summaryrefslogtreecommitdiffstats
path: root/usr.bin/ssh/sshkey.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* highly polished whitespace, mostly fixing spaces-for-tab and baddjm2021-04-031-11/+11
| | | | indentation on continuation lines. Prompted by GHPR#185
* fix memleaks in private key deserialisation; enforce more consistencydjm2021-02-021-1/+20
| | | | | between redundant fields in private key certificate and private key body; ok markus@
* move check_host_cert() from sshconnect,c to sshkey.c and refactordjm2021-01-261-4/+35
| | | | | | it to make it more generally usable and testable. ok markus@
* Make output buffer larger to prevent potential truncation warnings fromdtucker2021-01-151-2/+2
| | | | | compilers not smart enough to know the strftime calls won't ever fully fill "to" and "from". ok djm@
* Adapt XMSS to new logging infrastructure. With markus@, ok djm@.dtucker2020-10-191-5/+5
|
* support for user-verified FIDO keysdjm2020-08-271-9/+11
| | | | | | | | | | | | | | | FIDO2 supports a notion of "user verification" where the user is required to demonstrate their identity to the token before particular operations (e.g. signing). Typically this is done by authenticating themselves using a PIN that has been set on the token. This adds support for generating and using user verified keys where the verification happens via PIN (other options might be added in the future, but none are in common use now). Practically, this adds another key generation option "verify-required" that yields a key that requires a PIN before each authentication. feedback markus@ and Pedro Martelletto; ok markus@
* only call sshkey_xmss_init() once for KEY_XMSS_CERT; ok djmmarkus2020-06-241-2/+4
|
* Add support for FIDO webauthn (verification only). webauthn is adjm2020-06-221-1/+3
| | | | | | standard for using FIDO keys in web browsers. webauthn signatures are a slightly different format to plain FIDO signatures - this support allows verification of these. Feedback and ok markus@
* Refactor private key parsing. Eliminates a fair bit of duplicateddjm2020-04-111-147/+40
| | | | | | | code and fixes oss-fuzz#20074 (NULL deref) caused by a missing key type check in the ECDSA_CERT parsing path. feedback and ok markus@
* add sshkey_parse_pubkey_from_private_fileblob_type()djm2020-04-081-1/+65
| | | | | | | Extracts a public key from the unencrypted envelope of a new-style OpenSSH private key. ok markus@
* simplify sshkey_parse_private_fileblob_type()djm2020-04-081-16/+5
| | | | | | | Try new format parser for all key types first, fall back to PEM parser only for invalid format errors. ok markus@
* check private key type against requested key type in new-style privatedjm2020-04-081-1/+7
| | | | decoding; ok markus@
* check that pubkey in private key envelope matches actual private keydjm2020-04-081-8/+19
| | | | | | (this public key is currently unusued) ok markus@
* refactor private key parsing a littledjm2020-04-081-40/+114
| | | | | | | | | Split out the base64 decoding and private section decryption steps in to separate functions. This will make the decryption step easier to fuzz as well as making it easier to write a "load public key from new-format private key" function. ok markus@
* sshkey_cert_check_authority requires reason to be set; ok djmmarkus2020-03-061-3/+3
|
* passphrase depends on kdfname, not ciphername (possible null-deref);markus2020-03-061-8/+8
| | | | ok djm
* change explicit_bzero();free() to freezero()jsg2020-02-261-29/+15
| | | | | | | | While freezero() returns early if the pointer is NULL the tests for NULL in callers are left to avoid warnings about passing an uninitialised size argument across a function boundry. ok deraadt@ djm@
* fix ssh-keygen not displaying authenticator touch prompt;djm2020-01-211-1/+4
| | | | reported by jmc@
* SK API and sk-helper error/PIN passingdjm2019-12-301-2/+2
| | | | | | | | | | | Allow passing a PIN via the SK API (API major crank) and let the ssh-sk-helper API follow. Also enhance the ssh-sk-helper API to support passing back an error code instead of a complete reply. Will be used to signal "wrong PIN", etc. feedback and ok markus@
* use ssh-sk-helper for all security key signing operationsdjm2019-12-131-8/+5
| | | | | | | | | This extracts and refactors the client interface for ssh-sk-helper from ssh-agent and generalises it for use by the other programs. This means that most OpenSSH tools no longer need to link against libfido2 or directly interact with /dev/uhid* requested by, feedback and ok markus@
* Add new structure for signature optionsdjm2019-11-251-5/+14
| | | | | | | | | This is populated during signature verification with additional fields that are present in and covered by the signature. At the moment, it is only used to record security key-specific options, especially the flags field. with and ok markus@
* fix a bug that prevented serialisation of ed25519-sk keysdjm2019-11-181-1/+2
|
* fix bug that prevented certification of ed25519-sk keysdjm2019-11-181-1/+7
|
* remove most uses of BN_CTXdjm2019-11-151-57/+33
| | | | | We weren't following the rules re BN_CTX_start/BN_CTX_end and the places we were using it didn't benefit from its use anyway. ok dtucker@
* in order to be able to figure out the number of signatures left onmarkus2019-11-131-1/+6
| | | | | a shielded key, we need to transfer the number of signatures left from the private to the public key. ok djm@
* fix shield/unshield for xmss keys:markus2019-11-131-2/+2
| | | | | | | | - in ssh-agent we need to delay the call to shield until we have received key specific options. - when serializing xmss keys for shield we need to deal with all optional components (e.g. state might not be loaded). ok djm@
* enable ed25519 support; ok djmmarkus2019-11-121-1/+153
|
* implement sshsk_ed25519_inner_sig(); ok djmmarkus2019-11-121-1/+6
|
* rename sshsk_ecdsa_sign() to sshsk_sign(); ok djmmarkus2019-11-121-3/+3
|
* implement ssh-ed25519-sk verification; ok djm@markus2019-11-121-1/+5
|
* Refactor signing - use sshkey_sign for everything, including the newdjm2019-10-311-8/+18
| | | | | | | | | | | U2F signatures. Don't use sshsk_ecdsa_sign() directly, instead make it reachable via sshkey_sign() like all other signature operations. This means that we need to add a provider argument to sshkey_sign(), so most of this change is mechanically adding that. Suggested by / ok markus@
* Initial infrastructure for U2F/FIDO supportdjm2019-10-311-26/+179
| | | | | | | Key library support: including allocation, marshalling public/private keys and certificates, signature validation. feedback & ok markus@
* fix an unreachable integer overflow similar to the XMSS case, and somedjm2019-10-091-4/+22
| | | | | | other NULL dereferences found by fuzzing. fix with and ok markus@
* fixes for !WITH_OPENSSL compilation; ok dtucker@djm2019-09-061-1/+5
|
* make get_sigtype public as sshkey_get_sigtype(); ok markus@djm2019-09-031-7/+7
|
* remove mostly vestigal uuencode.[ch]; moving the only uniquedjm2019-07-161-20/+7
| | | | | functionality there (wrapping of base64-encoded data) to sshbuf functions; feedback and ok markus@
* support PKCS8 as an optional format for storage of private keys,djm2019-07-151-21/+55
| | | | | | | | | | | | enabled via "ssh-keygen -m PKCS8" on operations that save private keys to disk. The OpenSSH native key format remains the default, but PKCS8 is a superior format to PEM if interoperability with non-OpenSSH software is required, as it may use a less terrible KDF (IIRC PEM uses a single round of MD5 as a KDF). adapted from patch by Jakub Jelen via bz3013; ok markus
* Remove some set but never used variables. ok daraadt@dtucker2019-07-071-4/+2
|
* fix NULL deference (bzero) on error path added in last commit;djm2019-06-271-2/+2
| | | | | | spotted by Reynir Björnsson ok deraadt@ markus@ tb@
* fix mismatch proto/decl from key shielding change; spotted via oss-fuzzdjm2019-06-231-2/+2
|
* Add protection for private keys at rest in RAM against speculationdjm2019-06-211-17/+282
| | | | | | | | | | | | | | | | | | | | | | | and memory sidechannel attacks like Spectre, Meltdown, Rowhammer and Rambleed. This change encrypts private keys when they are not in use with a symmetic key that is derived from a relatively large "prekey" consisting of random data (currently 16KB). Attackers must recover the entire prekey with high accuracy before they can attempt to decrypt the shielded private key, but the current generation of attacks have bit error rates that, when applied cumulatively to the entire prekey, make this unlikely. Implementation-wise, keys are encrypted "shielded" when loaded and then automatically and transparently unshielded when used for signatures or when being saved/serialised. Hopefully we can remove this in a few years time when computer architecture has become less unsafe. been in snaps for a bit already; thanks deraadt@ ok dtucker@ deraadt@
* When signing certificates with an RSA key, default to using thedjm2019-05-201-1/+8
| | | | | | | | | | | rsa-sha2-512 signature algorithm. Certificates signed by RSA keys will therefore be incompatible with OpenSSH < 7.2 unless the default is overridden. Document the ability of the ssh-keygen -t flag to override the signature algorithm when signing certificates, and the new default. ok deraadt@
* Wrap XMSS including in ifdef. Patch from markus at blueflash.cc, ok djmdtucker2019-05-031-2/+4
|
* Make sshpkt_get_bignum2() allocate the bignum it is parsing ratherdjm2019-01-211-70/+26
| | | | | | than make the caller do it. Saves a lot of boilerplate code. from markus@ ok djm@
* typo in plain RSA algorithm counterpart names for certificates;djm2018-10-111-3/+3
| | | | spotted by Adam Eijdenberg; ok dtucker@
* Treat all PEM_read_bio_PrivateKey() errors when a passphrase is specifieddjm2018-10-091-2/+11
| | | | | | | | | | | | | as "incorrect passphrase" instead of trying to choose between that and "invalid format". libcrypto can return ASN1 parsing errors rather than the expected decrypt error in certain infrequent cases when trying to decrypt/parse PEM private keys when supplied with an invalid passphrase. Report and repro recipe from Thomas Deutschmann in bz#2901 ok markus@
* garbage-collect moribund ssh_new_private() API.djm2018-09-141-17/+6
|
* hold our collective noses and use the openssl-1.1.x API in OpenSSH;djm2018-09-131-289/+331
| | | | feedback and ok tb@ jsing@ markus@
* add sshkey_check_cert_sigtype() that checks a cert->signature_typedjm2018-09-121-1/+22
| | | | against a supplied whitelist; ok markus
* add cert->signature_type field and keep it in sync with certificatedjm2018-09-121-26/+67
| | | | signature wrt loading and certification operations; ok markus@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.