blob: 39e5577f6b4446f862ad7ef1ef08ce4bef61746b [file] [log] [blame]
Damien Miller3bde12a2012-06-20 21:51:11 +10001/* $OpenBSD: key.h,v 1.34 2012/05/23 03:28:28 djm Exp $ */
Ben Lindstrom36579d32001-01-29 07:39:26 +00002
Damien Millere4340be2000-09-16 13:29:08 +11003/*
Ben Lindstrom44697232001-07-04 03:32:30 +00004 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
Damien Millere4340be2000-09-16 13:29:08 +11005 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
Damien Miller450a7a12000-03-26 13:04:51 +100026#ifndef KEY_H
27#define KEY_H
28
Damien Miller0a80ca12010-02-27 07:55:05 +110029#include "buffer.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000030#include <openssl/rsa.h>
31#include <openssl/dsa.h>
Damien Miller6af914a2010-09-10 11:39:26 +100032#ifdef OPENSSL_HAS_ECC
Damien Millereb8b60e2010-08-31 22:41:14 +100033#include <openssl/ec.h>
Damien Miller6af914a2010-09-10 11:39:26 +100034#endif
Ben Lindstrom226cfa02001-01-22 05:34:40 +000035
Damien Miller450a7a12000-03-26 13:04:51 +100036typedef struct Key Key;
37enum types {
Damien Miller0bc1bd82000-11-13 22:57:25 +110038 KEY_RSA1,
Damien Miller450a7a12000-03-26 13:04:51 +100039 KEY_RSA,
40 KEY_DSA,
Damien Millereb8b60e2010-08-31 22:41:14 +100041 KEY_ECDSA,
Damien Miller0a80ca12010-02-27 07:55:05 +110042 KEY_RSA_CERT,
43 KEY_DSA_CERT,
Damien Millereb8b60e2010-08-31 22:41:14 +100044 KEY_ECDSA_CERT,
Damien Miller4e270b02010-04-16 15:56:21 +100045 KEY_RSA_CERT_V00,
46 KEY_DSA_CERT_V00,
Damien Miller0bc1bd82000-11-13 22:57:25 +110047 KEY_UNSPEC
Damien Miller450a7a12000-03-26 13:04:51 +100048};
Ben Lindstrom96e8ea62001-03-11 20:03:44 +000049enum fp_type {
50 SSH_FP_SHA1,
Damien Miller3bde12a2012-06-20 21:51:11 +100051 SSH_FP_MD5,
52 SSH_FP_SHA256
Ben Lindstrom96e8ea62001-03-11 20:03:44 +000053};
54enum fp_rep {
55 SSH_FP_HEX,
Darren Tucker9c16ac92008-06-13 04:40:35 +100056 SSH_FP_BUBBLEBABBLE,
57 SSH_FP_RANDOMART
Ben Lindstrom96e8ea62001-03-11 20:03:44 +000058};
Ben Lindstromc5b68002001-07-04 04:52:03 +000059
60/* key is stored in external hardware */
61#define KEY_FLAG_EXT 0x0001
62
Damien Miller0a80ca12010-02-27 07:55:05 +110063#define CERT_MAX_PRINCIPALS 256
64struct KeyCert {
65 Buffer certblob; /* Kept around for use on wire */
66 u_int type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */
Damien Miller4e270b02010-04-16 15:56:21 +100067 u_int64_t serial;
Damien Miller0a80ca12010-02-27 07:55:05 +110068 char *key_id;
69 u_int nprincipals;
70 char **principals;
71 u_int64_t valid_after, valid_before;
Damien Miller4e270b02010-04-16 15:56:21 +100072 Buffer critical;
73 Buffer extensions;
Damien Miller0a80ca12010-02-27 07:55:05 +110074 Key *signature_key;
75};
76
Damien Miller450a7a12000-03-26 13:04:51 +100077struct Key {
Ben Lindstromc5b68002001-07-04 04:52:03 +000078 int type;
79 int flags;
Damien Miller450a7a12000-03-26 13:04:51 +100080 RSA *rsa;
81 DSA *dsa;
Damien Millereb8b60e2010-08-31 22:41:14 +100082 int ecdsa_nid; /* NID of curve */
Damien Miller6af914a2010-09-10 11:39:26 +100083#ifdef OPENSSL_HAS_ECC
Damien Millereb8b60e2010-08-31 22:41:14 +100084 EC_KEY *ecdsa;
Damien Miller6af914a2010-09-10 11:39:26 +100085#else
86 void *ecdsa;
87#endif
Damien Miller0a80ca12010-02-27 07:55:05 +110088 struct KeyCert *cert;
Damien Miller450a7a12000-03-26 13:04:51 +100089};
90
Damien Millerf58b58c2003-11-17 21:18:23 +110091Key *key_new(int);
Damien Miller0a80ca12010-02-27 07:55:05 +110092void key_add_private(Key *);
Damien Millerf58b58c2003-11-17 21:18:23 +110093Key *key_new_private(int);
94void key_free(Key *);
95Key *key_demote(const Key *);
Damien Miller0a80ca12010-02-27 07:55:05 +110096int key_equal_public(const Key *, const Key *);
Damien Millerf58b58c2003-11-17 21:18:23 +110097int key_equal(const Key *, const Key *);
Damien Miller0a80ca12010-02-27 07:55:05 +110098char *key_fingerprint(Key *, enum fp_type, enum fp_rep);
99u_char *key_fingerprint_raw(Key *, enum fp_type, u_int *);
Damien Millerf58b58c2003-11-17 21:18:23 +1100100const char *key_type(const Key *);
Damien Miller1cfbfaf2010-03-22 05:58:24 +1100101const char *key_cert_type(const Key *);
Damien Millerf58b58c2003-11-17 21:18:23 +1100102int key_write(const Key *, FILE *);
103int key_read(Key *, char **);
104u_int key_size(const Key *);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100105
Ben Lindstrom16ae3d02001-07-04 04:02:36 +0000106Key *key_generate(int, u_int);
Damien Millerf58b58c2003-11-17 21:18:23 +1100107Key *key_from_private(const Key *);
Ben Lindstrom4cc240d2001-07-04 04:46:56 +0000108int key_type_from_name(char *);
Damien Miller0a80ca12010-02-27 07:55:05 +1100109int key_is_cert(const Key *);
110int key_type_plain(int);
Damien Miller4e270b02010-04-16 15:56:21 +1000111int key_to_certified(Key *, int);
Damien Miller0a80ca12010-02-27 07:55:05 +1100112int key_drop_cert(Key *);
113int key_certify(Key *, Key *);
114void key_cert_copy(const Key *, struct Key *);
115int key_cert_check_authority(const Key *, int, int, const char *,
116 const char **);
Damien Miller4e270b02010-04-16 15:56:21 +1000117int key_cert_is_legacy(Key *);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100118
Damien Millereb8b60e2010-08-31 22:41:14 +1000119int key_ecdsa_nid_from_name(const char *);
120int key_curve_name_to_nid(const char *);
121const char * key_curve_nid_to_name(int);
Damien Miller041ab7c2010-09-10 11:23:34 +1000122u_int key_curve_nid_to_bits(int);
Damien Millereb8b60e2010-08-31 22:41:14 +1000123int key_ecdsa_bits_to_nid(int);
Damien Miller6af914a2010-09-10 11:39:26 +1000124#ifdef OPENSSL_HAS_ECC
Damien Millerb472a902010-11-05 10:19:49 +1100125int key_ecdsa_key_to_nid(EC_KEY *);
Damien Miller041ab7c2010-09-10 11:23:34 +1000126const EVP_MD * key_ec_nid_to_evpmd(int nid);
Damien Millereb8b60e2010-08-31 22:41:14 +1000127int key_ec_validate_public(const EC_GROUP *, const EC_POINT *);
128int key_ec_validate_private(const EC_KEY *);
Damien Miller6af914a2010-09-10 11:39:26 +1000129#endif
Damien Millereb8b60e2010-08-31 22:41:14 +1000130
Damien Millerf58b58c2003-11-17 21:18:23 +1100131Key *key_from_blob(const u_char *, u_int);
132int key_to_blob(const Key *, u_char **, u_int *);
133const char *key_ssh_name(const Key *);
Damien Millereb8b60e2010-08-31 22:41:14 +1000134const char *key_ssh_name_plain(const Key *);
Damien Millerf58b58c2003-11-17 21:18:23 +1100135int key_names_valid2(const char *);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100136
Damien Millerf58b58c2003-11-17 21:18:23 +1100137int key_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
138int key_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
Damien Miller450a7a12000-03-26 13:04:51 +1000139
Damien Millerf58b58c2003-11-17 21:18:23 +1100140int ssh_dss_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
141int ssh_dss_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
Damien Millereb8b60e2010-08-31 22:41:14 +1000142int ssh_ecdsa_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
143int ssh_ecdsa_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
Damien Millerf58b58c2003-11-17 21:18:23 +1100144int ssh_rsa_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
145int ssh_rsa_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
Damien Millere8a240f2003-02-24 12:01:40 +1100146
Damien Miller6af914a2010-09-10 11:39:26 +1000147#if defined(OPENSSL_HAS_ECC) && (defined(DEBUG_KEXECDH) || defined(DEBUG_PK))
Damien Millereb8b60e2010-08-31 22:41:14 +1000148void key_dump_ec_point(const EC_GROUP *, const EC_POINT *);
149void key_dump_ec_key(const EC_KEY *);
150#endif
151
Damien Miller450a7a12000-03-26 13:04:51 +1000152#endif