xref: /openssh-portable/ssh-ed25519-sk.c (revision d5ba1c03)
1 /* $OpenBSD: ssh-ed25519-sk.c,v 1.5 2020/02/26 13:40:09 jsg Exp $ */
2 /*
3  * Copyright (c) 2019 Markus Friedl.  All rights reserved.
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 /* #define DEBUG_SK 1 */
19 
20 #include "includes.h"
21 
22 #define SSHKEY_INTERNAL
23 #include <sys/types.h>
24 #include <limits.h>
25 
26 #include "crypto_api.h"
27 
28 #include <string.h>
29 #include <stdarg.h>
30 
31 #include "log.h"
32 #include "sshbuf.h"
33 #include "sshkey.h"
34 #include "ssherr.h"
35 #include "ssh.h"
36 #include "digest.h"
37 
38 int
ssh_ed25519_sk_verify(const struct sshkey * key,const u_char * signature,size_t signaturelen,const u_char * data,size_t datalen,u_int compat,struct sshkey_sig_details ** detailsp)39 ssh_ed25519_sk_verify(const struct sshkey *key,
40     const u_char *signature, size_t signaturelen,
41     const u_char *data, size_t datalen, u_int compat,
42     struct sshkey_sig_details **detailsp)
43 {
44 	struct sshbuf *b = NULL;
45 	struct sshbuf *encoded = NULL;
46 	char *ktype = NULL;
47 	const u_char *sigblob;
48 	const u_char *sm;
49 	u_char *m = NULL;
50 	u_char apphash[32];
51 	u_char msghash[32];
52 	u_char sig_flags;
53 	u_int sig_counter;
54 	size_t len;
55 	unsigned long long smlen = 0, mlen = 0;
56 	int r = SSH_ERR_INTERNAL_ERROR;
57 	int ret;
58 	struct sshkey_sig_details *details = NULL;
59 
60 	if (detailsp != NULL)
61 		*detailsp = NULL;
62 
63 	if (key == NULL ||
64 	    sshkey_type_plain(key->type) != KEY_ED25519_SK ||
65 	    key->ed25519_pk == NULL ||
66 	    signature == NULL || signaturelen == 0)
67 		return SSH_ERR_INVALID_ARGUMENT;
68 
69 	if ((b = sshbuf_from(signature, signaturelen)) == NULL)
70 		return SSH_ERR_ALLOC_FAIL;
71 	if (sshbuf_get_cstring(b, &ktype, NULL) != 0 ||
72 	    sshbuf_get_string_direct(b, &sigblob, &len) != 0 ||
73 	    sshbuf_get_u8(b, &sig_flags) != 0 ||
74 	    sshbuf_get_u32(b, &sig_counter) != 0) {
75 		r = SSH_ERR_INVALID_FORMAT;
76 		goto out;
77 	}
78 #ifdef DEBUG_SK
79 	fprintf(stderr, "%s: data:\n", __func__);
80 	/* sshbuf_dump_data(data, datalen, stderr); */
81 	fprintf(stderr, "%s: sigblob:\n", __func__);
82 	sshbuf_dump_data(sigblob, len, stderr);
83 	fprintf(stderr, "%s: sig_flags = 0x%02x, sig_counter = %u\n",
84 	    __func__, sig_flags, sig_counter);
85 #endif
86 	if (strcmp(sshkey_ssh_name_plain(key), ktype) != 0) {
87 		r = SSH_ERR_KEY_TYPE_MISMATCH;
88 		goto out;
89 	}
90 	if (sshbuf_len(b) != 0) {
91 		r = SSH_ERR_UNEXPECTED_TRAILING_DATA;
92 		goto out;
93 	}
94 	if (len > crypto_sign_ed25519_BYTES) {
95 		r = SSH_ERR_INVALID_FORMAT;
96 		goto out;
97 	}
98 	if (ssh_digest_memory(SSH_DIGEST_SHA256, key->sk_application,
99 	    strlen(key->sk_application), apphash, sizeof(apphash)) != 0 ||
100 	    ssh_digest_memory(SSH_DIGEST_SHA256, data, datalen,
101 	    msghash, sizeof(msghash)) != 0) {
102 		r = SSH_ERR_INVALID_ARGUMENT;
103 		goto out;
104 	}
105 #ifdef DEBUG_SK
106 	fprintf(stderr, "%s: hashed application:\n", __func__);
107 	sshbuf_dump_data(apphash, sizeof(apphash), stderr);
108 	fprintf(stderr, "%s: hashed message:\n", __func__);
109 	sshbuf_dump_data(msghash, sizeof(msghash), stderr);
110 #endif
111 	if ((details = calloc(1, sizeof(*details))) == NULL) {
112 		r = SSH_ERR_ALLOC_FAIL;
113 		goto out;
114 	}
115 	details->sk_counter = sig_counter;
116 	details->sk_flags = sig_flags;
117 	if ((encoded = sshbuf_new()) == NULL) {
118 		r = SSH_ERR_ALLOC_FAIL;
119 		goto out;
120 	}
121 	if (sshbuf_put(encoded, sigblob, len) != 0 ||
122 	    sshbuf_put(encoded, apphash, sizeof(apphash)) != 0 ||
123 	    sshbuf_put_u8(encoded, sig_flags) != 0 ||
124 	    sshbuf_put_u32(encoded, sig_counter) != 0 ||
125 	    sshbuf_put(encoded, msghash, sizeof(msghash)) != 0) {
126 		r = SSH_ERR_ALLOC_FAIL;
127 		goto out;
128 	}
129 #ifdef DEBUG_SK
130 	fprintf(stderr, "%s: signed buf:\n", __func__);
131 	sshbuf_dump(encoded, stderr);
132 #endif
133 	sm = sshbuf_ptr(encoded);
134 	smlen = sshbuf_len(encoded);
135 	mlen = smlen;
136 	if ((m = malloc(smlen)) == NULL) {
137 		r = SSH_ERR_ALLOC_FAIL;
138 		goto out;
139 	}
140 	if ((ret = crypto_sign_ed25519_open(m, &mlen, sm, smlen,
141 	    key->ed25519_pk)) != 0) {
142 		debug2("%s: crypto_sign_ed25519_open failed: %d",
143 		    __func__, ret);
144 	}
145 	if (ret != 0 || mlen != smlen - len) {
146 		r = SSH_ERR_SIGNATURE_INVALID;
147 		goto out;
148 	}
149 	/* XXX compare 'm' and 'sm + len' ? */
150 	/* success */
151 	r = 0;
152 	if (detailsp != NULL) {
153 		*detailsp = details;
154 		details = NULL;
155 	}
156  out:
157 	if (m != NULL)
158 		freezero(m, smlen); /* NB mlen may be invalid if r != 0 */
159 	sshkey_sig_details_free(details);
160 	sshbuf_free(b);
161 	sshbuf_free(encoded);
162 	free(ktype);
163 	return r;
164 }
165