1/* $OpenBSD: ssh-sk.h,v 1.11 2021/10/28 02:54:18 djm Exp $ */
2/*
3 * Copyright (c) 2019 Google LLC
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#ifndef _SSH_SK_H
19#define _SSH_SK_H 1
20
21struct sshbuf;
22struct sshkey;
23struct sk_option;
24
25/* Version of protocol expected from ssh-sk-helper */
26#define SSH_SK_HELPER_VERSION		5
27
28/* ssh-sk-helper messages */
29#define SSH_SK_HELPER_ERROR		0	/* Only valid H->C */
30#define SSH_SK_HELPER_SIGN		1
31#define SSH_SK_HELPER_ENROLL		2
32#define SSH_SK_HELPER_LOAD_RESIDENT	3
33
34struct sshsk_resident_key {
35	struct sshkey *key;
36	uint8_t *user_id;
37	size_t user_id_len;
38};
39
40/*
41 * Enroll (generate) a new security-key hosted private key of given type
42 * via the specified provider middleware.
43 * If challenge_buf is NULL then a random 256 bit challenge will be used.
44 *
45 * Returns 0 on success or a ssherr.h error code on failure.
46 *
47 * If successful and the attest_data buffer is not NULL then attestation
48 * information is placed there.
49 */
50int sshsk_enroll(int type, const char *provider_path, const char *device,
51    const char *application, const char *userid, uint8_t flags,
52    const char *pin, struct sshbuf *challenge_buf,
53    struct sshkey **keyp, struct sshbuf *attest);
54
55/*
56 * Calculate an ECDSA_SK or ED25519_SK signature using the specified key
57 * and provider middleware.
58 *
59 * Returns 0 on success or a ssherr.h error code on failure.
60 */
61int sshsk_sign(const char *provider_path, struct sshkey *key,
62    u_char **sigp, size_t *lenp, const u_char *data, size_t datalen,
63    u_int compat, const char *pin);
64
65/*
66 * Enumerates and loads all SSH-compatible resident keys from a security
67 * key.
68 *
69 * Returns 0 on success or a ssherr.h error code on failure.
70 */
71int sshsk_load_resident(const char *provider_path, const char *device,
72    const char *pin, u_int flags, struct sshsk_resident_key ***srksp,
73    size_t *nsrksp);
74
75/* Free an array of sshsk_resident_key (as returned from sshsk_load_resident) */
76void sshsk_free_resident_keys(struct sshsk_resident_key **srks, size_t nsrks);
77
78#endif /* _SSH_SK_H */
79
80