1*19261079SEd Maste /* $OpenBSD: sk-api.h,v 1.12 2021/02/18 02:15:07 djm Exp $ */ 2*19261079SEd Maste /* 3*19261079SEd Maste * Copyright (c) 2019 Google LLC 4*19261079SEd Maste * 5*19261079SEd Maste * Permission to use, copy, modify, and distribute this software for any 6*19261079SEd Maste * purpose with or without fee is hereby granted, provided that the above 7*19261079SEd Maste * copyright notice and this permission notice appear in all copies. 8*19261079SEd Maste * 9*19261079SEd Maste * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10*19261079SEd Maste * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11*19261079SEd Maste * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12*19261079SEd Maste * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13*19261079SEd Maste * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14*19261079SEd Maste * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15*19261079SEd Maste * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16*19261079SEd Maste */ 17*19261079SEd Maste 18*19261079SEd Maste #ifndef _SK_API_H 19*19261079SEd Maste #define _SK_API_H 1 20*19261079SEd Maste 21*19261079SEd Maste #include <stddef.h> 22*19261079SEd Maste #ifdef HAVE_STDINT_H 23*19261079SEd Maste #include <stdint.h> 24*19261079SEd Maste #endif 25*19261079SEd Maste 26*19261079SEd Maste /* Flags */ 27*19261079SEd Maste #define SSH_SK_USER_PRESENCE_REQD 0x01 28*19261079SEd Maste #define SSH_SK_USER_VERIFICATION_REQD 0x04 29*19261079SEd Maste #define SSH_SK_RESIDENT_KEY 0x20 30*19261079SEd Maste 31*19261079SEd Maste /* Algs */ 32*19261079SEd Maste #define SSH_SK_ECDSA 0x00 33*19261079SEd Maste #define SSH_SK_ED25519 0x01 34*19261079SEd Maste 35*19261079SEd Maste /* Error codes */ 36*19261079SEd Maste #define SSH_SK_ERR_GENERAL -1 37*19261079SEd Maste #define SSH_SK_ERR_UNSUPPORTED -2 38*19261079SEd Maste #define SSH_SK_ERR_PIN_REQUIRED -3 39*19261079SEd Maste #define SSH_SK_ERR_DEVICE_NOT_FOUND -4 40*19261079SEd Maste 41*19261079SEd Maste struct sk_enroll_response { 42*19261079SEd Maste uint8_t *public_key; 43*19261079SEd Maste size_t public_key_len; 44*19261079SEd Maste uint8_t *key_handle; 45*19261079SEd Maste size_t key_handle_len; 46*19261079SEd Maste uint8_t *signature; 47*19261079SEd Maste size_t signature_len; 48*19261079SEd Maste uint8_t *attestation_cert; 49*19261079SEd Maste size_t attestation_cert_len; 50*19261079SEd Maste uint8_t *authdata; 51*19261079SEd Maste size_t authdata_len; 52*19261079SEd Maste }; 53*19261079SEd Maste 54*19261079SEd Maste struct sk_sign_response { 55*19261079SEd Maste uint8_t flags; 56*19261079SEd Maste uint32_t counter; 57*19261079SEd Maste uint8_t *sig_r; 58*19261079SEd Maste size_t sig_r_len; 59*19261079SEd Maste uint8_t *sig_s; 60*19261079SEd Maste size_t sig_s_len; 61*19261079SEd Maste }; 62*19261079SEd Maste 63*19261079SEd Maste struct sk_resident_key { 64*19261079SEd Maste uint32_t alg; 65*19261079SEd Maste size_t slot; 66*19261079SEd Maste char *application; 67*19261079SEd Maste struct sk_enroll_response key; 68*19261079SEd Maste uint8_t flags; 69*19261079SEd Maste }; 70*19261079SEd Maste 71*19261079SEd Maste struct sk_option { 72*19261079SEd Maste char *name; 73*19261079SEd Maste char *value; 74*19261079SEd Maste uint8_t required; 75*19261079SEd Maste }; 76*19261079SEd Maste 77*19261079SEd Maste #define SSH_SK_VERSION_MAJOR 0x00070000 /* current API version */ 78*19261079SEd Maste #define SSH_SK_VERSION_MAJOR_MASK 0xffff0000 79*19261079SEd Maste 80*19261079SEd Maste /* Return the version of the middleware API */ 81*19261079SEd Maste uint32_t sk_api_version(void); 82*19261079SEd Maste 83*19261079SEd Maste /* Enroll a U2F key (private key generation) */ 84*19261079SEd Maste int sk_enroll(uint32_t alg, const uint8_t *challenge, size_t challenge_len, 85*19261079SEd Maste const char *application, uint8_t flags, const char *pin, 86*19261079SEd Maste struct sk_option **options, struct sk_enroll_response **enroll_response); 87*19261079SEd Maste 88*19261079SEd Maste /* Sign a challenge */ 89*19261079SEd Maste int sk_sign(uint32_t alg, const uint8_t *data, size_t data_len, 90*19261079SEd Maste const char *application, const uint8_t *key_handle, size_t key_handle_len, 91*19261079SEd Maste uint8_t flags, const char *pin, struct sk_option **options, 92*19261079SEd Maste struct sk_sign_response **sign_response); 93*19261079SEd Maste 94*19261079SEd Maste /* Enumerate all resident keys */ 95*19261079SEd Maste int sk_load_resident_keys(const char *pin, struct sk_option **options, 96*19261079SEd Maste struct sk_resident_key ***rks, size_t *nrks); 97*19261079SEd Maste 98*19261079SEd Maste #endif /* _SK_API_H */ 99