1262566Sdes/* $OpenBSD: key.h,v 1.41 2014/01/09 23:20:00 djm Exp $ */ 276259Sgreen 365668Skris/* 492555Sdes * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 565668Skris * 665668Skris * Redistribution and use in source and binary forms, with or without 765668Skris * modification, are permitted provided that the following conditions 865668Skris * are met: 965668Skris * 1. Redistributions of source code must retain the above copyright 1065668Skris * notice, this list of conditions and the following disclaimer. 1165668Skris * 2. Redistributions in binary form must reproduce the above copyright 1265668Skris * notice, this list of conditions and the following disclaimer in the 1365668Skris * documentation and/or other materials provided with the distribution. 1465668Skris * 1565668Skris * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 1665668Skris * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 1765668Skris * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 1865668Skris * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 1965668Skris * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 2065668Skris * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 2165668Skris * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 2265668Skris * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 2365668Skris * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 2465668Skris * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 2565668Skris */ 2658582Skris#ifndef KEY_H 2758582Skris#define KEY_H 2858582Skris 29204917Sdes#include "buffer.h" 3076259Sgreen#include <openssl/rsa.h> 3176259Sgreen#include <openssl/dsa.h> 32221420Sdes#ifdef OPENSSL_HAS_ECC 33221420Sdes#include <openssl/ec.h> 34221420Sdes#endif 3576259Sgreen 3658582Skristypedef struct Key Key; 3758582Skrisenum types { 3876259Sgreen KEY_RSA1, 3958582Skris KEY_RSA, 4058582Skris KEY_DSA, 41221420Sdes KEY_ECDSA, 42262566Sdes KEY_ED25519, 43204917Sdes KEY_RSA_CERT, 44204917Sdes KEY_DSA_CERT, 45221420Sdes KEY_ECDSA_CERT, 46262566Sdes KEY_ED25519_CERT, 47215116Sdes KEY_RSA_CERT_V00, 48215116Sdes KEY_DSA_CERT_V00, 4976259Sgreen KEY_UNSPEC 5058582Skris}; 5176259Sgreenenum fp_type { 5276259Sgreen SSH_FP_SHA1, 53240075Sdes SSH_FP_MD5, 54240075Sdes SSH_FP_SHA256 5576259Sgreen}; 5676259Sgreenenum fp_rep { 5776259Sgreen SSH_FP_HEX, 58181111Sdes SSH_FP_BUBBLEBABBLE, 59181111Sdes SSH_FP_RANDOMART 6076259Sgreen}; 6192555Sdes 6292555Sdes/* key is stored in external hardware */ 6392555Sdes#define KEY_FLAG_EXT 0x0001 6492555Sdes 65204917Sdes#define CERT_MAX_PRINCIPALS 256 66204917Sdesstruct KeyCert { 67204917Sdes Buffer certblob; /* Kept around for use on wire */ 68204917Sdes u_int type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */ 69215116Sdes u_int64_t serial; 70204917Sdes char *key_id; 71204917Sdes u_int nprincipals; 72204917Sdes char **principals; 73204917Sdes u_int64_t valid_after, valid_before; 74215116Sdes Buffer critical; 75215116Sdes Buffer extensions; 76204917Sdes Key *signature_key; 77204917Sdes}; 78204917Sdes 7958582Skrisstruct Key { 8092555Sdes int type; 8192555Sdes int flags; 8258582Skris RSA *rsa; 8358582Skris DSA *dsa; 84221420Sdes int ecdsa_nid; /* NID of curve */ 85221420Sdes#ifdef OPENSSL_HAS_ECC 86221420Sdes EC_KEY *ecdsa; 87221420Sdes#else 88221420Sdes void *ecdsa; 89221420Sdes#endif 90204917Sdes struct KeyCert *cert; 91262566Sdes u_char *ed25519_sk; 92262566Sdes u_char *ed25519_pk; 9358582Skris}; 9458582Skris 95262566Sdes#define ED25519_SK_SZ crypto_sign_ed25519_SECRETKEYBYTES 96262566Sdes#define ED25519_PK_SZ crypto_sign_ed25519_PUBLICKEYBYTES 97262566Sdes 98126274SdesKey *key_new(int); 99204917Sdesvoid key_add_private(Key *); 100126274SdesKey *key_new_private(int); 101126274Sdesvoid key_free(Key *); 102126274SdesKey *key_demote(const Key *); 103204917Sdesint key_equal_public(const Key *, const Key *); 104126274Sdesint key_equal(const Key *, const Key *); 105255767Sdeschar *key_fingerprint(const Key *, enum fp_type, enum fp_rep); 106248619Sdesu_char *key_fingerprint_raw(const Key *, enum fp_type, u_int *); 107126274Sdesconst char *key_type(const Key *); 108207319Sdesconst char *key_cert_type(const Key *); 109126274Sdesint key_write(const Key *, FILE *); 110126274Sdesint key_read(Key *, char **); 111126274Sdesu_int key_size(const Key *); 11258582Skris 11392555SdesKey *key_generate(int, u_int); 114126274SdesKey *key_from_private(const Key *); 11592555Sdesint key_type_from_name(char *); 116204917Sdesint key_is_cert(const Key *); 117262566Sdesint key_type_is_cert(int); 118204917Sdesint key_type_plain(int); 119215116Sdesint key_to_certified(Key *, int); 120204917Sdesint key_drop_cert(Key *); 121204917Sdesint key_certify(Key *, Key *); 122204917Sdesvoid key_cert_copy(const Key *, struct Key *); 123204917Sdesint key_cert_check_authority(const Key *, int, int, const char *, 124204917Sdes const char **); 125248619Sdesint key_cert_is_legacy(const Key *); 12676259Sgreen 127221420Sdesint key_ecdsa_nid_from_name(const char *); 128221420Sdesint key_curve_name_to_nid(const char *); 129255767Sdesconst char *key_curve_nid_to_name(int); 130221420Sdesu_int key_curve_nid_to_bits(int); 131221420Sdesint key_ecdsa_bits_to_nid(int); 132221420Sdes#ifdef OPENSSL_HAS_ECC 133221420Sdesint key_ecdsa_key_to_nid(EC_KEY *); 134262566Sdesint key_ec_nid_to_hash_alg(int nid); 135221420Sdesint key_ec_validate_public(const EC_GROUP *, const EC_POINT *); 136221420Sdesint key_ec_validate_private(const EC_KEY *); 137221420Sdes#endif 138262566Sdeschar *key_alg_list(int, int); 139221420Sdes 140126274SdesKey *key_from_blob(const u_char *, u_int); 141126274Sdesint key_to_blob(const Key *, u_char **, u_int *); 142126274Sdesconst char *key_ssh_name(const Key *); 143221420Sdesconst char *key_ssh_name_plain(const Key *); 144126274Sdesint key_names_valid2(const char *); 14576259Sgreen 146126274Sdesint key_sign(const Key *, u_char **, u_int *, const u_char *, u_int); 147126274Sdesint key_verify(const Key *, const u_char *, u_int, const u_char *, u_int); 14876259Sgreen 149126274Sdesint ssh_dss_sign(const Key *, u_char **, u_int *, const u_char *, u_int); 150126274Sdesint ssh_dss_verify(const Key *, const u_char *, u_int, const u_char *, u_int); 151221420Sdesint ssh_ecdsa_sign(const Key *, u_char **, u_int *, const u_char *, u_int); 152221420Sdesint ssh_ecdsa_verify(const Key *, const u_char *, u_int, const u_char *, u_int); 153126274Sdesint ssh_rsa_sign(const Key *, u_char **, u_int *, const u_char *, u_int); 154126274Sdesint ssh_rsa_verify(const Key *, const u_char *, u_int, const u_char *, u_int); 155262566Sdesint ssh_ed25519_sign(const Key *, u_char **, u_int *, const u_char *, u_int); 156262566Sdesint ssh_ed25519_verify(const Key *, const u_char *, u_int, const u_char *, u_int); 157113908Sdes 158221420Sdes#if defined(OPENSSL_HAS_ECC) && (defined(DEBUG_KEXECDH) || defined(DEBUG_PK)) 159221420Sdesvoid key_dump_ec_point(const EC_GROUP *, const EC_POINT *); 160221420Sdesvoid key_dump_ec_key(const EC_KEY *); 16158582Skris#endif 162221420Sdes 163262566Sdesvoid key_private_serialize(const Key *, Buffer *); 164262566SdesKey *key_private_deserialize(Buffer *); 165262566Sdes 166221420Sdes#endif 167