upstream: factor out encoding of a raw ed25519 signature into its

ssh form into a separate function

OpenBSD-Commit-ID: 3711c6d6b52dde0bd1f17884da5cddb8716f1b64

diff --git a/ssh-ed25519.c b/ssh-ed25519.c
index 22d8db026b4c7a94fe5adb424b0886e9841d0681..c8caa22214b7b9dc527ec5688c9505a3804d4618 100644 (file)
--- a/ssh-ed25519.c
+++ b/ssh-ed25519.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-ed25519.c,v 1.19 2022/10/28 00:44:44 djm Exp $ */
+/* $OpenBSD: ssh-ed25519.c,v 1.20 2025/07/24 06:12:08 djm Exp $ */
 /*
  * Copyright (c) 2013 Markus Friedl <markus@openbsd.org>
  *
@@ -149,10 +149,9 @@ ssh_ed25519_sign(struct sshkey *key,
     const char *alg, const char *sk_provider, const char *sk_pin, u_int compat)
 {
        u_char *sig = NULL;
-       size_t slen = 0, len;
+       size_t slen = 0;
        unsigned long long smlen;
        int r, ret;
-       struct sshbuf *b = NULL;
 
        if (lenp != NULL)
                *lenp = 0;
@@ -173,13 +172,40 @@ ssh_ed25519_sign(struct sshkey *key,
                r = SSH_ERR_INVALID_ARGUMENT; /* XXX better error? */
                goto out;
        }
+       if ((r = ssh_ed25519_encode_store_sig(sig, smlen - datalen,
+           sigp, lenp)) != 0)
+               goto out;
+
+       /* success */
+       r = 0;
+ out:
+       freezero(sig, slen);
+       return r;
+}
+
+int
+ssh_ed25519_encode_store_sig(const u_char *sig, size_t slen,
+    u_char **sigp, size_t *lenp)
+{
+       struct sshbuf *b = NULL;
+       int r = -1;
+       size_t len;
+
+       if (lenp != NULL)
+               *lenp = 0;
+       if (sigp != NULL)
+               *sigp = NULL;
+
+       if (slen != crypto_sign_ed25519_BYTES)
+               return SSH_ERR_INVALID_ARGUMENT;
+
        /* encode signature */
        if ((b = sshbuf_new()) == NULL) {
                r = SSH_ERR_ALLOC_FAIL;
                goto out;
        }
        if ((r = sshbuf_put_cstring(b, "ssh-ed25519")) != 0 ||
-           (r = sshbuf_put_string(b, sig, smlen - datalen)) != 0)
+           (r = sshbuf_put_string(b, sig, slen)) != 0)
                goto out;
        len = sshbuf_len(b);
        if (sigp != NULL) {
@@ -195,9 +221,6 @@ ssh_ed25519_sign(struct sshkey *key,
        r = 0;
  out:
        sshbuf_free(b);
-       if (sig != NULL)
-               freezero(sig, slen);
-
        return r;
 }
 

diff --git a/sshkey.h b/sshkey.h
index 13309416b6c80fc1a94fb3f187520b1c788afb35..77253bc4e12a50bc5b2a9d275882c8e2360c1218 100644 (file)
--- a/sshkey.h
+++ b/sshkey.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshkey.h,v 1.68 2025/07/24 05:44:55 djm Exp $ */
+/* $OpenBSD: sshkey.h,v 1.69 2025/07/24 06:12:08 djm Exp $ */
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -319,6 +319,8 @@ int ssh_rsa_encode_store_sig(int, const u_char *, size_t,
            u_char **, size_t *);
 int    ssh_ecdsa_encode_store_sig(const struct sshkey *,
            const BIGNUM *, const BIGNUM *, u_char **, size_t *);
+int    ssh_ed25519_encode_store_sig(const u_char *, size_t,
+           u_char **, size_t *);
 /* XXX should be internal, but used by ssh-keygen */
 int ssh_rsa_complete_crt_parameters(const BIGNUM *, const BIGNUM *,
     const BIGNUM *, const BIGNUM *, BIGNUM **, BIGNUM **);