Mercurial > dropbear

comparison sk-ecdsa.c @ 1928:333688ec53d0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Handle ecdsa-sk flags, reject no-touch For the time being Dropbear will only allow SK auth with default parameters, user-presence needs to be set. In future handling of authorized_keys option "no-touch-required" can be added. This code would also be refactored to share between ecdsa and ed25519 once I get hardware/emulation to test ed25519.
author Matt Johnston <matt@ucc.asn.au>
date Wed, 30 Mar 2022 21:06:15 +0800
parents 35d504d59c05
children
comparison
equal deleted inserted replaced
1927:dc615fdb7c06 1928:333688ec53d0
4 4
5 #include "dbutil.h" 5 #include "dbutil.h"
6 #include "ecc.h" 6 #include "ecc.h"
7 #include "ecdsa.h" 7 #include "ecdsa.h"
8 #include "sk-ecdsa.h" 8 #include "sk-ecdsa.h"
9 #include "ssh.h"
9 10
10 int buf_sk_ecdsa_verify(buffer *buf, const ecc_key *key, const buffer *data_buf, const char* app, unsigned int applen) { 11 int buf_sk_ecdsa_verify(buffer *buf, const ecc_key *key, const buffer *data_buf, const char* app, unsigned int applen) {
11 hash_state hs; 12 hash_state hs;
12 unsigned char subhash[SHA256_HASH_SIZE]; 13 unsigned char subhash[SHA256_HASH_SIZE];
13 buffer *sk_buffer = NULL, *sig_buffer = NULL; 14 buffer *sk_buffer = NULL, *sig_buffer = NULL;
38 39
39 ret = buf_ecdsa_verify(sig_buffer, key, sk_buffer); 40 ret = buf_ecdsa_verify(sig_buffer, key, sk_buffer);
40 buf_free(sk_buffer); 41 buf_free(sk_buffer);
41 buf_free(sig_buffer); 42 buf_free(sig_buffer);
42 43
44 /* TODO: allow "no-touch-required" or "verify-required" authorized_keys options */
45 if (!(flags & SSH_SK_USER_PRESENCE_REQD)) {
46 if (ret == DROPBEAR_SUCCESS) {
47 dropbear_log(LOG_WARNING, "Rejecting, user-presence not set");
48 }
49 ret = DROPBEAR_FAILURE;
50 }
51
43 TRACE(("leave buf_sk_ecdsa_verify, ret=%d", ret)) 52 TRACE(("leave buf_sk_ecdsa_verify, ret=%d", ret))
44 return ret; 53 return ret;
45 } 54 }
46 55
47 #endif /* DROPBEAR_SK_ECDSA */ 56 #endif /* DROPBEAR_SK_ECDSA */