1 /* $OpenBSD: auth-rsa.c,v 1.73 2008/07/02 12:03:51 dtucker Exp $ */
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * RSA-based authentication. This code determines whether to admit a login
7 * based on RSA authentication. This file also contains functions to check
8 * validity of the host key.
10 * As far as I am concerned, the code I have written for this software
11 * can be used freely for any purpose. Any derived versions of this
12 * software must be clearly marked as such, and if the derived work is
13 * incompatible with the protocol description in the RFC file, it must be
14 * called by a name other than "ssh" or "Secure Shell".
19 #include <sys/types.h>
22 #include <openssl/rsa.h>
23 #include <openssl/md5.h>
37 #include "auth-options.h"
38 #include "pathnames.h"
48 #include "monitor_wrap.h"
53 extern ServerOptions options
;
56 * Session identifier that is used to bind key exchange and authentication
57 * responses to a particular session.
59 extern u_char session_id
[16];
62 * The .ssh/authorized_keys file contains public keys, one per line, in the
64 * options bits e n comment
65 * where bits, e and n are decimal numbers,
66 * and comment is any string of characters up to newline. The maximum
67 * length of a line is SSH_MAX_PUBKEY_BYTES characters. See sshd(8) for a
68 * description of the options.
72 auth_rsa_generate_challenge(Key
*key
)
77 if ((challenge
= BN_new()) == NULL
)
78 fatal("auth_rsa_generate_challenge: BN_new() failed");
79 /* Generate a random challenge. */
80 if (BN_rand(challenge
, 256, 0, 0) == 0)
81 fatal("auth_rsa_generate_challenge: BN_rand failed");
82 if ((ctx
= BN_CTX_new()) == NULL
)
83 fatal("auth_rsa_generate_challenge: BN_CTX_new failed");
84 if (BN_mod(challenge
, challenge
, key
->rsa
->n
, ctx
) == 0)
85 fatal("auth_rsa_generate_challenge: BN_mod failed");
92 auth_rsa_verify_response(Key
*key
, BIGNUM
*challenge
, u_char response
[16])
94 u_char buf
[32], mdbuf
[16];
98 /* don't allow short keys */
99 if (BN_num_bits(key
->rsa
->n
) < SSH_RSA_MINIMUM_MODULUS_SIZE
) {
100 error("auth_rsa_verify_response: RSA modulus too small: %d < minimum %d bits",
101 BN_num_bits(key
->rsa
->n
), SSH_RSA_MINIMUM_MODULUS_SIZE
);
105 /* The response is MD5 of decrypted challenge plus session id. */
106 len
= BN_num_bytes(challenge
);
107 if (len
<= 0 || len
> 32)
108 fatal("auth_rsa_verify_response: bad challenge length %d", len
);
110 BN_bn2bin(challenge
, buf
+ 32 - len
);
112 MD5_Update(&md
, buf
, 32);
113 MD5_Update(&md
, session_id
, 16);
114 MD5_Final(mdbuf
, &md
);
116 /* Verify that the response is the original challenge. */
117 if (memcmp(response
, mdbuf
, 16) != 0) {
121 /* Correct answer. */
126 * Performs the RSA authentication challenge-response dialog with the client,
127 * and returns true (non-zero) if the client gave the correct answer to
128 * our challenge; returns zero if the client gives a wrong answer.
132 auth_rsa_challenge_dialog(Key
*key
)
134 BIGNUM
*challenge
, *encrypted_challenge
;
138 if ((encrypted_challenge
= BN_new()) == NULL
)
139 fatal("auth_rsa_challenge_dialog: BN_new() failed");
141 challenge
= PRIVSEP(auth_rsa_generate_challenge(key
));
143 /* Encrypt the challenge with the public key. */
144 rsa_public_encrypt(encrypted_challenge
, challenge
, key
->rsa
);
146 /* Send the encrypted challenge to the client. */
147 packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE
);
148 packet_put_bignum(encrypted_challenge
);
150 BN_clear_free(encrypted_challenge
);
153 /* Wait for a response. */
154 packet_read_expect(SSH_CMSG_AUTH_RSA_RESPONSE
);
155 for (i
= 0; i
< 16; i
++)
156 response
[i
] = (u_char
)packet_get_char();
159 success
= PRIVSEP(auth_rsa_verify_response(key
, challenge
, response
));
160 BN_clear_free(challenge
);
165 * check if there's user key matching client_n,
166 * return key if login is allowed, NULL otherwise
170 auth_rsa_key_allowed(struct passwd
*pw
, BIGNUM
*client_n
, Key
**rkey
)
172 char line
[SSH_MAX_PUBKEY_BYTES
], *file
;
179 /* Temporarily use the user's uid. */
180 temporarily_use_uid(pw
);
182 /* The authorized keys. */
183 file
= authorized_keys_file(pw
);
184 debug("trying public RSA key file %s", file
);
185 f
= auth_openkeyfile(file
, pw
, options
.strict_modes
);
192 /* Flag indicating whether the key is allowed. */
195 key
= key_new(KEY_RSA1
);
198 * Go though the accepted keys, looking for the current key. If
199 * found, perform a challenge-response dialog to verify that the
200 * user really has the corresponding private key.
202 while (read_keyfile_line(f
, file
, line
, sizeof(line
), &linenum
) != -1) {
208 /* Skip leading whitespace, empty and comment lines. */
209 for (cp
= line
; *cp
== ' ' || *cp
== '\t'; cp
++)
211 if (!*cp
|| *cp
== '\n' || *cp
== '#')
215 * Check if there are options for this key, and if so,
216 * save their starting address and skip the option part
217 * for now. If there are no options, set the starting
220 if (*cp
< '0' || *cp
> '9') {
223 for (; *cp
&& (quoted
|| (*cp
!= ' ' && *cp
!= '\t')); cp
++) {
224 if (*cp
== '\\' && cp
[1] == '"')
225 cp
++; /* Skip both */
232 /* Parse the key from the line. */
233 if (hostfile_read_key(&cp
, &bits
, key
) == 0) {
234 debug("%.100s, line %lu: non ssh1 key syntax",
238 /* cp now points to the comment part. */
240 /* Check if the we have found the desired key (identified by its modulus). */
241 if (BN_cmp(key
->rsa
->n
, client_n
) != 0)
244 /* check the real bits */
245 keybits
= BN_num_bits(key
->rsa
->n
);
246 if (keybits
< 0 || bits
!= (u_int
)keybits
)
247 logit("Warning: %s, line %lu: keysize mismatch: "
248 "actual %d vs. announced %d.",
249 file
, linenum
, BN_num_bits(key
->rsa
->n
), bits
);
251 if (blacklisted_key(key
)) {
252 fp
= key_fingerprint(key
, SSH_FP_MD5
, SSH_FP_HEX
);
253 if (options
.permit_blacklisted_keys
)
254 logit("Public key %s blacklisted (see "
255 "ssh-vulnkey(1)); continuing anyway", fp
);
257 logit("Public key %s blacklisted (see "
258 "ssh-vulnkey(1))", fp
);
260 if (!options
.permit_blacklisted_keys
)
264 /* We have found the desired key. */
266 * If our options do not allow this key to be used,
267 * do not send challenge.
269 if (!auth_parse_options(pw
, key_options
, file
, linenum
))
272 /* break out, this key is allowed */
277 /* Restore the privileged uid. */
280 /* Close the file. */
284 /* return key if allowed */
285 if (allowed
&& rkey
!= NULL
)
293 * Performs the RSA authentication dialog with the client. This returns
294 * 0 if the client could not be authenticated, and 1 if authentication was
295 * successful. This may exit if there is a serious protocol violation.
298 auth_rsa(Authctxt
*authctxt
, BIGNUM
*client_n
)
302 struct passwd
*pw
= authctxt
->pw
;
305 if (!authctxt
->valid
)
308 if (!PRIVSEP(auth_rsa_key_allowed(pw
, client_n
, &key
))) {
309 auth_clear_options();
313 /* Perform the challenge-response dialog for this key. */
314 if (!auth_rsa_challenge_dialog(key
)) {
315 /* Wrong response. */
316 verbose("Wrong response to RSA authentication challenge.");
317 packet_send_debug("Wrong response to RSA authentication challenge.");
319 * Break out of the loop. Otherwise we might send
320 * another challenge and break the protocol.
326 * Correct response. The client has been successfully
327 * authenticated. Note that we have not yet processed the
328 * options; this will be reset if the options cause the
329 * authentication to be rejected.
331 fp
= key_fingerprint(key
, SSH_FP_MD5
, SSH_FP_HEX
);
332 verbose("Found matching %s key: %s",
337 packet_send_debug("RSA authentication accepted.");