/src/openssh/ssh-ecdsa.c

Source (jump to first uncovered line)
/* $OpenBSD: ssh-ecdsa.c,v 1.27 2024/08/15 00:51:51 djm Exp $ */
/*
 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
 * Copyright (c) 2010 Damien Miller.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"

#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)

#include <sys/types.h>

#include <openssl/bn.h>
#include <openssl/ec.h>
#include <openssl/ecdsa.h>
#include <openssl/evp.h>

#include <string.h>

#include "sshbuf.h"
#include "ssherr.h"
#include "digest.h"
#define SSHKEY_INTERNAL
#include "sshkey.h"

#include "openbsd-compat/openssl-compat.h"

int
sshkey_ecdsa_fixup_group(EVP_PKEY *k)
{
  int nids[] = {
    NID_X9_62_prime256v1,
    NID_secp384r1,
#ifdef OPENSSL_HAS_NISTP521
    NID_secp521r1,
#endif
    -1
  };
  int nid = -1;
  u_int i;
  const EC_GROUP *g;
  EC_KEY *ec = NULL;
  EC_GROUP *eg = NULL;

  if ((ec = EVP_PKEY_get1_EC_KEY(k)) == NULL ||
      (g = EC_KEY_get0_group(ec)) == NULL)
    goto out;
  /*
   * The group may be stored in a ASN.1 encoded private key in one of two
   * ways: as a "named group", which is reconstituted by ASN.1 object ID
   * or explicit group parameters encoded into the key blob. Only the
   * "named group" case sets the group NID for us, but we can figure
   * it out for the other case by comparing against all the groups that
   * are supported.
   */
  if ((nid = EC_GROUP_get_curve_name(g)) > 0)
    goto out;
  nid = -1;
  for (i = 0; nids[i] != -1; i++) {
    if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL)
      goto out;
    if (EC_GROUP_cmp(g, eg, NULL) == 0)
      break;
    EC_GROUP_free(eg);
    eg = NULL;
  }
  if (nids[i] == -1)
    goto out;

  /* Use the group with the NID attached */
  EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE);
  if (EC_KEY_set_group(ec, eg) != 1 ||
      EVP_PKEY_set1_EC_KEY(k, ec) != 1)
    goto out;
  /* success */
  nid = nids[i];
 out:
  EC_KEY_free(ec);
  EC_GROUP_free(eg);
  return nid;
}

static u_int
ssh_ecdsa_size(const struct sshkey *key)
{
  switch (key->ecdsa_nid) {
  case NID_X9_62_prime256v1:
    return 256;
  case NID_secp384r1:
    return 384;
#ifdef OPENSSL_HAS_NISTP521
  case NID_secp521r1:
    return 521;
#endif
  default:
    return 0;
  }
}

static void
ssh_ecdsa_cleanup(struct sshkey *k)
{
  EVP_PKEY_free(k->pkey);
  k->pkey = NULL;
}

static int
ssh_ecdsa_equal(const struct sshkey *a, const struct sshkey *b)
{
  if (a->pkey == NULL || b->pkey == NULL)
    return 0;
  return EVP_PKEY_cmp(a->pkey, b->pkey) == 1;
}

static int
ssh_ecdsa_serialize_public(const struct sshkey *key, struct sshbuf *b,
    enum sshkey_serialize_rep opts)
{
  int r;

  if (key->pkey == NULL)
    return SSH_ERR_INVALID_ARGUMENT;
  if ((r = sshbuf_put_cstring(b,
      sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 ||
      (r = sshbuf_put_ec_pkey(b, key->pkey)) != 0)
    return r;

  return 0;
}

static int
ssh_ecdsa_serialize_private(const struct sshkey *key, struct sshbuf *b,
    enum sshkey_serialize_rep opts)
{
  int r;

  if (!sshkey_is_cert(key)) {
    if ((r = ssh_ecdsa_serialize_public(key, b, opts)) != 0)
      return r;
  }
  if ((r = sshbuf_put_bignum2(b,
      EC_KEY_get0_private_key(EVP_PKEY_get0_EC_KEY(key->pkey)))) != 0)
    return r;
  return 0;
}

static int
ssh_ecdsa_generate(struct sshkey *k, int bits)
{
  EVP_PKEY *res = NULL;
  EVP_PKEY_CTX *ctx = NULL;
  int ret = SSH_ERR_INTERNAL_ERROR;

  if ((k->ecdsa_nid = sshkey_ecdsa_bits_to_nid(bits)) == -1)
    return SSH_ERR_KEY_LENGTH;

  if ((ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL)
    return SSH_ERR_ALLOC_FAIL;

  if (EVP_PKEY_keygen_init(ctx) <= 0 ||
      EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, k->ecdsa_nid) <= 0 ||
      EVP_PKEY_keygen(ctx, &res) <= 0) {
    ret = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  /* success */
  k->pkey = res;
  res = NULL;
  ret = 0;
 out:
  EVP_PKEY_free(res);
  EVP_PKEY_CTX_free(ctx);
  return ret;
}

static int
ssh_ecdsa_copy_public(const struct sshkey *from, struct sshkey *to)
{
  const EC_KEY *ec_from;
  EC_KEY *ec_to = NULL;
  int ret = SSH_ERR_INTERNAL_ERROR;

  ec_from = EVP_PKEY_get0_EC_KEY(from->pkey);
  if (ec_from == NULL)
    return SSH_ERR_LIBCRYPTO_ERROR;

  to->ecdsa_nid = from->ecdsa_nid;
  if ((ec_to = EC_KEY_new_by_curve_name(from->ecdsa_nid)) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  if (EC_KEY_set_public_key(ec_to,
      EC_KEY_get0_public_key(ec_from)) != 1) {
    ret = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  EVP_PKEY_free(to->pkey);
  if ((to->pkey = EVP_PKEY_new()) == NULL) {
    ret = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if (EVP_PKEY_set1_EC_KEY(to->pkey, ec_to) != 1) {
    ret = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  ret = 0;
 out:
  EC_KEY_free(ec_to);
  return ret;
}

static int
ssh_ecdsa_deserialize_public(const char *ktype, struct sshbuf *b,
    struct sshkey *key)
{
  int r;
  char *curve = NULL;
  EVP_PKEY *pkey = NULL;
  EC_KEY *ec = NULL;

  if ((key->ecdsa_nid = sshkey_ecdsa_nid_from_name(ktype)) == -1)
    return SSH_ERR_INVALID_ARGUMENT;
  if ((r = sshbuf_get_cstring(b, &curve, NULL)) != 0)
    goto out;
  if (key->ecdsa_nid != sshkey_curve_name_to_nid(curve)) {
    r = SSH_ERR_EC_CURVE_MISMATCH;
    goto out;
  }
  if ((ec = EC_KEY_new_by_curve_name(key->ecdsa_nid)) == NULL) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  if ((r = sshbuf_get_eckey(b, ec)) != 0)
    goto out;
  if (sshkey_ec_validate_public(EC_KEY_get0_group(ec),
      EC_KEY_get0_public_key(ec)) != 0) {
    r = SSH_ERR_KEY_INVALID_EC_VALUE;
    goto out;
  }
  if ((pkey = EVP_PKEY_new()) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if (EVP_PKEY_set1_EC_KEY(pkey, ec) != 1) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  EVP_PKEY_free(key->pkey);
  key->pkey = pkey;
  pkey = NULL;
  /* success */
  r = 0;
#ifdef DEBUG_PK
  sshkey_dump_ec_point(
      EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(key->pkey)),
      EC_KEY_get0_public_key(EVP_PKEY_get0_EC_KEY(key->pkey)));
#endif
 out:
  EC_KEY_free(ec);
  EVP_PKEY_free(pkey);
  free(curve);
  return r;
}

static int
ssh_ecdsa_deserialize_private(const char *ktype, struct sshbuf *b,
    struct sshkey *key)
{
  int r;
  BIGNUM *exponent = NULL;
  EC_KEY *ec = NULL;

  if (!sshkey_is_cert(key)) {
    if ((r = ssh_ecdsa_deserialize_public(ktype, b, key)) != 0)
      return r;
  }
  if ((r = sshbuf_get_bignum2(b, &exponent)) != 0)
    goto out;
  if ((ec = EVP_PKEY_get1_EC_KEY(key->pkey)) == NULL) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  if (EC_KEY_set_private_key(ec, exponent) != 1) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  if ((r = sshkey_ec_validate_private(ec)) != 0)
    goto out;
  if (EVP_PKEY_set1_EC_KEY(key->pkey, ec) != 1) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  /* success */
  r = 0;
 out:
  BN_clear_free(exponent);
  EC_KEY_free(ec);
  return r;
}

static int
ssh_ecdsa_sign(struct sshkey *key,
    u_char **sigp, size_t *lenp,
    const u_char *data, size_t dlen,
    const char *alg, const char *sk_provider, const char *sk_pin, u_int compat)
{
  ECDSA_SIG *esig = NULL;
  unsigned char *sigb = NULL;
  const unsigned char *psig;
  const BIGNUM *sig_r, *sig_s;
  int hash_alg;
  size_t slen = 0;
  struct sshbuf *b = NULL, *bb = NULL;
  int len = 0, ret = SSH_ERR_INTERNAL_ERROR;

  if (lenp != NULL)
    *lenp = 0;
  if (sigp != NULL)
    *sigp = NULL;

  if (key == NULL || key->pkey == NULL ||
      sshkey_type_plain(key->type) != KEY_ECDSA)
    return SSH_ERR_INVALID_ARGUMENT;

  if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1)
    return SSH_ERR_INTERNAL_ERROR;

  if ((ret = sshkey_pkey_digest_sign(key->pkey, hash_alg, &sigb, &slen,
      data, dlen)) != 0)
    goto out;

  psig = sigb;
  if ((esig = d2i_ECDSA_SIG(NULL, &psig, slen)) == NULL) {
    ret = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  if ((bb = sshbuf_new()) == NULL || (b = sshbuf_new()) == NULL) {
    ret = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  ECDSA_SIG_get0(esig, &sig_r, &sig_s);
  if ((ret = sshbuf_put_bignum2(bb, sig_r)) != 0 ||
      (ret = sshbuf_put_bignum2(bb, sig_s)) != 0)
    goto out;
  if ((ret = sshbuf_put_cstring(b, sshkey_ssh_name_plain(key))) != 0 ||
      (ret = sshbuf_put_stringb(b, bb)) != 0)
    goto out;
  len = sshbuf_len(b);
  if (sigp != NULL) {
    if ((*sigp = malloc(len)) == NULL) {
      ret = SSH_ERR_ALLOC_FAIL;
      goto out;
    }
    memcpy(*sigp, sshbuf_ptr(b), len);
  }
  if (lenp != NULL)
    *lenp = len;
  ret = 0;
 out:
  freezero(sigb, slen);
  sshbuf_free(b);
  sshbuf_free(bb);
  ECDSA_SIG_free(esig);
  return ret;
}

static int
ssh_ecdsa_verify(const struct sshkey *key,
    const u_char *sig, size_t siglen,
    const u_char *data, size_t dlen, const char *alg, u_int compat,
    struct sshkey_sig_details **detailsp)
{
  ECDSA_SIG *esig = NULL;
  BIGNUM *sig_r = NULL, *sig_s = NULL;
  int hash_alg, len = 0;
  int ret = SSH_ERR_INTERNAL_ERROR;
  struct sshbuf *b = NULL, *sigbuf = NULL;
  char *ktype = NULL;
  unsigned char *sigb = NULL, *cp;

  if (key == NULL || key->pkey == NULL ||
      sshkey_type_plain(key->type) != KEY_ECDSA ||
      sig == NULL || siglen == 0)
    return SSH_ERR_INVALID_ARGUMENT;

  if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1)
    return SSH_ERR_INTERNAL_ERROR;

  /* fetch signature */
  if ((b = sshbuf_from(sig, siglen)) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  if (sshbuf_get_cstring(b, &ktype, NULL) != 0 ||
      sshbuf_froms(b, &sigbuf) != 0) {
    ret = SSH_ERR_INVALID_FORMAT;
    goto out;
  }
  if (strcmp(sshkey_ssh_name_plain(key), ktype) != 0) {
    ret = SSH_ERR_KEY_TYPE_MISMATCH;
    goto out;
  }
  if (sshbuf_len(b) != 0) {
    ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
    goto out;
  }

  /* parse signature */
  if (sshbuf_get_bignum2(sigbuf, &sig_r) != 0 ||
      sshbuf_get_bignum2(sigbuf, &sig_s) != 0) {
    ret = SSH_ERR_INVALID_FORMAT;
    goto out;
  }
  if (sshbuf_len(sigbuf) != 0) {
    ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
    goto out;
  }

  if ((esig = ECDSA_SIG_new()) == NULL) {
    ret = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if (!ECDSA_SIG_set0(esig, sig_r, sig_s)) {
    ret = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  sig_r = sig_s = NULL; /* transferred */

  if ((len = i2d_ECDSA_SIG(esig, NULL)) <= 0) {
    len = 0;
    ret = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  if ((sigb = calloc(1, len)) == NULL) {
    ret = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  cp = sigb; /* ASN1_item_i2d increments the pointer past the object */
  if (i2d_ECDSA_SIG(esig, &cp) != len) {
    ret = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  if ((ret = sshkey_pkey_digest_verify(key->pkey, hash_alg,
      data, dlen, sigb, len)) != 0)
    goto out;
  /* success */
 out:
  freezero(sigb, len);
  sshbuf_free(sigbuf);
  sshbuf_free(b);
  ECDSA_SIG_free(esig);
  BN_clear_free(sig_r);
  BN_clear_free(sig_s);
  free(ktype);
  return ret;
}

/* NB. not static; used by ECDSA-SK */
const struct sshkey_impl_funcs sshkey_ecdsa_funcs = {
  /* .size = */   ssh_ecdsa_size,
  /* .alloc = */    NULL,
  /* .cleanup = */  ssh_ecdsa_cleanup,
  /* .equal = */    ssh_ecdsa_equal,
  /* .ssh_serialize_public = */ ssh_ecdsa_serialize_public,
  /* .ssh_deserialize_public = */ ssh_ecdsa_deserialize_public,
  /* .ssh_serialize_private = */ ssh_ecdsa_serialize_private,
  /* .ssh_deserialize_private = */ ssh_ecdsa_deserialize_private,
  /* .generate = */ ssh_ecdsa_generate,
  /* .copy_public = */  ssh_ecdsa_copy_public,
  /* .sign = */   ssh_ecdsa_sign,
  /* .verify = */   ssh_ecdsa_verify,
};

const struct sshkey_impl sshkey_ecdsa_nistp256_impl = {
  /* .name = */   "ecdsa-sha2-nistp256",
  /* .shortname = */  "ECDSA",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_ECDSA,
  /* .nid = */    NID_X9_62_prime256v1,
  /* .cert = */   0,
  /* .sigonly = */  0,
  /* .keybits = */  0,
  /* .funcs = */    &sshkey_ecdsa_funcs,
};

const struct sshkey_impl sshkey_ecdsa_nistp256_cert_impl = {
  /* .name = */   "ecdsa-sha2-nistp256-cert-v01@openssh.com",
  /* .shortname = */  "ECDSA-CERT",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_ECDSA_CERT,
  /* .nid = */    NID_X9_62_prime256v1,
  /* .cert = */   1,
  /* .sigonly = */  0,
  /* .keybits = */  0,
  /* .funcs = */    &sshkey_ecdsa_funcs,
};

const struct sshkey_impl sshkey_ecdsa_nistp384_impl = {
  /* .name = */   "ecdsa-sha2-nistp384",
  /* .shortname = */  "ECDSA",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_ECDSA,
  /* .nid = */    NID_secp384r1,
  /* .cert = */   0,
  /* .sigonly = */  0,
  /* .keybits = */  0,
  /* .funcs = */    &sshkey_ecdsa_funcs,
};

const struct sshkey_impl sshkey_ecdsa_nistp384_cert_impl = {
  /* .name = */   "ecdsa-sha2-nistp384-cert-v01@openssh.com",
  /* .shortname = */  "ECDSA-CERT",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_ECDSA_CERT,
  /* .nid = */    NID_secp384r1,
  /* .cert = */   1,
  /* .sigonly = */  0,
  /* .keybits = */  0,
  /* .funcs = */    &sshkey_ecdsa_funcs,
};

#ifdef OPENSSL_HAS_NISTP521
const struct sshkey_impl sshkey_ecdsa_nistp521_impl = {
  /* .name = */   "ecdsa-sha2-nistp521",
  /* .shortname = */  "ECDSA",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_ECDSA,
  /* .nid = */    NID_secp521r1,
  /* .cert = */   0,
  /* .sigonly = */  0,
  /* .keybits = */  0,
  /* .funcs = */    &sshkey_ecdsa_funcs,
};

const struct sshkey_impl sshkey_ecdsa_nistp521_cert_impl = {
  /* .name = */   "ecdsa-sha2-nistp521-cert-v01@openssh.com",
  /* .shortname = */  "ECDSA-CERT",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_ECDSA_CERT,
  /* .nid = */    NID_secp521r1,
  /* .cert = */   1,
  /* .sigonly = */  0,
  /* .keybits = */  0,
  /* .funcs = */    &sshkey_ecdsa_funcs,
};
#endif

#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */

Coverage Report

Created: 2025-07-02 06:56

Line	Count	Source (jump to first uncovered line)
1		/* $OpenBSD: ssh-ecdsa.c,v 1.27 2024/08/15 00:51:51 djm Exp $ */
2		/*
3		* Copyright (c) 2000 Markus Friedl. All rights reserved.
4		* Copyright (c) 2010 Damien Miller. All rights reserved.
5		*
6		* Redistribution and use in source and binary forms, with or without
7		* modification, are permitted provided that the following conditions
8		* are met:
9		* 1. Redistributions of source code must retain the above copyright
10		* notice, this list of conditions and the following disclaimer.
11		* 2. Redistributions in binary form must reproduce the above copyright
12		* notice, this list of conditions and the following disclaimer in the
13		* documentation and/or other materials provided with the distribution.
14		*
15		* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16		* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17		* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18		* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19		* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20		* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21		* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22		* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23		* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24		* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25		*/
26
27		#include "includes.h"
28
29		#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
30
31		#include <sys/types.h>
32
33		#include <openssl/bn.h>
34		#include <openssl/ec.h>
35		#include <openssl/ecdsa.h>
36		#include <openssl/evp.h>
37
38		#include <string.h>
39
40		#include "sshbuf.h"
41		#include "ssherr.h"
42		#include "digest.h"
43		#define SSHKEY_INTERNAL
44		#include "sshkey.h"
45
46		#include "openbsd-compat/openssl-compat.h"
47
48		int
49		sshkey_ecdsa_fixup_group(EVP_PKEY *k)
50	0	{
51	0	int nids[] = {
52	0	NID_X9_62_prime256v1,
53	0	NID_secp384r1,
54	0	#ifdef OPENSSL_HAS_NISTP521
55	0	NID_secp521r1,
56	0	#endif
57	0	-1
58	0	};
59	0	int nid = -1;
60	0	u_int i;
61	0	const EC_GROUP *g;
62	0	EC_KEY *ec = NULL;
63	0	EC_GROUP *eg = NULL;
64
65	0	if ((ec = EVP_PKEY_get1_EC_KEY(k)) == NULL \|\|
66	0	(g = EC_KEY_get0_group(ec)) == NULL)
67	0	goto out;
68		/*
69		* The group may be stored in a ASN.1 encoded private key in one of two
70		* ways: as a "named group", which is reconstituted by ASN.1 object ID
71		* or explicit group parameters encoded into the key blob. Only the
72		* "named group" case sets the group NID for us, but we can figure
73		* it out for the other case by comparing against all the groups that
74		* are supported.
75		*/
76	0	if ((nid = EC_GROUP_get_curve_name(g)) > 0)
77	0	goto out;
78	0	nid = -1;
79	0	for (i = 0; nids[i] != -1; i++) {
80	0	if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL)
81	0	goto out;
82	0	if (EC_GROUP_cmp(g, eg, NULL) == 0)
83	0	break;
84	0	EC_GROUP_free(eg);
85	0	eg = NULL;
86	0	}
87	0	if (nids[i] == -1)
88	0	goto out;
89
90		/* Use the group with the NID attached */
91	0	EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE);
92	0	if (EC_KEY_set_group(ec, eg) != 1 \|\|
93	0	EVP_PKEY_set1_EC_KEY(k, ec) != 1)
94	0	goto out;
95		/* success */
96	0	nid = nids[i];
97	0	out:
98	0	EC_KEY_free(ec);
99	0	EC_GROUP_free(eg);
100	0	return nid;
101	0	}
102
103		static u_int
104		ssh_ecdsa_size(const struct sshkey *key)
105	0	{
106	0	switch (key->ecdsa_nid) {
107	0	case NID_X9_62_prime256v1:
108	0	return 256;
109	0	case NID_secp384r1:
110	0	return 384;
111	0	#ifdef OPENSSL_HAS_NISTP521
112	0	case NID_secp521r1:
113	0	return 521;
114	0	#endif
115	0	default:
116	0	return 0;
117	0	}
118	0	}
119
120		static void
121		ssh_ecdsa_cleanup(struct sshkey *k)
122	9.67k	{
123	9.67k	EVP_PKEY_free(k->pkey);
124	9.67k	k->pkey = NULL;
125	9.67k	}
126
127		static int
128		ssh_ecdsa_equal(const struct sshkey a, const struct sshkey b)
129	3.86k	{
130	3.86k	if (a->pkey == NULL \|\| b->pkey == NULL)
131	0	return 0;
132	3.86k	return EVP_PKEY_cmp(a->pkey, b->pkey) == 1;
133	3.86k	}
134
135		static int
136		ssh_ecdsa_serialize_public(const struct sshkey key, struct sshbuf b,
137		enum sshkey_serialize_rep opts)
138	12	{
139	12	int r;
140
141	12	if (key->pkey == NULL)
142	0	return SSH_ERR_INVALID_ARGUMENT;
143	12	if ((r = sshbuf_put_cstring(b,
144	12	sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 \|\|
145	12	(r = sshbuf_put_ec_pkey(b, key->pkey)) != 0)
146	0	return r;
147
148	12	return 0;
149	12	}
150
151		static int
152		ssh_ecdsa_serialize_private(const struct sshkey key, struct sshbuf b,
153		enum sshkey_serialize_rep opts)
154	0	{
155	0	int r;
156
157	0	if (!sshkey_is_cert(key)) {
158	0	if ((r = ssh_ecdsa_serialize_public(key, b, opts)) != 0)
159	0	return r;
160	0	}
161	0	if ((r = sshbuf_put_bignum2(b,
162	0	EC_KEY_get0_private_key(EVP_PKEY_get0_EC_KEY(key->pkey)))) != 0)
163	0	return r;
164	0	return 0;
165	0	}
166
167		static int
168		ssh_ecdsa_generate(struct sshkey *k, int bits)
169	0	{
170	0	EVP_PKEY *res = NULL;
171	0	EVP_PKEY_CTX *ctx = NULL;
172	0	int ret = SSH_ERR_INTERNAL_ERROR;
173
174	0	if ((k->ecdsa_nid = sshkey_ecdsa_bits_to_nid(bits)) == -1)
175	0	return SSH_ERR_KEY_LENGTH;
176
177	0	if ((ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL)
178	0	return SSH_ERR_ALLOC_FAIL;
179
180	0	if (EVP_PKEY_keygen_init(ctx) <= 0 \|\|
181	0	EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, k->ecdsa_nid) <= 0 \|\|
182	0	EVP_PKEY_keygen(ctx, &res) <= 0) {
183	0	ret = SSH_ERR_LIBCRYPTO_ERROR;
184	0	goto out;
185	0	}
186		/* success */
187	0	k->pkey = res;
188	0	res = NULL;
189	0	ret = 0;
190	0	out:
191	0	EVP_PKEY_free(res);
192	0	EVP_PKEY_CTX_free(ctx);
193	0	return ret;
194	0	}
195
196		static int
197		ssh_ecdsa_copy_public(const struct sshkey from, struct sshkey to)
198	0	{
199	0	const EC_KEY *ec_from;
200	0	EC_KEY *ec_to = NULL;
201	0	int ret = SSH_ERR_INTERNAL_ERROR;
202
203	0	ec_from = EVP_PKEY_get0_EC_KEY(from->pkey);
204	0	if (ec_from == NULL)
205	0	return SSH_ERR_LIBCRYPTO_ERROR;
206
207	0	to->ecdsa_nid = from->ecdsa_nid;
208	0	if ((ec_to = EC_KEY_new_by_curve_name(from->ecdsa_nid)) == NULL)
209	0	return SSH_ERR_ALLOC_FAIL;
210	0	if (EC_KEY_set_public_key(ec_to,
211	0	EC_KEY_get0_public_key(ec_from)) != 1) {
212	0	ret = SSH_ERR_LIBCRYPTO_ERROR;
213	0	goto out;
214	0	}
215	0	EVP_PKEY_free(to->pkey);
216	0	if ((to->pkey = EVP_PKEY_new()) == NULL) {
217	0	ret = SSH_ERR_ALLOC_FAIL;
218	0	goto out;
219	0	}
220	0	if (EVP_PKEY_set1_EC_KEY(to->pkey, ec_to) != 1) {
221	0	ret = SSH_ERR_LIBCRYPTO_ERROR;
222	0	goto out;
223	0	}
224	0	ret = 0;
225	0	out:
226	0	EC_KEY_free(ec_to);
227	0	return ret;
228	0	}
229
230		static int
231		ssh_ecdsa_deserialize_public(const char ktype, struct sshbuf b,
232		struct sshkey *key)
233	9.67k	{
234	9.67k	int r;
235	9.67k	char *curve = NULL;
236	9.67k	EVP_PKEY *pkey = NULL;
237	9.67k	EC_KEY *ec = NULL;
238
239	9.67k	if ((key->ecdsa_nid = sshkey_ecdsa_nid_from_name(ktype)) == -1)
240	0	return SSH_ERR_INVALID_ARGUMENT;
241	9.67k	if ((r = sshbuf_get_cstring(b, &curve, NULL)) != 0)
242	0	goto out;
243	9.67k	if (key->ecdsa_nid != sshkey_curve_name_to_nid(curve)) {
244	0	r = SSH_ERR_EC_CURVE_MISMATCH;
245	0	goto out;
246	0	}
247	9.67k	if ((ec = EC_KEY_new_by_curve_name(key->ecdsa_nid)) == NULL) {
248	0	r = SSH_ERR_LIBCRYPTO_ERROR;
249	0	goto out;
250	0	}
251	9.67k	if ((r = sshbuf_get_eckey(b, ec)) != 0)
252	0	goto out;
253	9.67k	if (sshkey_ec_validate_public(EC_KEY_get0_group(ec),
254	9.67k	EC_KEY_get0_public_key(ec)) != 0) {
255	0	r = SSH_ERR_KEY_INVALID_EC_VALUE;
256	0	goto out;
257	0	}
258	9.67k	if ((pkey = EVP_PKEY_new()) == NULL) {
259	0	r = SSH_ERR_ALLOC_FAIL;
260	0	goto out;
261	0	}
262	9.67k	if (EVP_PKEY_set1_EC_KEY(pkey, ec) != 1) {
263	0	r = SSH_ERR_LIBCRYPTO_ERROR;
264	0	goto out;
265	0	}
266	9.67k	EVP_PKEY_free(key->pkey);
267	9.67k	key->pkey = pkey;
268	9.67k	pkey = NULL;
269		/* success */
270	9.67k	r = 0;
271		#ifdef DEBUG_PK
272		sshkey_dump_ec_point(
273		EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(key->pkey)),
274		EC_KEY_get0_public_key(EVP_PKEY_get0_EC_KEY(key->pkey)));
275		#endif
276	9.67k	out:
277	9.67k	EC_KEY_free(ec);
278	9.67k	EVP_PKEY_free(pkey);
279	9.67k	free(curve);
280	9.67k	return r;
281	9.67k	}
282
283		static int
284		ssh_ecdsa_deserialize_private(const char ktype, struct sshbuf b,
285		struct sshkey *key)
286	1.93k	{
287	1.93k	int r;
288	1.93k	BIGNUM *exponent = NULL;
289	1.93k	EC_KEY *ec = NULL;
290
291	1.93k	if (!sshkey_is_cert(key)) {
292	1.93k	if ((r = ssh_ecdsa_deserialize_public(ktype, b, key)) != 0)
293	0	return r;
294	1.93k	}
295	1.93k	if ((r = sshbuf_get_bignum2(b, &exponent)) != 0)
296	0	goto out;
297	1.93k	if ((ec = EVP_PKEY_get1_EC_KEY(key->pkey)) == NULL) {
298	0	r = SSH_ERR_LIBCRYPTO_ERROR;
299	0	goto out;
300	0	}
301	1.93k	if (EC_KEY_set_private_key(ec, exponent) != 1) {
302	0	r = SSH_ERR_LIBCRYPTO_ERROR;
303	0	goto out;
304	0	}
305	1.93k	if ((r = sshkey_ec_validate_private(ec)) != 0)
306	0	goto out;
307	1.93k	if (EVP_PKEY_set1_EC_KEY(key->pkey, ec) != 1) {
308	0	r = SSH_ERR_LIBCRYPTO_ERROR;
309	0	goto out;
310	0	}
311		/* success */
312	1.93k	r = 0;
313	1.93k	out:
314	1.93k	BN_clear_free(exponent);
315	1.93k	EC_KEY_free(ec);
316	1.93k	return r;
317	1.93k	}
318
319		static int
320		ssh_ecdsa_sign(struct sshkey *key,
321		u_char *sigp, size_t lenp,
322		const u_char *data, size_t dlen,
323		const char alg, const char sk_provider, const char *sk_pin, u_int compat)
324	0	{
325	0	ECDSA_SIG *esig = NULL;
326	0	unsigned char *sigb = NULL;
327	0	const unsigned char *psig;
328	0	const BIGNUM sig_r, sig_s;
329	0	int hash_alg;
330	0	size_t slen = 0;
331	0	struct sshbuf b = NULL, bb = NULL;
332	0	int len = 0, ret = SSH_ERR_INTERNAL_ERROR;
333
334	0	if (lenp != NULL)
335	0	*lenp = 0;
336	0	if (sigp != NULL)
337	0	*sigp = NULL;
338
339	0	if (key == NULL \|\| key->pkey == NULL \|\|
340	0	sshkey_type_plain(key->type) != KEY_ECDSA)
341	0	return SSH_ERR_INVALID_ARGUMENT;
342
343	0	if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1)
344	0	return SSH_ERR_INTERNAL_ERROR;
345
346	0	if ((ret = sshkey_pkey_digest_sign(key->pkey, hash_alg, &sigb, &slen,
347	0	data, dlen)) != 0)
348	0	goto out;
349
350	0	psig = sigb;
351	0	if ((esig = d2i_ECDSA_SIG(NULL, &psig, slen)) == NULL) {
352	0	ret = SSH_ERR_LIBCRYPTO_ERROR;
353	0	goto out;
354	0	}
355	0	if ((bb = sshbuf_new()) == NULL \|\| (b = sshbuf_new()) == NULL) {
356	0	ret = SSH_ERR_ALLOC_FAIL;
357	0	goto out;
358	0	}
359	0	ECDSA_SIG_get0(esig, &sig_r, &sig_s);
360	0	if ((ret = sshbuf_put_bignum2(bb, sig_r)) != 0 \|\|
361	0	(ret = sshbuf_put_bignum2(bb, sig_s)) != 0)
362	0	goto out;
363	0	if ((ret = sshbuf_put_cstring(b, sshkey_ssh_name_plain(key))) != 0 \|\|
364	0	(ret = sshbuf_put_stringb(b, bb)) != 0)
365	0	goto out;
366	0	len = sshbuf_len(b);
367	0	if (sigp != NULL) {
368	0	if ((*sigp = malloc(len)) == NULL) {
369	0	ret = SSH_ERR_ALLOC_FAIL;
370	0	goto out;
371	0	}
372	0	memcpy(*sigp, sshbuf_ptr(b), len);
373	0	}
374	0	if (lenp != NULL)
375	0	*lenp = len;
376	0	ret = 0;
377	0	out:
378	0	freezero(sigb, slen);
379	0	sshbuf_free(b);
380	0	sshbuf_free(bb);
381	0	ECDSA_SIG_free(esig);
382	0	return ret;
383	0	}
384
385		static int
386		ssh_ecdsa_verify(const struct sshkey *key,
387		const u_char *sig, size_t siglen,
388		const u_char data, size_t dlen, const char alg, u_int compat,
389		struct sshkey_sig_details **detailsp)
390	0	{
391	0	ECDSA_SIG *esig = NULL;
392	0	BIGNUM sig_r = NULL, sig_s = NULL;
393	0	int hash_alg, len = 0;
394	0	int ret = SSH_ERR_INTERNAL_ERROR;
395	0	struct sshbuf b = NULL, sigbuf = NULL;
396	0	char *ktype = NULL;
397	0	unsigned char sigb = NULL, cp;
398
399	0	if (key == NULL \|\| key->pkey == NULL \|\|
400	0	sshkey_type_plain(key->type) != KEY_ECDSA \|\|
401	0	sig == NULL \|\| siglen == 0)
402	0	return SSH_ERR_INVALID_ARGUMENT;
403
404	0	if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1)
405	0	return SSH_ERR_INTERNAL_ERROR;
406
407		/* fetch signature */
408	0	if ((b = sshbuf_from(sig, siglen)) == NULL)
409	0	return SSH_ERR_ALLOC_FAIL;
410	0	if (sshbuf_get_cstring(b, &ktype, NULL) != 0 \|\|
411	0	sshbuf_froms(b, &sigbuf) != 0) {
412	0	ret = SSH_ERR_INVALID_FORMAT;
413	0	goto out;
414	0	}
415	0	if (strcmp(sshkey_ssh_name_plain(key), ktype) != 0) {
416	0	ret = SSH_ERR_KEY_TYPE_MISMATCH;
417	0	goto out;
418	0	}
419	0	if (sshbuf_len(b) != 0) {
420	0	ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
421	0	goto out;
422	0	}
423
424		/* parse signature */
425	0	if (sshbuf_get_bignum2(sigbuf, &sig_r) != 0 \|\|
426	0	sshbuf_get_bignum2(sigbuf, &sig_s) != 0) {
427	0	ret = SSH_ERR_INVALID_FORMAT;
428	0	goto out;
429	0	}
430	0	if (sshbuf_len(sigbuf) != 0) {
431	0	ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
432	0	goto out;
433	0	}
434
435	0	if ((esig = ECDSA_SIG_new()) == NULL) {
436	0	ret = SSH_ERR_ALLOC_FAIL;
437	0	goto out;
438	0	}
439	0	if (!ECDSA_SIG_set0(esig, sig_r, sig_s)) {
440	0	ret = SSH_ERR_LIBCRYPTO_ERROR;
441	0	goto out;
442	0	}
443	0	sig_r = sig_s = NULL; /* transferred */
444
445	0	if ((len = i2d_ECDSA_SIG(esig, NULL)) <= 0) {
446	0	len = 0;
447	0	ret = SSH_ERR_LIBCRYPTO_ERROR;
448	0	goto out;
449	0	}
450	0	if ((sigb = calloc(1, len)) == NULL) {
451	0	ret = SSH_ERR_ALLOC_FAIL;
452	0	goto out;
453	0	}
454	0	cp = sigb; /* ASN1_item_i2d increments the pointer past the object */
455	0	if (i2d_ECDSA_SIG(esig, &cp) != len) {
456	0	ret = SSH_ERR_LIBCRYPTO_ERROR;
457	0	goto out;
458	0	}
459	0	if ((ret = sshkey_pkey_digest_verify(key->pkey, hash_alg,
460	0	data, dlen, sigb, len)) != 0)
461	0	goto out;
462		/* success */
463	0	out:
464	0	freezero(sigb, len);
465	0	sshbuf_free(sigbuf);
466	0	sshbuf_free(b);
467	0	ECDSA_SIG_free(esig);
468	0	BN_clear_free(sig_r);
469	0	BN_clear_free(sig_s);
470	0	free(ktype);
471	0	return ret;
472	0	}
473
474		/* NB. not static; used by ECDSA-SK */
475		const struct sshkey_impl_funcs sshkey_ecdsa_funcs = {
476		/* .size = */ ssh_ecdsa_size,
477		/* .alloc = */ NULL,
478		/* .cleanup = */ ssh_ecdsa_cleanup,
479		/* .equal = */ ssh_ecdsa_equal,
480		/* .ssh_serialize_public = */ ssh_ecdsa_serialize_public,
481		/* .ssh_deserialize_public = */ ssh_ecdsa_deserialize_public,
482		/* .ssh_serialize_private = */ ssh_ecdsa_serialize_private,
483		/* .ssh_deserialize_private = */ ssh_ecdsa_deserialize_private,
484		/* .generate = */ ssh_ecdsa_generate,
485		/* .copy_public = */ ssh_ecdsa_copy_public,
486		/* .sign = */ ssh_ecdsa_sign,
487		/* .verify = */ ssh_ecdsa_verify,
488		};
489
490		const struct sshkey_impl sshkey_ecdsa_nistp256_impl = {
491		/* .name = */ "ecdsa-sha2-nistp256",
492		/* .shortname = */ "ECDSA",
493		/* .sigalg = */ NULL,
494		/* .type = */ KEY_ECDSA,
495		/* .nid = */ NID_X9_62_prime256v1,
496		/* .cert = */ 0,
497		/* .sigonly = */ 0,
498		/* .keybits = */ 0,
499		/* .funcs = */ &sshkey_ecdsa_funcs,
500		};
501
502		const struct sshkey_impl sshkey_ecdsa_nistp256_cert_impl = {
503		/* .name = */ "ecdsa-sha2-nistp256-cert-v01@openssh.com",
504		/* .shortname = */ "ECDSA-CERT",
505		/* .sigalg = */ NULL,
506		/* .type = */ KEY_ECDSA_CERT,
507		/* .nid = */ NID_X9_62_prime256v1,
508		/* .cert = */ 1,
509		/* .sigonly = */ 0,
510		/* .keybits = */ 0,
511		/* .funcs = */ &sshkey_ecdsa_funcs,
512		};
513
514		const struct sshkey_impl sshkey_ecdsa_nistp384_impl = {
515		/* .name = */ "ecdsa-sha2-nistp384",
516		/* .shortname = */ "ECDSA",
517		/* .sigalg = */ NULL,
518		/* .type = */ KEY_ECDSA,
519		/* .nid = */ NID_secp384r1,
520		/* .cert = */ 0,
521		/* .sigonly = */ 0,
522		/* .keybits = */ 0,
523		/* .funcs = */ &sshkey_ecdsa_funcs,
524		};
525
526		const struct sshkey_impl sshkey_ecdsa_nistp384_cert_impl = {
527		/* .name = */ "ecdsa-sha2-nistp384-cert-v01@openssh.com",
528		/* .shortname = */ "ECDSA-CERT",
529		/* .sigalg = */ NULL,
530		/* .type = */ KEY_ECDSA_CERT,
531		/* .nid = */ NID_secp384r1,
532		/* .cert = */ 1,
533		/* .sigonly = */ 0,
534		/* .keybits = */ 0,
535		/* .funcs = */ &sshkey_ecdsa_funcs,
536		};
537
538		#ifdef OPENSSL_HAS_NISTP521
539		const struct sshkey_impl sshkey_ecdsa_nistp521_impl = {
540		/* .name = */ "ecdsa-sha2-nistp521",
541		/* .shortname = */ "ECDSA",
542		/* .sigalg = */ NULL,
543		/* .type = */ KEY_ECDSA,
544		/* .nid = */ NID_secp521r1,
545		/* .cert = */ 0,
546		/* .sigonly = */ 0,
547		/* .keybits = */ 0,
548		/* .funcs = */ &sshkey_ecdsa_funcs,
549		};
550
551		const struct sshkey_impl sshkey_ecdsa_nistp521_cert_impl = {
552		/* .name = */ "ecdsa-sha2-nistp521-cert-v01@openssh.com",
553		/* .shortname = */ "ECDSA-CERT",
554		/* .sigalg = */ NULL,
555		/* .type = */ KEY_ECDSA_CERT,
556		/* .nid = */ NID_secp521r1,
557		/* .cert = */ 1,
558		/* .sigonly = */ 0,
559		/* .keybits = */ 0,
560		/* .funcs = */ &sshkey_ecdsa_funcs,
561		};
562		#endif
563
564		#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */