djm@openbsd.org | 57b181e | 2020-01-10 23:43:26 +0000 | [diff] [blame] | 1 | /* $OpenBSD: ssh-sk.h,v 1.10 2020/01/10 23:43:26 djm Exp $ */ |
djm@openbsd.org | ed3467c | 2019-10-31 21:16:20 +0000 | [diff] [blame] | 2 | /* |
| 3 | * Copyright (c) 2019 Google LLC |
| 4 | * |
| 5 | * Permission to use, copy, modify, and distribute this software for any |
| 6 | * purpose with or without fee is hereby granted, provided that the above |
| 7 | * copyright notice and this permission notice appear in all copies. |
| 8 | * |
| 9 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 10 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 11 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
| 12 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 13 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
| 14 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
| 15 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
| 16 | */ |
| 17 | |
| 18 | #ifndef _SSH_SK_H |
| 19 | #define _SSH_SK_H 1 |
| 20 | |
| 21 | struct sshbuf; |
| 22 | struct sshkey; |
djm@openbsd.org | c312ca0 | 2020-01-06 02:00:46 +0000 | [diff] [blame] | 23 | struct sk_option; |
djm@openbsd.org | ed3467c | 2019-10-31 21:16:20 +0000 | [diff] [blame] | 24 | |
djm@openbsd.org | c54cd18 | 2019-12-30 09:23:28 +0000 | [diff] [blame] | 25 | /* Version of protocol expected from ssh-sk-helper */ |
djm@openbsd.org | 57b181e | 2020-01-10 23:43:26 +0000 | [diff] [blame] | 26 | #define SSH_SK_HELPER_VERSION 5 |
djm@openbsd.org | c54cd18 | 2019-12-30 09:23:28 +0000 | [diff] [blame] | 27 | |
| 28 | /* ssh-sk-helper messages */ |
| 29 | #define SSH_SK_HELPER_ERROR 0 /* Only valid H->C */ |
| 30 | #define SSH_SK_HELPER_SIGN 1 |
| 31 | #define SSH_SK_HELPER_ENROLL 2 |
| 32 | #define SSH_SK_HELPER_LOAD_RESIDENT 3 |
| 33 | |
djm@openbsd.org | ed3467c | 2019-10-31 21:16:20 +0000 | [diff] [blame] | 34 | /* |
markus@openbsd.org | 7c32b51 | 2019-11-12 19:31:45 +0000 | [diff] [blame] | 35 | * Enroll (generate) a new security-key hosted private key of given type |
| 36 | * via the specified provider middleware. |
djm@openbsd.org | ed3467c | 2019-10-31 21:16:20 +0000 | [diff] [blame] | 37 | * If challenge_buf is NULL then a random 256 bit challenge will be used. |
| 38 | * |
| 39 | * Returns 0 on success or a ssherr.h error code on failure. |
| 40 | * |
| 41 | * If successful and the attest_data buffer is not NULL then attestation |
| 42 | * information is placed there. |
| 43 | */ |
djm@openbsd.org | c312ca0 | 2020-01-06 02:00:46 +0000 | [diff] [blame] | 44 | int sshsk_enroll(int type, const char *provider_path, const char *device, |
| 45 | const char *application, const char *userid, uint8_t flags, |
| 46 | const char *pin, struct sshbuf *challenge_buf, |
djm@openbsd.org | c54cd18 | 2019-12-30 09:23:28 +0000 | [diff] [blame] | 47 | struct sshkey **keyp, struct sshbuf *attest); |
djm@openbsd.org | ed3467c | 2019-10-31 21:16:20 +0000 | [diff] [blame] | 48 | |
| 49 | /* |
markus@openbsd.org | fe05a36 | 2019-11-12 19:31:18 +0000 | [diff] [blame] | 50 | * Calculate an ECDSA_SK or ED25519_SK signature using the specified key |
markus@openbsd.org | e03a29e | 2019-11-12 19:30:50 +0000 | [diff] [blame] | 51 | * and provider middleware. |
djm@openbsd.org | ed3467c | 2019-10-31 21:16:20 +0000 | [diff] [blame] | 52 | * |
| 53 | * Returns 0 on success or a ssherr.h error code on failure. |
| 54 | */ |
djm@openbsd.org | b52ec0b | 2019-12-13 19:09:10 +0000 | [diff] [blame] | 55 | int sshsk_sign(const char *provider_path, struct sshkey *key, |
djm@openbsd.org | ed3467c | 2019-10-31 21:16:20 +0000 | [diff] [blame] | 56 | u_char **sigp, size_t *lenp, const u_char *data, size_t datalen, |
djm@openbsd.org | c54cd18 | 2019-12-30 09:23:28 +0000 | [diff] [blame] | 57 | u_int compat, const char *pin); |
djm@openbsd.org | ed3467c | 2019-10-31 21:16:20 +0000 | [diff] [blame] | 58 | |
djm@openbsd.org | 14cea36 | 2019-12-30 09:21:16 +0000 | [diff] [blame] | 59 | /* |
| 60 | * Enumerates and loads all SSH-compatible resident keys from a security |
| 61 | * key. |
| 62 | * |
| 63 | * Returns 0 on success or a ssherr.h error code on failure. |
| 64 | */ |
djm@openbsd.org | c312ca0 | 2020-01-06 02:00:46 +0000 | [diff] [blame] | 65 | int sshsk_load_resident(const char *provider_path, const char *device, |
| 66 | const char *pin, struct sshkey ***keysp, size_t *nkeysp); |
djm@openbsd.org | 14cea36 | 2019-12-30 09:21:16 +0000 | [diff] [blame] | 67 | |
djm@openbsd.org | ed3467c | 2019-10-31 21:16:20 +0000 | [diff] [blame] | 68 | #endif /* _SSH_SK_H */ |
| 69 | |