blob: 7efa16ff9ceb3d2be959039a2310f37dd2f34077 [file] [log] [blame]
djm@openbsd.org04c7e282017-12-18 02:25:15 +00001/* $OpenBSD: sshkey.h,v 1.23 2017/12/18 02:25:15 djm Exp $ */
Damien Miller86687062014-07-02 15:28:02 +10002
3/*
4 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26#ifndef SSHKEY_H
27#define SSHKEY_H
28
29#include <sys/types.h>
30
31#ifdef WITH_OPENSSL
32#include <openssl/rsa.h>
33#include <openssl/dsa.h>
Damien Millerf0935692014-08-20 11:06:50 +100034# ifdef OPENSSL_HAS_ECC
35# include <openssl/ec.h>
36# else /* OPENSSL_HAS_ECC */
37# define EC_KEY void
38# define EC_GROUP void
39# define EC_POINT void
40# endif /* OPENSSL_HAS_ECC */
41#else /* WITH_OPENSSL */
42# define RSA void
43# define DSA void
44# define EC_KEY void
45# define EC_GROUP void
46# define EC_POINT void
Damien Miller86687062014-07-02 15:28:02 +100047#endif /* WITH_OPENSSL */
48
djm@openbsd.orgbd636f42017-05-07 23:15:59 +000049#define SSH_RSA_MINIMUM_MODULUS_SIZE 1024
Damien Miller86687062014-07-02 15:28:02 +100050#define SSH_KEY_MAX_SIGN_DATA_SIZE (1 << 20)
51
52struct sshbuf;
53
54/* Key types */
55enum sshkey_types {
Damien Miller86687062014-07-02 15:28:02 +100056 KEY_RSA,
57 KEY_DSA,
58 KEY_ECDSA,
59 KEY_ED25519,
60 KEY_RSA_CERT,
61 KEY_DSA_CERT,
62 KEY_ECDSA_CERT,
63 KEY_ED25519_CERT,
Damien Miller86687062014-07-02 15:28:02 +100064 KEY_UNSPEC
65};
66
djm@openbsd.org56d1c832014-12-21 22:27:55 +000067/* Default fingerprint hash */
68#define SSH_FP_HASH_DEFAULT SSH_DIGEST_SHA256
Damien Miller86687062014-07-02 15:28:02 +100069
70/* Fingerprint representation formats */
71enum sshkey_fp_rep {
djm@openbsd.org56d1c832014-12-21 22:27:55 +000072 SSH_FP_DEFAULT = 0,
Damien Miller86687062014-07-02 15:28:02 +100073 SSH_FP_HEX,
djm@openbsd.org56d1c832014-12-21 22:27:55 +000074 SSH_FP_BASE64,
Damien Miller86687062014-07-02 15:28:02 +100075 SSH_FP_BUBBLEBABBLE,
76 SSH_FP_RANDOMART
77};
78
79/* key is stored in external hardware */
80#define SSHKEY_FLAG_EXT 0x0001
81
82#define SSHKEY_CERT_MAX_PRINCIPALS 256
83/* XXX opaquify? */
84struct sshkey_cert {
85 struct sshbuf *certblob; /* Kept around for use on wire */
86 u_int type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */
87 u_int64_t serial;
88 char *key_id;
89 u_int nprincipals;
90 char **principals;
91 u_int64_t valid_after, valid_before;
92 struct sshbuf *critical;
93 struct sshbuf *extensions;
94 struct sshkey *signature_key;
95};
96
97/* XXX opaquify? */
98struct sshkey {
99 int type;
100 int flags;
101 RSA *rsa;
102 DSA *dsa;
103 int ecdsa_nid; /* NID of curve */
104 EC_KEY *ecdsa;
105 u_char *ed25519_sk;
106 u_char *ed25519_pk;
107 struct sshkey_cert *cert;
108};
109
110#define ED25519_SK_SZ crypto_sign_ed25519_SECRETKEYBYTES
111#define ED25519_PK_SZ crypto_sign_ed25519_PUBLICKEYBYTES
112
113struct sshkey *sshkey_new(int);
114int sshkey_add_private(struct sshkey *);
115struct sshkey *sshkey_new_private(int);
116void sshkey_free(struct sshkey *);
117int sshkey_demote(const struct sshkey *, struct sshkey **);
118int sshkey_equal_public(const struct sshkey *,
119 const struct sshkey *);
120int sshkey_equal(const struct sshkey *, const struct sshkey *);
121char *sshkey_fingerprint(const struct sshkey *,
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000122 int, enum sshkey_fp_rep);
Damien Miller86687062014-07-02 15:28:02 +1000123int sshkey_fingerprint_raw(const struct sshkey *k,
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000124 int, u_char **retp, size_t *lenp);
Damien Miller86687062014-07-02 15:28:02 +1000125const char *sshkey_type(const struct sshkey *);
126const char *sshkey_cert_type(const struct sshkey *);
djm@openbsd.org6026f482017-06-13 11:22:15 +0000127int sshkey_format_text(const struct sshkey *, struct sshbuf *);
Damien Miller86687062014-07-02 15:28:02 +1000128int sshkey_write(const struct sshkey *, FILE *);
129int sshkey_read(struct sshkey *, char **);
130u_int sshkey_size(const struct sshkey *);
131
132int sshkey_generate(int type, u_int bits, struct sshkey **keyp);
133int sshkey_from_private(const struct sshkey *, struct sshkey **);
134int sshkey_type_from_name(const char *);
135int sshkey_is_cert(const struct sshkey *);
136int sshkey_type_is_cert(int);
137int sshkey_type_plain(int);
djm@openbsd.orgc28fc622015-07-03 03:43:18 +0000138int sshkey_to_certified(struct sshkey *);
Damien Miller86687062014-07-02 15:28:02 +1000139int sshkey_drop_cert(struct sshkey *);
Damien Miller86687062014-07-02 15:28:02 +1000140int sshkey_cert_copy(const struct sshkey *, struct sshkey *);
141int sshkey_cert_check_authority(const struct sshkey *, int, int,
142 const char *, const char **);
djm@openbsd.org499cf362015-11-19 01:08:55 +0000143size_t sshkey_format_cert_validity(const struct sshkey_cert *,
144 char *, size_t) __attribute__((__bounded__(__string__, 2, 3)));
Damien Miller86687062014-07-02 15:28:02 +1000145
djm@openbsd.orga98339e2017-06-28 01:09:22 +0000146int sshkey_certify(struct sshkey *, struct sshkey *, const char *);
147/* Variant allowing use of a custom signature function (e.g. for ssh-agent) */
148typedef int sshkey_certify_signer(const struct sshkey *, u_char **, size_t *,
149 const u_char *, size_t, const char *, u_int, void *);
150int sshkey_certify_custom(struct sshkey *, struct sshkey *, const char *,
151 sshkey_certify_signer *, void *);
152
Damien Miller86687062014-07-02 15:28:02 +1000153int sshkey_ecdsa_nid_from_name(const char *);
154int sshkey_curve_name_to_nid(const char *);
155const char * sshkey_curve_nid_to_name(int);
156u_int sshkey_curve_nid_to_bits(int);
157int sshkey_ecdsa_bits_to_nid(int);
158int sshkey_ecdsa_key_to_nid(EC_KEY *);
159int sshkey_ec_nid_to_hash_alg(int nid);
160int sshkey_ec_validate_public(const EC_GROUP *, const EC_POINT *);
161int sshkey_ec_validate_private(const EC_KEY *);
162const char *sshkey_ssh_name(const struct sshkey *);
163const char *sshkey_ssh_name_plain(const struct sshkey *);
djm@openbsd.org1f729f02015-01-13 07:39:19 +0000164int sshkey_names_valid2(const char *, int);
djm@openbsd.org183ba552017-03-10 04:07:20 +0000165char *sshkey_alg_list(int, int, int, char);
Damien Miller86687062014-07-02 15:28:02 +1000166
167int sshkey_from_blob(const u_char *, size_t, struct sshkey **);
djm@openbsd.org60b18252015-01-26 02:59:11 +0000168int sshkey_fromb(struct sshbuf *, struct sshkey **);
169int sshkey_froms(struct sshbuf *, struct sshkey **);
Damien Miller86687062014-07-02 15:28:02 +1000170int sshkey_to_blob(const struct sshkey *, u_char **, size_t *);
djm@openbsd.orgd80fbe42015-05-21 04:55:51 +0000171int sshkey_to_base64(const struct sshkey *, char **);
djm@openbsd.org60b18252015-01-26 02:59:11 +0000172int sshkey_putb(const struct sshkey *, struct sshbuf *);
173int sshkey_puts(const struct sshkey *, struct sshbuf *);
Damien Miller86687062014-07-02 15:28:02 +1000174int sshkey_plain_to_blob(const struct sshkey *, u_char **, size_t *);
djm@openbsd.org60b18252015-01-26 02:59:11 +0000175int sshkey_putb_plain(const struct sshkey *, struct sshbuf *);
Damien Miller86687062014-07-02 15:28:02 +1000176
djm@openbsd.org931c78d2017-12-18 02:22:29 +0000177int sshkey_sigtype(const u_char *, size_t, char **);
Damien Miller86687062014-07-02 15:28:02 +1000178int sshkey_sign(const struct sshkey *, u_char **, size_t *,
markus@openbsd.org76c9fbb2015-12-04 16:41:28 +0000179 const u_char *, size_t, const char *, u_int);
Damien Miller86687062014-07-02 15:28:02 +1000180int sshkey_verify(const struct sshkey *, const u_char *, size_t,
djm@openbsd.org04c7e282017-12-18 02:25:15 +0000181 const u_char *, size_t, const char *, u_int);
Damien Miller86687062014-07-02 15:28:02 +1000182
183/* for debug */
184void sshkey_dump_ec_point(const EC_GROUP *, const EC_POINT *);
185void sshkey_dump_ec_key(const EC_KEY *);
186
187/* private key parsing and serialisation */
188int sshkey_private_serialize(const struct sshkey *key, struct sshbuf *buf);
189int sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **keyp);
190
191/* private key file format parsing and serialisation */
192int sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob,
193 const char *passphrase, const char *comment,
194 int force_new_format, const char *new_format_cipher, int new_format_rounds);
Damien Miller86687062014-07-02 15:28:02 +1000195int sshkey_parse_private_fileblob(struct sshbuf *buffer,
tim@openbsd.org3c019a92015-09-13 14:39:16 +0000196 const char *passphrase, struct sshkey **keyp, char **commentp);
Damien Miller86687062014-07-02 15:28:02 +1000197int sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type,
198 const char *passphrase, struct sshkey **keyp, char **commentp);
199
djm@openbsd.org83fa3a02017-07-01 13:50:45 +0000200/* XXX should be internal, but used by ssh-keygen */
201int ssh_rsa_generate_additional_parameters(struct sshkey *);
202
Damien Miller86687062014-07-02 15:28:02 +1000203#ifdef SSHKEY_INTERNAL
markus@openbsd.org76c9fbb2015-12-04 16:41:28 +0000204int ssh_rsa_sign(const struct sshkey *key,
205 u_char **sigp, size_t *lenp, const u_char *data, size_t datalen,
206 const char *ident);
Damien Miller86687062014-07-02 15:28:02 +1000207int ssh_rsa_verify(const struct sshkey *key,
djm@openbsd.org04c7e282017-12-18 02:25:15 +0000208 const u_char *sig, size_t siglen, const u_char *data, size_t datalen,
209 const char *alg);
Damien Miller86687062014-07-02 15:28:02 +1000210int ssh_dss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
211 const u_char *data, size_t datalen, u_int compat);
212int ssh_dss_verify(const struct sshkey *key,
213 const u_char *signature, size_t signaturelen,
214 const u_char *data, size_t datalen, u_int compat);
215int ssh_ecdsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
216 const u_char *data, size_t datalen, u_int compat);
217int ssh_ecdsa_verify(const struct sshkey *key,
218 const u_char *signature, size_t signaturelen,
219 const u_char *data, size_t datalen, u_int compat);
220int ssh_ed25519_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
221 const u_char *data, size_t datalen, u_int compat);
222int ssh_ed25519_verify(const struct sshkey *key,
223 const u_char *signature, size_t signaturelen,
224 const u_char *data, size_t datalen, u_int compat);
225#endif
226
Damien Millerf0935692014-08-20 11:06:50 +1000227#if !defined(WITH_OPENSSL)
228# undef RSA
229# undef DSA
230# undef EC_KEY
231# undef EC_GROUP
232# undef EC_POINT
233#elif !defined(OPENSSL_HAS_ECC)
234# undef EC_KEY
235# undef EC_GROUP
236# undef EC_POINT
237#endif
Damien Miller86687062014-07-02 15:28:02 +1000238
239#endif /* SSHKEY_H */