/src/openssh/ssh-ed25519-sk.c

Source
/* $OpenBSD: ssh-ed25519-sk.c,v 1.15 2022/10/28 00:44:44 djm Exp $ */
/*
 * Copyright (c) 2019 Markus Friedl.  All rights reserved.
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

/* #define DEBUG_SK 1 */

#include "includes.h"

#define SSHKEY_INTERNAL
#include <sys/types.h>
#include <limits.h>

#include "crypto_api.h"

#include <string.h>
#include <stdarg.h>

#include "log.h"
#include "sshbuf.h"
#include "sshkey.h"
#include "ssherr.h"
#include "ssh.h"
#include "digest.h"

/* Reuse some ED25519 internals */
extern struct sshkey_impl_funcs sshkey_ed25519_funcs;

static void
ssh_ed25519_sk_cleanup(struct sshkey *k)
{
  sshkey_sk_cleanup(k);
  sshkey_ed25519_funcs.cleanup(k);
}

static int
ssh_ed25519_sk_equal(const struct sshkey *a, const struct sshkey *b)
{
  if (!sshkey_sk_fields_equal(a, b))
    return 0;
  if (!sshkey_ed25519_funcs.equal(a, b))
    return 0;
  return 1;
}

static int
ssh_ed25519_sk_serialize_public(const struct sshkey *key, struct sshbuf *b,
    enum sshkey_serialize_rep opts)
{
  int r;

  if ((r = sshkey_ed25519_funcs.serialize_public(key, b, opts)) != 0)
    return r;
  if ((r = sshkey_serialize_sk(key, b)) != 0)
    return r;

  return 0;
}

static int
ssh_ed25519_sk_serialize_private(const struct sshkey *key, struct sshbuf *b,
    enum sshkey_serialize_rep opts)
{
  int r;

  if ((r = sshkey_ed25519_funcs.serialize_public(key, b, opts)) != 0)
    return r;
  if ((r = sshkey_serialize_private_sk(key, b)) != 0)
    return r;

  return 0;
}

static int
ssh_ed25519_sk_copy_public(const struct sshkey *from, struct sshkey *to)
{
  int r;

  if ((r = sshkey_ed25519_funcs.copy_public(from, to)) != 0)
    return r;
  if ((r = sshkey_copy_public_sk(from, to)) != 0)
    return r;
  return 0;
}

static int
ssh_ed25519_sk_deserialize_public(const char *ktype, struct sshbuf *b,
    struct sshkey *key)
{
  int r;

  if ((r = sshkey_ed25519_funcs.deserialize_public(ktype, b, key)) != 0)
    return r;
  if ((r = sshkey_deserialize_sk(b, key)) != 0)
    return r;
  return 0;
}

static int
ssh_ed25519_sk_deserialize_private(const char *ktype, struct sshbuf *b,
    struct sshkey *key)
{
  int r;

  if ((r = sshkey_ed25519_funcs.deserialize_public(ktype, b, key)) != 0)
    return r;
  if ((r = sshkey_private_deserialize_sk(b, key)) != 0)
    return r;
  return 0;
}

static int
ssh_ed25519_sk_verify(const struct sshkey *key,
    const u_char *sig, size_t siglen,
    const u_char *data, size_t dlen, const char *alg, u_int compat,
    struct sshkey_sig_details **detailsp)
{
  struct sshbuf *b = NULL;
  struct sshbuf *encoded = NULL;
  char *ktype = NULL;
  const u_char *sigblob;
  const u_char *sm;
  u_char *m = NULL;
  u_char apphash[32];
  u_char msghash[32];
  u_char sig_flags;
  u_int sig_counter;
  size_t len;
  unsigned long long smlen = 0, mlen = 0;
  int r = SSH_ERR_INTERNAL_ERROR;
  int ret;
  struct sshkey_sig_details *details = NULL;

  if (detailsp != NULL)
    *detailsp = NULL;

  if (key == NULL ||
      sshkey_type_plain(key->type) != KEY_ED25519_SK ||
      key->ed25519_pk == NULL ||
      sig == NULL || siglen == 0)
    return SSH_ERR_INVALID_ARGUMENT;

  if ((b = sshbuf_from(sig, siglen)) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  if (sshbuf_get_cstring(b, &ktype, NULL) != 0 ||
      sshbuf_get_string_direct(b, &sigblob, &len) != 0 ||
      sshbuf_get_u8(b, &sig_flags) != 0 ||
      sshbuf_get_u32(b, &sig_counter) != 0) {
    r = SSH_ERR_INVALID_FORMAT;
    goto out;
  }
#ifdef DEBUG_SK
  fprintf(stderr, "%s: data:\n", __func__);
  /* sshbuf_dump_data(data, datalen, stderr); */
  fprintf(stderr, "%s: sigblob:\n", __func__);
  sshbuf_dump_data(sigblob, len, stderr);
  fprintf(stderr, "%s: sig_flags = 0x%02x, sig_counter = %u\n",
      __func__, sig_flags, sig_counter);
#endif
  if (strcmp(sshkey_ssh_name_plain(key), ktype) != 0) {
    r = SSH_ERR_KEY_TYPE_MISMATCH;
    goto out;
  }
  if (sshbuf_len(b) != 0) {
    r = SSH_ERR_UNEXPECTED_TRAILING_DATA;
    goto out;
  }
  if (len > crypto_sign_ed25519_BYTES) {
    r = SSH_ERR_INVALID_FORMAT;
    goto out;
  }
  if (ssh_digest_memory(SSH_DIGEST_SHA256, key->sk_application,
      strlen(key->sk_application), apphash, sizeof(apphash)) != 0 ||
      ssh_digest_memory(SSH_DIGEST_SHA256, data, dlen,
      msghash, sizeof(msghash)) != 0) {
    r = SSH_ERR_INVALID_ARGUMENT;
    goto out;
  }
#ifdef DEBUG_SK
  fprintf(stderr, "%s: hashed application:\n", __func__);
  sshbuf_dump_data(apphash, sizeof(apphash), stderr);
  fprintf(stderr, "%s: hashed message:\n", __func__);
  sshbuf_dump_data(msghash, sizeof(msghash), stderr);
#endif
  if ((details = calloc(1, sizeof(*details))) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  details->sk_counter = sig_counter;
  details->sk_flags = sig_flags;
  if ((encoded = sshbuf_new()) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if (sshbuf_put(encoded, sigblob, len) != 0 ||
      sshbuf_put(encoded, apphash, sizeof(apphash)) != 0 ||
      sshbuf_put_u8(encoded, sig_flags) != 0 ||
      sshbuf_put_u32(encoded, sig_counter) != 0 ||
      sshbuf_put(encoded, msghash, sizeof(msghash)) != 0) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
#ifdef DEBUG_SK
  fprintf(stderr, "%s: signed buf:\n", __func__);
  sshbuf_dump(encoded, stderr);
#endif
  sm = sshbuf_ptr(encoded);
  smlen = sshbuf_len(encoded);
  mlen = smlen;
  if ((m = malloc(smlen)) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if ((ret = crypto_sign_ed25519_open(m, &mlen, sm, smlen,
      key->ed25519_pk)) != 0) {
    debug2_f("crypto_sign_ed25519_open failed: %d", ret);
  }
  if (ret != 0 || mlen != smlen - len) {
    r = SSH_ERR_SIGNATURE_INVALID;
    goto out;
  }
  /* XXX compare 'm' and 'sm + len' ? */
  /* success */
  r = 0;
  if (detailsp != NULL) {
    *detailsp = details;
    details = NULL;
  }
 out:
  if (m != NULL)
    freezero(m, smlen); /* NB mlen may be invalid if r != 0 */
  sshkey_sig_details_free(details);
  sshbuf_free(b);
  sshbuf_free(encoded);
  free(ktype);
  return r;
}

static const struct sshkey_impl_funcs sshkey_ed25519_sk_funcs = {
  /* .size = */   NULL,
  /* .alloc = */    NULL,
  /* .cleanup = */  ssh_ed25519_sk_cleanup,
  /* .equal = */    ssh_ed25519_sk_equal,
  /* .ssh_serialize_public = */ ssh_ed25519_sk_serialize_public,
  /* .ssh_deserialize_public = */ ssh_ed25519_sk_deserialize_public,
  /* .ssh_serialize_private = */ ssh_ed25519_sk_serialize_private,
  /* .ssh_deserialize_private = */ ssh_ed25519_sk_deserialize_private,
  /* .generate = */ NULL,
  /* .copy_public = */  ssh_ed25519_sk_copy_public,
  /* .sign = */   NULL,
  /* .verify = */   ssh_ed25519_sk_verify,
};

const struct sshkey_impl sshkey_ed25519_sk_impl = {
  /* .name = */   "sk-ssh-ed25519@openssh.com",
  /* .shortname = */  "ED25519-SK",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_ED25519_SK,
  /* .nid = */    0,
  /* .cert = */   0,
  /* .sigonly = */  0,
  /* .keybits = */  256,
  /* .funcs = */    &sshkey_ed25519_sk_funcs,
};

const struct sshkey_impl sshkey_ed25519_sk_cert_impl = {
  /* .name = */   "sk-ssh-ed25519-cert-v01@openssh.com",
  /* .shortname = */  "ED25519-SK-CERT",
  /* .sigalg = */   NULL,
  /* .type = */   KEY_ED25519_SK_CERT,
  /* .nid = */    0,
  /* .cert = */   1,
  /* .sigonly = */  0,
  /* .keybits = */  256,
  /* .funcs = */    &sshkey_ed25519_sk_funcs,
};

Coverage Report

Created: 2026-01-08 06:57

Line	Count	Source
1		/* $OpenBSD: ssh-ed25519-sk.c,v 1.15 2022/10/28 00:44:44 djm Exp $ */
2		/*
3		* Copyright (c) 2019 Markus Friedl. All rights reserved.
4		*
5		* Permission to use, copy, modify, and distribute this software for any
6		* purpose with or without fee is hereby granted, provided that the above
7		* copyright notice and this permission notice appear in all copies.
8		*
9		* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10		* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11		* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12		* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13		* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14		* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15		* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16		*/
17
18		/* #define DEBUG_SK 1 */
19
20		#include "includes.h"
21
22		#define SSHKEY_INTERNAL
23		#include <sys/types.h>
24		#include <limits.h>
25
26		#include "crypto_api.h"
27
28		#include <string.h>
29		#include <stdarg.h>
30
31		#include "log.h"
32		#include "sshbuf.h"
33		#include "sshkey.h"
34		#include "ssherr.h"
35		#include "ssh.h"
36		#include "digest.h"
37
38		/* Reuse some ED25519 internals */
39		extern struct sshkey_impl_funcs sshkey_ed25519_funcs;
40
41		static void
42		ssh_ed25519_sk_cleanup(struct sshkey *k)
43	11.3k	{
44	11.3k	sshkey_sk_cleanup(k);
45	11.3k	sshkey_ed25519_funcs.cleanup(k);
46	11.3k	}
47
48		static int
49		ssh_ed25519_sk_equal(const struct sshkey a, const struct sshkey b)
50	3.99k	{
51	3.99k	if (!sshkey_sk_fields_equal(a, b))
52	0	return 0;
53	3.99k	if (!sshkey_ed25519_funcs.equal(a, b))
54	1	return 0;
55	3.99k	return 1;
56	3.99k	}
57
58		static int
59		ssh_ed25519_sk_serialize_public(const struct sshkey key, struct sshbuf b,
60		enum sshkey_serialize_rep opts)
61	563	{
62	563	int r;
63
64	563	if ((r = sshkey_ed25519_funcs.serialize_public(key, b, opts)) != 0)
65	0	return r;
66	563	if ((r = sshkey_serialize_sk(key, b)) != 0)
67	0	return r;
68
69	563	return 0;
70	563	}
71
72		static int
73		ssh_ed25519_sk_serialize_private(const struct sshkey key, struct sshbuf b,
74		enum sshkey_serialize_rep opts)
75	2	{
76	2	int r;
77
78	2	if ((r = sshkey_ed25519_funcs.serialize_public(key, b, opts)) != 0)
79	0	return r;
80	2	if ((r = sshkey_serialize_private_sk(key, b)) != 0)
81	0	return r;
82
83	2	return 0;
84	2	}
85
86		static int
87		ssh_ed25519_sk_copy_public(const struct sshkey from, struct sshkey to)
88	2	{
89	2	int r;
90
91	2	if ((r = sshkey_ed25519_funcs.copy_public(from, to)) != 0)
92	0	return r;
93	2	if ((r = sshkey_copy_public_sk(from, to)) != 0)
94	0	return r;
95	2	return 0;
96	2	}
97
98		static int
99		ssh_ed25519_sk_deserialize_public(const char ktype, struct sshbuf b,
100		struct sshkey *key)
101	7.15k	{
102	7.15k	int r;
103
104	7.15k	if ((r = sshkey_ed25519_funcs.deserialize_public(ktype, b, key)) != 0)
105	26	return r;
106	7.12k	if ((r = sshkey_deserialize_sk(b, key)) != 0)
107	9	return r;
108	7.12k	return 0;
109	7.12k	}
110
111		static int
112		ssh_ed25519_sk_deserialize_private(const char ktype, struct sshbuf b,
113		struct sshkey *key)
114	4.20k	{
115	4.20k	int r;
116
117	4.20k	if ((r = sshkey_ed25519_funcs.deserialize_public(ktype, b, key)) != 0)
118	28	return r;
119	4.17k	if ((r = sshkey_private_deserialize_sk(b, key)) != 0)
120	131	return r;
121	4.04k	return 0;
122	4.17k	}
123
124		static int
125		ssh_ed25519_sk_verify(const struct sshkey *key,
126		const u_char *sig, size_t siglen,
127		const u_char data, size_t dlen, const char alg, u_int compat,
128		struct sshkey_sig_details **detailsp)
129	670	{
130	670	struct sshbuf *b = NULL;
131	670	struct sshbuf *encoded = NULL;
132	670	char *ktype = NULL;
133	670	const u_char *sigblob;
134	670	const u_char *sm;
135	670	u_char *m = NULL;
136	670	u_char apphash[32];
137	670	u_char msghash[32];
138	670	u_char sig_flags;
139	670	u_int sig_counter;
140	670	size_t len;
141	670	unsigned long long smlen = 0, mlen = 0;
142	670	int r = SSH_ERR_INTERNAL_ERROR;
143	670	int ret;
144	670	struct sshkey_sig_details *details = NULL;
145
146	670	if (detailsp != NULL)
147	175	*detailsp = NULL;
148
149	670	if (key == NULL \|\|
150	670	sshkey_type_plain(key->type) != KEY_ED25519_SK \|\|
151	670	key->ed25519_pk == NULL \|\|
152	670	sig == NULL \|\| siglen == 0)
153	0	return SSH_ERR_INVALID_ARGUMENT;
154
155	670	if ((b = sshbuf_from(sig, siglen)) == NULL)
156	0	return SSH_ERR_ALLOC_FAIL;
157	670	if (sshbuf_get_cstring(b, &ktype, NULL) != 0 \|\|
158	623	sshbuf_get_string_direct(b, &sigblob, &len) != 0 \|\|
159	611	sshbuf_get_u8(b, &sig_flags) != 0 \|\|
160	606	sshbuf_get_u32(b, &sig_counter) != 0) {
161	68	r = SSH_ERR_INVALID_FORMAT;
162	68	goto out;
163	68	}
164		#ifdef DEBUG_SK
165		fprintf(stderr, "%s: data:\n", __func__);
166		/* sshbuf_dump_data(data, datalen, stderr); */
167		fprintf(stderr, "%s: sigblob:\n", __func__);
168		sshbuf_dump_data(sigblob, len, stderr);
169		fprintf(stderr, "%s: sig_flags = 0x%02x, sig_counter = %u\n",
170		__func__, sig_flags, sig_counter);
171		#endif
172	602	if (strcmp(sshkey_ssh_name_plain(key), ktype) != 0) {
173	401	r = SSH_ERR_KEY_TYPE_MISMATCH;
174	401	goto out;
175	401	}
176	201	if (sshbuf_len(b) != 0) {
177	11	r = SSH_ERR_UNEXPECTED_TRAILING_DATA;
178	11	goto out;
179	11	}
180	190	if (len > crypto_sign_ed25519_BYTES) {
181	3	r = SSH_ERR_INVALID_FORMAT;
182	3	goto out;
183	3	}
184	187	if (ssh_digest_memory(SSH_DIGEST_SHA256, key->sk_application,
185	187	strlen(key->sk_application), apphash, sizeof(apphash)) != 0 \|\|
186	187	ssh_digest_memory(SSH_DIGEST_SHA256, data, dlen,
187	187	msghash, sizeof(msghash)) != 0) {
188	0	r = SSH_ERR_INVALID_ARGUMENT;
189	0	goto out;
190	0	}
191		#ifdef DEBUG_SK
192		fprintf(stderr, "%s: hashed application:\n", __func__);
193		sshbuf_dump_data(apphash, sizeof(apphash), stderr);
194		fprintf(stderr, "%s: hashed message:\n", __func__);
195		sshbuf_dump_data(msghash, sizeof(msghash), stderr);
196		#endif
197	187	if ((details = calloc(1, sizeof(*details))) == NULL) {
198	0	r = SSH_ERR_ALLOC_FAIL;
199	0	goto out;
200	0	}
201	187	details->sk_counter = sig_counter;
202	187	details->sk_flags = sig_flags;
203	187	if ((encoded = sshbuf_new()) == NULL) {
204	0	r = SSH_ERR_ALLOC_FAIL;
205	0	goto out;
206	0	}
207	187	if (sshbuf_put(encoded, sigblob, len) != 0 \|\|
208	187	sshbuf_put(encoded, apphash, sizeof(apphash)) != 0 \|\|
209	187	sshbuf_put_u8(encoded, sig_flags) != 0 \|\|
210	187	sshbuf_put_u32(encoded, sig_counter) != 0 \|\|
211	187	sshbuf_put(encoded, msghash, sizeof(msghash)) != 0) {
212	0	r = SSH_ERR_ALLOC_FAIL;
213	0	goto out;
214	0	}
215		#ifdef DEBUG_SK
216		fprintf(stderr, "%s: signed buf:\n", __func__);
217		sshbuf_dump(encoded, stderr);
218		#endif
219	187	sm = sshbuf_ptr(encoded);
220	187	smlen = sshbuf_len(encoded);
221	187	mlen = smlen;
222	187	if ((m = malloc(smlen)) == NULL) {
223	0	r = SSH_ERR_ALLOC_FAIL;
224	0	goto out;
225	0	}
226	187	if ((ret = crypto_sign_ed25519_open(m, &mlen, sm, smlen,
227	187	key->ed25519_pk)) != 0) {
228	38	debug2_f("crypto_sign_ed25519_open failed: %d", ret);
229	38	}
230	187	if (ret != 0 \|\| mlen != smlen - len) {
231	38	r = SSH_ERR_SIGNATURE_INVALID;
232	38	goto out;
233	38	}
234		/* XXX compare 'm' and 'sm + len' ? */
235		/* success */
236	149	r = 0;
237	149	if (detailsp != NULL) {
238	1	*detailsp = details;
239	1	details = NULL;
240	1	}
241	670	out:
242	670	if (m != NULL)
243	187	freezero(m, smlen); /* NB mlen may be invalid if r != 0 */
244	670	sshkey_sig_details_free(details);
245	670	sshbuf_free(b);
246	670	sshbuf_free(encoded);
247	670	free(ktype);
248	670	return r;
249	149	}
250
251		static const struct sshkey_impl_funcs sshkey_ed25519_sk_funcs = {
252		/* .size = */ NULL,
253		/* .alloc = */ NULL,
254		/* .cleanup = */ ssh_ed25519_sk_cleanup,
255		/* .equal = */ ssh_ed25519_sk_equal,
256		/* .ssh_serialize_public = */ ssh_ed25519_sk_serialize_public,
257		/* .ssh_deserialize_public = */ ssh_ed25519_sk_deserialize_public,
258		/* .ssh_serialize_private = */ ssh_ed25519_sk_serialize_private,
259		/* .ssh_deserialize_private = */ ssh_ed25519_sk_deserialize_private,
260		/* .generate = */ NULL,
261		/* .copy_public = */ ssh_ed25519_sk_copy_public,
262		/* .sign = */ NULL,
263		/* .verify = */ ssh_ed25519_sk_verify,
264		};
265
266		const struct sshkey_impl sshkey_ed25519_sk_impl = {
267		/* .name = */ "sk-ssh-ed25519@openssh.com",
268		/* .shortname = */ "ED25519-SK",
269		/* .sigalg = */ NULL,
270		/* .type = */ KEY_ED25519_SK,
271		/* .nid = */ 0,
272		/* .cert = */ 0,
273		/* .sigonly = */ 0,
274		/* .keybits = */ 256,
275		/* .funcs = */ &sshkey_ed25519_sk_funcs,
276		};
277
278		const struct sshkey_impl sshkey_ed25519_sk_cert_impl = {
279		/* .name = */ "sk-ssh-ed25519-cert-v01@openssh.com",
280		/* .shortname = */ "ED25519-SK-CERT",
281		/* .sigalg = */ NULL,
282		/* .type = */ KEY_ED25519_SK_CERT,
283		/* .nid = */ 0,
284		/* .cert = */ 1,
285		/* .sigonly = */ 0,
286		/* .keybits = */ 256,
287		/* .funcs = */ &sshkey_ed25519_sk_funcs,
288		};