1 files changed, 414 insertions, 95 deletions

diff --git a/sshkey.c b/sshkey.c
index 4d2048b6a..fd5b77246 100644
--- a/sshkey.c
+++ b/sshkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshkey.c,v 1.84 2019/10/09 00:04:42 djm Exp $ */
+/* $OpenBSD: sshkey.c,v 1.99 2020/01/21 05:56:56 djm Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Alexander von Gernler.  All rights reserved.
@@ -57,6 +57,7 @@
 #define SSHKEY_INTERNAL
 #include "sshkey.h"
 #include "match.h"
+#include "ssh-sk.h"
 
 #ifdef WITH_XMSS
 #include "sshkey-xmss.h"
@@ -106,6 +107,10 @@ static const struct keytype keytypes[] = {
         { "ssh-ed25519", "ED25519", NULL, KEY_ED25519, 0, 0, 0 },
         { "ssh-ed25519-cert-v01@openssh.com", "ED25519-CERT", NULL,
             KEY_ED25519_CERT, 0, 1, 0 },
+        { "sk-ssh-ed25519@openssh.com", "ED25519-SK", NULL,
+            KEY_ED25519_SK, 0, 0, 0 },
+        { "sk-ssh-ed25519-cert-v01@openssh.com", "ED25519-SK-CERT", NULL,
+            KEY_ED25519_SK_CERT, 0, 1, 0 },
 #ifdef WITH_XMSS
         { "ssh-xmss@openssh.com", "XMSS", NULL, KEY_XMSS, 0, 0, 0 },
         { "ssh-xmss-cert-v01@openssh.com", "XMSS-CERT", NULL,
@@ -125,6 +130,8 @@ static const struct keytype keytypes[] = {
         { "ecdsa-sha2-nistp521", "ECDSA", NULL,
             KEY_ECDSA, NID_secp521r1, 0, 0 },
 #  endif /* OPENSSL_HAS_NISTP521 */
+        { "sk-ecdsa-sha2-nistp256@openssh.com", "ECDSA-SK", NULL,
+            KEY_ECDSA_SK, NID_X9_62_prime256v1, 0, 0 },
 # endif /* OPENSSL_HAS_ECC */
         { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", NULL,
             KEY_RSA_CERT, 0, 1, 0 },
@@ -143,6 +150,8 @@ static const struct keytype keytypes[] = {
         { "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ECDSA-CERT", NULL,
            KEY_ECDSA_CERT, NID_secp521r1, 1, 0 },
 #  endif /* OPENSSL_HAS_NISTP521 */
+        { "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-SK-CERT", NULL,
+            KEY_ECDSA_SK_CERT, NID_X9_62_prime256v1, 1, 0 },
 # endif /* OPENSSL_HAS_ECC */
 #endif /* WITH_OPENSSL */
         { "null", "null", NULL, KEY_NULL, 0, 0, 0 },
@@ -212,13 +221,26 @@ sshkey_type_from_name(const char *name)
         return KEY_UNSPEC;
 }
 
+static int
+key_type_is_ecdsa_variant(int type)
+{
+        switch (type) {
+        case KEY_ECDSA:
+        case KEY_ECDSA_CERT:
+        case KEY_ECDSA_SK:
+        case KEY_ECDSA_SK_CERT:
+                return 1;
+        }
+        return 0;
+}
+
 int
 sshkey_ecdsa_nid_from_name(const char *name)
 {
         const struct keytype *kt;
 
         for (kt = keytypes; kt->type != -1; kt++) {
-                if (kt->type != KEY_ECDSA && kt->type != KEY_ECDSA_CERT)
+                if (!key_type_is_ecdsa_variant(kt->type))
                         continue;
                 if (kt->name != NULL && strcmp(name, kt->name) == 0)
                         return kt->nid;
@@ -314,10 +336,14 @@ sshkey_size(const struct sshkey *k)
                 return BN_num_bits(dsa_p);
         case KEY_ECDSA:
         case KEY_ECDSA_CERT:
+        case KEY_ECDSA_SK:
+        case KEY_ECDSA_SK_CERT:
                 return sshkey_curve_nid_to_bits(k->ecdsa_nid);
 #endif /* WITH_OPENSSL */
         case KEY_ED25519:
         case KEY_ED25519_CERT:
+        case KEY_ED25519_SK:
+        case KEY_ED25519_SK_CERT:
         case KEY_XMSS:
         case KEY_XMSS_CERT:
                 return 256;     /* XXX */
@@ -332,7 +358,9 @@ sshkey_type_is_valid_ca(int type)
         case KEY_RSA:
         case KEY_DSA:
         case KEY_ECDSA:
+        case KEY_ECDSA_SK:
         case KEY_ED25519:
+        case KEY_ED25519_SK:
         case KEY_XMSS:
                 return 1;
         default:
@@ -348,6 +376,20 @@ sshkey_is_cert(const struct sshkey *k)
         return sshkey_type_is_cert(k->type);
 }
 
+int
+sshkey_is_sk(const struct sshkey *k)
+{
+        if (k == NULL)
+                return 0;
+        switch (sshkey_type_plain(k->type)) {
+        case KEY_ECDSA_SK:
+        case KEY_ED25519_SK:
+                return 1;
+        default:
+                return 0;
+        }
+}
+
 /* Return the cert-less equivalent to a certified key type */
 int
 sshkey_type_plain(int type)
@@ -359,8 +401,12 @@ sshkey_type_plain(int type)
                 return KEY_DSA;
         case KEY_ECDSA_CERT:
                 return KEY_ECDSA;
+        case KEY_ECDSA_SK_CERT:
+                return KEY_ECDSA_SK;
         case KEY_ED25519_CERT:
                 return KEY_ED25519;
+        case KEY_ED25519_SK_CERT:
+                return KEY_ED25519_SK;
         case KEY_XMSS_CERT:
                 return KEY_XMSS;
         default:
@@ -534,11 +580,15 @@ sshkey_new(int type)
                 break;
         case KEY_ECDSA:
         case KEY_ECDSA_CERT:
+        case KEY_ECDSA_SK:
+        case KEY_ECDSA_SK_CERT:
                 /* Cannot do anything until we know the group */
                 break;
 #endif /* WITH_OPENSSL */
         case KEY_ED25519:
         case KEY_ED25519_CERT:
+        case KEY_ED25519_SK:
+        case KEY_ED25519_SK_CERT:
         case KEY_XMSS:
         case KEY_XMSS_CERT:
                 /* no need to prealloc */
@@ -578,6 +628,12 @@ sshkey_free(struct sshkey *k)
                 k->dsa = NULL;
                 break;
 # ifdef OPENSSL_HAS_ECC
+        case KEY_ECDSA_SK:
+        case KEY_ECDSA_SK_CERT:
+                free(k->sk_application);
+                sshbuf_free(k->sk_key_handle);
+                sshbuf_free(k->sk_reserved);
+                /* FALLTHROUGH */
         case KEY_ECDSA:
         case KEY_ECDSA_CERT:
                 EC_KEY_free(k->ecdsa);
@@ -585,6 +641,12 @@ sshkey_free(struct sshkey *k)
                 break;
 # endif /* OPENSSL_HAS_ECC */
 #endif /* WITH_OPENSSL */
+        case KEY_ED25519_SK:
+        case KEY_ED25519_SK_CERT:
+                free(k->sk_application);
+                sshbuf_free(k->sk_key_handle);
+                sshbuf_free(k->sk_reserved);
+                /* FALLTHROUGH */
         case KEY_ED25519:
         case KEY_ED25519_CERT:
                 freezero(k->ed25519_pk, ED25519_PK_SZ);
@@ -645,9 +707,6 @@ sshkey_equal_public(const struct sshkey *a, const struct sshkey *b)
         const BIGNUM *rsa_e_b, *rsa_n_b;
         const BIGNUM *dsa_p_a, *dsa_q_a, *dsa_g_a, *dsa_pub_key_a;
         const BIGNUM *dsa_p_b, *dsa_q_b, *dsa_g_b, *dsa_pub_key_b;
-# if defined(OPENSSL_HAS_ECC)
-        BN_CTX *bnctx;
-# endif /* OPENSSL_HAS_ECC */
 #endif /* WITH_OPENSSL */
 
         if (a == NULL || b == NULL ||
@@ -677,26 +736,35 @@ sshkey_equal_public(const struct sshkey *a, const struct sshkey *b)
                     BN_cmp(dsa_g_a, dsa_g_b) == 0 &&
                     BN_cmp(dsa_pub_key_a, dsa_pub_key_b) == 0;
 # ifdef OPENSSL_HAS_ECC
+        case KEY_ECDSA_SK:
+        case KEY_ECDSA_SK_CERT:
+                if (a->sk_application == NULL || b->sk_application == NULL)
+                        return 0;
+                if (strcmp(a->sk_application, b->sk_application) != 0)
+                        return 0;
+                /* FALLTHROUGH */
         case KEY_ECDSA_CERT:
         case KEY_ECDSA:
                 if (a->ecdsa == NULL || b->ecdsa == NULL ||
                     EC_KEY_get0_public_key(a->ecdsa) == NULL ||
                     EC_KEY_get0_public_key(b->ecdsa) == NULL)
                         return 0;
-                if ((bnctx = BN_CTX_new()) == NULL)
-                        return 0;
                 if (EC_GROUP_cmp(EC_KEY_get0_group(a->ecdsa),
-                    EC_KEY_get0_group(b->ecdsa), bnctx) != 0 ||
+                    EC_KEY_get0_group(b->ecdsa), NULL) != 0 ||
                     EC_POINT_cmp(EC_KEY_get0_group(a->ecdsa),
                     EC_KEY_get0_public_key(a->ecdsa),
-                    EC_KEY_get0_public_key(b->ecdsa), bnctx) != 0) {
-                        BN_CTX_free(bnctx);
+                    EC_KEY_get0_public_key(b->ecdsa), NULL) != 0)
                         return 0;
-                }
-                BN_CTX_free(bnctx);
                 return 1;
 # endif /* OPENSSL_HAS_ECC */
 #endif /* WITH_OPENSSL */
+        case KEY_ED25519_SK:
+        case KEY_ED25519_SK_CERT:
+                if (a->sk_application == NULL || b->sk_application == NULL)
+                        return 0;
+                if (strcmp(a->sk_application, b->sk_application) != 0)
+                        return 0;
+                /* FALLTHROUGH */
         case KEY_ED25519:
         case KEY_ED25519_CERT:
                 return a->ed25519_pk != NULL && b->ed25519_pk != NULL &&
@@ -752,9 +820,11 @@ to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain,
 #ifdef WITH_OPENSSL
         case KEY_DSA_CERT:
         case KEY_ECDSA_CERT:
+        case KEY_ECDSA_SK_CERT:
         case KEY_RSA_CERT:
 #endif /* WITH_OPENSSL */
         case KEY_ED25519_CERT:
+        case KEY_ED25519_SK_CERT:
 #ifdef WITH_XMSS
         case KEY_XMSS_CERT:
 #endif /* WITH_XMSS */
@@ -778,6 +848,7 @@ to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain,
                 break;
 # ifdef OPENSSL_HAS_ECC
         case KEY_ECDSA:
+        case KEY_ECDSA_SK:
                 if (key->ecdsa == NULL)
                         return SSH_ERR_INVALID_ARGUMENT;
                 if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
@@ -785,6 +856,11 @@ to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain,
                     sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 ||
                     (ret = sshbuf_put_eckey(b, key->ecdsa)) != 0)
                         return ret;
+                if (type == KEY_ECDSA_SK) {
+                        if ((ret = sshbuf_put_cstring(b,
+                            key->sk_application)) != 0)
+                                return ret;
+                }
                 break;
 # endif
         case KEY_RSA:
@@ -798,12 +874,18 @@ to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain,
                 break;
 #endif /* WITH_OPENSSL */
         case KEY_ED25519:
+        case KEY_ED25519_SK:
                 if (key->ed25519_pk == NULL)
                         return SSH_ERR_INVALID_ARGUMENT;
                 if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
                     (ret = sshbuf_put_string(b,
                     key->ed25519_pk, ED25519_PK_SZ)) != 0)
                         return ret;
+                if (type == KEY_ED25519_SK) {
+                        if ((ret = sshbuf_put_cstring(b,
+                            key->sk_application)) != 0)
+                                return ret;
+                }
                 break;
 #ifdef WITH_XMSS
         case KEY_XMSS:
@@ -1218,7 +1300,7 @@ peek_type_nid(const char *s, size_t l, int *nid)
                         continue;
                 if (memcmp(s, kt->name, l) == 0) {
                         *nid = -1;
-                        if (kt->type == KEY_ECDSA || kt->type == KEY_ECDSA_CERT)
+                        if (key_type_is_ecdsa_variant(kt->type))
                                 *nid = kt->nid;
                         return kt->type;
                 }
@@ -1244,11 +1326,15 @@ sshkey_read(struct sshkey *ret, char **cpp)
         case KEY_RSA:
         case KEY_DSA:
         case KEY_ECDSA:
+        case KEY_ECDSA_SK:
         case KEY_ED25519:
+        case KEY_ED25519_SK:
         case KEY_DSA_CERT:
         case KEY_ECDSA_CERT:
+        case KEY_ECDSA_SK_CERT:
         case KEY_RSA_CERT:
         case KEY_ED25519_CERT:
+        case KEY_ED25519_SK_CERT:
 #ifdef WITH_XMSS
         case KEY_XMSS:
         case KEY_XMSS_CERT:
@@ -1303,7 +1389,7 @@ sshkey_read(struct sshkey *ret, char **cpp)
                 sshkey_free(k);
                 return SSH_ERR_KEY_TYPE_MISMATCH;
         }
-        if (sshkey_type_plain(type) == KEY_ECDSA && curve_nid != k->ecdsa_nid) {
+        if (key_type_is_ecdsa_variant(type) && curve_nid != k->ecdsa_nid) {
                 sshkey_free(k);
                 return SSH_ERR_EC_CURVE_MISMATCH;
         }
@@ -1349,6 +1435,19 @@ sshkey_read(struct sshkey *ret, char **cpp)
                 sshkey_dump_ec_key(ret->ecdsa);
 #endif
                 break;
+        case KEY_ECDSA_SK:
+                EC_KEY_free(ret->ecdsa);
+                ret->ecdsa = k->ecdsa;
+                ret->ecdsa_nid = k->ecdsa_nid;
+                ret->sk_application = k->sk_application;
+                k->ecdsa = NULL;
+                k->ecdsa_nid = -1;
+                k->sk_application = NULL;
+#ifdef DEBUG_PK
+                sshkey_dump_ec_key(ret->ecdsa);
+                fprintf(stderr, "App: %s\n", ret->sk_application);
+#endif
+                break;
 # endif /* OPENSSL_HAS_ECC */
 #endif /* WITH_OPENSSL */
         case KEY_ED25519:
@@ -1359,6 +1458,13 @@ sshkey_read(struct sshkey *ret, char **cpp)
                 /* XXX */
 #endif
                 break;
+        case KEY_ED25519_SK:
+                freezero(ret->ed25519_pk, ED25519_PK_SZ);
+                ret->ed25519_pk = k->ed25519_pk;
+                ret->sk_application = k->sk_application;
+                k->ed25519_pk = NULL;
+                k->sk_application = NULL;
+                break;
 #ifdef WITH_XMSS
         case KEY_XMSS:
                 free(ret->xmss_pk);
@@ -1547,7 +1653,6 @@ sshkey_ecdsa_key_to_nid(EC_KEY *k)
         };
         int nid;
         u_int i;
-        BN_CTX *bnctx;
         const EC_GROUP *g = EC_KEY_get0_group(k);
 
         /*
@@ -1560,18 +1665,13 @@ sshkey_ecdsa_key_to_nid(EC_KEY *k)
          */
         if ((nid = EC_GROUP_get_curve_name(g)) > 0)
                 return nid;
-        if ((bnctx = BN_CTX_new()) == NULL)
-                return -1;
         for (i = 0; nids[i] != -1; i++) {
-                if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL) {
-                        BN_CTX_free(bnctx);
+                if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL)
                         return -1;
-                }
-                if (EC_GROUP_cmp(g, eg, bnctx) == 0)
+                if (EC_GROUP_cmp(g, eg, NULL) == 0)
                         break;
                 EC_GROUP_free(eg);
         }
-        BN_CTX_free(bnctx);
         if (nids[i] != -1) {
                 /* Use the group with the NID attached */
                 EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE);
@@ -1748,15 +1848,14 @@ sshkey_from_private(const struct sshkey *k, struct sshkey **pkp)
 #endif /* WITH_OPENSSL */
 
         *pkp = NULL;
+        if ((n = sshkey_new(k->type)) == NULL) {
+                r = SSH_ERR_ALLOC_FAIL;
+                goto out;
+        }
         switch (k->type) {
 #ifdef WITH_OPENSSL
         case KEY_DSA:
         case KEY_DSA_CERT:
-                if ((n = sshkey_new(k->type)) == NULL) {
-                        r = SSH_ERR_ALLOC_FAIL;
-                        goto out;
-                }
-
                 DSA_get0_pqg(k->dsa, &dsa_p, &dsa_q, &dsa_g);
                 DSA_get0_key(k->dsa, &dsa_pub_key, NULL);
                 if ((dsa_p_dup = BN_dup(dsa_p)) == NULL ||
@@ -1781,10 +1880,8 @@ sshkey_from_private(const struct sshkey *k, struct sshkey **pkp)
 # ifdef OPENSSL_HAS_ECC
         case KEY_ECDSA:
         case KEY_ECDSA_CERT:
-                if ((n = sshkey_new(k->type)) == NULL) {
-                        r = SSH_ERR_ALLOC_FAIL;
-                        goto out;
-                }
+        case KEY_ECDSA_SK:
+        case KEY_ECDSA_SK_CERT:
                 n->ecdsa_nid = k->ecdsa_nid;
                 n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid);
                 if (n->ecdsa == NULL) {
@@ -1796,14 +1893,15 @@ sshkey_from_private(const struct sshkey *k, struct sshkey **pkp)
                         r = SSH_ERR_LIBCRYPTO_ERROR;
                         goto out;
                 }
+                if (k->type != KEY_ECDSA_SK && k->type != KEY_ECDSA_SK_CERT)
+                        break;
+                /* Append security-key application string */
+                if ((n->sk_application = strdup(k->sk_application)) == NULL)
+                        goto out;
                 break;
 # endif /* OPENSSL_HAS_ECC */
         case KEY_RSA:
         case KEY_RSA_CERT:
-                if ((n = sshkey_new(k->type)) == NULL) {
-                        r = SSH_ERR_ALLOC_FAIL;
-                        goto out;
-                }
                 RSA_get0_key(k->rsa, &rsa_n, &rsa_e, NULL);
                 if ((rsa_n_dup = BN_dup(rsa_n)) == NULL ||
                     (rsa_e_dup = BN_dup(rsa_e)) == NULL) {
@@ -1819,10 +1917,8 @@ sshkey_from_private(const struct sshkey *k, struct sshkey **pkp)
 #endif /* WITH_OPENSSL */
         case KEY_ED25519:
         case KEY_ED25519_CERT:
-                if ((n = sshkey_new(k->type)) == NULL) {
-                        r = SSH_ERR_ALLOC_FAIL;
-                        goto out;
-                }
+        case KEY_ED25519_SK:
+        case KEY_ED25519_SK_CERT:
                 if (k->ed25519_pk != NULL) {
                         if ((n->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) {
                                 r = SSH_ERR_ALLOC_FAIL;
@@ -1830,17 +1926,20 @@ sshkey_from_private(const struct sshkey *k, struct sshkey **pkp)
                         }
                         memcpy(n->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ);
                 }
+                if (k->type != KEY_ED25519_SK &&
+                    k->type != KEY_ED25519_SK_CERT)
+                        break;
+                /* Append security-key application string */
+                if ((n->sk_application = strdup(k->sk_application)) == NULL)
+                        goto out;
                 break;
 #ifdef WITH_XMSS
         case KEY_XMSS:
         case KEY_XMSS_CERT:
-                if ((n = sshkey_new(k->type)) == NULL) {
-                        r = SSH_ERR_ALLOC_FAIL;
-                        goto out;
-                }
                 if ((r = sshkey_xmss_init(n, k->xmss_name)) != 0)
                         goto out;
                 if (k->xmss_pk != NULL) {
+                        u_int32_t left;
                         size_t pklen = sshkey_xmss_pklen(k);
                         if (pklen == 0 || sshkey_xmss_pklen(n) != pklen) {
                                 r = SSH_ERR_INTERNAL_ERROR;
@@ -1851,6 +1950,10 @@ sshkey_from_private(const struct sshkey *k, struct sshkey **pkp)
                                 goto out;
                         }
                         memcpy(n->xmss_pk, k->xmss_pk, pklen);
+                        /* simulate number of signatures left on pubkey */
+                        left = sshkey_xmss_signatures_left(k);
+                        if (left)
+                                sshkey_xmss_enable_maxsign(n, left);
                 }
                 break;
 #endif /* WITH_XMSS */
@@ -1935,7 +2038,7 @@ sshkey_shield_private(struct sshkey *k)
         if (sshkey_is_shielded(k) && (r = sshkey_unshield_private(k)) != 0)
                 goto out;
         if ((r = sshkey_private_serialize_opt(k, prvbuf,
-             SSHKEY_SERIALIZE_FULL)) != 0)
+             SSHKEY_SERIALIZE_SHIELD)) != 0)
                 goto out;
         /* pad to cipher blocksize */
         i = 0;
@@ -1978,6 +2081,9 @@ sshkey_shield_private(struct sshkey *k)
         enc = prekey = NULL; /* transferred */
         enclen = 0;
 
+        /* preserve key fields that are required for correct operation */
+        k->sk_flags = kswap->sk_flags;
+
         /* success */
         r = 0;
 
@@ -2199,7 +2305,7 @@ cert_parse(struct sshbuf *b, struct sshkey *key, struct sshbuf *certbuf)
                 goto out;
         }
         if ((ret = sshkey_verify(key->cert->signature_key, sig, slen,
-            sshbuf_ptr(key->cert->certblob), signed_len, NULL, 0)) != 0)
+            sshbuf_ptr(key->cert->certblob), signed_len, NULL, 0, NULL)) != 0)
                 goto out;
         if ((ret = sshkey_get_sigtype(sig, slen,
             &key->cert->signature_type)) != 0)
@@ -2329,15 +2435,17 @@ sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp,
                 DSA_print_fp(stderr, key->dsa, 8);
 #endif
                 break;
+# ifdef OPENSSL_HAS_ECC
         case KEY_ECDSA_CERT:
+        case KEY_ECDSA_SK_CERT:
                 /* Skip nonce */
                 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) {
                         ret = SSH_ERR_INVALID_FORMAT;
                         goto out;
                 }
                 /* FALLTHROUGH */
-# ifdef OPENSSL_HAS_ECC
         case KEY_ECDSA:
+        case KEY_ECDSA_SK:
                 if ((key = sshkey_new(type)) == NULL) {
                         ret = SSH_ERR_ALLOC_FAIL;
                         goto out;
@@ -2378,10 +2486,22 @@ sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp,
 #ifdef DEBUG_PK
                 sshkey_dump_ec_point(EC_KEY_get0_group(key->ecdsa), q);
 #endif
+                if (type == KEY_ECDSA_SK || type == KEY_ECDSA_SK_CERT) {
+                        /* Parse additional security-key application string */
+                        if (sshbuf_get_cstring(b, &key->sk_application,
+                            NULL) != 0) {
+                                ret = SSH_ERR_INVALID_FORMAT;
+                                goto out;
+                        }
+#ifdef DEBUG_PK
+                        fprintf(stderr, "App: %s\n", key->sk_application);
+#endif
+                }
                 break;
 # endif /* OPENSSL_HAS_ECC */
 #endif /* WITH_OPENSSL */
         case KEY_ED25519_CERT:
+        case KEY_ED25519_SK_CERT:
                 /* Skip nonce */
                 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) {
                         ret = SSH_ERR_INVALID_FORMAT;
@@ -2389,6 +2509,7 @@ sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp,
                 }
                 /* FALLTHROUGH */
         case KEY_ED25519:
+        case KEY_ED25519_SK:
                 if ((ret = sshbuf_get_string(b, &pk, &len)) != 0)
                         goto out;
                 if (len != ED25519_PK_SZ) {
@@ -2399,6 +2520,17 @@ sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp,
                         ret = SSH_ERR_ALLOC_FAIL;
                         goto out;
                 }
+                if (type == KEY_ED25519_SK || type == KEY_ED25519_SK_CERT) {
+                        /* Parse additional security-key application string */
+                        if (sshbuf_get_cstring(b, &key->sk_application,
+                            NULL) != 0) {
+                                ret = SSH_ERR_INVALID_FORMAT;
+                                goto out;
+                        }
+#ifdef DEBUG_PK
+                        fprintf(stderr, "App: %s\n", key->sk_application);
+#endif
+                }
                 key->ed25519_pk = pk;
                 pk = NULL;
                 break;
@@ -2597,7 +2729,8 @@ sshkey_check_sigtype(const u_char *sig, size_t siglen,
 int
 sshkey_sign(struct sshkey *key,
     u_char **sigp, size_t *lenp,
-    const u_char *data, size_t datalen, const char *alg, u_int compat)
+    const u_char *data, size_t datalen,
+    const char *alg, const char *sk_provider, u_int compat)
 {
         int was_shielded = sshkey_is_shielded(key);
         int r2, r = SSH_ERR_INTERNAL_ERROR;
@@ -2631,6 +2764,13 @@ sshkey_sign(struct sshkey *key,
         case KEY_ED25519_CERT:
                 r = ssh_ed25519_sign(key, sigp, lenp, data, datalen, compat);
                 break;
+        case KEY_ED25519_SK:
+        case KEY_ED25519_SK_CERT:
+        case KEY_ECDSA_SK_CERT:
+        case KEY_ECDSA_SK:
+                r = sshsk_sign(sk_provider, key, sigp, lenp, data,
+                    datalen, compat, /* XXX PIN */ NULL);
+                break;
 #ifdef WITH_XMSS
         case KEY_XMSS:
         case KEY_XMSS_CERT:
@@ -2653,8 +2793,11 @@ sshkey_sign(struct sshkey *key,
 int
 sshkey_verify(const struct sshkey *key,
     const u_char *sig, size_t siglen,
-    const u_char *data, size_t dlen, const char *alg, u_int compat)
+    const u_char *data, size_t dlen, const char *alg, u_int compat,
+    struct sshkey_sig_details **detailsp)
 {
+        if (detailsp != NULL)
+                *detailsp = NULL;
         if (siglen == 0 || dlen > SSH_KEY_MAX_SIGN_DATA_SIZE)
                 return SSH_ERR_INVALID_ARGUMENT;
         switch (key->type) {
@@ -2666,6 +2809,10 @@ sshkey_verify(const struct sshkey *key,
         case KEY_ECDSA_CERT:
         case KEY_ECDSA:
                 return ssh_ecdsa_verify(key, sig, siglen, data, dlen, compat);
+        case KEY_ECDSA_SK_CERT:
+        case KEY_ECDSA_SK:
+                return ssh_ecdsa_sk_verify(key, sig, siglen, data, dlen,
+                    compat, detailsp);
 # endif /* OPENSSL_HAS_ECC */
         case KEY_RSA_CERT:
         case KEY_RSA:
@@ -2674,6 +2821,10 @@ sshkey_verify(const struct sshkey *key,
         case KEY_ED25519:
         case KEY_ED25519_CERT:
                 return ssh_ed25519_verify(key, sig, siglen, data, dlen, compat);
+        case KEY_ED25519_SK:
+        case KEY_ED25519_SK_CERT:
+                return ssh_ed25519_sk_verify(key, sig, siglen, data, dlen,
+                    compat, detailsp);
 #ifdef WITH_XMSS
         case KEY_XMSS:
         case KEY_XMSS_CERT:
@@ -2701,7 +2852,13 @@ sshkey_to_certified(struct sshkey *k)
         case KEY_ECDSA:
                 newtype = KEY_ECDSA_CERT;
                 break;
+        case KEY_ECDSA_SK:
+                newtype = KEY_ECDSA_SK_CERT;
+                break;
 #endif /* WITH_OPENSSL */
+        case KEY_ED25519_SK:
+                newtype = KEY_ED25519_SK_CERT;
+                break;
         case KEY_ED25519:
                 newtype = KEY_ED25519_CERT;
                 break;
@@ -2734,7 +2891,7 @@ sshkey_drop_cert(struct sshkey *k)
 /* Sign a certified key, (re-)generating the signed certblob. */
 int
 sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg,
-    sshkey_certify_signer *signer, void *signer_ctx)
+    const char *sk_provider, sshkey_certify_signer *signer, void *signer_ctx)
 {
         struct sshbuf *principals = NULL;
         u_char *ca_blob = NULL, *sig_blob = NULL, nonce[32];
@@ -2798,12 +2955,18 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg,
                 break;
 # ifdef OPENSSL_HAS_ECC
         case KEY_ECDSA_CERT:
+        case KEY_ECDSA_SK_CERT:
                 if ((ret = sshbuf_put_cstring(cert,
                     sshkey_curve_nid_to_name(k->ecdsa_nid))) != 0 ||
                     (ret = sshbuf_put_ec(cert,
                     EC_KEY_get0_public_key(k->ecdsa),
                     EC_KEY_get0_group(k->ecdsa))) != 0)
                         goto out;
+                if (k->type == KEY_ECDSA_SK_CERT) {
+                        if ((ret = sshbuf_put_cstring(cert,
+                            k->sk_application)) != 0)
+                                goto out;
+                }
                 break;
 # endif /* OPENSSL_HAS_ECC */
         case KEY_RSA_CERT:
@@ -2814,9 +2977,15 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg,
                 break;
 #endif /* WITH_OPENSSL */
         case KEY_ED25519_CERT:
+        case KEY_ED25519_SK_CERT:
                 if ((ret = sshbuf_put_string(cert,
                     k->ed25519_pk, ED25519_PK_SZ)) != 0)
                         goto out;
+                if (k->type == KEY_ED25519_SK_CERT) {
+                        if ((ret = sshbuf_put_cstring(cert,
+                            k->sk_application)) != 0)
+                                goto out;
+                }
                 break;
 #ifdef WITH_XMSS
         case KEY_XMSS_CERT:
@@ -2860,7 +3029,7 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg,
 
         /* Sign the whole mess */
         if ((ret = signer(ca, &sig_blob, &sig_len, sshbuf_ptr(cert),
-            sshbuf_len(cert), alg, 0, signer_ctx)) != 0)
+            sshbuf_len(cert), alg, sk_provider, 0, signer_ctx)) != 0)
                 goto out;
         /* Check and update signature_type against what was actually used */
         if ((ret = sshkey_get_sigtype(sig_blob, sig_len, &sigtype)) != 0)
@@ -2890,17 +3059,20 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg,
 static int
 default_key_sign(struct sshkey *key, u_char **sigp, size_t *lenp,
     const u_char *data, size_t datalen,
-    const char *alg, u_int compat, void *ctx)
+    const char *alg, const char *sk_provider, u_int compat, void *ctx)
 {
         if (ctx != NULL)
                 return SSH_ERR_INVALID_ARGUMENT;
-        return sshkey_sign(key, sigp, lenp, data, datalen, alg, compat);
+        return sshkey_sign(key, sigp, lenp, data, datalen, alg,
+            sk_provider, compat);
 }
 
 int
-sshkey_certify(struct sshkey *k, struct sshkey *ca, const char *alg)
+sshkey_certify(struct sshkey *k, struct sshkey *ca, const char *alg,
+    const char *sk_provider)
 {
-        return sshkey_certify_custom(k, ca, alg, default_key_sign, NULL);
+        return sshkey_certify_custom(k, ca, alg, sk_provider,
+            default_key_sign, NULL);
 }
 
 int
@@ -3083,6 +3255,28 @@ sshkey_private_serialize_opt(struct sshkey *key, struct sshbuf *buf,
                     EC_KEY_get0_private_key(key->ecdsa))) != 0)
                         goto out;
                 break;
+        case KEY_ECDSA_SK:
+                if ((r = sshbuf_put_cstring(b,
+                    sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 ||
+                    (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 ||
+                    (r = sshbuf_put_cstring(b, key->sk_application)) != 0 ||
+                    (r = sshbuf_put_u8(b, key->sk_flags)) != 0 ||
+                    (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 ||
+                    (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0)
+                        goto out;
+                break;
+        case KEY_ECDSA_SK_CERT:
+                if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) {
+                        r = SSH_ERR_INVALID_ARGUMENT;
+                        goto out;
+                }
+                if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
+                    (r = sshbuf_put_cstring(b, key->sk_application)) != 0 ||
+                    (r = sshbuf_put_u8(b, key->sk_flags)) != 0 ||
+                    (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 ||
+                    (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0)
+                        goto out;
+                break;
 # endif /* OPENSSL_HAS_ECC */
 #endif /* WITH_OPENSSL */
         case KEY_ED25519:
@@ -3104,6 +3298,29 @@ sshkey_private_serialize_opt(struct sshkey *key, struct sshbuf *buf,
                     ED25519_SK_SZ)) != 0)
                         goto out;
                 break;
+        case KEY_ED25519_SK:
+                if ((r = sshbuf_put_string(b, key->ed25519_pk,
+                    ED25519_PK_SZ)) != 0 ||
+                    (r = sshbuf_put_cstring(b, key->sk_application)) != 0 ||
+                    (r = sshbuf_put_u8(b, key->sk_flags)) != 0 ||
+                    (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 ||
+                    (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0)
+                        goto out;
+                break;
+        case KEY_ED25519_SK_CERT:
+                if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) {
+                        r = SSH_ERR_INVALID_ARGUMENT;
+                        goto out;
+                }
+                if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
+                    (r = sshbuf_put_string(b, key->ed25519_pk,
+                    ED25519_PK_SZ)) != 0 ||
+                    (r = sshbuf_put_cstring(b, key->sk_application)) != 0 ||
+                    (r = sshbuf_put_u8(b, key->sk_flags)) != 0 ||
+                    (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 ||
+                    (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0)
+                        goto out;
+                break;
 #ifdef WITH_XMSS
         case KEY_XMSS:
                 if (key->xmss_name == NULL) {
@@ -3271,6 +3488,60 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                     (r = sshkey_ec_validate_private(k->ecdsa)) != 0)
                         goto out;
                 break;
+        case KEY_ECDSA_SK:
+                if ((k = sshkey_new(type)) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
+                if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) {
+                        r = SSH_ERR_INVALID_ARGUMENT;
+                        goto out;
+                }
+                if ((r = sshbuf_get_cstring(buf, &curve, NULL)) != 0)
+                        goto out;
+                if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) {
+                        r = SSH_ERR_EC_CURVE_MISMATCH;
+                        goto out;
+                }
+                if ((k->sk_key_handle = sshbuf_new()) == NULL ||
+                    (k->sk_reserved = sshbuf_new()) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
+                k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid);
+                if (k->ecdsa  == NULL) {
+                        r = SSH_ERR_LIBCRYPTO_ERROR;
+                        goto out;
+                }
+                if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 ||
+                    (r = sshbuf_get_cstring(buf, &k->sk_application,
+                    NULL)) != 0 ||
+                    (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 ||
+                    (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 ||
+                    (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0)
+                        goto out;
+                if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa),
+                    EC_KEY_get0_public_key(k->ecdsa))) != 0)
+                        goto out;
+                break;
+        case KEY_ECDSA_SK_CERT:
+                if ((r = sshkey_froms(buf, &k)) != 0)
+                        goto out;
+                if ((k->sk_key_handle = sshbuf_new()) == NULL ||
+                    (k->sk_reserved = sshbuf_new()) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
+                if ((r = sshbuf_get_cstring(buf, &k->sk_application,
+                    NULL)) != 0 ||
+                    (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 ||
+                    (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 ||
+                    (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0)
+                        goto out;
+                if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa),
+                    EC_KEY_get0_public_key(k->ecdsa))) != 0)
+                        goto out;
+                break;
 # endif /* OPENSSL_HAS_ECC */
         case KEY_RSA:
                 if ((k = sshkey_new(type)) == NULL) {
@@ -3359,6 +3630,57 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
                 k->ed25519_sk = ed25519_sk;
                 ed25519_pk = ed25519_sk = NULL; /* transferred */
                 break;
+        case KEY_ED25519_SK:
+                if ((k = sshkey_new(type)) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
+                if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0)
+                        goto out;
+                if (pklen != ED25519_PK_SZ) {
+                        r = SSH_ERR_INVALID_FORMAT;
+                        goto out;
+                }
+                if ((k->sk_key_handle = sshbuf_new()) == NULL ||
+                    (k->sk_reserved = sshbuf_new()) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
+                if ((r = sshbuf_get_cstring(buf, &k->sk_application,
+                    NULL)) != 0 ||
+                    (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 ||
+                    (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 ||
+                    (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0)
+                        goto out;
+                k->ed25519_pk = ed25519_pk;
+                ed25519_pk = NULL;
+                break;
+        case KEY_ED25519_SK_CERT:
+                if ((r = sshkey_froms(buf, &k)) != 0 ||
+                    (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0)
+                        goto out;
+                if (k->type != type) {
+                        r = SSH_ERR_INVALID_FORMAT;
+                        goto out;
+                }
+                if (pklen != ED25519_PK_SZ) {
+                        r = SSH_ERR_INVALID_FORMAT;
+                        goto out;
+                }
+                if ((k->sk_key_handle = sshbuf_new()) == NULL ||
+                    (k->sk_reserved = sshbuf_new()) == NULL) {
+                        r = SSH_ERR_ALLOC_FAIL;
+                        goto out;
+                }
+                if ((r = sshbuf_get_cstring(buf, &k->sk_application,
+                    NULL)) != 0 ||
+                    (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 ||
+                    (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 ||
+                    (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0)
+                        goto out;
+                k->ed25519_pk = ed25519_pk;
+                ed25519_pk = NULL; /* transferred */
+                break;
 #ifdef WITH_XMSS
         case KEY_XMSS:
                 if ((k = sshkey_new(type)) == NULL) {
@@ -3457,9 +3779,8 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
 int
 sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public)
 {
-        BN_CTX *bnctx;
         EC_POINT *nq = NULL;
-        BIGNUM *order, *x, *y, *tmp;
+        BIGNUM *order = NULL, *x = NULL, *y = NULL, *tmp = NULL;
         int ret = SSH_ERR_KEY_INVALID_EC_VALUE;
 
         /*
@@ -3470,10 +3791,6 @@ sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public)
          * EC_POINT_oct2point then the caller will need to explicitly check.
          */
 
-        if ((bnctx = BN_CTX_new()) == NULL)
-                return SSH_ERR_ALLOC_FAIL;
-        BN_CTX_start(bnctx);
-
         /*
          * We shouldn't ever hit this case because bignum_get_ecpoint()
          * refuses to load GF2m points.
@@ -3486,18 +3803,18 @@ sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public)
         if (EC_POINT_is_at_infinity(group, public))
                 goto out;
 
-        if ((x = BN_CTX_get(bnctx)) == NULL ||
-            (y = BN_CTX_get(bnctx)) == NULL ||
-            (order = BN_CTX_get(bnctx)) == NULL ||
-            (tmp = BN_CTX_get(bnctx)) == NULL) {
+        if ((x = BN_new()) == NULL ||
+            (y = BN_new()) == NULL ||
+            (order = BN_new()) == NULL ||
+            (tmp = BN_new()) == NULL) {
                 ret = SSH_ERR_ALLOC_FAIL;
                 goto out;
         }
 
         /* log2(x) > log2(order)/2, log2(y) > log2(order)/2 */
-        if (EC_GROUP_get_order(group, order, bnctx) != 1 ||
+        if (EC_GROUP_get_order(group, order, NULL) != 1 ||
             EC_POINT_get_affine_coordinates_GFp(group, public,
-            x, y, bnctx) != 1) {
+            x, y, NULL) != 1) {
                 ret = SSH_ERR_LIBCRYPTO_ERROR;
                 goto out;
         }
@@ -3510,7 +3827,7 @@ sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public)
                 ret = SSH_ERR_ALLOC_FAIL;
                 goto out;
         }
-        if (EC_POINT_mul(group, nq, NULL, public, order, bnctx) != 1) {
+        if (EC_POINT_mul(group, nq, NULL, public, order, NULL) != 1) {
                 ret = SSH_ERR_LIBCRYPTO_ERROR;
                 goto out;
         }
@@ -3526,7 +3843,10 @@ sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public)
                 goto out;
         ret = 0;
  out:
-        BN_CTX_free(bnctx);
+        BN_clear_free(x);
+        BN_clear_free(y);
+        BN_clear_free(order);
+        BN_clear_free(tmp);
         EC_POINT_free(nq);
         return ret;
 }
@@ -3534,22 +3854,16 @@ sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public)
 int
 sshkey_ec_validate_private(const EC_KEY *key)
 {
-        BN_CTX *bnctx;
-        BIGNUM *order, *tmp;
+        BIGNUM *order = NULL, *tmp = NULL;
         int ret = SSH_ERR_KEY_INVALID_EC_VALUE;
 
-        if ((bnctx = BN_CTX_new()) == NULL)
-                return SSH_ERR_ALLOC_FAIL;
-        BN_CTX_start(bnctx);
-
-        if ((order = BN_CTX_get(bnctx)) == NULL ||
-            (tmp = BN_CTX_get(bnctx)) == NULL) {
+        if ((order = BN_new()) == NULL || (tmp = BN_new()) == NULL) {
                 ret = SSH_ERR_ALLOC_FAIL;
                 goto out;
         }
 
         /* log2(private) > log2(order)/2 */
-        if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, bnctx) != 1) {
+        if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, NULL) != 1) {
                 ret = SSH_ERR_LIBCRYPTO_ERROR;
                 goto out;
         }
@@ -3566,47 +3880,43 @@ sshkey_ec_validate_private(const EC_KEY *key)
                 goto out;
         ret = 0;
  out:
-        BN_CTX_free(bnctx);
+        BN_clear_free(order);
+        BN_clear_free(tmp);
         return ret;
 }
 
 void
 sshkey_dump_ec_point(const EC_GROUP *group, const EC_POINT *point)
 {
-        BIGNUM *x, *y;
-        BN_CTX *bnctx;
+        BIGNUM *x = NULL, *y = NULL;
 
         if (point == NULL) {
                 fputs("point=(NULL)\n", stderr);
                 return;
         }
-        if ((bnctx = BN_CTX_new()) == NULL) {
-                fprintf(stderr, "%s: BN_CTX_new failed\n", __func__);
-                return;
-        }
-        BN_CTX_start(bnctx);
-        if ((x = BN_CTX_get(bnctx)) == NULL ||
-            (y = BN_CTX_get(bnctx)) == NULL) {
-                fprintf(stderr, "%s: BN_CTX_get failed\n", __func__);
-                return;
+        if ((x = BN_new()) == NULL || (y = BN_new()) == NULL) {
+                fprintf(stderr, "%s: BN_new failed\n", __func__);
+                goto out;
         }
         if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) !=
             NID_X9_62_prime_field) {
                 fprintf(stderr, "%s: group is not a prime field\n", __func__);
-                return;
+                goto out;
         }
-        if (EC_POINT_get_affine_coordinates_GFp(group, point, x, y,
-            bnctx) != 1) {
+        if (EC_POINT_get_affine_coordinates_GFp(group, point,
+            x, y, NULL) != 1) {
                 fprintf(stderr, "%s: EC_POINT_get_affine_coordinates_GFp\n",
                     __func__);
-                return;
+                goto out;
         }
         fputs("x=", stderr);
         BN_print_fp(stderr, x);
         fputs("\ny=", stderr);
         BN_print_fp(stderr, y);
         fputs("\n", stderr);
-        BN_CTX_free(bnctx);
+ out:
+        BN_clear_free(x);
+        BN_clear_free(y);
 }
 
 void
@@ -4088,9 +4398,13 @@ sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob,
                 break; /* see below */
 #endif /* WITH_OPENSSL */
         case KEY_ED25519:
+        case KEY_ED25519_SK:
 #ifdef WITH_XMSS
         case KEY_XMSS:
 #endif /* WITH_XMSS */
+#ifdef WITH_OPENSSL
+        case KEY_ECDSA_SK:
+#endif /* WITH_OPENSSL */
                 return sshkey_private_to_blob2(key, blob, passphrase,
                     comment, openssh_format_cipher, openssh_format_rounds);
         default:
@@ -4112,7 +4426,6 @@ sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob,
 #endif /* WITH_OPENSSL */
 }
 
-
 #ifdef WITH_OPENSSL
 static int
 translate_libcrypto_error(unsigned long pem_err)
@@ -4346,6 +4659,12 @@ sshkey_parse_private_fileblob(struct sshbuf *buffer, const char *passphrase,
             passphrase, keyp, commentp);
 }
 
+void
+sshkey_sig_details_free(struct sshkey_sig_details *details)
+{
+        freezero(details, sizeof(*details));
+}
+
 #ifdef WITH_XMSS
 /*
  * serialize the key with the current state and forward the state