blob: 8c3d866bfd60023b76ff3de80016c6cb39ce8a92 [file] [log] [blame]
djm@openbsd.org57464e32016-05-02 09:36:42 +00001/* $OpenBSD: sshkey.h,v 1.13 2016/05/02 09:36:42 djm Exp $ */
Damien Miller86687062014-07-02 15:28:02 +10002
3/*
4 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26#ifndef SSHKEY_H
27#define SSHKEY_H
28
29#include <sys/types.h>
30
31#ifdef WITH_OPENSSL
32#include <openssl/rsa.h>
33#include <openssl/dsa.h>
Damien Millerf0935692014-08-20 11:06:50 +100034# ifdef OPENSSL_HAS_ECC
35# include <openssl/ec.h>
36# else /* OPENSSL_HAS_ECC */
37# define EC_KEY void
38# define EC_GROUP void
39# define EC_POINT void
40# endif /* OPENSSL_HAS_ECC */
41#else /* WITH_OPENSSL */
42# define RSA void
43# define DSA void
44# define EC_KEY void
45# define EC_GROUP void
46# define EC_POINT void
Damien Miller86687062014-07-02 15:28:02 +100047#endif /* WITH_OPENSSL */
48
djm@openbsd.org57e8e222015-08-04 05:23:06 +000049#define SSH_RSA_MINIMUM_MODULUS_SIZE 768
Damien Miller86687062014-07-02 15:28:02 +100050#define SSH_KEY_MAX_SIGN_DATA_SIZE (1 << 20)
51
52struct sshbuf;
53
54/* Key types */
55enum sshkey_types {
56 KEY_RSA1,
57 KEY_RSA,
58 KEY_DSA,
59 KEY_ECDSA,
60 KEY_ED25519,
61 KEY_RSA_CERT,
62 KEY_DSA_CERT,
63 KEY_ECDSA_CERT,
64 KEY_ED25519_CERT,
Damien Miller86687062014-07-02 15:28:02 +100065 KEY_UNSPEC
66};
67
djm@openbsd.org56d1c832014-12-21 22:27:55 +000068/* Default fingerprint hash */
69#define SSH_FP_HASH_DEFAULT SSH_DIGEST_SHA256
Damien Miller86687062014-07-02 15:28:02 +100070
71/* Fingerprint representation formats */
72enum sshkey_fp_rep {
djm@openbsd.org56d1c832014-12-21 22:27:55 +000073 SSH_FP_DEFAULT = 0,
Damien Miller86687062014-07-02 15:28:02 +100074 SSH_FP_HEX,
djm@openbsd.org56d1c832014-12-21 22:27:55 +000075 SSH_FP_BASE64,
Damien Miller86687062014-07-02 15:28:02 +100076 SSH_FP_BUBBLEBABBLE,
77 SSH_FP_RANDOMART
78};
79
80/* key is stored in external hardware */
81#define SSHKEY_FLAG_EXT 0x0001
82
83#define SSHKEY_CERT_MAX_PRINCIPALS 256
84/* XXX opaquify? */
85struct sshkey_cert {
86 struct sshbuf *certblob; /* Kept around for use on wire */
87 u_int type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */
88 u_int64_t serial;
89 char *key_id;
90 u_int nprincipals;
91 char **principals;
92 u_int64_t valid_after, valid_before;
93 struct sshbuf *critical;
94 struct sshbuf *extensions;
95 struct sshkey *signature_key;
96};
97
98/* XXX opaquify? */
99struct sshkey {
100 int type;
101 int flags;
102 RSA *rsa;
103 DSA *dsa;
104 int ecdsa_nid; /* NID of curve */
105 EC_KEY *ecdsa;
106 u_char *ed25519_sk;
107 u_char *ed25519_pk;
108 struct sshkey_cert *cert;
109};
110
111#define ED25519_SK_SZ crypto_sign_ed25519_SECRETKEYBYTES
112#define ED25519_PK_SZ crypto_sign_ed25519_PUBLICKEYBYTES
113
114struct sshkey *sshkey_new(int);
115int sshkey_add_private(struct sshkey *);
116struct sshkey *sshkey_new_private(int);
117void sshkey_free(struct sshkey *);
118int sshkey_demote(const struct sshkey *, struct sshkey **);
119int sshkey_equal_public(const struct sshkey *,
120 const struct sshkey *);
121int sshkey_equal(const struct sshkey *, const struct sshkey *);
122char *sshkey_fingerprint(const struct sshkey *,
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000123 int, enum sshkey_fp_rep);
Damien Miller86687062014-07-02 15:28:02 +1000124int sshkey_fingerprint_raw(const struct sshkey *k,
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000125 int, u_char **retp, size_t *lenp);
Damien Miller86687062014-07-02 15:28:02 +1000126const char *sshkey_type(const struct sshkey *);
127const char *sshkey_cert_type(const struct sshkey *);
128int sshkey_write(const struct sshkey *, FILE *);
129int sshkey_read(struct sshkey *, char **);
130u_int sshkey_size(const struct sshkey *);
131
132int sshkey_generate(int type, u_int bits, struct sshkey **keyp);
133int sshkey_from_private(const struct sshkey *, struct sshkey **);
134int sshkey_type_from_name(const char *);
135int sshkey_is_cert(const struct sshkey *);
136int sshkey_type_is_cert(int);
137int sshkey_type_plain(int);
djm@openbsd.orgc28fc622015-07-03 03:43:18 +0000138int sshkey_to_certified(struct sshkey *);
Damien Miller86687062014-07-02 15:28:02 +1000139int sshkey_drop_cert(struct sshkey *);
djm@openbsd.org57464e32016-05-02 09:36:42 +0000140int sshkey_certify(struct sshkey *, struct sshkey *, const char *);
Damien Miller86687062014-07-02 15:28:02 +1000141int sshkey_cert_copy(const struct sshkey *, struct sshkey *);
142int sshkey_cert_check_authority(const struct sshkey *, int, int,
143 const char *, const char **);
djm@openbsd.org499cf362015-11-19 01:08:55 +0000144size_t sshkey_format_cert_validity(const struct sshkey_cert *,
145 char *, size_t) __attribute__((__bounded__(__string__, 2, 3)));
Damien Miller86687062014-07-02 15:28:02 +1000146
147int sshkey_ecdsa_nid_from_name(const char *);
148int sshkey_curve_name_to_nid(const char *);
149const char * sshkey_curve_nid_to_name(int);
150u_int sshkey_curve_nid_to_bits(int);
151int sshkey_ecdsa_bits_to_nid(int);
152int sshkey_ecdsa_key_to_nid(EC_KEY *);
153int sshkey_ec_nid_to_hash_alg(int nid);
154int sshkey_ec_validate_public(const EC_GROUP *, const EC_POINT *);
155int sshkey_ec_validate_private(const EC_KEY *);
156const char *sshkey_ssh_name(const struct sshkey *);
157const char *sshkey_ssh_name_plain(const struct sshkey *);
djm@openbsd.org1f729f02015-01-13 07:39:19 +0000158int sshkey_names_valid2(const char *, int);
Damien Miller86687062014-07-02 15:28:02 +1000159char *key_alg_list(int, int);
160
161int sshkey_from_blob(const u_char *, size_t, struct sshkey **);
djm@openbsd.org60b18252015-01-26 02:59:11 +0000162int sshkey_fromb(struct sshbuf *, struct sshkey **);
163int sshkey_froms(struct sshbuf *, struct sshkey **);
Damien Miller86687062014-07-02 15:28:02 +1000164int sshkey_to_blob(const struct sshkey *, u_char **, size_t *);
djm@openbsd.orgd80fbe42015-05-21 04:55:51 +0000165int sshkey_to_base64(const struct sshkey *, char **);
djm@openbsd.org60b18252015-01-26 02:59:11 +0000166int sshkey_putb(const struct sshkey *, struct sshbuf *);
167int sshkey_puts(const struct sshkey *, struct sshbuf *);
Damien Miller86687062014-07-02 15:28:02 +1000168int sshkey_plain_to_blob(const struct sshkey *, u_char **, size_t *);
djm@openbsd.org60b18252015-01-26 02:59:11 +0000169int sshkey_putb_plain(const struct sshkey *, struct sshbuf *);
Damien Miller86687062014-07-02 15:28:02 +1000170
171int sshkey_sign(const struct sshkey *, u_char **, size_t *,
markus@openbsd.org76c9fbb2015-12-04 16:41:28 +0000172 const u_char *, size_t, const char *, u_int);
Damien Miller86687062014-07-02 15:28:02 +1000173int sshkey_verify(const struct sshkey *, const u_char *, size_t,
174 const u_char *, size_t, u_int);
175
176/* for debug */
177void sshkey_dump_ec_point(const EC_GROUP *, const EC_POINT *);
178void sshkey_dump_ec_key(const EC_KEY *);
179
180/* private key parsing and serialisation */
181int sshkey_private_serialize(const struct sshkey *key, struct sshbuf *buf);
182int sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **keyp);
183
184/* private key file format parsing and serialisation */
185int sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob,
186 const char *passphrase, const char *comment,
187 int force_new_format, const char *new_format_cipher, int new_format_rounds);
188int sshkey_parse_public_rsa1_fileblob(struct sshbuf *blob,
189 struct sshkey **keyp, char **commentp);
Damien Miller86687062014-07-02 15:28:02 +1000190int sshkey_parse_private_fileblob(struct sshbuf *buffer,
tim@openbsd.org3c019a92015-09-13 14:39:16 +0000191 const char *passphrase, struct sshkey **keyp, char **commentp);
Damien Miller86687062014-07-02 15:28:02 +1000192int sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type,
193 const char *passphrase, struct sshkey **keyp, char **commentp);
194
195#ifdef SSHKEY_INTERNAL
markus@openbsd.org76c9fbb2015-12-04 16:41:28 +0000196int ssh_rsa_sign(const struct sshkey *key,
197 u_char **sigp, size_t *lenp, const u_char *data, size_t datalen,
198 const char *ident);
Damien Miller86687062014-07-02 15:28:02 +1000199int ssh_rsa_verify(const struct sshkey *key,
markus@openbsd.org76c9fbb2015-12-04 16:41:28 +0000200 const u_char *sig, size_t siglen, const u_char *data, size_t datalen);
Damien Miller86687062014-07-02 15:28:02 +1000201int ssh_dss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
202 const u_char *data, size_t datalen, u_int compat);
203int ssh_dss_verify(const struct sshkey *key,
204 const u_char *signature, size_t signaturelen,
205 const u_char *data, size_t datalen, u_int compat);
206int ssh_ecdsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
207 const u_char *data, size_t datalen, u_int compat);
208int ssh_ecdsa_verify(const struct sshkey *key,
209 const u_char *signature, size_t signaturelen,
210 const u_char *data, size_t datalen, u_int compat);
211int ssh_ed25519_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
212 const u_char *data, size_t datalen, u_int compat);
213int ssh_ed25519_verify(const struct sshkey *key,
214 const u_char *signature, size_t signaturelen,
215 const u_char *data, size_t datalen, u_int compat);
216#endif
217
Damien Millerf0935692014-08-20 11:06:50 +1000218#if !defined(WITH_OPENSSL)
219# undef RSA
220# undef DSA
221# undef EC_KEY
222# undef EC_GROUP
223# undef EC_POINT
224#elif !defined(OPENSSL_HAS_ECC)
225# undef EC_KEY
226# undef EC_GROUP
227# undef EC_POINT
228#endif
Damien Miller86687062014-07-02 15:28:02 +1000229
230#endif /* SSHKEY_H */