libssh 0.12.1 The SSH library

Loading...
Searching...
No Matches
pki.h
1/*
2 * This file is part of the SSH Library
3 *
4 * Copyright (c) 2010 by Aris Adamantiadis
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21#ifndef PKI_H_
22#define PKI_H_
23
24#include <stdint.h>
25#include "libssh/priv.h"
26#ifdef HAVE_OPENSSL_EC_H
27#include <openssl/ec.h>
28#endif
29#ifdef HAVE_OPENSSL_ECDSA_H
30#include <openssl/ecdsa.h>
31#endif
32#ifdef HAVE_LIBCRYPTO
33#include <openssl/evp.h>
34#endif
35#include "libssh/crypto.h"
36#ifdef HAVE_LIBCRYPTO
37/* If using OpenSSL implementation, define the signature length which would be
38 * defined in libssh/ed25519.h otherwise */
39#define ED25519_SIG_LEN 64
40#else
41#include "libssh/ed25519.h"
42#endif
43/* This definition is used for both OpenSSL and internal implementations */
44#define ED25519_KEY_LEN 32
45
46#define MAX_PUBKEY_SIZE 0x100000 /* 1M */
47#define MAX_PRIVKEY_SIZE 0x400000 /* 4M */
48
49#define RSA_MIN_KEY_SIZE 1024
50#define RSA_MIN_FIPS_KEY_SIZE 2048
51#define RSA_DEFAULT_KEY_SIZE 3072
52
53#define SSH_KEY_FLAG_EMPTY 0x0
54#define SSH_KEY_FLAG_PUBLIC 0x0001
55#define SSH_KEY_FLAG_PRIVATE 0x0002
56#define SSH_KEY_FLAG_PKCS11_URI 0x0004
57
58/* Constants matching the Lightweight Secure Shell Signature Format */
59/* https://datatracker.ietf.org/doc/draft-josefsson-sshsig-format */
60#define SSHSIG_VERSION 0x01
61#define SSHSIG_MAGIC_PREAMBLE "SSHSIG"
62#define SSHSIG_MAGIC_PREAMBLE_LEN (sizeof(SSHSIG_MAGIC_PREAMBLE) - 1)
63#define SSHSIG_BEGIN_SIGNATURE "-----BEGIN SSH SIGNATURE-----"
64#define SSHSIG_END_SIGNATURE "-----END SSH SIGNATURE-----"
65#define SSHSIG_LINE_LENGTH 76
66
67 struct ssh_key_struct {
68 enum ssh_keytypes_e type;
69 int flags;
70 const char *type_c; /* Don't free it ! it is static */
71 int ecdsa_nid;
72#if defined(HAVE_LIBGCRYPT)
73 gcry_sexp_t rsa;
74 gcry_sexp_t ecdsa;
75#elif defined(HAVE_LIBMBEDCRYPTO)
76 mbedtls_pk_context *pk;
77 mbedtls_ecdsa_context *ecdsa;
78#elif defined(HAVE_LIBCRYPTO)
79 /* This holds either ENGINE/PROVIDER key for PKCS#11 support
80 * or just key in high-level format */
81 EVP_PKEY *key;
82 /* keep this around for FIPS mode so we can parse the public keys. We won't
83 * be able to use them nor use the private keys though */
84 uint8_t *ed25519_pubkey;
85#endif /* HAVE_LIBGCRYPT */
86#ifndef HAVE_LIBCRYPTO
87 ed25519_pubkey *ed25519_pubkey;
88 ed25519_privkey *ed25519_privkey;
89#endif /* HAVE_LIBCRYPTO */
90 ssh_string sk_application;
91 ssh_buffer cert;
92 enum ssh_keytypes_e cert_type;
93
94 /* Security Key specific private data */
95 uint8_t sk_flags;
96 ssh_string sk_key_handle;
97 ssh_string sk_reserved;
98
99 /* Resident key specific metadata */
100 ssh_string sk_user_id;
101};
102
103 struct ssh_signature_struct {
104 enum ssh_keytypes_e type;
105 enum ssh_digest_e hash_type;
106 const char *type_c;
107#if defined(HAVE_LIBGCRYPT)
108 gcry_sexp_t rsa_sig;
109 gcry_sexp_t ecdsa_sig;
110#elif defined(HAVE_LIBMBEDCRYPTO)
111 ssh_string rsa_sig;
112 struct mbedtls_ecdsa_sig ecdsa_sig;
113#endif /* HAVE_LIBGCRYPT */
114#ifndef HAVE_LIBCRYPTO
115 ed25519_signature *ed25519_sig;
116#endif /* HAVE_LIBGCRYPT */
117 ssh_string raw_sig;
118
119 /* Security Key specific additions */
120 uint8_t sk_flags;
121 uint32_t sk_counter;
122};
123
124 typedef struct ssh_signature_struct *ssh_signature;
125
126#ifdef __cplusplus
127 extern "C" {
128#endif
129
130/* SSH Key Functions */
131 void ssh_key_clean (ssh_key key);
132
133 const char *
134 ssh_key_get_signature_algorithm(ssh_session session,
135 enum ssh_keytypes_e type);
136 enum ssh_keytypes_e ssh_key_type_from_signature_name(const char *name);
137 enum ssh_keytypes_e ssh_key_type_plain(enum ssh_keytypes_e type);
138 enum ssh_digest_e ssh_key_type_to_hash(ssh_session session,
139 enum ssh_keytypes_e type);
140 enum ssh_digest_e ssh_key_hash_from_name(const char *name);
141
142#define is_ecdsa_key_type(t) \
143 ((t) >= SSH_KEYTYPE_ECDSA_P256 && (t) <= SSH_KEYTYPE_ECDSA_P521)
144
145#define is_cert_type(kt)\
146 ((kt) == SSH_KEYTYPE_RSA_CERT01 ||\
147 (kt) == SSH_KEYTYPE_SK_ECDSA_CERT01 ||\
148 (kt) == SSH_KEYTYPE_SK_ED25519_CERT01 ||\
149 ((kt) >= SSH_KEYTYPE_ECDSA_P256_CERT01 &&\
150 (kt) <= SSH_KEYTYPE_ED25519_CERT01))
151
152#define is_sk_key_type(kt) \
153 ((kt) == SSH_KEYTYPE_SK_ECDSA || (kt) == SSH_KEYTYPE_SK_ED25519 || \
154 (kt) == SSH_KEYTYPE_SK_ECDSA_CERT01 || \
155 (kt) == SSH_KEYTYPE_SK_ED25519_CERT01)
156
157/* SSH Signature Functions */
158ssh_signature ssh_signature_new(void);
159 void ssh_signature_free(ssh_signature sign);
160#define SSH_SIGNATURE_FREE(x) \
161 do { ssh_signature_free(x); x = NULL; } while(0)
162
163 int ssh_pki_export_signature_blob(const ssh_signature sign,
164 ssh_string *sign_blob);
165 int ssh_pki_import_signature_blob(const ssh_string sig_blob,
166 const ssh_key pubkey,
167 ssh_signature *psig);
168 int ssh_pki_signature_verify(ssh_session session,
169 ssh_signature sig,
170 const ssh_key key,
171 const unsigned char *digest,
172 size_t dlen);
173
174/* SSH Public Key Functions */
175 int ssh_pki_export_pubkey_blob(const ssh_key key,
176 ssh_string *pblob);
177 int ssh_pki_import_pubkey_blob(const ssh_string key_blob,
178 ssh_key *pkey);
179
180 int ssh_pki_import_cert_blob(const ssh_string cert_blob,
181 ssh_key *pkey);
182
183/* SSH Private Key Functions */
184 int ssh_pki_export_privkey_blob(const ssh_key key,
185 ssh_string *pblob);
186
187
188/* SSH Signing Functions */
189ssh_string ssh_pki_do_sign(ssh_session session, ssh_buffer sigbuf,
190 const ssh_key privatekey, enum ssh_digest_e hash_type);
191ssh_string ssh_pki_do_sign_agent(ssh_session session,
192 struct ssh_buffer_struct *buf,
193 const ssh_key pubkey);
194ssh_string ssh_srv_pki_do_sign_sessionid(ssh_session session,
195 const ssh_key privkey,
196 const enum ssh_digest_e digest);
197
198/* Temporary functions, to be removed after migration to ssh_key */
199ssh_public_key ssh_pki_convert_key_to_publickey(const ssh_key key);
200ssh_private_key ssh_pki_convert_key_to_privatekey(const ssh_key key);
201
202 int ssh_key_algorithm_allowed(ssh_session session, const char *type);
203 bool ssh_key_size_allowed(ssh_session session, ssh_key key);
204
205/* Return the key size in bits */
206 int ssh_key_size(ssh_key key);
207
208/* PKCS11 URI function to check if filename is a path or a PKCS11 URI */
209#ifdef WITH_PKCS11_URI
210 bool ssh_pki_is_uri(const char *filename);
211 char *ssh_pki_export_pub_uri_from_priv_uri(const char *priv_uri);
212#endif /* WITH_PKCS11_URI */
213
214#ifdef __cplusplus
215}
216#endif
217
218#endif /* PKI_H_ */
ssh_key_type_to_hash
enum ssh_digest_e ssh_key_type_to_hash(ssh_session session, enum ssh_keytypes_e type)
Convert a key type to a hash type. This is usually unambiguous for all the key types,...
Definition pki.c:628
ssh_key_type_plain
enum ssh_keytypes_e ssh_key_type_plain(enum ssh_keytypes_e type)
Get the public key type corresponding to a certificate type.
Definition pki.c:781
ssh_key_type_from_signature_name
enum ssh_keytypes_e ssh_key_type_from_signature_name(const char *name)
Convert a ssh key algorithm name to a ssh key algorithm type.
Definition pki.c:710
ssh_key_algorithm_allowed
int ssh_key_algorithm_allowed(ssh_session session, const char *type)
Checks the given key against the configured allowed public key algorithm types.
Definition pki.c:494
ssh_key_clean
void ssh_key_clean(ssh_key key)
clean up the key and deallocate all existing keys
Definition pki.c:221
ssh_key_get_signature_algorithm
const char * ssh_key_get_signature_algorithm(ssh_session session, enum ssh_keytypes_e type)
Gets signature algorithm name to be used with the given key type.
Definition pki.c:678
ssh_key_size_allowed
bool ssh_key_size_allowed(ssh_session session, ssh_key key)
Check the given key is acceptable in regards to the key size policy specified by the configuration.
Definition pki.c:548