===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/ssh-keygen.c,v
retrieving revision 1.66
retrieving revision 1.74
diff -u -r1.66 -r1.74
--- src/usr.bin/ssh/ssh-keygen.c	2001/06/26 02:47:07	1.66
+++ src/usr.bin/ssh/ssh-keygen.c	2001/08/01 23:33:09	1.74
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keygen.c,v 1.66 2001/06/26 02:47:07 markus Exp $");
+RCSID("$OpenBSD: ssh-keygen.c,v 1.74 2001/08/01 23:33:09 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/pem.h>
@@ -190,7 +190,7 @@
 	Buffer b;
 	Key *key = NULL;
 	char *type, *cipher;
-	u_char *sig, data[10] = "abcde12345";
+	u_char *sig, data[] = "abcde12345";
 	int magic, rlen, ktype, i1, i2, i3, i4;
 	u_int slen;
 	u_long e;
@@ -260,7 +260,7 @@
 		buffer_get_bignum_bits(&b, key->rsa->iqmp);
 		buffer_get_bignum_bits(&b, key->rsa->q);
 		buffer_get_bignum_bits(&b, key->rsa->p);
-		generate_additional_parameters(key->rsa);
+		rsa_generate_additional_parameters(key->rsa);
 		break;
 	}
 	rlen = buffer_len(&b);
@@ -376,31 +376,49 @@
 	exit(0);
 }
 
+#ifdef SMARTCARD
 #define NUM_RSA_KEY_ELEMENTS 5+1
 #define COPY_RSA_KEY(x, i) \
 	do { \
 		len = BN_num_bytes(prv->rsa->x); \
 		elements[i] = xmalloc(len); \
-error("#bytes %d", len); \
+		debug("#bytes %d", len); \
 		if (BN_bn2bin(prv->rsa->x, elements[i]) < 0) \
 			goto done; \
 	} while(0)
 
+static int
+get_AUT0(char *aut0)
+{
+	EVP_MD *evp_md = EVP_sha1();
+	EVP_MD_CTX md;
+	char *pass;
+
+	pass = read_passphrase("Enter passphrase for smartcard: ", RP_ALLOW_STDIN);
+	if (pass == NULL)
+		return -1;
+	EVP_DigestInit(&md, evp_md);
+	EVP_DigestUpdate(&md, pass, strlen(pass));
+	EVP_DigestFinal(&md, aut0, NULL);
+	memset(pass, 0, strlen(pass));
+	xfree(pass);
+	return 0;
+}
+
 static void
 do_upload(struct passwd *pw, int reader)
 {
-#ifndef SMARTCARD
-	fatal("no support for smartcards.");
-#else
 	Key *prv = NULL;
 	struct stat st;
 	u_char *elements[NUM_RSA_KEY_ELEMENTS];
 	u_char key_fid[2];
-        u_char atr[256];
-	u_char AUT0[] = {0xad, 0x9f, 0x61, 0xfe, 0xfa, 0x20, 0xce, 0x63};
+	u_char DEFAUT0[] = {0xad, 0x9f, 0x61, 0xfe, 0xfa, 0x20, 0xce, 0x63};
+	u_char AUT0[EVP_MAX_MD_SIZE];
 	int len, status = 1, i, fd = -1, ret;
-	int cla = 0x00;
+	int sw = 0, cla = 0x00;
 
+	for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
+		elements[i] = NULL;
 	if (!have_identity)
 		ask_filename(pw, "Enter file in which the key is");
 	if (stat(identity_file, &st) < 0) {
@@ -412,12 +430,6 @@
 		error("load failed");
 		goto done;
 	}
-{
-	prv->type = KEY_RSA;
-	key_write(prv, stderr);
-}
-	for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
-		elements[i] = NULL;
 	COPY_RSA_KEY(q, 0);
 	COPY_RSA_KEY(p, 1);
 	COPY_RSA_KEY(iqmp, 2);
@@ -425,29 +437,47 @@
 	COPY_RSA_KEY(dmp1, 4);
 	COPY_RSA_KEY(n, 5);
 	len = BN_num_bytes(prv->rsa->n);
-        fd = scopen(reader, 0, NULL);
-        if (fd < 0) {
-                error("scopen failed %d.", fd);
+	fd = sectok_open(reader, STONOWAIT, &sw);
+	if (fd < 0) {
+                error("sectok_open failed: %s", sectok_get_sw(sw));
 		goto done;
-        }
-        ret = screset(fd, atr, NULL);
-        if (ret <= 0) {
-                error("screset failed.");
+	}
+	ret = sectok_reset(fd, 0, NULL, &sw);
+	if (ret <= 0) {
+                error("sectok_reset failed: %s", sectok_get_sw(sw));
 		goto done;
-        }
-	if (cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(AUT0)) < 0) {
-		error("cyberflex_verify_AUT0 failed");
+	}
+	if ((cla = cyberflex_inq_class(fd)) < 0) {
+		error("cyberflex_inq_class failed");
 		goto done;
 	}
+	memcpy(AUT0, DEFAUT0, sizeof(DEFAUT0));
+	if (cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {
+		if (get_AUT0(AUT0) < 0 ||
+		    cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {
+			error("cyberflex_verify_AUT0 failed");
+			goto done;
+		}
+	}
 	key_fid[0] = 0x00;
 	key_fid[1] = 0x12;
-	if (cyberflex_load_rsa_priv(fd, cla, key_fid, 5, 8*len, elements) < 0)
+	if (cyberflex_load_rsa_priv(fd, cla, key_fid, 5, 8*len, elements,
+	    &sw) < 0) {
+		error("cyberflex_load_rsa_priv failed: %s", sectok_get_sw(sw));
 		goto done;
+	}
+	if (!sectok_swOK(sw))
+		goto done;
 	log("cyberflex_load_rsa_priv done");
 	key_fid[0] = 0x73;
 	key_fid[1] = 0x68;
-	if (cyberflex_load_rsa_pub(fd, cla, key_fid, len, elements[5]) < 0)
+	if (cyberflex_load_rsa_pub(fd, cla, key_fid, len, elements[5],
+	    &sw) < 0) {
+		error("cyberflex_load_rsa_pub failed: %s", sectok_get_sw(sw));
 		goto done;
+	}
+	if (!sectok_swOK(sw))
+		goto done;
 	log("cyberflex_load_rsa_pub done");
 	status = 0;
 	log("loading key done");
@@ -455,12 +485,13 @@
 	if (prv)
 		key_free(prv);
 	for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
-		xfree(elements[i]);
+		if (elements[i])
+			xfree(elements[i]);
 	if (fd != -1)
-		scclose(fd);
+		sectok_close(fd);
 	exit(status);
-#endif
 }
+#endif
 
 static void
 do_fingerprint(struct passwd *pw)
@@ -860,7 +891,11 @@
 	if (print_public)
 		do_print_public(pw);
 	if (reader != -1)
+#ifdef SMARTCARD
 		do_upload(pw, reader);
+#else
+		fatal("no support for smartcards.");
+#endif
 
 	arc4random_stir();