1 /* $OpenBSD: ssh-sk.h,v 1.11 2021/10/28 02:54:18 djm Exp $ */ 2 /* 3 * Copyright (c) 2019 Google LLC 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #ifndef _SSH_SK_H 19 #define _SSH_SK_H 1 20 21 struct sshbuf; 22 struct sshkey; 23 struct sk_option; 24 25 /* Version of protocol expected from ssh-sk-helper */ 26 #define SSH_SK_HELPER_VERSION 5 27 28 /* ssh-sk-helper messages */ 29 #define SSH_SK_HELPER_ERROR 0 /* Only valid H->C */ 30 #define SSH_SK_HELPER_SIGN 1 31 #define SSH_SK_HELPER_ENROLL 2 32 #define SSH_SK_HELPER_LOAD_RESIDENT 3 33 34 struct sshsk_resident_key { 35 struct sshkey *key; 36 uint8_t *user_id; 37 size_t user_id_len; 38 }; 39 40 /* 41 * Enroll (generate) a new security-key hosted private key of given type 42 * via the specified provider middleware. 43 * If challenge_buf is NULL then a random 256 bit challenge will be used. 44 * 45 * Returns 0 on success or a ssherr.h error code on failure. 46 * 47 * If successful and the attest_data buffer is not NULL then attestation 48 * information is placed there. 49 */ 50 int sshsk_enroll(int type, const char *provider_path, const char *device, 51 const char *application, const char *userid, uint8_t flags, 52 const char *pin, struct sshbuf *challenge_buf, 53 struct sshkey **keyp, struct sshbuf *attest); 54 55 /* 56 * Calculate an ECDSA_SK or ED25519_SK signature using the specified key 57 * and provider middleware. 58 * 59 * Returns 0 on success or a ssherr.h error code on failure. 60 */ 61 int sshsk_sign(const char *provider_path, struct sshkey *key, 62 u_char **sigp, size_t *lenp, const u_char *data, size_t datalen, 63 u_int compat, const char *pin); 64 65 /* 66 * Enumerates and loads all SSH-compatible resident keys from a security 67 * key. 68 * 69 * Returns 0 on success or a ssherr.h error code on failure. 70 */ 71 int sshsk_load_resident(const char *provider_path, const char *device, 72 const char *pin, u_int flags, struct sshsk_resident_key ***srksp, 73 size_t *nsrksp); 74 75 /* Free an array of sshsk_resident_key (as returned from sshsk_load_resident) */ 76 void sshsk_free_resident_keys(struct sshsk_resident_key **srks, size_t nsrks); 77 78 #endif /* _SSH_SK_H */ 79 80