blob: 62c1c3e2fdb181e58e8dd462f078b6a5ee46172a [file] [log] [blame]
djm@openbsd.org60b18252015-01-26 02:59:11 +00001/* $OpenBSD: sshkey.h,v 1.5 2015/01/26 02:59:11 djm Exp $ */
Damien Miller86687062014-07-02 15:28:02 +10002
3/*
4 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26#ifndef SSHKEY_H
27#define SSHKEY_H
28
29#include <sys/types.h>
30
31#ifdef WITH_OPENSSL
32#include <openssl/rsa.h>
33#include <openssl/dsa.h>
Damien Millerf0935692014-08-20 11:06:50 +100034# ifdef OPENSSL_HAS_ECC
35# include <openssl/ec.h>
36# else /* OPENSSL_HAS_ECC */
37# define EC_KEY void
38# define EC_GROUP void
39# define EC_POINT void
40# endif /* OPENSSL_HAS_ECC */
41#else /* WITH_OPENSSL */
42# define RSA void
43# define DSA void
44# define EC_KEY void
45# define EC_GROUP void
46# define EC_POINT void
Damien Miller86687062014-07-02 15:28:02 +100047#endif /* WITH_OPENSSL */
48
49#define SSH_RSA_MINIMUM_MODULUS_SIZE 768
50#define SSH_KEY_MAX_SIGN_DATA_SIZE (1 << 20)
51
52struct sshbuf;
53
54/* Key types */
55enum sshkey_types {
56 KEY_RSA1,
57 KEY_RSA,
58 KEY_DSA,
59 KEY_ECDSA,
60 KEY_ED25519,
61 KEY_RSA_CERT,
62 KEY_DSA_CERT,
63 KEY_ECDSA_CERT,
64 KEY_ED25519_CERT,
65 KEY_RSA_CERT_V00,
66 KEY_DSA_CERT_V00,
67 KEY_UNSPEC
68};
69
djm@openbsd.org56d1c832014-12-21 22:27:55 +000070/* Default fingerprint hash */
71#define SSH_FP_HASH_DEFAULT SSH_DIGEST_SHA256
Damien Miller86687062014-07-02 15:28:02 +100072
73/* Fingerprint representation formats */
74enum sshkey_fp_rep {
djm@openbsd.org56d1c832014-12-21 22:27:55 +000075 SSH_FP_DEFAULT = 0,
Damien Miller86687062014-07-02 15:28:02 +100076 SSH_FP_HEX,
djm@openbsd.org56d1c832014-12-21 22:27:55 +000077 SSH_FP_BASE64,
Damien Miller86687062014-07-02 15:28:02 +100078 SSH_FP_BUBBLEBABBLE,
79 SSH_FP_RANDOMART
80};
81
82/* key is stored in external hardware */
83#define SSHKEY_FLAG_EXT 0x0001
84
85#define SSHKEY_CERT_MAX_PRINCIPALS 256
86/* XXX opaquify? */
87struct sshkey_cert {
88 struct sshbuf *certblob; /* Kept around for use on wire */
89 u_int type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */
90 u_int64_t serial;
91 char *key_id;
92 u_int nprincipals;
93 char **principals;
94 u_int64_t valid_after, valid_before;
95 struct sshbuf *critical;
96 struct sshbuf *extensions;
97 struct sshkey *signature_key;
98};
99
100/* XXX opaquify? */
101struct sshkey {
102 int type;
103 int flags;
104 RSA *rsa;
105 DSA *dsa;
106 int ecdsa_nid; /* NID of curve */
107 EC_KEY *ecdsa;
108 u_char *ed25519_sk;
109 u_char *ed25519_pk;
110 struct sshkey_cert *cert;
111};
112
113#define ED25519_SK_SZ crypto_sign_ed25519_SECRETKEYBYTES
114#define ED25519_PK_SZ crypto_sign_ed25519_PUBLICKEYBYTES
115
116struct sshkey *sshkey_new(int);
117int sshkey_add_private(struct sshkey *);
118struct sshkey *sshkey_new_private(int);
119void sshkey_free(struct sshkey *);
120int sshkey_demote(const struct sshkey *, struct sshkey **);
121int sshkey_equal_public(const struct sshkey *,
122 const struct sshkey *);
123int sshkey_equal(const struct sshkey *, const struct sshkey *);
124char *sshkey_fingerprint(const struct sshkey *,
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000125 int, enum sshkey_fp_rep);
Damien Miller86687062014-07-02 15:28:02 +1000126int sshkey_fingerprint_raw(const struct sshkey *k,
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000127 int, u_char **retp, size_t *lenp);
Damien Miller86687062014-07-02 15:28:02 +1000128const char *sshkey_type(const struct sshkey *);
129const char *sshkey_cert_type(const struct sshkey *);
130int sshkey_write(const struct sshkey *, FILE *);
131int sshkey_read(struct sshkey *, char **);
132u_int sshkey_size(const struct sshkey *);
133
134int sshkey_generate(int type, u_int bits, struct sshkey **keyp);
135int sshkey_from_private(const struct sshkey *, struct sshkey **);
136int sshkey_type_from_name(const char *);
137int sshkey_is_cert(const struct sshkey *);
138int sshkey_type_is_cert(int);
139int sshkey_type_plain(int);
140int sshkey_to_certified(struct sshkey *, int);
141int sshkey_drop_cert(struct sshkey *);
142int sshkey_certify(struct sshkey *, struct sshkey *);
143int sshkey_cert_copy(const struct sshkey *, struct sshkey *);
144int sshkey_cert_check_authority(const struct sshkey *, int, int,
145 const char *, const char **);
146int sshkey_cert_is_legacy(const struct sshkey *);
147
148int sshkey_ecdsa_nid_from_name(const char *);
149int sshkey_curve_name_to_nid(const char *);
150const char * sshkey_curve_nid_to_name(int);
151u_int sshkey_curve_nid_to_bits(int);
152int sshkey_ecdsa_bits_to_nid(int);
153int sshkey_ecdsa_key_to_nid(EC_KEY *);
154int sshkey_ec_nid_to_hash_alg(int nid);
155int sshkey_ec_validate_public(const EC_GROUP *, const EC_POINT *);
156int sshkey_ec_validate_private(const EC_KEY *);
157const char *sshkey_ssh_name(const struct sshkey *);
158const char *sshkey_ssh_name_plain(const struct sshkey *);
djm@openbsd.org1f729f02015-01-13 07:39:19 +0000159int sshkey_names_valid2(const char *, int);
Damien Miller86687062014-07-02 15:28:02 +1000160char *key_alg_list(int, int);
161
162int sshkey_from_blob(const u_char *, size_t, struct sshkey **);
djm@openbsd.org60b18252015-01-26 02:59:11 +0000163int sshkey_fromb(struct sshbuf *, struct sshkey **);
164int sshkey_froms(struct sshbuf *, struct sshkey **);
Damien Miller86687062014-07-02 15:28:02 +1000165int sshkey_to_blob(const struct sshkey *, u_char **, size_t *);
djm@openbsd.org60b18252015-01-26 02:59:11 +0000166int sshkey_putb(const struct sshkey *, struct sshbuf *);
167int sshkey_puts(const struct sshkey *, struct sshbuf *);
Damien Miller86687062014-07-02 15:28:02 +1000168int sshkey_plain_to_blob(const struct sshkey *, u_char **, size_t *);
djm@openbsd.org60b18252015-01-26 02:59:11 +0000169int sshkey_putb_plain(const struct sshkey *, struct sshbuf *);
Damien Miller86687062014-07-02 15:28:02 +1000170
171int sshkey_sign(const struct sshkey *, u_char **, size_t *,
172 const u_char *, size_t, u_int);
173int sshkey_verify(const struct sshkey *, const u_char *, size_t,
174 const u_char *, size_t, u_int);
175
176/* for debug */
177void sshkey_dump_ec_point(const EC_GROUP *, const EC_POINT *);
178void sshkey_dump_ec_key(const EC_KEY *);
179
180/* private key parsing and serialisation */
181int sshkey_private_serialize(const struct sshkey *key, struct sshbuf *buf);
182int sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **keyp);
183
184/* private key file format parsing and serialisation */
185int sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob,
186 const char *passphrase, const char *comment,
187 int force_new_format, const char *new_format_cipher, int new_format_rounds);
188int sshkey_parse_public_rsa1_fileblob(struct sshbuf *blob,
189 struct sshkey **keyp, char **commentp);
Damien Miller86687062014-07-02 15:28:02 +1000190int sshkey_parse_private_fileblob(struct sshbuf *buffer,
191 const char *passphrase, const char *filename, struct sshkey **keyp,
192 char **commentp);
193int sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type,
194 const char *passphrase, struct sshkey **keyp, char **commentp);
195
196#ifdef SSHKEY_INTERNAL
197int ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
198 const u_char *data, size_t datalen, u_int compat);
199int ssh_rsa_verify(const struct sshkey *key,
200 const u_char *signature, size_t signaturelen,
201 const u_char *data, size_t datalen, u_int compat);
202int ssh_dss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
203 const u_char *data, size_t datalen, u_int compat);
204int ssh_dss_verify(const struct sshkey *key,
205 const u_char *signature, size_t signaturelen,
206 const u_char *data, size_t datalen, u_int compat);
207int ssh_ecdsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
208 const u_char *data, size_t datalen, u_int compat);
209int ssh_ecdsa_verify(const struct sshkey *key,
210 const u_char *signature, size_t signaturelen,
211 const u_char *data, size_t datalen, u_int compat);
212int ssh_ed25519_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
213 const u_char *data, size_t datalen, u_int compat);
214int ssh_ed25519_verify(const struct sshkey *key,
215 const u_char *signature, size_t signaturelen,
216 const u_char *data, size_t datalen, u_int compat);
217#endif
218
Damien Millerf0935692014-08-20 11:06:50 +1000219#if !defined(WITH_OPENSSL)
220# undef RSA
221# undef DSA
222# undef EC_KEY
223# undef EC_GROUP
224# undef EC_POINT
225#elif !defined(OPENSSL_HAS_ECC)
226# undef EC_KEY
227# undef EC_GROUP
228# undef EC_POINT
229#endif
Damien Miller86687062014-07-02 15:28:02 +1000230
231#endif /* SSHKEY_H */