/src/openssh/ssh-rsa.c

Source
/* $OpenBSD: ssh-rsa.c,v 1.84 2026/02/14 00:18:34 jsg Exp $ */
/*
 * Copyright (c) 2000, 2003 Markus Friedl <markus@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include "includes.h"

#ifdef WITH_OPENSSL
#include "openbsd-compat/openssl-compat.h"

#include <sys/types.h>

#include <openssl/bn.h>
#include <openssl/evp.h>

#include <stdarg.h>
#include <string.h>

#include "sshbuf.h"
#include "ssherr.h"
#define SSHKEY_INTERNAL
#include "sshkey.h"
#include "digest.h"

static u_int
ssh_rsa_size(const struct sshkey *k)
{
  if (k->pkey == NULL)
    return 0;
  return EVP_PKEY_bits(k->pkey);
}

static int
ssh_rsa_alloc(struct sshkey *k)
{
  if ((k->pkey = EVP_PKEY_new()) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  return 0;
}

static void
ssh_rsa_cleanup(struct sshkey *k)
{
  EVP_PKEY_free(k->pkey);
  k->pkey = NULL;
}

static int
ssh_rsa_equal(const struct sshkey *a, const struct sshkey *b)
{
  if (a->pkey == NULL || b->pkey == NULL)
    return 0;
  return EVP_PKEY_cmp(a->pkey, b->pkey) == 1;
}

static int
ssh_rsa_serialize_public(const struct sshkey *key, struct sshbuf *b,
    enum sshkey_serialize_rep opts)
{
  int r;
  const BIGNUM *rsa_n, *rsa_e;
  const RSA *rsa;

  if (key->pkey == NULL)
    return SSH_ERR_INVALID_ARGUMENT;
  if ((rsa = EVP_PKEY_get0_RSA(key->pkey)) == NULL)
    return SSH_ERR_LIBCRYPTO_ERROR;

  RSA_get0_key(rsa, &rsa_n, &rsa_e, NULL);
  if ((r = sshbuf_put_bignum2(b, rsa_e)) != 0 ||
      (r = sshbuf_put_bignum2(b, rsa_n)) != 0)
    return r;

  return 0;
}

static int
ssh_rsa_serialize_private(const struct sshkey *key, struct sshbuf *b,
    enum sshkey_serialize_rep opts)
{
  int r;
  const BIGNUM *rsa_n, *rsa_e, *rsa_d, *rsa_iqmp, *rsa_p, *rsa_q;
  const RSA *rsa;

  if ((rsa = EVP_PKEY_get0_RSA(key->pkey)) == NULL)
    return SSH_ERR_LIBCRYPTO_ERROR;
  RSA_get0_key(rsa, &rsa_n, &rsa_e, &rsa_d);
  RSA_get0_factors(rsa, &rsa_p, &rsa_q);
  RSA_get0_crt_params(rsa, NULL, NULL, &rsa_iqmp);

  if (!sshkey_is_cert(key)) {
    /* Note: can't reuse ssh_rsa_serialize_public: e, n vs. n, e */
    if ((r = sshbuf_put_bignum2(b, rsa_n)) != 0 ||
        (r = sshbuf_put_bignum2(b, rsa_e)) != 0)
      return r;
  }
  if ((r = sshbuf_put_bignum2(b, rsa_d)) != 0 ||
      (r = sshbuf_put_bignum2(b, rsa_iqmp)) != 0 ||
      (r = sshbuf_put_bignum2(b, rsa_p)) != 0 ||
      (r = sshbuf_put_bignum2(b, rsa_q)) != 0)
    return r;

  return 0;
}

static int
ssh_rsa_generate(struct sshkey *k, int bits)
{
  EVP_PKEY_CTX *ctx = NULL;
  EVP_PKEY *res = NULL;

  int ret = SSH_ERR_INTERNAL_ERROR;

  if (bits < SSH_RSA_MINIMUM_MODULUS_SIZE ||
      bits > SSHBUF_MAX_BIGNUM * 8)
    return SSH_ERR_KEY_LENGTH;

  if ((ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL)) == NULL) {
    ret = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if (EVP_PKEY_keygen_init(ctx) <= 0) {
    ret = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, bits) <= 0) {
    ret = SSH_ERR_KEY_LENGTH;
    goto out;
  }
  if (EVP_PKEY_keygen(ctx, &res) <= 0 || res == NULL) {
    ret = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  /* success */
  k->pkey = res;
  ret = 0;
 out:
  EVP_PKEY_CTX_free(ctx);
  return ret;
}

static int
ssh_rsa_copy_public(const struct sshkey *from, struct sshkey *to)
{
  const BIGNUM *rsa_n, *rsa_e;
  BIGNUM *rsa_n_dup = NULL, *rsa_e_dup = NULL;
  int r = SSH_ERR_INTERNAL_ERROR;
  const RSA *rsa_from;
  RSA *rsa_to = NULL;

  if ((rsa_from = EVP_PKEY_get0_RSA(from->pkey)) == NULL ||
      (rsa_to = RSA_new()) == NULL)
    return SSH_ERR_LIBCRYPTO_ERROR;

  RSA_get0_key(rsa_from, &rsa_n, &rsa_e, NULL);
  if ((rsa_n_dup = BN_dup(rsa_n)) == NULL ||
      (rsa_e_dup = BN_dup(rsa_e)) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if (!RSA_set0_key(rsa_to, rsa_n_dup, rsa_e_dup, NULL)) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  rsa_n_dup = rsa_e_dup = NULL; /* transferred */

  if (EVP_PKEY_set1_RSA(to->pkey, rsa_to) != 1) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  /* success */
  r = 0;
 out:
  RSA_free(rsa_to);
  BN_clear_free(rsa_n_dup);
  BN_clear_free(rsa_e_dup);
  return r;
}

static int
ssh_rsa_deserialize_public(const char *ktype, struct sshbuf *b,
    struct sshkey *key)
{
  int ret = SSH_ERR_INTERNAL_ERROR;
  BIGNUM *rsa_n = NULL, *rsa_e = NULL;
  RSA *rsa = NULL;

  if ((rsa = RSA_new()) == NULL)
    return SSH_ERR_LIBCRYPTO_ERROR;

  if (sshbuf_get_bignum2(b, &rsa_e) != 0 ||
      sshbuf_get_bignum2(b, &rsa_n) != 0) {
    ret = SSH_ERR_INVALID_FORMAT;
    goto out;
  }
  if (!RSA_set0_key(rsa, rsa_n, rsa_e, NULL)) {
    ret = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  rsa_n = rsa_e = NULL; /* transferred */
  if (EVP_PKEY_set1_RSA(key->pkey, rsa) != 1) {
    ret = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  if ((ret = sshkey_check_rsa_length(key, 0)) != 0)
    goto out;
#ifdef DEBUG_PK
  RSA_print_fp(stderr, rsa, 8);
#endif
  /* success */
  ret = 0;
 out:
  RSA_free(rsa);
  BN_clear_free(rsa_n);
  BN_clear_free(rsa_e);
  return ret;
}

static int
ssh_rsa_deserialize_private(const char *ktype, struct sshbuf *b,
    struct sshkey *key)
{
  int r;
  BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL;
  BIGNUM *rsa_iqmp = NULL, *rsa_p = NULL, *rsa_q = NULL;
  BIGNUM *rsa_dmp1 = NULL, *rsa_dmq1 = NULL;
  RSA *rsa = NULL;

  if (sshkey_is_cert(key)) {
    /* sshkey_private_deserialize already has pubkey from cert */
    if ((rsa = EVP_PKEY_get1_RSA(key->pkey)) == NULL) {
      r = SSH_ERR_LIBCRYPTO_ERROR;
      goto out;
    }
  } else {
    if ((rsa = RSA_new()) == NULL) {
      r = SSH_ERR_LIBCRYPTO_ERROR;
      goto out;
    }
    /* Note: can't reuse ssh_rsa_deserialize_public: e,n vs. n,e */
    if ((r = sshbuf_get_bignum2(b, &rsa_n)) != 0 ||
        (r = sshbuf_get_bignum2(b, &rsa_e)) != 0)
      goto out;
    if (!RSA_set0_key(rsa, rsa_n, rsa_e, NULL)) {
      r = SSH_ERR_LIBCRYPTO_ERROR;
      goto out;
    }
    rsa_n = rsa_e = NULL; /* transferred */
  }
  if ((r = sshbuf_get_bignum2(b, &rsa_d)) != 0 ||
      (r = sshbuf_get_bignum2(b, &rsa_iqmp)) != 0 ||
      (r = sshbuf_get_bignum2(b, &rsa_p)) != 0 ||
      (r = sshbuf_get_bignum2(b, &rsa_q)) != 0)
    goto out;
  if ((r = ssh_rsa_complete_crt_parameters(rsa_d, rsa_p, rsa_q,
      rsa_iqmp, &rsa_dmp1, &rsa_dmq1)) != 0)
    goto out;
  if (!RSA_set0_key(rsa, NULL, NULL, rsa_d)) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  rsa_d = NULL; /* transferred */
  if (!RSA_set0_factors(rsa, rsa_p, rsa_q)) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  rsa_p = rsa_q = NULL; /* transferred */
  if (!RSA_set0_crt_params(rsa, rsa_dmp1, rsa_dmq1, rsa_iqmp)) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  rsa_dmp1 = rsa_dmq1 = rsa_iqmp = NULL;
  if (RSA_blinding_on(rsa, NULL) != 1) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  if (EVP_PKEY_set1_RSA(key->pkey, rsa) != 1) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  if ((r = sshkey_check_rsa_length(key, 0)) != 0)
    goto out;
  /* success */
  r = 0;
 out:
  RSA_free(rsa);
  BN_clear_free(rsa_n);
  BN_clear_free(rsa_e);
  BN_clear_free(rsa_d);
  BN_clear_free(rsa_p);
  BN_clear_free(rsa_q);
  BN_clear_free(rsa_iqmp);
  BN_clear_free(rsa_dmp1);
  BN_clear_free(rsa_dmq1);
  return r;
}

const char *
ssh_rsa_hash_alg_ident(int hash_alg)
{
  switch (hash_alg) {
  case SSH_DIGEST_SHA1:
    return "ssh-rsa";
  case SSH_DIGEST_SHA256:
    return "rsa-sha2-256";
  case SSH_DIGEST_SHA512:
    return "rsa-sha2-512";
  }
  return NULL;
}

/*
 * Returns the hash algorithm ID for a given algorithm identifier as used
 * inside the signature blob,
 */
static int
rsa_hash_id_from_ident(const char *ident)
{
  if (strcmp(ident, "ssh-rsa") == 0)
    return SSH_DIGEST_SHA1;
  if (strcmp(ident, "rsa-sha2-256") == 0)
    return SSH_DIGEST_SHA256;
  if (strcmp(ident, "rsa-sha2-512") == 0)
    return SSH_DIGEST_SHA512;
  return -1;
}

/*
 * Return the hash algorithm ID for the specified key name. This includes
 * all the cases of rsa_hash_id_from_ident() but also the certificate key
 * types.
 */
int
ssh_rsa_hash_id_from_keyname(const char *alg)
{
  int r;

  if ((r = rsa_hash_id_from_ident(alg)) != -1)
    return r;
  if (strcmp(alg, "ssh-rsa-cert-v01@openssh.com") == 0)
    return SSH_DIGEST_SHA1;
  if (strcmp(alg, "rsa-sha2-256-cert-v01@openssh.com") == 0)
    return SSH_DIGEST_SHA256;
  if (strcmp(alg, "rsa-sha2-512-cert-v01@openssh.com") == 0)
    return SSH_DIGEST_SHA512;
  return -1;
}

int
ssh_rsa_complete_crt_parameters(const BIGNUM *rsa_d, const BIGNUM *rsa_p,
    const BIGNUM *rsa_q, const BIGNUM *rsa_iqmp, BIGNUM **rsa_dmp1,
    BIGNUM **rsa_dmq1)
{
  BIGNUM *aux = NULL, *d_consttime = NULL;
  BN_CTX *ctx = NULL;
  int r;

  *rsa_dmq1 = *rsa_dmp1 = NULL;
  if ((ctx = BN_CTX_new()) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  if ((aux = BN_new()) == NULL ||
      (*rsa_dmq1 = BN_new()) == NULL ||
      (*rsa_dmp1 = BN_new()) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  if ((d_consttime = BN_dup(rsa_d)) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  BN_set_flags(aux, BN_FLG_CONSTTIME);
  BN_set_flags(d_consttime, BN_FLG_CONSTTIME);

  if ((BN_sub(aux, rsa_q, BN_value_one()) == 0) ||
      (BN_mod(*rsa_dmq1, d_consttime, aux, ctx) == 0) ||
      (BN_sub(aux, rsa_p, BN_value_one()) == 0) ||
      (BN_mod(*rsa_dmp1, d_consttime, aux, ctx) == 0)) {
    r = SSH_ERR_LIBCRYPTO_ERROR;
    goto out;
  }
  /* success */
  r = 0;
 out:
  BN_clear_free(aux);
  BN_clear_free(d_consttime);
  BN_CTX_free(ctx);
  return r;
}

/* RSASSA-PKCS1-v1_5 (PKCS #1 v2.0 signature) with SHA1 */
static int
ssh_rsa_sign(struct sshkey *key,
    u_char **sigp, size_t *lenp,
    const u_char *data, size_t datalen,
    const char *alg, const char *sk_provider, const char *sk_pin, u_int compat)
{
  u_char *sig = NULL;
  size_t diff, len = 0;
  int slen = 0;
  int hash_alg, ret = SSH_ERR_INTERNAL_ERROR;

  if (lenp != NULL)
    *lenp = 0;
  if (sigp != NULL)
    *sigp = NULL;

  if (alg == NULL || strlen(alg) == 0)
    hash_alg = SSH_DIGEST_SHA1;
  else
    hash_alg = ssh_rsa_hash_id_from_keyname(alg);

  if (key == NULL || key->pkey == NULL || hash_alg == -1 ||
      sshkey_type_plain(key->type) != KEY_RSA)
    return SSH_ERR_INVALID_ARGUMENT;
  slen = EVP_PKEY_size(key->pkey);
  if (slen <= 0 || slen > SSHBUF_MAX_BIGNUM)
    return SSH_ERR_INVALID_ARGUMENT;
  if (EVP_PKEY_bits(key->pkey) < SSH_RSA_MINIMUM_MODULUS_SIZE)
    return SSH_ERR_KEY_LENGTH;

  if ((ret = sshkey_pkey_digest_sign(key->pkey, hash_alg, &sig, &len,
      data, datalen)) < 0)
    goto out;
  if (len < (size_t)slen) {
    diff = slen - len;
    memmove(sig + diff, sig, len);
    explicit_bzero(sig, diff);
  } else if (len > (size_t)slen) {
    ret = SSH_ERR_INTERNAL_ERROR;
    goto out;
  }
  if ((ret = ssh_rsa_encode_store_sig(hash_alg, sig, slen,
      sigp, lenp)) != 0)
    goto out;

  /* success */
  ret = 0;
 out:
  freezero(sig, slen);
  return ret;
}

int
ssh_rsa_encode_store_sig(int hash_alg, const u_char *sig, size_t slen,
    u_char **sigp, size_t *lenp)
{
  struct sshbuf *b = NULL;
  int ret = SSH_ERR_INTERNAL_ERROR;
  size_t len;

  if (lenp != NULL)
    *lenp = 0;
  if (sigp != NULL)
    *sigp = NULL;

  /* Encode signature */
  if ((b = sshbuf_new()) == NULL) {
    ret = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if ((ret = sshbuf_put_cstring(b,
      ssh_rsa_hash_alg_ident(hash_alg))) != 0 ||
      (ret = sshbuf_put_string(b, sig, slen)) != 0)
    goto out;
  len = sshbuf_len(b);

  /* Store signature */
  if (sigp != NULL) {
    if ((*sigp = malloc(len)) == NULL) {
      ret = SSH_ERR_ALLOC_FAIL;
      goto out;
    }
    memcpy(*sigp, sshbuf_ptr(b), len);
  }
  if (lenp != NULL)
    *lenp = len;
  ret = 0;
 out:
  sshbuf_free(b);
  return ret;
}

static int
ssh_rsa_verify(const struct sshkey *key,
    const u_char *sig, size_t siglen,
    const u_char *data, size_t dlen, const char *alg, u_int compat,
    struct sshkey_sig_details **detailsp)
{
  char *sigtype = NULL;
  int hash_alg, want_alg, ret = SSH_ERR_INTERNAL_ERROR;
  size_t len = 0, diff, modlen, rsasize;
  struct sshbuf *b = NULL;
  u_char digest[SSH_DIGEST_MAX_LENGTH], *osigblob, *sigblob = NULL;

  if (key == NULL || key->pkey == NULL ||
      sshkey_type_plain(key->type) != KEY_RSA ||
      sig == NULL || siglen == 0)
    return SSH_ERR_INVALID_ARGUMENT;
  if (EVP_PKEY_bits(key->pkey) < SSH_RSA_MINIMUM_MODULUS_SIZE)
    return SSH_ERR_KEY_LENGTH;

  if ((b = sshbuf_from(sig, siglen)) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  if (sshbuf_get_cstring(b, &sigtype, NULL) != 0) {
    ret = SSH_ERR_INVALID_FORMAT;
    goto out;
  }
  if ((hash_alg = rsa_hash_id_from_ident(sigtype)) == -1) {
    ret = SSH_ERR_KEY_TYPE_MISMATCH;
    goto out;
  }
  /*
   * Allow ssh-rsa-cert-v01 certs to generate SHA2 signatures for
   * legacy reasons, but otherwise the signature type should match.
   */
  if (alg != NULL && strcmp(alg, "ssh-rsa-cert-v01@openssh.com") != 0) {
    if ((want_alg = ssh_rsa_hash_id_from_keyname(alg)) == -1) {
      ret = SSH_ERR_INVALID_ARGUMENT;
      goto out;
    }
    if (hash_alg != want_alg) {
      ret = SSH_ERR_SIGNATURE_INVALID;
      goto out;
    }
  }
  if (sshbuf_get_string(b, &sigblob, &len) != 0) {
    ret = SSH_ERR_INVALID_FORMAT;
    goto out;
  }
  if (sshbuf_len(b) != 0) {
    ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
    goto out;
  }
  /* RSA_verify expects a signature of RSA_size */
  modlen = EVP_PKEY_size(key->pkey);
  if (len > modlen) {
    ret = SSH_ERR_KEY_BITS_MISMATCH;
    goto out;
  } else if (len < modlen) {
    diff = modlen - len;
    osigblob = sigblob;
    if ((sigblob = realloc(sigblob, modlen)) == NULL) {
      sigblob = osigblob; /* put it back for clear/free */
      ret = SSH_ERR_ALLOC_FAIL;
      goto out;
    }
    memmove(sigblob + diff, sigblob, len);
    explicit_bzero(sigblob, diff);
    len = modlen;
  }

  rsasize = EVP_PKEY_size(key->pkey);
  if (rsasize <= 0 || rsasize > SSHBUF_MAX_BIGNUM ||
      len == 0 || len > rsasize) {
    ret = SSH_ERR_INVALID_ARGUMENT;
    goto out;
  }
  ret = sshkey_pkey_digest_verify(key->pkey, hash_alg, data, dlen,
      sigblob, len);

 out:
  freezero(sigblob, len);
  free(sigtype);
  sshbuf_free(b);
  explicit_bzero(digest, sizeof(digest));
  return ret;
}

static const struct sshkey_impl_funcs sshkey_rsa_funcs = {
  /* .size = */   ssh_rsa_size,
  /* .alloc = */    ssh_rsa_alloc,
  /* .cleanup = */  ssh_rsa_cleanup,
  /* .equal = */    ssh_rsa_equal,
  /* .ssh_serialize_public = */ ssh_rsa_serialize_public,
  /* .ssh_deserialize_public = */ ssh_rsa_deserialize_public,
  /* .ssh_serialize_private = */ ssh_rsa_serialize_private,
  /* .ssh_deserialize_private = */ ssh_rsa_deserialize_private,
  /* .generate = */ ssh_rsa_generate,
  /* .copy_public = */  ssh_rsa_copy_public,
  /* .sign = */   ssh_rsa_sign,
  /* .verify = */   ssh_rsa_verify,
};

const struct sshkey_impl sshkey_rsa_impl = {
  /* .name = */   "ssh-rsa",
  /* .shortname = */  "RSA",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_RSA,
  /* .nid = */    0,
  /* .cert = */   0,
  /* .sigonly = */  0,
  /* .keybits = */  0,
  /* .funcs = */    &sshkey_rsa_funcs,
};

const struct sshkey_impl sshkey_rsa_cert_impl = {
  /* .name = */   "ssh-rsa-cert-v01@openssh.com",
  /* .shortname = */  "RSA-CERT",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_RSA_CERT,
  /* .nid = */    0,
  /* .cert = */   1,
  /* .sigonly = */  0,
  /* .keybits = */  0,
  /* .funcs = */    &sshkey_rsa_funcs,
};

/* SHA2 signature algorithms */

const struct sshkey_impl sshkey_rsa_sha256_impl = {
  /* .name = */   "rsa-sha2-256",
  /* .shortname = */  "RSA",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_RSA,
  /* .nid = */    0,
  /* .cert = */   0,
  /* .sigonly = */  1,
  /* .keybits = */  0,
  /* .funcs = */    &sshkey_rsa_funcs,
};

const struct sshkey_impl sshkey_rsa_sha512_impl = {
  /* .name = */   "rsa-sha2-512",
  /* .shortname = */  "RSA",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_RSA,
  /* .nid = */    0,
  /* .cert = */   0,
  /* .sigonly = */  1,
  /* .keybits = */  0,
  /* .funcs = */    &sshkey_rsa_funcs,
};

const struct sshkey_impl sshkey_rsa_sha256_cert_impl = {
  /* .name = */   "rsa-sha2-256-cert-v01@openssh.com",
  /* .shortname = */  "RSA-CERT",
  /* .sigalg = */   "rsa-sha2-256",
  /* .type = */   KEY_RSA_CERT,
  /* .nid = */    0,
  /* .cert = */   1,
  /* .sigonly = */  1,
  /* .keybits = */  0,
  /* .funcs = */    &sshkey_rsa_funcs,
};

const struct sshkey_impl sshkey_rsa_sha512_cert_impl = {
  /* .name = */   "rsa-sha2-512-cert-v01@openssh.com",
  /* .shortname = */  "RSA-CERT",
  /* .sigalg = */   "rsa-sha2-512",
  /* .type = */   KEY_RSA_CERT,
  /* .nid = */    0,
  /* .cert = */   1,
  /* .sigonly = */  1,
  /* .keybits = */  0,
  /* .funcs = */    &sshkey_rsa_funcs,
};
#endif /* WITH_OPENSSL */

Coverage Report

Created: 2026-03-09 06:40

Line	Count	Source
1		/* $OpenBSD: ssh-rsa.c,v 1.84 2026/02/14 00:18:34 jsg Exp $ */
2		/*
3		* Copyright (c) 2000, 2003 Markus Friedl <markus@openbsd.org>
4		*
5		* Permission to use, copy, modify, and distribute this software for any
6		* purpose with or without fee is hereby granted, provided that the above
7		* copyright notice and this permission notice appear in all copies.
8		*
9		* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10		* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11		* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12		* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13		* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14		* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15		* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16		*/
17
18		#include "includes.h"
19
20		#ifdef WITH_OPENSSL
21		#include "openbsd-compat/openssl-compat.h"
22
23		#include <sys/types.h>
24
25		#include <openssl/bn.h>
26		#include <openssl/evp.h>
27
28		#include <stdarg.h>
29		#include <string.h>
30
31		#include "sshbuf.h"
32		#include "ssherr.h"
33		#define SSHKEY_INTERNAL
34		#include "sshkey.h"
35		#include "digest.h"
36
37		static u_int
38		ssh_rsa_size(const struct sshkey *k)
39	0	{
40	0	if (k->pkey == NULL)
41	0	return 0;
42	0	return EVP_PKEY_bits(k->pkey);
43	0	}
44
45		static int
46		ssh_rsa_alloc(struct sshkey *k)
47	0	{
48	0	if ((k->pkey = EVP_PKEY_new()) == NULL)
49	0	return SSH_ERR_ALLOC_FAIL;
50	0	return 0;
51	0	}
52
53		static void
54		ssh_rsa_cleanup(struct sshkey *k)
55	0	{
56	0	EVP_PKEY_free(k->pkey);
57	0	k->pkey = NULL;
58	0	}
59
60		static int
61		ssh_rsa_equal(const struct sshkey a, const struct sshkey b)
62	0	{
63	0	if (a->pkey == NULL \|\| b->pkey == NULL)
64	0	return 0;
65	0	return EVP_PKEY_cmp(a->pkey, b->pkey) == 1;
66	0	}
67
68		static int
69		ssh_rsa_serialize_public(const struct sshkey key, struct sshbuf b,
70		enum sshkey_serialize_rep opts)
71	0	{
72	0	int r;
73	0	const BIGNUM rsa_n, rsa_e;
74	0	const RSA *rsa;
75
76	0	if (key->pkey == NULL)
77	0	return SSH_ERR_INVALID_ARGUMENT;
78	0	if ((rsa = EVP_PKEY_get0_RSA(key->pkey)) == NULL)
79	0	return SSH_ERR_LIBCRYPTO_ERROR;
80
81	0	RSA_get0_key(rsa, &rsa_n, &rsa_e, NULL);
82	0	if ((r = sshbuf_put_bignum2(b, rsa_e)) != 0 \|\|
83	0	(r = sshbuf_put_bignum2(b, rsa_n)) != 0)
84	0	return r;
85
86	0	return 0;
87	0	}
88
89		static int
90		ssh_rsa_serialize_private(const struct sshkey key, struct sshbuf b,
91		enum sshkey_serialize_rep opts)
92	0	{
93	0	int r;
94	0	const BIGNUM rsa_n, rsa_e, rsa_d, rsa_iqmp, rsa_p, rsa_q;
95	0	const RSA *rsa;
96
97	0	if ((rsa = EVP_PKEY_get0_RSA(key->pkey)) == NULL)
98	0	return SSH_ERR_LIBCRYPTO_ERROR;
99	0	RSA_get0_key(rsa, &rsa_n, &rsa_e, &rsa_d);
100	0	RSA_get0_factors(rsa, &rsa_p, &rsa_q);
101	0	RSA_get0_crt_params(rsa, NULL, NULL, &rsa_iqmp);
102
103	0	if (!sshkey_is_cert(key)) {
104		/* Note: can't reuse ssh_rsa_serialize_public: e, n vs. n, e */
105	0	if ((r = sshbuf_put_bignum2(b, rsa_n)) != 0 \|\|
106	0	(r = sshbuf_put_bignum2(b, rsa_e)) != 0)
107	0	return r;
108	0	}
109	0	if ((r = sshbuf_put_bignum2(b, rsa_d)) != 0 \|\|
110	0	(r = sshbuf_put_bignum2(b, rsa_iqmp)) != 0 \|\|
111	0	(r = sshbuf_put_bignum2(b, rsa_p)) != 0 \|\|
112	0	(r = sshbuf_put_bignum2(b, rsa_q)) != 0)
113	0	return r;
114
115	0	return 0;
116	0	}
117
118		static int
119		ssh_rsa_generate(struct sshkey *k, int bits)
120	1	{
121	1	EVP_PKEY_CTX *ctx = NULL;
122	1	EVP_PKEY *res = NULL;
123
124	1	int ret = SSH_ERR_INTERNAL_ERROR;
125
126	1	if (bits < SSH_RSA_MINIMUM_MODULUS_SIZE \|\|
127	1	bits > SSHBUF_MAX_BIGNUM * 8)
128	0	return SSH_ERR_KEY_LENGTH;
129
130	1	if ((ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL)) == NULL) {
131	0	ret = SSH_ERR_ALLOC_FAIL;
132	0	goto out;
133	0	}
134	1	if (EVP_PKEY_keygen_init(ctx) <= 0) {
135	0	ret = SSH_ERR_LIBCRYPTO_ERROR;
136	0	goto out;
137	0	}
138	1	if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, bits) <= 0) {
139	0	ret = SSH_ERR_KEY_LENGTH;
140	0	goto out;
141	0	}
142	1	if (EVP_PKEY_keygen(ctx, &res) <= 0 \|\| res == NULL) {
143	0	ret = SSH_ERR_LIBCRYPTO_ERROR;
144	0	goto out;
145	0	}
146		/* success */
147	1	k->pkey = res;
148	1	ret = 0;
149	1	out:
150	1	EVP_PKEY_CTX_free(ctx);
151	1	return ret;
152	1	}
153
154		static int
155		ssh_rsa_copy_public(const struct sshkey from, struct sshkey to)
156	0	{
157	0	const BIGNUM rsa_n, rsa_e;
158	0	BIGNUM rsa_n_dup = NULL, rsa_e_dup = NULL;
159	0	int r = SSH_ERR_INTERNAL_ERROR;
160	0	const RSA *rsa_from;
161	0	RSA *rsa_to = NULL;
162
163	0	if ((rsa_from = EVP_PKEY_get0_RSA(from->pkey)) == NULL \|\|
164	0	(rsa_to = RSA_new()) == NULL)
165	0	return SSH_ERR_LIBCRYPTO_ERROR;
166
167	0	RSA_get0_key(rsa_from, &rsa_n, &rsa_e, NULL);
168	0	if ((rsa_n_dup = BN_dup(rsa_n)) == NULL \|\|
169	0	(rsa_e_dup = BN_dup(rsa_e)) == NULL) {
170	0	r = SSH_ERR_ALLOC_FAIL;
171	0	goto out;
172	0	}
173	0	if (!RSA_set0_key(rsa_to, rsa_n_dup, rsa_e_dup, NULL)) {
174	0	r = SSH_ERR_LIBCRYPTO_ERROR;
175	0	goto out;
176	0	}
177	0	rsa_n_dup = rsa_e_dup = NULL; /* transferred */
178
179	0	if (EVP_PKEY_set1_RSA(to->pkey, rsa_to) != 1) {
180	0	r = SSH_ERR_LIBCRYPTO_ERROR;
181	0	goto out;
182	0	}
183		/* success */
184	0	r = 0;
185	0	out:
186	0	RSA_free(rsa_to);
187	0	BN_clear_free(rsa_n_dup);
188	0	BN_clear_free(rsa_e_dup);
189	0	return r;
190	0	}
191
192		static int
193		ssh_rsa_deserialize_public(const char ktype, struct sshbuf b,
194		struct sshkey *key)
195	0	{
196	0	int ret = SSH_ERR_INTERNAL_ERROR;
197	0	BIGNUM rsa_n = NULL, rsa_e = NULL;
198	0	RSA *rsa = NULL;
199
200	0	if ((rsa = RSA_new()) == NULL)
201	0	return SSH_ERR_LIBCRYPTO_ERROR;
202
203	0	if (sshbuf_get_bignum2(b, &rsa_e) != 0 \|\|
204	0	sshbuf_get_bignum2(b, &rsa_n) != 0) {
205	0	ret = SSH_ERR_INVALID_FORMAT;
206	0	goto out;
207	0	}
208	0	if (!RSA_set0_key(rsa, rsa_n, rsa_e, NULL)) {
209	0	ret = SSH_ERR_LIBCRYPTO_ERROR;
210	0	goto out;
211	0	}
212	0	rsa_n = rsa_e = NULL; /* transferred */
213	0	if (EVP_PKEY_set1_RSA(key->pkey, rsa) != 1) {
214	0	ret = SSH_ERR_LIBCRYPTO_ERROR;
215	0	goto out;
216	0	}
217	0	if ((ret = sshkey_check_rsa_length(key, 0)) != 0)
218	0	goto out;
219		#ifdef DEBUG_PK
220		RSA_print_fp(stderr, rsa, 8);
221		#endif
222		/* success */
223	0	ret = 0;
224	0	out:
225	0	RSA_free(rsa);
226	0	BN_clear_free(rsa_n);
227	0	BN_clear_free(rsa_e);
228	0	return ret;
229	0	}
230
231		static int
232		ssh_rsa_deserialize_private(const char ktype, struct sshbuf b,
233		struct sshkey *key)
234	0	{
235	0	int r;
236	0	BIGNUM rsa_n = NULL, rsa_e = NULL, *rsa_d = NULL;
237	0	BIGNUM rsa_iqmp = NULL, rsa_p = NULL, *rsa_q = NULL;
238	0	BIGNUM rsa_dmp1 = NULL, rsa_dmq1 = NULL;
239	0	RSA *rsa = NULL;
240
241	0	if (sshkey_is_cert(key)) {
242		/* sshkey_private_deserialize already has pubkey from cert */
243	0	if ((rsa = EVP_PKEY_get1_RSA(key->pkey)) == NULL) {
244	0	r = SSH_ERR_LIBCRYPTO_ERROR;
245	0	goto out;
246	0	}
247	0	} else {
248	0	if ((rsa = RSA_new()) == NULL) {
249	0	r = SSH_ERR_LIBCRYPTO_ERROR;
250	0	goto out;
251	0	}
252		/* Note: can't reuse ssh_rsa_deserialize_public: e,n vs. n,e */
253	0	if ((r = sshbuf_get_bignum2(b, &rsa_n)) != 0 \|\|
254	0	(r = sshbuf_get_bignum2(b, &rsa_e)) != 0)
255	0	goto out;
256	0	if (!RSA_set0_key(rsa, rsa_n, rsa_e, NULL)) {
257	0	r = SSH_ERR_LIBCRYPTO_ERROR;
258	0	goto out;
259	0	}
260	0	rsa_n = rsa_e = NULL; /* transferred */
261	0	}
262	0	if ((r = sshbuf_get_bignum2(b, &rsa_d)) != 0 \|\|
263	0	(r = sshbuf_get_bignum2(b, &rsa_iqmp)) != 0 \|\|
264	0	(r = sshbuf_get_bignum2(b, &rsa_p)) != 0 \|\|
265	0	(r = sshbuf_get_bignum2(b, &rsa_q)) != 0)
266	0	goto out;
267	0	if ((r = ssh_rsa_complete_crt_parameters(rsa_d, rsa_p, rsa_q,
268	0	rsa_iqmp, &rsa_dmp1, &rsa_dmq1)) != 0)
269	0	goto out;
270	0	if (!RSA_set0_key(rsa, NULL, NULL, rsa_d)) {
271	0	r = SSH_ERR_LIBCRYPTO_ERROR;
272	0	goto out;
273	0	}
274	0	rsa_d = NULL; /* transferred */
275	0	if (!RSA_set0_factors(rsa, rsa_p, rsa_q)) {
276	0	r = SSH_ERR_LIBCRYPTO_ERROR;
277	0	goto out;
278	0	}
279	0	rsa_p = rsa_q = NULL; /* transferred */
280	0	if (!RSA_set0_crt_params(rsa, rsa_dmp1, rsa_dmq1, rsa_iqmp)) {
281	0	r = SSH_ERR_LIBCRYPTO_ERROR;
282	0	goto out;
283	0	}
284	0	rsa_dmp1 = rsa_dmq1 = rsa_iqmp = NULL;
285	0	if (RSA_blinding_on(rsa, NULL) != 1) {
286	0	r = SSH_ERR_LIBCRYPTO_ERROR;
287	0	goto out;
288	0	}
289	0	if (EVP_PKEY_set1_RSA(key->pkey, rsa) != 1) {
290	0	r = SSH_ERR_LIBCRYPTO_ERROR;
291	0	goto out;
292	0	}
293	0	if ((r = sshkey_check_rsa_length(key, 0)) != 0)
294	0	goto out;
295		/* success */
296	0	r = 0;
297	0	out:
298	0	RSA_free(rsa);
299	0	BN_clear_free(rsa_n);
300	0	BN_clear_free(rsa_e);
301	0	BN_clear_free(rsa_d);
302	0	BN_clear_free(rsa_p);
303	0	BN_clear_free(rsa_q);
304	0	BN_clear_free(rsa_iqmp);
305	0	BN_clear_free(rsa_dmp1);
306	0	BN_clear_free(rsa_dmq1);
307	0	return r;
308	0	}
309
310		const char *
311		ssh_rsa_hash_alg_ident(int hash_alg)
312	0	{
313	0	switch (hash_alg) {
314	0	case SSH_DIGEST_SHA1:
315	0	return "ssh-rsa";
316	0	case SSH_DIGEST_SHA256:
317	0	return "rsa-sha2-256";
318	0	case SSH_DIGEST_SHA512:
319	0	return "rsa-sha2-512";
320	0	}
321	0	return NULL;
322	0	}
323
324		/*
325		* Returns the hash algorithm ID for a given algorithm identifier as used
326		* inside the signature blob,
327		*/
328		static int
329		rsa_hash_id_from_ident(const char *ident)
330	1.11k	{
331	1.11k	if (strcmp(ident, "ssh-rsa") == 0)
332	154	return SSH_DIGEST_SHA1;
333	957	if (strcmp(ident, "rsa-sha2-256") == 0)
334	3	return SSH_DIGEST_SHA256;
335	954	if (strcmp(ident, "rsa-sha2-512") == 0)
336	5	return SSH_DIGEST_SHA512;
337	949	return -1;
338	954	}
339
340		/*
341		* Return the hash algorithm ID for the specified key name. This includes
342		* all the cases of rsa_hash_id_from_ident() but also the certificate key
343		* types.
344		*/
345		int
346		ssh_rsa_hash_id_from_keyname(const char *alg)
347	0	{
348	0	int r;
349
350	0	if ((r = rsa_hash_id_from_ident(alg)) != -1)
351	0	return r;
352	0	if (strcmp(alg, "ssh-rsa-cert-v01@openssh.com") == 0)
353	0	return SSH_DIGEST_SHA1;
354	0	if (strcmp(alg, "rsa-sha2-256-cert-v01@openssh.com") == 0)
355	0	return SSH_DIGEST_SHA256;
356	0	if (strcmp(alg, "rsa-sha2-512-cert-v01@openssh.com") == 0)
357	0	return SSH_DIGEST_SHA512;
358	0	return -1;
359	0	}
360
361		int
362		ssh_rsa_complete_crt_parameters(const BIGNUM rsa_d, const BIGNUM rsa_p,
363		const BIGNUM rsa_q, const BIGNUM rsa_iqmp, BIGNUM **rsa_dmp1,
364		BIGNUM **rsa_dmq1)
365	0	{
366	0	BIGNUM aux = NULL, d_consttime = NULL;
367	0	BN_CTX *ctx = NULL;
368	0	int r;
369
370	0	rsa_dmq1 = rsa_dmp1 = NULL;
371	0	if ((ctx = BN_CTX_new()) == NULL)
372	0	return SSH_ERR_ALLOC_FAIL;
373	0	if ((aux = BN_new()) == NULL \|\|
374	0	(*rsa_dmq1 = BN_new()) == NULL \|\|
375	0	(*rsa_dmp1 = BN_new()) == NULL)
376	0	return SSH_ERR_ALLOC_FAIL;
377	0	if ((d_consttime = BN_dup(rsa_d)) == NULL) {
378	0	r = SSH_ERR_ALLOC_FAIL;
379	0	goto out;
380	0	}
381	0	BN_set_flags(aux, BN_FLG_CONSTTIME);
382	0	BN_set_flags(d_consttime, BN_FLG_CONSTTIME);
383
384	0	if ((BN_sub(aux, rsa_q, BN_value_one()) == 0) \|\|
385	0	(BN_mod(*rsa_dmq1, d_consttime, aux, ctx) == 0) \|\|
386	0	(BN_sub(aux, rsa_p, BN_value_one()) == 0) \|\|
387	0	(BN_mod(*rsa_dmp1, d_consttime, aux, ctx) == 0)) {
388	0	r = SSH_ERR_LIBCRYPTO_ERROR;
389	0	goto out;
390	0	}
391		/* success */
392	0	r = 0;
393	0	out:
394	0	BN_clear_free(aux);
395	0	BN_clear_free(d_consttime);
396	0	BN_CTX_free(ctx);
397	0	return r;
398	0	}
399
400		/* RSASSA-PKCS1-v1_5 (PKCS #1 v2.0 signature) with SHA1 */
401		static int
402		ssh_rsa_sign(struct sshkey *key,
403		u_char *sigp, size_t lenp,
404		const u_char *data, size_t datalen,
405		const char alg, const char sk_provider, const char *sk_pin, u_int compat)
406	0	{
407	0	u_char *sig = NULL;
408	0	size_t diff, len = 0;
409	0	int slen = 0;
410	0	int hash_alg, ret = SSH_ERR_INTERNAL_ERROR;
411
412	0	if (lenp != NULL)
413	0	*lenp = 0;
414	0	if (sigp != NULL)
415	0	*sigp = NULL;
416
417	0	if (alg == NULL \|\| strlen(alg) == 0)
418	0	hash_alg = SSH_DIGEST_SHA1;
419	0	else
420	0	hash_alg = ssh_rsa_hash_id_from_keyname(alg);
421
422	0	if (key == NULL \|\| key->pkey == NULL \|\| hash_alg == -1 \|\|
423	0	sshkey_type_plain(key->type) != KEY_RSA)
424	0	return SSH_ERR_INVALID_ARGUMENT;
425	0	slen = EVP_PKEY_size(key->pkey);
426	0	if (slen <= 0 \|\| slen > SSHBUF_MAX_BIGNUM)
427	0	return SSH_ERR_INVALID_ARGUMENT;
428	0	if (EVP_PKEY_bits(key->pkey) < SSH_RSA_MINIMUM_MODULUS_SIZE)
429	0	return SSH_ERR_KEY_LENGTH;
430
431	0	if ((ret = sshkey_pkey_digest_sign(key->pkey, hash_alg, &sig, &len,
432	0	data, datalen)) < 0)
433	0	goto out;
434	0	if (len < (size_t)slen) {
435	0	diff = slen - len;
436	0	memmove(sig + diff, sig, len);
437	0	explicit_bzero(sig, diff);
438	0	} else if (len > (size_t)slen) {
439	0	ret = SSH_ERR_INTERNAL_ERROR;
440	0	goto out;
441	0	}
442	0	if ((ret = ssh_rsa_encode_store_sig(hash_alg, sig, slen,
443	0	sigp, lenp)) != 0)
444	0	goto out;
445
446		/* success */
447	0	ret = 0;
448	0	out:
449	0	freezero(sig, slen);
450	0	return ret;
451	0	}
452
453		int
454		ssh_rsa_encode_store_sig(int hash_alg, const u_char *sig, size_t slen,
455		u_char *sigp, size_t lenp)
456	0	{
457	0	struct sshbuf *b = NULL;
458	0	int ret = SSH_ERR_INTERNAL_ERROR;
459	0	size_t len;
460
461	0	if (lenp != NULL)
462	0	*lenp = 0;
463	0	if (sigp != NULL)
464	0	*sigp = NULL;
465
466		/* Encode signature */
467	0	if ((b = sshbuf_new()) == NULL) {
468	0	ret = SSH_ERR_ALLOC_FAIL;
469	0	goto out;
470	0	}
471	0	if ((ret = sshbuf_put_cstring(b,
472	0	ssh_rsa_hash_alg_ident(hash_alg))) != 0 \|\|
473	0	(ret = sshbuf_put_string(b, sig, slen)) != 0)
474	0	goto out;
475	0	len = sshbuf_len(b);
476
477		/* Store signature */
478	0	if (sigp != NULL) {
479	0	if ((*sigp = malloc(len)) == NULL) {
480	0	ret = SSH_ERR_ALLOC_FAIL;
481	0	goto out;
482	0	}
483	0	memcpy(*sigp, sshbuf_ptr(b), len);
484	0	}
485	0	if (lenp != NULL)
486	0	*lenp = len;
487	0	ret = 0;
488	0	out:
489	0	sshbuf_free(b);
490	0	return ret;
491	0	}
492
493		static int
494		ssh_rsa_verify(const struct sshkey *key,
495		const u_char *sig, size_t siglen,
496		const u_char data, size_t dlen, const char alg, u_int compat,
497		struct sshkey_sig_details **detailsp)
498	1.18k	{
499	1.18k	char *sigtype = NULL;
500	1.18k	int hash_alg, want_alg, ret = SSH_ERR_INTERNAL_ERROR;
501	1.18k	size_t len = 0, diff, modlen, rsasize;
502	1.18k	struct sshbuf *b = NULL;
503	1.18k	u_char digest[SSH_DIGEST_MAX_LENGTH], osigblob, sigblob = NULL;
504
505	1.18k	if (key == NULL \|\| key->pkey == NULL \|\|
506	1.18k	sshkey_type_plain(key->type) != KEY_RSA \|\|
507	1.18k	sig == NULL \|\| siglen == 0)
508	0	return SSH_ERR_INVALID_ARGUMENT;
509	1.18k	if (EVP_PKEY_bits(key->pkey) < SSH_RSA_MINIMUM_MODULUS_SIZE)
510	0	return SSH_ERR_KEY_LENGTH;
511
512	1.18k	if ((b = sshbuf_from(sig, siglen)) == NULL)
513	0	return SSH_ERR_ALLOC_FAIL;
514	1.18k	if (sshbuf_get_cstring(b, &sigtype, NULL) != 0) {
515	74	ret = SSH_ERR_INVALID_FORMAT;
516	74	goto out;
517	74	}
518	1.11k	if ((hash_alg = rsa_hash_id_from_ident(sigtype)) == -1) {
519	949	ret = SSH_ERR_KEY_TYPE_MISMATCH;
520	949	goto out;
521	949	}
522		/*
523		* Allow ssh-rsa-cert-v01 certs to generate SHA2 signatures for
524		* legacy reasons, but otherwise the signature type should match.
525		*/
526	162	if (alg != NULL && strcmp(alg, "ssh-rsa-cert-v01@openssh.com") != 0) {
527	0	if ((want_alg = ssh_rsa_hash_id_from_keyname(alg)) == -1) {
528	0	ret = SSH_ERR_INVALID_ARGUMENT;
529	0	goto out;
530	0	}
531	0	if (hash_alg != want_alg) {
532	0	ret = SSH_ERR_SIGNATURE_INVALID;
533	0	goto out;
534	0	}
535	0	}
536	162	if (sshbuf_get_string(b, &sigblob, &len) != 0) {
537	65	ret = SSH_ERR_INVALID_FORMAT;
538	65	goto out;
539	65	}
540	97	if (sshbuf_len(b) != 0) {
541	43	ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
542	43	goto out;
543	43	}
544		/* RSA_verify expects a signature of RSA_size */
545	54	modlen = EVP_PKEY_size(key->pkey);
546	54	if (len > modlen) {
547	42	ret = SSH_ERR_KEY_BITS_MISMATCH;
548	42	goto out;
549	42	} else if (len < modlen) {
550	11	diff = modlen - len;
551	11	osigblob = sigblob;
552	11	if ((sigblob = realloc(sigblob, modlen)) == NULL) {
553	0	sigblob = osigblob; /* put it back for clear/free */
554	0	ret = SSH_ERR_ALLOC_FAIL;
555	0	goto out;
556	0	}
557	11	memmove(sigblob + diff, sigblob, len);
558	11	explicit_bzero(sigblob, diff);
559	11	len = modlen;
560	11	}
561
562	12	rsasize = EVP_PKEY_size(key->pkey);
563	12	if (rsasize <= 0 \|\| rsasize > SSHBUF_MAX_BIGNUM \|\|
564	12	len == 0 \|\| len > rsasize) {
565	0	ret = SSH_ERR_INVALID_ARGUMENT;
566	0	goto out;
567	0	}
568	12	ret = sshkey_pkey_digest_verify(key->pkey, hash_alg, data, dlen,
569	12	sigblob, len);
570
571	1.18k	out:
572	1.18k	freezero(sigblob, len);
573	1.18k	free(sigtype);
574	1.18k	sshbuf_free(b);
575	1.18k	explicit_bzero(digest, sizeof(digest));
576	1.18k	return ret;
577	12	}
578
579		static const struct sshkey_impl_funcs sshkey_rsa_funcs = {
580		/* .size = */ ssh_rsa_size,
581		/* .alloc = */ ssh_rsa_alloc,
582		/* .cleanup = */ ssh_rsa_cleanup,
583		/* .equal = */ ssh_rsa_equal,
584		/* .ssh_serialize_public = */ ssh_rsa_serialize_public,
585		/* .ssh_deserialize_public = */ ssh_rsa_deserialize_public,
586		/* .ssh_serialize_private = */ ssh_rsa_serialize_private,
587		/* .ssh_deserialize_private = */ ssh_rsa_deserialize_private,
588		/* .generate = */ ssh_rsa_generate,
589		/* .copy_public = */ ssh_rsa_copy_public,
590		/* .sign = */ ssh_rsa_sign,
591		/* .verify = */ ssh_rsa_verify,
592		};
593
594		const struct sshkey_impl sshkey_rsa_impl = {
595		/* .name = */ "ssh-rsa",
596		/* .shortname = */ "RSA",
597		/* .sigalg = */ NULL,
598		/* .type = */ KEY_RSA,
599		/* .nid = */ 0,
600		/* .cert = */ 0,
601		/* .sigonly = */ 0,
602		/* .keybits = */ 0,
603		/* .funcs = */ &sshkey_rsa_funcs,
604		};
605
606		const struct sshkey_impl sshkey_rsa_cert_impl = {
607		/* .name = */ "ssh-rsa-cert-v01@openssh.com",
608		/* .shortname = */ "RSA-CERT",
609		/* .sigalg = */ NULL,
610		/* .type = */ KEY_RSA_CERT,
611		/* .nid = */ 0,
612		/* .cert = */ 1,
613		/* .sigonly = */ 0,
614		/* .keybits = */ 0,
615		/* .funcs = */ &sshkey_rsa_funcs,
616		};
617
618		/* SHA2 signature algorithms */
619
620		const struct sshkey_impl sshkey_rsa_sha256_impl = {
621		/* .name = */ "rsa-sha2-256",
622		/* .shortname = */ "RSA",
623		/* .sigalg = */ NULL,
624		/* .type = */ KEY_RSA,
625		/* .nid = */ 0,
626		/* .cert = */ 0,
627		/* .sigonly = */ 1,
628		/* .keybits = */ 0,
629		/* .funcs = */ &sshkey_rsa_funcs,
630		};
631
632		const struct sshkey_impl sshkey_rsa_sha512_impl = {
633		/* .name = */ "rsa-sha2-512",
634		/* .shortname = */ "RSA",
635		/* .sigalg = */ NULL,
636		/* .type = */ KEY_RSA,
637		/* .nid = */ 0,
638		/* .cert = */ 0,
639		/* .sigonly = */ 1,
640		/* .keybits = */ 0,
641		/* .funcs = */ &sshkey_rsa_funcs,
642		};
643
644		const struct sshkey_impl sshkey_rsa_sha256_cert_impl = {
645		/* .name = */ "rsa-sha2-256-cert-v01@openssh.com",
646		/* .shortname = */ "RSA-CERT",
647		/* .sigalg = */ "rsa-sha2-256",
648		/* .type = */ KEY_RSA_CERT,
649		/* .nid = */ 0,
650		/* .cert = */ 1,
651		/* .sigonly = */ 1,
652		/* .keybits = */ 0,
653		/* .funcs = */ &sshkey_rsa_funcs,
654		};
655
656		const struct sshkey_impl sshkey_rsa_sha512_cert_impl = {
657		/* .name = */ "rsa-sha2-512-cert-v01@openssh.com",
658		/* .shortname = */ "RSA-CERT",
659		/* .sigalg = */ "rsa-sha2-512",
660		/* .type = */ KEY_RSA_CERT,
661		/* .nid = */ 0,
662		/* .cert = */ 1,
663		/* .sigonly = */ 1,
664		/* .keybits = */ 0,
665		/* .funcs = */ &sshkey_rsa_funcs,
666		};
667		#endif /* WITH_OPENSSL */