security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-01-03 12:11:33 +01:00
Code Activity

agent: Support SSH signature flags.

Browse Source 
* agent/command-ssh.c (SSH_AGENT_RSA_SHA2_256): New.
(SSH_AGENT_RSA_SHA2_512): New.
(ssh_handler_sign_request): Override SPEC when FLAGS
is specified.

--

GnuPG-bug-id: 3880
Reported-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
This commit is contained in:
NIIBE Yutaka 2018-04-06 14:58:14 +09:00
parent d27417d3a5
commit 80b775bdbb
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
agent/command-ssh.c
View File

@ -83,6 +83,8 @@
/* Other constants. */ /* Other constants. */
#define SSH_DSA_SIGNATURE_PADDING 20 #define SSH_DSA_SIGNATURE_PADDING 20
#define SSH_DSA_SIGNATURE_ELEMS 2 #define SSH_DSA_SIGNATURE_ELEMS 2
#define SSH_AGENT_RSA_SHA2_256 0x02
#define SSH_AGENT_RSA_SHA2_512 0x04
#define SPEC_FLAG_USE_PKCS1V2 (1 << 0) #define SPEC_FLAG_USE_PKCS1V2 (1 << 0)
#define SPEC_FLAG_IS_ECDSA (1 << 1) #define SPEC_FLAG_IS_ECDSA (1 << 1)
#define SPEC_FLAG_IS_EdDSA (1 << 2) /*(lowercase 'd' on purpose.)*/ #define SPEC_FLAG_IS_EdDSA (1 << 2) /*(lowercase 'd' on purpose.)*/
@ -2880,11 +2882,24 @@ ssh_handler_sign_request (ctrl_t ctrl, estream_t request, estream_t response)
if (err) if (err)
goto out; goto out;
/* FIXME? */
err = stream_read_uint32 (request, &flags); err = stream_read_uint32 (request, &flags);
if (err) if (err)
goto out; goto out;
if (spec.algo == GCRY_PK_RSA)
{
if ((flags & SSH_AGENT_RSA_SHA2_256))
{
spec.ssh_identifier = "rsa-sha2-256";
spec.hash_algo = GCRY_MD_SHA256;
}
else if ((flags & SSH_AGENT_RSA_SHA2_512))
{
spec.ssh_identifier = "rsa-sha2-512";
spec.hash_algo = GCRY_MD_SHA512;
}
}
hash_algo = spec.hash_algo; hash_algo = spec.hash_algo;
if (!hash_algo) if (!hash_algo)
hash_algo = GCRY_MD_SHA1; /* Use the default. */ hash_algo = GCRY_MD_SHA1; /* Use the default. */