NAME¶

libssh2_sign_sk - Create a signature from a FIDO2 authenticator.

SYNOPSIS¶

#include <libssh2.h>
int
libssh2_sign_sk(LIBSSH2_SESSION *session,


                unsigned char **sig,


                size_t *sig_len,


                const unsigned char *data,


                size_t data_len,


                void **abstract);
typedef struct _LIBSSH2_PRIVKEY_SK {


    int algorithm;


    uint8_t flags;


    const char *application;


    const unsigned char *key_handle;


    size_t handle_len;


    LIBSSH2_USERAUTH_SK_SIGN_FUNC((*sign_callback));


    void **orig_abstract;
} LIBSSH2_PRIVKEY_SK;

DESCRIPTION¶

session - Session instance as returned by libssh2_session_init_ex(3)

sig - A pointer to a buffer in which to place the signature. The caller is responsible for freeing the signature with LIBSSH2_FREE.

sig_len - A pointer to the length of the sig parameter.

data - The data to sign.

data_len - The length of the data parameter.

abstract - A pointer to a pointer to a LIBSSH2_PRIVKEY_SK. See description below.

Create a signature from a FIDO2 authenticator, using either the sk-ssh-ed25519@openssh.com or sk-ecdsa-sha2-nistp256@openssh.com key exchange algorithms.

The abstract parameter is a pointer to a pointer due to the internal workings of libssh2. The LIBSSH2_PRIVKEY_SK must be completely filled out, and the caller is responsible for all memory management of its fields.

algorithm - The signing algorithm to use. Possible values are LIBSSH2_HOSTKEY_TYPE_ED25519 and LIBSSH2_HOSTKEY_TYPE_ECDSA_256.

flags - A bitmask specifying options for the authenticator. When LIBSSH2_SK_PRESENCE_REQUIRED is set, the authenticator requires a touch. When LIBSSH2_SK_VERIFICATION_REQUIRED is set, the authenticator requires a PIN. Many servers and authenticators do not work properly when LIBSSH2_SK_PRESENCE_REQUIRED is not set.

application - A user-defined string to use as the RP name for the authenticator. Usually "ssh:".

key_handle - The key handle to use for the authenticator's allow list.

handle_len - The length of the key_handle parameter.

abstract - User-defined data. When a PIN is required, use this to pass in the PIN, or a function pointer to retrieve the PIN.

key_handle The decoded key handle from the private key file.

handle_len The length of the key_handle parameter.

sign_callback - Responsible for communicating with the hardware authenticator to generate a signature. On success, the signature information must be placed in the `sig_info sig_info parameter and the callback must return 0. On failure, it should return a negative number. See libssh2_userauth_publickey_sk(3)
for more information.

orig_abstract - User-defined data. When a PIN is required, use this to pass in the PIN, or a function pointer to retrieve the PIN.

RETURN VALUE¶

Return 0 on success or negative on failure.

SEE ALSO¶

libssh2_userauth_publickey_sk(3)