key.c revision 240075
1/* $OpenBSD: key.c,v 1.99 2012/05/23 03:28:28 djm Exp $ */ 2/* 3 * read_bignum(): 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5 * 6 * As far as I am concerned, the code I have written for this software 7 * can be used freely for any purpose. Any derived versions of this 8 * software must be clearly marked as such, and if the derived work is 9 * incompatible with the protocol description in the RFC file, it must be 10 * called by a name other than "ssh" or "Secure Shell". 11 * 12 * 13 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 14 * Copyright (c) 2008 Alexander von Gernler. All rights reserved. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions 18 * are met: 19 * 1. Redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer. 21 * 2. Redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35 */ 36 37#include "includes.h" 38 39#include <sys/param.h> 40#include <sys/types.h> 41 42#include <openssl/evp.h> 43#include <openbsd-compat/openssl-compat.h> 44 45#include <stdarg.h> 46#include <stdio.h> 47#include <string.h> 48 49#include "xmalloc.h" 50#include "key.h" 51#include "rsa.h" 52#include "uuencode.h" 53#include "buffer.h" 54#include "log.h" 55#include "misc.h" 56#include "ssh2.h" 57 58static struct KeyCert * 59cert_new(void) 60{ 61 struct KeyCert *cert; 62 63 cert = xcalloc(1, sizeof(*cert)); 64 buffer_init(&cert->certblob); 65 buffer_init(&cert->critical); 66 buffer_init(&cert->extensions); 67 cert->key_id = NULL; 68 cert->principals = NULL; 69 cert->signature_key = NULL; 70 return cert; 71} 72 73Key * 74key_new(int type) 75{ 76 Key *k; 77 RSA *rsa; 78 DSA *dsa; 79 k = xcalloc(1, sizeof(*k)); 80 k->type = type; 81 k->ecdsa = NULL; 82 k->ecdsa_nid = -1; 83 k->dsa = NULL; 84 k->rsa = NULL; 85 k->cert = NULL; 86 switch (k->type) { 87 case KEY_RSA1: 88 case KEY_RSA: 89 case KEY_RSA_CERT_V00: 90 case KEY_RSA_CERT: 91 if ((rsa = RSA_new()) == NULL) 92 fatal("key_new: RSA_new failed"); 93 if ((rsa->n = BN_new()) == NULL) 94 fatal("key_new: BN_new failed"); 95 if ((rsa->e = BN_new()) == NULL) 96 fatal("key_new: BN_new failed"); 97 k->rsa = rsa; 98 break; 99 case KEY_DSA: 100 case KEY_DSA_CERT_V00: 101 case KEY_DSA_CERT: 102 if ((dsa = DSA_new()) == NULL) 103 fatal("key_new: DSA_new failed"); 104 if ((dsa->p = BN_new()) == NULL) 105 fatal("key_new: BN_new failed"); 106 if ((dsa->q = BN_new()) == NULL) 107 fatal("key_new: BN_new failed"); 108 if ((dsa->g = BN_new()) == NULL) 109 fatal("key_new: BN_new failed"); 110 if ((dsa->pub_key = BN_new()) == NULL) 111 fatal("key_new: BN_new failed"); 112 k->dsa = dsa; 113 break; 114#ifdef OPENSSL_HAS_ECC 115 case KEY_ECDSA: 116 case KEY_ECDSA_CERT: 117 /* Cannot do anything until we know the group */ 118 break; 119#endif 120 case KEY_UNSPEC: 121 break; 122 default: 123 fatal("key_new: bad key type %d", k->type); 124 break; 125 } 126 127 if (key_is_cert(k)) 128 k->cert = cert_new(); 129 130 return k; 131} 132 133void 134key_add_private(Key *k) 135{ 136 switch (k->type) { 137 case KEY_RSA1: 138 case KEY_RSA: 139 case KEY_RSA_CERT_V00: 140 case KEY_RSA_CERT: 141 if ((k->rsa->d = BN_new()) == NULL) 142 fatal("key_new_private: BN_new failed"); 143 if ((k->rsa->iqmp = BN_new()) == NULL) 144 fatal("key_new_private: BN_new failed"); 145 if ((k->rsa->q = BN_new()) == NULL) 146 fatal("key_new_private: BN_new failed"); 147 if ((k->rsa->p = BN_new()) == NULL) 148 fatal("key_new_private: BN_new failed"); 149 if ((k->rsa->dmq1 = BN_new()) == NULL) 150 fatal("key_new_private: BN_new failed"); 151 if ((k->rsa->dmp1 = BN_new()) == NULL) 152 fatal("key_new_private: BN_new failed"); 153 break; 154 case KEY_DSA: 155 case KEY_DSA_CERT_V00: 156 case KEY_DSA_CERT: 157 if ((k->dsa->priv_key = BN_new()) == NULL) 158 fatal("key_new_private: BN_new failed"); 159 break; 160 case KEY_ECDSA: 161 case KEY_ECDSA_CERT: 162 /* Cannot do anything until we know the group */ 163 break; 164 case KEY_UNSPEC: 165 break; 166 default: 167 break; 168 } 169} 170 171Key * 172key_new_private(int type) 173{ 174 Key *k = key_new(type); 175 176 key_add_private(k); 177 return k; 178} 179 180static void 181cert_free(struct KeyCert *cert) 182{ 183 u_int i; 184 185 buffer_free(&cert->certblob); 186 buffer_free(&cert->critical); 187 buffer_free(&cert->extensions); 188 if (cert->key_id != NULL) 189 xfree(cert->key_id); 190 for (i = 0; i < cert->nprincipals; i++) 191 xfree(cert->principals[i]); 192 if (cert->principals != NULL) 193 xfree(cert->principals); 194 if (cert->signature_key != NULL) 195 key_free(cert->signature_key); 196} 197 198void 199key_free(Key *k) 200{ 201 if (k == NULL) 202 fatal("key_free: key is NULL"); 203 switch (k->type) { 204 case KEY_RSA1: 205 case KEY_RSA: 206 case KEY_RSA_CERT_V00: 207 case KEY_RSA_CERT: 208 if (k->rsa != NULL) 209 RSA_free(k->rsa); 210 k->rsa = NULL; 211 break; 212 case KEY_DSA: 213 case KEY_DSA_CERT_V00: 214 case KEY_DSA_CERT: 215 if (k->dsa != NULL) 216 DSA_free(k->dsa); 217 k->dsa = NULL; 218 break; 219#ifdef OPENSSL_HAS_ECC 220 case KEY_ECDSA: 221 case KEY_ECDSA_CERT: 222 if (k->ecdsa != NULL) 223 EC_KEY_free(k->ecdsa); 224 k->ecdsa = NULL; 225 break; 226#endif 227 case KEY_UNSPEC: 228 break; 229 default: 230 fatal("key_free: bad key type %d", k->type); 231 break; 232 } 233 if (key_is_cert(k)) { 234 if (k->cert != NULL) 235 cert_free(k->cert); 236 k->cert = NULL; 237 } 238 239 xfree(k); 240} 241 242static int 243cert_compare(struct KeyCert *a, struct KeyCert *b) 244{ 245 if (a == NULL && b == NULL) 246 return 1; 247 if (a == NULL || b == NULL) 248 return 0; 249 if (buffer_len(&a->certblob) != buffer_len(&b->certblob)) 250 return 0; 251 if (timingsafe_bcmp(buffer_ptr(&a->certblob), buffer_ptr(&b->certblob), 252 buffer_len(&a->certblob)) != 0) 253 return 0; 254 return 1; 255} 256 257/* 258 * Compare public portions of key only, allowing comparisons between 259 * certificates and plain keys too. 260 */ 261int 262key_equal_public(const Key *a, const Key *b) 263{ 264#ifdef OPENSSL_HAS_ECC 265 BN_CTX *bnctx; 266#endif 267 268 if (a == NULL || b == NULL || 269 key_type_plain(a->type) != key_type_plain(b->type)) 270 return 0; 271 272 switch (a->type) { 273 case KEY_RSA1: 274 case KEY_RSA_CERT_V00: 275 case KEY_RSA_CERT: 276 case KEY_RSA: 277 return a->rsa != NULL && b->rsa != NULL && 278 BN_cmp(a->rsa->e, b->rsa->e) == 0 && 279 BN_cmp(a->rsa->n, b->rsa->n) == 0; 280 case KEY_DSA_CERT_V00: 281 case KEY_DSA_CERT: 282 case KEY_DSA: 283 return a->dsa != NULL && b->dsa != NULL && 284 BN_cmp(a->dsa->p, b->dsa->p) == 0 && 285 BN_cmp(a->dsa->q, b->dsa->q) == 0 && 286 BN_cmp(a->dsa->g, b->dsa->g) == 0 && 287 BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0; 288#ifdef OPENSSL_HAS_ECC 289 case KEY_ECDSA_CERT: 290 case KEY_ECDSA: 291 if (a->ecdsa == NULL || b->ecdsa == NULL || 292 EC_KEY_get0_public_key(a->ecdsa) == NULL || 293 EC_KEY_get0_public_key(b->ecdsa) == NULL) 294 return 0; 295 if ((bnctx = BN_CTX_new()) == NULL) 296 fatal("%s: BN_CTX_new failed", __func__); 297 if (EC_GROUP_cmp(EC_KEY_get0_group(a->ecdsa), 298 EC_KEY_get0_group(b->ecdsa), bnctx) != 0 || 299 EC_POINT_cmp(EC_KEY_get0_group(a->ecdsa), 300 EC_KEY_get0_public_key(a->ecdsa), 301 EC_KEY_get0_public_key(b->ecdsa), bnctx) != 0) { 302 BN_CTX_free(bnctx); 303 return 0; 304 } 305 BN_CTX_free(bnctx); 306 return 1; 307#endif /* OPENSSL_HAS_ECC */ 308 default: 309 fatal("key_equal: bad key type %d", a->type); 310 } 311 /* NOTREACHED */ 312} 313 314int 315key_equal(const Key *a, const Key *b) 316{ 317 if (a == NULL || b == NULL || a->type != b->type) 318 return 0; 319 if (key_is_cert(a)) { 320 if (!cert_compare(a->cert, b->cert)) 321 return 0; 322 } 323 return key_equal_public(a, b); 324} 325 326u_char* 327key_fingerprint_raw(Key *k, enum fp_type dgst_type, u_int *dgst_raw_length) 328{ 329 const EVP_MD *md = NULL; 330 EVP_MD_CTX ctx; 331 u_char *blob = NULL; 332 u_char *retval = NULL; 333 u_int len = 0; 334 int nlen, elen, otype; 335 336 *dgst_raw_length = 0; 337 338 switch (dgst_type) { 339 case SSH_FP_MD5: 340 md = EVP_md5(); 341 break; 342 case SSH_FP_SHA1: 343 md = EVP_sha1(); 344 break; 345#ifdef HAVE_EVP_SHA256 346 case SSH_FP_SHA256: 347 md = EVP_sha256(); 348 break; 349#endif 350 default: 351 fatal("key_fingerprint_raw: bad digest type %d", 352 dgst_type); 353 } 354 switch (k->type) { 355 case KEY_RSA1: 356 nlen = BN_num_bytes(k->rsa->n); 357 elen = BN_num_bytes(k->rsa->e); 358 len = nlen + elen; 359 blob = xmalloc(len); 360 BN_bn2bin(k->rsa->n, blob); 361 BN_bn2bin(k->rsa->e, blob + nlen); 362 break; 363 case KEY_DSA: 364 case KEY_ECDSA: 365 case KEY_RSA: 366 key_to_blob(k, &blob, &len); 367 break; 368 case KEY_DSA_CERT_V00: 369 case KEY_RSA_CERT_V00: 370 case KEY_DSA_CERT: 371 case KEY_ECDSA_CERT: 372 case KEY_RSA_CERT: 373 /* We want a fingerprint of the _key_ not of the cert */ 374 otype = k->type; 375 k->type = key_type_plain(k->type); 376 key_to_blob(k, &blob, &len); 377 k->type = otype; 378 break; 379 case KEY_UNSPEC: 380 return retval; 381 default: 382 fatal("key_fingerprint_raw: bad key type %d", k->type); 383 break; 384 } 385 if (blob != NULL) { 386 retval = xmalloc(EVP_MAX_MD_SIZE); 387 EVP_DigestInit(&ctx, md); 388 EVP_DigestUpdate(&ctx, blob, len); 389 EVP_DigestFinal(&ctx, retval, dgst_raw_length); 390 memset(blob, 0, len); 391 xfree(blob); 392 } else { 393 fatal("key_fingerprint_raw: blob is null"); 394 } 395 return retval; 396} 397 398static char * 399key_fingerprint_hex(u_char *dgst_raw, u_int dgst_raw_len) 400{ 401 char *retval; 402 u_int i; 403 404 retval = xcalloc(1, dgst_raw_len * 3 + 1); 405 for (i = 0; i < dgst_raw_len; i++) { 406 char hex[4]; 407 snprintf(hex, sizeof(hex), "%02x:", dgst_raw[i]); 408 strlcat(retval, hex, dgst_raw_len * 3 + 1); 409 } 410 411 /* Remove the trailing ':' character */ 412 retval[(dgst_raw_len * 3) - 1] = '\0'; 413 return retval; 414} 415 416static char * 417key_fingerprint_bubblebabble(u_char *dgst_raw, u_int dgst_raw_len) 418{ 419 char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' }; 420 char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm', 421 'n', 'p', 'r', 's', 't', 'v', 'z', 'x' }; 422 u_int i, j = 0, rounds, seed = 1; 423 char *retval; 424 425 rounds = (dgst_raw_len / 2) + 1; 426 retval = xcalloc((rounds * 6), sizeof(char)); 427 retval[j++] = 'x'; 428 for (i = 0; i < rounds; i++) { 429 u_int idx0, idx1, idx2, idx3, idx4; 430 if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) { 431 idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) + 432 seed) % 6; 433 idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15; 434 idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) + 435 (seed / 6)) % 6; 436 retval[j++] = vowels[idx0]; 437 retval[j++] = consonants[idx1]; 438 retval[j++] = vowels[idx2]; 439 if ((i + 1) < rounds) { 440 idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15; 441 idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15; 442 retval[j++] = consonants[idx3]; 443 retval[j++] = '-'; 444 retval[j++] = consonants[idx4]; 445 seed = ((seed * 5) + 446 ((((u_int)(dgst_raw[2 * i])) * 7) + 447 ((u_int)(dgst_raw[(2 * i) + 1])))) % 36; 448 } 449 } else { 450 idx0 = seed % 6; 451 idx1 = 16; 452 idx2 = seed / 6; 453 retval[j++] = vowels[idx0]; 454 retval[j++] = consonants[idx1]; 455 retval[j++] = vowels[idx2]; 456 } 457 } 458 retval[j++] = 'x'; 459 retval[j++] = '\0'; 460 return retval; 461} 462 463/* 464 * Draw an ASCII-Art representing the fingerprint so human brain can 465 * profit from its built-in pattern recognition ability. 466 * This technique is called "random art" and can be found in some 467 * scientific publications like this original paper: 468 * 469 * "Hash Visualization: a New Technique to improve Real-World Security", 470 * Perrig A. and Song D., 1999, International Workshop on Cryptographic 471 * Techniques and E-Commerce (CrypTEC '99) 472 * sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf 473 * 474 * The subject came up in a talk by Dan Kaminsky, too. 475 * 476 * If you see the picture is different, the key is different. 477 * If the picture looks the same, you still know nothing. 478 * 479 * The algorithm used here is a worm crawling over a discrete plane, 480 * leaving a trace (augmenting the field) everywhere it goes. 481 * Movement is taken from dgst_raw 2bit-wise. Bumping into walls 482 * makes the respective movement vector be ignored for this turn. 483 * Graphs are not unambiguous, because circles in graphs can be 484 * walked in either direction. 485 */ 486 487/* 488 * Field sizes for the random art. Have to be odd, so the starting point 489 * can be in the exact middle of the picture, and FLDBASE should be >=8 . 490 * Else pictures would be too dense, and drawing the frame would 491 * fail, too, because the key type would not fit in anymore. 492 */ 493#define FLDBASE 8 494#define FLDSIZE_Y (FLDBASE + 1) 495#define FLDSIZE_X (FLDBASE * 2 + 1) 496static char * 497key_fingerprint_randomart(u_char *dgst_raw, u_int dgst_raw_len, const Key *k) 498{ 499 /* 500 * Chars to be used after each other every time the worm 501 * intersects with itself. Matter of taste. 502 */ 503 char *augmentation_string = " .o+=*BOX@%&#/^SE"; 504 char *retval, *p; 505 u_char field[FLDSIZE_X][FLDSIZE_Y]; 506 u_int i, b; 507 int x, y; 508 size_t len = strlen(augmentation_string) - 1; 509 510 retval = xcalloc(1, (FLDSIZE_X + 3) * (FLDSIZE_Y + 2)); 511 512 /* initialize field */ 513 memset(field, 0, FLDSIZE_X * FLDSIZE_Y * sizeof(char)); 514 x = FLDSIZE_X / 2; 515 y = FLDSIZE_Y / 2; 516 517 /* process raw key */ 518 for (i = 0; i < dgst_raw_len; i++) { 519 int input; 520 /* each byte conveys four 2-bit move commands */ 521 input = dgst_raw[i]; 522 for (b = 0; b < 4; b++) { 523 /* evaluate 2 bit, rest is shifted later */ 524 x += (input & 0x1) ? 1 : -1; 525 y += (input & 0x2) ? 1 : -1; 526 527 /* assure we are still in bounds */ 528 x = MAX(x, 0); 529 y = MAX(y, 0); 530 x = MIN(x, FLDSIZE_X - 1); 531 y = MIN(y, FLDSIZE_Y - 1); 532 533 /* augment the field */ 534 if (field[x][y] < len - 2) 535 field[x][y]++; 536 input = input >> 2; 537 } 538 } 539 540 /* mark starting point and end point*/ 541 field[FLDSIZE_X / 2][FLDSIZE_Y / 2] = len - 1; 542 field[x][y] = len; 543 544 /* fill in retval */ 545 snprintf(retval, FLDSIZE_X, "+--[%4s %4u]", key_type(k), key_size(k)); 546 p = strchr(retval, '\0'); 547 548 /* output upper border */ 549 for (i = p - retval - 1; i < FLDSIZE_X; i++) 550 *p++ = '-'; 551 *p++ = '+'; 552 *p++ = '\n'; 553 554 /* output content */ 555 for (y = 0; y < FLDSIZE_Y; y++) { 556 *p++ = '|'; 557 for (x = 0; x < FLDSIZE_X; x++) 558 *p++ = augmentation_string[MIN(field[x][y], len)]; 559 *p++ = '|'; 560 *p++ = '\n'; 561 } 562 563 /* output lower border */ 564 *p++ = '+'; 565 for (i = 0; i < FLDSIZE_X; i++) 566 *p++ = '-'; 567 *p++ = '+'; 568 569 return retval; 570} 571 572char * 573key_fingerprint(Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep) 574{ 575 char *retval = NULL; 576 u_char *dgst_raw; 577 u_int dgst_raw_len; 578 579 dgst_raw = key_fingerprint_raw(k, dgst_type, &dgst_raw_len); 580 if (!dgst_raw) 581 fatal("key_fingerprint: null from key_fingerprint_raw()"); 582 switch (dgst_rep) { 583 case SSH_FP_HEX: 584 retval = key_fingerprint_hex(dgst_raw, dgst_raw_len); 585 break; 586 case SSH_FP_BUBBLEBABBLE: 587 retval = key_fingerprint_bubblebabble(dgst_raw, dgst_raw_len); 588 break; 589 case SSH_FP_RANDOMART: 590 retval = key_fingerprint_randomart(dgst_raw, dgst_raw_len, k); 591 break; 592 default: 593 fatal("key_fingerprint: bad digest representation %d", 594 dgst_rep); 595 break; 596 } 597 memset(dgst_raw, 0, dgst_raw_len); 598 xfree(dgst_raw); 599 return retval; 600} 601 602/* 603 * Reads a multiple-precision integer in decimal from the buffer, and advances 604 * the pointer. The integer must already be initialized. This function is 605 * permitted to modify the buffer. This leaves *cpp to point just beyond the 606 * last processed (and maybe modified) character. Note that this may modify 607 * the buffer containing the number. 608 */ 609static int 610read_bignum(char **cpp, BIGNUM * value) 611{ 612 char *cp = *cpp; 613 int old; 614 615 /* Skip any leading whitespace. */ 616 for (; *cp == ' ' || *cp == '\t'; cp++) 617 ; 618 619 /* Check that it begins with a decimal digit. */ 620 if (*cp < '0' || *cp > '9') 621 return 0; 622 623 /* Save starting position. */ 624 *cpp = cp; 625 626 /* Move forward until all decimal digits skipped. */ 627 for (; *cp >= '0' && *cp <= '9'; cp++) 628 ; 629 630 /* Save the old terminating character, and replace it by \0. */ 631 old = *cp; 632 *cp = 0; 633 634 /* Parse the number. */ 635 if (BN_dec2bn(&value, *cpp) == 0) 636 return 0; 637 638 /* Restore old terminating character. */ 639 *cp = old; 640 641 /* Move beyond the number and return success. */ 642 *cpp = cp; 643 return 1; 644} 645 646static int 647write_bignum(FILE *f, BIGNUM *num) 648{ 649 char *buf = BN_bn2dec(num); 650 if (buf == NULL) { 651 error("write_bignum: BN_bn2dec() failed"); 652 return 0; 653 } 654 fprintf(f, " %s", buf); 655 OPENSSL_free(buf); 656 return 1; 657} 658 659/* returns 1 ok, -1 error */ 660int 661key_read(Key *ret, char **cpp) 662{ 663 Key *k; 664 int success = -1; 665 char *cp, *space; 666 int len, n, type; 667 u_int bits; 668 u_char *blob; 669#ifdef OPENSSL_HAS_ECC 670 int curve_nid = -1; 671#endif 672 673 cp = *cpp; 674 675 switch (ret->type) { 676 case KEY_RSA1: 677 /* Get number of bits. */ 678 if (*cp < '0' || *cp > '9') 679 return -1; /* Bad bit count... */ 680 for (bits = 0; *cp >= '0' && *cp <= '9'; cp++) 681 bits = 10 * bits + *cp - '0'; 682 if (bits == 0) 683 return -1; 684 *cpp = cp; 685 /* Get public exponent, public modulus. */ 686 if (!read_bignum(cpp, ret->rsa->e)) 687 return -1; 688 if (!read_bignum(cpp, ret->rsa->n)) 689 return -1; 690 /* validate the claimed number of bits */ 691 if ((u_int)BN_num_bits(ret->rsa->n) != bits) { 692 verbose("key_read: claimed key size %d does not match " 693 "actual %d", bits, BN_num_bits(ret->rsa->n)); 694 return -1; 695 } 696 success = 1; 697 break; 698 case KEY_UNSPEC: 699 case KEY_RSA: 700 case KEY_DSA: 701 case KEY_ECDSA: 702 case KEY_DSA_CERT_V00: 703 case KEY_RSA_CERT_V00: 704 case KEY_DSA_CERT: 705 case KEY_ECDSA_CERT: 706 case KEY_RSA_CERT: 707 space = strchr(cp, ' '); 708 if (space == NULL) { 709 debug3("key_read: missing whitespace"); 710 return -1; 711 } 712 *space = '\0'; 713 type = key_type_from_name(cp); 714#ifdef OPENSSL_HAS_ECC 715 if (key_type_plain(type) == KEY_ECDSA && 716 (curve_nid = key_ecdsa_nid_from_name(cp)) == -1) { 717 debug("key_read: invalid curve"); 718 return -1; 719 } 720#endif 721 *space = ' '; 722 if (type == KEY_UNSPEC) { 723 debug3("key_read: missing keytype"); 724 return -1; 725 } 726 cp = space+1; 727 if (*cp == '\0') { 728 debug3("key_read: short string"); 729 return -1; 730 } 731 if (ret->type == KEY_UNSPEC) { 732 ret->type = type; 733 } else if (ret->type != type) { 734 /* is a key, but different type */ 735 debug3("key_read: type mismatch"); 736 return -1; 737 } 738 len = 2*strlen(cp); 739 blob = xmalloc(len); 740 n = uudecode(cp, blob, len); 741 if (n < 0) { 742 error("key_read: uudecode %s failed", cp); 743 xfree(blob); 744 return -1; 745 } 746 k = key_from_blob(blob, (u_int)n); 747 xfree(blob); 748 if (k == NULL) { 749 error("key_read: key_from_blob %s failed", cp); 750 return -1; 751 } 752 if (k->type != type) { 753 error("key_read: type mismatch: encoding error"); 754 key_free(k); 755 return -1; 756 } 757#ifdef OPENSSL_HAS_ECC 758 if (key_type_plain(type) == KEY_ECDSA && 759 curve_nid != k->ecdsa_nid) { 760 error("key_read: type mismatch: EC curve mismatch"); 761 key_free(k); 762 return -1; 763 } 764#endif 765/*XXXX*/ 766 if (key_is_cert(ret)) { 767 if (!key_is_cert(k)) { 768 error("key_read: loaded key is not a cert"); 769 key_free(k); 770 return -1; 771 } 772 if (ret->cert != NULL) 773 cert_free(ret->cert); 774 ret->cert = k->cert; 775 k->cert = NULL; 776 } 777 if (key_type_plain(ret->type) == KEY_RSA) { 778 if (ret->rsa != NULL) 779 RSA_free(ret->rsa); 780 ret->rsa = k->rsa; 781 k->rsa = NULL; 782#ifdef DEBUG_PK 783 RSA_print_fp(stderr, ret->rsa, 8); 784#endif 785 } 786 if (key_type_plain(ret->type) == KEY_DSA) { 787 if (ret->dsa != NULL) 788 DSA_free(ret->dsa); 789 ret->dsa = k->dsa; 790 k->dsa = NULL; 791#ifdef DEBUG_PK 792 DSA_print_fp(stderr, ret->dsa, 8); 793#endif 794 } 795#ifdef OPENSSL_HAS_ECC 796 if (key_type_plain(ret->type) == KEY_ECDSA) { 797 if (ret->ecdsa != NULL) 798 EC_KEY_free(ret->ecdsa); 799 ret->ecdsa = k->ecdsa; 800 ret->ecdsa_nid = k->ecdsa_nid; 801 k->ecdsa = NULL; 802 k->ecdsa_nid = -1; 803#ifdef DEBUG_PK 804 key_dump_ec_key(ret->ecdsa); 805#endif 806 } 807#endif 808 success = 1; 809/*XXXX*/ 810 key_free(k); 811 if (success != 1) 812 break; 813 /* advance cp: skip whitespace and data */ 814 while (*cp == ' ' || *cp == '\t') 815 cp++; 816 while (*cp != '\0' && *cp != ' ' && *cp != '\t') 817 cp++; 818 *cpp = cp; 819 break; 820 default: 821 fatal("key_read: bad key type: %d", ret->type); 822 break; 823 } 824 return success; 825} 826 827int 828key_write(const Key *key, FILE *f) 829{ 830 int n, success = 0; 831 u_int len, bits = 0; 832 u_char *blob; 833 char *uu; 834 835 if (key_is_cert(key)) { 836 if (key->cert == NULL) { 837 error("%s: no cert data", __func__); 838 return 0; 839 } 840 if (buffer_len(&key->cert->certblob) == 0) { 841 error("%s: no signed certificate blob", __func__); 842 return 0; 843 } 844 } 845 846 switch (key->type) { 847 case KEY_RSA1: 848 if (key->rsa == NULL) 849 return 0; 850 /* size of modulus 'n' */ 851 bits = BN_num_bits(key->rsa->n); 852 fprintf(f, "%u", bits); 853 if (write_bignum(f, key->rsa->e) && 854 write_bignum(f, key->rsa->n)) 855 return 1; 856 error("key_write: failed for RSA key"); 857 return 0; 858 case KEY_DSA: 859 case KEY_DSA_CERT_V00: 860 case KEY_DSA_CERT: 861 if (key->dsa == NULL) 862 return 0; 863 break; 864#ifdef OPENSSL_HAS_ECC 865 case KEY_ECDSA: 866 case KEY_ECDSA_CERT: 867 if (key->ecdsa == NULL) 868 return 0; 869 break; 870#endif 871 case KEY_RSA: 872 case KEY_RSA_CERT_V00: 873 case KEY_RSA_CERT: 874 if (key->rsa == NULL) 875 return 0; 876 break; 877 default: 878 return 0; 879 } 880 881 key_to_blob(key, &blob, &len); 882 uu = xmalloc(2*len); 883 n = uuencode(blob, len, uu, 2*len); 884 if (n > 0) { 885 fprintf(f, "%s %s", key_ssh_name(key), uu); 886 success = 1; 887 } 888 xfree(blob); 889 xfree(uu); 890 891 return success; 892} 893 894const char * 895key_type(const Key *k) 896{ 897 switch (k->type) { 898 case KEY_RSA1: 899 return "RSA1"; 900 case KEY_RSA: 901 return "RSA"; 902 case KEY_DSA: 903 return "DSA"; 904#ifdef OPENSSL_HAS_ECC 905 case KEY_ECDSA: 906 return "ECDSA"; 907#endif 908 case KEY_RSA_CERT_V00: 909 return "RSA-CERT-V00"; 910 case KEY_DSA_CERT_V00: 911 return "DSA-CERT-V00"; 912 case KEY_RSA_CERT: 913 return "RSA-CERT"; 914 case KEY_DSA_CERT: 915 return "DSA-CERT"; 916#ifdef OPENSSL_HAS_ECC 917 case KEY_ECDSA_CERT: 918 return "ECDSA-CERT"; 919#endif 920 } 921 return "unknown"; 922} 923 924const char * 925key_cert_type(const Key *k) 926{ 927 switch (k->cert->type) { 928 case SSH2_CERT_TYPE_USER: 929 return "user"; 930 case SSH2_CERT_TYPE_HOST: 931 return "host"; 932 default: 933 return "unknown"; 934 } 935} 936 937static const char * 938key_ssh_name_from_type_nid(int type, int nid) 939{ 940 switch (type) { 941 case KEY_RSA: 942 return "ssh-rsa"; 943 case KEY_DSA: 944 return "ssh-dss"; 945 case KEY_RSA_CERT_V00: 946 return "ssh-rsa-cert-v00@openssh.com"; 947 case KEY_DSA_CERT_V00: 948 return "ssh-dss-cert-v00@openssh.com"; 949 case KEY_RSA_CERT: 950 return "ssh-rsa-cert-v01@openssh.com"; 951 case KEY_DSA_CERT: 952 return "ssh-dss-cert-v01@openssh.com"; 953#ifdef OPENSSL_HAS_ECC 954 case KEY_ECDSA: 955 switch (nid) { 956 case NID_X9_62_prime256v1: 957 return "ecdsa-sha2-nistp256"; 958 case NID_secp384r1: 959 return "ecdsa-sha2-nistp384"; 960 case NID_secp521r1: 961 return "ecdsa-sha2-nistp521"; 962 default: 963 break; 964 } 965 break; 966 case KEY_ECDSA_CERT: 967 switch (nid) { 968 case NID_X9_62_prime256v1: 969 return "ecdsa-sha2-nistp256-cert-v01@openssh.com"; 970 case NID_secp384r1: 971 return "ecdsa-sha2-nistp384-cert-v01@openssh.com"; 972 case NID_secp521r1: 973 return "ecdsa-sha2-nistp521-cert-v01@openssh.com"; 974 default: 975 break; 976 } 977 break; 978#endif /* OPENSSL_HAS_ECC */ 979 } 980 return "ssh-unknown"; 981} 982 983const char * 984key_ssh_name(const Key *k) 985{ 986 return key_ssh_name_from_type_nid(k->type, k->ecdsa_nid); 987} 988 989const char * 990key_ssh_name_plain(const Key *k) 991{ 992 return key_ssh_name_from_type_nid(key_type_plain(k->type), 993 k->ecdsa_nid); 994} 995 996u_int 997key_size(const Key *k) 998{ 999 switch (k->type) { 1000 case KEY_RSA1: 1001 case KEY_RSA: 1002 case KEY_RSA_CERT_V00: 1003 case KEY_RSA_CERT: 1004 return BN_num_bits(k->rsa->n); 1005 case KEY_DSA: 1006 case KEY_DSA_CERT_V00: 1007 case KEY_DSA_CERT: 1008 return BN_num_bits(k->dsa->p); 1009#ifdef OPENSSL_HAS_ECC 1010 case KEY_ECDSA: 1011 case KEY_ECDSA_CERT: 1012 return key_curve_nid_to_bits(k->ecdsa_nid); 1013#endif 1014 } 1015 return 0; 1016} 1017 1018static RSA * 1019rsa_generate_private_key(u_int bits) 1020{ 1021 RSA *private = RSA_new(); 1022 BIGNUM *f4 = BN_new(); 1023 1024 if (private == NULL) 1025 fatal("%s: RSA_new failed", __func__); 1026 if (f4 == NULL) 1027 fatal("%s: BN_new failed", __func__); 1028 if (!BN_set_word(f4, RSA_F4)) 1029 fatal("%s: BN_new failed", __func__); 1030 if (!RSA_generate_key_ex(private, bits, f4, NULL)) 1031 fatal("%s: key generation failed.", __func__); 1032 BN_free(f4); 1033 return private; 1034} 1035 1036static DSA* 1037dsa_generate_private_key(u_int bits) 1038{ 1039 DSA *private = DSA_new(); 1040 1041 if (private == NULL) 1042 fatal("%s: DSA_new failed", __func__); 1043 if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL, 1044 NULL, NULL)) 1045 fatal("%s: DSA_generate_parameters failed", __func__); 1046 if (!DSA_generate_key(private)) 1047 fatal("%s: DSA_generate_key failed.", __func__); 1048 return private; 1049} 1050 1051int 1052key_ecdsa_bits_to_nid(int bits) 1053{ 1054 switch (bits) { 1055#ifdef OPENSSL_HAS_ECC 1056 case 256: 1057 return NID_X9_62_prime256v1; 1058 case 384: 1059 return NID_secp384r1; 1060 case 521: 1061 return NID_secp521r1; 1062#endif 1063 default: 1064 return -1; 1065 } 1066} 1067 1068#ifdef OPENSSL_HAS_ECC 1069int 1070key_ecdsa_key_to_nid(EC_KEY *k) 1071{ 1072 EC_GROUP *eg; 1073 int nids[] = { 1074 NID_X9_62_prime256v1, 1075 NID_secp384r1, 1076 NID_secp521r1, 1077 -1 1078 }; 1079 int nid; 1080 u_int i; 1081 BN_CTX *bnctx; 1082 const EC_GROUP *g = EC_KEY_get0_group(k); 1083 1084 /* 1085 * The group may be stored in a ASN.1 encoded private key in one of two 1086 * ways: as a "named group", which is reconstituted by ASN.1 object ID 1087 * or explicit group parameters encoded into the key blob. Only the 1088 * "named group" case sets the group NID for us, but we can figure 1089 * it out for the other case by comparing against all the groups that 1090 * are supported. 1091 */ 1092 if ((nid = EC_GROUP_get_curve_name(g)) > 0) 1093 return nid; 1094 if ((bnctx = BN_CTX_new()) == NULL) 1095 fatal("%s: BN_CTX_new() failed", __func__); 1096 for (i = 0; nids[i] != -1; i++) { 1097 if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL) 1098 fatal("%s: EC_GROUP_new_by_curve_name failed", 1099 __func__); 1100 if (EC_GROUP_cmp(g, eg, bnctx) == 0) 1101 break; 1102 EC_GROUP_free(eg); 1103 } 1104 BN_CTX_free(bnctx); 1105 debug3("%s: nid = %d", __func__, nids[i]); 1106 if (nids[i] != -1) { 1107 /* Use the group with the NID attached */ 1108 EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE); 1109 if (EC_KEY_set_group(k, eg) != 1) 1110 fatal("%s: EC_KEY_set_group", __func__); 1111 } 1112 return nids[i]; 1113} 1114 1115static EC_KEY* 1116ecdsa_generate_private_key(u_int bits, int *nid) 1117{ 1118 EC_KEY *private; 1119 1120 if ((*nid = key_ecdsa_bits_to_nid(bits)) == -1) 1121 fatal("%s: invalid key length", __func__); 1122 if ((private = EC_KEY_new_by_curve_name(*nid)) == NULL) 1123 fatal("%s: EC_KEY_new_by_curve_name failed", __func__); 1124 if (EC_KEY_generate_key(private) != 1) 1125 fatal("%s: EC_KEY_generate_key failed", __func__); 1126 EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE); 1127 return private; 1128} 1129#endif /* OPENSSL_HAS_ECC */ 1130 1131Key * 1132key_generate(int type, u_int bits) 1133{ 1134 Key *k = key_new(KEY_UNSPEC); 1135 switch (type) { 1136 case KEY_DSA: 1137 k->dsa = dsa_generate_private_key(bits); 1138 break; 1139#ifdef OPENSSL_HAS_ECC 1140 case KEY_ECDSA: 1141 k->ecdsa = ecdsa_generate_private_key(bits, &k->ecdsa_nid); 1142 break; 1143#endif 1144 case KEY_RSA: 1145 case KEY_RSA1: 1146 k->rsa = rsa_generate_private_key(bits); 1147 break; 1148 case KEY_RSA_CERT_V00: 1149 case KEY_DSA_CERT_V00: 1150 case KEY_RSA_CERT: 1151 case KEY_DSA_CERT: 1152 fatal("key_generate: cert keys cannot be generated directly"); 1153 default: 1154 fatal("key_generate: unknown type %d", type); 1155 } 1156 k->type = type; 1157 return k; 1158} 1159 1160void 1161key_cert_copy(const Key *from_key, struct Key *to_key) 1162{ 1163 u_int i; 1164 const struct KeyCert *from; 1165 struct KeyCert *to; 1166 1167 if (to_key->cert != NULL) { 1168 cert_free(to_key->cert); 1169 to_key->cert = NULL; 1170 } 1171 1172 if ((from = from_key->cert) == NULL) 1173 return; 1174 1175 to = to_key->cert = cert_new(); 1176 1177 buffer_append(&to->certblob, buffer_ptr(&from->certblob), 1178 buffer_len(&from->certblob)); 1179 1180 buffer_append(&to->critical, 1181 buffer_ptr(&from->critical), buffer_len(&from->critical)); 1182 buffer_append(&to->extensions, 1183 buffer_ptr(&from->extensions), buffer_len(&from->extensions)); 1184 1185 to->serial = from->serial; 1186 to->type = from->type; 1187 to->key_id = from->key_id == NULL ? NULL : xstrdup(from->key_id); 1188 to->valid_after = from->valid_after; 1189 to->valid_before = from->valid_before; 1190 to->signature_key = from->signature_key == NULL ? 1191 NULL : key_from_private(from->signature_key); 1192 1193 to->nprincipals = from->nprincipals; 1194 if (to->nprincipals > CERT_MAX_PRINCIPALS) 1195 fatal("%s: nprincipals (%u) > CERT_MAX_PRINCIPALS (%u)", 1196 __func__, to->nprincipals, CERT_MAX_PRINCIPALS); 1197 if (to->nprincipals > 0) { 1198 to->principals = xcalloc(from->nprincipals, 1199 sizeof(*to->principals)); 1200 for (i = 0; i < to->nprincipals; i++) 1201 to->principals[i] = xstrdup(from->principals[i]); 1202 } 1203} 1204 1205Key * 1206key_from_private(const Key *k) 1207{ 1208 Key *n = NULL; 1209 switch (k->type) { 1210 case KEY_DSA: 1211 case KEY_DSA_CERT_V00: 1212 case KEY_DSA_CERT: 1213 n = key_new(k->type); 1214 if ((BN_copy(n->dsa->p, k->dsa->p) == NULL) || 1215 (BN_copy(n->dsa->q, k->dsa->q) == NULL) || 1216 (BN_copy(n->dsa->g, k->dsa->g) == NULL) || 1217 (BN_copy(n->dsa->pub_key, k->dsa->pub_key) == NULL)) 1218 fatal("key_from_private: BN_copy failed"); 1219 break; 1220#ifdef OPENSSL_HAS_ECC 1221 case KEY_ECDSA: 1222 case KEY_ECDSA_CERT: 1223 n = key_new(k->type); 1224 n->ecdsa_nid = k->ecdsa_nid; 1225 if ((n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid)) == NULL) 1226 fatal("%s: EC_KEY_new_by_curve_name failed", __func__); 1227 if (EC_KEY_set_public_key(n->ecdsa, 1228 EC_KEY_get0_public_key(k->ecdsa)) != 1) 1229 fatal("%s: EC_KEY_set_public_key failed", __func__); 1230 break; 1231#endif 1232 case KEY_RSA: 1233 case KEY_RSA1: 1234 case KEY_RSA_CERT_V00: 1235 case KEY_RSA_CERT: 1236 n = key_new(k->type); 1237 if ((BN_copy(n->rsa->n, k->rsa->n) == NULL) || 1238 (BN_copy(n->rsa->e, k->rsa->e) == NULL)) 1239 fatal("key_from_private: BN_copy failed"); 1240 break; 1241 default: 1242 fatal("key_from_private: unknown type %d", k->type); 1243 break; 1244 } 1245 if (key_is_cert(k)) 1246 key_cert_copy(k, n); 1247 return n; 1248} 1249 1250int 1251key_type_from_name(char *name) 1252{ 1253 if (strcmp(name, "rsa1") == 0) { 1254 return KEY_RSA1; 1255 } else if (strcmp(name, "rsa") == 0) { 1256 return KEY_RSA; 1257 } else if (strcmp(name, "dsa") == 0) { 1258 return KEY_DSA; 1259 } else if (strcmp(name, "ssh-rsa") == 0) { 1260 return KEY_RSA; 1261 } else if (strcmp(name, "ssh-dss") == 0) { 1262 return KEY_DSA; 1263#ifdef OPENSSL_HAS_ECC 1264 } else if (strcmp(name, "ecdsa") == 0 || 1265 strcmp(name, "ecdsa-sha2-nistp256") == 0 || 1266 strcmp(name, "ecdsa-sha2-nistp384") == 0 || 1267 strcmp(name, "ecdsa-sha2-nistp521") == 0) { 1268 return KEY_ECDSA; 1269#endif 1270 } else if (strcmp(name, "ssh-rsa-cert-v00@openssh.com") == 0) { 1271 return KEY_RSA_CERT_V00; 1272 } else if (strcmp(name, "ssh-dss-cert-v00@openssh.com") == 0) { 1273 return KEY_DSA_CERT_V00; 1274 } else if (strcmp(name, "ssh-rsa-cert-v01@openssh.com") == 0) { 1275 return KEY_RSA_CERT; 1276 } else if (strcmp(name, "ssh-dss-cert-v01@openssh.com") == 0) { 1277 return KEY_DSA_CERT; 1278#ifdef OPENSSL_HAS_ECC 1279 } else if (strcmp(name, "ecdsa-sha2-nistp256-cert-v01@openssh.com") == 0 || 1280 strcmp(name, "ecdsa-sha2-nistp384-cert-v01@openssh.com") == 0 || 1281 strcmp(name, "ecdsa-sha2-nistp521-cert-v01@openssh.com") == 0) { 1282 return KEY_ECDSA_CERT; 1283#endif 1284 } 1285 1286 debug2("key_type_from_name: unknown key type '%s'", name); 1287 return KEY_UNSPEC; 1288} 1289 1290int 1291key_ecdsa_nid_from_name(const char *name) 1292{ 1293#ifdef OPENSSL_HAS_ECC 1294 if (strcmp(name, "ecdsa-sha2-nistp256") == 0 || 1295 strcmp(name, "ecdsa-sha2-nistp256-cert-v01@openssh.com") == 0) 1296 return NID_X9_62_prime256v1; 1297 if (strcmp(name, "ecdsa-sha2-nistp384") == 0 || 1298 strcmp(name, "ecdsa-sha2-nistp384-cert-v01@openssh.com") == 0) 1299 return NID_secp384r1; 1300 if (strcmp(name, "ecdsa-sha2-nistp521") == 0 || 1301 strcmp(name, "ecdsa-sha2-nistp521-cert-v01@openssh.com") == 0) 1302 return NID_secp521r1; 1303#endif /* OPENSSL_HAS_ECC */ 1304 1305 debug2("%s: unknown/non-ECDSA key type '%s'", __func__, name); 1306 return -1; 1307} 1308 1309int 1310key_names_valid2(const char *names) 1311{ 1312 char *s, *cp, *p; 1313 1314 if (names == NULL || strcmp(names, "") == 0) 1315 return 0; 1316 s = cp = xstrdup(names); 1317 for ((p = strsep(&cp, ",")); p && *p != '\0'; 1318 (p = strsep(&cp, ","))) { 1319 switch (key_type_from_name(p)) { 1320 case KEY_RSA1: 1321 case KEY_UNSPEC: 1322 xfree(s); 1323 return 0; 1324 } 1325 } 1326 debug3("key names ok: [%s]", names); 1327 xfree(s); 1328 return 1; 1329} 1330 1331static int 1332cert_parse(Buffer *b, Key *key, const u_char *blob, u_int blen) 1333{ 1334 u_char *principals, *critical, *exts, *sig_key, *sig; 1335 u_int signed_len, plen, clen, sklen, slen, kidlen, elen; 1336 Buffer tmp; 1337 char *principal; 1338 int ret = -1; 1339 int v00 = key->type == KEY_DSA_CERT_V00 || 1340 key->type == KEY_RSA_CERT_V00; 1341 1342 buffer_init(&tmp); 1343 1344 /* Copy the entire key blob for verification and later serialisation */ 1345 buffer_append(&key->cert->certblob, blob, blen); 1346 1347 elen = 0; /* Not touched for v00 certs */ 1348 principals = exts = critical = sig_key = sig = NULL; 1349 if ((!v00 && buffer_get_int64_ret(&key->cert->serial, b) != 0) || 1350 buffer_get_int_ret(&key->cert->type, b) != 0 || 1351 (key->cert->key_id = buffer_get_cstring_ret(b, &kidlen)) == NULL || 1352 (principals = buffer_get_string_ret(b, &plen)) == NULL || 1353 buffer_get_int64_ret(&key->cert->valid_after, b) != 0 || 1354 buffer_get_int64_ret(&key->cert->valid_before, b) != 0 || 1355 (critical = buffer_get_string_ret(b, &clen)) == NULL || 1356 (!v00 && (exts = buffer_get_string_ret(b, &elen)) == NULL) || 1357 (v00 && buffer_get_string_ptr_ret(b, NULL) == NULL) || /* nonce */ 1358 buffer_get_string_ptr_ret(b, NULL) == NULL || /* reserved */ 1359 (sig_key = buffer_get_string_ret(b, &sklen)) == NULL) { 1360 error("%s: parse error", __func__); 1361 goto out; 1362 } 1363 1364 /* Signature is left in the buffer so we can calculate this length */ 1365 signed_len = buffer_len(&key->cert->certblob) - buffer_len(b); 1366 1367 if ((sig = buffer_get_string_ret(b, &slen)) == NULL) { 1368 error("%s: parse error", __func__); 1369 goto out; 1370 } 1371 1372 if (key->cert->type != SSH2_CERT_TYPE_USER && 1373 key->cert->type != SSH2_CERT_TYPE_HOST) { 1374 error("Unknown certificate type %u", key->cert->type); 1375 goto out; 1376 } 1377 1378 buffer_append(&tmp, principals, plen); 1379 while (buffer_len(&tmp) > 0) { 1380 if (key->cert->nprincipals >= CERT_MAX_PRINCIPALS) { 1381 error("%s: Too many principals", __func__); 1382 goto out; 1383 } 1384 if ((principal = buffer_get_cstring_ret(&tmp, &plen)) == NULL) { 1385 error("%s: Principals data invalid", __func__); 1386 goto out; 1387 } 1388 key->cert->principals = xrealloc(key->cert->principals, 1389 key->cert->nprincipals + 1, sizeof(*key->cert->principals)); 1390 key->cert->principals[key->cert->nprincipals++] = principal; 1391 } 1392 1393 buffer_clear(&tmp); 1394 1395 buffer_append(&key->cert->critical, critical, clen); 1396 buffer_append(&tmp, critical, clen); 1397 /* validate structure */ 1398 while (buffer_len(&tmp) != 0) { 1399 if (buffer_get_string_ptr_ret(&tmp, NULL) == NULL || 1400 buffer_get_string_ptr_ret(&tmp, NULL) == NULL) { 1401 error("%s: critical option data invalid", __func__); 1402 goto out; 1403 } 1404 } 1405 buffer_clear(&tmp); 1406 1407 buffer_append(&key->cert->extensions, exts, elen); 1408 buffer_append(&tmp, exts, elen); 1409 /* validate structure */ 1410 while (buffer_len(&tmp) != 0) { 1411 if (buffer_get_string_ptr_ret(&tmp, NULL) == NULL || 1412 buffer_get_string_ptr_ret(&tmp, NULL) == NULL) { 1413 error("%s: extension data invalid", __func__); 1414 goto out; 1415 } 1416 } 1417 buffer_clear(&tmp); 1418 1419 if ((key->cert->signature_key = key_from_blob(sig_key, 1420 sklen)) == NULL) { 1421 error("%s: Signature key invalid", __func__); 1422 goto out; 1423 } 1424 if (key->cert->signature_key->type != KEY_RSA && 1425 key->cert->signature_key->type != KEY_DSA && 1426 key->cert->signature_key->type != KEY_ECDSA) { 1427 error("%s: Invalid signature key type %s (%d)", __func__, 1428 key_type(key->cert->signature_key), 1429 key->cert->signature_key->type); 1430 goto out; 1431 } 1432 1433 switch (key_verify(key->cert->signature_key, sig, slen, 1434 buffer_ptr(&key->cert->certblob), signed_len)) { 1435 case 1: 1436 ret = 0; 1437 break; /* Good signature */ 1438 case 0: 1439 error("%s: Invalid signature on certificate", __func__); 1440 goto out; 1441 case -1: 1442 error("%s: Certificate signature verification failed", 1443 __func__); 1444 goto out; 1445 } 1446 1447 out: 1448 buffer_free(&tmp); 1449 if (principals != NULL) 1450 xfree(principals); 1451 if (critical != NULL) 1452 xfree(critical); 1453 if (exts != NULL) 1454 xfree(exts); 1455 if (sig_key != NULL) 1456 xfree(sig_key); 1457 if (sig != NULL) 1458 xfree(sig); 1459 return ret; 1460} 1461 1462Key * 1463key_from_blob(const u_char *blob, u_int blen) 1464{ 1465 Buffer b; 1466 int rlen, type; 1467 char *ktype = NULL, *curve = NULL; 1468 Key *key = NULL; 1469#ifdef OPENSSL_HAS_ECC 1470 EC_POINT *q = NULL; 1471 int nid = -1; 1472#endif 1473 1474#ifdef DEBUG_PK 1475 dump_base64(stderr, blob, blen); 1476#endif 1477 buffer_init(&b); 1478 buffer_append(&b, blob, blen); 1479 if ((ktype = buffer_get_cstring_ret(&b, NULL)) == NULL) { 1480 error("key_from_blob: can't read key type"); 1481 goto out; 1482 } 1483 1484 type = key_type_from_name(ktype); 1485#ifdef OPENSSL_HAS_ECC 1486 if (key_type_plain(type) == KEY_ECDSA) 1487 nid = key_ecdsa_nid_from_name(ktype); 1488#endif 1489 1490 switch (type) { 1491 case KEY_RSA_CERT: 1492 (void)buffer_get_string_ptr_ret(&b, NULL); /* Skip nonce */ 1493 /* FALLTHROUGH */ 1494 case KEY_RSA: 1495 case KEY_RSA_CERT_V00: 1496 key = key_new(type); 1497 if (buffer_get_bignum2_ret(&b, key->rsa->e) == -1 || 1498 buffer_get_bignum2_ret(&b, key->rsa->n) == -1) { 1499 error("key_from_blob: can't read rsa key"); 1500 badkey: 1501 key_free(key); 1502 key = NULL; 1503 goto out; 1504 } 1505#ifdef DEBUG_PK 1506 RSA_print_fp(stderr, key->rsa, 8); 1507#endif 1508 break; 1509 case KEY_DSA_CERT: 1510 (void)buffer_get_string_ptr_ret(&b, NULL); /* Skip nonce */ 1511 /* FALLTHROUGH */ 1512 case KEY_DSA: 1513 case KEY_DSA_CERT_V00: 1514 key = key_new(type); 1515 if (buffer_get_bignum2_ret(&b, key->dsa->p) == -1 || 1516 buffer_get_bignum2_ret(&b, key->dsa->q) == -1 || 1517 buffer_get_bignum2_ret(&b, key->dsa->g) == -1 || 1518 buffer_get_bignum2_ret(&b, key->dsa->pub_key) == -1) { 1519 error("key_from_blob: can't read dsa key"); 1520 goto badkey; 1521 } 1522#ifdef DEBUG_PK 1523 DSA_print_fp(stderr, key->dsa, 8); 1524#endif 1525 break; 1526#ifdef OPENSSL_HAS_ECC 1527 case KEY_ECDSA_CERT: 1528 (void)buffer_get_string_ptr_ret(&b, NULL); /* Skip nonce */ 1529 /* FALLTHROUGH */ 1530 case KEY_ECDSA: 1531 key = key_new(type); 1532 key->ecdsa_nid = nid; 1533 if ((curve = buffer_get_string_ret(&b, NULL)) == NULL) { 1534 error("key_from_blob: can't read ecdsa curve"); 1535 goto badkey; 1536 } 1537 if (key->ecdsa_nid != key_curve_name_to_nid(curve)) { 1538 error("key_from_blob: ecdsa curve doesn't match type"); 1539 goto badkey; 1540 } 1541 if (key->ecdsa != NULL) 1542 EC_KEY_free(key->ecdsa); 1543 if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid)) 1544 == NULL) 1545 fatal("key_from_blob: EC_KEY_new_by_curve_name failed"); 1546 if ((q = EC_POINT_new(EC_KEY_get0_group(key->ecdsa))) == NULL) 1547 fatal("key_from_blob: EC_POINT_new failed"); 1548 if (buffer_get_ecpoint_ret(&b, EC_KEY_get0_group(key->ecdsa), 1549 q) == -1) { 1550 error("key_from_blob: can't read ecdsa key point"); 1551 goto badkey; 1552 } 1553 if (key_ec_validate_public(EC_KEY_get0_group(key->ecdsa), 1554 q) != 0) 1555 goto badkey; 1556 if (EC_KEY_set_public_key(key->ecdsa, q) != 1) 1557 fatal("key_from_blob: EC_KEY_set_public_key failed"); 1558#ifdef DEBUG_PK 1559 key_dump_ec_point(EC_KEY_get0_group(key->ecdsa), q); 1560#endif 1561 break; 1562#endif /* OPENSSL_HAS_ECC */ 1563 case KEY_UNSPEC: 1564 key = key_new(type); 1565 break; 1566 default: 1567 error("key_from_blob: cannot handle type %s", ktype); 1568 goto out; 1569 } 1570 if (key_is_cert(key) && cert_parse(&b, key, blob, blen) == -1) { 1571 error("key_from_blob: can't parse cert data"); 1572 goto badkey; 1573 } 1574 rlen = buffer_len(&b); 1575 if (key != NULL && rlen != 0) 1576 error("key_from_blob: remaining bytes in key blob %d", rlen); 1577 out: 1578 if (ktype != NULL) 1579 xfree(ktype); 1580 if (curve != NULL) 1581 xfree(curve); 1582#ifdef OPENSSL_HAS_ECC 1583 if (q != NULL) 1584 EC_POINT_free(q); 1585#endif 1586 buffer_free(&b); 1587 return key; 1588} 1589 1590int 1591key_to_blob(const Key *key, u_char **blobp, u_int *lenp) 1592{ 1593 Buffer b; 1594 int len; 1595 1596 if (key == NULL) { 1597 error("key_to_blob: key == NULL"); 1598 return 0; 1599 } 1600 buffer_init(&b); 1601 switch (key->type) { 1602 case KEY_DSA_CERT_V00: 1603 case KEY_RSA_CERT_V00: 1604 case KEY_DSA_CERT: 1605 case KEY_ECDSA_CERT: 1606 case KEY_RSA_CERT: 1607 /* Use the existing blob */ 1608 buffer_append(&b, buffer_ptr(&key->cert->certblob), 1609 buffer_len(&key->cert->certblob)); 1610 break; 1611 case KEY_DSA: 1612 buffer_put_cstring(&b, key_ssh_name(key)); 1613 buffer_put_bignum2(&b, key->dsa->p); 1614 buffer_put_bignum2(&b, key->dsa->q); 1615 buffer_put_bignum2(&b, key->dsa->g); 1616 buffer_put_bignum2(&b, key->dsa->pub_key); 1617 break; 1618#ifdef OPENSSL_HAS_ECC 1619 case KEY_ECDSA: 1620 buffer_put_cstring(&b, key_ssh_name(key)); 1621 buffer_put_cstring(&b, key_curve_nid_to_name(key->ecdsa_nid)); 1622 buffer_put_ecpoint(&b, EC_KEY_get0_group(key->ecdsa), 1623 EC_KEY_get0_public_key(key->ecdsa)); 1624 break; 1625#endif 1626 case KEY_RSA: 1627 buffer_put_cstring(&b, key_ssh_name(key)); 1628 buffer_put_bignum2(&b, key->rsa->e); 1629 buffer_put_bignum2(&b, key->rsa->n); 1630 break; 1631 default: 1632 error("key_to_blob: unsupported key type %d", key->type); 1633 buffer_free(&b); 1634 return 0; 1635 } 1636 len = buffer_len(&b); 1637 if (lenp != NULL) 1638 *lenp = len; 1639 if (blobp != NULL) { 1640 *blobp = xmalloc(len); 1641 memcpy(*blobp, buffer_ptr(&b), len); 1642 } 1643 memset(buffer_ptr(&b), 0, len); 1644 buffer_free(&b); 1645 return len; 1646} 1647 1648int 1649key_sign( 1650 const Key *key, 1651 u_char **sigp, u_int *lenp, 1652 const u_char *data, u_int datalen) 1653{ 1654 switch (key->type) { 1655 case KEY_DSA_CERT_V00: 1656 case KEY_DSA_CERT: 1657 case KEY_DSA: 1658 return ssh_dss_sign(key, sigp, lenp, data, datalen); 1659#ifdef OPENSSL_HAS_ECC 1660 case KEY_ECDSA_CERT: 1661 case KEY_ECDSA: 1662 return ssh_ecdsa_sign(key, sigp, lenp, data, datalen); 1663#endif 1664 case KEY_RSA_CERT_V00: 1665 case KEY_RSA_CERT: 1666 case KEY_RSA: 1667 return ssh_rsa_sign(key, sigp, lenp, data, datalen); 1668 default: 1669 error("key_sign: invalid key type %d", key->type); 1670 return -1; 1671 } 1672} 1673 1674/* 1675 * key_verify returns 1 for a correct signature, 0 for an incorrect signature 1676 * and -1 on error. 1677 */ 1678int 1679key_verify( 1680 const Key *key, 1681 const u_char *signature, u_int signaturelen, 1682 const u_char *data, u_int datalen) 1683{ 1684 if (signaturelen == 0) 1685 return -1; 1686 1687 switch (key->type) { 1688 case KEY_DSA_CERT_V00: 1689 case KEY_DSA_CERT: 1690 case KEY_DSA: 1691 return ssh_dss_verify(key, signature, signaturelen, data, datalen); 1692#ifdef OPENSSL_HAS_ECC 1693 case KEY_ECDSA_CERT: 1694 case KEY_ECDSA: 1695 return ssh_ecdsa_verify(key, signature, signaturelen, data, datalen); 1696#endif 1697 case KEY_RSA_CERT_V00: 1698 case KEY_RSA_CERT: 1699 case KEY_RSA: 1700 return ssh_rsa_verify(key, signature, signaturelen, data, datalen); 1701 default: 1702 error("key_verify: invalid key type %d", key->type); 1703 return -1; 1704 } 1705} 1706 1707/* Converts a private to a public key */ 1708Key * 1709key_demote(const Key *k) 1710{ 1711 Key *pk; 1712 1713 pk = xcalloc(1, sizeof(*pk)); 1714 pk->type = k->type; 1715 pk->flags = k->flags; 1716 pk->ecdsa_nid = k->ecdsa_nid; 1717 pk->dsa = NULL; 1718 pk->ecdsa = NULL; 1719 pk->rsa = NULL; 1720 1721 switch (k->type) { 1722 case KEY_RSA_CERT_V00: 1723 case KEY_RSA_CERT: 1724 key_cert_copy(k, pk); 1725 /* FALLTHROUGH */ 1726 case KEY_RSA1: 1727 case KEY_RSA: 1728 if ((pk->rsa = RSA_new()) == NULL) 1729 fatal("key_demote: RSA_new failed"); 1730 if ((pk->rsa->e = BN_dup(k->rsa->e)) == NULL) 1731 fatal("key_demote: BN_dup failed"); 1732 if ((pk->rsa->n = BN_dup(k->rsa->n)) == NULL) 1733 fatal("key_demote: BN_dup failed"); 1734 break; 1735 case KEY_DSA_CERT_V00: 1736 case KEY_DSA_CERT: 1737 key_cert_copy(k, pk); 1738 /* FALLTHROUGH */ 1739 case KEY_DSA: 1740 if ((pk->dsa = DSA_new()) == NULL) 1741 fatal("key_demote: DSA_new failed"); 1742 if ((pk->dsa->p = BN_dup(k->dsa->p)) == NULL) 1743 fatal("key_demote: BN_dup failed"); 1744 if ((pk->dsa->q = BN_dup(k->dsa->q)) == NULL) 1745 fatal("key_demote: BN_dup failed"); 1746 if ((pk->dsa->g = BN_dup(k->dsa->g)) == NULL) 1747 fatal("key_demote: BN_dup failed"); 1748 if ((pk->dsa->pub_key = BN_dup(k->dsa->pub_key)) == NULL) 1749 fatal("key_demote: BN_dup failed"); 1750 break; 1751#ifdef OPENSSL_HAS_ECC 1752 case KEY_ECDSA_CERT: 1753 key_cert_copy(k, pk); 1754 /* FALLTHROUGH */ 1755 case KEY_ECDSA: 1756 if ((pk->ecdsa = EC_KEY_new_by_curve_name(pk->ecdsa_nid)) == NULL) 1757 fatal("key_demote: EC_KEY_new_by_curve_name failed"); 1758 if (EC_KEY_set_public_key(pk->ecdsa, 1759 EC_KEY_get0_public_key(k->ecdsa)) != 1) 1760 fatal("key_demote: EC_KEY_set_public_key failed"); 1761 break; 1762#endif 1763 default: 1764 fatal("key_free: bad key type %d", k->type); 1765 break; 1766 } 1767 1768 return (pk); 1769} 1770 1771int 1772key_is_cert(const Key *k) 1773{ 1774 if (k == NULL) 1775 return 0; 1776 switch (k->type) { 1777 case KEY_RSA_CERT_V00: 1778 case KEY_DSA_CERT_V00: 1779 case KEY_RSA_CERT: 1780 case KEY_DSA_CERT: 1781 case KEY_ECDSA_CERT: 1782 return 1; 1783 default: 1784 return 0; 1785 } 1786} 1787 1788/* Return the cert-less equivalent to a certified key type */ 1789int 1790key_type_plain(int type) 1791{ 1792 switch (type) { 1793 case KEY_RSA_CERT_V00: 1794 case KEY_RSA_CERT: 1795 return KEY_RSA; 1796 case KEY_DSA_CERT_V00: 1797 case KEY_DSA_CERT: 1798 return KEY_DSA; 1799 case KEY_ECDSA_CERT: 1800 return KEY_ECDSA; 1801 default: 1802 return type; 1803 } 1804} 1805 1806/* Convert a KEY_RSA or KEY_DSA to their _CERT equivalent */ 1807int 1808key_to_certified(Key *k, int legacy) 1809{ 1810 switch (k->type) { 1811 case KEY_RSA: 1812 k->cert = cert_new(); 1813 k->type = legacy ? KEY_RSA_CERT_V00 : KEY_RSA_CERT; 1814 return 0; 1815 case KEY_DSA: 1816 k->cert = cert_new(); 1817 k->type = legacy ? KEY_DSA_CERT_V00 : KEY_DSA_CERT; 1818 return 0; 1819 case KEY_ECDSA: 1820 if (legacy) 1821 fatal("%s: legacy ECDSA certificates are not supported", 1822 __func__); 1823 k->cert = cert_new(); 1824 k->type = KEY_ECDSA_CERT; 1825 return 0; 1826 default: 1827 error("%s: key has incorrect type %s", __func__, key_type(k)); 1828 return -1; 1829 } 1830} 1831 1832/* Convert a KEY_RSA_CERT or KEY_DSA_CERT to their raw key equivalent */ 1833int 1834key_drop_cert(Key *k) 1835{ 1836 switch (k->type) { 1837 case KEY_RSA_CERT_V00: 1838 case KEY_RSA_CERT: 1839 cert_free(k->cert); 1840 k->type = KEY_RSA; 1841 return 0; 1842 case KEY_DSA_CERT_V00: 1843 case KEY_DSA_CERT: 1844 cert_free(k->cert); 1845 k->type = KEY_DSA; 1846 return 0; 1847 case KEY_ECDSA_CERT: 1848 cert_free(k->cert); 1849 k->type = KEY_ECDSA; 1850 return 0; 1851 default: 1852 error("%s: key has incorrect type %s", __func__, key_type(k)); 1853 return -1; 1854 } 1855} 1856 1857/* 1858 * Sign a KEY_RSA_CERT, KEY_DSA_CERT or KEY_ECDSA_CERT, (re-)generating 1859 * the signed certblob 1860 */ 1861int 1862key_certify(Key *k, Key *ca) 1863{ 1864 Buffer principals; 1865 u_char *ca_blob, *sig_blob, nonce[32]; 1866 u_int i, ca_len, sig_len; 1867 1868 if (k->cert == NULL) { 1869 error("%s: key lacks cert info", __func__); 1870 return -1; 1871 } 1872 1873 if (!key_is_cert(k)) { 1874 error("%s: certificate has unknown type %d", __func__, 1875 k->cert->type); 1876 return -1; 1877 } 1878 1879 if (ca->type != KEY_RSA && ca->type != KEY_DSA && 1880 ca->type != KEY_ECDSA) { 1881 error("%s: CA key has unsupported type %s", __func__, 1882 key_type(ca)); 1883 return -1; 1884 } 1885 1886 key_to_blob(ca, &ca_blob, &ca_len); 1887 1888 buffer_clear(&k->cert->certblob); 1889 buffer_put_cstring(&k->cert->certblob, key_ssh_name(k)); 1890 1891 /* -v01 certs put nonce first */ 1892 arc4random_buf(&nonce, sizeof(nonce)); 1893 if (!key_cert_is_legacy(k)) 1894 buffer_put_string(&k->cert->certblob, nonce, sizeof(nonce)); 1895 1896 switch (k->type) { 1897 case KEY_DSA_CERT_V00: 1898 case KEY_DSA_CERT: 1899 buffer_put_bignum2(&k->cert->certblob, k->dsa->p); 1900 buffer_put_bignum2(&k->cert->certblob, k->dsa->q); 1901 buffer_put_bignum2(&k->cert->certblob, k->dsa->g); 1902 buffer_put_bignum2(&k->cert->certblob, k->dsa->pub_key); 1903 break; 1904#ifdef OPENSSL_HAS_ECC 1905 case KEY_ECDSA_CERT: 1906 buffer_put_cstring(&k->cert->certblob, 1907 key_curve_nid_to_name(k->ecdsa_nid)); 1908 buffer_put_ecpoint(&k->cert->certblob, 1909 EC_KEY_get0_group(k->ecdsa), 1910 EC_KEY_get0_public_key(k->ecdsa)); 1911 break; 1912#endif 1913 case KEY_RSA_CERT_V00: 1914 case KEY_RSA_CERT: 1915 buffer_put_bignum2(&k->cert->certblob, k->rsa->e); 1916 buffer_put_bignum2(&k->cert->certblob, k->rsa->n); 1917 break; 1918 default: 1919 error("%s: key has incorrect type %s", __func__, key_type(k)); 1920 buffer_clear(&k->cert->certblob); 1921 xfree(ca_blob); 1922 return -1; 1923 } 1924 1925 /* -v01 certs have a serial number next */ 1926 if (!key_cert_is_legacy(k)) 1927 buffer_put_int64(&k->cert->certblob, k->cert->serial); 1928 1929 buffer_put_int(&k->cert->certblob, k->cert->type); 1930 buffer_put_cstring(&k->cert->certblob, k->cert->key_id); 1931 1932 buffer_init(&principals); 1933 for (i = 0; i < k->cert->nprincipals; i++) 1934 buffer_put_cstring(&principals, k->cert->principals[i]); 1935 buffer_put_string(&k->cert->certblob, buffer_ptr(&principals), 1936 buffer_len(&principals)); 1937 buffer_free(&principals); 1938 1939 buffer_put_int64(&k->cert->certblob, k->cert->valid_after); 1940 buffer_put_int64(&k->cert->certblob, k->cert->valid_before); 1941 buffer_put_string(&k->cert->certblob, 1942 buffer_ptr(&k->cert->critical), buffer_len(&k->cert->critical)); 1943 1944 /* -v01 certs have non-critical options here */ 1945 if (!key_cert_is_legacy(k)) { 1946 buffer_put_string(&k->cert->certblob, 1947 buffer_ptr(&k->cert->extensions), 1948 buffer_len(&k->cert->extensions)); 1949 } 1950 1951 /* -v00 certs put the nonce at the end */ 1952 if (key_cert_is_legacy(k)) 1953 buffer_put_string(&k->cert->certblob, nonce, sizeof(nonce)); 1954 1955 buffer_put_string(&k->cert->certblob, NULL, 0); /* reserved */ 1956 buffer_put_string(&k->cert->certblob, ca_blob, ca_len); 1957 xfree(ca_blob); 1958 1959 /* Sign the whole mess */ 1960 if (key_sign(ca, &sig_blob, &sig_len, buffer_ptr(&k->cert->certblob), 1961 buffer_len(&k->cert->certblob)) != 0) { 1962 error("%s: signature operation failed", __func__); 1963 buffer_clear(&k->cert->certblob); 1964 return -1; 1965 } 1966 /* Append signature and we are done */ 1967 buffer_put_string(&k->cert->certblob, sig_blob, sig_len); 1968 xfree(sig_blob); 1969 1970 return 0; 1971} 1972 1973int 1974key_cert_check_authority(const Key *k, int want_host, int require_principal, 1975 const char *name, const char **reason) 1976{ 1977 u_int i, principal_matches; 1978 time_t now = time(NULL); 1979 1980 if (want_host) { 1981 if (k->cert->type != SSH2_CERT_TYPE_HOST) { 1982 *reason = "Certificate invalid: not a host certificate"; 1983 return -1; 1984 } 1985 } else { 1986 if (k->cert->type != SSH2_CERT_TYPE_USER) { 1987 *reason = "Certificate invalid: not a user certificate"; 1988 return -1; 1989 } 1990 } 1991 if (now < 0) { 1992 error("%s: system clock lies before epoch", __func__); 1993 *reason = "Certificate invalid: not yet valid"; 1994 return -1; 1995 } 1996 if ((u_int64_t)now < k->cert->valid_after) { 1997 *reason = "Certificate invalid: not yet valid"; 1998 return -1; 1999 } 2000 if ((u_int64_t)now >= k->cert->valid_before) { 2001 *reason = "Certificate invalid: expired"; 2002 return -1; 2003 } 2004 if (k->cert->nprincipals == 0) { 2005 if (require_principal) { 2006 *reason = "Certificate lacks principal list"; 2007 return -1; 2008 } 2009 } else if (name != NULL) { 2010 principal_matches = 0; 2011 for (i = 0; i < k->cert->nprincipals; i++) { 2012 if (strcmp(name, k->cert->principals[i]) == 0) { 2013 principal_matches = 1; 2014 break; 2015 } 2016 } 2017 if (!principal_matches) { 2018 *reason = "Certificate invalid: name is not a listed " 2019 "principal"; 2020 return -1; 2021 } 2022 } 2023 return 0; 2024} 2025 2026int 2027key_cert_is_legacy(Key *k) 2028{ 2029 switch (k->type) { 2030 case KEY_DSA_CERT_V00: 2031 case KEY_RSA_CERT_V00: 2032 return 1; 2033 default: 2034 return 0; 2035 } 2036} 2037 2038/* XXX: these are really begging for a table-driven approach */ 2039int 2040key_curve_name_to_nid(const char *name) 2041{ 2042#ifdef OPENSSL_HAS_ECC 2043 if (strcmp(name, "nistp256") == 0) 2044 return NID_X9_62_prime256v1; 2045 else if (strcmp(name, "nistp384") == 0) 2046 return NID_secp384r1; 2047 else if (strcmp(name, "nistp521") == 0) 2048 return NID_secp521r1; 2049#endif 2050 2051 debug("%s: unsupported EC curve name \"%.100s\"", __func__, name); 2052 return -1; 2053} 2054 2055u_int 2056key_curve_nid_to_bits(int nid) 2057{ 2058 switch (nid) { 2059#ifdef OPENSSL_HAS_ECC 2060 case NID_X9_62_prime256v1: 2061 return 256; 2062 case NID_secp384r1: 2063 return 384; 2064 case NID_secp521r1: 2065 return 521; 2066#endif 2067 default: 2068 error("%s: unsupported EC curve nid %d", __func__, nid); 2069 return 0; 2070 } 2071} 2072 2073const char * 2074key_curve_nid_to_name(int nid) 2075{ 2076#ifdef OPENSSL_HAS_ECC 2077 if (nid == NID_X9_62_prime256v1) 2078 return "nistp256"; 2079 else if (nid == NID_secp384r1) 2080 return "nistp384"; 2081 else if (nid == NID_secp521r1) 2082 return "nistp521"; 2083#endif 2084 error("%s: unsupported EC curve nid %d", __func__, nid); 2085 return NULL; 2086} 2087 2088#ifdef OPENSSL_HAS_ECC 2089const EVP_MD * 2090key_ec_nid_to_evpmd(int nid) 2091{ 2092 int kbits = key_curve_nid_to_bits(nid); 2093 2094 if (kbits == 0) 2095 fatal("%s: invalid nid %d", __func__, nid); 2096 /* RFC5656 section 6.2.1 */ 2097 if (kbits <= 256) 2098 return EVP_sha256(); 2099 else if (kbits <= 384) 2100 return EVP_sha384(); 2101 else 2102 return EVP_sha512(); 2103} 2104 2105int 2106key_ec_validate_public(const EC_GROUP *group, const EC_POINT *public) 2107{ 2108 BN_CTX *bnctx; 2109 EC_POINT *nq = NULL; 2110 BIGNUM *order, *x, *y, *tmp; 2111 int ret = -1; 2112 2113 if ((bnctx = BN_CTX_new()) == NULL) 2114 fatal("%s: BN_CTX_new failed", __func__); 2115 BN_CTX_start(bnctx); 2116 2117 /* 2118 * We shouldn't ever hit this case because bignum_get_ecpoint() 2119 * refuses to load GF2m points. 2120 */ 2121 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 2122 NID_X9_62_prime_field) { 2123 error("%s: group is not a prime field", __func__); 2124 goto out; 2125 } 2126 2127 /* Q != infinity */ 2128 if (EC_POINT_is_at_infinity(group, public)) { 2129 error("%s: received degenerate public key (infinity)", 2130 __func__); 2131 goto out; 2132 } 2133 2134 if ((x = BN_CTX_get(bnctx)) == NULL || 2135 (y = BN_CTX_get(bnctx)) == NULL || 2136 (order = BN_CTX_get(bnctx)) == NULL || 2137 (tmp = BN_CTX_get(bnctx)) == NULL) 2138 fatal("%s: BN_CTX_get failed", __func__); 2139 2140 /* log2(x) > log2(order)/2, log2(y) > log2(order)/2 */ 2141 if (EC_GROUP_get_order(group, order, bnctx) != 1) 2142 fatal("%s: EC_GROUP_get_order failed", __func__); 2143 if (EC_POINT_get_affine_coordinates_GFp(group, public, 2144 x, y, bnctx) != 1) 2145 fatal("%s: EC_POINT_get_affine_coordinates_GFp", __func__); 2146 if (BN_num_bits(x) <= BN_num_bits(order) / 2) { 2147 error("%s: public key x coordinate too small: " 2148 "bits(x) = %d, bits(order)/2 = %d", __func__, 2149 BN_num_bits(x), BN_num_bits(order) / 2); 2150 goto out; 2151 } 2152 if (BN_num_bits(y) <= BN_num_bits(order) / 2) { 2153 error("%s: public key y coordinate too small: " 2154 "bits(y) = %d, bits(order)/2 = %d", __func__, 2155 BN_num_bits(x), BN_num_bits(order) / 2); 2156 goto out; 2157 } 2158 2159 /* nQ == infinity (n == order of subgroup) */ 2160 if ((nq = EC_POINT_new(group)) == NULL) 2161 fatal("%s: BN_CTX_tmp failed", __func__); 2162 if (EC_POINT_mul(group, nq, NULL, public, order, bnctx) != 1) 2163 fatal("%s: EC_GROUP_mul failed", __func__); 2164 if (EC_POINT_is_at_infinity(group, nq) != 1) { 2165 error("%s: received degenerate public key (nQ != infinity)", 2166 __func__); 2167 goto out; 2168 } 2169 2170 /* x < order - 1, y < order - 1 */ 2171 if (!BN_sub(tmp, order, BN_value_one())) 2172 fatal("%s: BN_sub failed", __func__); 2173 if (BN_cmp(x, tmp) >= 0) { 2174 error("%s: public key x coordinate >= group order - 1", 2175 __func__); 2176 goto out; 2177 } 2178 if (BN_cmp(y, tmp) >= 0) { 2179 error("%s: public key y coordinate >= group order - 1", 2180 __func__); 2181 goto out; 2182 } 2183 ret = 0; 2184 out: 2185 BN_CTX_free(bnctx); 2186 EC_POINT_free(nq); 2187 return ret; 2188} 2189 2190int 2191key_ec_validate_private(const EC_KEY *key) 2192{ 2193 BN_CTX *bnctx; 2194 BIGNUM *order, *tmp; 2195 int ret = -1; 2196 2197 if ((bnctx = BN_CTX_new()) == NULL) 2198 fatal("%s: BN_CTX_new failed", __func__); 2199 BN_CTX_start(bnctx); 2200 2201 if ((order = BN_CTX_get(bnctx)) == NULL || 2202 (tmp = BN_CTX_get(bnctx)) == NULL) 2203 fatal("%s: BN_CTX_get failed", __func__); 2204 2205 /* log2(private) > log2(order)/2 */ 2206 if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, bnctx) != 1) 2207 fatal("%s: EC_GROUP_get_order failed", __func__); 2208 if (BN_num_bits(EC_KEY_get0_private_key(key)) <= 2209 BN_num_bits(order) / 2) { 2210 error("%s: private key too small: " 2211 "bits(y) = %d, bits(order)/2 = %d", __func__, 2212 BN_num_bits(EC_KEY_get0_private_key(key)), 2213 BN_num_bits(order) / 2); 2214 goto out; 2215 } 2216 2217 /* private < order - 1 */ 2218 if (!BN_sub(tmp, order, BN_value_one())) 2219 fatal("%s: BN_sub failed", __func__); 2220 if (BN_cmp(EC_KEY_get0_private_key(key), tmp) >= 0) { 2221 error("%s: private key >= group order - 1", __func__); 2222 goto out; 2223 } 2224 ret = 0; 2225 out: 2226 BN_CTX_free(bnctx); 2227 return ret; 2228} 2229 2230#if defined(DEBUG_KEXECDH) || defined(DEBUG_PK) 2231void 2232key_dump_ec_point(const EC_GROUP *group, const EC_POINT *point) 2233{ 2234 BIGNUM *x, *y; 2235 BN_CTX *bnctx; 2236 2237 if (point == NULL) { 2238 fputs("point=(NULL)\n", stderr); 2239 return; 2240 } 2241 if ((bnctx = BN_CTX_new()) == NULL) 2242 fatal("%s: BN_CTX_new failed", __func__); 2243 BN_CTX_start(bnctx); 2244 if ((x = BN_CTX_get(bnctx)) == NULL || (y = BN_CTX_get(bnctx)) == NULL) 2245 fatal("%s: BN_CTX_get failed", __func__); 2246 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 2247 NID_X9_62_prime_field) 2248 fatal("%s: group is not a prime field", __func__); 2249 if (EC_POINT_get_affine_coordinates_GFp(group, point, x, y, bnctx) != 1) 2250 fatal("%s: EC_POINT_get_affine_coordinates_GFp", __func__); 2251 fputs("x=", stderr); 2252 BN_print_fp(stderr, x); 2253 fputs("\ny=", stderr); 2254 BN_print_fp(stderr, y); 2255 fputs("\n", stderr); 2256 BN_CTX_free(bnctx); 2257} 2258 2259void 2260key_dump_ec_key(const EC_KEY *key) 2261{ 2262 const BIGNUM *exponent; 2263 2264 key_dump_ec_point(EC_KEY_get0_group(key), EC_KEY_get0_public_key(key)); 2265 fputs("exponent=", stderr); 2266 if ((exponent = EC_KEY_get0_private_key(key)) == NULL) 2267 fputs("(NULL)", stderr); 2268 else 2269 BN_print_fp(stderr, EC_KEY_get0_private_key(key)); 2270 fputs("\n", stderr); 2271} 2272#endif /* defined(DEBUG_KEXECDH) || defined(DEBUG_PK) */ 2273#endif /* OPENSSL_HAS_ECC */ 2274