1 /* ssh-utils.c - Secure Shell helper functions
2 * Copyright (C) 2011 Free Software Foundation, Inc.
4 * This file is part of GnuPG.
6 * This file is free software; you can redistribute it and/or modify
7 * it under the terms of either
9 * - the GNU Lesser General Public License as published by the Free
10 * Software Foundation; either version 3 of the License, or (at
11 * your option) any later version.
15 * - the GNU General Public License as published by the Free
16 * Software Foundation; either version 2 of the License, or (at
17 * your option) any later version.
19 * or both in parallel, as here.
21 * This file is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 * GNU General Public License for more details.
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <https://www.gnu.org/licenses/>.
37 #include "ssh-utils.h"
40 /* Return true if KEYPARMS holds an EdDSA key. */
42 is_eddsa (gcry_sexp_t keyparms)
50 list = gcry_sexp_find_token (keyparms, "flags", 0);
51 for (i = list ? gcry_sexp_length (list)-1 : 0; i > 0; i--)
53 s = gcry_sexp_nth_data (list, i, &n);
55 continue; /* Not a data element. */
57 if (n == 5 && !memcmp (s, "eddsa", 5))
63 gcry_sexp_release (list);
68 /* Return the Secure Shell type fingerprint for KEY. The length of
69 the fingerprint is returned at R_LEN and the fingerprint itself at
70 R_FPR. In case of a error code is returned and NULL stored at
73 get_fingerprint (gcry_sexp_t key, void **r_fpr, size_t *r_len, int as_string)
76 gcry_sexp_t list = NULL;
77 gcry_sexp_t l2 = NULL;
82 gcry_md_hd_t md = NULL;
88 /* Check that the first element is valid. */
89 list = gcry_sexp_find_token (key, "public-key", 0);
91 list = gcry_sexp_find_token (key, "private-key", 0);
93 list = gcry_sexp_find_token (key, "protected-private-key", 0);
95 list = gcry_sexp_find_token (key, "shadowed-private-key", 0);
98 err = gpg_err_make (default_errsource, GPG_ERR_UNKNOWN_SEXP);
102 l2 = gcry_sexp_cadr (list);
103 gcry_sexp_release (list);
107 name = gcry_sexp_nth_string (list, 0);
110 err = gpg_err_make (default_errsource, GPG_ERR_INV_SEXP);
114 err = gcry_md_open (&md, GCRY_MD_MD5, 0);
118 switch (gcry_pk_map_name (name))
122 gcry_md_write (md, "\0\0\0\x07ssh-rsa", 11);
127 gcry_md_write (md, "\0\0\0\x07ssh-dss", 11);
135 /* For now there is just one curve, thus no need to switch
137 gcry_md_write (md, "\0\0\0\x0b" "ssh-ed25519", 15);
141 /* We only support the 3 standard curves for now. It is
142 just a quick hack. */
144 gcry_md_write (md, "\0\0\0\x13" "ecdsa-sha2-nistp", 20);
145 l2 = gcry_sexp_find_token (list, "curve", 0);
151 name = gcry_sexp_nth_string (l2, 1);
152 gcry_sexp_release (l2);
156 else if (!strcmp (name, "NIST P-256")||!strcmp (name, "nistp256"))
157 gcry_md_write (md, "256\0\0\0\x08nistp256", 15);
158 else if (!strcmp (name, "NIST P-384")||!strcmp (name, "nistp384"))
159 gcry_md_write (md, "384\0\0\0\x08nistp384", 15);
160 else if (!strcmp (name, "NIST P-521")||!strcmp (name, "nistp521"))
161 gcry_md_write (md, "521\0\0\0\x08nistp521", 15);
166 err = gpg_err_make (default_errsource, GPG_ERR_UNKNOWN_CURVE);
172 err = gpg_err_make (default_errsource, GPG_ERR_PUBKEY_ALGO);
179 for (idx = 0, s = elems; *s; s++, idx++)
181 l2 = gcry_sexp_find_token (list, s, 1);
184 err = gpg_err_make (default_errsource, GPG_ERR_INV_SEXP);
191 unsigned char lenbuf[4];
193 blob = gcry_sexp_nth_data (l2, 1, &bloblen);
196 err = gpg_err_make (default_errsource, GPG_ERR_INV_SEXP);
201 lenbuf[0] = bloblen >> 24;
202 lenbuf[1] = bloblen >> 16;
203 lenbuf[2] = bloblen >> 8;
205 gcry_md_write (md, lenbuf, 4);
206 gcry_md_write (md, blob, bloblen);
214 a = gcry_sexp_nth_mpi (l2, 1, GCRYMPI_FMT_USG);
215 gcry_sexp_release (l2);
219 err = gpg_err_make (default_errsource, GPG_ERR_INV_SEXP);
223 err = gcry_mpi_aprint (GCRYMPI_FMT_SSH, &buf, &buflen, a);
224 gcry_mpi_release (a);
227 gcry_md_write (md, buf, buflen);
232 *r_fpr = gcry_malloc (as_string? 61:20);
235 err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
241 bin2hexcolon (gcry_md_read (md, GCRY_MD_MD5), 16, *r_fpr);
247 memcpy (*r_fpr, gcry_md_read (md, GCRY_MD_MD5), 16);
254 gcry_sexp_release (l2);
256 gcry_sexp_release (list);
260 /* Return the Secure Shell type fingerprint for KEY. The length of
261 the fingerprint is returned at R_LEN and the fingerprint itself at
262 R_FPR. In case of an error an error code is returned and NULL
265 ssh_get_fingerprint (gcry_sexp_t key, void **r_fpr, size_t *r_len)
267 return get_fingerprint (key, r_fpr, r_len, 0);
271 /* Return the Secure Shell type fingerprint for KEY as a string. The
272 fingerprint is mallcoed and stored at R_FPRSTR. In case of an
273 error an error code is returned and NULL stored at R_FPRSTR. */
275 ssh_get_fingerprint_string (gcry_sexp_t key, char **r_fprstr)
281 err = get_fingerprint (key, &string, &dummy, 1);