1 /* $OpenBSD: auth-rsa.c,v 1.90 2015/01/28 22:36:00 djm Exp $ */
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * RSA-based authentication. This code determines whether to admit a login
7 * based on RSA authentication. This file also contains functions to check
8 * validity of the host key.
10 * As far as I am concerned, the code I have written for this software
11 * can be used freely for any purpose. Any derived versions of this
12 * software must be clearly marked as such, and if the derived work is
13 * incompatible with the protocol description in the RFC file, it must be
14 * called by a name other than "ssh" or "Secure Shell".
21 #include <sys/types.h>
24 #include <openssl/rsa.h>
38 #include "pathnames.h"
43 #include "auth-options.h"
49 #include "monitor_wrap.h"
55 extern ServerOptions options
;
58 * Session identifier that is used to bind key exchange and authentication
59 * responses to a particular session.
61 extern u_char session_id
[16];
64 * The .ssh/authorized_keys file contains public keys, one per line, in the
66 * options bits e n comment
67 * where bits, e and n are decimal numbers,
68 * and comment is any string of characters up to newline. The maximum
69 * length of a line is SSH_MAX_PUBKEY_BYTES characters. See sshd(8) for a
70 * description of the options.
74 auth_rsa_generate_challenge(Key
*key
)
79 if ((challenge
= BN_new()) == NULL
)
80 fatal("auth_rsa_generate_challenge: BN_new() failed");
81 /* Generate a random challenge. */
82 if (BN_rand(challenge
, 256, 0, 0) == 0)
83 fatal("auth_rsa_generate_challenge: BN_rand failed");
84 if ((ctx
= BN_CTX_new()) == NULL
)
85 fatal("auth_rsa_generate_challenge: BN_CTX_new failed");
86 if (BN_mod(challenge
, challenge
, key
->rsa
->n
, ctx
) == 0)
87 fatal("auth_rsa_generate_challenge: BN_mod failed");
94 auth_rsa_verify_response(Key
*key
, BIGNUM
*challenge
, u_char response
[16])
96 u_char buf
[32], mdbuf
[16];
97 struct ssh_digest_ctx
*md
;
100 /* don't allow short keys */
101 if (BN_num_bits(key
->rsa
->n
) < SSH_RSA_MINIMUM_MODULUS_SIZE
) {
102 error("%s: RSA modulus too small: %d < minimum %d bits",
104 BN_num_bits(key
->rsa
->n
), SSH_RSA_MINIMUM_MODULUS_SIZE
);
108 /* The response is MD5 of decrypted challenge plus session id. */
109 len
= BN_num_bytes(challenge
);
110 if (len
<= 0 || len
> 32)
111 fatal("%s: bad challenge length %d", __func__
, len
);
113 BN_bn2bin(challenge
, buf
+ 32 - len
);
114 if ((md
= ssh_digest_start(SSH_DIGEST_MD5
)) == NULL
||
115 ssh_digest_update(md
, buf
, 32) < 0 ||
116 ssh_digest_update(md
, session_id
, 16) < 0 ||
117 ssh_digest_final(md
, mdbuf
, sizeof(mdbuf
)) < 0)
118 fatal("%s: md5 failed", __func__
);
121 /* Verify that the response is the original challenge. */
122 if (timingsafe_bcmp(response
, mdbuf
, 16) != 0) {
126 /* Correct answer. */
131 * Performs the RSA authentication challenge-response dialog with the client,
132 * and returns true (non-zero) if the client gave the correct answer to
133 * our challenge; returns zero if the client gives a wrong answer.
137 auth_rsa_challenge_dialog(Key
*key
)
139 BIGNUM
*challenge
, *encrypted_challenge
;
143 if ((encrypted_challenge
= BN_new()) == NULL
)
144 fatal("auth_rsa_challenge_dialog: BN_new() failed");
146 challenge
= PRIVSEP(auth_rsa_generate_challenge(key
));
148 /* Encrypt the challenge with the public key. */
149 if (rsa_public_encrypt(encrypted_challenge
, challenge
, key
->rsa
) != 0)
150 fatal("%s: rsa_public_encrypt failed", __func__
);
152 /* Send the encrypted challenge to the client. */
153 packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE
);
154 packet_put_bignum(encrypted_challenge
);
156 BN_clear_free(encrypted_challenge
);
159 /* Wait for a response. */
160 packet_read_expect(SSH_CMSG_AUTH_RSA_RESPONSE
);
161 for (i
= 0; i
< 16; i
++)
162 response
[i
] = (u_char
)packet_get_char();
165 success
= PRIVSEP(auth_rsa_verify_response(key
, challenge
, response
));
166 BN_clear_free(challenge
);
171 rsa_key_allowed_in_file(struct passwd
*pw
, char *file
,
172 const BIGNUM
*client_n
, Key
**rkey
)
174 char *fp
, line
[SSH_MAX_PUBKEY_BYTES
];
175 int allowed
= 0, bits
;
180 debug("trying public RSA key file %s", file
);
181 if ((f
= auth_openkeyfile(file
, pw
, options
.strict_modes
)) == NULL
)
185 * Go though the accepted keys, looking for the current key. If
186 * found, perform a challenge-response dialog to verify that the
187 * user really has the corresponding private key.
189 key
= key_new(KEY_RSA1
);
190 while (read_keyfile_line(f
, file
, line
, sizeof(line
), &linenum
) != -1) {
195 /* Skip leading whitespace, empty and comment lines. */
196 for (cp
= line
; *cp
== ' ' || *cp
== '\t'; cp
++)
198 if (!*cp
|| *cp
== '\n' || *cp
== '#')
202 * Check if there are options for this key, and if so,
203 * save their starting address and skip the option part
204 * for now. If there are no options, set the starting
207 if (*cp
< '0' || *cp
> '9') {
210 for (; *cp
&& (quoted
|| (*cp
!= ' ' && *cp
!= '\t')); cp
++) {
211 if (*cp
== '\\' && cp
[1] == '"')
212 cp
++; /* Skip both */
219 /* Parse the key from the line. */
220 if (hostfile_read_key(&cp
, &bits
, key
) == 0) {
221 debug("%.100s, line %lu: non ssh1 key syntax",
225 /* cp now points to the comment part. */
228 * Check if the we have found the desired key (identified
231 if (BN_cmp(key
->rsa
->n
, client_n
) != 0)
234 /* check the real bits */
235 keybits
= BN_num_bits(key
->rsa
->n
);
236 if (keybits
< 0 || bits
!= keybits
)
237 logit("Warning: %s, line %lu: keysize mismatch: "
238 "actual %d vs. announced %d.",
239 file
, linenum
, BN_num_bits(key
->rsa
->n
), bits
);
241 if ((fp
= sshkey_fingerprint(key
, options
.fingerprint_hash
,
242 SSH_FP_DEFAULT
)) == NULL
)
244 debug("matching key found: file %s, line %lu %s %s",
245 file
, linenum
, key_type(key
), fp
);
248 /* Never accept a revoked key */
249 if (auth_key_is_revoked(key
))
252 /* We have found the desired key. */
254 * If our options do not allow this key to be used,
255 * do not send challenge.
257 if (!auth_parse_options(pw
, key_options
, file
, linenum
))
259 if (key_is_cert_authority
)
261 /* break out, this key is allowed */
266 /* Close the file. */
269 /* return key if allowed */
270 if (allowed
&& rkey
!= NULL
)
279 * check if there's user key matching client_n,
280 * return key if login is allowed, NULL otherwise
284 auth_rsa_key_allowed(struct passwd
*pw
, BIGNUM
*client_n
, Key
**rkey
)
287 u_int i
, allowed
= 0;
289 temporarily_use_uid(pw
);
291 for (i
= 0; !allowed
&& i
< options
.num_authkeys_files
; i
++) {
292 if (strcasecmp(options
.authorized_keys_files
[i
], "none") == 0)
294 file
= expand_authorized_keys(
295 options
.authorized_keys_files
[i
], pw
);
296 allowed
= rsa_key_allowed_in_file(pw
, file
, client_n
, rkey
);
306 * Performs the RSA authentication dialog with the client. This returns
307 * 0 if the client could not be authenticated, and 1 if authentication was
308 * successful. This may exit if there is a serious protocol violation.
311 auth_rsa(Authctxt
*authctxt
, BIGNUM
*client_n
)
314 struct passwd
*pw
= authctxt
->pw
;
317 if (!authctxt
->valid
)
320 if (!PRIVSEP(auth_rsa_key_allowed(pw
, client_n
, &key
))) {
321 auth_clear_options();
325 /* Perform the challenge-response dialog for this key. */
326 if (!auth_rsa_challenge_dialog(key
)) {
327 /* Wrong response. */
328 verbose("Wrong response to RSA authentication challenge.");
329 packet_send_debug("Wrong response to RSA authentication challenge.");
331 * Break out of the loop. Otherwise we might send
332 * another challenge and break the protocol.
338 * Correct response. The client has been successfully
339 * authenticated. Note that we have not yet processed the
340 * options; this will be reset if the options cause the
341 * authentication to be rejected.
343 pubkey_auth_info(authctxt
, key
, NULL
);
345 packet_send_debug("RSA authentication accepted.");
349 #endif /* WITH_SSH1 */