diff options
Diffstat (limited to 'sshkey.c')
-rw-r--r-- | sshkey.c | 26 |
1 files changed, 16 insertions, 10 deletions
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: sshkey.c,v 1.108 2020/04/11 10:16:11 djm Exp $ */ | 1 | /* $OpenBSD: sshkey.c,v 1.111 2020/08/27 01:06:19 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. |
4 | * Copyright (c) 2008 Alexander von Gernler. All rights reserved. | 4 | * Copyright (c) 2008 Alexander von Gernler. All rights reserved. |
@@ -132,6 +132,8 @@ static const struct keytype keytypes[] = { | |||
132 | # endif /* OPENSSL_HAS_NISTP521 */ | 132 | # endif /* OPENSSL_HAS_NISTP521 */ |
133 | { "sk-ecdsa-sha2-nistp256@openssh.com", "ECDSA-SK", NULL, | 133 | { "sk-ecdsa-sha2-nistp256@openssh.com", "ECDSA-SK", NULL, |
134 | KEY_ECDSA_SK, NID_X9_62_prime256v1, 0, 0 }, | 134 | KEY_ECDSA_SK, NID_X9_62_prime256v1, 0, 0 }, |
135 | { "webauthn-sk-ecdsa-sha2-nistp256@openssh.com", "ECDSA-SK", NULL, | ||
136 | KEY_ECDSA_SK, NID_X9_62_prime256v1, 0, 1 }, | ||
135 | # endif /* OPENSSL_HAS_ECC */ | 137 | # endif /* OPENSSL_HAS_ECC */ |
136 | { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", NULL, | 138 | { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", NULL, |
137 | KEY_RSA_CERT, 0, 1, 0 }, | 139 | KEY_RSA_CERT, 0, 1, 0 }, |
@@ -2726,7 +2728,7 @@ int | |||
2726 | sshkey_sign(struct sshkey *key, | 2728 | sshkey_sign(struct sshkey *key, |
2727 | u_char **sigp, size_t *lenp, | 2729 | u_char **sigp, size_t *lenp, |
2728 | const u_char *data, size_t datalen, | 2730 | const u_char *data, size_t datalen, |
2729 | const char *alg, const char *sk_provider, u_int compat) | 2731 | const char *alg, const char *sk_provider, const char *sk_pin, u_int compat) |
2730 | { | 2732 | { |
2731 | int was_shielded = sshkey_is_shielded(key); | 2733 | int was_shielded = sshkey_is_shielded(key); |
2732 | int r2, r = SSH_ERR_INTERNAL_ERROR; | 2734 | int r2, r = SSH_ERR_INTERNAL_ERROR; |
@@ -2765,7 +2767,7 @@ sshkey_sign(struct sshkey *key, | |||
2765 | case KEY_ECDSA_SK_CERT: | 2767 | case KEY_ECDSA_SK_CERT: |
2766 | case KEY_ECDSA_SK: | 2768 | case KEY_ECDSA_SK: |
2767 | r = sshsk_sign(sk_provider, key, sigp, lenp, data, | 2769 | r = sshsk_sign(sk_provider, key, sigp, lenp, data, |
2768 | datalen, compat, /* XXX PIN */ NULL); | 2770 | datalen, compat, sk_pin); |
2769 | break; | 2771 | break; |
2770 | #ifdef WITH_XMSS | 2772 | #ifdef WITH_XMSS |
2771 | case KEY_XMSS: | 2773 | case KEY_XMSS: |
@@ -2887,7 +2889,8 @@ sshkey_drop_cert(struct sshkey *k) | |||
2887 | /* Sign a certified key, (re-)generating the signed certblob. */ | 2889 | /* Sign a certified key, (re-)generating the signed certblob. */ |
2888 | int | 2890 | int |
2889 | sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg, | 2891 | sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg, |
2890 | const char *sk_provider, sshkey_certify_signer *signer, void *signer_ctx) | 2892 | const char *sk_provider, const char *sk_pin, |
2893 | sshkey_certify_signer *signer, void *signer_ctx) | ||
2891 | { | 2894 | { |
2892 | struct sshbuf *principals = NULL; | 2895 | struct sshbuf *principals = NULL; |
2893 | u_char *ca_blob = NULL, *sig_blob = NULL, nonce[32]; | 2896 | u_char *ca_blob = NULL, *sig_blob = NULL, nonce[32]; |
@@ -3025,7 +3028,7 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg, | |||
3025 | 3028 | ||
3026 | /* Sign the whole mess */ | 3029 | /* Sign the whole mess */ |
3027 | if ((ret = signer(ca, &sig_blob, &sig_len, sshbuf_ptr(cert), | 3030 | if ((ret = signer(ca, &sig_blob, &sig_len, sshbuf_ptr(cert), |
3028 | sshbuf_len(cert), alg, sk_provider, 0, signer_ctx)) != 0) | 3031 | sshbuf_len(cert), alg, sk_provider, sk_pin, 0, signer_ctx)) != 0) |
3029 | goto out; | 3032 | goto out; |
3030 | /* Check and update signature_type against what was actually used */ | 3033 | /* Check and update signature_type against what was actually used */ |
3031 | if ((ret = sshkey_get_sigtype(sig_blob, sig_len, &sigtype)) != 0) | 3034 | if ((ret = sshkey_get_sigtype(sig_blob, sig_len, &sigtype)) != 0) |
@@ -3055,19 +3058,20 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg, | |||
3055 | static int | 3058 | static int |
3056 | default_key_sign(struct sshkey *key, u_char **sigp, size_t *lenp, | 3059 | default_key_sign(struct sshkey *key, u_char **sigp, size_t *lenp, |
3057 | const u_char *data, size_t datalen, | 3060 | const u_char *data, size_t datalen, |
3058 | const char *alg, const char *sk_provider, u_int compat, void *ctx) | 3061 | const char *alg, const char *sk_provider, const char *sk_pin, |
3062 | u_int compat, void *ctx) | ||
3059 | { | 3063 | { |
3060 | if (ctx != NULL) | 3064 | if (ctx != NULL) |
3061 | return SSH_ERR_INVALID_ARGUMENT; | 3065 | return SSH_ERR_INVALID_ARGUMENT; |
3062 | return sshkey_sign(key, sigp, lenp, data, datalen, alg, | 3066 | return sshkey_sign(key, sigp, lenp, data, datalen, alg, |
3063 | sk_provider, compat); | 3067 | sk_provider, sk_pin, compat); |
3064 | } | 3068 | } |
3065 | 3069 | ||
3066 | int | 3070 | int |
3067 | sshkey_certify(struct sshkey *k, struct sshkey *ca, const char *alg, | 3071 | sshkey_certify(struct sshkey *k, struct sshkey *ca, const char *alg, |
3068 | const char *sk_provider) | 3072 | const char *sk_provider, const char *sk_pin) |
3069 | { | 3073 | { |
3070 | return sshkey_certify_custom(k, ca, alg, sk_provider, | 3074 | return sshkey_certify_custom(k, ca, alg, sk_provider, sk_pin, |
3071 | default_key_sign, NULL); | 3075 | default_key_sign, NULL); |
3072 | } | 3076 | } |
3073 | 3077 | ||
@@ -3599,10 +3603,12 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) | |||
3599 | case KEY_XMSS: | 3603 | case KEY_XMSS: |
3600 | case KEY_XMSS_CERT: | 3604 | case KEY_XMSS_CERT: |
3601 | if ((r = sshbuf_get_cstring(buf, &xmss_name, NULL)) != 0 || | 3605 | if ((r = sshbuf_get_cstring(buf, &xmss_name, NULL)) != 0 || |
3602 | (r = sshkey_xmss_init(k, xmss_name)) != 0 || | ||
3603 | (r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 || | 3606 | (r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 || |
3604 | (r = sshbuf_get_string(buf, &xmss_sk, &sklen)) != 0) | 3607 | (r = sshbuf_get_string(buf, &xmss_sk, &sklen)) != 0) |
3605 | goto out; | 3608 | goto out; |
3609 | if (type == KEY_XMSS && | ||
3610 | (r = sshkey_xmss_init(k, xmss_name)) != 0) | ||
3611 | goto out; | ||
3606 | if (pklen != sshkey_xmss_pklen(k) || | 3612 | if (pklen != sshkey_xmss_pklen(k) || |
3607 | sklen != sshkey_xmss_sklen(k)) { | 3613 | sklen != sshkey_xmss_sklen(k)) { |
3608 | r = SSH_ERR_INVALID_FORMAT; | 3614 | r = SSH_ERR_INVALID_FORMAT; |