Skip to content

Commit 063384d

Browse files
geedo0geedo0
committed
Implement Hybrid SSH Keys
This finishes the work in PR #160 which applied the upstream `sshkey.c` refactor to the OQS fork by adding support for hybrid SSH keys. More importantly, this brings the `OQS-v9` branch up to parity with `OQS-v8` in terms of supported algorithms and functionality. Therefore, we can do more in depth and thorough validation to increase confidence in cutting over to this newer branch. Speaking to the code changes for hybrid SSH key support, this works by adding logic to `ssh-oqs` which branches on hybrid SSH key implementations to handle the classical portion of the key and combine it with the PQ portion as-appropriate. The main trick is to introduce a small lookup table for the RSA/ECDSA implementation and exposing the symbols to `ssh-oqs` via an extern declaration. One notable oddity is that upstream OpenSSH multiplexes the underlying EC curves by placing a generic implementation behind the P-256 struct and allowing the implementation to fork based on the `bits` or `key->type` parameters. Depending on the context, this is how `sshkey` does things so I followed their convention. Related to issue #135 Asserted that Circle CI jobs pass. These tests run through a subset of the OpenSSH unit tests that have been documented to pass against the OQS fork and skip tests that depend on missing/broken functionality. This demonstrates internal consistency and parity with the testing bar set by `OQS-v8`. Performed interop testing between `OQS-v8` and `OQS-v9` to assert that we have no regressions from pulling in 2 years of upstream changes and re-implementing PQ+Hybrid SSH Keys. This was done by modifying `try_connection.py` which tests all PQ+Hybrid signatures and key exchanges by connecting the built SSH client to the SSHD server and explicitly specifying each algorithm. By adding CLI flags to override this test to use an SSH or SSHD binary from somewhere else, we can perform thorough interop testing between an `OQS-v8` server and `OQS-v9` client or vice versa. Detailed process/commands outlined below. ``` git clone git@github.com:open-quantum-safe/openssh.git oqs-openssh-clean cd oqs-openssh-clean git checkout OQS-v8 ./oqs-scripts/clone_liboqs.sh ./oqs-scripts/build_liboqs.sh ./oqs-scripts/build_openssh.sh python3 oqs-test/try_connection.py --sshd `readlink -f ../oqs-openssh-clean/sshd` doall Success! Key Exchange Algorithm: frodokem-640-aes-sha256. Signature Algorithm: ssh-falcon512. Success! Key Exchange Algorithm: frodokem-640-aes-sha256. Signature Algorithm: ssh-rsa3072-falcon512. Success! Key Exchange Algorithm: frodokem-640-aes-sha256. Signature Algorithm: ssh-ecdsa-nistp256-falcon512. Success! Key Exchange Algorithm: frodokem-640-aes-sha256. Signature Algorithm: ssh-falcon1024. Success! Key Exchange Algorithm: frodokem-640-aes-sha256. Signature Algorithm: ssh-ecdsa-nistp521-falcon1024. Success! Key Exchange Algorithm: frodokem-640-aes-sha256. Signature Algorithm: ssh-dilithium2. ... python3 oqs-test/try_connection.py --ssh `readlink -f ../oqs-openssh-clean/ssh` doall Success! Key Exchange Algorithm: frodokem-640-aes-sha256. Signature Algorithm: ssh-falcon512. Success! Key Exchange Algorithm: frodokem-640-aes-sha256. Signature Algorithm: ssh-rsa3072-falcon512. Success! Key Exchange Algorithm: frodokem-640-aes-sha256. Signature Algorithm: ssh-ecdsa-nistp256-falcon512. Success! Key Exchange Algorithm: frodokem-640-aes-sha256. Signature Algorithm: ssh-falcon1024. Success! Key Exchange Algorithm: frodokem-640-aes-sha256. Signature Algorithm: ssh-ecdsa-nistp521-falcon1024. Success! Key Exchange Algorithm: frodokem-640-aes-sha256. Signature Algorithm: ssh-dilithium2. ... ``` Signed-off-by: gcr <gcr@amazon.com>
1 parent 116ba5a commit 063384d

12 files changed

+621
-134
lines changed

‎oqs-template/oqs-test/try_connection.py/list_all_kexs.fragment

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{%- for kex in config['kexs'] %}
22
"{{ kex['pretty_name'] }}",
33
{%- for curve in kex['mix_with'] %}
4-
# "{{ curve['pretty_name'] }}",
4+
"{{ curve['pretty_name'] }}",
55
{%- endfor -%}
66
{%- endfor %}
77

‎oqs-template/oqs-test/try_connection.py/list_all_sigs.fragment

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{%- for sig in config['sigs'] %}
22
"ssh-{{ sig['name']|replace('_','') }}",
33
{%- for alg in sig['mix_with'] %}
4-
# "ssh-{{ alg['name']|replace('_','-') }}-{{ sig['name']|replace('_','') }}",
4+
"ssh-{{ alg['name']|replace('_','-') }}-{{ sig['name']|replace('_','') }}",
55
{%- endfor -%}
66
{%- endfor %}
77

‎oqs-template/ssh-keygen.c/define_key_types.fragment

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
#ifdef WITH_OPENSSL
55
{%- for sig in config['sigs'] %}
66
{%- for alg in sig['mix_with'] if alg['rsa'] %}
7-
// { "{{ alg['name'] }}_{{ sig['name']|replace('_','') }}", "{{ alg['name']|upper }}_{{ sig['name']|upper }}", _PATH_HOST_{{ alg['name']|upper }}_{{ sig['name']|upper }}_KEY_FILE },
7+
{ "{{ alg['name'] }}_{{ sig['name']|replace('_','') }}", "{{ alg['name']|upper }}_{{ sig['name']|upper }}", _PATH_HOST_{{ alg['name']|upper }}_{{ sig['name']|upper }}_KEY_FILE },
88
{%- endfor %}
99
{%- endfor %}
1010
#ifdef OPENSSL_HAS_ECC
1111
{%- for sig in config['sigs'] %}
1212
{%- for alg in sig['mix_with'] if not alg['rsa'] %}
13-
// { "{{ alg['name'] }}_{{ sig['name']|replace('_','') }}", "{{ alg['name']|upper }}_{{ sig['name']|upper }}", _PATH_HOST_{{ alg['name']|upper }}_{{ sig['name']|upper }}_KEY_FILE },
13+
{ "{{ alg['name'] }}_{{ sig['name']|replace('_','') }}", "{{ alg['name']|upper }}_{{ sig['name']|upper }}", _PATH_HOST_{{ alg['name']|upper }}_{{ sig['name']|upper }}_KEY_FILE },
1414
{%- endfor %}
1515
{%- endfor %}
1616
#endif /* OPENSSL_HAS_ECC */

‎oqs-template/ssh-oqs.c/define_sig_functions.fragment

+46-13
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ static int ssh_{{ symbol_base_name }}_generate(struct sshkey *k, int bits)
1515
return OQS_SIG_{{ sig['name'] }}_keypair(k->oqs_pk, k->oqs_sk);
1616
}
1717

18-
int ssh_{{ symbol_base_name }}_sign(const struct sshkey *key,
18+
int ssh_{{ symbol_base_name }}_sign(struct sshkey *key,
1919
u_char **sigp,
2020
size_t *lenp,
2121
const u_char *data,
@@ -29,7 +29,7 @@ int ssh_{{ symbol_base_name }}_sign(const struct sshkey *key,
2929
if (sig == NULL) {
3030
return SSH_ERR_ALLOC_FAIL;
3131
}
32-
int r = ssh_generic_sign(sig, "{{ symbol_base_name }}", key, sigp, lenp, data, datalen, compat);
32+
int r = oqs_sign(sig, "{{ symbol_base_name }}", key, sigp, lenp, data, datalen, compat);
3333
OQS_SIG_free(sig);
3434
return r;
3535
}
@@ -40,13 +40,14 @@ int ssh_{{ symbol_base_name }}_verify(const struct sshkey *key,
4040
const u_char *data,
4141
size_t datalen,
4242
const char *alg,
43-
u_int compat)
43+
u_int compat,
44+
struct sshkey_sig_details **detailsp)
4445
{
4546
OQS_SIG *sig = OQS_SIG_new(OQS_SIG_alg_{{ sig['name'] }});
4647
if (sig == NULL) {
4748
return SSH_ERR_ALLOC_FAIL;
4849
}
49-
int r = ssh_generic_verify(sig, "{{ symbol_base_name }}", key, signature, signaturelen, data, datalen, compat);
50+
int r = oqs_verify(sig, "{{ symbol_base_name }}", key, signature, signaturelen, data, datalen, compat);
5051
OQS_SIG_free(sig);
5152
return r;
5253
}
@@ -74,13 +75,12 @@ const struct sshkey_impl sshkey_{{ symbol_base_name }}_impl = {
7475
/* .nid = */ 0,
7576
/* .cert = */ 0,
7677
/* .sigonly = */ 0,
77-
/* .keybits = */ 256, // TODO - What should be here?
78+
/* .keybits = */ 0,
7879
/* .funcs = */ &sshkey_{{ symbol_base_name }}_funcs,
7980
};
8081
{%- endfor %}
8182

82-
#ifdef HYBRID_IMPLEMENTATION_EXISTS
83-
// #ifdef WITH_OPENSSL
83+
#ifdef WITH_OPENSSL
8484
{%- for sig in config['sigs'] %}
8585
{%- for alg in sig['mix_with'] if alg['rsa'] %}
8686
{%- set symbol_base_name = alg['name']|replace('_','') + '_' + sig['name']|replace('_','') %}
@@ -93,24 +93,57 @@ static const struct sshkey_impl_funcs sshkey_{{ symbol_base_name }}_funcs = {
9393
/* .ssh_deserialize_public = */ ssh_generic_deserialize_public,
9494
/* .ssh_serialize_private = */ ssh_generic_serialize_private,
9595
/* .ssh_deserialize_private = */ ssh_generic_deserialize_private,
96-
/* .generate = */ ssh_{{ symbol_base_name }}_generate,
96+
/* .generate = */ ssh_generic_generate,
9797
/* .copy_public = */ ssh_generic_copy_public,
98-
/* .sign = */ ssh_{{ symbol_base_name }}_sign,
99-
/* .verify = */ ssh_{{ symbol_base_name }}_verify,
98+
/* .sign = */ ssh_generic_sign,
99+
/* .verify = */ ssh_generic_verify,
100100
};
101101

102102
const struct sshkey_impl sshkey_{{ symbol_base_name }}_impl = {
103-
/* .name = */ "ssh-{{ symbol_base_name }}",
103+
/* .name = */ "ssh-{{ alg['name']|replace('_','') + '-' + sig['name']|replace('_','') }}",
104104
/* .shortname = */ "{{ symbol_base_name|upper }}",
105105
/* .sigalg = */ NULL,
106-
/* .type = */ KEY_{{ sig['name']|upper }},
106+
/* .type = */ KEY_{{ alg['name']|upper }}_{{ sig['name']|upper }},
107107
/* .nid = */ 0,
108108
/* .cert = */ 0,
109109
/* .sigonly = */ 0,
110-
/* .keybits = */ 256, // TODO - What should be here?
110+
/* .keybits = */ 0,
111+
/* .funcs = */ &sshkey_{{ symbol_base_name }}_funcs,
112+
};
113+
{%- endfor %}
114+
{%- endfor %}
115+
#ifdef OPENSSL_HAS_ECC
116+
{%- for sig in config['sigs'] %}
117+
{%- for alg in sig['mix_with'] if not alg['rsa'] %}
118+
{%- set symbol_base_name = alg['name']|replace('_','') + '_' + sig['name']|replace('_','') %}
119+
static const struct sshkey_impl_funcs sshkey_{{ symbol_base_name }}_funcs = {
120+
/* .size = */ ssh_generic_size,
121+
/* .alloc = */ ssh_generic_alloc,
122+
/* .cleanup = */ ssh_generic_cleanup,
123+
/* .equal = */ ssh_generic_equal,
124+
/* .ssh_serialize_public = */ ssh_generic_serialize_public,
125+
/* .ssh_deserialize_public = */ ssh_generic_deserialize_public,
126+
/* .ssh_serialize_private = */ ssh_generic_serialize_private,
127+
/* .ssh_deserialize_private = */ ssh_generic_deserialize_private,
128+
/* .generate = */ ssh_generic_generate,
129+
/* .copy_public = */ ssh_generic_copy_public,
130+
/* .sign = */ ssh_generic_sign,
131+
/* .verify = */ ssh_generic_verify,
132+
};
133+
134+
const struct sshkey_impl sshkey_{{ symbol_base_name }}_impl = {
135+
/* .name = */ "ssh-{{ alg['name']|replace('_','-') + '-' + sig['name']|replace('_','') }}",
136+
/* .shortname = */ "{{ alg['name']|upper + '_' + sig['name']|replace('_','')|upper }}",
137+
/* .sigalg = */ NULL,
138+
/* .type = */ KEY_{{ alg['name']|upper }}_{{ sig['name']|upper }},
139+
/* .nid = */ {{ alg['openssl_nid'] }},
140+
/* .cert = */ 0,
141+
/* .sigonly = */ 0,
142+
/* .keybits = */ 0,
111143
/* .funcs = */ &sshkey_{{ symbol_base_name }}_funcs,
112144
};
113145
{%- endfor %}
114146
{%- endfor %}
147+
#endif /* OPENSSL_HAS_ECC */
115148
#endif /* WITH_OPENSSL */
116149

‎oqs-template/ssh-oqs.c/impl_lookup_cases.fragment

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{% for sig in config['sigs'] %}
2+
case KEY_{{ sig['name']|upper }}:
3+
{%- for alg in sig['mix_with'] %}
4+
case KEY_{{ alg['name']|upper }}_{{ sig['name']|upper }}:
5+
{%- endfor %}
6+
impl = &sshkey_{{ sig['name']|replace('_','') }}_impl;
7+
break;
8+
{%- endfor %}
9+

‎oqs-template/sshkey.c/define_keytypes.fragment

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
{%- for sig in config['sigs'] %}
22
&sshkey_{{ sig['name']|replace('_','') }}_impl,
33
{%- endfor %}
4-
#ifdef HYBRID_IMPLEMENTATION_EXISTS
5-
// #ifdef WITH_OPENSSL
4+
#ifdef WITH_OPENSSL
65
{%- for sig in config['sigs'] %}
76
{%- for alg in sig['mix_with'] if alg['rsa'] %}
87
&sshkey_{{ alg['name']|replace('_','') }}_{{ sig['name']|replace('_','') }}_impl,

‎oqs-template/sshkey.c/extern_key_impls.fragment

+1-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@
22
extern const struct sshkey_impl sshkey_{{ sig['name']|replace('_','') }}_impl;
33
{%- endfor %}
44

5-
#ifdef HYBRID_IMPLEMENTATION_EXISTS
6-
// #ifdef WITH_OPENSSL
5+
#ifdef WITH_OPENSSL
76
{%- for sig in config['sigs'] %}
87
{%- for alg in sig['mix_with'] if alg['rsa'] %}
98
extern const struct sshkey_impl sshkey_{{ alg['name']|replace('_','') }}_{{ sig['name']|replace('_','') }}_impl;

‎oqs-test/try_connection.py

+42-38
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# and signature algorithm, and checks whether the stock BoringSSL
33
# client and server can establish a handshake with the choices.
44

5+
import argparse
56
import os
67
import random
78
import subprocess
@@ -13,75 +14,75 @@
1314
kexs = [
1415
##### OQS_TEMPLATE_FRAGMENT_LIST_ALL_KEXS_START
1516
"frodokem-640-aes-sha256",
16-
# "ecdh-nistp256-frodokem-640-aesr2-sha256@openquantumsafe.org",
17+
"ecdh-nistp256-frodokem-640-aesr2-sha256@openquantumsafe.org",
1718
"frodokem-976-aes-sha384",
18-
# "ecdh-nistp384-frodokem-976-aesr2-sha384@openquantumsafe.org",
19+
"ecdh-nistp384-frodokem-976-aesr2-sha384@openquantumsafe.org",
1920
"frodokem-1344-aes-sha512",
20-
# "ecdh-nistp521-frodokem-1344-aesr2-sha512@openquantumsafe.org",
21+
"ecdh-nistp521-frodokem-1344-aesr2-sha512@openquantumsafe.org",
2122
"frodokem-640-shake-sha256",
22-
# "ecdh-nistp256-frodokem-640-shaker2-sha256@openquantumsafe.org",
23+
"ecdh-nistp256-frodokem-640-shaker2-sha256@openquantumsafe.org",
2324
"frodokem-976-shake-sha384",
24-
# "ecdh-nistp384-frodokem-976-shaker2-sha384@openquantumsafe.org",
25+
"ecdh-nistp384-frodokem-976-shaker2-sha384@openquantumsafe.org",
2526
"frodokem-1344-shake-sha512",
26-
# "ecdh-nistp521-frodokem-1344-shaker2-sha512@openquantumsafe.org",
27+
"ecdh-nistp521-frodokem-1344-shaker2-sha512@openquantumsafe.org",
2728
"kyber-512-sha256",
28-
# "ecdh-nistp256-kyber-512r3-sha256-d00@openquantumsafe.org",
29+
"ecdh-nistp256-kyber-512r3-sha256-d00@openquantumsafe.org",
2930
"kyber-768-sha384",
30-
# "ecdh-nistp384-kyber-768r3-sha384-d00@openquantumsafe.org",
31+
"ecdh-nistp384-kyber-768r3-sha384-d00@openquantumsafe.org",
3132
"kyber-1024-sha512",
32-
# "ecdh-nistp521-kyber-1024r3-sha512-d00@openquantumsafe.org",
33+
"ecdh-nistp521-kyber-1024r3-sha512-d00@openquantumsafe.org",
3334
"bike-l1-sha512",
34-
# "ecdh-nistp256-bike-l1r3-sha512@openquantumsafe.org",
35+
"ecdh-nistp256-bike-l1r3-sha512@openquantumsafe.org",
3536
"bike-l3-sha512",
36-
# "ecdh-nistp384-bike-l3r3-sha512@openquantumsafe.org",
37+
"ecdh-nistp384-bike-l3r3-sha512@openquantumsafe.org",
3738
"classic-mceliece-348864-sha256",
38-
# "ecdh-nistp256-classic-mceliece-348864r4-sha256@openquantumsafe.org",
39+
"ecdh-nistp256-classic-mceliece-348864r4-sha256@openquantumsafe.org",
3940
"classic-mceliece-348864f-sha256",
40-
# "ecdh-nistp256-classic-mceliece-348864fr4-sha256@openquantumsafe.org",
41+
"ecdh-nistp256-classic-mceliece-348864fr4-sha256@openquantumsafe.org",
4142
"classic-mceliece-460896-sha512",
42-
# "ecdh-nistp384-classic-mceliece-460896r4-sha512@openquantumsafe.org",
43+
"ecdh-nistp384-classic-mceliece-460896r4-sha512@openquantumsafe.org",
4344
"classic-mceliece-460896f-sha512",
44-
# "ecdh-nistp384-classic-mceliece-460896fr4-sha512@openquantumsafe.org",
45+
"ecdh-nistp384-classic-mceliece-460896fr4-sha512@openquantumsafe.org",
4546
"classic-mceliece-6688128-sha512",
46-
# "ecdh-nistp521-classic-mceliece-6688128r4-sha512@openquantumsafe.org",
47+
"ecdh-nistp521-classic-mceliece-6688128r4-sha512@openquantumsafe.org",
4748
"classic-mceliece-6688128f-sha512",
48-
# "ecdh-nistp521-classic-mceliece-6688128fr4-sha512@openquantumsafe.org",
49+
"ecdh-nistp521-classic-mceliece-6688128fr4-sha512@openquantumsafe.org",
4950
"classic-mceliece-6960119-sha512",
50-
# "ecdh-nistp521-classic-mceliece-6960119r4-sha512@openquantumsafe.org",
51+
"ecdh-nistp521-classic-mceliece-6960119r4-sha512@openquantumsafe.org",
5152
"classic-mceliece-6960119f-sha512",
52-
# "ecdh-nistp521-classic-mceliece-6960119fr4-sha512@openquantumsafe.org",
53+
"ecdh-nistp521-classic-mceliece-6960119fr4-sha512@openquantumsafe.org",
5354
"classic-mceliece-8192128-sha512",
54-
# "ecdh-nistp521-classic-mceliece-8192128r4-sha512@openquantumsafe.org",
55+
"ecdh-nistp521-classic-mceliece-8192128r4-sha512@openquantumsafe.org",
5556
"classic-mceliece-8192128f-sha512",
56-
# "ecdh-nistp521-classic-mceliece-8192128fr4-sha512@openquantumsafe.org",
57+
"ecdh-nistp521-classic-mceliece-8192128fr4-sha512@openquantumsafe.org",
5758
"hqc-128-sha256",
58-
# "ecdh-nistp256-hqc-128r3-sha256@openquantumsafe.org",
59+
"ecdh-nistp256-hqc-128r3-sha256@openquantumsafe.org",
5960
"hqc-192-sha384",
60-
# "ecdh-nistp384-hqc-192r3-sha384@openquantumsafe.org",
61+
"ecdh-nistp384-hqc-192r3-sha384@openquantumsafe.org",
6162
"hqc-256-sha512",
62-
# "ecdh-nistp521-hqc-256r3-sha512@openquantumsafe.org",
63+
"ecdh-nistp521-hqc-256r3-sha512@openquantumsafe.org",
6364
##### OQS_TEMPLATE_FRAGMENT_LIST_ALL_KEXS_END
6465
]
6566

6667
sigs = [
6768
##### OQS_TEMPLATE_FRAGMENT_LIST_ALL_SIGS_START
6869
"ssh-falcon512",
69-
# "ssh-rsa3072-falcon512",
70-
# "ssh-ecdsa-nistp256-falcon512",
70+
"ssh-rsa3072-falcon512",
71+
"ssh-ecdsa-nistp256-falcon512",
7172
"ssh-falcon1024",
72-
# "ssh-ecdsa-nistp521-falcon1024",
73+
"ssh-ecdsa-nistp521-falcon1024",
7374
"ssh-dilithium2",
74-
# "ssh-rsa3072-dilithium2",
75-
# "ssh-ecdsa-nistp256-dilithium2",
75+
"ssh-rsa3072-dilithium2",
76+
"ssh-ecdsa-nistp256-dilithium2",
7677
"ssh-dilithium3",
77-
# "ssh-ecdsa-nistp384-dilithium3",
78+
"ssh-ecdsa-nistp384-dilithium3",
7879
"ssh-dilithium5",
79-
# "ssh-ecdsa-nistp521-dilithium5",
80+
"ssh-ecdsa-nistp521-dilithium5",
8081
"ssh-sphincssha2128fsimple",
81-
# "ssh-rsa3072-sphincssha2128fsimple",
82-
# "ssh-ecdsa-nistp256-sphincssha2128fsimple",
82+
"ssh-rsa3072-sphincssha2128fsimple",
83+
"ssh-ecdsa-nistp256-sphincssha2128fsimple",
8384
"ssh-sphincssha2256fsimple",
84-
# "ssh-ecdsa-nistp521-sphincssha2256fsimple",
85+
"ssh-ecdsa-nistp521-sphincssha2256fsimple",
8586
##### OQS_TEMPLATE_FRAGMENT_LIST_ALL_SIGS_END
8687
]
8788

@@ -131,8 +132,11 @@ def try_handshake(ssh, sshd, dorandom="random"):
131132
do_handshake(ssh, sshd, test_sig, test_kex)
132133

133134
if __name__ == '__main__':
134-
if len(sys.argv)==1:
135-
try_handshake(os.path.abspath('ssh'), os.path.abspath('sshd'))
136-
else:
137-
try_handshake(os.path.abspath('ssh'), os.path.abspath('sshd'), dorandom=sys.argv[1])
135+
parser = argparse.ArgumentParser(description="Test connections between ssh and sshd using PQ algorithms.")
136+
parser.add_argument("--ssh", default=os.path.abspath('ssh'), type=str, help="Override the ssh binary.")
137+
parser.add_argument("--sshd", default=os.path.abspath('sshd'), type=str, help="Override the sshd binary.")
138+
parser.add_argument("dorandom", type=str, default="random", choices=["doall", "doone", "random"],
139+
help="Slice of test cases to run.")
140+
args = parser.parse_args()
141+
try_handshake(args.ssh, args.sshd, args.dorandom)
138142

‎ssh-ecdsa.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -305,8 +305,8 @@ ssh_ecdsa_verify(const struct sshkey *key,
305305
char *ktype = NULL;
306306

307307
if (key == NULL || key->ecdsa == NULL ||
308-
sshkey_type_plain(key->type) != KEY_ECDSA &&
309-
!oqs_utils_is_ecdsa_hybrid(sshkey_type_plain(key->type)) ||
308+
(sshkey_type_plain(key->type) != KEY_ECDSA &&
309+
!oqs_utils_is_ecdsa_hybrid(sshkey_type_plain(key->type))) ||
310310
sig == NULL || siglen == 0)
311311
return SSH_ERR_INVALID_ARGUMENT;
312312

‎ssh-keygen.c

+10-10
Original file line numberDiff line numberDiff line change
@@ -1170,17 +1170,17 @@ do_gen_all_hostkeys(struct passwd *pw)
11701170
{ "sphincssha2128fsimple", "SPHINCS_SHA2_128F_SIMPLE", _PATH_HOST_SPHINCS_SHA2_128F_SIMPLE_KEY_FILE },
11711171
{ "sphincssha2256fsimple", "SPHINCS_SHA2_256F_SIMPLE", _PATH_HOST_SPHINCS_SHA2_256F_SIMPLE_KEY_FILE },
11721172
#ifdef WITH_OPENSSL
1173-
// { "rsa3072_falcon512", "RSA3072_FALCON_512", _PATH_HOST_RSA3072_FALCON_512_KEY_FILE },
1174-
// { "rsa3072_dilithium2", "RSA3072_DILITHIUM_2", _PATH_HOST_RSA3072_DILITHIUM_2_KEY_FILE },
1175-
// { "rsa3072_sphincssha2128fsimple", "RSA3072_SPHINCS_SHA2_128F_SIMPLE", _PATH_HOST_RSA3072_SPHINCS_SHA2_128F_SIMPLE_KEY_FILE },
1173+
{ "rsa3072_falcon512", "RSA3072_FALCON_512", _PATH_HOST_RSA3072_FALCON_512_KEY_FILE },
1174+
{ "rsa3072_dilithium2", "RSA3072_DILITHIUM_2", _PATH_HOST_RSA3072_DILITHIUM_2_KEY_FILE },
1175+
{ "rsa3072_sphincssha2128fsimple", "RSA3072_SPHINCS_SHA2_128F_SIMPLE", _PATH_HOST_RSA3072_SPHINCS_SHA2_128F_SIMPLE_KEY_FILE },
11761176
#ifdef OPENSSL_HAS_ECC
1177-
// { "ecdsa_nistp256_falcon512", "ECDSA_NISTP256_FALCON_512", _PATH_HOST_ECDSA_NISTP256_FALCON_512_KEY_FILE },
1178-
// { "ecdsa_nistp521_falcon1024", "ECDSA_NISTP521_FALCON_1024", _PATH_HOST_ECDSA_NISTP521_FALCON_1024_KEY_FILE },
1179-
// { "ecdsa_nistp256_dilithium2", "ECDSA_NISTP256_DILITHIUM_2", _PATH_HOST_ECDSA_NISTP256_DILITHIUM_2_KEY_FILE },
1180-
// { "ecdsa_nistp384_dilithium3", "ECDSA_NISTP384_DILITHIUM_3", _PATH_HOST_ECDSA_NISTP384_DILITHIUM_3_KEY_FILE },
1181-
// { "ecdsa_nistp521_dilithium5", "ECDSA_NISTP521_DILITHIUM_5", _PATH_HOST_ECDSA_NISTP521_DILITHIUM_5_KEY_FILE },
1182-
// { "ecdsa_nistp256_sphincssha2128fsimple", "ECDSA_NISTP256_SPHINCS_SHA2_128F_SIMPLE", _PATH_HOST_ECDSA_NISTP256_SPHINCS_SHA2_128F_SIMPLE_KEY_FILE },
1183-
// { "ecdsa_nistp521_sphincssha2256fsimple", "ECDSA_NISTP521_SPHINCS_SHA2_256F_SIMPLE", _PATH_HOST_ECDSA_NISTP521_SPHINCS_SHA2_256F_SIMPLE_KEY_FILE },
1177+
{ "ecdsa_nistp256_falcon512", "ECDSA_NISTP256_FALCON_512", _PATH_HOST_ECDSA_NISTP256_FALCON_512_KEY_FILE },
1178+
{ "ecdsa_nistp521_falcon1024", "ECDSA_NISTP521_FALCON_1024", _PATH_HOST_ECDSA_NISTP521_FALCON_1024_KEY_FILE },
1179+
{ "ecdsa_nistp256_dilithium2", "ECDSA_NISTP256_DILITHIUM_2", _PATH_HOST_ECDSA_NISTP256_DILITHIUM_2_KEY_FILE },
1180+
{ "ecdsa_nistp384_dilithium3", "ECDSA_NISTP384_DILITHIUM_3", _PATH_HOST_ECDSA_NISTP384_DILITHIUM_3_KEY_FILE },
1181+
{ "ecdsa_nistp521_dilithium5", "ECDSA_NISTP521_DILITHIUM_5", _PATH_HOST_ECDSA_NISTP521_DILITHIUM_5_KEY_FILE },
1182+
{ "ecdsa_nistp256_sphincssha2128fsimple", "ECDSA_NISTP256_SPHINCS_SHA2_128F_SIMPLE", _PATH_HOST_ECDSA_NISTP256_SPHINCS_SHA2_128F_SIMPLE_KEY_FILE },
1183+
{ "ecdsa_nistp521_sphincssha2256fsimple", "ECDSA_NISTP521_SPHINCS_SHA2_256F_SIMPLE", _PATH_HOST_ECDSA_NISTP521_SPHINCS_SHA2_256F_SIMPLE_KEY_FILE },
11841184
#endif /* OPENSSL_HAS_ECC */
11851185
#endif /* WITH_OPENSSL */
11861186
///// OQS_TEMPLATE_FRAGMENT_DEFINE_KEY_TYPES_END

0 commit comments

Comments
 (0)