Home | History | Annotate | Line # | Download | only in dist
ssh-sk.h revision 1.1.1.2 
      1 /* $OpenBSD: ssh-sk.h,v 1.11 2021/10/28 02:54:18 djm Exp $ */
      2 /*
      3  * Copyright (c) 2019 Google LLC
      4  *
      5  * Permission to use, copy, modify, and distribute this software for any
      6  * purpose with or without fee is hereby granted, provided that the above
      7  * copyright notice and this permission notice appear in all copies.
      8  *
      9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
     10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
     11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
     12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
     13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
     14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
     15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
     16  */
     17 
     18 #ifndef _SSH_SK_H
     19 #define _SSH_SK_H 1
     20 
     21 struct sshbuf;
     22 struct sshkey;
     23 struct sk_option;
     24 
     25 /* Version of protocol expected from ssh-sk-helper */
     26 #define SSH_SK_HELPER_VERSION		5
     27 
     28 /* ssh-sk-helper messages */
     29 #define SSH_SK_HELPER_ERROR		0	/* Only valid H->C */
     30 #define SSH_SK_HELPER_SIGN		1
     31 #define SSH_SK_HELPER_ENROLL		2
     32 #define SSH_SK_HELPER_LOAD_RESIDENT	3
     33 
     34 struct sshsk_resident_key {
     35 	struct sshkey *key;
     36 	uint8_t *user_id;
     37 	size_t user_id_len;
     38 };
     39 
     40 /*
     41  * Enroll (generate) a new security-key hosted private key of given type
     42  * via the specified provider middleware.
     43  * If challenge_buf is NULL then a random 256 bit challenge will be used.
     44  *
     45  * Returns 0 on success or a ssherr.h error code on failure.
     46  *
     47  * If successful and the attest_data buffer is not NULL then attestation
     48  * information is placed there.
     49  */
     50 int sshsk_enroll(int type, const char *provider_path, const char *device,
     51     const char *application, const char *userid, uint8_t flags,
     52     const char *pin, struct sshbuf *challenge_buf,
     53     struct sshkey **keyp, struct sshbuf *attest);
     54 
     55 /*
     56  * Calculate an ECDSA_SK or ED25519_SK signature using the specified key
     57  * and provider middleware.
     58  *
     59  * Returns 0 on success or a ssherr.h error code on failure.
     60  */
     61 int sshsk_sign(const char *provider_path, struct sshkey *key,
     62     u_char **sigp, size_t *lenp, const u_char *data, size_t datalen,
     63     u_int compat, const char *pin);
     64 
     65 /*
     66  * Enumerates and loads all SSH-compatible resident keys from a security
     67  * key.
     68  *
     69  * Returns 0 on success or a ssherr.h error code on failure.
     70  */
     71 int sshsk_load_resident(const char *provider_path, const char *device,
     72     const char *pin, u_int flags, struct sshsk_resident_key ***srksp,
     73     size_t *nsrksp);
     74 
     75 /* Free an array of sshsk_resident_key (as returned from sshsk_load_resident) */
     76 void sshsk_free_resident_keys(struct sshsk_resident_key **srks, size_t nsrks);
     77 
     78 #endif /* _SSH_SK_H */
     79 
     80