diff options
Diffstat (limited to 'sshkey.h')
-rw-r--r-- | sshkey.h | 233 |
1 files changed, 233 insertions, 0 deletions
diff --git a/sshkey.h b/sshkey.h new file mode 100644 index 000000000..b573e7f33 --- /dev/null +++ b/sshkey.h | |||
@@ -0,0 +1,233 @@ | |||
1 | /* $OpenBSD: sshkey.h,v 1.1 2014/06/24 01:16:58 djm Exp $ */ | ||
2 | |||
3 | /* | ||
4 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. | ||
5 | * | ||
6 | * Redistribution and use in source and binary forms, with or without | ||
7 | * modification, are permitted provided that the following conditions | ||
8 | * are met: | ||
9 | * 1. Redistributions of source code must retain the above copyright | ||
10 | * notice, this list of conditions and the following disclaimer. | ||
11 | * 2. Redistributions in binary form must reproduce the above copyright | ||
12 | * notice, this list of conditions and the following disclaimer in the | ||
13 | * documentation and/or other materials provided with the distribution. | ||
14 | * | ||
15 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
16 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
17 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
18 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
19 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
20 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
21 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
22 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
23 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
24 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
25 | */ | ||
26 | #ifndef SSHKEY_H | ||
27 | #define SSHKEY_H | ||
28 | |||
29 | #include <sys/types.h> | ||
30 | |||
31 | #ifdef WITH_OPENSSL | ||
32 | #include <openssl/rsa.h> | ||
33 | #include <openssl/dsa.h> | ||
34 | # ifdef OPENSSL_HAS_ECC | ||
35 | # include <openssl/ec.h> | ||
36 | # else /* OPENSSL_HAS_ECC */ | ||
37 | # define EC_KEY void | ||
38 | # define EC_GROUP void | ||
39 | # define EC_POINT void | ||
40 | # endif /* OPENSSL_HAS_ECC */ | ||
41 | #else /* WITH_OPENSSL */ | ||
42 | # define RSA void | ||
43 | # define DSA void | ||
44 | # define EC_KEY void | ||
45 | # define EC_GROUP void | ||
46 | # define EC_POINT void | ||
47 | #endif /* WITH_OPENSSL */ | ||
48 | |||
49 | #define SSH_RSA_MINIMUM_MODULUS_SIZE 768 | ||
50 | #define SSH_KEY_MAX_SIGN_DATA_SIZE (1 << 20) | ||
51 | |||
52 | struct sshbuf; | ||
53 | |||
54 | /* Key types */ | ||
55 | enum sshkey_types { | ||
56 | KEY_RSA1, | ||
57 | KEY_RSA, | ||
58 | KEY_DSA, | ||
59 | KEY_ECDSA, | ||
60 | KEY_ED25519, | ||
61 | KEY_RSA_CERT, | ||
62 | KEY_DSA_CERT, | ||
63 | KEY_ECDSA_CERT, | ||
64 | KEY_ED25519_CERT, | ||
65 | KEY_RSA_CERT_V00, | ||
66 | KEY_DSA_CERT_V00, | ||
67 | KEY_NULL, | ||
68 | KEY_UNSPEC | ||
69 | }; | ||
70 | |||
71 | /* Fingerprint hash algorithms */ | ||
72 | enum sshkey_fp_type { | ||
73 | SSH_FP_SHA1, | ||
74 | SSH_FP_MD5, | ||
75 | SSH_FP_SHA256 | ||
76 | }; | ||
77 | |||
78 | /* Fingerprint representation formats */ | ||
79 | enum sshkey_fp_rep { | ||
80 | SSH_FP_HEX, | ||
81 | SSH_FP_BUBBLEBABBLE, | ||
82 | SSH_FP_RANDOMART | ||
83 | }; | ||
84 | |||
85 | /* key is stored in external hardware */ | ||
86 | #define SSHKEY_FLAG_EXT 0x0001 | ||
87 | |||
88 | #define SSHKEY_CERT_MAX_PRINCIPALS 256 | ||
89 | /* XXX opaquify? */ | ||
90 | struct sshkey_cert { | ||
91 | struct sshbuf *certblob; /* Kept around for use on wire */ | ||
92 | u_int type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */ | ||
93 | u_int64_t serial; | ||
94 | char *key_id; | ||
95 | u_int nprincipals; | ||
96 | char **principals; | ||
97 | u_int64_t valid_after, valid_before; | ||
98 | struct sshbuf *critical; | ||
99 | struct sshbuf *extensions; | ||
100 | struct sshkey *signature_key; | ||
101 | }; | ||
102 | |||
103 | /* XXX opaquify? */ | ||
104 | struct sshkey { | ||
105 | int type; | ||
106 | int flags; | ||
107 | RSA *rsa; | ||
108 | DSA *dsa; | ||
109 | int ecdsa_nid; /* NID of curve */ | ||
110 | EC_KEY *ecdsa; | ||
111 | u_char *ed25519_sk; | ||
112 | u_char *ed25519_pk; | ||
113 | struct sshkey_cert *cert; | ||
114 | }; | ||
115 | |||
116 | #define ED25519_SK_SZ crypto_sign_ed25519_SECRETKEYBYTES | ||
117 | #define ED25519_PK_SZ crypto_sign_ed25519_PUBLICKEYBYTES | ||
118 | |||
119 | struct sshkey *sshkey_new(int); | ||
120 | int sshkey_add_private(struct sshkey *); | ||
121 | struct sshkey *sshkey_new_private(int); | ||
122 | void sshkey_free(struct sshkey *); | ||
123 | int sshkey_demote(const struct sshkey *, struct sshkey **); | ||
124 | int sshkey_equal_public(const struct sshkey *, | ||
125 | const struct sshkey *); | ||
126 | int sshkey_equal(const struct sshkey *, const struct sshkey *); | ||
127 | char *sshkey_fingerprint(const struct sshkey *, | ||
128 | enum sshkey_fp_type, enum sshkey_fp_rep); | ||
129 | int sshkey_fingerprint_raw(const struct sshkey *k, | ||
130 | enum sshkey_fp_type dgst_type, u_char **retp, size_t *lenp); | ||
131 | const char *sshkey_type(const struct sshkey *); | ||
132 | const char *sshkey_cert_type(const struct sshkey *); | ||
133 | int sshkey_write(const struct sshkey *, FILE *); | ||
134 | int sshkey_read(struct sshkey *, char **); | ||
135 | u_int sshkey_size(const struct sshkey *); | ||
136 | |||
137 | int sshkey_generate(int type, u_int bits, struct sshkey **keyp); | ||
138 | int sshkey_from_private(const struct sshkey *, struct sshkey **); | ||
139 | int sshkey_type_from_name(const char *); | ||
140 | int sshkey_is_cert(const struct sshkey *); | ||
141 | int sshkey_type_is_cert(int); | ||
142 | int sshkey_type_plain(int); | ||
143 | int sshkey_to_certified(struct sshkey *, int); | ||
144 | int sshkey_drop_cert(struct sshkey *); | ||
145 | int sshkey_certify(struct sshkey *, struct sshkey *); | ||
146 | int sshkey_cert_copy(const struct sshkey *, struct sshkey *); | ||
147 | int sshkey_cert_check_authority(const struct sshkey *, int, int, | ||
148 | const char *, const char **); | ||
149 | int sshkey_cert_is_legacy(const struct sshkey *); | ||
150 | |||
151 | int sshkey_ecdsa_nid_from_name(const char *); | ||
152 | int sshkey_curve_name_to_nid(const char *); | ||
153 | const char * sshkey_curve_nid_to_name(int); | ||
154 | u_int sshkey_curve_nid_to_bits(int); | ||
155 | int sshkey_ecdsa_bits_to_nid(int); | ||
156 | int sshkey_ecdsa_key_to_nid(EC_KEY *); | ||
157 | int sshkey_ec_nid_to_hash_alg(int nid); | ||
158 | int sshkey_ec_validate_public(const EC_GROUP *, const EC_POINT *); | ||
159 | int sshkey_ec_validate_private(const EC_KEY *); | ||
160 | const char *sshkey_ssh_name(const struct sshkey *); | ||
161 | const char *sshkey_ssh_name_plain(const struct sshkey *); | ||
162 | int sshkey_names_valid2(const char *); | ||
163 | char *key_alg_list(int, int); | ||
164 | |||
165 | int sshkey_from_blob(const u_char *, size_t, struct sshkey **); | ||
166 | int sshkey_to_blob_buf(const struct sshkey *, struct sshbuf *); | ||
167 | int sshkey_to_blob(const struct sshkey *, u_char **, size_t *); | ||
168 | int sshkey_plain_to_blob_buf(const struct sshkey *, struct sshbuf *); | ||
169 | int sshkey_plain_to_blob(const struct sshkey *, u_char **, size_t *); | ||
170 | |||
171 | int sshkey_sign(const struct sshkey *, u_char **, size_t *, | ||
172 | const u_char *, size_t, u_int); | ||
173 | int sshkey_verify(const struct sshkey *, const u_char *, size_t, | ||
174 | const u_char *, size_t, u_int); | ||
175 | |||
176 | /* for debug */ | ||
177 | void sshkey_dump_ec_point(const EC_GROUP *, const EC_POINT *); | ||
178 | void sshkey_dump_ec_key(const EC_KEY *); | ||
179 | |||
180 | /* private key parsing and serialisation */ | ||
181 | int sshkey_private_serialize(const struct sshkey *key, struct sshbuf *buf); | ||
182 | int sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **keyp); | ||
183 | |||
184 | /* private key file format parsing and serialisation */ | ||
185 | int sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob, | ||
186 | const char *passphrase, const char *comment, | ||
187 | int force_new_format, const char *new_format_cipher, int new_format_rounds); | ||
188 | int sshkey_parse_public_rsa1_fileblob(struct sshbuf *blob, | ||
189 | struct sshkey **keyp, char **commentp); | ||
190 | int sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, | ||
191 | const char *passphrase, struct sshkey **keyp, char **commentp); | ||
192 | int sshkey_parse_private_fileblob(struct sshbuf *buffer, | ||
193 | const char *passphrase, const char *filename, struct sshkey **keyp, | ||
194 | char **commentp); | ||
195 | int sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type, | ||
196 | const char *passphrase, struct sshkey **keyp, char **commentp); | ||
197 | |||
198 | #ifdef SSHKEY_INTERNAL | ||
199 | int ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp, | ||
200 | const u_char *data, size_t datalen, u_int compat); | ||
201 | int ssh_rsa_verify(const struct sshkey *key, | ||
202 | const u_char *signature, size_t signaturelen, | ||
203 | const u_char *data, size_t datalen, u_int compat); | ||
204 | int ssh_dss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp, | ||
205 | const u_char *data, size_t datalen, u_int compat); | ||
206 | int ssh_dss_verify(const struct sshkey *key, | ||
207 | const u_char *signature, size_t signaturelen, | ||
208 | const u_char *data, size_t datalen, u_int compat); | ||
209 | int ssh_ecdsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp, | ||
210 | const u_char *data, size_t datalen, u_int compat); | ||
211 | int ssh_ecdsa_verify(const struct sshkey *key, | ||
212 | const u_char *signature, size_t signaturelen, | ||
213 | const u_char *data, size_t datalen, u_int compat); | ||
214 | int ssh_ed25519_sign(const struct sshkey *key, u_char **sigp, size_t *lenp, | ||
215 | const u_char *data, size_t datalen, u_int compat); | ||
216 | int ssh_ed25519_verify(const struct sshkey *key, | ||
217 | const u_char *signature, size_t signaturelen, | ||
218 | const u_char *data, size_t datalen, u_int compat); | ||
219 | #endif | ||
220 | |||
221 | #if !defined(WITH_OPENSSL) | ||
222 | # undef RSA | ||
223 | # undef DSA | ||
224 | # undef EC_KEY | ||
225 | # undef EC_GROUP | ||
226 | # undef EC_POINT | ||
227 | #elif !defined(OPENSSL_HAS_ECC) | ||
228 | # undef EC_KEY | ||
229 | # undef EC_GROUP | ||
230 | # undef EC_POINT | ||
231 | #endif | ||
232 | |||
233 | #endif /* SSHKEY_H */ | ||