libssh2

1
.\" Copyright (C) The libssh2 project and its contributors.
2
.\" SPDX-License-Identifier: BSD-3-Clause
3
.TH libssh2_sign_sk 3 "1 Jun 2022" "libssh2 1.10.0" "libssh2"
4
.SH NAME
5
libssh2_sign_sk - Create a signature from a FIDO2 authenticator.
6
.SH SYNOPSIS
7
.nf
8
#include <libssh2.h>
9

10
int
11
libssh2_sign_sk(LIBSSH2_SESSION *session,
12
                unsigned char **sig,
13
                size_t *sig_len,
14
                const unsigned char *data,
15
                size_t data_len,
16
                void **abstract);
17

18
typedef struct _LIBSSH2_PRIVKEY_SK {
19
    int algorithm;
20
    uint8_t flags;
21
    const char *application;
22
    const unsigned char *key_handle;
23
    size_t handle_len;
24
    LIBSSH2_USERAUTH_SK_SIGN_FUNC((*sign_callback));
25
    void **orig_abstract;
26
} LIBSSH2_PRIVKEY_SK;
27
.fi
28
.SH DESCRIPTION
29
\fIsession\fP - Session instance as returned by
30
.BR libssh2_session_init_ex(3)
31

32
\fIsig\fP - A pointer to a buffer in which to place the signature. The caller
33
is responsible for freeing the signature with LIBSSH2_FREE.
34

35
\fIsig_len\fP - A pointer to the length of the sig parameter.
36

37
\fIdata\fP - The data to sign.
38

39
\fIdata_len\fP - The length of the data parameter.
40

41
\fIabstract\fP - A pointer to a pointer to a LIBSSH2_PRIVKEY_SK. See
42
description below.
43

44
Create a signature from a FIDO2 authenticator, using either the
45
sk-ssh-ed25519@openssh.com or sk-ecdsa-sha2-nistp256@openssh.com key
46
exchange algorithms.
47

48
The abstract parameter is a pointer to a pointer due to the internal workings
49
of libssh2. The LIBSSH2_PRIVKEY_SK must be completely filled out, and the
50
caller is responsible for all memory management of its fields.
51

52
\fIalgorithm\fP - The signing algorithm to use. Possible values are
53
LIBSSH2_HOSTKEY_TYPE_ED25519 and LIBSSH2_HOSTKEY_TYPE_ECDSA_256.
54

55
\fIflags\fP - A bitmask specifying options for the authenticator. When
56
LIBSSH2_SK_PRESENCE_REQUIRED is set, the authenticator requires a touch. When
57
LIBSSH2_SK_VERIFICATION_REQUIRED is set, the authenticator requires a PIN.
58
Many servers and authenticators do not work properly when
59
LIBSSH2_SK_PRESENCE_REQUIRED is not set.
60

61
\fIapplication\fP - A user-defined string to use as the RP name for the
62
authenticator. Usually "ssh:".
63

64
\fIkey_handle\fP - The key handle to use for the authenticator's allow list.
65

66
\fIhandle_len\fP - The length of the key_handle parameter.
67

68
\fIabstract\fP - User-defined data. When a PIN is required, use this to pass in
69
the PIN, or a function pointer to retrieve the PIN.
70

71
\fIkey_handle\fP The decoded key handle from the private key file.
72

73
\fIhandle_len\fP The length of the key_handle parameter.
74

75
\fIsign_callback\fP - Responsible for communicating with the hardware
76
authenticator to generate a signature. On success, the signature information
77
must be placed in the `\fIsig_info\fP sig_info parameter and the callback must
78
return 0. On failure, it should return a negative number. See
79
.BR libssh2_userauth_publickey_sk(3)
80
 for more information.
81

82
\fIorig_abstract\fP - User-defined data. When a PIN is required, use this to
83
pass in the PIN, or a function pointer to retrieve the PIN.
84
.SH RETURN VALUE
85
Return 0 on success or negative on failure.
86
.SH SEE ALSO
87
.BR libssh2_userauth_publickey_sk(3)
88