/src/openssh/ssh-ed25519-sk.c

Source
/* $OpenBSD: ssh-ed25519-sk.c,v 1.16 2026/02/14 00:18:34 jsg Exp $ */
/*
 * Copyright (c) 2019 Markus Friedl.  All rights reserved.
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

/* #define DEBUG_SK 1 */

#include "includes.h"

#define SSHKEY_INTERNAL
#include <sys/types.h>

#include "crypto_api.h"

#include <string.h>
#include <stdarg.h>

#include "log.h"
#include "sshbuf.h"
#include "sshkey.h"
#include "ssherr.h"
#include "digest.h"

/* Reuse some ED25519 internals */
extern struct sshkey_impl_funcs sshkey_ed25519_funcs;

static void
ssh_ed25519_sk_cleanup(struct sshkey *k)
{
  sshkey_sk_cleanup(k);
  sshkey_ed25519_funcs.cleanup(k);
}

static int
ssh_ed25519_sk_equal(const struct sshkey *a, const struct sshkey *b)
{
  if (!sshkey_sk_fields_equal(a, b))
    return 0;
  if (!sshkey_ed25519_funcs.equal(a, b))
    return 0;
  return 1;
}

static int
ssh_ed25519_sk_serialize_public(const struct sshkey *key, struct sshbuf *b,
    enum sshkey_serialize_rep opts)
{
  int r;

  if ((r = sshkey_ed25519_funcs.serialize_public(key, b, opts)) != 0)
    return r;
  if ((r = sshkey_serialize_sk(key, b)) != 0)
    return r;

  return 0;
}

static int
ssh_ed25519_sk_serialize_private(const struct sshkey *key, struct sshbuf *b,
    enum sshkey_serialize_rep opts)
{
  int r;

  if ((r = sshkey_ed25519_funcs.serialize_public(key, b, opts)) != 0)
    return r;
  if ((r = sshkey_serialize_private_sk(key, b)) != 0)
    return r;

  return 0;
}

static int
ssh_ed25519_sk_copy_public(const struct sshkey *from, struct sshkey *to)
{
  int r;

  if ((r = sshkey_ed25519_funcs.copy_public(from, to)) != 0)
    return r;
  if ((r = sshkey_copy_public_sk(from, to)) != 0)
    return r;
  return 0;
}

static int
ssh_ed25519_sk_deserialize_public(const char *ktype, struct sshbuf *b,
    struct sshkey *key)
{
  int r;

  if ((r = sshkey_ed25519_funcs.deserialize_public(ktype, b, key)) != 0)
    return r;
  if ((r = sshkey_deserialize_sk(b, key)) != 0)
    return r;
  return 0;
}

static int
ssh_ed25519_sk_deserialize_private(const char *ktype, struct sshbuf *b,
    struct sshkey *key)
{
  int r;

  if ((r = sshkey_ed25519_funcs.deserialize_public(ktype, b, key)) != 0)
    return r;
  if ((r = sshkey_private_deserialize_sk(b, key)) != 0)
    return r;
  return 0;
}

static int
ssh_ed25519_sk_verify(const struct sshkey *key,
    const u_char *sig, size_t siglen,
    const u_char *data, size_t dlen, const char *alg, u_int compat,
    struct sshkey_sig_details **detailsp)
{
  struct sshbuf *b = NULL;
  struct sshbuf *encoded = NULL;
  char *ktype = NULL;
  const u_char *sigblob;
  const u_char *sm;
  u_char *m = NULL;
  u_char apphash[32];
  u_char msghash[32];
  u_char sig_flags;
  u_int sig_counter;
  size_t len;
  unsigned long long smlen = 0, mlen = 0;
  int r = SSH_ERR_INTERNAL_ERROR;
  int ret;
  struct sshkey_sig_details *details = NULL;

  if (detailsp != NULL)
    *detailsp = NULL;

  if (key == NULL ||
      sshkey_type_plain(key->type) != KEY_ED25519_SK ||
      key->ed25519_pk == NULL ||
      sig == NULL || siglen == 0)
    return SSH_ERR_INVALID_ARGUMENT;

  if ((b = sshbuf_from(sig, siglen)) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  if (sshbuf_get_cstring(b, &ktype, NULL) != 0 ||
      sshbuf_get_string_direct(b, &sigblob, &len) != 0 ||
      sshbuf_get_u8(b, &sig_flags) != 0 ||
      sshbuf_get_u32(b, &sig_counter) != 0) {
    r = SSH_ERR_INVALID_FORMAT;
    goto out;
  }
#ifdef DEBUG_SK
  fprintf(stderr, "%s: data:\n", __func__);
  /* sshbuf_dump_data(data, datalen, stderr); */
  fprintf(stderr, "%s: sigblob:\n", __func__);
  sshbuf_dump_data(sigblob, len, stderr);
  fprintf(stderr, "%s: sig_flags = 0x%02x, sig_counter = %u\n",
      __func__, sig_flags, sig_counter);
#endif
  if (strcmp(sshkey_ssh_name_plain(key), ktype) != 0) {
    r = SSH_ERR_KEY_TYPE_MISMATCH;
    goto out;
  }
  if (sshbuf_len(b) != 0) {
    r = SSH_ERR_UNEXPECTED_TRAILING_DATA;
    goto out;
  }
  if (len > crypto_sign_ed25519_BYTES) {
    r = SSH_ERR_INVALID_FORMAT;
    goto out;
  }
  if (ssh_digest_memory(SSH_DIGEST_SHA256, key->sk_application,
      strlen(key->sk_application), apphash, sizeof(apphash)) != 0 ||
      ssh_digest_memory(SSH_DIGEST_SHA256, data, dlen,
      msghash, sizeof(msghash)) != 0) {
    r = SSH_ERR_INVALID_ARGUMENT;
    goto out;
  }
#ifdef DEBUG_SK
  fprintf(stderr, "%s: hashed application:\n", __func__);
  sshbuf_dump_data(apphash, sizeof(apphash), stderr);
  fprintf(stderr, "%s: hashed message:\n", __func__);
  sshbuf_dump_data(msghash, sizeof(msghash), stderr);
#endif
  if ((details = calloc(1, sizeof(*details))) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  details->sk_counter = sig_counter;
  details->sk_flags = sig_flags;
  if ((encoded = sshbuf_new()) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if (sshbuf_put(encoded, sigblob, len) != 0 ||
      sshbuf_put(encoded, apphash, sizeof(apphash)) != 0 ||
      sshbuf_put_u8(encoded, sig_flags) != 0 ||
      sshbuf_put_u32(encoded, sig_counter) != 0 ||
      sshbuf_put(encoded, msghash, sizeof(msghash)) != 0) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
#ifdef DEBUG_SK
  fprintf(stderr, "%s: signed buf:\n", __func__);
  sshbuf_dump(encoded, stderr);
#endif
  sm = sshbuf_ptr(encoded);
  smlen = sshbuf_len(encoded);
  mlen = smlen;
  if ((m = malloc(smlen)) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if ((ret = crypto_sign_ed25519_open(m, &mlen, sm, smlen,
      key->ed25519_pk)) != 0) {
    debug2_f("crypto_sign_ed25519_open failed: %d", ret);
  }
  if (ret != 0 || mlen != smlen - len) {
    r = SSH_ERR_SIGNATURE_INVALID;
    goto out;
  }
  /* XXX compare 'm' and 'sm + len' ? */
  /* success */
  r = 0;
  if (detailsp != NULL) {
    *detailsp = details;
    details = NULL;
  }
 out:
  if (m != NULL)
    freezero(m, smlen); /* NB mlen may be invalid if r != 0 */
  sshkey_sig_details_free(details);
  sshbuf_free(b);
  sshbuf_free(encoded);
  free(ktype);
  return r;
}

static const struct sshkey_impl_funcs sshkey_ed25519_sk_funcs = {
  /* .size = */   NULL,
  /* .alloc = */    NULL,
  /* .cleanup = */  ssh_ed25519_sk_cleanup,
  /* .equal = */    ssh_ed25519_sk_equal,
  /* .ssh_serialize_public = */ ssh_ed25519_sk_serialize_public,
  /* .ssh_deserialize_public = */ ssh_ed25519_sk_deserialize_public,
  /* .ssh_serialize_private = */ ssh_ed25519_sk_serialize_private,
  /* .ssh_deserialize_private = */ ssh_ed25519_sk_deserialize_private,
  /* .generate = */ NULL,
  /* .copy_public = */  ssh_ed25519_sk_copy_public,
  /* .sign = */   NULL,
  /* .verify = */   ssh_ed25519_sk_verify,
};

const struct sshkey_impl sshkey_ed25519_sk_impl = {
  /* .name = */   "sk-ssh-ed25519@openssh.com",
  /* .shortname = */  "ED25519-SK",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_ED25519_SK,
  /* .nid = */    0,
  /* .cert = */   0,
  /* .sigonly = */  0,
  /* .keybits = */  256,
  /* .funcs = */    &sshkey_ed25519_sk_funcs,
};

const struct sshkey_impl sshkey_ed25519_sk_cert_impl = {
  /* .name = */   "sk-ssh-ed25519-cert-v01@openssh.com",
  /* .shortname = */  "ED25519-SK-CERT",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_ED25519_SK_CERT,
  /* .nid = */    0,
  /* .cert = */   1,
  /* .sigonly = */  0,
  /* .keybits = */  256,
  /* .funcs = */    &sshkey_ed25519_sk_funcs,
};

Coverage Report

Created: 2026-02-26 06:46

Line	Count	Source
1		/* $OpenBSD: ssh-ed25519-sk.c,v 1.16 2026/02/14 00:18:34 jsg Exp $ */
2		/*
3		* Copyright (c) 2019 Markus Friedl. All rights reserved.
4		*
5		* Permission to use, copy, modify, and distribute this software for any
6		* purpose with or without fee is hereby granted, provided that the above
7		* copyright notice and this permission notice appear in all copies.
8		*
9		* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10		* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11		* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12		* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13		* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14		* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15		* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16		*/
17
18		/* #define DEBUG_SK 1 */
19
20		#include "includes.h"
21
22		#define SSHKEY_INTERNAL
23		#include <sys/types.h>
24
25		#include "crypto_api.h"
26
27		#include <string.h>
28		#include <stdarg.h>
29
30		#include "log.h"
31		#include "sshbuf.h"
32		#include "sshkey.h"
33		#include "ssherr.h"
34		#include "digest.h"
35
36		/* Reuse some ED25519 internals */
37		extern struct sshkey_impl_funcs sshkey_ed25519_funcs;
38
39		static void
40		ssh_ed25519_sk_cleanup(struct sshkey *k)
41	0	{
42	0	sshkey_sk_cleanup(k);
43	0	sshkey_ed25519_funcs.cleanup(k);
44	0	}
45
46		static int
47		ssh_ed25519_sk_equal(const struct sshkey a, const struct sshkey b)
48	0	{
49	0	if (!sshkey_sk_fields_equal(a, b))
50	0	return 0;
51	0	if (!sshkey_ed25519_funcs.equal(a, b))
52	0	return 0;
53	0	return 1;
54	0	}
55
56		static int
57		ssh_ed25519_sk_serialize_public(const struct sshkey key, struct sshbuf b,
58		enum sshkey_serialize_rep opts)
59	0	{
60	0	int r;
61
62	0	if ((r = sshkey_ed25519_funcs.serialize_public(key, b, opts)) != 0)
63	0	return r;
64	0	if ((r = sshkey_serialize_sk(key, b)) != 0)
65	0	return r;
66
67	0	return 0;
68	0	}
69
70		static int
71		ssh_ed25519_sk_serialize_private(const struct sshkey key, struct sshbuf b,
72		enum sshkey_serialize_rep opts)
73	0	{
74	0	int r;
75
76	0	if ((r = sshkey_ed25519_funcs.serialize_public(key, b, opts)) != 0)
77	0	return r;
78	0	if ((r = sshkey_serialize_private_sk(key, b)) != 0)
79	0	return r;
80
81	0	return 0;
82	0	}
83
84		static int
85		ssh_ed25519_sk_copy_public(const struct sshkey from, struct sshkey to)
86	0	{
87	0	int r;
88
89	0	if ((r = sshkey_ed25519_funcs.copy_public(from, to)) != 0)
90	0	return r;
91	0	if ((r = sshkey_copy_public_sk(from, to)) != 0)
92	0	return r;
93	0	return 0;
94	0	}
95
96		static int
97		ssh_ed25519_sk_deserialize_public(const char ktype, struct sshbuf b,
98		struct sshkey *key)
99	0	{
100	0	int r;
101
102	0	if ((r = sshkey_ed25519_funcs.deserialize_public(ktype, b, key)) != 0)
103	0	return r;
104	0	if ((r = sshkey_deserialize_sk(b, key)) != 0)
105	0	return r;
106	0	return 0;
107	0	}
108
109		static int
110		ssh_ed25519_sk_deserialize_private(const char ktype, struct sshbuf b,
111		struct sshkey *key)
112	0	{
113	0	int r;
114
115	0	if ((r = sshkey_ed25519_funcs.deserialize_public(ktype, b, key)) != 0)
116	0	return r;
117	0	if ((r = sshkey_private_deserialize_sk(b, key)) != 0)
118	0	return r;
119	0	return 0;
120	0	}
121
122		static int
123		ssh_ed25519_sk_verify(const struct sshkey *key,
124		const u_char *sig, size_t siglen,
125		const u_char data, size_t dlen, const char alg, u_int compat,
126		struct sshkey_sig_details **detailsp)
127	0	{
128	0	struct sshbuf *b = NULL;
129	0	struct sshbuf *encoded = NULL;
130	0	char *ktype = NULL;
131	0	const u_char *sigblob;
132	0	const u_char *sm;
133	0	u_char *m = NULL;
134	0	u_char apphash[32];
135	0	u_char msghash[32];
136	0	u_char sig_flags;
137	0	u_int sig_counter;
138	0	size_t len;
139	0	unsigned long long smlen = 0, mlen = 0;
140	0	int r = SSH_ERR_INTERNAL_ERROR;
141	0	int ret;
142	0	struct sshkey_sig_details *details = NULL;
143
144	0	if (detailsp != NULL)
145	0	*detailsp = NULL;
146
147	0	if (key == NULL \|\|
148	0	sshkey_type_plain(key->type) != KEY_ED25519_SK \|\|
149	0	key->ed25519_pk == NULL \|\|
150	0	sig == NULL \|\| siglen == 0)
151	0	return SSH_ERR_INVALID_ARGUMENT;
152
153	0	if ((b = sshbuf_from(sig, siglen)) == NULL)
154	0	return SSH_ERR_ALLOC_FAIL;
155	0	if (sshbuf_get_cstring(b, &ktype, NULL) != 0 \|\|
156	0	sshbuf_get_string_direct(b, &sigblob, &len) != 0 \|\|
157	0	sshbuf_get_u8(b, &sig_flags) != 0 \|\|
158	0	sshbuf_get_u32(b, &sig_counter) != 0) {
159	0	r = SSH_ERR_INVALID_FORMAT;
160	0	goto out;
161	0	}
162		#ifdef DEBUG_SK
163		fprintf(stderr, "%s: data:\n", __func__);
164		/* sshbuf_dump_data(data, datalen, stderr); */
165		fprintf(stderr, "%s: sigblob:\n", __func__);
166		sshbuf_dump_data(sigblob, len, stderr);
167		fprintf(stderr, "%s: sig_flags = 0x%02x, sig_counter = %u\n",
168		__func__, sig_flags, sig_counter);
169		#endif
170	0	if (strcmp(sshkey_ssh_name_plain(key), ktype) != 0) {
171	0	r = SSH_ERR_KEY_TYPE_MISMATCH;
172	0	goto out;
173	0	}
174	0	if (sshbuf_len(b) != 0) {
175	0	r = SSH_ERR_UNEXPECTED_TRAILING_DATA;
176	0	goto out;
177	0	}
178	0	if (len > crypto_sign_ed25519_BYTES) {
179	0	r = SSH_ERR_INVALID_FORMAT;
180	0	goto out;
181	0	}
182	0	if (ssh_digest_memory(SSH_DIGEST_SHA256, key->sk_application,
183	0	strlen(key->sk_application), apphash, sizeof(apphash)) != 0 \|\|
184	0	ssh_digest_memory(SSH_DIGEST_SHA256, data, dlen,
185	0	msghash, sizeof(msghash)) != 0) {
186	0	r = SSH_ERR_INVALID_ARGUMENT;
187	0	goto out;
188	0	}
189		#ifdef DEBUG_SK
190		fprintf(stderr, "%s: hashed application:\n", __func__);
191		sshbuf_dump_data(apphash, sizeof(apphash), stderr);
192		fprintf(stderr, "%s: hashed message:\n", __func__);
193		sshbuf_dump_data(msghash, sizeof(msghash), stderr);
194		#endif
195	0	if ((details = calloc(1, sizeof(*details))) == NULL) {
196	0	r = SSH_ERR_ALLOC_FAIL;
197	0	goto out;
198	0	}
199	0	details->sk_counter = sig_counter;
200	0	details->sk_flags = sig_flags;
201	0	if ((encoded = sshbuf_new()) == NULL) {
202	0	r = SSH_ERR_ALLOC_FAIL;
203	0	goto out;
204	0	}
205	0	if (sshbuf_put(encoded, sigblob, len) != 0 \|\|
206	0	sshbuf_put(encoded, apphash, sizeof(apphash)) != 0 \|\|
207	0	sshbuf_put_u8(encoded, sig_flags) != 0 \|\|
208	0	sshbuf_put_u32(encoded, sig_counter) != 0 \|\|
209	0	sshbuf_put(encoded, msghash, sizeof(msghash)) != 0) {
210	0	r = SSH_ERR_ALLOC_FAIL;
211	0	goto out;
212	0	}
213		#ifdef DEBUG_SK
214		fprintf(stderr, "%s: signed buf:\n", __func__);
215		sshbuf_dump(encoded, stderr);
216		#endif
217	0	sm = sshbuf_ptr(encoded);
218	0	smlen = sshbuf_len(encoded);
219	0	mlen = smlen;
220	0	if ((m = malloc(smlen)) == NULL) {
221	0	r = SSH_ERR_ALLOC_FAIL;
222	0	goto out;
223	0	}
224	0	if ((ret = crypto_sign_ed25519_open(m, &mlen, sm, smlen,
225	0	key->ed25519_pk)) != 0) {
226	0	debug2_f("crypto_sign_ed25519_open failed: %d", ret);
227	0	}
228	0	if (ret != 0 \|\| mlen != smlen - len) {
229	0	r = SSH_ERR_SIGNATURE_INVALID;
230	0	goto out;
231	0	}
232		/* XXX compare 'm' and 'sm + len' ? */
233		/* success */
234	0	r = 0;
235	0	if (detailsp != NULL) {
236	0	*detailsp = details;
237	0	details = NULL;
238	0	}
239	0	out:
240	0	if (m != NULL)
241	0	freezero(m, smlen); /* NB mlen may be invalid if r != 0 */
242	0	sshkey_sig_details_free(details);
243	0	sshbuf_free(b);
244	0	sshbuf_free(encoded);
245	0	free(ktype);
246	0	return r;
247	0	}
248
249		static const struct sshkey_impl_funcs sshkey_ed25519_sk_funcs = {
250		/* .size = */ NULL,
251		/* .alloc = */ NULL,
252		/* .cleanup = */ ssh_ed25519_sk_cleanup,
253		/* .equal = */ ssh_ed25519_sk_equal,
254		/* .ssh_serialize_public = */ ssh_ed25519_sk_serialize_public,
255		/* .ssh_deserialize_public = */ ssh_ed25519_sk_deserialize_public,
256		/* .ssh_serialize_private = */ ssh_ed25519_sk_serialize_private,
257		/* .ssh_deserialize_private = */ ssh_ed25519_sk_deserialize_private,
258		/* .generate = */ NULL,
259		/* .copy_public = */ ssh_ed25519_sk_copy_public,
260		/* .sign = */ NULL,
261		/* .verify = */ ssh_ed25519_sk_verify,
262		};
263
264		const struct sshkey_impl sshkey_ed25519_sk_impl = {
265		/* .name = */ "sk-ssh-ed25519@openssh.com",
266		/* .shortname = */ "ED25519-SK",
267		/* .sigalg = */ NULL,
268		/* .type = */ KEY_ED25519_SK,
269		/* .nid = */ 0,
270		/* .cert = */ 0,
271		/* .sigonly = */ 0,
272		/* .keybits = */ 256,
273		/* .funcs = */ &sshkey_ed25519_sk_funcs,
274		};
275
276		const struct sshkey_impl sshkey_ed25519_sk_cert_impl = {
277		/* .name = */ "sk-ssh-ed25519-cert-v01@openssh.com",
278		/* .shortname = */ "ED25519-SK-CERT",
279		/* .sigalg = */ NULL,
280		/* .type = */ KEY_ED25519_SK_CERT,
281		/* .nid = */ 0,
282		/* .cert = */ 1,
283		/* .sigonly = */ 0,
284		/* .keybits = */ 256,
285		/* .funcs = */ &sshkey_ed25519_sk_funcs,
286		};