sshkey.h revision 295367
1/* $OpenBSD: sshkey.h,v 1.9 2015/08/04 05:23:06 djm Exp $ */
2
3/*
4 * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26#ifndef SSHKEY_H
27#define SSHKEY_H
28
29#include <sys/types.h>
30
31#ifdef WITH_OPENSSL
32#include <openssl/rsa.h>
33#include <openssl/dsa.h>
34# ifdef OPENSSL_HAS_ECC
35#  include <openssl/ec.h>
36# else /* OPENSSL_HAS_ECC */
37#  define EC_KEY	void
38#  define EC_GROUP	void
39#  define EC_POINT	void
40# endif /* OPENSSL_HAS_ECC */
41#else /* WITH_OPENSSL */
42# define RSA		void
43# define DSA		void
44# define EC_KEY		void
45# define EC_GROUP	void
46# define EC_POINT	void
47#endif /* WITH_OPENSSL */
48
49#define SSH_RSA_MINIMUM_MODULUS_SIZE	768
50#define SSH_KEY_MAX_SIGN_DATA_SIZE	(1 << 20)
51
52struct sshbuf;
53
54/* Key types */
55enum sshkey_types {
56	KEY_RSA1,
57	KEY_RSA,
58	KEY_DSA,
59	KEY_ECDSA,
60	KEY_ED25519,
61	KEY_RSA_CERT,
62	KEY_DSA_CERT,
63	KEY_ECDSA_CERT,
64	KEY_ED25519_CERT,
65	KEY_UNSPEC
66};
67
68/* Default fingerprint hash */
69#define SSH_FP_HASH_DEFAULT	SSH_DIGEST_SHA256
70
71/* Fingerprint representation formats */
72enum sshkey_fp_rep {
73	SSH_FP_DEFAULT = 0,
74	SSH_FP_HEX,
75	SSH_FP_BASE64,
76	SSH_FP_BUBBLEBABBLE,
77	SSH_FP_RANDOMART
78};
79
80/* key is stored in external hardware */
81#define SSHKEY_FLAG_EXT		0x0001
82
83#define SSHKEY_CERT_MAX_PRINCIPALS	256
84/* XXX opaquify? */
85struct sshkey_cert {
86	struct sshbuf	*certblob; /* Kept around for use on wire */
87	u_int		 type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */
88	u_int64_t	 serial;
89	char		*key_id;
90	u_int		 nprincipals;
91	char		**principals;
92	u_int64_t	 valid_after, valid_before;
93	struct sshbuf	*critical;
94	struct sshbuf	*extensions;
95	struct sshkey	*signature_key;
96};
97
98/* XXX opaquify? */
99struct sshkey {
100	int	 type;
101	int	 flags;
102	RSA	*rsa;
103	DSA	*dsa;
104	int	 ecdsa_nid;	/* NID of curve */
105	EC_KEY	*ecdsa;
106	u_char	*ed25519_sk;
107	u_char	*ed25519_pk;
108	struct sshkey_cert *cert;
109};
110
111#define	ED25519_SK_SZ	crypto_sign_ed25519_SECRETKEYBYTES
112#define	ED25519_PK_SZ	crypto_sign_ed25519_PUBLICKEYBYTES
113
114struct sshkey	*sshkey_new(int);
115int		 sshkey_add_private(struct sshkey *);
116struct sshkey	*sshkey_new_private(int);
117void		 sshkey_free(struct sshkey *);
118int		 sshkey_demote(const struct sshkey *, struct sshkey **);
119int		 sshkey_equal_public(const struct sshkey *,
120    const struct sshkey *);
121int		 sshkey_equal(const struct sshkey *, const struct sshkey *);
122char		*sshkey_fingerprint(const struct sshkey *,
123    int, enum sshkey_fp_rep);
124int		 sshkey_fingerprint_raw(const struct sshkey *k,
125    int, u_char **retp, size_t *lenp);
126const char	*sshkey_type(const struct sshkey *);
127const char	*sshkey_cert_type(const struct sshkey *);
128int		 sshkey_write(const struct sshkey *, FILE *);
129int		 sshkey_read(struct sshkey *, char **);
130u_int		 sshkey_size(const struct sshkey *);
131
132int		 sshkey_generate(int type, u_int bits, struct sshkey **keyp);
133int		 sshkey_from_private(const struct sshkey *, struct sshkey **);
134int	 sshkey_type_from_name(const char *);
135int	 sshkey_is_cert(const struct sshkey *);
136int	 sshkey_type_is_cert(int);
137int	 sshkey_type_plain(int);
138int	 sshkey_to_certified(struct sshkey *);
139int	 sshkey_drop_cert(struct sshkey *);
140int	 sshkey_certify(struct sshkey *, struct sshkey *);
141int	 sshkey_cert_copy(const struct sshkey *, struct sshkey *);
142int	 sshkey_cert_check_authority(const struct sshkey *, int, int,
143    const char *, const char **);
144
145int		 sshkey_ecdsa_nid_from_name(const char *);
146int		 sshkey_curve_name_to_nid(const char *);
147const char *	 sshkey_curve_nid_to_name(int);
148u_int		 sshkey_curve_nid_to_bits(int);
149int		 sshkey_ecdsa_bits_to_nid(int);
150int		 sshkey_ecdsa_key_to_nid(EC_KEY *);
151int		 sshkey_ec_nid_to_hash_alg(int nid);
152int		 sshkey_ec_validate_public(const EC_GROUP *, const EC_POINT *);
153int		 sshkey_ec_validate_private(const EC_KEY *);
154const char	*sshkey_ssh_name(const struct sshkey *);
155const char	*sshkey_ssh_name_plain(const struct sshkey *);
156int		 sshkey_names_valid2(const char *, int);
157char		*key_alg_list(int, int);
158
159int	 sshkey_from_blob(const u_char *, size_t, struct sshkey **);
160int	 sshkey_fromb(struct sshbuf *, struct sshkey **);
161int	 sshkey_froms(struct sshbuf *, struct sshkey **);
162int	 sshkey_to_blob(const struct sshkey *, u_char **, size_t *);
163int	 sshkey_to_base64(const struct sshkey *, char **);
164int	 sshkey_putb(const struct sshkey *, struct sshbuf *);
165int	 sshkey_puts(const struct sshkey *, struct sshbuf *);
166int	 sshkey_plain_to_blob(const struct sshkey *, u_char **, size_t *);
167int	 sshkey_putb_plain(const struct sshkey *, struct sshbuf *);
168
169int	 sshkey_sign(const struct sshkey *, u_char **, size_t *,
170    const u_char *, size_t, u_int);
171int	 sshkey_verify(const struct sshkey *, const u_char *, size_t,
172    const u_char *, size_t, u_int);
173
174/* for debug */
175void	sshkey_dump_ec_point(const EC_GROUP *, const EC_POINT *);
176void	sshkey_dump_ec_key(const EC_KEY *);
177
178/* private key parsing and serialisation */
179int	sshkey_private_serialize(const struct sshkey *key, struct sshbuf *buf);
180int	sshkey_private_deserialize(struct sshbuf *buf,  struct sshkey **keyp);
181
182/* private key file format parsing and serialisation */
183int	sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob,
184    const char *passphrase, const char *comment,
185    int force_new_format, const char *new_format_cipher, int new_format_rounds);
186int	sshkey_parse_public_rsa1_fileblob(struct sshbuf *blob,
187    struct sshkey **keyp, char **commentp);
188int	sshkey_parse_private_fileblob(struct sshbuf *buffer,
189    const char *passphrase, const char *filename, struct sshkey **keyp,
190    char **commentp);
191int	sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type,
192    const char *passphrase, struct sshkey **keyp, char **commentp);
193
194#ifdef SSHKEY_INTERNAL
195int ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
196    const u_char *data, size_t datalen, u_int compat);
197int ssh_rsa_verify(const struct sshkey *key,
198    const u_char *signature, size_t signaturelen,
199    const u_char *data, size_t datalen, u_int compat);
200int ssh_dss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
201    const u_char *data, size_t datalen, u_int compat);
202int ssh_dss_verify(const struct sshkey *key,
203    const u_char *signature, size_t signaturelen,
204    const u_char *data, size_t datalen, u_int compat);
205int ssh_ecdsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
206    const u_char *data, size_t datalen, u_int compat);
207int ssh_ecdsa_verify(const struct sshkey *key,
208    const u_char *signature, size_t signaturelen,
209    const u_char *data, size_t datalen, u_int compat);
210int ssh_ed25519_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
211    const u_char *data, size_t datalen, u_int compat);
212int ssh_ed25519_verify(const struct sshkey *key,
213    const u_char *signature, size_t signaturelen,
214    const u_char *data, size_t datalen, u_int compat);
215#endif
216
217#if !defined(WITH_OPENSSL)
218# undef RSA
219# undef DSA
220# undef EC_KEY
221# undef EC_GROUP
222# undef EC_POINT
223#elif !defined(OPENSSL_HAS_ECC)
224# undef EC_KEY
225# undef EC_GROUP
226# undef EC_POINT
227#endif
228
229#endif /* SSHKEY_H */
230