48 lines
1.4 KiB
C
48 lines
1.4 KiB
C
/* SPDX-License-Identifier: GPL-3.0-only */
|
|
/* Persistent SSH host identity, separate from the HTTPS certificate key. */
|
|
|
|
#pragma once
|
|
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
|
|
#include "esp_err.h"
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
#define SSH_SECURITY_NVS_NAMESPACE "ssh_sec"
|
|
#define SSH_SECURITY_NVS_BLOB_KEY "material"
|
|
#define SSH_SECURITY_PRIVATE_KEY_DER_CAPACITY 256U
|
|
#define SSH_SECURITY_SHA256_LENGTH 32U
|
|
|
|
#define SSH_SECURITY_KEY_TYPE "ecdsa-sha2-nistp256"
|
|
#define SSH_SECURITY_CURVE_NAME "nistp256"
|
|
|
|
typedef enum {
|
|
SSH_SECURITY_LOAD_STORED = 0,
|
|
SSH_SECURITY_LOAD_GENERATED_MISSING = 1,
|
|
} ssh_security_load_result_t;
|
|
|
|
typedef struct {
|
|
uint32_t generation;
|
|
uint8_t sha256_fingerprint[SSH_SECURITY_SHA256_LENGTH];
|
|
} ssh_security_metadata_t;
|
|
|
|
/* NVS and secure_random must be ready. Existing malformed material is not replaced. */
|
|
esp_err_t ssh_security_init(ssh_security_load_result_t *load_result);
|
|
|
|
/* Query with output NULL/capacity zero; the required length is always returned. */
|
|
esp_err_t ssh_security_copy_private_key(uint8_t *output, size_t capacity,
|
|
size_t *output_length);
|
|
esp_err_t ssh_security_get_metadata(ssh_security_metadata_t *metadata);
|
|
|
|
/* Caller must stop SSH first. Rotation requires valid live material; reset replaces any stored state. */
|
|
esp_err_t ssh_security_rotate(void);
|
|
esp_err_t ssh_security_reset(void);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|