nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-07-18 11:31:00 -05:00
Code Issues Projects Releases Wiki Activity

Certificate-aware handling of key fingerprints.

Browse Source 
OpenSSH, when called on to give the fingerprint of a certified public
key, will in many circumstances generate the hash of the public blob
of the _underlying_ key, rather than the hash of the full certificate.

I think the hash of the certificate is also potentially useful (if
nothing else, it provides a way to tell apart multiple certificates on
the same key). But I can also see that it's useful to be able to
recognise a key as the same one 'really' (since all certificates on
the same key share a private key, so they're unavoidably related).

So I've dealt with this by introducing an extra pair of fingerprint
types, giving the cross product of {MD5, SHA-256} x {base key only,
full certificate}. You can manually select which one you want to see
in some circumstances (notably PuTTYgen), and in others (such as
diagnostics) both fingerprints will be emitted side by side via the
new functions ssh2_double_fingerprint[_blob].

The default, following OpenSSH, is to just fingerprint the base key.
This commit is contained in:
Simon Tatham
2022-08-05 18:08:59 +01:00
parent e711a08daf
commit cd7f6c4407
11 changed files with 150 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
ssh.h
View File

@ -1454,12 +1454,36 @@ enum {
};
typedef enum {
/* Default fingerprint types strip off a certificate to show you
* the fingerprint of the underlying public key */
SSH_FPTYPE_MD5,
SSH_FPTYPE_SHA256,
/* Non-default version of each fingerprint type which is 'raw',
* giving you the true hash of the public key blob even if it
* includes a certificate */
SSH_FPTYPE_MD5_CERT,
SSH_FPTYPE_SHA256_CERT,
} FingerprintType;
static inline bool ssh_fptype_is_cert(FingerprintType fptype)
{
return fptype >= SSH_FPTYPE_MD5_CERT;
}
static inline FingerprintType ssh_fptype_from_cert(FingerprintType fptype)
{
if (ssh_fptype_is_cert(fptype))
fptype -= (SSH_FPTYPE_MD5_CERT - SSH_FPTYPE_MD5);
return fptype;
}
static inline FingerprintType ssh_fptype_to_cert(FingerprintType fptype)
{
if (!ssh_fptype_is_cert(fptype))
fptype += (SSH_FPTYPE_MD5_CERT - SSH_FPTYPE_MD5);
return fptype;
}
#define SSH_N_FPTYPES (SSH_FPTYPE_SHA256_CERT + 1)
#define SSH_FPTYPE_DEFAULT SSH_FPTYPE_SHA256
#define SSH_N_FPTYPES (SSH_FPTYPE_SHA256 + 1)
FingerprintType ssh2_pick_fingerprint(char **fingerprints,
FingerprintType preferred_type);
@ -1473,6 +1497,8 @@ void ssh2_write_pubkey(FILE *fp, const char *comment,
int keytype);
char *ssh2_fingerprint_blob(ptrlen, FingerprintType);
char *ssh2_fingerprint(ssh_key *key, FingerprintType);
char *ssh2_double_fingerprint_blob(ptrlen, FingerprintType);
char *ssh2_double_fingerprint(ssh_key *key, FingerprintType);
char **ssh2_all_fingerprints_for_blob(ptrlen);
char **ssh2_all_fingerprints(ssh_key *key);
void ssh2_free_all_fingerprints(char **);