tyler.durden/openssh-portable
1
0
Fork 0
mirror of https://github.com/PowerShell/openssh-portable.git synced 2025-07-28 16:24:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

upstream: implement sshsk_ed25519_inner_sig(); ok djm

Browse Source 
OpenBSD-Commit-ID: f422d0052c6d948fe0e4b04bc961f37fdffa0910
This commit is contained in:
markus@openbsd.org 2019-11-12 19:31:18 +00:00 committed by Damien Miller
parent e03a29e655
commit fe05a36dc0
3 changed files with 61 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
ssh-sk.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-sk.c,v 1.4 2019/11/12 19:30:50 markus Exp $ */ /* $OpenBSD: ssh-sk.c,v 1.5 2019/11/12 19:31:18 markus Exp $ */
/* /*
* Copyright (c) 2019 Google LLC * Copyright (c) 2019 Google LLC
* *
@ -330,8 +330,37 @@ sshsk_ecdsa_inner_sig(struct sk_sign_response *resp, struct sshbuf **retp)
sshbuf_dump_data(resp->sig_r, resp->sig_r_len, stderr); sshbuf_dump_data(resp->sig_r, resp->sig_r_len, stderr);
fprintf(stderr, "%s: sig_s:\n", __func__); fprintf(stderr, "%s: sig_s:\n", __func__);
sshbuf_dump_data(resp->sig_s, resp->sig_s_len, stderr); sshbuf_dump_data(resp->sig_s, resp->sig_s_len, stderr);
fprintf(stderr, "%s: sig_flags = 0x%02x, sig_counter = %u\n", #endif
__func__, resp->flags, resp->counter); *retp = inner_sig;
inner_sig = NULL;
r = 0;
out:
sshbuf_free(inner_sig);
return r;
}
static int
sshsk_ed25519_inner_sig(struct sk_sign_response *resp, struct sshbuf **retp)
{
struct sshbuf *inner_sig = NULL;
int r = SSH_ERR_INTERNAL_ERROR;
*retp = NULL;
if ((inner_sig = sshbuf_new()) == NULL) {
r = SSH_ERR_ALLOC_FAIL;
goto out;
}
/* Prepare inner signature object */
if ((r = sshbuf_put_string(inner_sig,
resp->sig_r, resp->sig_r_len)) != 0 ||
(r = sshbuf_put_u8(inner_sig, resp->flags)) != 0 ||
(r = sshbuf_put_u32(inner_sig, resp->counter)) != 0) {
debug("%s: buffer error: %s", __func__, ssh_err(r));
goto out;
}
#ifdef DEBUG_SK
fprintf(stderr, "%s: sig_r:\n", __func__);
sshbuf_dump_data(resp->sig_r, resp->sig_r_len, stderr);
#endif #endif
*retp = inner_sig; *retp = inner_sig;
inner_sig = NULL; inner_sig = NULL;
@ -348,6 +377,7 @@ sshsk_sign(const char *provider_path, const struct sshkey *key,
{ {
struct sshsk_provider *skp = NULL; struct sshsk_provider *skp = NULL;
int r = SSH_ERR_INTERNAL_ERROR; int r = SSH_ERR_INTERNAL_ERROR;
int type;
struct sk_sign_response *resp = NULL; struct sk_sign_response *resp = NULL;
struct sshbuf *inner_sig = NULL, *sig = NULL; struct sshbuf *inner_sig = NULL, *sig = NULL;
uint8_t message[32]; uint8_t message[32];
@ -356,8 +386,15 @@ sshsk_sign(const char *provider_path, const struct sshkey *key,
*sigp = NULL; *sigp = NULL;
if (lenp != NULL) if (lenp != NULL)
*lenp = 0; *lenp = 0;
type = sshkey_type_plain(key->type);
switch (type) {
case KEY_ECDSA_SK:
case KEY_ED25519_SK:
break;
default:
return SSH_ERR_INVALID_ARGUMENT;
}
if (provider_path == NULL || if (provider_path == NULL ||
sshkey_type_plain(key->type) != KEY_ECDSA_SK ||
key->sk_key_handle == NULL || key->sk_key_handle == NULL ||
key->sk_application == NULL || *key->sk_application == '\0') { key->sk_application == NULL || *key->sk_application == '\0') {
r = SSH_ERR_INVALID_ARGUMENT; r = SSH_ERR_INVALID_ARGUMENT;
@ -383,8 +420,16 @@ sshsk_sign(const char *provider_path, const struct sshkey *key,
goto out; goto out;
} }
/* Prepare inner signature object */ /* Prepare inner signature object */
switch (type) {
case KEY_ECDSA_SK:
if ((r = sshsk_ecdsa_inner_sig(resp, &inner_sig)) != 0) if ((r = sshsk_ecdsa_inner_sig(resp, &inner_sig)) != 0)
goto out; goto out;
break;
case KEY_ED25519_SK:
if ((r = sshsk_ed25519_inner_sig(resp, &inner_sig)) != 0)
goto out;
break;
}
/* Assemble outer signature */ /* Assemble outer signature */
if ((sig = sshbuf_new()) == NULL) { if ((sig = sshbuf_new()) == NULL) {
r = SSH_ERR_ALLOC_FAIL; r = SSH_ERR_ALLOC_FAIL;
@ -396,6 +441,8 @@ sshsk_sign(const char *provider_path, const struct sshkey *key,
goto out; goto out;
} }
#ifdef DEBUG_SK #ifdef DEBUG_SK
fprintf(stderr, "%s: sig_flags = 0x%02x, sig_counter = %u\n",
__func__, resp->flags, resp->counter);
fprintf(stderr, "%s: hashed message:\n", __func__); fprintf(stderr, "%s: hashed message:\n", __func__);
sshbuf_dump_data(message, sizeof(message), stderr); sshbuf_dump_data(message, sizeof(message), stderr);
fprintf(stderr, "%s: inner:\n", __func__); fprintf(stderr, "%s: inner:\n", __func__);

4
ssh-sk.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-sk.h,v 1.3 2019/11/12 19:30:50 markus Exp $ */ /* $OpenBSD: ssh-sk.h,v 1.4 2019/11/12 19:31:18 markus Exp $ */
/* /*
* Copyright (c) 2019 Google LLC * Copyright (c) 2019 Google LLC
* *
@ -39,7 +39,7 @@ int sshsk_enroll(const char *provider_path, const char *application,
struct sshbuf *attest); struct sshbuf *attest);
/* /*
* Calculate an ECDSA_SK signature using the specified key * Calculate an ECDSA_SK or ED25519_SK signature using the specified key
* and provider middleware. * and provider middleware.
* *
* Returns 0 on success or a ssherr.h error code on failure. * Returns 0 on success or a ssherr.h error code on failure.

7
sshkey.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshkey.c,v 1.88 2019/11/12 19:30:50 markus Exp $ */ /* $OpenBSD: sshkey.c,v 1.89 2019/11/12 19:31:18 markus Exp $ */
/* /*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Alexander von Gernler. All rights reserved. * Copyright (c) 2008 Alexander von Gernler. All rights reserved.
@ -2701,6 +2701,11 @@ sshkey_sign(struct sshkey *key,
case KEY_ED25519_CERT: case KEY_ED25519_CERT:
r = ssh_ed25519_sign(key, sigp, lenp, data, datalen, compat); r = ssh_ed25519_sign(key, sigp, lenp, data, datalen, compat);
break; break;
case KEY_ED25519_SK:
case KEY_ED25519_SK_CERT:
r = sshsk_sign(sk_provider, key, sigp, lenp, data, datalen,
compat);
break;
#ifdef WITH_XMSS #ifdef WITH_XMSS
case KEY_XMSS: case KEY_XMSS:
case KEY_XMSS_CERT: case KEY_XMSS_CERT: