/src/openssh/ssh-ed25519-sk.c

Source
/* $OpenBSD: ssh-ed25519-sk.c,v 1.17 2026/09/16 00:43:00 djm Exp $ */
/*
 * Copyright (c) 2019 Markus Friedl.  All rights reserved.
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

/* #define DEBUG_SK 1 */

#include "includes.h"

#define SSHKEY_INTERNAL
#include <sys/types.h>

#include "crypto_api.h"

#include <string.h>
#include <stdarg.h>

#include "log.h"
#include "sshbuf.h"
#include "sshkey.h"
#include "ssherr.h"
#include "digest.h"

/* Reuse some ED25519 internals */
extern struct sshkey_impl_funcs sshkey_ed25519_funcs;

static void
ssh_ed25519_sk_cleanup(struct sshkey *k)
{
  sshkey_sk_cleanup(k);
  sshkey_ed25519_funcs.cleanup(k);
}

static int
ssh_ed25519_sk_equal(const struct sshkey *a, const struct sshkey *b)
{
  if (!sshkey_sk_fields_equal(a, b))
    return 0;
  if (!sshkey_ed25519_funcs.equal(a, b))
    return 0;
  return 1;
}

static int
ssh_ed25519_sk_serialize_public(const struct sshkey *key, struct sshbuf *b,
    enum sshkey_serialize_rep opts)
{
  int r;

  if ((r = sshkey_ed25519_funcs.serialize_public(key, b, opts)) != 0)
    return r;
  if ((r = sshkey_serialize_sk(key, b)) != 0)
    return r;

  return 0;
}

static int
ssh_ed25519_sk_serialize_private(const struct sshkey *key, struct sshbuf *b,
    enum sshkey_serialize_rep opts)
{
  int r;

  if ((r = sshkey_ed25519_funcs.serialize_public(key, b, opts)) != 0)
    return r;
  if ((r = sshkey_serialize_private_sk(key, b)) != 0)
    return r;

  return 0;
}

static int
ssh_ed25519_sk_copy_public(const struct sshkey *from, struct sshkey *to)
{
  int r;

  if ((r = sshkey_ed25519_funcs.copy_public(from, to)) != 0)
    return r;
  if ((r = sshkey_copy_public_sk(from, to)) != 0)
    return r;
  return 0;
}

static int
ssh_ed25519_sk_deserialize_public(const char *ktype, struct sshbuf *b,
    struct sshkey *key)
{
  int r;

  if ((r = sshkey_ed25519_funcs.deserialize_public(ktype, b, key)) != 0)
    return r;
  if ((r = sshkey_deserialize_sk(b, key)) != 0)
    return r;
  return 0;
}

static int
ssh_ed25519_sk_deserialize_private(const char *ktype, struct sshbuf *b,
    struct sshkey *key)
{
  int r;

  if ((r = sshkey_ed25519_funcs.deserialize_public(ktype, b, key)) != 0)
    return r;
  if ((r = sshkey_private_deserialize_sk(b, key)) != 0)
    return r;
  return 0;
}

static int
ssh_ed25519_sk_verify(const struct sshkey *key,
    const u_char *sig, size_t siglen,
    const u_char *data, size_t dlen, const char *alg, u_int compat,
    struct sshkey_sig_details **detailsp)
{
  struct sshbuf *b = NULL;
  struct sshbuf *encoded = NULL;
  char *ktype = NULL;
  const u_char *sigblob;
  u_char apphash[32];
  u_char msghash[32];
  u_char sig_flags;
  u_int sig_counter;
  size_t len;
  int r = SSH_ERR_INTERNAL_ERROR;
  int ret;
  struct sshkey_sig_details *details = NULL;

  if (detailsp != NULL)
    *detailsp = NULL;

  if (key == NULL ||
      sshkey_type_plain(key->type) != KEY_ED25519_SK ||
      key->ed25519_pk == NULL ||
      sig == NULL || siglen == 0)
    return SSH_ERR_INVALID_ARGUMENT;

  if ((b = sshbuf_from(sig, siglen)) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  if (sshbuf_get_cstring(b, &ktype, NULL) != 0 ||
      sshbuf_get_string_direct(b, &sigblob, &len) != 0 ||
      sshbuf_get_u8(b, &sig_flags) != 0 ||
      sshbuf_get_u32(b, &sig_counter) != 0) {
    r = SSH_ERR_INVALID_FORMAT;
    goto out;
  }
#ifdef DEBUG_SK
  fprintf(stderr, "%s: data:\n", __func__);
  /* sshbuf_dump_data(data, datalen, stderr); */
  fprintf(stderr, "%s: sigblob:\n", __func__);
  sshbuf_dump_data(sigblob, len, stderr);
  fprintf(stderr, "%s: sig_flags = 0x%02x, sig_counter = %u\n",
      __func__, sig_flags, sig_counter);
#endif
  if (strcmp(sshkey_ssh_name_plain(key), ktype) != 0) {
    r = SSH_ERR_KEY_TYPE_MISMATCH;
    goto out;
  }
  if (sshbuf_len(b) != 0) {
    r = SSH_ERR_UNEXPECTED_TRAILING_DATA;
    goto out;
  }
  if (len != crypto_sign_ed25519_BYTES) {
    r = SSH_ERR_INVALID_FORMAT;
    goto out;
  }
  if (ssh_digest_memory(SSH_DIGEST_SHA256, key->sk_application,
      strlen(key->sk_application), apphash, sizeof(apphash)) != 0 ||
      ssh_digest_memory(SSH_DIGEST_SHA256, data, dlen,
      msghash, sizeof(msghash)) != 0) {
    r = SSH_ERR_INVALID_ARGUMENT;
    goto out;
  }
#ifdef DEBUG_SK
  fprintf(stderr, "%s: hashed application:\n", __func__);
  sshbuf_dump_data(apphash, sizeof(apphash), stderr);
  fprintf(stderr, "%s: hashed message:\n", __func__);
  sshbuf_dump_data(msghash, sizeof(msghash), stderr);
#endif
  if ((details = calloc(1, sizeof(*details))) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  details->sk_counter = sig_counter;
  details->sk_flags = sig_flags;
  if ((encoded = sshbuf_new()) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if (sshbuf_put(encoded, apphash, sizeof(apphash)) != 0 ||
      sshbuf_put_u8(encoded, sig_flags) != 0 ||
      sshbuf_put_u32(encoded, sig_counter) != 0 ||
      sshbuf_put(encoded, msghash, sizeof(msghash)) != 0) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
#ifdef DEBUG_SK
  fprintf(stderr, "%s: signed buf:\n", __func__);
  sshbuf_dump(encoded, stderr);
#endif
  if ((ret = crypto_sign_ed25519_verify_detached(sigblob,
      sshbuf_ptr(encoded), sshbuf_len(encoded),
      key->ed25519_pk)) != 0) {
    debug2_f("crypto_sign_ed25519_verify_detached failed: %d", ret);
  }
  if (ret != 0) {
    r = SSH_ERR_SIGNATURE_INVALID;
    goto out;
  }
  /* success */
  r = 0;
  if (detailsp != NULL) {
    *detailsp = details;
    details = NULL;
  }
 out:
  sshkey_sig_details_free(details);
  sshbuf_free(b);
  sshbuf_free(encoded);
  free(ktype);
  return r;
}

static const struct sshkey_impl_funcs sshkey_ed25519_sk_funcs = {
  /* .size = */   NULL,
  /* .alloc = */    NULL,
  /* .cleanup = */  ssh_ed25519_sk_cleanup,
  /* .equal = */    ssh_ed25519_sk_equal,
  /* .ssh_serialize_public = */ ssh_ed25519_sk_serialize_public,
  /* .ssh_deserialize_public = */ ssh_ed25519_sk_deserialize_public,
  /* .ssh_serialize_private = */ ssh_ed25519_sk_serialize_private,
  /* .ssh_deserialize_private = */ ssh_ed25519_sk_deserialize_private,
  /* .generate = */ NULL,
  /* .copy_public = */  ssh_ed25519_sk_copy_public,
  /* .sign = */   NULL,
  /* .verify = */   ssh_ed25519_sk_verify,
};

const struct sshkey_impl sshkey_ed25519_sk_impl = {
  /* .name = */   "sk-ssh-ed25519@openssh.com",
  /* .shortname = */  "ED25519-SK",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_ED25519_SK,
  /* .nid = */    0,
  /* .cert = */   0,
  /* .sigonly = */  0,
  /* .keybits = */  256,
  /* .funcs = */    &sshkey_ed25519_sk_funcs,
};

const struct sshkey_impl sshkey_ed25519_sk_cert_impl = {
  /* .name = */   "sk-ssh-ed25519-cert-v01@openssh.com",
  /* .shortname = */  "ED25519-SK-CERT",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_ED25519_SK_CERT,
  /* .nid = */    0,
  /* .cert = */   1,
  /* .sigonly = */  0,
  /* .keybits = */  256,
  /* .funcs = */    &sshkey_ed25519_sk_funcs,
};

Coverage Report

Created: 2026-10-17 06:39

Line	Count	Source
1		/* $OpenBSD: ssh-ed25519-sk.c,v 1.17 2026/09/16 00:43:00 djm Exp $ */
2		/*
3		* Copyright (c) 2019 Markus Friedl. All rights reserved.
4		*
5		* Permission to use, copy, modify, and distribute this software for any
6		* purpose with or without fee is hereby granted, provided that the above
7		* copyright notice and this permission notice appear in all copies.
8		*
9		* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10		* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11		* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12		* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13		* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14		* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15		* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16		*/
17
18		/* #define DEBUG_SK 1 */
19
20		#include "includes.h"
21
22		#define SSHKEY_INTERNAL
23		#include <sys/types.h>
24
25		#include "crypto_api.h"
26
27		#include <string.h>
28		#include <stdarg.h>
29
30		#include "log.h"
31		#include "sshbuf.h"
32		#include "sshkey.h"
33		#include "ssherr.h"
34		#include "digest.h"
35
36		/* Reuse some ED25519 internals */
37		extern struct sshkey_impl_funcs sshkey_ed25519_funcs;
38
39		static void
40		ssh_ed25519_sk_cleanup(struct sshkey *k)
41	6	{
42	6	sshkey_sk_cleanup(k);
43	6	sshkey_ed25519_funcs.cleanup(k);
44	6	}
45
46		static int
47		ssh_ed25519_sk_equal(const struct sshkey a, const struct sshkey b)
48	0	{
49	0	if (!sshkey_sk_fields_equal(a, b))
50	0	return 0;
51	0	if (!sshkey_ed25519_funcs.equal(a, b))
52	0	return 0;
53	0	return 1;
54	0	}
55
56		static int
57		ssh_ed25519_sk_serialize_public(const struct sshkey key, struct sshbuf b,
58		enum sshkey_serialize_rep opts)
59	0	{
60	0	int r;
61
62	0	if ((r = sshkey_ed25519_funcs.serialize_public(key, b, opts)) != 0)
63	0	return r;
64	0	if ((r = sshkey_serialize_sk(key, b)) != 0)
65	0	return r;
66
67	0	return 0;
68	0	}
69
70		static int
71		ssh_ed25519_sk_serialize_private(const struct sshkey key, struct sshbuf b,
72		enum sshkey_serialize_rep opts)
73	0	{
74	0	int r;
75
76	0	if ((r = sshkey_ed25519_funcs.serialize_public(key, b, opts)) != 0)
77	0	return r;
78	0	if ((r = sshkey_serialize_private_sk(key, b)) != 0)
79	0	return r;
80
81	0	return 0;
82	0	}
83
84		static int
85		ssh_ed25519_sk_copy_public(const struct sshkey from, struct sshkey to)
86	0	{
87	0	int r;
88
89	0	if ((r = sshkey_ed25519_funcs.copy_public(from, to)) != 0)
90	0	return r;
91	0	if ((r = sshkey_copy_public_sk(from, to)) != 0)
92	0	return r;
93	0	return 0;
94	0	}
95
96		static int
97		ssh_ed25519_sk_deserialize_public(const char ktype, struct sshbuf b,
98		struct sshkey *key)
99	4	{
100	4	int r;
101
102	4	if ((r = sshkey_ed25519_funcs.deserialize_public(ktype, b, key)) != 0)
103	4	return r;
104	0	if ((r = sshkey_deserialize_sk(b, key)) != 0)
105	0	return r;
106	0	return 0;
107	0	}
108
109		static int
110		ssh_ed25519_sk_deserialize_private(const char ktype, struct sshbuf b,
111		struct sshkey *key)
112	0	{
113	0	int r;
114
115	0	if ((r = sshkey_ed25519_funcs.deserialize_public(ktype, b, key)) != 0)
116	0	return r;
117	0	if ((r = sshkey_private_deserialize_sk(b, key)) != 0)
118	0	return r;
119	0	return 0;
120	0	}
121
122		static int
123		ssh_ed25519_sk_verify(const struct sshkey *key,
124		const u_char *sig, size_t siglen,
125		const u_char data, size_t dlen, const char alg, u_int compat,
126		struct sshkey_sig_details **detailsp)
127	0	{
128	0	struct sshbuf *b = NULL;
129	0	struct sshbuf *encoded = NULL;
130	0	char *ktype = NULL;
131	0	const u_char *sigblob;
132	0	u_char apphash[32];
133	0	u_char msghash[32];
134	0	u_char sig_flags;
135	0	u_int sig_counter;
136	0	size_t len;
137	0	int r = SSH_ERR_INTERNAL_ERROR;
138	0	int ret;
139	0	struct sshkey_sig_details *details = NULL;
140
141	0	if (detailsp != NULL)
142	0	*detailsp = NULL;
143
144	0	if (key == NULL \|\|
145	0	sshkey_type_plain(key->type) != KEY_ED25519_SK \|\|
146	0	key->ed25519_pk == NULL \|\|
147	0	sig == NULL \|\| siglen == 0)
148	0	return SSH_ERR_INVALID_ARGUMENT;
149
150	0	if ((b = sshbuf_from(sig, siglen)) == NULL)
151	0	return SSH_ERR_ALLOC_FAIL;
152	0	if (sshbuf_get_cstring(b, &ktype, NULL) != 0 \|\|
153	0	sshbuf_get_string_direct(b, &sigblob, &len) != 0 \|\|
154	0	sshbuf_get_u8(b, &sig_flags) != 0 \|\|
155	0	sshbuf_get_u32(b, &sig_counter) != 0) {
156	0	r = SSH_ERR_INVALID_FORMAT;
157	0	goto out;
158	0	}
159		#ifdef DEBUG_SK
160		fprintf(stderr, "%s: data:\n", __func__);
161		/* sshbuf_dump_data(data, datalen, stderr); */
162		fprintf(stderr, "%s: sigblob:\n", __func__);
163		sshbuf_dump_data(sigblob, len, stderr);
164		fprintf(stderr, "%s: sig_flags = 0x%02x, sig_counter = %u\n",
165		__func__, sig_flags, sig_counter);
166		#endif
167	0	if (strcmp(sshkey_ssh_name_plain(key), ktype) != 0) {
168	0	r = SSH_ERR_KEY_TYPE_MISMATCH;
169	0	goto out;
170	0	}
171	0	if (sshbuf_len(b) != 0) {
172	0	r = SSH_ERR_UNEXPECTED_TRAILING_DATA;
173	0	goto out;
174	0	}
175	0	if (len != crypto_sign_ed25519_BYTES) {
176	0	r = SSH_ERR_INVALID_FORMAT;
177	0	goto out;
178	0	}
179	0	if (ssh_digest_memory(SSH_DIGEST_SHA256, key->sk_application,
180	0	strlen(key->sk_application), apphash, sizeof(apphash)) != 0 \|\|
181	0	ssh_digest_memory(SSH_DIGEST_SHA256, data, dlen,
182	0	msghash, sizeof(msghash)) != 0) {
183	0	r = SSH_ERR_INVALID_ARGUMENT;
184	0	goto out;
185	0	}
186		#ifdef DEBUG_SK
187		fprintf(stderr, "%s: hashed application:\n", __func__);
188		sshbuf_dump_data(apphash, sizeof(apphash), stderr);
189		fprintf(stderr, "%s: hashed message:\n", __func__);
190		sshbuf_dump_data(msghash, sizeof(msghash), stderr);
191		#endif
192	0	if ((details = calloc(1, sizeof(*details))) == NULL) {
193	0	r = SSH_ERR_ALLOC_FAIL;
194	0	goto out;
195	0	}
196	0	details->sk_counter = sig_counter;
197	0	details->sk_flags = sig_flags;
198	0	if ((encoded = sshbuf_new()) == NULL) {
199	0	r = SSH_ERR_ALLOC_FAIL;
200	0	goto out;
201	0	}
202	0	if (sshbuf_put(encoded, apphash, sizeof(apphash)) != 0 \|\|
203	0	sshbuf_put_u8(encoded, sig_flags) != 0 \|\|
204	0	sshbuf_put_u32(encoded, sig_counter) != 0 \|\|
205	0	sshbuf_put(encoded, msghash, sizeof(msghash)) != 0) {
206	0	r = SSH_ERR_ALLOC_FAIL;
207	0	goto out;
208	0	}
209		#ifdef DEBUG_SK
210		fprintf(stderr, "%s: signed buf:\n", __func__);
211		sshbuf_dump(encoded, stderr);
212		#endif
213	0	if ((ret = crypto_sign_ed25519_verify_detached(sigblob,
214	0	sshbuf_ptr(encoded), sshbuf_len(encoded),
215	0	key->ed25519_pk)) != 0) {
216	0	debug2_f("crypto_sign_ed25519_verify_detached failed: %d", ret);
217	0	}
218	0	if (ret != 0) {
219	0	r = SSH_ERR_SIGNATURE_INVALID;
220	0	goto out;
221	0	}
222		/* success */
223	0	r = 0;
224	0	if (detailsp != NULL) {
225	0	*detailsp = details;
226	0	details = NULL;
227	0	}
228	0	out:
229	0	sshkey_sig_details_free(details);
230	0	sshbuf_free(b);
231	0	sshbuf_free(encoded);
232	0	free(ktype);
233	0	return r;
234	0	}
235
236		static const struct sshkey_impl_funcs sshkey_ed25519_sk_funcs = {
237		/* .size = */ NULL,
238		/* .alloc = */ NULL,
239		/* .cleanup = */ ssh_ed25519_sk_cleanup,
240		/* .equal = */ ssh_ed25519_sk_equal,
241		/* .ssh_serialize_public = */ ssh_ed25519_sk_serialize_public,
242		/* .ssh_deserialize_public = */ ssh_ed25519_sk_deserialize_public,
243		/* .ssh_serialize_private = */ ssh_ed25519_sk_serialize_private,
244		/* .ssh_deserialize_private = */ ssh_ed25519_sk_deserialize_private,
245		/* .generate = */ NULL,
246		/* .copy_public = */ ssh_ed25519_sk_copy_public,
247		/* .sign = */ NULL,
248		/* .verify = */ ssh_ed25519_sk_verify,
249		};
250
251		const struct sshkey_impl sshkey_ed25519_sk_impl = {
252		/* .name = */ "sk-ssh-ed25519@openssh.com",
253		/* .shortname = */ "ED25519-SK",
254		/* .sigalg = */ NULL,
255		/* .type = */ KEY_ED25519_SK,
256		/* .nid = */ 0,
257		/* .cert = */ 0,
258		/* .sigonly = */ 0,
259		/* .keybits = */ 256,
260		/* .funcs = */ &sshkey_ed25519_sk_funcs,
261		};
262
263		const struct sshkey_impl sshkey_ed25519_sk_cert_impl = {
264		/* .name = */ "sk-ssh-ed25519-cert-v01@openssh.com",
265		/* .shortname = */ "ED25519-SK-CERT",
266		/* .sigalg = */ NULL,
267		/* .type = */ KEY_ED25519_SK_CERT,
268		/* .nid = */ 0,
269		/* .cert = */ 1,
270		/* .sigonly = */ 0,
271		/* .keybits = */ 256,
272		/* .funcs = */ &sshkey_ed25519_sk_funcs,
273		};