10cbfa66cSDaniel Fojt /* $OpenBSD: ssh-sk.h,v 1.10 2020/01/10 23:43:26 djm Exp $ */ 20cbfa66cSDaniel Fojt /* 30cbfa66cSDaniel Fojt * Copyright (c) 2019 Google LLC 40cbfa66cSDaniel Fojt * 50cbfa66cSDaniel Fojt * Permission to use, copy, modify, and distribute this software for any 60cbfa66cSDaniel Fojt * purpose with or without fee is hereby granted, provided that the above 70cbfa66cSDaniel Fojt * copyright notice and this permission notice appear in all copies. 80cbfa66cSDaniel Fojt * 90cbfa66cSDaniel Fojt * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 100cbfa66cSDaniel Fojt * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 110cbfa66cSDaniel Fojt * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 120cbfa66cSDaniel Fojt * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 130cbfa66cSDaniel Fojt * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 140cbfa66cSDaniel Fojt * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 150cbfa66cSDaniel Fojt * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 160cbfa66cSDaniel Fojt */ 170cbfa66cSDaniel Fojt 180cbfa66cSDaniel Fojt #ifndef _SSH_SK_H 190cbfa66cSDaniel Fojt #define _SSH_SK_H 1 200cbfa66cSDaniel Fojt 210cbfa66cSDaniel Fojt struct sshbuf; 220cbfa66cSDaniel Fojt struct sshkey; 230cbfa66cSDaniel Fojt struct sk_option; 240cbfa66cSDaniel Fojt 250cbfa66cSDaniel Fojt /* Version of protocol expected from ssh-sk-helper */ 260cbfa66cSDaniel Fojt #define SSH_SK_HELPER_VERSION 5 270cbfa66cSDaniel Fojt 280cbfa66cSDaniel Fojt /* ssh-sk-helper messages */ 290cbfa66cSDaniel Fojt #define SSH_SK_HELPER_ERROR 0 /* Only valid H->C */ 300cbfa66cSDaniel Fojt #define SSH_SK_HELPER_SIGN 1 310cbfa66cSDaniel Fojt #define SSH_SK_HELPER_ENROLL 2 320cbfa66cSDaniel Fojt #define SSH_SK_HELPER_LOAD_RESIDENT 3 330cbfa66cSDaniel Fojt 340cbfa66cSDaniel Fojt /* 350cbfa66cSDaniel Fojt * Enroll (generate) a new security-key hosted private key of given type 360cbfa66cSDaniel Fojt * via the specified provider middleware. 370cbfa66cSDaniel Fojt * If challenge_buf is NULL then a random 256 bit challenge will be used. 380cbfa66cSDaniel Fojt * 390cbfa66cSDaniel Fojt * Returns 0 on success or a ssherr.h error code on failure. 400cbfa66cSDaniel Fojt * 410cbfa66cSDaniel Fojt * If successful and the attest_data buffer is not NULL then attestation 420cbfa66cSDaniel Fojt * information is placed there. 430cbfa66cSDaniel Fojt */ 440cbfa66cSDaniel Fojt int sshsk_enroll(int type, const char *provider_path, const char *device, 450cbfa66cSDaniel Fojt const char *application, const char *userid, uint8_t flags, 460cbfa66cSDaniel Fojt const char *pin, struct sshbuf *challenge_buf, 470cbfa66cSDaniel Fojt struct sshkey **keyp, struct sshbuf *attest); 480cbfa66cSDaniel Fojt 490cbfa66cSDaniel Fojt /* 500cbfa66cSDaniel Fojt * Calculate an ECDSA_SK or ED25519_SK signature using the specified key 510cbfa66cSDaniel Fojt * and provider middleware. 520cbfa66cSDaniel Fojt * 530cbfa66cSDaniel Fojt * Returns 0 on success or a ssherr.h error code on failure. 540cbfa66cSDaniel Fojt */ 550cbfa66cSDaniel Fojt int sshsk_sign(const char *provider_path, struct sshkey *key, 560cbfa66cSDaniel Fojt u_char **sigp, size_t *lenp, const u_char *data, size_t datalen, 570cbfa66cSDaniel Fojt u_int compat, const char *pin); 580cbfa66cSDaniel Fojt 590cbfa66cSDaniel Fojt /* 600cbfa66cSDaniel Fojt * Enumerates and loads all SSH-compatible resident keys from a security 610cbfa66cSDaniel Fojt * key. 620cbfa66cSDaniel Fojt * 630cbfa66cSDaniel Fojt * Returns 0 on success or a ssherr.h error code on failure. 640cbfa66cSDaniel Fojt */ 650cbfa66cSDaniel Fojt int sshsk_load_resident(const char *provider_path, const char *device, 660cbfa66cSDaniel Fojt const char *pin, struct sshkey ***keysp, size_t *nkeysp); 670cbfa66cSDaniel Fojt 680cbfa66cSDaniel Fojt #endif /* _SSH_SK_H */ 690cbfa66cSDaniel Fojt 70