Fix up ECCP384 support

pfmooney · Sep 26, 2018 · a9c41e5 · a9c41e5
1 parent 21752c5
commit a9c41e5
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 3 deletions.
diff --git a/agent.c b/agent.c
@@ -646,7 +646,19 @@ process_sign_request2(SocketEntry *e)
 		else if (flags & SSH_AGENT_RSA_SHA2_512)
 			hashalg = SSH_DIGEST_SHA512;
 	} else if (key->type == KEY_ECDSA) {
-		hashalg = SSH_DIGEST_SHA256;
+		switch (sshkey_curve_nid_to_bits(key->ecdsa_nid)) {
+		case 256:
+			hashalg = SSH_DIGEST_SHA256;
+			break;
+		case 384:
+			hashalg = SSH_DIGEST_SHA384;
+			break;
+		case 521:
+			hashalg = SSH_DIGEST_SHA512;
+			break;
+		default:
+			hashalg = SSH_DIGEST_SHA256;
+		}
 	}
 	ohashalg = hashalg;
 	r = piv_sign(selk, slot, data, dlen, &hashalg, &rawsig, &rslen);

diff --git a/piv.c b/piv.c
@@ -2247,8 +2247,15 @@ piv_sign(struct piv_token *tk, struct piv_slot *slot, const uint8_t *data,
 		}
 		break;
 	case PIV_ALG_ECCP384:
-		*hashalgo = SSH_DIGEST_SHA384;
-		inplen = (dglen = 48);
+		inplen = 48;
+		if (*hashalgo == SSH_DIGEST_SHA1) {
+			dglen = 20;
+		} else if (*hashalgo == SSH_DIGEST_SHA256) {
+			dglen = 32;
+		} else {
+			*hashalgo = SSH_DIGEST_SHA384;
+			dglen = 48;
+		}
 		break;
 	default:
 		assert(0);