1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
package sshsig
import (
"crypto"
"errors"
"fmt"
"hash"
)
// supportedHashAlgorithm is a map of supported hash algorithms, as defined in
// the protocol.
// xref: https://github.com/openssh/openssh-portable/blob/V_9_2_P1/PROTOCOL.sshsig#L66-L67
var supportedHashAlgorithms = map[HashAlgorithm]crypto.Hash{
HashSHA256: crypto.SHA256,
HashSHA512: crypto.SHA512,
}
var (
// ErrUnsupportedHashAlgorithm is returned by Sign and Verify if the hash
// algorithm is not supported.
ErrUnsupportedHashAlgorithm = errors.New("unsupported hash algorithm")
// ErrUnavailableHashAlgorithm is returned by Sign and Verify if the hash
// algorithm is not available.
ErrUnavailableHashAlgorithm = errors.New("unavailable hash algorithm")
)
const (
// HashSHA256 is the SHA-256 hash algorithm.
HashSHA256 HashAlgorithm = "sha256"
// HashSHA512 is the SHA-512 hash algorithm.
HashSHA512 HashAlgorithm = "sha512"
)
// HashAlgorithm represents an algorithm used to compute a hash of a
// message.
type HashAlgorithm string
// Supported returns ErrUnsupportedHashAlgorithm if the hash algorithm is not
// supported, nil otherwise. Use Available if the intention is to make use of
// the hash algorithm, as it also checks if the hash algorithm is available.
func (h HashAlgorithm) Supported() error {
if _, ok := supportedHashAlgorithms[h]; !ok {
// TODO(hidde): if the number of supported hash algorithms grows, it
// might be worth generating the list of supported algorithms.
return fmt.Errorf("%w %q: must be %q or %q", ErrUnsupportedHashAlgorithm, h.String(), HashSHA256, HashSHA512)
}
return nil
}
// Available returns ErrUnsupportedHashAlgorithm if the hash algorithm is not
// supported, ErrUnavailableHashAlgorithm if the hash algorithm is not available,
// nil otherwise.
func (h HashAlgorithm) Available() error {
if err := h.Supported(); err != nil {
return err
}
if !supportedHashAlgorithms[h].Available() {
return fmt.Errorf("%w %q", ErrUnavailableHashAlgorithm, h.String())
}
return nil
}
// Hash returns a hash.Hash for the hash algorithm. If the hash algorithm is
// not available, it panics. The library itself ensures that the hash algorithm
// is available before calling this function.
func (h HashAlgorithm) Hash() hash.Hash {
if h == "" {
panic("sshsig: hash algorithm not specified")
}
if err := h.Available(); err != nil {
panic("sshsig: " + err.Error())
}
return supportedHashAlgorithms[h].New()
}
// String returns the string representation of the hash algorithm.
func (h HashAlgorithm) String() string {
return string(h)
}
// SupportedHashAlgorithms returns a list of supported hash algorithms.
func SupportedHashAlgorithms() []HashAlgorithm {
var algorithms []HashAlgorithm
for algorithm := range supportedHashAlgorithms {
algorithms = append(algorithms, algorithm)
}
return algorithms
}
|
