diff options
Diffstat (limited to 'crypto/openssh/sk-api.h')
| -rw-r--r-- | crypto/openssh/sk-api.h | 103 |
1 files changed, 103 insertions, 0 deletions
diff --git a/crypto/openssh/sk-api.h b/crypto/openssh/sk-api.h new file mode 100644 index 000000000000..08f567a9e271 --- /dev/null +++ b/crypto/openssh/sk-api.h @@ -0,0 +1,103 @@ +/* $OpenBSD: sk-api.h,v 1.15 2022/07/20 03:29:14 djm Exp $ */ +/* + * Copyright (c) 2019 Google LLC + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef _SK_API_H +#define _SK_API_H 1 + +#include <stddef.h> +#ifdef HAVE_STDINT_H +#include <stdint.h> +#endif + +/* Flags */ +#define SSH_SK_USER_PRESENCE_REQD 0x01 +#define SSH_SK_USER_VERIFICATION_REQD 0x04 +#define SSH_SK_FORCE_OPERATION 0x10 +#define SSH_SK_RESIDENT_KEY 0x20 + +/* Algs */ +#define SSH_SK_ECDSA 0x00 +#define SSH_SK_ED25519 0x01 + +/* Error codes */ +#define SSH_SK_ERR_GENERAL -1 +#define SSH_SK_ERR_UNSUPPORTED -2 +#define SSH_SK_ERR_PIN_REQUIRED -3 +#define SSH_SK_ERR_DEVICE_NOT_FOUND -4 +#define SSH_SK_ERR_CREDENTIAL_EXISTS -5 + +struct sk_enroll_response { + uint8_t flags; + uint8_t *public_key; + size_t public_key_len; + uint8_t *key_handle; + size_t key_handle_len; + uint8_t *signature; + size_t signature_len; + uint8_t *attestation_cert; + size_t attestation_cert_len; + uint8_t *authdata; + size_t authdata_len; +}; + +struct sk_sign_response { + uint8_t flags; + uint32_t counter; + uint8_t *sig_r; + size_t sig_r_len; + uint8_t *sig_s; + size_t sig_s_len; +}; + +struct sk_resident_key { + uint32_t alg; + size_t slot; + char *application; + struct sk_enroll_response key; + uint8_t flags; + uint8_t *user_id; + size_t user_id_len; +}; + +struct sk_option { + char *name; + char *value; + uint8_t required; +}; + +#define SSH_SK_VERSION_MAJOR 0x000a0000 /* current API version */ +#define SSH_SK_VERSION_MAJOR_MASK 0xffff0000 + +/* Return the version of the middleware API */ +uint32_t sk_api_version(void); + +/* Enroll a U2F key (private key generation) */ +int sk_enroll(uint32_t alg, const uint8_t *challenge, size_t challenge_len, + const char *application, uint8_t flags, const char *pin, + struct sk_option **options, struct sk_enroll_response **enroll_response); + +/* Sign a challenge */ +int sk_sign(uint32_t alg, const uint8_t *data, size_t data_len, + const char *application, const uint8_t *key_handle, size_t key_handle_len, + uint8_t flags, const char *pin, struct sk_option **options, + struct sk_sign_response **sign_response); + +/* Enumerate all resident keys */ +int sk_load_resident_keys(const char *pin, struct sk_option **options, + struct sk_resident_key ***rks, size_t *nrks); + +#endif /* _SK_API_H */ |