1*ee116499SAntonio Huete Jimenez /* $OpenBSD: ssh-sk.h,v 1.11 2021/10/28 02:54:18 djm Exp $ */ 20cbfa66cSDaniel Fojt /* 30cbfa66cSDaniel Fojt * Copyright (c) 2019 Google LLC 40cbfa66cSDaniel Fojt * 50cbfa66cSDaniel Fojt * Permission to use, copy, modify, and distribute this software for any 60cbfa66cSDaniel Fojt * purpose with or without fee is hereby granted, provided that the above 70cbfa66cSDaniel Fojt * copyright notice and this permission notice appear in all copies. 80cbfa66cSDaniel Fojt * 90cbfa66cSDaniel Fojt * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 100cbfa66cSDaniel Fojt * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 110cbfa66cSDaniel Fojt * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 120cbfa66cSDaniel Fojt * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 130cbfa66cSDaniel Fojt * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 140cbfa66cSDaniel Fojt * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 150cbfa66cSDaniel Fojt * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 160cbfa66cSDaniel Fojt */ 170cbfa66cSDaniel Fojt 180cbfa66cSDaniel Fojt #ifndef _SSH_SK_H 190cbfa66cSDaniel Fojt #define _SSH_SK_H 1 200cbfa66cSDaniel Fojt 210cbfa66cSDaniel Fojt struct sshbuf; 220cbfa66cSDaniel Fojt struct sshkey; 230cbfa66cSDaniel Fojt struct sk_option; 240cbfa66cSDaniel Fojt 250cbfa66cSDaniel Fojt /* Version of protocol expected from ssh-sk-helper */ 260cbfa66cSDaniel Fojt #define SSH_SK_HELPER_VERSION 5 270cbfa66cSDaniel Fojt 280cbfa66cSDaniel Fojt /* ssh-sk-helper messages */ 290cbfa66cSDaniel Fojt #define SSH_SK_HELPER_ERROR 0 /* Only valid H->C */ 300cbfa66cSDaniel Fojt #define SSH_SK_HELPER_SIGN 1 310cbfa66cSDaniel Fojt #define SSH_SK_HELPER_ENROLL 2 320cbfa66cSDaniel Fojt #define SSH_SK_HELPER_LOAD_RESIDENT 3 330cbfa66cSDaniel Fojt 34*ee116499SAntonio Huete Jimenez struct sshsk_resident_key { 35*ee116499SAntonio Huete Jimenez struct sshkey *key; 36*ee116499SAntonio Huete Jimenez uint8_t *user_id; 37*ee116499SAntonio Huete Jimenez size_t user_id_len; 38*ee116499SAntonio Huete Jimenez }; 39*ee116499SAntonio Huete Jimenez 400cbfa66cSDaniel Fojt /* 410cbfa66cSDaniel Fojt * Enroll (generate) a new security-key hosted private key of given type 420cbfa66cSDaniel Fojt * via the specified provider middleware. 430cbfa66cSDaniel Fojt * If challenge_buf is NULL then a random 256 bit challenge will be used. 440cbfa66cSDaniel Fojt * 450cbfa66cSDaniel Fojt * Returns 0 on success or a ssherr.h error code on failure. 460cbfa66cSDaniel Fojt * 470cbfa66cSDaniel Fojt * If successful and the attest_data buffer is not NULL then attestation 480cbfa66cSDaniel Fojt * information is placed there. 490cbfa66cSDaniel Fojt */ 500cbfa66cSDaniel Fojt int sshsk_enroll(int type, const char *provider_path, const char *device, 510cbfa66cSDaniel Fojt const char *application, const char *userid, uint8_t flags, 520cbfa66cSDaniel Fojt const char *pin, struct sshbuf *challenge_buf, 530cbfa66cSDaniel Fojt struct sshkey **keyp, struct sshbuf *attest); 540cbfa66cSDaniel Fojt 550cbfa66cSDaniel Fojt /* 560cbfa66cSDaniel Fojt * Calculate an ECDSA_SK or ED25519_SK signature using the specified key 570cbfa66cSDaniel Fojt * and provider middleware. 580cbfa66cSDaniel Fojt * 590cbfa66cSDaniel Fojt * Returns 0 on success or a ssherr.h error code on failure. 600cbfa66cSDaniel Fojt */ 610cbfa66cSDaniel Fojt int sshsk_sign(const char *provider_path, struct sshkey *key, 620cbfa66cSDaniel Fojt u_char **sigp, size_t *lenp, const u_char *data, size_t datalen, 630cbfa66cSDaniel Fojt u_int compat, const char *pin); 640cbfa66cSDaniel Fojt 650cbfa66cSDaniel Fojt /* 660cbfa66cSDaniel Fojt * Enumerates and loads all SSH-compatible resident keys from a security 670cbfa66cSDaniel Fojt * key. 680cbfa66cSDaniel Fojt * 690cbfa66cSDaniel Fojt * Returns 0 on success or a ssherr.h error code on failure. 700cbfa66cSDaniel Fojt */ 710cbfa66cSDaniel Fojt int sshsk_load_resident(const char *provider_path, const char *device, 72*ee116499SAntonio Huete Jimenez const char *pin, u_int flags, struct sshsk_resident_key ***srksp, 73*ee116499SAntonio Huete Jimenez size_t *nsrksp); 74*ee116499SAntonio Huete Jimenez 75*ee116499SAntonio Huete Jimenez /* Free an array of sshsk_resident_key (as returned from sshsk_load_resident) */ 76*ee116499SAntonio Huete Jimenez void sshsk_free_resident_keys(struct sshsk_resident_key **srks, size_t nsrks); 770cbfa66cSDaniel Fojt 780cbfa66cSDaniel Fojt #endif /* _SSH_SK_H */ 790cbfa66cSDaniel Fojt 80