1 /* $OpenBSD: auth-rsa.c,v 1.78 2010/07/13 23:13:16 djm Exp $ */
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * RSA-based authentication. This code determines whether to admit a login
7 * based on RSA authentication. This file also contains functions to check
8 * validity of the host key.
10 * As far as I am concerned, the code I have written for this software
11 * can be used freely for any purpose. Any derived versions of this
12 * software must be clearly marked as such, and if the derived work is
13 * incompatible with the protocol description in the RFC file, it must be
14 * called by a name other than "ssh" or "Secure Shell".
19 #include <sys/types.h>
22 #include <openssl/rsa.h>
23 #include <openssl/md5.h>
37 #include "pathnames.h"
41 #include "auth-options.h"
48 #include "monitor_wrap.h"
53 extern ServerOptions options
;
56 * Session identifier that is used to bind key exchange and authentication
57 * responses to a particular session.
59 extern u_char session_id
[16];
62 * The .ssh/authorized_keys file contains public keys, one per line, in the
64 * options bits e n comment
65 * where bits, e and n are decimal numbers,
66 * and comment is any string of characters up to newline. The maximum
67 * length of a line is SSH_MAX_PUBKEY_BYTES characters. See sshd(8) for a
68 * description of the options.
72 auth_rsa_generate_challenge(Key
*key
)
77 if ((challenge
= BN_new()) == NULL
)
78 fatal("auth_rsa_generate_challenge: BN_new() failed");
79 /* Generate a random challenge. */
80 if (BN_rand(challenge
, 256, 0, 0) == 0)
81 fatal("auth_rsa_generate_challenge: BN_rand failed");
82 if ((ctx
= BN_CTX_new()) == NULL
)
83 fatal("auth_rsa_generate_challenge: BN_CTX_new failed");
84 if (BN_mod(challenge
, challenge
, key
->rsa
->n
, ctx
) == 0)
85 fatal("auth_rsa_generate_challenge: BN_mod failed");
92 auth_rsa_verify_response(Key
*key
, BIGNUM
*challenge
, u_char response
[16])
94 u_char buf
[32], mdbuf
[16];
98 if (auth_key_is_revoked(key
))
101 /* don't allow short keys */
102 if (BN_num_bits(key
->rsa
->n
) < SSH_RSA_MINIMUM_MODULUS_SIZE
) {
103 error("auth_rsa_verify_response: RSA modulus too small: %d < minimum %d bits",
104 BN_num_bits(key
->rsa
->n
), SSH_RSA_MINIMUM_MODULUS_SIZE
);
108 /* The response is MD5 of decrypted challenge plus session id. */
109 len
= BN_num_bytes(challenge
);
110 if (len
<= 0 || len
> 32)
111 fatal("auth_rsa_verify_response: bad challenge length %d", len
);
113 BN_bn2bin(challenge
, buf
+ 32 - len
);
115 MD5_Update(&md
, buf
, 32);
116 MD5_Update(&md
, session_id
, 16);
117 MD5_Final(mdbuf
, &md
);
119 /* Verify that the response is the original challenge. */
120 if (timingsafe_bcmp(response
, mdbuf
, 16) != 0) {
124 /* Correct answer. */
129 * Performs the RSA authentication challenge-response dialog with the client,
130 * and returns true (non-zero) if the client gave the correct answer to
131 * our challenge; returns zero if the client gives a wrong answer.
135 auth_rsa_challenge_dialog(Key
*key
)
137 BIGNUM
*challenge
, *encrypted_challenge
;
141 if ((encrypted_challenge
= BN_new()) == NULL
)
142 fatal("auth_rsa_challenge_dialog: BN_new() failed");
144 challenge
= PRIVSEP(auth_rsa_generate_challenge(key
));
146 /* Encrypt the challenge with the public key. */
147 rsa_public_encrypt(encrypted_challenge
, challenge
, key
->rsa
);
149 /* Send the encrypted challenge to the client. */
150 packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE
);
151 packet_put_bignum(encrypted_challenge
);
153 BN_clear_free(encrypted_challenge
);
156 /* Wait for a response. */
157 packet_read_expect(SSH_CMSG_AUTH_RSA_RESPONSE
);
158 for (i
= 0; i
< 16; i
++)
159 response
[i
] = (u_char
)packet_get_char();
162 success
= PRIVSEP(auth_rsa_verify_response(key
, challenge
, response
));
163 BN_clear_free(challenge
);
168 * check if there's user key matching client_n,
169 * return key if login is allowed, NULL otherwise
173 auth_rsa_key_allowed(struct passwd
*pw
, BIGNUM
*client_n
, Key
**rkey
)
175 char line
[SSH_MAX_PUBKEY_BYTES
], *file
;
182 /* Temporarily use the user's uid. */
183 temporarily_use_uid(pw
);
185 /* The authorized keys. */
186 file
= authorized_keys_file(pw
);
187 debug("trying public RSA key file %s", file
);
188 f
= auth_openkeyfile(file
, pw
, options
.strict_modes
);
195 /* Flag indicating whether the key is allowed. */
198 key
= key_new(KEY_RSA1
);
201 * Go though the accepted keys, looking for the current key. If
202 * found, perform a challenge-response dialog to verify that the
203 * user really has the corresponding private key.
205 while (read_keyfile_line(f
, file
, line
, sizeof(line
), &linenum
) != -1) {
211 /* Skip leading whitespace, empty and comment lines. */
212 for (cp
= line
; *cp
== ' ' || *cp
== '\t'; cp
++)
214 if (!*cp
|| *cp
== '\n' || *cp
== '#')
218 * Check if there are options for this key, and if so,
219 * save their starting address and skip the option part
220 * for now. If there are no options, set the starting
223 if (*cp
< '0' || *cp
> '9') {
226 for (; *cp
&& (quoted
|| (*cp
!= ' ' && *cp
!= '\t')); cp
++) {
227 if (*cp
== '\\' && cp
[1] == '"')
228 cp
++; /* Skip both */
235 /* Parse the key from the line. */
236 if (hostfile_read_key(&cp
, &bits
, key
) == 0) {
237 debug("%.100s, line %lu: non ssh1 key syntax",
241 /* cp now points to the comment part. */
243 /* Check if the we have found the desired key (identified by its modulus). */
244 if (BN_cmp(key
->rsa
->n
, client_n
) != 0)
247 /* check the real bits */
248 keybits
= BN_num_bits(key
->rsa
->n
);
249 if (keybits
< 0 || bits
!= (u_int
)keybits
)
250 logit("Warning: %s, line %lu: keysize mismatch: "
251 "actual %d vs. announced %d.",
252 file
, linenum
, BN_num_bits(key
->rsa
->n
), bits
);
254 if (blacklisted_key(key
)) {
255 fp
= key_fingerprint(key
, SSH_FP_MD5
, SSH_FP_HEX
);
256 if (options
.permit_blacklisted_keys
)
257 logit("Public key %s blacklisted (see "
258 "ssh-vulnkey(1)); continuing anyway", fp
);
260 logit("Public key %s blacklisted (see "
261 "ssh-vulnkey(1))", fp
);
263 if (!options
.permit_blacklisted_keys
)
267 /* We have found the desired key. */
269 * If our options do not allow this key to be used,
270 * do not send challenge.
272 if (!auth_parse_options(pw
, key_options
, file
, linenum
))
274 if (key_is_cert_authority
)
276 /* break out, this key is allowed */
281 /* Restore the privileged uid. */
284 /* Close the file. */
288 /* return key if allowed */
289 if (allowed
&& rkey
!= NULL
)
297 * Performs the RSA authentication dialog with the client. This returns
298 * 0 if the client could not be authenticated, and 1 if authentication was
299 * successful. This may exit if there is a serious protocol violation.
302 auth_rsa(Authctxt
*authctxt
, BIGNUM
*client_n
)
306 struct passwd
*pw
= authctxt
->pw
;
309 if (!authctxt
->valid
)
312 if (!PRIVSEP(auth_rsa_key_allowed(pw
, client_n
, &key
))) {
313 auth_clear_options();
317 /* Perform the challenge-response dialog for this key. */
318 if (!auth_rsa_challenge_dialog(key
)) {
319 /* Wrong response. */
320 verbose("Wrong response to RSA authentication challenge.");
321 packet_send_debug("Wrong response to RSA authentication challenge.");
323 * Break out of the loop. Otherwise we might send
324 * another challenge and break the protocol.
330 * Correct response. The client has been successfully
331 * authenticated. Note that we have not yet processed the
332 * options; this will be reset if the options cause the
333 * authentication to be rejected.
335 fp
= key_fingerprint(key
, SSH_FP_MD5
, SSH_FP_HEX
);
336 verbose("Found matching %s key: %s",
341 packet_send_debug("RSA authentication accepted.");