1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
module SSHData
module PublicKey
class DSA < Base
attr_reader :p, :q, :g, :y, :openssl
# Convert an SSH encoded DSA signature to DER encoding for verification with
# OpenSSL.
#
# sig - A binary String signature from an SSH packet.
#
# Returns a binary String signature, as expected by OpenSSL.
def self.openssl_signature(sig)
if sig.bytesize != 40
raise DecodeError, "bad DSA signature size"
end
r = OpenSSL::BN.new(sig.byteslice(0, 20), 2)
s = OpenSSL::BN.new(sig.byteslice(20, 20), 2)
OpenSSL::ASN1::Sequence.new([
OpenSSL::ASN1::Integer.new(r),
OpenSSL::ASN1::Integer.new(s)
]).to_der
end
# Convert an DER encoded DSA signature, as generated by OpenSSL to SSH
# encoding.
#
# sig - A binary String signature, as generated by OpenSSL.
#
# Returns a binary String signature, as found in an SSH packet.
def self.ssh_signature(sig)
a1 = OpenSSL::ASN1.decode(sig)
if a1.tag_class != :UNIVERSAL || a1.tag != OpenSSL::ASN1::SEQUENCE || a1.value.count != 2
raise DecodeError, "bad asn1 signature"
end
r, s = a1.value
if r.tag_class != :UNIVERSAL || r.tag != OpenSSL::ASN1::INTEGER || s.tag_class != :UNIVERSAL || s.tag != OpenSSL::ASN1::INTEGER
raise DecodeError, "bad asn1 signature"
end
# left pad big endian representations to 20 bytes and concatenate
[
"\x00" * (20 - r.value.num_bytes),
r.value.to_s(2),
"\x00" * (20 - s.value.num_bytes),
s.value.to_s(2)
].join
end
def initialize(algo:, p:, q:, g:, y:)
unless algo == ALGO_DSA
raise DecodeError, "bad algorithm: #{algo.inspect}"
end
@p = p
@q = q
@g = g
@y = y
@openssl = OpenSSL::PKey::DSA.new(asn1.to_der)
super(algo: algo)
end
# Verify an SSH signature.
#
# signed_data - The String message that the signature was calculated over.
# signature - The binarty String signature with SSH encoding.
#
# Returns boolean.
def verify(signed_data, signature)
sig_algo, ssh_sig, _ = Encoding.decode_signature(signature)
if sig_algo != ALGO_DSA
raise DecodeError, "bad signature algorithm: #{sig_algo.inspect}"
end
openssl_sig = self.class.openssl_signature(ssh_sig)
openssl.verify(OpenSSL::Digest::SHA1.new, openssl_sig, signed_data)
end
# RFC4253 binary encoding of the public key.
#
# Returns a binary String.
def rfc4253
Encoding.encode_fields(
[:string, algo],
[:mpint, p],
[:mpint, q],
[:mpint, g],
[:mpint, y],
)
end
# Is this public key equal to another public key?
#
# other - Another SSHData::PublicKey::Base instance to compare with.
#
# Returns boolean.
def ==(other)
super && other.p == p && other.q == q && other.g == g && other.y == y
end
private
def asn1
OpenSSL::ASN1::Sequence.new([
OpenSSL::ASN1::Sequence.new([
OpenSSL::ASN1::ObjectId.new("DSA"),
OpenSSL::ASN1::Sequence.new([
OpenSSL::ASN1::Integer.new(p),
OpenSSL::ASN1::Integer.new(q),
OpenSSL::ASN1::Integer.new(g),
]),
]),
OpenSSL::ASN1::BitString.new(OpenSSL::ASN1::Integer.new(y).to_der),
])
end
end
end
end
|
