(decrypted)) {
                 if ((r = sshbuf_get_u8(decrypted, &pad)) != 0)
@@ -4254,8 +4191,54 @@ sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase,
                         goto out;
                 }
         }
+        /* success */
+        r = 0;
+ out:
+        explicit_bzero(&pad, sizeof(pad));
+        explicit_bzero(&i, sizeof(i));
+        return r;
+}
 
-        /* XXX decode pubkey and check against private */
+static int
+sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase,
+    struct sshkey **keyp, char **commentp)
+{
+        char *comment = NULL;
+        int r = SSH_ERR_INTERNAL_ERROR;
+        struct sshbuf *decoded = NULL, *decrypted = NULL;
+        struct sshkey *k = NULL, *pubkey = NULL;
+
+        if (keyp != NULL)
+                *keyp = NULL;
+        if (commentp != NULL)
+                *commentp = NULL;
+
+        /* Undo base64 encoding and decrypt the private section */
+        if ((r = private2_uudecode(blob, &decoded)) != 0 ||
+            (r = private2_decrypt(decoded, passphrase,
+            &decrypted, &pubkey)) != 0)
+                goto out;
+
+        if (type != KEY_UNSPEC &&
+            sshkey_type_plain(type) != sshkey_type_plain(pubkey->type)) {
+                r = SSH_ERR_KEY_TYPE_MISMATCH;
+                goto out;
+        }
+
+        /* Load the private key and comment */
+        if ((r = sshkey_private_deserialize(decrypted, &k)) != 0 ||
+            (r = sshbuf_get_cstring(decrypted, &comment, NULL)) != 0)
+                goto out;
+
+        /* Check deterministic padding after private section */
+        if ((r = private2_check_padding(decrypted)) != 0)
+                goto out;
+
+        /* Check that the public key in the envelope matches the private key */
+        if (!sshkey_equal(pubkey, k)) {
+                r = SSH_ERR_INVALID_FORMAT;
+                goto out;
+        }
 
         /* success */
         r = 0;
@@ -4268,27 +4251,63 @@ sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase,
                 comment = NULL;
         }
  out:
-        pad = 0;
-        cipher_free(ciphercontext);
-        free(ciphername);
-        free(kdfname);
         free(comment);
-        if (salt != NULL) {
-                explicit_bzero(salt, slen);
-                free(salt);
-        }
-        if (key != NULL) {
-                explicit_bzero(key, keylen + ivlen);
-                free(key);
-        }
-        sshbuf_free(encoded);
         sshbuf_free(decoded);
-        sshbuf_free(kdf);
         sshbuf_free(decrypted);
         sshkey_free(k);
+        sshkey_free(pubkey);
         return r;
 }
 
+static int
+sshkey_parse_private2_pubkey(struct sshbuf *blob, int type,
+    struct sshkey **keyp)
+{
+        int r = SSH_ERR_INTERNAL_ERROR;
+        struct sshbuf *decoded = NULL;
+        struct sshkey *pubkey = NULL;
+        u_int nkeys = 0;
+
+        if (keyp != NULL)
+                *keyp = NULL;
+
+        if ((r = private2_uudecode(blob, &decoded)) != 0)
+                goto out;
+        /* parse public key from unencrypted envelope */
+        if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC))) != 0 ||
+            (r = sshbuf_skip_string(decoded)) != 0 || /* cipher */
+            (r = sshbuf_skip_string(decoded)) != 0 || /* KDF alg */
+            (r = sshbuf_skip_string(decoded)) != 0 || /* KDF hint */
+            (r = sshbuf_get_u32(decoded, &nkeys)) != 0)
+                goto out;
+
+        if (nkeys != 1) {
+                /* XXX only one key supported at present */
+                r = SSH_ERR_INVALID_FORMAT;
+                goto out;
+        }
+
+        /* Parse the public key */
+        if ((r = sshkey_froms(decoded, &pubkey)) != 0)
+                goto out;
+
+        if (type != KEY_UNSPEC &&
+            sshkey_type_plain(type) != sshkey_type_plain(pubkey->type)) {
+                r = SSH_ERR_KEY_TYPE_MISMATCH;
+                goto out;
+        }
+
+        /* success */
+        r = 0;
+        if (keyp != NULL) {
+                *keyp = pubkey;
+                pubkey = NULL;
+        }
+ out:
+        sshbuf_free(decoded);
+        sshkey_free(pubkey);
+        return r;
+}
 
 #ifdef WITH_OPENSSL
 /* convert SSH v2 key to PEM or PKCS#8 format */
@@ -4615,24 +4634,16 @@ sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type,
                 *commentp = NULL;
 
         switch (type) {
-#ifdef WITH_OPENSSL
-        case KEY_DSA:
-        case KEY_ECDSA:
-        case KEY_RSA:
-                return sshkey_parse_private_pem_fileblob(blob, type,
-                    passphrase, keyp);
-#endif /* WITH_OPENSSL */
         case KEY_ED25519:
-#ifdef WITH_XMSS
         case KEY_XMSS:
-#endif /* WITH_XMSS */
+                /* No fallback for new-format-only keys */
                 return sshkey_parse_private2(blob, type, passphrase,
                     keyp, commentp);
-        case KEY_UNSPEC:
+        default:
                 r = sshkey_parse_private2(blob, type, passphrase, keyp,
                     commentp);
-                /* Do not fallback to PEM parser if only passphrase is wrong. */
-                if (r == 0 || r == SSH_ERR_KEY_WRONG_PASSPHRASE)
+                /* Only fallback to PEM parser if a format error occurred. */
+                if (r != SSH_ERR_INVALID_FORMAT)
                         return r;
 #ifdef WITH_OPENSSL
                 return sshkey_parse_private_pem_fileblob(blob, type,
@@ -4640,8 +4651,6 @@ sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type,
 #else
                 return SSH_ERR_INVALID_FORMAT;
 #endif /* WITH_OPENSSL */
-        default:
-                return SSH_ERR_KEY_TYPE_UNKNOWN;
         }
 }
 
@@ -4664,6 +4673,20 @@ sshkey_sig_details_free(struct sshkey_sig_details *details)
         freezero(details, sizeof(*details));
 }
 
+int
+sshkey_parse_pubkey_from_private_fileblob_type(struct sshbuf *blob, int type,
+    struct sshkey **pubkeyp)
+{
+        int r = SSH_ERR_INTERNAL_ERROR;
+
+        if (pubkeyp != NULL)
+                *pubkeyp = NULL;
+        /* only new-format private keys bundle a public key inside */
+        if ((r = sshkey_parse_private2_pubkey(blob, type, pubkeyp)) != 0)
+                return r;
+        return 0;
+}
+
 #ifdef WITH_XMSS
 /*
  * serialize the key with the current state and forward the state