ttssh2/ttxssh/keyfiles.c

/*
 * Copyright (c) 1998-2001, Robert O'Callahan
 * (C) 2004- TeraTerm Project
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. The name of the author may not be used to endorse or promote products
 *    derived from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

/*
This code is copyright (C) 1998-1999 Robert O'Callahan.
See LICENSE.TXT for the license.
*/

#include "ttxssh.h"
#include "keyfiles.h"
#include "keyfiles-putty.h"
#include "key.h"
#include "hostkey.h"
#include "argon2.h"

#include <io.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <openssl/rsa.h>
#include <openssl/dsa.h>
#include <openssl/evp.h>
#include <openssl/pem.h>
#include <openssl/md5.h>
#include <openssl/err.h>

#include "cipher.h"

static char ID_string[] = "SSH PRIVATE KEY FILE FORMAT 1.1\n";

typedef struct keyfile_header {
        ssh2_keyfile_type type;
        char *header;
} keyfile_header_t;

static keyfile_header_t keyfile_headers[] = {
        {SSH2_KEYFILE_TYPE_OPENSSH, "-----BEGIN RSA PRIVATE KEY-----"},
        {SSH2_KEYFILE_TYPE_OPENSSH, "-----BEGIN DSA PRIVATE KEY-----"},
        {SSH2_KEYFILE_TYPE_OPENSSH, "-----BEGIN EC PRIVATE KEY-----"},
        {SSH2_KEYFILE_TYPE_OPENSSH, "-----BEGIN ENCRYPTED PRIVATE KEY-----"},
        {SSH2_KEYFILE_TYPE_OPENSSH, "-----BEGIN PRIVATE KEY-----"},
        {SSH2_KEYFILE_TYPE_OPENSSH, "-----BEGIN OPENSSH PRIVATE KEY-----"},
        {SSH2_KEYFILE_TYPE_PUTTY,   "PuTTY-User-Key-File-2"},
        {SSH2_KEYFILE_TYPE_PUTTY,   "PuTTY-User-Key-File-3"},
        {SSH2_KEYFILE_TYPE_SECSH,   "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----"},
        {SSH2_KEYFILE_TYPE_NONE,    NULL},
};

static BIGNUM *get_bignum(unsigned char *bytes)
{
        int bits = get_ushort16_MSBfirst(bytes);

        return BN_bin2bn(bytes + 2, (bits + 7) / 8, NULL);
}

/* normalize the RSA key by precomputing various bits of it.
   This code is adapted from libeay's rsa_gen.c
   It's needed to work around "issues" with LIBEAY/RSAREF.
   If this function returns 0, then something went wrong and the
   key must be discarded. */
static BOOL normalize_key(RSA *key)
{
        BOOL OK = FALSE;
        BIGNUM *r = BN_new();
        BN_CTX *ctx = BN_CTX_new();
        BIGNUM *e, *n, *d, *dmp1, *dmq1, *iqmp, *p, *q;

        e = n = d = dmp1 = dmq1 = iqmp = p = q = NULL;

        RSA_get0_key(key, &n, &e, &d);
        RSA_get0_factors(key, &p, &q);
        RSA_get0_crt_params(key, &dmp1, &dmq1, &iqmp);

        if (BN_cmp(p, q) < 0) {
                BN_swap(p, q);
        }

        if (r != NULL && ctx != NULL) {
                dmp1 = BN_new();
                dmq1 = BN_new();
                iqmp = BN_mod_inverse(NULL, q, p, ctx);
                RSA_set0_crt_params(key, dmp1, dmq1, iqmp);

                if (dmp1 != NULL && dmq1 != NULL && iqmp != NULL) {
                        OK = BN_sub(r, p, BN_value_one())
                          && BN_mod(dmp1, d, r, ctx)
                          && BN_sub(r, q, BN_value_one())
                          && BN_mod(dmq1, d, r, ctx);
                }
        }

        BN_free(r);
        BN_CTX_free(ctx);

        return OK;
}

static RSA *read_RSA_private_key(PTInstVar pvar,
                                 char * relative_name,
                                 char * passphrase,
                                 BOOL * invalid_passphrase,
                                 BOOL is_auto_login)
{
        char filename[2048];
        int fd;
        unsigned int length, amount_read;
        unsigned char *keyfile_data;
        unsigned int index;
        int cipher;
        RSA *key;
        unsigned int E_index, N_index, D_index, U_index, P_index, Q_index = 0;
        BIGNUM *e, *n, *d, *p, *q;

        *invalid_passphrase = FALSE;

        get_teraterm_dir_relative_name(filename, sizeof(filename),
                                       relative_name);

        fd = _open(filename, _O_RDONLY | _O_SEQUENTIAL | _O_BINARY);
        if (fd == -1) {
                if (errno == ENOENT) {
                        UTIL_get_lang_msg("MSG_KEYFILES_READ_ENOENT_ERROR", pvar,
                                          "An error occurred while trying to read the key file.\n"
                                          "The specified filename does not exist.");
                        notify_nonfatal_error(pvar, pvar->UIMsg);
                } else {
                        UTIL_get_lang_msg("MSG_KEYFILES_READ_ERROR", pvar,
                                          "An error occurred while trying to read the key file.");
                        notify_nonfatal_error(pvar, pvar->UIMsg);
                }
                return NULL;
        }

        length = (int) _lseek(fd, 0, SEEK_END);
        _lseek(fd, 0, SEEK_SET);

        if (length >= 0 && length < 0x7FFFFFFF) {
                keyfile_data = malloc(length + 1);
                if (keyfile_data == NULL) {
                        UTIL_get_lang_msg("MSG_KEYFILES_READ_ALLOC_ERROR", pvar,
                                          "Memory ran out while trying to allocate space to read the key file.");
                        notify_nonfatal_error(pvar, pvar->UIMsg);
                        _close(fd);
                        return NULL;
                }
        } else {
                UTIL_get_lang_msg("MSG_KEYFILES_READ_ERROR", pvar,
                                  "An error occurred while trying to read the key file.");
                notify_nonfatal_error(pvar, pvar->UIMsg);
                _close(fd);
                return NULL;
        }

        amount_read = _read(fd, keyfile_data, length);
        /* terminate it with 0 so that the strncmp below is guaranteed not to
           crash */
        keyfile_data[length] = 0;

        _close(fd);

        if (amount_read != length) {
                UTIL_get_lang_msg("MSG_KEYFILES_READ_ERROR", pvar,
                                  "An error occurred while trying to read the key file.");
                notify_nonfatal_error(pvar, pvar->UIMsg);
                free(keyfile_data);
                return NULL;
        }

        if (strcmp(keyfile_data, ID_string) != 0) {
                UTIL_get_lang_msg("MSG_KEYFILES_PRIVATEKEY_NOTCONTAIN_ERROR", pvar,
                                  "The specified key file does not contain an SSH private key.");
                notify_nonfatal_error(pvar, pvar->UIMsg);
                free(keyfile_data);
                return NULL;
        }

        index = NUM_ELEM(ID_string);

        if (length < index + 9) {
                UTIL_get_lang_msg("MSG_KEYFILES_PRIVATEKEY_TRUNCATE_ERROR", pvar,
                                  "The specified key file has been truncated and does not contain a valid private key.");
                notify_nonfatal_error(pvar, pvar->UIMsg);
                free(keyfile_data);
                return NULL;
        }

        cipher = keyfile_data[index];
        /* skip reserved int32, public key bits int32 */
        index += 9;
        /* skip public key e and n mp_ints */
        if (length < index + 2) {
                UTIL_get_lang_msg("MSG_KEYFILES_PRIVATEKEY_TRUNCATE_ERROR", pvar,
                                  "The specified key file has been truncated and does not contain a valid private key.");
                notify_nonfatal_error(pvar, pvar->UIMsg);
                free(keyfile_data);
                return NULL;
        }
        N_index = index;
        index += (get_ushort16_MSBfirst(keyfile_data + index) + 7) / 8 + 2;
        if (length < index + 2) {
                UTIL_get_lang_msg("MSG_KEYFILES_PRIVATEKEY_TRUNCATE_ERROR", pvar,
                                  "The specified key file has been truncated and does not contain a valid private key.");
                notify_nonfatal_error(pvar, pvar->UIMsg);
                free(keyfile_data);
                return NULL;
        }
        E_index = index;
        index += (get_ushort16_MSBfirst(keyfile_data + index) + 7) / 8 + 2;
        /* skip comment */
        if (length < index + 4) {
                UTIL_get_lang_msg("MSG_KEYFILES_PRIVATEKEY_TRUNCATE_ERROR", pvar,
                                  "The specified key file has been truncated and does not contain a valid private key.");
                notify_nonfatal_error(pvar, pvar->UIMsg);
                free(keyfile_data);
                return NULL;
        }
        index += get_uint32_MSBfirst(keyfile_data + index) + 4;

        if (length < index + 6) {
                UTIL_get_lang_msg("MSG_KEYFILES_PRIVATEKEY_TRUNCATE_ERROR", pvar,
                                  "The specified key file has been truncated and does not contain a valid private key.");
                notify_nonfatal_error(pvar, pvar->UIMsg);
                free(keyfile_data);
                return NULL;
        }
        if (cipher != SSH_CIPHER_NONE) {
                if ((length - index) % 8 != 0) {
                        UTIL_get_lang_msg("MSG_KEYFILES_PRIVATEKEY_LENGTH_ERROR", pvar,
                                          "The specified key file cannot be decrypted using the passphrase.\n"
                                          "The file does not have the correct length.");
                        notify_nonfatal_error(pvar, pvar->UIMsg);
                        free(keyfile_data);
                        return NULL;
                }
                if (!CRYPT_passphrase_decrypt
                        (cipher, passphrase, keyfile_data + index, length - index)) {
                        UTIL_get_lang_msg("MSG_KEYFILES_PRIVATEKEY_NOCIPHER_ERROR", pvar,
                                          "The specified key file cannot be decrypted using the passphrase.\n"
                                          "The cipher type used to encrypt the file is not supported by TTSSH for this purpose.");
                        notify_nonfatal_error(pvar, pvar->UIMsg);
                        free(keyfile_data);
                        return NULL;
                }
        }

        if (keyfile_data[index] != keyfile_data[index + 2]
         || keyfile_data[index + 1] != keyfile_data[index + 3]) {
                *invalid_passphrase = TRUE;
                if (is_auto_login) {
                        UTIL_get_lang_msg("MSG_KEYFILES_PASSPHRASE_EMPTY_ERROR", pvar,
                                          "The specified key file cannot be decrypted using the empty passphrase.\n"
                                          "For auto-login, you must create a key file with no passphrase.\n"
                                          "BEWARE: This means the key can easily be stolen.");
                        notify_nonfatal_error(pvar, pvar->UIMsg);
                }
                else {
                        UTIL_get_lang_msg("MSG_KEYFILES_PASSPHRASE_ERROR", pvar,
                                          "The specified key file cannot be decrypted using the passphrase.\n"
                                          "The passphrase is incorrect.");
                        notify_nonfatal_error(pvar, pvar->UIMsg);
                }
                SecureZeroMemory(keyfile_data, length);
                free(keyfile_data);
                return NULL;
        }
        index += 4;

        D_index = index;
        if (length >= D_index + 2) {
                U_index =
                        D_index + (get_ushort16_MSBfirst(keyfile_data + D_index) +
                                           7) / 8 + 2;
                if (length >= U_index + 2) {
                        P_index =
                                U_index + (get_ushort16_MSBfirst(keyfile_data + U_index) +
                                                   7) / 8 + 2;
                        if (length >= P_index + 2) {
                                Q_index =
                                        P_index +
                                        (get_ushort16_MSBfirst(keyfile_data + P_index) +
                                         7) / 8 + 2;
                        }
                }
        }
        if (Q_index == 0
         || length <
            Q_index + (get_ushort16_MSBfirst(keyfile_data + Q_index) + 7) / 8 + 2) {
                UTIL_get_lang_msg("MSG_KEYFILES_PRIVATEKEY_TRUNCATE_ERROR", pvar,
                              "The specified key file has been truncated and does not contain a valid private key.");
                notify_nonfatal_error(pvar, pvar->UIMsg);
                SecureZeroMemory(keyfile_data, length);
                free(keyfile_data);
                return NULL;
        }

        key = RSA_new();
        n = get_bignum(keyfile_data + N_index);
        e = get_bignum(keyfile_data + E_index);
        d = get_bignum(keyfile_data + D_index);
        RSA_set0_key(key, n, e, d);
        p = get_bignum(keyfile_data + P_index);
        q = get_bignum(keyfile_data + Q_index);
        RSA_set0_factors(key, p, q);

        if (!normalize_key(key)) {
                UTIL_get_lang_msg("MSG_KEYFILES_CRYPTOLIB_ERROR", pvar,
                                  "Error in cryptography library.\n"
                                  "Perhaps the stored key is invalid.");
                notify_nonfatal_error(pvar, pvar->UIMsg);

                RSA_free(key);
                key = NULL;
        }

        SecureZeroMemory(keyfile_data, length);
        free(keyfile_data);
        return key;
}

Key *KEYFILES_read_private_key(PTInstVar pvar,
                               char * relative_name,
                               char * passphrase,
                               BOOL * invalid_passphrase,
                               BOOL is_auto_login)
{
        RSA *RSA_key = read_RSA_private_key(pvar, relative_name,
                                            passphrase, invalid_passphrase,
                                            is_auto_login);

        if (RSA_key == NULL) {
                return FALSE;
        } else {
                Key *result = (Key *) malloc(sizeof(Key));

                // �t���[���������� 0 ���������������������������B(2004.12.20 yutaka)
                ZeroMemory(result, sizeof(Key));

                result->rsa = RSA_key;
                return result;
        }
}


//
// SSH2
//

// bcrypt KDF �`��������
// based on key_parse_private2() @ OpenSSH 6.5
static Key *read_SSH2_private2_key(PTInstVar pvar,
                                   FILE * fp,
                                   char * passphrase,
                                   BOOL * invalid_passphrase,
                                   BOOL is_auto_login,
                                   char *errmsg,
                                   int errmsg_len)
{
        /* (A)
         * buffer_consume�n�������g���������Abuffer_len��buffer_ptr���g�����������A
         *   buffer_len -> buffer_remain_len
         *   buffer_ptr -> buffer_tail_ptr
         * �������g�p���������B
         */
        buffer_t *blob = NULL;
        buffer_t *b = NULL;
        buffer_t *kdf = NULL;
        buffer_t *encoded = NULL;
        buffer_t *copy_consumed = NULL;     // (A)
        Key *keyfmt = NULL;
        unsigned char buf[1024];
        unsigned char *cp, last, pad;
        char *ciphername = NULL, *kdfname = NULL, *kdfp = NULL, *key = NULL, *salt = NULL, *comment = NULL;
        unsigned int len, klen, nkeys, blocksize, keylen, ivlen, slen, rounds;
        unsigned int check1, check2, m1len, m2len;
        int dlen, i;
        const struct ssh2cipher *cipher;
        size_t authlen;
        struct sshcipher_ctx *cc = NULL;
        int ret;

        blob = buffer_init();
        b = buffer_init();
        kdf = buffer_init();
        encoded = buffer_init();
        copy_consumed = buffer_init();

        if (blob == NULL || b == NULL || kdf == NULL || encoded == NULL || copy_consumed == NULL)
                goto error;

        // �t�@�C������������������
        for (;;) {
                len = fread(buf, 1, sizeof(buf), fp);
                buffer_append(blob, buf, len);
                if (buffer_len(blob) > MAX_KEY_FILE_SIZE) {
                        logprintf(LOG_LEVEL_WARNING, "%s: key file too large.", __FUNCTION__);
                        goto error;
                }
                if (len < sizeof(buf))
                        break;
        }

        /* base64 decode */
        m1len = sizeof(MARK_BEGIN) - 1;
        m2len = sizeof(MARK_END) - 1;
        cp = buffer_ptr(blob);
        len = buffer_len(blob);
        if (len < m1len || memcmp(cp, MARK_BEGIN, m1len)) {
                logprintf(LOG_LEVEL_VERBOSE, "%s: missing begin marker", __FUNCTION__);
                goto error;
        }
        cp += m1len;
        len -= m1len;
        while (len) {
                if (*cp != '\n' && *cp != '\r')
                        buffer_put_char(encoded, *cp);
                last = *cp;
                len--;
                cp++;
                if (last == '\n') {
                        if (len >= m2len && !memcmp(cp, MARK_END, m2len)) {
                                buffer_put_char(encoded, '\0');
                                break;
                        }
                }
        }
        if (!len) {
                logprintf(LOG_LEVEL_VERBOSE, "%s: no end marker", __FUNCTION__);
                goto error;
        }

        // �t�@�C�����X�L�������I�����������Abase64 decode�����B
        len = buffer_len(encoded);
        if ((cp = buffer_append_space(copy_consumed, len)) == NULL) {
                logprintf(LOG_LEVEL_ERROR, "%s: buffer_append_space", __FUNCTION__);
                goto error;
        }
        if ((dlen = b64decode(cp, len, buffer_ptr(encoded))) < 0) {
                logprintf(LOG_LEVEL_ERROR, "%s: base64 decode failed", __FUNCTION__);
                goto error;
        }
        if ((unsigned int)dlen > len) {
                logprintf(LOG_LEVEL_ERROR, "%s: crazy base64 length %d > %u", __FUNCTION__, dlen, len);
                goto error;
        }

        buffer_consume_end(copy_consumed, len - dlen);
        if (buffer_remain_len(copy_consumed) < sizeof(AUTH_MAGIC) ||
            memcmp(buffer_tail_ptr(copy_consumed), AUTH_MAGIC, sizeof(AUTH_MAGIC))) {
                logprintf(LOG_LEVEL_ERROR, "%s: bad magic", __FUNCTION__);
                goto error;
        }
        buffer_consume(copy_consumed, sizeof(AUTH_MAGIC));

        /*
         * �f�R�[�h�����f�[�^�����������B
         */
        // �������A���S���Y�������O
        ciphername = buffer_get_string_msg(copy_consumed, NULL);
        cipher = get_cipher_by_name(ciphername);
        if (cipher == NULL && strcmp(ciphername, "none") != 0) {
                logprintf(LOG_LEVEL_ERROR, "%s: unknown cipher name", __FUNCTION__);
                goto error;
        }
        // �p�X�t���[�Y���`�F�b�N�B�������� none �����������������p�X���[�h���F�������B
        if ((passphrase == NULL || strlen(passphrase) == 0) &&
            strcmp(ciphername, "none") != 0) {
                /* passphrase required */
                goto error;
        }

        kdfname = buffer_get_string_msg(copy_consumed, NULL);
        if (kdfname == NULL ||
            (!strcmp(kdfname, "none") && !strcmp(kdfname, KDFNAME))) {
                logprintf(LOG_LEVEL_ERROR, "%s: unknown kdf name", __FUNCTION__ );
                goto error;
        }
        if (!strcmp(kdfname, "none") && strcmp(ciphername, "none") != 0) {
                logprintf(LOG_LEVEL_ERROR, "%s: cipher %s requires kdf", __FUNCTION__, ciphername);
                goto error;
        }

        /* kdf options */
        kdfp = buffer_get_string_msg(copy_consumed, &klen);
        if (kdfp == NULL) {
                logprintf(LOG_LEVEL_ERROR, "%s: kdf options not set", __FUNCTION__);
                goto error;
        }
        if (klen > 0) {
                if ((cp = buffer_append_space(kdf, klen)) == NULL) {
                        logprintf(LOG_LEVEL_ERROR, "%s: kdf alloc failed", __FUNCTION__);
                        goto error;
                }
                memcpy(cp, kdfp, klen);
        }

        /* number of keys */
        if (buffer_get_int_ret(&nkeys, copy_consumed) < 0) {
                logprintf(LOG_LEVEL_ERROR, "%s: key counter missing", __FUNCTION__);
                goto error;
        }
        if (nkeys != 1) {
                logprintf(LOG_LEVEL_ERROR, "%s: only one key supported", __FUNCTION__);
                goto error;
        }

        /* pubkey */
        cp = buffer_get_string_msg(copy_consumed, &len);
        if (cp == NULL) {
                logprintf(LOG_LEVEL_ERROR, "%s: pubkey not found", __FUNCTION__);
                goto error;
        }
        free(cp); /* XXX check pubkey against decrypted private key */

        /* size of encrypted key blob */
        len = buffer_get_int(copy_consumed);
        blocksize = get_cipher_block_size(cipher);
        authlen = 0;  // TODO: ����������������
        if (len < blocksize) {
                logprintf(LOG_LEVEL_ERROR, "%s: encrypted data too small", __FUNCTION__);
                goto error;
        }
        if (len % blocksize) {
                logprintf(LOG_LEVEL_ERROR, "%s: length not multiple of blocksize", __FUNCTION__);
                goto error;
        }

        /* setup key */
        keylen = get_cipher_key_len(cipher);
        ivlen = blocksize;
        key = calloc(1, keylen + ivlen);
        if (!strcmp(kdfname, KDFNAME)) {
                salt = buffer_get_string_msg(kdf, &slen);
                if (salt == NULL) {
                        logprintf(LOG_LEVEL_ERROR, "%s: salt not set", __FUNCTION__);
                        goto error;
                }
                rounds = buffer_get_int(kdf);
                // TODO: error check
                if (bcrypt_pbkdf(passphrase, strlen(passphrase), salt, slen,
                    key, keylen + ivlen, rounds) < 0) {
                        logprintf(LOG_LEVEL_ERROR, "%s: bcrypt_pbkdf failed", __FUNCTION__);
                        goto error;
                }
        }

        // ������
        cp = buffer_append_space(b, len);
        cipher_init_SSH2(&cc, cipher, key, keylen, key + keylen, ivlen, CIPHER_DECRYPT, pvar);
        ret = EVP_Cipher(cc->evp, cp, buffer_tail_ptr(copy_consumed), len);
        if (ret == 0) {
                goto error;
        }
        buffer_consume(copy_consumed, len);

        if (buffer_remain_len(copy_consumed) != 0) {
                logprintf(LOG_LEVEL_ERROR, "%s: key blob has trailing data (len = %u)", __FUNCTION__,
                        buffer_remain_len(copy_consumed));
                goto error;
        }

        /* check bytes */
        if (buffer_get_int_ret(&check1, b) < 0 ||
            buffer_get_int_ret(&check2, b) < 0) {
                logprintf(LOG_LEVEL_ERROR, "%s: check bytes missing", __FUNCTION__);
                goto error;
        }
        if (check1 != check2) {
                logprintf(LOG_LEVEL_VERBOSE, "%s: decrypt failed: 0x%08x != 0x%08x", __FUNCTION__,
                        check1, check2);
                goto error;
        }

        keyfmt = key_private_deserialize(b);
        if (keyfmt == NULL)
                goto error;

        /* comment */
        comment = buffer_get_string_msg(b, NULL);

        i = 0;
        while (buffer_remain_len(b)) {
                if (buffer_get_char_ret(&pad, b) == -1 ||
                    pad != (++i & 0xff)) {
                        logprintf(LOG_LEVEL_ERROR, "%s: bad padding", __FUNCTION__);
                        key_free(keyfmt);
                        keyfmt = NULL;
                        goto error;
                }
        }

        /* success */
        keyfmt->bcrypt_kdf = 1;

error:
        buffer_free(blob);
        buffer_free(b);
        buffer_free(kdf);
        buffer_free(encoded);
        buffer_free(copy_consumed);
        cipher_free_SSH2(cc);

        free(ciphername);
        free(kdfname);
        free(kdfp);
        free(key);
        free(salt);
        free(comment);

        // KDF ������������
        if (keyfmt == NULL) {
                fseek(fp, 0, SEEK_SET);

        } else {
                fclose(fp);

        }

        return (keyfmt);
}


// OpenSSL format
Key *read_SSH2_private_key(PTInstVar pvar,
                           FILE * fp,
                           char * passphrase,
                           BOOL * invalid_passphrase,
                           BOOL is_auto_login,
                           char *errmsg,
                           int errmsg_len)
{
        Key *result = NULL;
        EVP_PKEY *pk = NULL;
        unsigned long err = 0;
        int pk_type;

        OpenSSL_add_all_algorithms();
        ERR_load_crypto_strings();
        //seed_prng();

        result = read_SSH2_private2_key(pvar, fp, passphrase, invalid_passphrase, is_auto_login, errmsg, errmsg_len);
        if (result)
                return (result);

        result = (Key *)malloc(sizeof(Key));
        ZeroMemory(result, sizeof(Key));

        // �t�@�C�������p�X�t���[�Y�����������������������B
        pk = PEM_read_PrivateKey(fp, NULL, NULL, passphrase);
        if (pk == NULL) {
                err = ERR_get_error();
                ERR_error_string_n(err, errmsg, errmsg_len);
                *invalid_passphrase = TRUE;
                goto error;
        }

        pk_type = EVP_PKEY_id(pk);
        switch (pk_type) {
        case EVP_PKEY_RSA: // RSA key
                result->type = KEY_RSA;
                result->rsa = EVP_PKEY_get1_RSA(pk);
                result->dsa = NULL;
                result->ecdsa = NULL;

                // RSA�������������L���������i�^�C�~���O�U���������h���j
                if (RSA_blinding_on(result->rsa, NULL) != 1) {
                        err = ERR_get_error();
                        ERR_error_string_n(err, errmsg, errmsg_len);
                        goto error;
                }
                break;

        case EVP_PKEY_DSA: // DSA key
                result->type = KEY_DSA;
                result->rsa = NULL;
                result->dsa = EVP_PKEY_get1_DSA(pk);
                result->ecdsa = NULL;
                break;

        case EVP_PKEY_EC: // ECDSA key
                result->rsa = NULL;
                result->dsa = NULL;
                result->ecdsa = EVP_PKEY_get1_EC_KEY(pk);
                {
                        const EC_GROUP *g = EC_KEY_get0_group(result->ecdsa);
                        result->type = nid_to_keytype(EC_GROUP_get_curve_name(g));
                        if (result->type == KEY_UNSPEC) {
                                goto error;
                        }
                }
                break;

        default:
                goto error;
                break;
        }

        if (pk != NULL)
                EVP_PKEY_free(pk);

        fclose(fp);
        return (result);

error:
        if (pk != NULL)
                EVP_PKEY_free(pk);

        if (result != NULL)
                key_free(result);

        if (fp != NULL)
                fclose(fp);

        return (NULL);
}

// PuTTY format
/*
 * PuTTY-User-Key-File-2: ssh-dss
 * Encryption: aes256-cbc
 * Comment: imported-openssh-key
 * Public-Lines: 10
 * Base64...
 * Private-Lines: 1
 * Base64...
 * Private-MAC: Base16...
 *
 * for "ssh-rsa", it will be composed of
 *
 * "Public-Lines: " plus a number N.
 *
 *    string "ssh-rsa"
 *    mpint  exponent
 *    mpint  modulus
 *
 * "Private-Lines: " plus a number N,
 *
 *    mpint  private_exponent
 *    mpint  p                  (the larger of the two primes)
 *    mpint  q                  (the smaller prime)
 *    mpint  iqmp               (the inverse of q modulo p)
 *    data   padding            (to reach a multiple of the cipher block size)
 *
 * for "ssh-dss", it will be composed of
 *
 * "Public-Lines: " plus a number N.
 *
 *    string "ssh-rsa"
 *    mpint p
 *    mpint q
 *    mpint g
 *    mpint y
 *
 * "Private-Lines: " plus a number N,
 *
 *    mpint  x                  (the private key parameter)
 *
 * for "ecdsa-sha2-nistp256" or
 *     "ecdsa-sha2-nistp384" or
 *     "ecdsa-sha2-nistp521", it will be composed of
 *
 * "Public-Lines: " plus a number N.
 *
 *    string  "ecdsa-sha2-[identifier]" ("ecdsa-sha2-nistp256" or
 *                                       "ecdsa-sha2-nistp384" or
 *                                       "ecdsa-sha2-nistp521")
 *    string  [identifier] ("nistp256" or "nistp384" or "nistp521")
 *    string  Q            (EC_POINT)
 *
 * "Private-Lines: " plus a number N,
 *
 *    mpint  n
 *
 * for "ssh-ed25519", it will be composed of
 *
 * "Public-Lines: " plus a number N.
 *
 *    string "ssh-ed25519"
 *    string key
 *
 * "Private-Lines: " plus a number N,
 *
 *    string key
 *
 * "Private-MAC: " plus a hex, HMAC-SHA-1 of:
 *
 *    string name of algorithm ("ssh-dss", "ssh-rsa")
 *    string encryption type
 *    string comment
 *    string public-blob
 *    string private-plaintext
 */
Key *read_SSH2_PuTTY_private_key(PTInstVar pvar,
                                 FILE * fp,
                                 char * passphrase,
                                 BOOL * invalid_passphrase,
                                 BOOL is_auto_login,
                                 char *errmsg,
                                 int errmsg_len)
{
        char header[40], *b = NULL, *encryption = NULL, *comment = NULL, *mac = NULL;
        Key *result = NULL;
        buffer_t *public_blob = NULL, *private_blob = NULL, *cipher_mac_keys_blob = NULL;
        unsigned char *cipherkey = NULL, *cipheriv = NULL, *mackey = NULL;
        unsigned int cipherkey_len, cipheriv_len, mackey_len;
        buffer_t *passphrase_salt = buffer_init();
        const struct ssh2cipher *ciphertype;
        int lines, len;
        ppk_argon2_parameters params;
        unsigned fmt_version = 0;

        result = (Key *)malloc(sizeof(Key));
        ZeroMemory(result, sizeof(Key));
        result->type = KEY_NONE;
        result->rsa = NULL;
        result->dsa = NULL;
        result->ecdsa = NULL;

        // version and algorithm-name
        if (!ppk_read_header(fp, header)) {
                strncpy_s(errmsg, errmsg_len, "no header line found in key file", _TRUNCATE);
                goto error;
        }
        if (0 == strcmp(header, "PuTTY-User-Key-File-3")) {
                fmt_version = 3;
        }
        else if (0 == strcmp(header, "PuTTY-User-Key-File-2")) {
                fmt_version = 2;
        }
        else if (0 == strcmp(header, "PuTTY-User-Key-File-1")) {
                strncpy_s(errmsg, errmsg_len, "PuTTY key format too old", _TRUNCATE);
                goto error;
        }
        else if (0 == strncmp(header, "PuTTY-User-Key-File-", 20)) {
                strncpy_s(errmsg, errmsg_len, "PuTTY key format too new", _TRUNCATE);
                goto error;
        }
        if ((b = ppk_read_body(fp)) == NULL) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                goto error;
        }
        if (0 == strcmp(b, "ssh-dss")) {
                result->type = KEY_DSA;
        }
        else if (0 == strcmp(b, "ssh-rsa")) {
                result->type = KEY_RSA;
        }
        else if (0 == strcmp(b, "ecdsa-sha2-nistp256")) {
                result->type = KEY_ECDSA256;
        }
        else if (0 == strcmp(b, "ecdsa-sha2-nistp384")) {
                result->type = KEY_ECDSA384;
        }
        else if (0 == strcmp(b, "ecdsa-sha2-nistp521")) {
                result->type = KEY_ECDSA521;
        }
        else if (0 == strcmp(b, "ssh-ed25519")) {
                result->type = KEY_ED25519;
        }
        else {
                strncpy_s(errmsg, errmsg_len, "unsupported key algorithm", _TRUNCATE);
                free(b);
                goto error;
        }
        free(b);

        // encryption-type
        if (!ppk_read_header(fp, header) || 0 != strcmp(header, "Encryption")) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                goto error;
        }
        if ((encryption = ppk_read_body(fp)) == NULL) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                goto error;
        }
        if (strcmp(encryption, "aes256-cbc") == 0) {
                ciphertype = get_cipher_by_name(encryption);
        }
        else if (strcmp(encryption, "none") == 0) {
                ciphertype = get_cipher_by_name(encryption);
        }
        else {
                strncpy_s(errmsg, errmsg_len, "unknown encryption type", _TRUNCATE);
                goto error;
        }

        // key-comment-string
        if (!ppk_read_header(fp, header) || 0 != strcmp(header, "Comment")) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                goto error;
        }
        if ((comment = ppk_read_body(fp)) == NULL) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                goto error;
        }

        // public key
        if (!ppk_read_header(fp, header) || 0 != strcmp(header, "Public-Lines")) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                goto error;
        }
        if ((b = ppk_read_body(fp)) == NULL) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                free(b);
                goto error;
        }
        lines = atoi(b);
        free(b);
        public_blob = buffer_init();
        if (!ppk_read_blob(fp, lines, public_blob)) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                goto error;
        }

        if (fmt_version >= 3 && ciphertype->key_len != 0) {
                size_t i;

                // argon2-flavour
                if (!ppk_read_header(fp, header) || 0 != strcmp(header, "Key-Derivation")) {
                        strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                        goto error;
                }
                if ((b = ppk_read_body(fp)) == NULL) {
                        strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                        free(b);
                        goto error;
                }
                if (!strcmp(b, "Argon2d")) {
                        params.type = Argon2_d;
                }
                else if (!strcmp(b, "Argon2i")) {
                        params.type = Argon2_i;
                }
                else if (!strcmp(b, "Argon2id")) {
                        params.type = Argon2_id;
                }
                else {
                        strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                        free(b);
                        goto error;
                }
                free(b);

                if (!ppk_read_header(fp, header) || 0 != strcmp(header, "Argon2-Memory")) {
                        strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                        goto error;
                }
                if ((b = ppk_read_body(fp)) == NULL) {
                        strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                        free(b);
                        goto error;
                }
                if (!str_to_uint32_t(b, &params.argon2_mem)) {
                        free(b);
                        goto error;
                }
                free(b);

                if (!ppk_read_header(fp, header) || 0 != strcmp(header, "Argon2-Passes")) {
                        strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                        goto error;
                }
                if ((b = ppk_read_body(fp)) == NULL) {
                        strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                        free(b);
                        goto error;
                }
                if (!str_to_uint32_t(b, &params.argon2_passes)) {
                        free(b);
                        goto error;
                }
                free(b);

                if (!ppk_read_header(fp, header) || 0 != strcmp(header, "Argon2-Parallelism")) {
                        strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                        goto error;
                }
                if ((b = ppk_read_body(fp)) == NULL) {
                        strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                        free(b);
                        goto error;
                }
                if (!str_to_uint32_t(b, &params.argon2_parallelism)) {
                        free(b);
                        goto error;
                }
                free(b);

                if (!ppk_read_header(fp, header) || 0 != strcmp(header, "Argon2-Salt")) {
                        strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                        goto error;
                }
                if ((b = ppk_read_body(fp)) == NULL) {
                        strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                        free(b);
                        goto error;
                }
                for (i = 0; b[i]; i += 2) {
                        if (isxdigit((unsigned char)b[i]) && b[i+1] &&
                            isxdigit((unsigned char)b[i+1])) {
                                char s[3];
                                s[0] = b[i];
                                s[1] = b[i+1];
                                s[2] = '\0';
                                buffer_put_char(passphrase_salt, strtoul(s, NULL, 16));
                        }
                        else {
                                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                                free(b);
                                goto error;
                        }
                }
                params.salt = buffer_ptr(passphrase_salt);
                params.saltlen = buffer_len(passphrase_salt);
                free(b);
        }

        // private key
        if (!ppk_read_header(fp, header) || 0 != strcmp(header, "Private-Lines")) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                goto error;
        }
        if ((b = ppk_read_body(fp)) == NULL) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                free(b);
                goto error;
        }
        lines = atoi(b);
        free(b);
        private_blob = buffer_init();
        if (!ppk_read_blob(fp, lines, private_blob)) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                goto error;
        }

        // hex-mac-data
        if (!ppk_read_header(fp, header) || 0 != strcmp(header, "Private-MAC")) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                goto error;
        }
        if ((mac = ppk_read_body(fp)) == NULL) {
                strncpy_s(errmsg, errmsg_len, "file format error", _TRUNCATE);
                goto error;
        }

        fclose(fp);

        if (result->type == KEY_NONE || strlen(encryption) == 0 || buffer_len(public_blob) == 0 || buffer_len(private_blob) == 0) {
                strncpy_s(errmsg, errmsg_len, "key file format error", _TRUNCATE);
                goto error;
        }

        // derive key, iv, mackey
        cipher_mac_keys_blob = buffer_init();
        ssh2_ppk_derive_keys(fmt_version, ciphertype,
                             passphrase,
                             cipher_mac_keys_blob,
                             &cipherkey, &cipherkey_len,
                             &cipheriv, &cipheriv_len,
                             &mackey, &mackey_len,
                             &params);

        // decrypt priate key with aes256-cbc
        if (strcmp(encryption, "aes256-cbc") == 0) {
                struct sshcipher_ctx *cc = NULL;
                char *decrypted = NULL;
                int ret;

                // decrypt
                ciphertype = get_cipher_by_name("aes256-cbc");
                cipher_init_SSH2(&cc, ciphertype, cipherkey, 32, cipheriv, 16, CIPHER_DECRYPT, pvar);
                len = buffer_len(private_blob);
                decrypted = (char *)malloc(len);
                ret = EVP_Cipher(cc->evp, decrypted, private_blob->buf, len);
                if (ret == 0) {
                        strncpy_s(errmsg, errmsg_len, "Key decrypt error", _TRUNCATE);
                        free(decrypted);
                        cipher_free_SSH2(cc);
                        goto error;
                }
                buffer_clear(private_blob);
                buffer_append(private_blob, decrypted, len);
                free(decrypted);
                cipher_free_SSH2(cc);
        }

        // verity MAC
        {
                unsigned char binary[32];
                char realmac[sizeof(binary) * 2 + 1];
                const EVP_MD *md;
                buffer_t *macdata;
                int i;

                macdata = buffer_init();
                buffer_put_cstring(macdata, get_ssh2_hostkey_type_name(result->type));
                buffer_put_cstring(macdata, encryption);
                buffer_put_cstring(macdata, comment);
                buffer_put_string(macdata, public_blob->buf, public_blob->len);
                buffer_put_string(macdata, private_blob->buf, private_blob->len);

                if (fmt_version == 2) {
                        md = EVP_sha1();
                }
                else {
                        md = EVP_sha256();
                }
                mac_simple(md, (unsigned char *)mackey, mackey_len, macdata->buf, macdata->len, binary);

                buffer_free(macdata);

                for (i=0; i<EVP_MD_size(md); i++) {
                        sprintf(realmac + 2*i, "%02x", binary[i]);
                }

                if (strcmp(mac, realmac) != 0) {
                        if (ciphertype->key_len > 0) {
                                strncpy_s(errmsg, errmsg_len, "wrong passphrase", _TRUNCATE);
                                *invalid_passphrase = TRUE;
                                goto error;
                        }
                        else {
                                strncpy_s(errmsg, errmsg_len, "MAC verify failed", _TRUNCATE);
                                goto error;
                        }
                }
        }

        switch (result->type) {
        case KEY_RSA:
        {
                char *pubkey_type, *pub, *pri;
                BIGNUM *e, *n, *d, *iqmp, *p, *q;

                pub = public_blob->buf;
                pri = private_blob->buf;
                pubkey_type = buffer_get_string(&pub, NULL);
                if (strcmp(pubkey_type, "ssh-rsa") != 0) {
                        strncpy_s(errmsg, errmsg_len, "key type error", _TRUNCATE);
                        free(pubkey_type);
                        goto error;
                }
                free(pubkey_type);

                result->rsa = RSA_new();
                if (result->rsa == NULL) {
                        strncpy_s(errmsg, errmsg_len, "key init error", _TRUNCATE);
                        goto error;
                }
                e = BN_new();
                n = BN_new();
                d = BN_new();
                RSA_set0_key(result->rsa, n, e, d);
                p = BN_new();
                q = BN_new();
                RSA_set0_factors(result->rsa, p, q);
                iqmp = BN_new();
                RSA_set0_crt_params(result->rsa, NULL, NULL, iqmp);
                if (e == NULL ||
                    n == NULL ||
                    d == NULL ||
                    p == NULL ||
                    q == NULL ||
                    iqmp == NULL) {
                        strncpy_s(errmsg, errmsg_len, "key init error", _TRUNCATE);
                        goto error;
                }

                buffer_get_bignum2(&pub, e);
                buffer_get_bignum2(&pub, n);

                buffer_get_bignum2(&pri, d);
                buffer_get_bignum2(&pri, p);
                buffer_get_bignum2(&pri, q);
                buffer_get_bignum2(&pri, iqmp);

                break;
        }
        case KEY_DSA:
        {
                char *pubkey_type, *pub, *pri;
                BIGNUM *p, *q, *g, *pub_key, *priv_key;

                pub = public_blob->buf;
                pri = private_blob->buf;
                pubkey_type = buffer_get_string(&pub, NULL);
                if (strcmp(pubkey_type, "ssh-dss") != 0) {
                        strncpy_s(errmsg, errmsg_len, "key type error", _TRUNCATE);
                        free(pubkey_type);
                        goto error;
                }
                free(pubkey_type);

                result->dsa = DSA_new();
                if (result->dsa == NULL) {
                        strncpy_s(errmsg, errmsg_len, "key init error", _TRUNCATE);
                        goto error;
                }
                p = BN_new();
                q = BN_new();
                g = BN_new();
                DSA_set0_pqg(result->dsa, p, q, g);
                pub_key = BN_new();
                priv_key = BN_new();
                DSA_set0_key(result->dsa, pub_key, priv_key);
                if (p == NULL ||
                    q == NULL ||
                    g == NULL ||
                    pub_key == NULL ||
                    priv_key == NULL) {
                        strncpy_s(errmsg, errmsg_len, "key init error", _TRUNCATE);
                        goto error;
                }

                buffer_get_bignum2(&pub, p);
                buffer_get_bignum2(&pub, q);
                buffer_get_bignum2(&pub, g);
                buffer_get_bignum2(&pub, pub_key);

                buffer_get_bignum2(&pri, priv_key);

                break;
        }
        case KEY_ECDSA256:
        case KEY_ECDSA384:
        case KEY_ECDSA521:
        {
                char *pubkey_type, *pub, *pri;
                int success = 0;
                unsigned int nid;
                char *curve = NULL;
                ssh_keytype skt;
                BIGNUM *exponent = NULL;
                EC_POINT *q = NULL;

                pub = public_blob->buf;
                pri = private_blob->buf;
                pubkey_type = buffer_get_string(&pub, NULL);
                if ((result->type == KEY_ECDSA256 && strcmp(pubkey_type, "ecdsa-sha2-nistp256") != 0) ||
                    (result->type == KEY_ECDSA384 && strcmp(pubkey_type, "ecdsa-sha2-nistp384") != 0) ||
                    (result->type == KEY_ECDSA521 && strcmp(pubkey_type, "ecdsa-sha2-nistp521") != 0)) {
                        strncpy_s(errmsg, errmsg_len, "key type error", _TRUNCATE);
                        free(pubkey_type);
                        goto error;
                }
                free(pubkey_type);

                nid = keytype_to_cipher_nid(result->type);
                curve = buffer_get_string(&pub, NULL);
                skt = key_curve_name_to_keytype(curve);
                if (nid != keytype_to_cipher_nid(skt))
                        goto ecdsa_error;

                if ((result->ecdsa = EC_KEY_new_by_curve_name(nid)) == NULL)
                        goto ecdsa_error;
                if ((q = EC_POINT_new(EC_KEY_get0_group(result->ecdsa))) == NULL)
                        goto ecdsa_error;
                if ((exponent = BN_new()) == NULL)
                        goto ecdsa_error;

                buffer_get_ecpoint(&pub, EC_KEY_get0_group(result->ecdsa), q);
                buffer_get_bignum2(&pri, exponent);
                if (EC_KEY_set_public_key(result->ecdsa, q) != 1)
                        goto ecdsa_error;
                if (EC_KEY_set_private_key(result->ecdsa, exponent) != 1)
                        goto ecdsa_error;
                if (key_ec_validate_public(EC_KEY_get0_group(result->ecdsa),
                                           EC_KEY_get0_public_key(result->ecdsa)) != 0)
                        goto ecdsa_error;
                if (key_ec_validate_private(result->ecdsa) != 0)
                        goto ecdsa_error;

                success = 1;

ecdsa_error:
                free(curve);
                if (exponent)
                        BN_clear_free(exponent);
                if (q)
                        EC_POINT_free(q);
                if (success == 0)
                        goto error;

                break;
        }
        case KEY_ED25519:
        {
                char *pubkey_type, *pub, *pri;
                unsigned int pklen, sklen;
                char *sk;
                pub = public_blob->buf;
                pri = private_blob->buf;
                pubkey_type = buffer_get_string(&pub, NULL);
                if (strcmp(pubkey_type, "ssh-ed25519") != 0) {
                        strncpy_s(errmsg, errmsg_len, "key type error", _TRUNCATE);
                        free(pubkey_type);
                        goto error;
                }
                free(pubkey_type);

                result->ed25519_pk = buffer_get_string(&pub, &pklen);
                sk = buffer_get_string(&pri, &sklen);
                result->ed25519_sk = malloc(pklen + sklen + 1);
                memcpy(result->ed25519_sk, sk, sklen);
                memcpy(result->ed25519_sk + sklen, result->ed25519_pk, pklen);
                result->ed25519_sk[sklen + pklen] = '\0';
                free(sk);

                if (pklen != ED25519_PK_SZ)
                        goto error;
                if (sklen + pklen != ED25519_SK_SZ)
                        goto error;

                break;
        }
        default:
                strncpy_s(errmsg, errmsg_len, "key type error", _TRUNCATE);
                goto error;
                break;
        }

        if (encryption != NULL)
                free(encryption);
        if (comment != NULL)
                free(comment);
        if (mac != NULL)
                free(mac);
        if (public_blob != NULL)
                buffer_free(public_blob);
        if (private_blob != NULL)
                buffer_free(private_blob);
        if (cipher_mac_keys_blob != NULL)
                buffer_free(cipher_mac_keys_blob);
        if (passphrase_salt != NULL)
                buffer_free(passphrase_salt);

        return (result);

error:
        if (result != NULL)
                key_free(result);
        if (fp != NULL)
                fclose(fp);
        if (encryption != NULL)
                free(encryption);
        if (comment != NULL)
                free(comment);
        if (mac != NULL)
                free(mac);
        if (public_blob != NULL)
                buffer_free(public_blob);
        if (private_blob != NULL)
                buffer_free(private_blob);
        if (cipher_mac_keys_blob != NULL)
                buffer_free(cipher_mac_keys_blob);
        if (passphrase_salt != NULL)
                buffer_free(passphrase_salt);

        return (NULL);
}

// SECSH(ssh.com) format
/*
 * Code to read ssh.com private keys.
 *
 *  "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----"
 *  "Comment:..."
 *  "Base64..."
 *  "---- END SSH2 ENCRYPTED PRIVATE KEY ----"
 *
 * Body of key data
 *
 *  - uint32 0x3f6ff9eb       (magic number)
 *  - uint32 size             (total blob size)
 *  - string key-type         (see below)
 *  - string cipher-type      (tells you if key is encrypted)
 *  - string encrypted-blob
 *
 * The key type strings are ghastly. The RSA key I looked at had a type string of
 *
 *   `if-modn{sign{rsa-pkcs1-sha1},encrypt{rsa-pkcs1v2-oaep}}'
 *   `dl-modp{sign{dsa-nist-sha1},dh{plain}}'
 *   `ec-modp'
 *
 * The encryption. The cipher-type string appears to be either
 *
 *    `none'
 *    `3des-cbc'
 *
 * The payload blob, for an RSA key, contains:
 *  - mpint e
 *  - mpint d
 *  - mpint n  (yes, the public and private stuff is intermixed)
 *  - mpint u  (presumably inverse of p mod q)
 *  - mpint p  (p is the smaller prime)
 *  - mpint q  (q is the larger)
 *
 * For a DSA key, the payload blob contains:
 *  - uint32 0
 *  - mpint p
 *  - mpint g
 *  - mpint q
 *  - mpint y
 *  - mpint x
 *
 * For a ECDSA key, the payload blob contains:
 *  - uint32 1
 *  - string [identifier] ("nistp256" or "nistp384" or "nistp521")
 *  - mpint  n
 */
Key *read_SSH2_SECSH_private_key(PTInstVar pvar,
                                 FILE * fp,
                                 char * passphrase,
                                 BOOL * invalid_passphrase,
                                 BOOL is_auto_login,
                                 char *errmsg,
                                 int errmsg_len)
{
        Key *result = NULL;
        unsigned long err = 0;
        int i, len2;
        unsigned int len;
        int encflag;
        char *encname = NULL;
        buffer_t *blob = NULL, *blob2 = NULL;
        const struct ssh2cipher *cipher = NULL;
        struct sshcipher_ctx *cc = NULL;

        result = (Key *)malloc(sizeof(Key));
        ZeroMemory(result, sizeof(Key));
        result->type = KEY_NONE;
        result->rsa = NULL;
        result->dsa = NULL;
        result->ecdsa = NULL;

        blob = buffer_init();
        blob2 = buffer_init();

        // parse keyfile & decode blob
        {
        char line[200], buf[100];
        BIO *bmem, *b64, *chain;
        int st = 0;

        b64 = BIO_new(BIO_f_base64());
        bmem = BIO_new(BIO_s_mem());

        while (fgets(line, sizeof(line), fp) != NULL) {
                if (strncmp(line, "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----", strlen("---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----")) == 0) {
                        if (st == 0) {
                                st = 1;
                                continue;
                        }
                        else {
                                break;
                        }
                }
                else if (strncmp(line, "---- END SSH2 ENCRYPTED PRIVATE KEY ----", strlen("---- END SSH2 ENCRYPTED PRIVATE KEY ----")) == 0) {
                        break;
                }

                if (st == 0) {
                        continue;
                }

                if (strchr(line, ':') != NULL) {
                        if (st == 1) {
                                continue;
                        }
                        strncpy_s(errmsg, errmsg_len, "header found in body of key data", _TRUNCATE);
                        BIO_free_all(bmem);
                        goto error;
                }
                else if (st == 1) {
                        st = 2;
                }

                BIO_write(bmem, line, strlen(line));
        }

        BIO_flush(bmem);
        chain = BIO_push(b64, bmem);
        BIO_set_mem_eof_return(chain, 0);
        while ((len2 = BIO_read(chain, buf, sizeof(buf))) > 0) {
                buffer_append(blob, buf, len2);
        }
        BIO_free_all(chain);
        buffer_rewind(blob);
        }

        if (blob->len < 8) {
                strncpy_s(errmsg, errmsg_len, "key body not present", _TRUNCATE);
                goto error;
        }
        i = buffer_get_int(blob);
        if (i != 0x3f6ff9eb) {
                strncpy_s(errmsg, errmsg_len, "magic number error", _TRUNCATE);
                goto error;
        }
        len = buffer_get_int(blob);
        if (len == 0 || len > blob->len) {
                strncpy_s(errmsg, errmsg_len, "body size error", _TRUNCATE);
                goto error;
        }

        len = buffer_get_int(blob);
        if (strncmp(blob->buf + blob->offset, "if-modn{sign{rsa", strlen("if-modn{sign{rsa") - 1) == 0) {
                result->type = KEY_RSA;
        }
        else if (strncmp(blob->buf + blob->offset, "dl-modp{sign{dsa", strlen("dl-modp{sign{dsa") - 1) == 0) {
                result->type = KEY_DSA;
        }
        else if (strncmp(blob->buf + blob->offset, "ec-modp", strlen("ec-modp") - 1) == 0) {
                result->type = KEY_ECDSA256;
        }
        else {
                strncpy_s(errmsg, errmsg_len, "unknown key type", _TRUNCATE);
                goto error;
        }
        buffer_consume(blob, len);

        len = buffer_get_int(blob);
        encname = (char *)malloc(len + 1);
        strncpy_s(encname, len + 1, blob->buf + blob->offset, _TRUNCATE);
        if (strcmp(encname, "3des-cbc") == 0) {
                encflag = 1;
        }
        else if (strcmp(encname, "none") == 0) {
                encflag = 0;
        }
        else {
                strncpy_s(errmsg, errmsg_len, "unknown encryption type", _TRUNCATE);
                goto error;
        }
        buffer_consume(blob, len);

        len = buffer_get_int(blob);
        if (len > (blob->len - blob->offset)) {
                strncpy_s(errmsg, errmsg_len, "body size error", _TRUNCATE);
                goto error;
        }

        // decrypt privkey with 3des-cbc
        if (strcmp(encname, "3des-cbc") == 0) {
                MD5_CTX md;
                unsigned char key[32], iv[16];
                EVP_CIPHER_CTX *cipher_ctx = NULL;
                char *decrypted = NULL;
                int ret;

                cipher_ctx = EVP_CIPHER_CTX_new();
                if (cipher_ctx == NULL) {
                        strncpy_s(errmsg, errmsg_len, "Out of memory: EVP_CIPHER_CTX_new()", _TRUNCATE);
                        goto error;
                }

                MD5_Init(&md);
                MD5_Update(&md, passphrase, strlen(passphrase));
                MD5_Final(key, &md);

                MD5_Init(&md);
                MD5_Update(&md, passphrase, strlen(passphrase));
                MD5_Update(&md, key, 16);
                MD5_Final(key + 16, &md);

                memset(iv, 0, sizeof(iv));

                // decrypt
                cipher = get_cipher_by_name("3des-cbc");
                cipher_init_SSH2(&cc, cipher, key, 24, iv, 8, CIPHER_DECRYPT, pvar);
                decrypted = (char *)malloc(len);
                ret = EVP_Cipher(cc->evp, decrypted, blob->buf + blob->offset, len);
                if (ret == 0) {
                        strncpy_s(errmsg, errmsg_len, "Key decrypt error", _TRUNCATE);
                        cipher_free_SSH2(cc);
                        goto error;
                }
                buffer_append(blob2, decrypted, len);
                free(decrypted);
                cipher_free_SSH2(cc);

                *invalid_passphrase = TRUE;
        }
        else { // none
                buffer_append(blob2, blob->buf + blob->offset, len);
        }
        buffer_rewind(blob2);

        len = buffer_get_int(blob2);
        if (len <= 0 || len > (blob2->len - blob2->offset)) {
                strncpy_s(errmsg, errmsg_len, "blob size error", _TRUNCATE);
                goto error;
        }

        switch (result->type) {
        case KEY_RSA:
        {
                BIGNUM *e, *n, *d, *iqmp, *p, *q;

                result->rsa = RSA_new();
                if (result->rsa == NULL) {
                        strncpy_s(errmsg, errmsg_len, "key init error", _TRUNCATE);
                        goto error;
                }
                e = BN_new();
                n = BN_new();
                d = BN_new();
                RSA_set0_key(result->rsa, n, e, d);
                p = BN_new();
                q = BN_new();
                RSA_set0_factors(result->rsa, p, q);
                iqmp = BN_new();
                RSA_set0_crt_params(result->rsa, NULL, NULL, iqmp);
                if (e == NULL ||
                    n == NULL ||
                    d == NULL ||
                    p == NULL ||
                    q == NULL ||
                    iqmp == NULL) {
                        strncpy_s(errmsg, errmsg_len, "key init error", _TRUNCATE);
                        goto error;
                }

                buffer_get_bignum_SECSH(blob2, e);
                buffer_get_bignum_SECSH(blob2, d);
                buffer_get_bignum_SECSH(blob2, n);
                buffer_get_bignum_SECSH(blob2, iqmp);
                buffer_get_bignum_SECSH(blob2, p);
                buffer_get_bignum_SECSH(blob2, q);

                break;
        }
        case KEY_DSA:
        {
                int param;
                BIGNUM *p, *q, *g, *pub_key, *priv_key;

                result->dsa = DSA_new();
                if (result->dsa == NULL) {
                        strncpy_s(errmsg, errmsg_len, "key init error", _TRUNCATE);
                        goto error;
                }
                p = BN_new();
                q = BN_new();
                g = BN_new();
                DSA_set0_pqg(result->dsa, p, q, g);
                pub_key = BN_new();
                priv_key = BN_new();
                DSA_set0_key(result->dsa, pub_key, priv_key);
                if (p == NULL ||
                    q == NULL ||
                    g == NULL ||
                    pub_key == NULL ||
                    priv_key == NULL) {
                        strncpy_s(errmsg, errmsg_len, "key init error", _TRUNCATE);
                        goto error;
                }

                param = buffer_get_int(blob2);
                if (param != 0) {
                        strncpy_s(errmsg, errmsg_len, "predefined DSA parameters not supported", _TRUNCATE);
                        goto error;
                }
                buffer_get_bignum_SECSH(blob2, p);
                buffer_get_bignum_SECSH(blob2, g);
                buffer_get_bignum_SECSH(blob2, q);
                buffer_get_bignum_SECSH(blob2, pub_key);
                buffer_get_bignum_SECSH(blob2, priv_key);

                break;
        }
        case KEY_ECDSA256:
        {
                unsigned int dummy, nid;
                int success = 0;
                char *curve = NULL;
                BIGNUM *exponent = NULL;
                EC_POINT *q = NULL;
                BN_CTX *ctx = NULL;

                dummy = buffer_get_int(blob2);
                curve = buffer_get_string_msg(blob2, NULL);

                if (strncmp(curve, "nistp256", strlen("nistp256")) == 0) {
                        result->type = KEY_ECDSA256;
                }
                else if (strncmp(curve, "nistp384", strlen("nistp384")) == 0) {
                        result->type = KEY_ECDSA384;
                }
                else if (strncmp(curve, "nistp521", strlen("nistp521")) == 0) {
                        result->type = KEY_ECDSA521;
                }
                else {
                        strncpy_s(errmsg, errmsg_len, "key type error", _TRUNCATE);
                        goto error;
                }

                nid = keytype_to_cipher_nid(result->type);
                if ((result->ecdsa = EC_KEY_new_by_curve_name(nid)) == NULL)
                        goto ecdsa_error;
                if ((q = EC_POINT_new(EC_KEY_get0_group(result->ecdsa))) == NULL)
                        goto ecdsa_error;
                if ((exponent = BN_new()) == NULL)
                        goto ecdsa_error;

                buffer_get_bignum_SECSH(blob2, exponent);
                if (EC_KEY_set_private_key(result->ecdsa, exponent) != 1)
                        goto ecdsa_error;
                if (key_ec_validate_private(result->ecdsa) != 0)
                        goto ecdsa_error;

                // �t�@�C�����������������i�[�������������������J�����v�Z��������
                if ((ctx = BN_CTX_new()) == NULL)
                        goto ecdsa_error;
                if (!EC_POINT_mul(EC_KEY_get0_group(result->ecdsa), q, exponent, NULL, NULL, ctx)) {
                        goto ecdsa_error;
                }
                if (EC_KEY_set_public_key(result->ecdsa, q) != 1)
                        goto ecdsa_error;
                if (key_ec_validate_public(EC_KEY_get0_group(result->ecdsa),
                                           EC_KEY_get0_public_key(result->ecdsa)) != 0)
                        goto ecdsa_error;

                success = 1;

ecdsa_error:
                free(curve);
                if (exponent)
                        BN_clear_free(exponent);
                if (q)
                        EC_POINT_free(q);
                if (ctx)
                        BN_CTX_free(ctx);
                if (success == 0)
                        goto error;

                break;
        }
        default:
                strncpy_s(errmsg, errmsg_len, "key type error", _TRUNCATE);
                goto error;
                break;
        }

        *invalid_passphrase = FALSE;

        fclose(fp);

        if (encname != NULL)
                free(encname);

        if (blob != NULL)
                buffer_free(blob);

        if (blob2 != NULL)
                buffer_free(blob2);

        return (result);

error:
        if (result != NULL)
                key_free(result);

        if (fp != NULL)
                fclose(fp);

        if (encname != NULL)
                free(encname);

        if (blob != NULL)
                buffer_free(blob);

        if (blob2 != NULL)
                buffer_free(blob2);

        return (NULL);
}

ssh2_keyfile_type get_ssh2_keytype(char *relative_name,
                                   FILE **fp,
                                   char *errmsg,
                                   int errmsg_len) {
        ssh2_keyfile_type ret = SSH2_KEYFILE_TYPE_NONE;
        char filename[2048];
        char line[200];
        int i;

        // �����p�X�������p�X�����������B�������������������A�u�h�b�g���n�����v�f�B���N�g����
        // �����t�@�C�������������������������B(2005.2.7 yutaka)
        get_teraterm_dir_relative_name(filename, sizeof(filename),
                                       relative_name);

        *fp = fopen(filename, "r");
        if (*fp == NULL) {
                strncpy_s(errmsg, errmsg_len, strerror(errno), _TRUNCATE);
                return ret;
        }

        while (fgets(line, sizeof(line), *fp) != NULL) {
                for (i=0; keyfile_headers[i].type != SSH2_KEYFILE_TYPE_NONE; i++) {
                        if ( strncmp(line, keyfile_headers[i].header, strlen(keyfile_headers[i].header)) == 0) {
                                ret = keyfile_headers[i].type;
                                break;
                        }
                }
                if (ret != SSH2_KEYFILE_TYPE_NONE)
                        break;
        }

        if (ret == SSH2_KEYFILE_TYPE_NONE) {
                strncpy_s(errmsg, errmsg_len, "Unknown key file type.", _TRUNCATE);
                fseek(*fp, 0, SEEK_SET);
                return ret;
        }

        fseek(*fp, 0, SEEK_SET);
        return ret;
}