bump version

This allows caching public keys (as done in the SSH agent).

.gitignore

@@ -55,3 +55,6 @@ docs/_build/
 
 # PyBuilder
 target/
+
+# Sublime Text
+*.sublime-*

.pylintrc

@@ -1,2 +1,2 @@
 [MESSAGES CONTROL]
-disable=invalid-name, missing-docstring, locally-disabled,no-member
+disable=invalid-name, missing-docstring, locally-disabled, unbalanced-tuple-unpacking,no-else-return

.travis.yml

@@ -3,15 +3,24 @@ language: python
 python:
   - "2.7"
   - "3.4"
+  - "3.5"
+  - "3.6"
+
+cache:
+  directories:
+    - $HOME/.cache/pip
+
+before_install:
+  - pip install -U setuptools pylint coverage pep8 pydocstyle "pip>=7.0" wheel
 
 install:
-  - pip install ecdsa ed25519  # test without trezorlib for now
-  - pip install pylint coverage pep8
+  - pip install -e .
 
 script:
-  - pep8 trezor_agent
-  - pylint --report=no --rcfile .pylintrc trezor_agent
-  - coverage run --source trezor_agent/ -m py.test -v
+  - pep8 libagent
+  - pylint --reports=no --rcfile .pylintrc libagent
+  - pydocstyle libagent
+  - coverage run --source libagent/ -m py.test -v
 
 after_success:
   - coverage report

INSTALL.md

@@ -0,0 +1,70 @@
+# Installation
+
+Install the following packages (depending on your distribution):
+
+### Debian
+
+    $ apt update && apt upgrade
+    $ apt install python-pip python-dev libusb-1.0-0-dev libudev-dev
+
+### Fedora/RedHat
+
+    $ yum update
+    $ yum install python-pip python-devel libusb-devel libudev-devel \
+                  gcc redhat-rpm-config
+
+Also, update Python packages before starting the installation:
+
+    $ pip install -U setuptools pip
+
+Make sure you are running the latest firmware version on your hardware device.
+Currently the following firmware versions are supported:
+
+ * [TREZOR](https://wallet.trezor.io/data/firmware/releases.json): `1.4.2+`
+ * [KeepKey](https://github.com/keepkey/keepkey-firmware/releases): `3.0.17+`
+ * [Ledger Nano S](https://github.com/LedgerHQ/blue-app-ssh-agent): `0.0.3+` (install [SSH/PGP Agent](https://www.ledgerwallet.com/images/apps/chrome-mngr-apps.png) app)
+
+## TREZOR
+
+Make sure that your `udev` rules are configured [correctly](https://doc.satoshilabs.com/trezor-user/settingupchromeonlinux.html#manual-configuration-of-udev-rules).
+Then, install the latest [trezor_agent](https://pypi.python.org/pypi/trezor_agent) package:
+
+    $ pip install trezor_agent
+
+Or, directly from the latest source code:
+
+    $ git clone https://github.com/romanz/trezor-agent
+    $ pip install --user -e trezor-agent/agents/trezor
+
+## KeepKey
+
+Make sure that your `udev` rules are configured [correctly](https://support.keepkey.com/support/solutions/articles/6000037796-keepkey-wallet-is-not-being-recognized-by-linux).
+Then, install the latest [keepkey_agent](https://pypi.python.org/pypi/keepkey_agent) package:
+
+    $ pip install keepkey_agent
+
+Or, directly from the latest source code:
+
+    $ git clone https://github.com/romanz/trezor-agent
+    $ pip install --user -e trezor-agent/agents/keepkey
+
+## Ledger Nano S
+
+Make sure that your `udev` rules are configured [correctly](http://support.ledgerwallet.com/knowledge_base/topics/ledger-wallet-is-not-recognized-on-linux).
+Then, install the latest [ledger_agent](https://pypi.python.org/pypi/ledger_agent) package:
+
+    $ pip install ledger_agent
+
+Or, directly from the latest source code:
+
+    $ git clone https://github.com/romanz/trezor-agent
+    $ pip install --user -e trezor-agent/agents/ledger
+
+## Troubleshooting
+
+If there is an import problem with the installed `protobuf` package,
+see [this issue](https://github.com/romanz/trezor-agent/issues/28) for fixing it.
+
+If you can't find the command-line utilities (after running `pip install --user`),
+please make sure that `~/.local/bin` is on your `PATH` variable
+(see a [relevant](https://github.com/pypa/pip/issues/3813) issue).

README-GPG.md

@@ -0,0 +1,102 @@
+Note: the GPG-related code is still under development, so please try the current implementation
+and please let me [know](https://github.com/romanz/trezor-agent/issues/new) if something doesn't
+work well for you. If possible:
+
+ * record the session (e.g. using [asciinema](asciinema.org))
+ * attach the GPG agent log from `~/.gnupg/{trezor,ledger}/gpg-agent.log`
+
+Thanks!
+
+# Installation
+
+First, verify that you have GPG 2.1.11+ installed
+([Debian](https://gist.github.com/vt0r/a2f8c0bcb1400131ff51),
+[macOS](https://sourceforge.net/p/gpgosx/docu/Download/)):
+
+```
+$ gpg2 --version | head -n1
+gpg (GnuPG) 2.1.15
+```
+
+This GPG version is included in [Ubuntu 16.04](https://launchpad.net/ubuntu/+source/gnupg2)
+and [Linux Mint 18](https://community.linuxmint.com/software/view/gnupg2).
+
+Update you device firmware to the latest version and install your specific `agent` package:
+
+```
+$ pip install --user (trezor|keepkey|ledger)_agent
+```
+
+# Quickstart
+
+## Identity creation
+[![asciicast](https://asciinema.org/a/90416.png)](https://asciinema.org/a/90416)
+
+In order to use specific device type for GPG indentity creation, use either command:
+```
+$ DEVICE=(trezor,ledger) ./scripts/gpg-init "John Doe <john@doe.bit>"
+```
+
+## Sample usage (signature and decryption)
+[![asciicast](https://asciinema.org/a/120441.png)](https://asciinema.org/a/120441)
+
+In order to use specific device type for GPG operations, set the following environment variable to either:
+```
+$ export GNUPGHOME=~/.gnupg/{trezor,ledger}
+```
+
+You can use GNU Privacy Assistant (GPA) in order to inspect the created keys
+and perform signature and decryption operations using:
+
+```
+$ sudo apt install gpa
+$ GNUPGHOME=~/.gnupg/trezor gpa
+```
+[![GPA](https://cloud.githubusercontent.com/assets/9900/20224804/053d7474-a849-11e6-87f3-ab07dc536158.png)](https://www.gnupg.org/related_software/swlist.html#gpa)
+
+## Git commit & tag signatures:
+Git can use GPG to sign and verify commits and tags (see [here](https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work)):
+```
+$ git config --local commit.gpgsign 1
+$ git config --local gpg.program $(which gpg2)
+$ git commit --gpg-sign                      # create GPG-signed commit
+$ git log --show-signature -1                # verify commit signature
+$ git tag v1.2.3 --sign                      # create GPG-signed tag
+$ git tag v1.2.3 --verify                    # verify tag signature
+```
+
+## Password manager
+
+First install `pass` from [passwordstore.org](https://www.passwordstore.org/) and initialize it to use your TREZOR-based GPG identity:
+```
+$ export GNUPGHOME=~/.gnupg/trezor
+$ pass init "Roman Zeyde <roman.zeyde@gmail.com>"
+Password store initialized for Roman Zeyde <roman.zeyde@gmail.com>
+```
+Then, you can generate truly random passwords and save them encrypted using your public key (as separate `.gpg` files under `~/.password-store/`):
+```
+$ pass generate Dev/github 32
+$ pass generate Social/hackernews 32
+$ pass generate Social/twitter 32
+$ pass generate VPS/linode 32
+$ pass
+Password Store
+├── Dev
+│   └── github
+├── Social
+│   ├── hackernews
+│   └── twitter
+└── VPS
+    └── linode
+```
+In order to paste them into the browser, you'd need to decrypt the password using your hardware device:
+```
+$ pass --clip VPS/linode
+Copied VPS/linode to clipboard. Will clear in 45 seconds.
+```
+
+You can also use the following [Qt-based UI](https://qtpass.org/) for `pass`:
+```
+$ sudo apt install qtpass
+$ GNUPGHOME=~/.gnupg/trezor qtpass
+```

README-SSH.md

@@ -0,0 +1,87 @@
+# Screencast demo usage
+
+## Simple usage (single SSH session)
+[![Demo](https://asciinema.org/a/22959.png)](https://asciinema.org/a/22959)
+
+## Advanced usage (multiple SSH sessions from a sub-shell)
+[![Subshell](https://asciinema.org/a/33240.png)](https://asciinema.org/a/33240)
+
+## Using for GitHub SSH authentication (via `trezor-git` utility)
+[![GitHub](https://asciinema.org/a/38337.png)](https://asciinema.org/a/38337)
+
+## Loading multiple SSH identities from configuration file
+[![Config](https://asciinema.org/a/bdxxtgctk5syu56yfz8lcp7ny.png)](https://asciinema.org/a/bdxxtgctk5syu56yfz8lcp7ny)
+
+# Public key generation
+
+Run:
+
+	/tmp $ trezor-agent user@ssh.hostname.com -v > hostname.pub
+	2015-09-02 15:03:18,929 INFO         getting "ssh://user@ssh.hostname.com" public key from Trezor...
+	2015-09-02 15:03:23,342 INFO         disconnected from Trezor
+	/tmp $ cat hostname.pub
+	ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGSevcDwmT+QaZPUEWUUjTeZRBICChxMKuJ7dRpBSF8+qt+8S1GBK5Zj8Xicc8SHG/SE/EXKUL2UU3kcUzE7ADQ= ssh://user@ssh.hostname.com
+
+Append `hostname.pub` contents to `/home/user/.ssh/authorized_keys`
+configuration file at `ssh.hostname.com`, so the remote server
+would allow you to login using the corresponding private key signature.
+
+# Usage
+
+Run:
+
+	/tmp $ trezor-agent user@ssh.hostname.com -v -c
+	2015-09-02 15:09:39,782 INFO         getting "ssh://user@ssh.hostname.com" public key from Trezor...
+	2015-09-02 15:09:44,430 INFO         please confirm user "roman" login to "ssh://user@ssh.hostname.com" using Trezor...
+	2015-09-02 15:09:46,152 INFO         signature status: OK
+	Linux lmde 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt11-1+deb8u3 (2015-08-04) x86_64
+
+	The programs included with the Debian GNU/Linux system are free software;
+	the exact distribution terms for each program are described in the
+	individual files in /usr/share/doc/*/copyright.
+
+	Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
+	permitted by applicable law.
+	Last login: Tue Sep  1 15:57:05 2015 from localhost
+	~ $
+
+Make sure to confirm SSH signature on the Trezor device when requested.
+
+## Accessing remote Git/Mercurial repositories
+
+Use your SSH public key to access your remote repository (e.g. [GitHub](https://help.github.com/articles/adding-a-new-ssh-key-to-your-github-account/)):
+
+	$ trezor-agent -v -e ed25519 git@github.com | xclip
+
+Use the following Bash alias for convinient Git operations:
+
+	$ alias git_hub='trezor-agent -v -e ed25519 git@github.com -- git'
+
+Replace `git` with `git_hub` for remote operations:
+
+	$ git_hub push origin master
+
+The same works for Mercurial (e.g. on [BitBucket](https://confluence.atlassian.com/bitbucket/set-up-ssh-for-mercurial-728138122.html)):
+
+	$ trezor-agent -v -e ed25519 git@bitbucket.org -- hg push
+
+
+# Troubleshooting
+
+If SSH connection fails to work, please open an [issue](https://github.com/romanz/trezor-agent/issues)
+with a verbose log attached (by running `trezor-agent -vv`) .
+
+## Incompatible SSH options
+
+Note that your local SSH configuration may ignore `trezor-agent`, if it has `IdentitiesOnly` option set to `yes`.
+
+     IdentitiesOnly
+             Specifies that ssh(1) should only use the authentication identity files configured in
+             the ssh_config files, even if ssh-agent(1) or a PKCS11Provider offers more identities.
+             The argument to this keyword must be “yes” or “no”.
+             This option is intended for situations where ssh-agent offers many different identities.
+             The default is “no”.
+
+If you are failing to connect, try running:
+
+    $ trezor-agent -vv user@host -- ssh -vv -oIdentitiesOnly=no user@host

README.md

@@ -1,71 +1,25 @@
-# Using TREZOR as a hardware SSH agent
+# Using TREZOR as a hardware SSH/GPG agent
 
 [![Build Status](https://travis-ci.org/romanz/trezor-agent.svg?branch=master)](https://travis-ci.org/romanz/trezor-agent)
-[![Python Versions](https://img.shields.io/pypi/pyversions/trezor_agent.svg)](https://pypi.python.org/pypi/trezor_agent/)
-[![License](https://img.shields.io/pypi/l/trezor_agent.svg)](https://pypi.python.org/pypi/trezor_agent/)
-[![Package Version](https://img.shields.io/pypi/v/trezor_agent.svg)](https://pypi.python.org/pypi/trezor_agent/)
-[![Development Status](https://img.shields.io/pypi/status/trezor_agent.svg)](https://pypi.python.org/pypi/trezor_agent/)
-[![Downloads](https://img.shields.io/pypi/dm/trezor_agent.svg)](https://pypi.python.org/pypi/trezor_agent/)
+[![Chat](https://badges.gitter.im/romanz/trezor-agent.svg)](https://gitter.im/romanz/trezor-agent)
 
-See SatoshiLabs' blog post about this feature:
+See SatoshiLabs' blog posts about this feature:
 
-- https://medium.com/@satoshilabs/trezor-firmware-1-3-4-enables-ssh-login-86a622d7e609
-
-## Screencast demo usage
-
-[![Demo](https://asciinema.org/a/22959.png)](https://asciinema.org/a/22959)
+- [TREZOR Firmware 1.3.4 enables SSH login](https://medium.com/@satoshilabs/trezor-firmware-1-3-4-enables-ssh-login-86a622d7e609)
+- [TREZOR Firmware 1.3.6 — GPG Signing, SSH Login Updates and Advanced Transaction Features for Segwit](https://medium.com/@satoshilabs/trezor-firmware-1-3-6-20a7df6e692)
+- [TREZOR Firmware 1.4.0 — GPG decryption support](https://www.reddit.com/r/TREZOR/comments/50h8r9/new_trezor_firmware_fidou2f_and_initial_ethereum/d7420q7/)
 
 ## Installation
 
-First, make sure that the latest `trezorlib` Python package
-is installed correctly (at least v0.6.6):
-
-	$ pip install Cython trezor
-
-Then, install the latest `trezor_agent` package:
-
-	$ pip install trezor_agent
-
-Finally, verify that you are running the latest TREZOR firmware version (at least v1.3.4):
-
-	$ trezorctl get_features
-	vendor: "bitcointrezor.com"
-	major_version: 1
-	minor_version: 3
-	patch_version: 4
-	...
-
-## Public key generation
-
-Run:
-
-	/tmp $ trezor-agent ssh.hostname.com -v > hostname.pub
-	2015-09-02 15:03:18,929 INFO         getting "ssh://ssh.hostname.com" public key from Trezor...
-	2015-09-02 15:03:23,342 INFO         disconnected from Trezor
-	/tmp $ cat hostname.pub
-	ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGSevcDwmT+QaZPUEWUUjTeZRBICChxMKuJ7dRpBSF8+qt+8S1GBK5Zj8Xicc8SHG/SE/EXKUL2UU3kcUzE7ADQ= ssh://ssh.hostname.com
-
-Append `hostname.pub` contents to `~/.ssh/authorized_keys`
-configuration file at `ssh.hostname.com`, so the remote server
-would allow you to login using the corresponding private key signature.
+See the [following instructions](INSTALL.md) for the
+[TREZOR](https://trezor.io/), [Keepkey](https://www.keepkey.com/) and
+[Ledger Nano S](https://www.ledgerwallet.com/products/ledger-nano-s) devices.
 
 ## Usage
 
-Run:
+For SSH, see the [following instructions](README-SSH.md) (for Windows support,
+see [trezor-ssh-agent](https://github.com/martin-lizner/trezor-ssh-agent) project by Martin Lízner).
 
-	/tmp $ trezor-agent ssh.hostname.com -v -c
-	2015-09-02 15:09:39,782 INFO         getting "ssh://ssh.hostname.com" public key from Trezor...
-	2015-09-02 15:09:44,430 INFO         please confirm user "roman" login to "ssh://ssh.hostname.com" using Trezor...
-	2015-09-02 15:09:46,152 INFO         signature status: OK
-	Linux lmde 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt11-1+deb8u3 (2015-08-04) x86_64
+For GPG, see the [following instructions](README-GPG.md).
 
-	The programs included with the Debian GNU/Linux system are free software;
-	the exact distribution terms for each program are described in the
-	individual files in /usr/share/doc/*/copyright.
-
-	Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
-	permitted by applicable law.
-	Last login: Tue Sep  1 15:57:05 2015 from localhost
-	~ $
-
-Make sure to confirm SSH signature on the Trezor device when requested.
+See [here](https://github.com/romanz/python-trezor#pin-entering) for PIN entering instructions.

agents/fake/fake_device_agent.py

@@ -0,0 +1,7 @@
+import libagent.gpg
+import libagent.ssh
+from libagent.device.fake_device import FakeDevice as DeviceType
+
+ssh_agent = lambda: libagent.ssh.main(DeviceType)
+gpg_tool = lambda: libagent.gpg.main(DeviceType)
+gpg_agent = lambda: libagent.gpg.run_agent(DeviceType)

agents/fake/setup.py

@@ -0,0 +1,42 @@
+#!/usr/bin/env python
+from setuptools import setup
+
+print('NEVER USE THIS CODE FOR REAL-LIFE USE-CASES!!!')
+print('ONLY FOR DEBUGGING AND TESTING!!!')
+
+setup(
+    name='fake_device_agent',
+    version='0.9.0',
+    description='Testing trezor_agent with a fake device - NOT SAFE!!!',
+    author='Roman Zeyde',
+    author_email='roman.zeyde@gmail.com',
+    url='http://github.com/romanz/trezor-agent',
+    scripts=['fake_device_agent.py'],
+    install_requires=[
+        'libagent>=0.9.0',
+    ],
+    platforms=['POSIX'],
+    classifiers=[
+        'Environment :: Console',
+        'Development Status :: 4 - Beta',
+        'Intended Audience :: Developers',
+        'Intended Audience :: Information Technology',
+        'Intended Audience :: System Administrators',
+        'License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)',
+        'Operating System :: POSIX',
+        'Programming Language :: Python :: 2.7',
+        'Programming Language :: Python :: 3.4',
+        'Programming Language :: Python :: 3.5',
+        'Programming Language :: Python :: 3.6',
+        'Topic :: Software Development :: Libraries :: Python Modules',
+        'Topic :: System :: Networking',
+        'Topic :: Communications',
+        'Topic :: Security',
+        'Topic :: Utilities',
+    ],
+    entry_points={'console_scripts': [
+        'fake-device-agent = fake_device_agent:ssh_agent',
+        'fake-device-gpg = fake_device_agent:gpg_tool',
+        'fake-device-gpg-agent = fake_device_agent:gpg_agent',
+    ]},
+)

agents/keepkey/keepkey_agent.py

@@ -0,0 +1,5 @@
+import libagent.gpg
+import libagent.ssh
+from libagent.device import keepkey
+
+ssh_agent = lambda: libagent.ssh.main(keepkey.KeepKey)

agents/keepkey/setup.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python
+from setuptools import setup
+
+setup(
+    name='keepkey_agent',
+    version='0.9.0',
+    description='Using KeepKey as hardware SSH/GPG agent',
+    author='Roman Zeyde',
+    author_email='roman.zeyde@gmail.com',
+    url='http://github.com/romanz/trezor-agent',
+    scripts=['keepkey_agent.py'],
+    install_requires=[
+        'libagent>=0.9.0',
+        'keepkey>=0.7.3'
+    ],
+    platforms=['POSIX'],
+    classifiers=[
+        'Environment :: Console',
+        'Development Status :: 4 - Beta',
+        'Intended Audience :: Developers',
+        'Intended Audience :: Information Technology',
+        'Intended Audience :: System Administrators',
+        'License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)',
+        'Operating System :: POSIX',
+        'Programming Language :: Python :: 2.7',
+        'Programming Language :: Python :: 3.4',
+        'Programming Language :: Python :: 3.5',
+        'Programming Language :: Python :: 3.6',
+        'Topic :: Software Development :: Libraries :: Python Modules',
+        'Topic :: System :: Networking',
+        'Topic :: Communications',
+        'Topic :: Security',
+        'Topic :: Utilities',
+    ],
+    entry_points={'console_scripts': [
+        'keepkey-agent = keepkey_agent:ssh_agent',
+    ]},
+)

agents/ledger/ledger_agent.py

@@ -0,0 +1,7 @@
+import libagent.gpg
+import libagent.ssh
+from libagent.device.ledger import LedgerNanoS as DeviceType
+
+ssh_agent = lambda: libagent.ssh.main(DeviceType)
+gpg_tool = lambda: libagent.gpg.main(DeviceType)
+gpg_agent = lambda: libagent.gpg.run_agent(DeviceType)

agents/ledger/setup.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python
+from setuptools import setup
+
+setup(
+    name='ledger_agent',
+    version='0.9.0',
+    description='Using Ledger as hardware SSH/GPG agent',
+    author='Roman Zeyde',
+    author_email='roman.zeyde@gmail.com',
+    url='http://github.com/romanz/trezor-agent',
+    scripts=['ledger_agent.py'],
+    install_requires=[
+        'libagent>=0.9.0',
+        'ledgerblue>=0.1.8'
+    ],
+    platforms=['POSIX'],
+    classifiers=[
+        'Environment :: Console',
+        'Development Status :: 4 - Beta',
+        'Intended Audience :: Developers',
+        'Intended Audience :: Information Technology',
+        'Intended Audience :: System Administrators',
+        'License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)',
+        'Operating System :: POSIX',
+        'Programming Language :: Python :: 2.7',
+        'Programming Language :: Python :: 3.4',
+        'Programming Language :: Python :: 3.5',
+        'Programming Language :: Python :: 3.6',
+        'Topic :: Software Development :: Libraries :: Python Modules',
+        'Topic :: System :: Networking',
+        'Topic :: Communications',
+        'Topic :: Security',
+        'Topic :: Utilities',
+    ],
+    entry_points={'console_scripts': [
+        'ledger-agent = ledger_agent:ssh_agent',
+        'ledger-gpg = ledger_agent:gpg_tool',
+        'ledger-gpg-agent = ledger_agent:gpg_agent',
+    ]},
+)

agents/trezor/setup.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python
+from setuptools import setup
+
+setup(
+    name='trezor_agent',
+    version='0.9.0',
+    description='Using Trezor as hardware SSH/GPG agent',
+    author='Roman Zeyde',
+    author_email='roman.zeyde@gmail.com',
+    url='http://github.com/romanz/trezor-agent',
+    scripts=['trezor_agent.py'],
+    install_requires=[
+        'libagent>=0.9.0',
+        'trezor>=0.7.6'
+    ],
+    platforms=['POSIX'],
+    classifiers=[
+        'Environment :: Console',
+        'Development Status :: 4 - Beta',
+        'Intended Audience :: Developers',
+        'Intended Audience :: Information Technology',
+        'Intended Audience :: System Administrators',
+        'License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)',
+        'Operating System :: POSIX',
+        'Programming Language :: Python :: 2.7',
+        'Programming Language :: Python :: 3.4',
+        'Programming Language :: Python :: 3.5',
+        'Programming Language :: Python :: 3.6',
+        'Topic :: Software Development :: Libraries :: Python Modules',
+        'Topic :: System :: Networking',
+        'Topic :: Communications',
+        'Topic :: Security',
+        'Topic :: Utilities',
+    ],
+    entry_points={'console_scripts': [
+        'trezor-agent = trezor_agent:ssh_agent',
+        'trezor-gpg = trezor_agent:gpg_tool',
+        'trezor-gpg-agent = trezor_agent:gpg_agent',
+    ]},
+)

agents/trezor/trezor_agent.py

@@ -0,0 +1,7 @@
+import libagent.gpg
+import libagent.ssh
+from libagent.device.trezor import Trezor as DeviceType
+
+ssh_agent = lambda: libagent.ssh.main(DeviceType)
+gpg_tool = lambda: libagent.gpg.main(DeviceType)
+gpg_agent = lambda: libagent.gpg.run_agent(DeviceType)

libagent/__init__.py

@@ -0,0 +1 @@
+"""SSH-agent implementation using hardware authentication devices."""

libagent/device/__init__.py

@@ -0,0 +1,3 @@
+"""Cryptographic hardware device management."""
+
+from . import interface

libagent/device/fake_device.py

@@ -0,0 +1,69 @@
+"""Fake device - ONLY FOR TESTS!!! (NEVER USE WITH REAL DATA)."""
+
+import hashlib
+import logging
+
+import ecdsa
+
+from . import interface
+from .. import formats
+
+log = logging.getLogger(__name__)
+
+
+def _verify_support(identity):
+    """Make sure the device supports given configuration."""
+    if identity.curve_name not in {formats.CURVE_NIST256}:
+        raise NotImplementedError(
+            'Unsupported elliptic curve: {}'.format(identity.curve_name))
+
+
+class FakeDevice(interface.Device):
+    """Connection to TREZOR device."""
+
+    def connect(self):
+        """Return "dummy" connection."""
+        log.critical('NEVER USE THIS CODE FOR REAL-LIFE USE-CASES!!!')
+        log.critical('ONLY FOR DEBUGGING AND TESTING!!!')
+        # The code below uses HARD-CODED secret key - and should be used ONLY
+        # for GnuPG integration tests (e.g. when no real device is available).
+        # pylint: disable=attribute-defined-outside-init
+        self.secexp = 1
+        self.sk = ecdsa.SigningKey.from_secret_exponent(
+            secexp=self.secexp, curve=ecdsa.curves.NIST256p, hashfunc=hashlib.sha256)
+        self.vk = self.sk.get_verifying_key()
+        return self
+
+    def close(self):
+        """Close connection."""
+        self.conn = None
+
+    def pubkey(self, identity, ecdh=False):
+        """Return public key."""
+        _verify_support(identity)
+        data = self.vk.to_string()
+        x, y = data[:32], data[32:]
+        prefix = bytearray([2 + (bytearray(y)[0] & 1)])
+        return bytes(prefix) + x
+
+    def sign(self, identity, blob):
+        """Sign given blob and return the signature (as bytes)."""
+        if identity.identity_dict['proto'] in {'ssh'}:
+            digest = hashlib.sha256(blob).digest()
+        else:
+            digest = blob
+        return self.sk.sign_digest_deterministic(digest=digest,
+                                                 hashfunc=hashlib.sha256)
+
+    def ecdh(self, identity, pubkey):
+        """Get shared session key using Elliptic Curve Diffie-Hellman."""
+        assert pubkey[:1] == b'\x04'
+        peer = ecdsa.VerifyingKey.from_string(
+            pubkey[1:],
+            curve=ecdsa.curves.NIST256p,
+            hashfunc=hashlib.sha256)
+        shared = ecdsa.VerifyingKey.from_public_point(
+            point=(peer.pubkey.point * self.secexp),
+            curve=ecdsa.curves.NIST256p,
+            hashfunc=hashlib.sha256)
+        return shared.to_string()

libagent/device/interface.py

@@ -0,0 +1,143 @@
+"""Device abstraction layer."""
+
+import hashlib
+import io
+import logging
+import re
+import struct
+
+import unidecode
+
+from .. import formats, util
+
+log = logging.getLogger(__name__)
+
+_identity_regexp = re.compile(''.join([
+    '^'
+    r'(?:(?P<proto>.*)://)?',
+    r'(?:(?P<user>.*)@)?',
+    r'(?P<host>.*?)',
+    r'(?::(?P<port>\w*))?',
+    r'(?P<path>/.*)?',
+    '$'
+]))
+
+
+def string_to_identity(identity_str):
+    """Parse string into Identity dictionary."""
+    m = _identity_regexp.match(identity_str)
+    result = m.groupdict()
+    log.debug('parsed identity: %s', result)
+    return {k: v for k, v in result.items() if v}
+
+
+def identity_to_string(identity_dict):
+    """Dump Identity dictionary into its string representation."""
+    result = []
+    if identity_dict.get('proto'):
+        result.append(identity_dict['proto'] + '://')
+    if identity_dict.get('user'):
+        result.append(identity_dict['user'] + '@')
+    result.append(identity_dict['host'])
+    if identity_dict.get('port'):
+        result.append(':' + identity_dict['port'])
+    if identity_dict.get('path'):
+        result.append(identity_dict['path'])
+    log.debug('identity parts: %s', result)
+    return ''.join(result)
+
+
+class Error(Exception):
+    """Device-related error."""
+
+
+class NotFoundError(Error):
+    """Device could not be found."""
+
+
+class DeviceError(Error):
+    """Error during device operation."""
+
+
+class Identity(object):
+    """Represent SLIP-0013 identity, together with a elliptic curve choice."""
+
+    def __init__(self, identity_str, curve_name):
+        """Configure for specific identity and elliptic curve usage."""
+        self.identity_dict = string_to_identity(identity_str)
+        self.curve_name = curve_name
+
+    def items(self):
+        """Return a copy of identity_dict items."""
+        return [(k, unidecode.unidecode(v))
+                for k, v in self.identity_dict.items()]
+
+    def to_bytes(self):
+        """Transliterate Unicode into ASCII."""
+        s = identity_to_string(self.identity_dict)
+        return unidecode.unidecode(s).encode('ascii')
+
+    def __str__(self):
+        """Return identity serialized to string."""
+        return '<{}|{}>'.format(identity_to_string(self.identity_dict), self.curve_name)
+
+    def get_bip32_address(self, ecdh=False):
+        """Compute BIP32 derivation address according to SLIP-0013/0017."""
+        index = struct.pack('<L', self.identity_dict.get('index', 0))
+        addr = index + self.to_bytes()
+        log.debug('bip32 address string: %r', addr)
+        digest = hashlib.sha256(addr).digest()
+        s = io.BytesIO(bytearray(digest))
+
+        hardened = 0x80000000
+        addr_0 = 17 if bool(ecdh) else 13
+        address_n = [addr_0] + list(util.recv(s, '<LLLL'))
+        return [(hardened | value) for value in address_n]
+
+    def get_curve_name(self, ecdh=False):
+        """Return correct curve name for device operations."""
+        if ecdh:
+            return formats.get_ecdh_curve_name(self.curve_name)
+        else:
+            return self.curve_name
+
+
+class Device(object):
+    """Abstract cryptographic hardware device interface."""
+
+    def __init__(self):
+        """C-tor."""
+        self.conn = None
+
+    def connect(self):
+        """Connect to device, otherwise raise NotFoundError."""
+        raise NotImplementedError()
+
+    def __enter__(self):
+        """Allow usage as context manager."""
+        self.conn = self.connect()
+        return self
+
+    def __exit__(self, *args):
+        """Close and mark as disconnected."""
+        try:
+            self.conn.close()
+        except Exception as e:  # pylint: disable=broad-except
+            log.exception('close failed: %s', e)
+        self.conn = None
+
+    def pubkey(self, identity, ecdh=False):
+        """Get public key (as bytes)."""
+        raise NotImplementedError()
+
+    def sign(self, identity, blob):
+        """Sign given blob and return the signature (as bytes)."""
+        raise NotImplementedError()
+
+    def ecdh(self, identity, pubkey):
+        """Get shared session key using Elliptic Curve Diffie-Hellman."""
+        raise NotImplementedError()
+
+    def __str__(self):
+        """Human-readable representation."""
+        return '{}'.format(self.__class__.__name__)

libagent/device/keepkey.py

@@ -0,0 +1,37 @@
+"""KeepKey-related code (see https://www.keepkey.com/)."""
+
+from . import trezor
+from .. import formats
+
+
+def _verify_support(identity, ecdh):
+    """Make sure the device supports given configuration."""
+    protocol = identity.identity_dict['proto']
+    if protocol not in {'ssh'}:
+        raise NotImplementedError(
+            'Unsupported protocol: {}'.format(protocol))
+    if ecdh:
+        raise NotImplementedError('No support for ECDH')
+    if identity.curve_name not in {formats.CURVE_NIST256}:
+        raise NotImplementedError(
+            'Unsupported elliptic curve: {}'.format(identity.curve_name))
+
+
+class KeepKey(trezor.Trezor):
+    """Connection to KeepKey device."""
+
+    @property
+    def _defs(self):
+        from . import keepkey_defs
+        return keepkey_defs
+
+    required_version = '>=1.0.4'
+
+    def pubkey(self, identity, ecdh=False):
+        """Return public key."""
+        _verify_support(identity, ecdh)
+        return trezor.Trezor.pubkey(self, identity=identity, ecdh=ecdh)
+
+    def ecdh(self, identity, pubkey):
+        """No support for ECDH in KeepKey firmware."""
+        _verify_support(identity, ecdh=True)

libagent/device/keepkey_defs.py

@@ -0,0 +1,9 @@
+"""KeepKey-related definitions."""
+
+# pylint: disable=unused-import,import-error
+
+from keepkeylib.client import CallException as Error
+from keepkeylib.client import KeepKeyClient as Client
+from keepkeylib.messages_pb2 import PassphraseAck, PinMatrixAck
+from keepkeylib.transport_hid import HidTransport as Transport
+from keepkeylib.types_pb2 import IdentityType

libagent/device/ledger.py

@@ -0,0 +1,111 @@
+"""Ledger-related code (see https://www.ledgerwallet.com/)."""
+
+import binascii
+import logging
+import struct
+
+from ledgerblue import comm  # pylint: disable=import-error
+
+from . import interface
+
+log = logging.getLogger(__name__)
+
+
+def _expand_path(path):
+    """Convert BIP32 path into bytes."""
+    return b''.join((struct.pack('>I', e) for e in path))
+
+
+def _convert_public_key(ecdsa_curve_name, result):
+    """Convert Ledger reply into PublicKey object."""
+    if ecdsa_curve_name == 'nist256p1':
+        if (result[64] & 1) != 0:
+            result = bytearray([0x03]) + result[1:33]
+        else:
+            result = bytearray([0x02]) + result[1:33]
+    else:
+        result = result[1:]
+        keyX = bytearray(result[0:32])
+        keyY = bytearray(result[32:][::-1])
+        if (keyX[31] & 1) != 0:
+            keyY[31] |= 0x80
+        result = b'\x00' + bytes(keyY)
+    return bytes(result)
+
+
+class LedgerNanoS(interface.Device):
+    """Connection to Ledger Nano S device."""
+
+    def connect(self):
+        """Enumerate and connect to the first USB HID interface."""
+        try:
+            return comm.getDongle()
+        except comm.CommException as e:
+            raise interface.NotFoundError(
+                '{} not connected: "{}"'.format(self, e))
+
+    def pubkey(self, identity, ecdh=False):
+        """Get PublicKey object for specified BIP32 address and elliptic curve."""
+        curve_name = identity.get_curve_name(ecdh)
+        path = _expand_path(identity.get_bip32_address(ecdh))
+        if curve_name == 'nist256p1':
+            p2 = '01'
+        else:
+            p2 = '02'
+        apdu = '800200' + p2
+        apdu = binascii.unhexlify(apdu)
+        apdu += bytearray([len(path) + 1, len(path) // 4])
+        apdu += path
+        result = bytearray(self.conn.exchange(bytes(apdu)))[1:]
+        return _convert_public_key(curve_name, result)
+
+    def sign(self, identity, blob):
+        """Sign given blob and return the signature (as bytes)."""
+        path = _expand_path(identity.get_bip32_address(ecdh=False))
+        if identity.identity_dict['proto'] == 'ssh':
+            ins = '04'
+            p1 = '00'
+        else:
+            ins = '08'
+            p1 = '00'
+        if identity.curve_name == 'nist256p1':
+            p2 = '81' if identity.identity_dict['proto'] == 'ssh' else '01'
+        else:
+            p2 = '82' if identity.identity_dict['proto'] == 'ssh' else '02'
+        apdu = '80' + ins + p1 + p2
+        apdu = binascii.unhexlify(apdu)
+        apdu += bytearray([len(blob) + len(path) + 1])
+        apdu += bytearray([len(path) // 4]) + path
+        apdu += blob
+        result = bytearray(self.conn.exchange(bytes(apdu)))
+        if identity.curve_name == 'nist256p1':
+            offset = 3
+            length = result[offset]
+            r = result[offset+1:offset+1+length]
+            if r[0] == 0:
+                r = r[1:]
+            offset = offset + 1 + length + 1
+            length = result[offset]
+            s = result[offset+1:offset+1+length]
+            if s[0] == 0:
+                s = s[1:]
+            offset = offset + 1 + length
+            return bytes(r) + bytes(s)
+        else:
+            return bytes(result[:64])
+
+    def ecdh(self, identity, pubkey):
+        """Get shared session key using Elliptic Curve Diffie-Hellman."""
+        path = _expand_path(identity.get_bip32_address(ecdh=True))
+        if identity.curve_name == 'nist256p1':
+            p2 = '01'
+        else:
+            p2 = '02'
+        apdu = '800a00' + p2
+        apdu = binascii.unhexlify(apdu)
+        apdu += bytearray([len(pubkey) + len(path) + 1])
+        apdu += bytearray([len(path) // 4]) + path
+        apdu += pubkey
+        result = bytearray(self.conn.exchange(bytes(apdu)))
+        assert result[0] == 0x04
+        return bytes(result)

libagent/device/trezor.py

@@ -0,0 +1,142 @@
+"""TREZOR-related code (see http://bitcointrezor.com/)."""
+
+import binascii
+import logging
+import os
+import sys
+
+import semver
+
+from . import interface
+
+log = logging.getLogger(__name__)
+
+
+class Trezor(interface.Device):
+    """Connection to TREZOR device."""
+
+    @property
+    def _defs(self):
+        from . import trezor_defs
+        # Allow using TREZOR bridge transport (instead of the HID default)
+        trezor_defs.Transport = {
+            'bridge': trezor_defs.BridgeTransport,
+        }.get(os.environ.get('TREZOR_TRANSPORT'), trezor_defs.HidTransport)
+        return trezor_defs
+
+    required_version = '>=1.4.0'
+    passphrase = os.environ.get('TREZOR_PASSPHRASE', '')
+
+    def connect(self):
+        """Enumerate and connect to the first USB HID interface."""
+        def passphrase_handler(_):
+            log.debug('using %s passphrase for %s',
+                      'non-empty' if self.passphrase else 'empty', self)
+            return self._defs.PassphraseAck(passphrase=self.passphrase)
+
+        def create_pin_handler(conn):
+            if os.isatty(sys.stdin.fileno()):
+                return conn.callback_PinMatrixRequest  # CLI-based PIN handler
+
+            def qt_handler(_):
+                # pylint: disable=import-error
+                from PyQt5.QtWidgets import QApplication, QInputDialog, QLineEdit
+                label = ('Use the numeric keypad to describe number positions.\n'
+                         'The layout is:\n'
+                         '    7 8 9\n'
+                         '    4 5 6\n'
+                         '    1 2 3\n'
+                         'Please enter PIN:')
+                app = QApplication([])
+                qd = QInputDialog()
+                qd.setTextEchoMode(QLineEdit.Password)
+                qd.setLabelText(label)
+                qd.show()
+                app.exec_()
+                return self._defs.PinMatrixAck(pin=qd.textValue())
+
+            return qt_handler
+
+        for d in self._defs.Transport.enumerate():
+            log.debug('endpoint: %s', d)
+            transport = self._defs.Transport(d)
+            connection = self._defs.Client(transport)
+            connection.callback_PassphraseRequest = passphrase_handler
+            connection.callback_PinMatrixRequest = create_pin_handler(connection)
+            f = connection.features
+            log.debug('connected to %s %s', self, f.device_id)
+            log.debug('label    : %s', f.label)
+            log.debug('vendor   : %s', f.vendor)
+            current_version = '{}.{}.{}'.format(f.major_version,
+                                                f.minor_version,
+                                                f.patch_version)
+            log.debug('version  : %s', current_version)
+            log.debug('revision : %s', binascii.hexlify(f.revision))
+            if not semver.match(current_version, self.required_version):
+                fmt = ('Please upgrade your {} firmware to {} version'
+                       ' (current: {})')
+                raise ValueError(fmt.format(self, self.required_version,
+                                            current_version))
+            connection.ping(msg='', pin_protection=True)  # unlock PIN
+            return connection
+        raise interface.NotFoundError('{} not connected'.format(self))
+
+    def close(self):
+        """Close connection."""
+        self.conn.close()
+
+    def pubkey(self, identity, ecdh=False):
+        """Return public key."""
+        curve_name = identity.get_curve_name(ecdh=ecdh)
+        log.debug('"%s" getting public key (%s) from %s',
+                  identity, curve_name, self)
+        addr = identity.get_bip32_address(ecdh=ecdh)
+        result = self.conn.get_public_node(n=addr,
+                                           ecdsa_curve_name=curve_name)
+        log.debug('result: %s', result)
+        return result.node.public_key
+
+    def _identity_proto(self, identity):
+        result = self._defs.IdentityType()
+        for name, value in identity.items():
+            setattr(result, name, value)
+        return result
+
+    def sign(self, identity, blob):
+        """Sign given blob and return the signature (as bytes)."""
+        curve_name = identity.get_curve_name(ecdh=False)
+        log.debug('"%s" signing %r (%s) on %s',
+                  identity, blob, curve_name, self)
+        try:
+            result = self.conn.sign_identity(
+                identity=self._identity_proto(identity),
+                challenge_hidden=blob,
+                challenge_visual='',
+                ecdsa_curve_name=curve_name)
+            log.debug('result: %s', result)
+            assert len(result.signature) == 65
+            assert result.signature[:1] == b'\x00'
+            return result.signature[1:]
+        except self._defs.Error as e:
+            msg = '{} error: {}'.format(self, e)
+            log.debug(msg, exc_info=True)
+            raise interface.DeviceError(msg)
+
+    def ecdh(self, identity, pubkey):
+        """Get shared session key using Elliptic Curve Diffie-Hellman."""
+        curve_name = identity.get_curve_name(ecdh=True)
+        log.debug('"%s" shared session key (%s) for %r from %s',
+                  identity, curve_name, pubkey, self)
+        try:
+            result = self.conn.get_ecdh_session_key(
+                identity=self._identity_proto(identity),
+                peer_public_key=pubkey,
+                ecdsa_curve_name=curve_name)
+            log.debug('result: %s', result)
+            assert len(result.session_key) in {65, 33}  # NIST256 or Curve25519
+            assert result.session_key[:1] == b'\x04'
+            return result.session_key
+        except self._defs.Error as e:
+            msg = '{} error: {}'.format(self, e)
+            log.debug(msg, exc_info=True)
+            raise interface.DeviceError(msg)

libagent/device/trezor_defs.py

@@ -0,0 +1,10 @@
+"""TREZOR-related definitions."""
+
+# pylint: disable=unused-import,import-error
+
+from trezorlib.client import CallException as Error
+from trezorlib.client import TrezorClient as Client
+from trezorlib.messages_pb2 import PassphraseAck, PinMatrixAck
+from trezorlib.transport_bridge import BridgeTransport
+from trezorlib.transport_hid import HidTransport
+from trezorlib.types_pb2 import IdentityType

libagent/formats.py

@@ -1,19 +1,25 @@
-import io
-import hashlib
+"""SSH format parsing and formatting tools."""
 import base64
+import hashlib
+import io
+import logging
+
 import ecdsa
 import ed25519
 
 from . import util
 
-import logging
 log = logging.getLogger(__name__)
 
-# Supported ECDSA curves
-CURVE_NIST256 = b'nist256p1'
-CURVE_ED25519 = b'ed25519'
+# Supported ECDSA curves (for SSH and GPG)
+CURVE_NIST256 = 'nist256p1'
+CURVE_ED25519 = 'ed25519'
 SUPPORTED_CURVES = {CURVE_NIST256, CURVE_ED25519}
 
+# Supported ECDH curves (for GPG)
+ECDH_NIST256 = 'nist256p1'
+ECDH_CURVE25519 = 'curve25519'
+
 # SSH key types
 SSH_NIST256_DER_OCTET = b'\x04'
 SSH_NIST256_KEY_PREFIX = b'ecdsa-sha2-'
@@ -26,11 +32,23 @@ hashfunc = hashlib.sha256
 
 
 def fingerprint(blob):
+    """
+    Compute SSH fingerprint for specified blob.
+
+    See https://en.wikipedia.org/wiki/Public_key_fingerprint for details.
+    """
     digest = hashlib.md5(blob).digest()
     return ':'.join('{:02x}'.format(c) for c in bytearray(digest))
 
 
 def parse_pubkey(blob):
+    """
+    Parse SSH public key from given blob.
+
+    Construct a verifier for ECDSA signatures.
+    The verifier returns the signatures in the required SSH format.
+    Currently, NIST256P1 and ED25519 elliptic curves are supported.
+    """
     fp = fingerprint(blob)
     s = io.BytesIO(blob)
     key_type = util.read_frame(s)
@@ -52,11 +70,11 @@ def parse_pubkey(blob):
 
         curve = ecdsa.NIST256p
         point = ecdsa.ellipticcurve.Point(curve.curve, *coords)
-        vk = ecdsa.VerifyingKey.from_public_point(point, curve, hashfunc)
 
         def ecdsa_verifier(sig, msg):
             assert len(sig) == 2 * size
             sig_decode = ecdsa.util.sigdecode_string
+            vk = ecdsa.VerifyingKey.from_public_point(point, curve, hashfunc)
             vk.verify(signature=sig, data=msg, sigdecode=sig_decode)
             parts = [sig[:size], sig[size:]]
             return b''.join([util.frame(b'\x00' + p) for p in parts])
@@ -67,10 +85,10 @@ def parse_pubkey(blob):
     if key_type == SSH_ED25519_KEY_TYPE:
         pubkey = util.read_frame(s)
         assert s.read() == b''
-        vk = ed25519.VerifyingKey(pubkey)
 
         def ed25519_verify(sig, msg):
             assert len(sig) == 64
+            vk = ed25519.VerifyingKey(pubkey)
             vk.verify(sig, msg)
             return sig
 
@@ -80,12 +98,20 @@ def parse_pubkey(blob):
 
 
 def _decompress_ed25519(pubkey):
+    """Load public key from the serialized blob (stripping the prefix byte)."""
     if pubkey[:1] == b'\x00':
         # set by Trezor fsm_msgSignIdentity() and fsm_msgGetPublicKey()
         return ed25519.VerifyingKey(pubkey[1:])
 
 
 def _decompress_nist256(pubkey):
+    """
+    Load public key from the serialized blob.
+
+    The leading byte least-significant bit is used to decide how to recreate
+    the y-coordinate from the specified x-coordinate. See bitcoin/main.py#L198
+    (from https://github.com/vbuterin/pybitcointools/) for details.
+    """
     if pubkey[:1] in {b'\x02', b'\x03'}:  # set by ecdsa_get_public_key33()
         curve = ecdsa.NIST256p
         P = curve.curve.p()
@@ -103,11 +129,17 @@ def _decompress_nist256(pubkey):
 
 
 def decompress_pubkey(pubkey, curve_name):
+    """
+    Load public key from the serialized blob.
+
+    Raise ValueError on parsing error.
+    """
     vk = None
     if len(pubkey) == 33:
         decompress = {
             CURVE_NIST256: _decompress_nist256,
-            CURVE_ED25519: _decompress_ed25519
+            CURVE_ED25519: _decompress_ed25519,
+            ECDH_CURVE25519: _decompress_ed25519,
         }[curve_name]
         vk = decompress(pubkey)
 
@@ -119,6 +151,12 @@ def decompress_pubkey(pubkey, curve_name):
 
 
 def serialize_verifying_key(vk):
+    """
+    Serialize a public key into SSH format (for exporting to text format).
+
+    Currently, NIST256P1 and ED25519 elliptic curves are supported.
+    Raise TypeError on unsupported key format.
+    """
     if isinstance(vk, ed25519.keys.VerifyingKey):
         pubkey = vk.to_bytes()
         key_type = SSH_ED25519_KEY_TYPE
@@ -137,6 +175,12 @@ def serialize_verifying_key(vk):
 
 
 def export_public_key(vk, label):
+    """
+    Export public key to text format.
+
+    The resulting string can be written into a .pub file or
+    appended to the ~/.ssh/authorized_keys file.
+    """
     key_type, blob = serialize_verifying_key(vk)
     log.debug('fingerprint: %s', fingerprint(blob))
     b64 = base64.b64encode(blob).decode('ascii')
@@ -144,12 +188,21 @@ def export_public_key(vk, label):
 
 
 def import_public_key(line):
-    ''' Parse public key textual format, as saved at .pub file '''
+    """Parse public key textual format, as saved at a .pub file."""
     log.debug('loading SSH public key: %r', line)
     file_type, base64blob, name = line.split()
     blob = base64.b64decode(base64blob)
     result = parse_pubkey(blob)
-    result['name'] = name.encode('ascii')
+    result['name'] = name.encode('utf-8')
     assert result['type'] == file_type.encode('ascii')
     log.debug('loaded %s public key: %s', file_type, result['fingerprint'])
     return result
+
+
+def get_ecdh_curve_name(signature_curve_name):
+    """Return appropriate curve for ECDH for specified signing curve."""
+    return {
+        CURVE_NIST256: ECDH_NIST256,
+        CURVE_ED25519: ECDH_CURVE25519,
+        ECDH_CURVE25519: ECDH_CURVE25519,
+    }[signature_curve_name]

libagent/gpg/__init__.py

@@ -0,0 +1,149 @@
+"""
+TREZOR support for ECDSA GPG signatures.
+
+See these links for more details:
+ - https://www.gnupg.org/faq/whats-new-in-2.1.html
+ - https://tools.ietf.org/html/rfc4880
+ - https://tools.ietf.org/html/rfc6637
+ - https://tools.ietf.org/html/draft-irtf-cfrg-eddsa-05
+"""
+
+import argparse
+import contextlib
+import functools
+import logging
+import os
+import sys
+import time
+
+import semver
+
+from . import agent, client, encode, keyring, protocol
+from .. import device, formats, server, util
+
+log = logging.getLogger(__name__)
+
+
+def export_public_key(device_type, args):
+    """Generate a new pubkey for a new/existing GPG identity."""
+    log.warning('NOTE: in order to re-generate the exact same GPG key later, '
+                'run this command with "--time=%d" commandline flag (to set '
+                'the timestamp of the GPG key manually).', args.time)
+    c = client.Client(device=device_type())
+    identity = client.create_identity(user_id=args.user_id,
+                                      curve_name=args.ecdsa_curve)
+    verifying_key = c.pubkey(identity=identity, ecdh=False)
+    decryption_key = c.pubkey(identity=identity, ecdh=True)
+    signer_func = functools.partial(c.sign, identity=identity)
+
+    if args.subkey:  # add as subkey
+        log.info('adding %s GPG subkey for "%s" to existing key',
+                 args.ecdsa_curve, args.user_id)
+        # subkey for signing
+        signing_key = protocol.PublicKey(
+            curve_name=args.ecdsa_curve, created=args.time,
+            verifying_key=verifying_key, ecdh=False)
+        # subkey for encryption
+        encryption_key = protocol.PublicKey(
+            curve_name=formats.get_ecdh_curve_name(args.ecdsa_curve),
+            created=args.time, verifying_key=decryption_key, ecdh=True)
+        primary_bytes = keyring.export_public_key(args.user_id)
+        result = encode.create_subkey(primary_bytes=primary_bytes,
+                                      subkey=signing_key,
+                                      signer_func=signer_func)
+        result = encode.create_subkey(primary_bytes=result,
+                                      subkey=encryption_key,
+                                      signer_func=signer_func)
+    else:  # add as primary
+        log.info('creating new %s GPG primary key for "%s"',
+                 args.ecdsa_curve, args.user_id)
+        # primary key for signing
+        primary = protocol.PublicKey(
+            curve_name=args.ecdsa_curve, created=args.time,
+            verifying_key=verifying_key, ecdh=False)
+        # subkey for encryption
+        subkey = protocol.PublicKey(
+            curve_name=formats.get_ecdh_curve_name(args.ecdsa_curve),
+            created=args.time, verifying_key=decryption_key, ecdh=True)
+
+        result = encode.create_primary(user_id=args.user_id,
+                                       pubkey=primary,
+                                       signer_func=signer_func)
+        result = encode.create_subkey(primary_bytes=result,
+                                      subkey=subkey,
+                                      signer_func=signer_func)
+
+    sys.stdout.write(protocol.armor(result, 'PUBLIC KEY BLOCK'))
+
+
+def run_create(device_type, args):
+    """Export public GPG key."""
+    util.setup_logging(verbosity=args.verbose)
+    log.warning('This GPG tool is still in EXPERIMENTAL mode, '
+                'so please note that the API and features may '
+                'change without backwards compatibility!')
+
+    existing_gpg = keyring.gpg_version().decode('ascii')
+    required_gpg = '>=2.1.11'
+    if semver.match(existing_gpg, required_gpg):
+        export_public_key(device_type, args)
+    else:
+        log.error('Existing gpg2 has version "%s" (%s required)',
+                  existing_gpg, required_gpg)
+
+
+def run_unlock(device_type, args):
+    """Unlock hardware device (for future interaction)."""
+    util.setup_logging(verbosity=args.verbose)
+    with device_type() as d:
+        log.info('unlocked %s device', d)
+
+
+def run_agent(device_type):
+    """Run a simple GPG-agent server."""
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--homedir', default=os.environ.get('GNUPGHOME'))
+    args, _ = parser.parse_known_args()
+
+    assert args.homedir
+    config_file = os.path.join(args.homedir, 'gpg-agent.conf')
+
+    lines = (line.strip() for line in open(config_file))
+    lines = (line for line in lines if line and not line.startswith('#'))
+    config = dict(line.split(' ', 1) for line in lines)
+
+    util.setup_logging(verbosity=int(config['verbosity']),
+                       filename=config['log-file'])
+    sock_path = keyring.get_agent_sock_path()
+    handler = agent.Handler(device=device_type())
+    with server.unix_domain_socket_server(sock_path) as sock:
+        for conn in agent.yield_connections(sock):
+            with contextlib.closing(conn):
+                try:
+                    handler.handle(conn)
+                except agent.AgentStop:
+                    log.info('stopping gpg-agent')
+                    return
+                except Exception as e:  # pylint: disable=broad-except
+                    log.exception('gpg-agent failed: %s', e)
+
+
+def main(device_type):
+    """Parse command-line arguments."""
+    parser = argparse.ArgumentParser()
+    subparsers = parser.add_subparsers()
+
+    p = subparsers.add_parser('create', help='Export public GPG key')
+    p.add_argument('user_id')
+    p.add_argument('-e', '--ecdsa-curve', default='nist256p1')
+    p.add_argument('-t', '--time', type=int, default=int(time.time()))
+    p.add_argument('-v', '--verbose', default=0, action='count')
+    p.add_argument('-s', '--subkey', default=False, action='store_true')
+    p.set_defaults(func=run_create)
+
+    p = subparsers.add_parser('unlock', help='Unlock the hardware device')
+    p.add_argument('-v', '--verbose', default=0, action='count')
+    p.set_defaults(func=run_unlock)
+
+    args = parser.parse_args()
+    return args.func(device_type=device_type, args=args)

libagent/gpg/agent.py

@@ -0,0 +1,209 @@
+"""GPG-agent utilities."""
+import binascii
+import logging
+
+from . import client, decode, keyring, protocol
+from .. import util
+
+log = logging.getLogger(__name__)
+
+
+def yield_connections(sock):
+    """Run a server on the specified socket."""
+    while True:
+        log.debug('waiting for connection on %s', sock.getsockname())
+        try:
+            conn, _ = sock.accept()
+        except KeyboardInterrupt:
+            return
+        conn.settimeout(None)
+        log.debug('accepted connection on %s', sock.getsockname())
+        yield conn
+
+
+def serialize(data):
+    """Serialize data according to ASSUAN protocol."""
+    for c in [b'%', b'\n', b'\r']:
+        escaped = '%{:02X}'.format(ord(c)).encode('ascii')
+        data = data.replace(c, escaped)
+    return data
+
+
+def sig_encode(r, s):
+    """Serialize ECDSA signature data into GPG S-expression."""
+    r = serialize(util.num2bytes(r, 32))
+    s = serialize(util.num2bytes(s, 32))
+    return b'(7:sig-val(5:ecdsa(1:r32:' + r + b')(1:s32:' + s + b')))'
+
+
+def _serialize_point(data):
+    prefix = '{}:'.format(len(data)).encode('ascii')
+    # https://www.gnupg.org/documentation/manuals/assuan/Server-responses.html
+    return b'(5:value' + serialize(prefix + data) + b')'
+
+
+def parse_ecdh(line):
+    """Parse ECDH request and return remote public key."""
+    prefix, line = line.split(b' ', 1)
+    assert prefix == b'D'
+    exp, leftover = keyring.parse(keyring.unescape(line))
+    log.debug('ECDH s-exp: %r', exp)
+    assert not leftover
+    label, exp = exp
+    assert label == b'enc-val'
+    assert exp[0] == b'ecdh'
+    items = exp[1:]
+    log.debug('ECDH parameters: %r', items)
+    return dict(items)[b'e']
+
+
+class AgentError(Exception):
+    """GnuPG agent-related error."""
+
+
+class AgentStop(Exception):
+    """Raised to close the agent."""
+
+
+class Handler(object):
+    """GPG agent requests' handler."""
+
+    def __init__(self, device):
+        """C-tor."""
+        self.client = client.Client(device=device)
+        # Cache ASSUAN commands' arguments between commands
+        self.keygrip = None
+        self.digest = None
+        self.algo = None
+        # Cache public keys from GnuPG
+        self.pubkey_bytes = keyring.export_public_keys()
+        # "Clone" existing GPG version
+        self.version = keyring.gpg_version()
+
+        self.handlers = {
+            b'RESET': None,
+            b'OPTION': None,
+            b'SETKEYDESC': None,
+            b'GETINFO': lambda conn, _: keyring.sendline(conn, b'D ' + self.version),
+            b'AGENT_ID': lambda conn, _: keyring.sendline(conn, b'D TREZOR'),  # "Fake" agent ID
+            b'SIGKEY': lambda _, args: self.set_key(*args),
+            b'SETKEY': lambda _, args: self.set_key(*args),
+            b'SETHASH': lambda _, args: self.set_hash(*args),
+            b'PKSIGN': lambda conn, _: self.pksign(conn),
+            b'PKDECRYPT': lambda conn, _: self.pkdecrypt(conn),
+            b'HAVEKEY': lambda _, args: self.have_key(*args),
+            b'KEYINFO': lambda conn, _: self.key_info(conn),
+            b'SCD': self.handle_scd,
+        }
+
+    def handle_scd(self, conn, args):
+        """No support for smart-card device protocol."""
+        reply = {
+            (b'GETINFO', b'version'): self.version,
+        }.get(args)
+        if reply is None:
+            raise AgentError(b'ERR 100696144 No such device <SCD>')
+        keyring.sendline(conn, b'D ' + reply)
+
+    @util.memoize
+    def get_identity(self, keygrip):
+        """
+        Returns device.interface.Identity that matches specified keygrip.
+
+        In case of missing keygrip, KeyError will be raised.
+        """
+        keygrip_bytes = binascii.unhexlify(keygrip)
+        pubkey_dict, user_ids = decode.load_by_keygrip(
+            pubkey_bytes=self.pubkey_bytes, keygrip=keygrip_bytes)
+        # We assume the first user ID is used to generate TREZOR-based GPG keys.
+        user_id = user_ids[0]['value'].decode('utf-8')
+        curve_name = protocol.get_curve_name_by_oid(pubkey_dict['curve_oid'])
+        ecdh = (pubkey_dict['algo'] == protocol.ECDH_ALGO_ID)
+
+        identity = client.create_identity(user_id=user_id, curve_name=curve_name)
+        verifying_key = self.client.pubkey(identity=identity, ecdh=ecdh)
+        pubkey = protocol.PublicKey(
+            curve_name=curve_name, created=pubkey_dict['created'],
+            verifying_key=verifying_key, ecdh=ecdh)
+        assert pubkey.key_id() == pubkey_dict['key_id']
+        assert pubkey.keygrip() == keygrip_bytes
+        return identity
+
+    def pksign(self, conn):
+        """Sign a message digest using a private EC key."""
+        log.debug('signing %r digest (algo #%s)', self.digest, self.algo)
+        identity = self.get_identity(keygrip=self.keygrip)
+        r, s = self.client.sign(identity=identity,
+                                digest=binascii.unhexlify(self.digest))
+        result = sig_encode(r, s)
+        log.debug('result: %r', result)
+        keyring.sendline(conn, b'D ' + result)
+
+    def pkdecrypt(self, conn):
+        """Handle decryption using ECDH."""
+        for msg in [b'S INQUIRE_MAXLEN 4096', b'INQUIRE CIPHERTEXT']:
+            keyring.sendline(conn, msg)
+
+        line = keyring.recvline(conn)
+        assert keyring.recvline(conn) == b'END'
+        remote_pubkey = parse_ecdh(line)
+
+        identity = self.get_identity(keygrip=self.keygrip)
+        ec_point = self.client.ecdh(identity=identity, pubkey=remote_pubkey)
+        keyring.sendline(conn, b'D ' + _serialize_point(ec_point))
+
+    @util.memoize
+    def have_key(self, *keygrips):
+        """Check if current keygrip correspond to a TREZOR-based key."""
+        try:
+            self.get_identity(keygrip=keygrips[0])
+        except KeyError as e:
+            log.warning('HAVEKEY(%s) failed: %s', keygrips, e)
+            raise AgentError(b'ERR 67108881 No secret key <GPG Agent>')
+
+    def key_info(self, conn):
+        """
+        Dummy reply (mainly for 'gpg --edit' to succeed).
+
+        For details, see GnuPG agent KEYINFO command help.
+        https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=agent/command.c;h=c8b34e9882076b1b724346787781f657cac75499;hb=refs/heads/master#l1082
+        """
+        fmt = 'S KEYINFO {0} X - - - - - - -'
+        keyring.sendline(conn, fmt.format(self.keygrip).encode('ascii'))
+
+    def set_key(self, keygrip):
+        """Set hexadecimal keygrip for next operation."""
+        self.keygrip = keygrip
+
+    def set_hash(self, algo, digest):
+        """Set algorithm ID and hexadecimal digest for next operation."""
+        self.algo = algo
+        self.digest = digest
+
+    def handle(self, conn):
+        """Handle connection from GPG binary using the ASSUAN protocol."""
+        keyring.sendline(conn, b'OK')
+        for line in keyring.iterlines(conn):
+            parts = line.split(b' ')
+            command = parts[0]
+            args = tuple(parts[1:])
+
+            if command == b'BYE':
+                return
+            elif command == b'KILLAGENT':
+                keyring.sendline(conn, b'OK')
+                raise AgentStop()
+
+            if command not in self.handlers:
+                log.error('unknown request: %r', line)
+                continue
+
+            handler = self.handlers[command]
+            if handler:
+                try:
+                    handler(conn, args)
+                except AgentError as e:
+                    msg, = e.args
+                    keyring.sendline(conn, msg)
+                    continue
+            keyring.sendline(conn, b'OK')

libagent/gpg/client.py

@@ -0,0 +1,48 @@
+"""Device abstraction layer for GPG operations."""
+
+import logging
+
+from .. import formats, util
+from ..device import interface
+
+log = logging.getLogger(__name__)
+
+
+def create_identity(user_id, curve_name):
+    """Create GPG identity for hardware device."""
+    result = interface.Identity(identity_str='gpg://', curve_name=curve_name)
+    result.identity_dict['host'] = user_id
+    return result
+
+
+class Client(object):
+    """Sign messages and get public keys from a hardware device."""
+
+    def __init__(self, device):
+        """C-tor."""
+        self.device = device
+
+    def pubkey(self, identity, ecdh=False):
+        """Return public key as VerifyingKey object."""
+        with self.device:
+            pubkey = self.device.pubkey(ecdh=ecdh, identity=identity)
+        return formats.decompress_pubkey(
+            pubkey=pubkey, curve_name=identity.curve_name)
+
+    def sign(self, identity, digest):
+        """Sign the digest and return a serialized signature."""
+        log.info('please confirm GPG signature on %s for "%s"...',
+                 self.device, identity)
+        if identity.curve_name == formats.CURVE_NIST256:
+            digest = digest[:32]  # sign the first 256 bits
+        log.debug('signing digest: %s', util.hexlify(digest))
+        with self.device:
+            sig = self.device.sign(blob=digest, identity=identity)
+        return (util.bytes2num(sig[:32]), util.bytes2num(sig[32:]))
+
+    def ecdh(self, identity, pubkey):
+        """Derive shared secret using ECDH from remote public key."""
+        log.info('please confirm GPG decryption on %s for "%s"...',
+                 self.device, identity)
+        with self.device:
+            return self.device.ecdh(pubkey=pubkey, identity=identity)

libagent/gpg/decode.py

@@ -0,0 +1,318 @@
+"""Decoders for GPG v2 data structures."""
+import base64
+import functools
+import hashlib
+import io
+import logging
+import struct
+
+import ecdsa
+import ed25519
+
+from . import protocol
+from .. import util
+
+log = logging.getLogger(__name__)
+
+
+def parse_subpackets(s):
+    """See https://tools.ietf.org/html/rfc4880#section-5.2.3.1 for details."""
+    subpackets = []
+    total_size = s.readfmt('>H')
+    data = s.read(total_size)
+    s = util.Reader(io.BytesIO(data))
+
+    while True:
+        try:
+            first = s.readfmt('B')
+        except EOFError:
+            break
+
+        if first < 192:
+            subpacket_len = first
+        elif first < 255:
+            subpacket_len = ((first - 192) << 8) + s.readfmt('B') + 192
+        else:  # first == 255
+            subpacket_len = s.readfmt('>L')
+
+        subpackets.append(s.read(subpacket_len))
+
+    return subpackets
+
+
+def parse_mpi(s):
+    """See https://tools.ietf.org/html/rfc4880#section-3.2 for details."""
+    bits = s.readfmt('>H')
+    blob = bytearray(s.read(int((bits + 7) // 8)))
+    return sum(v << (8 * i) for i, v in enumerate(reversed(blob)))
+
+
+def parse_mpis(s, n):
+    """Parse multiple MPIs from stream."""
+    return [parse_mpi(s) for _ in range(n)]
+
+
+def _parse_nist256p1_pubkey(mpi):
+    prefix, x, y = util.split_bits(mpi, 4, 256, 256)
+    if prefix != 4:
+        raise ValueError('Invalid MPI prefix: {}'.format(prefix))
+    point = ecdsa.ellipticcurve.Point(curve=ecdsa.NIST256p.curve,
+                                      x=x, y=y)
+    return ecdsa.VerifyingKey.from_public_point(
+        point=point, curve=ecdsa.curves.NIST256p,
+        hashfunc=hashlib.sha256)
+
+
+def _parse_ed25519_pubkey(mpi):
+    prefix, value = util.split_bits(mpi, 8, 256)
+    if prefix != 0x40:
+        raise ValueError('Invalid MPI prefix: {}'.format(prefix))
+    return ed25519.VerifyingKey(util.num2bytes(value, size=32))
+
+
+SUPPORTED_CURVES = {
+    b'\x2A\x86\x48\xCE\x3D\x03\x01\x07':
+        (_parse_nist256p1_pubkey, protocol.keygrip_nist256),
+    b'\x2B\x06\x01\x04\x01\xDA\x47\x0F\x01':
+        (_parse_ed25519_pubkey, protocol.keygrip_ed25519),
+    b'\x2B\x06\x01\x04\x01\x97\x55\x01\x05\x01':
+        (_parse_ed25519_pubkey, protocol.keygrip_curve25519),
+}
+
+RSA_ALGO_IDS = {1, 2, 3}
+ELGAMAL_ALGO_ID = 16
+DSA_ALGO_ID = 17
+ECDSA_ALGO_IDS = {18, 19, 22}  # {ecdsa, nist256, ed25519}
+
+
+def _parse_embedded_signatures(subpackets):
+    for packet in subpackets:
+        data = bytearray(packet)
+        if data[0] == 32:
+            # https://tools.ietf.org/html/rfc4880#section-5.2.3.26
+            stream = io.BytesIO(data[1:])
+            yield _parse_signature(util.Reader(stream))
+
+
+def has_custom_subpacket(signature_packet):
+    """Detect our custom public keys by matching subpacket data."""
+    return any(protocol.CUSTOM_KEY_LABEL == subpacket[1:]
+               for subpacket in signature_packet['unhashed_subpackets'])
+
+
+def _parse_signature(stream):
+    """See https://tools.ietf.org/html/rfc4880#section-5.2 for details."""
+    p = {'type': 'signature'}
+
+    to_hash = io.BytesIO()
+    with stream.capture(to_hash):
+        p['version'] = stream.readfmt('B')
+        p['sig_type'] = stream.readfmt('B')
+        p['pubkey_alg'] = stream.readfmt('B')
+        p['hash_alg'] = stream.readfmt('B')
+        p['hashed_subpackets'] = parse_subpackets(stream)
+
+    # https://tools.ietf.org/html/rfc4880#section-5.2.4
+    tail_to_hash = b'\x04\xff' + struct.pack('>L', to_hash.tell())
+
+    p['_to_hash'] = to_hash.getvalue() + tail_to_hash
+
+    p['unhashed_subpackets'] = parse_subpackets(stream)
+    embedded = list(_parse_embedded_signatures(p['unhashed_subpackets']))
+    if embedded:
+        log.debug('embedded sigs: %s', embedded)
+        p['embedded'] = embedded
+
+    p['hash_prefix'] = stream.readfmt('2s')
+    if p['pubkey_alg'] in ECDSA_ALGO_IDS:
+        p['sig'] = (parse_mpi(stream), parse_mpi(stream))
+    elif p['pubkey_alg'] in RSA_ALGO_IDS:  # RSA
+        p['sig'] = (parse_mpi(stream),)
+    elif p['pubkey_alg'] == DSA_ALGO_ID:
+        p['sig'] = (parse_mpi(stream), parse_mpi(stream))
+    else:
+        log.error('unsupported public key algo: %d', p['pubkey_alg'])
+
+    assert not stream.read()
+    return p
+
+
+def _parse_pubkey(stream, packet_type='pubkey'):
+    """See https://tools.ietf.org/html/rfc4880#section-5.5 for details."""
+    p = {'type': packet_type}
+    packet = io.BytesIO()
+    with stream.capture(packet):
+        p['version'] = stream.readfmt('B')
+        p['created'] = stream.readfmt('>L')
+        p['algo'] = stream.readfmt('B')
+        if p['algo'] in ECDSA_ALGO_IDS:
+            log.debug('parsing elliptic curve key')
+            # https://tools.ietf.org/html/rfc6637#section-11
+            oid_size = stream.readfmt('B')
+            oid = stream.read(oid_size)
+            assert oid in SUPPORTED_CURVES, util.hexlify(oid)
+            p['curve_oid'] = oid
+
+            mpi = parse_mpi(stream)
+            log.debug('mpi: %x (%d bits)', mpi, mpi.bit_length())
+            leftover = stream.read()
+            if leftover:
+                leftover = io.BytesIO(leftover)
+                # https://tools.ietf.org/html/rfc6637#section-8
+                # should be b'\x03\x01\x08\x07': SHA256 + AES128
+                size, = util.readfmt(leftover, 'B')
+                p['kdf'] = leftover.read(size)
+                p['secret'] = leftover.read()
+
+            parse_func, keygrip_func = SUPPORTED_CURVES[oid]
+            keygrip = keygrip_func(parse_func(mpi))
+            log.debug('keygrip: %s', util.hexlify(keygrip))
+            p['keygrip'] = keygrip
+
+        elif p['algo'] == DSA_ALGO_ID:
+            parse_mpis(stream, n=4)  # DSA keys are not supported
+        elif p['algo'] == ELGAMAL_ALGO_ID:
+            parse_mpis(stream, n=3)  # ElGamal keys are not supported
+        else:  # assume RSA
+            parse_mpis(stream, n=2)  # RSA keys are not supported
+        assert not stream.read()
+
+    # https://tools.ietf.org/html/rfc4880#section-12.2
+    packet_data = packet.getvalue()
+    data_to_hash = (b'\x99' + struct.pack('>H', len(packet_data)) +
+                    packet_data)
+    p['key_id'] = hashlib.sha1(data_to_hash).digest()[-8:]
+    p['_to_hash'] = data_to_hash
+    log.debug('key ID: %s', util.hexlify(p['key_id']))
+    return p
+
+_parse_subkey = functools.partial(_parse_pubkey, packet_type='subkey')
+
+
+def _parse_user_id(stream, packet_type='user_id'):
+    """See https://tools.ietf.org/html/rfc4880#section-5.11 for details."""
+    value = stream.read()
+    to_hash = b'\xb4' + util.prefix_len('>L', value)
+    return {'type': packet_type, 'value': value, '_to_hash': to_hash}
+
+# User attribute is handled as an opaque user ID
+_parse_attribute = functools.partial(_parse_user_id,
+                                     packet_type='user_attribute')
+
+PACKET_TYPES = {
+    2: _parse_signature,
+    5: _parse_pubkey,
+    6: _parse_pubkey,
+    7: _parse_subkey,
+    13: _parse_user_id,
+    14: _parse_subkey,
+    17: _parse_attribute,
+}
+
+
+def parse_packets(stream):
+    """
+    Support iterative parsing of available GPG packets.
+
+    See https://tools.ietf.org/html/rfc4880#section-4.2 for details.
+    """
+    reader = util.Reader(stream)
+    while True:
+        try:
+            value = reader.readfmt('B')
+        except EOFError:
+            return
+
+        log.debug('prefix byte: %s', bin(value))
+        assert util.bit(value, 7) == 1
+
+        tag = util.low_bits(value, 6)
+        if util.bit(value, 6) == 0:
+            length_type = util.low_bits(tag, 2)
+            tag = tag >> 2
+            fmt = {0: '>B', 1: '>H', 2: '>L'}[length_type]
+            packet_size = reader.readfmt(fmt)
+        else:
+            first = reader.readfmt('B')
+            if first < 192:
+                packet_size = first
+            elif first < 224:
+                packet_size = ((first - 192) << 8) + reader.readfmt('B') + 192
+            elif first == 255:
+                packet_size = reader.readfmt('>L')
+            else:
+                log.error('Partial Body Lengths unsupported')
+
+        log.debug('packet length: %d', packet_size)
+        packet_data = reader.read(packet_size)
+        packet_type = PACKET_TYPES.get(tag)
+
+        p = {'type': 'unknown', 'tag': tag, 'raw': packet_data}
+        if packet_type is not None:
+            try:
+                p = packet_type(util.Reader(io.BytesIO(packet_data)))
+                p['tag'] = tag
+            except ValueError:
+                log.exception('Skipping packet: %s', util.hexlify(packet_data))
+
+        log.debug('packet "%s": %s', p['type'], p)
+        yield p
+
+
+def digest_packets(packets, hasher):
+    """Compute digest on specified packets, according to '_to_hash' field."""
+    data_to_hash = io.BytesIO()
+    for p in packets:
+        data_to_hash.write(p['_to_hash'])
+    hasher.update(data_to_hash.getvalue())
+    return hasher.digest()
+
+
+HASH_ALGORITHMS = {
+    1: 'md5',
+    2: 'sha1',
+    3: 'ripemd160',
+    8: 'sha256',
+    9: 'sha384',
+    10: 'sha512',
+    11: 'sha224',
+}
+
+
+def load_by_keygrip(pubkey_bytes, keygrip):
+    """Return public key and first user ID for specified keygrip."""
+    stream = io.BytesIO(pubkey_bytes)
+    packets = list(parse_packets(stream))
+    packets_per_pubkey = []
+    for p in packets:
+        if p['type'] == 'pubkey':
+            # Add a new packet list for each pubkey.
+            packets_per_pubkey.append([])
+        packets_per_pubkey[-1].append(p)
+
+    for packets in packets_per_pubkey:
+        user_ids = [p for p in packets if p['type'] == 'user_id']
+        for p in packets:
+            if p.get('keygrip') == keygrip:
+                return p, user_ids
+    raise KeyError('{} keygrip not found'.format(util.hexlify(keygrip)))
+
+
+def load_signature(stream, original_data):
+    """Load signature from stream, and compute GPG digest for verification."""
+    signature, = list(parse_packets((stream)))
+    hash_alg = HASH_ALGORITHMS[signature['hash_alg']]
+    digest = digest_packets([{'_to_hash': original_data}, signature],
+                            hasher=hashlib.new(hash_alg))
+    assert signature['hash_prefix'] == digest[:2]
+    return signature, digest
+
+
+def remove_armor(armored_data):
+    """Decode armored data into its binary form."""
+    stream = io.BytesIO(armored_data)
+    lines = stream.readlines()[3:-1]
+    data = base64.b64decode(b''.join(lines))
+    payload, checksum = data[:-3], data[-3:]
+    assert util.crc24(payload) == checksum
+    return payload

libagent/gpg/encode.py

@@ -0,0 +1,101 @@
+"""Create GPG ECDSA signatures and public keys using TREZOR device."""
+import io
+import logging
+
+from . import decode, keyring, protocol
+from .. import util
+
+log = logging.getLogger(__name__)
+
+
+def create_primary(user_id, pubkey, signer_func, secret_bytes=b''):
+    """Export new primary GPG public key, ready for "gpg2 --import"."""
+    pubkey_packet = protocol.packet(tag=(5 if secret_bytes else 6),
+                                    blob=(pubkey.data() + secret_bytes))
+    user_id_bytes = user_id.encode('utf-8')
+    user_id_packet = protocol.packet(tag=13, blob=user_id_bytes)
+    data_to_sign = (pubkey.data_to_hash() + user_id_packet[:1] +
+                    util.prefix_len('>L', user_id_bytes))
+    hashed_subpackets = [
+        protocol.subpacket_time(pubkey.created),  # signature time
+        # https://tools.ietf.org/html/rfc4880#section-5.2.3.7
+        protocol.subpacket_byte(0x0B, 9),  # preferred symmetric algo (AES-256)
+        # https://tools.ietf.org/html/rfc4880#section-5.2.3.4
+        protocol.subpacket_byte(0x1B, 1 | 2),  # key flags (certify & sign)
+        # https://tools.ietf.org/html/rfc4880#section-5.2.3.21
+        protocol.subpacket_byte(0x15, 8),  # preferred hash (SHA256)
+        # https://tools.ietf.org/html/rfc4880#section-5.2.3.8
+        protocol.subpacket_byte(0x16, 0),  # preferred compression (none)
+        # https://tools.ietf.org/html/rfc4880#section-5.2.3.9
+        protocol.subpacket_byte(0x17, 0x80)  # key server prefs (no-modify)
+        # https://tools.ietf.org/html/rfc4880#section-5.2.3.17
+    ]
+    unhashed_subpackets = [
+        protocol.subpacket(16, pubkey.key_id()),  # issuer key id
+        protocol.CUSTOM_SUBPACKET]
+
+    signature = protocol.make_signature(
+        signer_func=signer_func,
+        public_algo=pubkey.algo_id,
+        data_to_sign=data_to_sign,
+        sig_type=0x13,  # user id & public key
+        hashed_subpackets=hashed_subpackets,
+        unhashed_subpackets=unhashed_subpackets)
+
+    sign_packet = protocol.packet(tag=2, blob=signature)
+    return pubkey_packet + user_id_packet + sign_packet
+
+
+def create_subkey(primary_bytes, subkey, signer_func, secret_bytes=b''):
+    """Export new subkey to GPG primary key."""
+    subkey_packet = protocol.packet(tag=(7 if secret_bytes else 14),
+                                    blob=(subkey.data() + secret_bytes))
+    packets = list(decode.parse_packets(io.BytesIO(primary_bytes)))
+    primary, user_id, signature = packets[:3]
+
+    data_to_sign = primary['_to_hash'] + subkey.data_to_hash()
+
+    if subkey.ecdh:
+        embedded_sig = None
+    else:
+        # Primary Key Binding Signature
+        hashed_subpackets = [
+            protocol.subpacket_time(subkey.created)]  # signature time
+        unhashed_subpackets = [
+            protocol.subpacket(16, subkey.key_id())]  # issuer key id
+        embedded_sig = protocol.make_signature(
+            signer_func=signer_func,
+            data_to_sign=data_to_sign,
+            public_algo=subkey.algo_id,
+            sig_type=0x19,
+            hashed_subpackets=hashed_subpackets,
+            unhashed_subpackets=unhashed_subpackets)
+
+    # Subkey Binding Signature
+
+    # Key flags: https://tools.ietf.org/html/rfc4880#section-5.2.3.21
+    # (certify & sign)                   (encrypt)
+    flags = (2) if (not subkey.ecdh) else (4 | 8)
+
+    hashed_subpackets = [
+        protocol.subpacket_time(subkey.created),  # signature time
+        protocol.subpacket_byte(0x1B, flags)]
+
+    unhashed_subpackets = []
+    unhashed_subpackets.append(protocol.subpacket(16, primary['key_id']))
+    if embedded_sig is not None:
+        unhashed_subpackets.append(protocol.subpacket(32, embedded_sig))
+    unhashed_subpackets.append(protocol.CUSTOM_SUBPACKET)
+
+    if not decode.has_custom_subpacket(signature):
+        signer_func = keyring.create_agent_signer(user_id['value'])
+
+    signature = protocol.make_signature(
+        signer_func=signer_func,
+        data_to_sign=data_to_sign,
+        public_algo=primary['algo'],
+        sig_type=0x18,
+        hashed_subpackets=hashed_subpackets,
+        unhashed_subpackets=unhashed_subpackets)
+    sign_packet = protocol.packet(tag=2, blob=signature)
+    return primary_bytes + subkey_packet + sign_packet

libagent/gpg/keyring.py

@@ -0,0 +1,229 @@
+"""Tools for doing signature using gpg-agent."""
+from __future__ import absolute_import, print_function, unicode_literals
+
+import binascii
+import io
+import logging
+import os
+import re
+import socket
+import subprocess
+
+from .. import util
+
+log = logging.getLogger(__name__)
+
+
+def get_agent_sock_path(sp=subprocess):
+    """Parse gpgconf output to find out GPG agent UNIX socket path."""
+    lines = sp.check_output(['gpgconf', '--list-dirs']).strip().split(b'\n')
+    dirs = dict(line.split(b':', 1) for line in lines)
+    return dirs[b'agent-socket']
+
+
+def connect_to_agent(sp=subprocess):
+    """Connect to GPG agent's UNIX socket."""
+    sock_path = get_agent_sock_path(sp=sp)
+    sp.check_call(['gpg-connect-agent', '/bye'])  # Make sure it's running
+    sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    sock.connect(sock_path)
+    return sock
+
+
+def communicate(sock, msg):
+    """Send a message and receive a single line."""
+    sendline(sock, msg.encode('ascii'))
+    return recvline(sock)
+
+
+def sendline(sock, msg):
+    """Send a binary message, followed by EOL."""
+    log.debug('<- %r', msg)
+    sock.sendall(msg + b'\n')
+
+
+def recvline(sock):
+    """Receive a single line from the socket."""
+    reply = io.BytesIO()
+
+    while True:
+        c = sock.recv(1)
+        if not c:
+            return None  # socket is closed
+
+        if c == b'\n':
+            break
+        reply.write(c)
+
+    result = reply.getvalue()
+    log.debug('-> %r', result)
+    return result
+
+
+def iterlines(conn):
+    """Iterate over input, split by lines."""
+    while True:
+        line = recvline(conn)
+        if line is None:
+            break
+        yield line
+
+
+def unescape(s):
+    """Unescape ASSUAN message (0xAB <-> '%AB')."""
+    s = bytearray(s)
+    i = 0
+    while i < len(s):
+        if s[i] == ord('%'):
+            hex_bytes = bytes(s[i+1:i+3])
+            value = int(hex_bytes.decode('ascii'), 16)
+            s[i:i+3] = [value]
+        i += 1
+    return bytes(s)
+
+
+def parse_term(s):
+    """Parse single s-expr term from bytes."""
+    size, s = s.split(b':', 1)
+    size = int(size)
+    return s[:size], s[size:]
+
+
+def parse(s):
+    """Parse full s-expr from bytes."""
+    if s.startswith(b'('):
+        s = s[1:]
+        name, s = parse_term(s)
+        values = [name]
+        while not s.startswith(b')'):
+            value, s = parse(s)
+            values.append(value)
+        return values, s[1:]
+    else:
+        return parse_term(s)
+
+
+def _parse_ecdsa_sig(args):
+    (r, sig_r), (s, sig_s) = args
+    assert r == b'r'
+    assert s == b's'
+    return (util.bytes2num(sig_r),
+            util.bytes2num(sig_s))
+
+# DSA and EDDSA happen to have the same structure as ECDSA signatures
+_parse_dsa_sig = _parse_ecdsa_sig
+_parse_eddsa_sig = _parse_ecdsa_sig
+
+
+def _parse_rsa_sig(args):
+    (s, sig_s), = args
+    assert s == b's'
+    return (util.bytes2num(sig_s),)
+
+
+def parse_sig(sig):
+    """Parse signature integer values from s-expr."""
+    label, sig = sig
+    assert label == b'sig-val'
+    algo_name = sig[0]
+    parser = {b'rsa': _parse_rsa_sig,
+              b'ecdsa': _parse_ecdsa_sig,
+              b'eddsa': _parse_eddsa_sig,
+              b'dsa': _parse_dsa_sig}[algo_name]
+    return parser(args=sig[1:])
+
+
+def sign_digest(sock, keygrip, digest, sp=subprocess, environ=None):
+    """Sign a digest using specified key using GPG agent."""
+    hash_algo = 8  # SHA256
+    assert len(digest) == 32
+
+    assert communicate(sock, 'RESET').startswith(b'OK')
+
+    ttyname = sp.check_output(['tty']).strip()
+    options = ['ttyname={}'.format(ttyname)]  # set TTY for passphrase entry
+
+    display = (environ or os.environ).get('DISPLAY')
+    if display is not None:
+        options.append('display={}'.format(display))
+
+    for opt in options:
+        assert communicate(sock, 'OPTION {}'.format(opt)) == b'OK'
+
+    assert communicate(sock, 'SIGKEY {}'.format(keygrip)) == b'OK'
+    hex_digest = binascii.hexlify(digest).upper().decode('ascii')
+    assert communicate(sock, 'SETHASH {} {}'.format(hash_algo,
+                                                    hex_digest)) == b'OK'
+
+    assert communicate(sock, 'SETKEYDESC '
+                       'Sign+a+new+TREZOR-based+subkey') == b'OK'
+    assert communicate(sock, 'PKSIGN') == b'OK'
+    while True:
+        line = recvline(sock).strip()
+        if line.startswith(b'S PROGRESS'):
+            continue
+        else:
+            break
+    line = unescape(line)
+    log.debug('unescaped: %r', line)
+    prefix, sig = line.split(b' ', 1)
+    if prefix != b'D':
+        raise ValueError(prefix)
+
+    sig, leftover = parse(sig)
+    assert not leftover, leftover
+    return parse_sig(sig)
+
+
+def gpg_command(args, env=None):
+    """Prepare common GPG command line arguments."""
+    if env is None:
+        env = os.environ
+    cmd = ['gpg2']
+    homedir = env.get('GNUPGHOME')
+    if homedir:
+        cmd.extend(['--homedir', homedir])
+    return cmd + args
+
+
+def get_keygrip(user_id, sp=subprocess):
+    """Get a keygrip of the primary GPG key of the specified user."""
+    args = gpg_command(['--list-keys', '--with-keygrip', user_id])
+    output = sp.check_output(args).decode('ascii')
+    return re.findall(r'Keygrip = (\w+)', output)[0]
+
+
+def gpg_version(sp=subprocess):
+    """Get a keygrip of the primary GPG key of the specified user."""
+    args = gpg_command(['--version'])
+    output = sp.check_output(args)
+    line = output.split(b'\n')[0]  # b'gpg (GnuPG) 2.1.11'
+    return line.split(b' ')[-1]  # b'2.1.11'
+
+
+def export_public_key(user_id, sp=subprocess):
+    """Export GPG public key for specified `user_id`."""
+    args = gpg_command(['--export', user_id])
+    result = sp.check_output(args=args)
+    if not result:
+        log.error('could not find public key %r in local GPG keyring', user_id)
+        raise KeyError(user_id)
+    return result
+
+
+def export_public_keys(sp=subprocess):
+    """Export all GPG public keys."""
+    args = gpg_command(['--export'])
+    return sp.check_output(args=args)
+
+
+def create_agent_signer(user_id):
+    """Sign digest with existing GPG keys using gpg-agent tool."""
+    sock = connect_to_agent()
+    keygrip = get_keygrip(user_id)
+
+    def sign(digest):
+        """Sign the digest and return an ECDSA/RSA/DSA signature."""
+        return sign_digest(sock=sock, keygrip=keygrip, digest=digest)
+
+    return sign

libagent/gpg/protocol.py

@@ -0,0 +1,271 @@
+"""GPG protocol utilities."""
+
+import base64
+import hashlib
+import logging
+import struct
+
+from .. import formats, util
+
+log = logging.getLogger(__name__)
+
+
+def packet(tag, blob):
+    """Create small GPG packet."""
+    assert len(blob) < 2**32
+
+    if len(blob) < 2**8:
+        length_type = 0
+    elif len(blob) < 2**16:
+        length_type = 1
+    else:
+        length_type = 2
+
+    fmt = ['>B', '>H', '>L'][length_type]
+    leading_byte = 0x80 | (tag << 2) | (length_type)
+    return struct.pack('>B', leading_byte) + util.prefix_len(fmt, blob)
+
+
+def subpacket(subpacket_type, fmt, *values):
+    """Create GPG subpacket."""
+    blob = struct.pack(fmt, *values) if values else fmt
+    return struct.pack('>B', subpacket_type) + blob
+
+
+def subpacket_long(subpacket_type, value):
+    """Create GPG subpacket with 32-bit unsigned integer."""
+    return subpacket(subpacket_type, '>L', value)
+
+
+def subpacket_time(value):
+    """Create GPG subpacket with time in seconds (since Epoch)."""
+    return subpacket_long(2, value)
+
+
+def subpacket_byte(subpacket_type, value):
+    """Create GPG subpacket with 8-bit unsigned integer."""
+    return subpacket(subpacket_type, '>B', value)
+
+
+def subpacket_prefix_len(item):
+    """Prefix subpacket length according to RFC 4880 section-5.2.3.1."""
+    n = len(item)
+    if n >= 8384:
+        prefix = b'\xFF' + struct.pack('>L', n)
+    elif n >= 192:
+        n = n - 192
+        prefix = struct.pack('BB', (n // 256) + 192, n % 256)
+    else:
+        prefix = struct.pack('B', n)
+    return prefix + item
+
+
+def subpackets(*items):
+    """Serialize several GPG subpackets."""
+    prefixed = [subpacket_prefix_len(item) for item in items]
+    return util.prefix_len('>H', b''.join(prefixed))
+
+
+def mpi(value):
+    """Serialize multipresicion integer using GPG format."""
+    bits = value.bit_length()
+    data_size = (bits + 7) // 8
+    data_bytes = bytearray(data_size)
+    for i in range(data_size):
+        data_bytes[i] = value & 0xFF
+        value = value >> 8
+
+    data_bytes.reverse()
+    return struct.pack('>H', bits) + bytes(data_bytes)
+
+
+def _serialize_nist256(vk):
+    return mpi((4 << 512) |
+               (vk.pubkey.point.x() << 256) |
+               (vk.pubkey.point.y()))
+
+
+def _serialize_ed25519(vk):
+    return mpi((0x40 << 256) |
+               util.bytes2num(vk.to_bytes()))
+
+
+def _compute_keygrip(params):
+    parts = []
+    for name, value in params:
+        exp = '{}:{}{}:'.format(len(name), name, len(value))
+        parts.append(b'(' + exp.encode('ascii') + value + b')')
+
+    return hashlib.sha1(b''.join(parts)).digest()
+
+
+def keygrip_nist256(vk):
+    """Compute keygrip for NIST256 curve public keys."""
+    curve = vk.curve.curve
+    gen = vk.curve.generator
+    g = (4 << 512) | (gen.x() << 256) | gen.y()
+    point = vk.pubkey.point
+    q = (4 << 512) | (point.x() << 256) | point.y()
+
+    return _compute_keygrip([
+        ['p', util.num2bytes(curve.p(), size=32)],
+        ['a', util.num2bytes(curve.a() % curve.p(), size=32)],
+        ['b', util.num2bytes(curve.b() % curve.p(), size=32)],
+        ['g', util.num2bytes(g, size=65)],
+        ['n', util.num2bytes(vk.curve.order, size=32)],
+        ['q', util.num2bytes(q, size=65)],
+    ])
+
+
+def keygrip_ed25519(vk):
+    """Compute keygrip for Ed25519 public keys."""
+    # pylint: disable=line-too-long
+    return _compute_keygrip([
+        ['p', util.num2bytes(0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFED, size=32)],  # nopep8
+        ['a', b'\x01'],
+        ['b', util.num2bytes(0x2DFC9311D490018C7338BF8688861767FF8FF5B2BEBE27548A14B235ECA6874A, size=32)],  # nopep8
+        ['g', util.num2bytes(0x04216936D3CD6E53FEC0A4E231FDD6DC5C692CC7609525A7B2C9562D608F25D51A6666666666666666666666666666666666666666666666666666666666666658, size=65)],  # nopep8
+        ['n', util.num2bytes(0x1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED, size=32)],  # nopep8
+        ['q', vk.to_bytes()],
+    ])
+
+
+def keygrip_curve25519(vk):
+    """Compute keygrip for Curve25519 public keys."""
+    # pylint: disable=line-too-long
+    return _compute_keygrip([
+        ['p', util.num2bytes(0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFED, size=32)],  # nopep8
+        ['a', b'\x01\xDB\x41'],
+        ['b', b'\x01'],
+        ['g', util.num2bytes(0x04000000000000000000000000000000000000000000000000000000000000000920ae19a1b8a086b4e01edd2c7748d14c923d4d7e6d7c61b229e9c5a27eced3d9, size=65)],  # nopep8
+        ['n', util.num2bytes(0x1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED, size=32)],  # nopep8
+        ['q', vk.to_bytes()],
+    ])
+
+
+SUPPORTED_CURVES = {
+    formats.CURVE_NIST256: {
+        # https://tools.ietf.org/html/rfc6637#section-11
+        'oid': b'\x2A\x86\x48\xCE\x3D\x03\x01\x07',
+        'algo_id': 19,
+        'serialize': _serialize_nist256,
+        'keygrip': keygrip_nist256,
+    },
+    formats.CURVE_ED25519: {
+        'oid': b'\x2B\x06\x01\x04\x01\xDA\x47\x0F\x01',
+        'algo_id': 22,
+        'serialize': _serialize_ed25519,
+        'keygrip': keygrip_ed25519,
+    },
+    formats.ECDH_CURVE25519: {
+        'oid': b'\x2B\x06\x01\x04\x01\x97\x55\x01\x05\x01',
+        'algo_id': 18,
+        'serialize': _serialize_ed25519,
+        'keygrip': keygrip_curve25519,
+    },
+}
+
+ECDH_ALGO_ID = 18
+
+CUSTOM_KEY_LABEL = b'TREZOR-GPG'  # marks "our" pubkey
+CUSTOM_SUBPACKET_ID = 26  # use "policy URL" subpacket
+CUSTOM_SUBPACKET = subpacket(CUSTOM_SUBPACKET_ID, CUSTOM_KEY_LABEL)
+
+
+def get_curve_name_by_oid(oid):
+    """Return curve name matching specified OID, or raise KeyError."""
+    for curve_name, info in SUPPORTED_CURVES.items():
+        if info['oid'] == oid:
+            return curve_name
+    raise KeyError('Unknown OID: {!r}'.format(oid))
+
+
+class PublicKey(object):
+    """GPG representation for public key packets."""
+
+    def __init__(self, curve_name, created, verifying_key, ecdh=False):
+        """Contruct using a ECDSA VerifyingKey object."""
+        self.curve_name = curve_name
+        self.curve_info = SUPPORTED_CURVES[curve_name]
+        self.created = int(created)  # time since Epoch
+        self.verifying_key = verifying_key
+        self.ecdh = bool(ecdh)
+        if ecdh:
+            self.algo_id = ECDH_ALGO_ID
+            self.ecdh_packet = b'\x03\x01\x08\x07'
+        else:
+            self.algo_id = self.curve_info['algo_id']
+            self.ecdh_packet = b''
+
+    def keygrip(self):
+        """Compute GPG keygrip of the verifying key."""
+        return self.curve_info['keygrip'](self.verifying_key)
+
+    def data(self):
+        """Data for packet creation."""
+        header = struct.pack('>BLB',
+                             4,             # version
+                             self.created,  # creation
+                             self.algo_id)  # public key algorithm ID
+        oid = util.prefix_len('>B', self.curve_info['oid'])
+        blob = self.curve_info['serialize'](self.verifying_key)
+        return header + oid + blob + self.ecdh_packet
+
+    def data_to_hash(self):
+        """Data for digest computation."""
+        return b'\x99' + util.prefix_len('>H', self.data())
+
+    def _fingerprint(self):
+        return hashlib.sha1(self.data_to_hash()).digest()
+
+    def key_id(self):
+        """Short (8 byte) GPG key ID."""
+        return self._fingerprint()[-8:]
+
+    def __repr__(self):
+        """Short (8 hexadecimal digits) GPG key ID."""
+        hex_key_id = util.hexlify(self.key_id())[-8:]
+        return 'GPG public key {}/{}'.format(self.curve_name, hex_key_id)
+
+    __str__ = __repr__
+
+
+def _split_lines(body, size):
+    lines = []
+    for i in range(0, len(body), size):
+        lines.append(body[i:i+size] + '\n')
+    return ''.join(lines)
+
+
+def armor(blob, type_str):
+    """See https://tools.ietf.org/html/rfc4880#section-6 for details."""
+    head = '-----BEGIN PGP {}-----\nVersion: GnuPG v2\n\n'.format(type_str)
+    body = base64.b64encode(blob).decode('ascii')
+    checksum = base64.b64encode(util.crc24(blob)).decode('ascii')
+    tail = '-----END PGP {}-----\n'.format(type_str)
+    return head + _split_lines(body, 64) + '=' + checksum + '\n' + tail
+
+
+def make_signature(signer_func, data_to_sign, public_algo,
+                   hashed_subpackets, unhashed_subpackets, sig_type=0):
+    """Create new GPG signature."""
+    # pylint: disable=too-many-arguments
+    header = struct.pack('>BBBB',
+                         4,         # version
+                         sig_type,  # rfc4880 (section-5.2.1)
+                         public_algo,
+                         8)         # hash_alg (SHA256)
+    hashed = subpackets(*hashed_subpackets)
+    unhashed = subpackets(*unhashed_subpackets)
+    tail = b'\x04\xff' + struct.pack('>L', len(header) + len(hashed))
+    data_to_hash = data_to_sign + header + hashed + tail
+
+    log.debug('hashing %d bytes', len(data_to_hash))
+    digest = hashlib.sha256(data_to_hash).digest()
+    log.debug('signing digest: %s', util.hexlify(digest))
+    params = signer_func(digest=digest)
+    sig = b''.join(mpi(p) for p in params)
+
+    return bytes(header + hashed + unhashed +
+                 digest[:2] +  # used for decoder's sanity check
+                 sig)  # actual ECDSA signature

libagent/gpg/tests/__init__.py

@@ -0,0 +1 @@
+"""Tests for GPG module."""

libagent/gpg/tests/test_decode.py

@@ -0,0 +1,62 @@
+import glob
+import io
+import os
+
+import pytest
+
+from .. import decode, protocol
+from ... import util
+
+
+def test_subpackets():
+    s = io.BytesIO(b'\x00\x05\x02\xAB\xCD\x01\xEF')
+    assert decode.parse_subpackets(util.Reader(s)) == [b'\xAB\xCD', b'\xEF']
+
+
+def test_subpackets_prefix():
+    for n in [0, 1, 2, 4, 5, 10, 191, 192, 193,
+              255, 256, 257, 8383, 8384, 65530]:
+        item = b'?' * n  # create dummy subpacket
+        prefixed = protocol.subpackets(item)
+        result = decode.parse_subpackets(util.Reader(io.BytesIO(prefixed)))
+        assert [item] == result
+
+
+def test_mpi():
+    s = io.BytesIO(b'\x00\x09\x01\x23')
+    assert decode.parse_mpi(util.Reader(s)) == 0x123
+
+    s = io.BytesIO(b'\x00\x09\x01\x23\x00\x03\x05')
+    assert decode.parse_mpis(util.Reader(s), n=2) == [0x123, 5]
+
+
+cwd = os.path.join(os.path.dirname(__file__))
+input_files = glob.glob(os.path.join(cwd, '*.gpg'))
+
+
+@pytest.fixture(params=input_files)
+def public_key_path(request):
+    return request.param
+
+
+def test_gpg_files(public_key_path):  # pylint: disable=redefined-outer-name
+    with open(public_key_path, 'rb') as f:
+        assert list(decode.parse_packets(f))
+
+
+def test_has_custom_subpacket():
+    sig = {'unhashed_subpackets': []}
+    assert not decode.has_custom_subpacket(sig)
+
+    custom_markers = [
+        protocol.CUSTOM_SUBPACKET,
+        protocol.subpacket(10, protocol.CUSTOM_KEY_LABEL),
+    ]
+    for marker in custom_markers:
+        sig = {'unhashed_subpackets': [marker]}
+        assert decode.has_custom_subpacket(sig)
+
+
+def test_load_by_keygrip_missing():
+    with pytest.raises(KeyError):
+        decode.load_by_keygrip(pubkey_bytes=b'', keygrip=b'')

libagent/gpg/tests/test_keyring.py

@@ -0,0 +1,101 @@
+import io
+
+import mock
+
+from .. import keyring
+
+
+def test_unescape_short():
+    assert keyring.unescape(b'abc%0AX%0D %25;.-+()') == b'abc\nX\r %;.-+()'
+
+
+def test_unescape_long():
+    escaped = (b'D (7:sig-val(3:dsa(1:r32:\x1d\x15.\x12\xe8h\x19\xd9O\xeb\x06'
+               b'yD?a:/\xae\xdb\xac\x93\xa6\x86\xcbs\xb8\x03\xf1\xcb\x89\xc7'
+               b'\x1f)(1:s32:%25\xb5\x04\x94\xc7\xc4X\xc7\xe0%0D\x08\xbb%0DuN'
+               b'\x9c6}[\xc2=t\x8c\xfdD\x81\xe8\xdd\x86=\xe2\xa9)))')
+    unescaped = (b'D (7:sig-val(3:dsa(1:r32:\x1d\x15.\x12\xe8h\x19\xd9O\xeb'
+                 b'\x06yD?a:/\xae\xdb\xac\x93\xa6\x86\xcbs\xb8\x03\xf1\xcb\x89'
+                 b'\xc7\x1f)(1:s32:%\xb5\x04\x94\xc7\xc4X\xc7\xe0\r\x08\xbb\ru'
+                 b'N\x9c6}[\xc2=t\x8c\xfdD\x81\xe8\xdd\x86=\xe2\xa9)))')
+    assert keyring.unescape(escaped) == unescaped
+
+
+def test_parse_term():
+    assert keyring.parse(b'4:abcdXXX') == (b'abcd', b'XXX')
+
+
+def test_parse_ecdsa():
+    sig, rest = keyring.parse(b'(7:sig-val(5:ecdsa'
+                              b'(1:r2:\x01\x02)(1:s2:\x03\x04)))')
+    values = [[b'r', b'\x01\x02'], [b's', b'\x03\x04']]
+    assert sig == [b'sig-val', [b'ecdsa'] + values]
+    assert rest == b''
+    assert keyring.parse_sig(sig) == (0x102, 0x304)
+
+
+def test_parse_rsa():
+    sig, rest = keyring.parse(b'(7:sig-val(3:rsa(1:s4:\x01\x02\x03\x04)))')
+    assert sig == [b'sig-val', [b'rsa', [b's', b'\x01\x02\x03\x04']]]
+    assert rest == b''
+    assert keyring.parse_sig(sig) == (0x1020304,)
+
+
+class FakeSocket(object):
+    def __init__(self):
+        self.rx = io.BytesIO()
+        self.tx = io.BytesIO()
+
+    def recv(self, n):
+        return self.rx.read(n)
+
+    def sendall(self, data):
+        self.tx.write(data)
+
+
+def test_sign_digest():
+    sock = FakeSocket()
+    sock.rx.write(b'OK Pleased to meet you, process XYZ\n')
+    sock.rx.write(b'OK\n' * 6)
+    sock.rx.write(b'D (7:sig-val(3:rsa(1:s16:0123456789ABCDEF)))\n')
+    sock.rx.seek(0)
+    keygrip = '1234'
+    digest = b'A' * 32
+    sp = mock.Mock(spec=['check_output'])
+    sp.check_output.return_value = '/dev/pts/0'
+    sig = keyring.sign_digest(sock=sock, keygrip=keygrip,
+                              digest=digest, sp=sp,
+                              environ={'DISPLAY': ':0'})
+    assert sig == (0x30313233343536373839414243444546,)
+    assert sock.tx.getvalue() == b'''RESET
+OPTION ttyname=/dev/pts/0
+OPTION display=:0
+SIGKEY 1234
+SETHASH 8 4141414141414141414141414141414141414141414141414141414141414141
+SETKEYDESC Sign+a+new+TREZOR-based+subkey
+PKSIGN
+'''
+
+
+def test_iterlines():
+    sock = FakeSocket()
+    sock.rx.write(b'foo\nbar\nxyz')
+    sock.rx.seek(0)
+    assert list(keyring.iterlines(sock)) == [b'foo', b'bar']
+
+
+def test_get_agent_sock_path():
+    sp = mock.Mock(spec=['check_output'])
+    sp.check_output.return_value = b'''sysconfdir:/usr/local/etc/gnupg
+bindir:/usr/local/bin
+libexecdir:/usr/local/libexec
+libdir:/usr/local/lib/gnupg
+datadir:/usr/local/share/gnupg
+localedir:/usr/local/share/locale
+dirmngr-socket:/run/user/1000/gnupg/S.dirmngr
+agent-ssh-socket:/run/user/1000/gnupg/S.gpg-agent.ssh
+agent-socket:/run/user/1000/gnupg/S.gpg-agent
+homedir:/home/roman/.gnupg
+'''
+    expected = b'/run/user/1000/gnupg/S.gpg-agent'
+    assert keyring.get_agent_sock_path(sp=sp) == expected

libagent/gpg/tests/test_protocol.py

@@ -0,0 +1,107 @@
+import ecdsa
+import ed25519
+import pytest
+
+from .. import protocol
+from ... import formats
+
+
+def test_packet():
+    assert protocol.packet(1, b'') == b'\x84\x00'
+    assert protocol.packet(2, b'A') == b'\x88\x01A'
+    blob = b'B' * 0xAB
+    assert protocol.packet(3, blob) == b'\x8c\xAB' + blob
+    blob = b'C' * 0x1234
+    assert protocol.packet(3, blob) == b'\x8d\x12\x34' + blob
+    blob = b'D' * 0x12345678
+    assert protocol.packet(4, blob) == b'\x92\x12\x34\x56\x78' + blob
+
+
+def test_subpackets():
+    assert protocol.subpacket(1, b'') == b'\x01'
+    assert protocol.subpacket(2, '>H', 0x0304) == b'\x02\x03\x04'
+    assert protocol.subpacket_long(9, 0x12345678) == b'\x09\x12\x34\x56\x78'
+    assert protocol.subpacket_time(0x12345678) == b'\x02\x12\x34\x56\x78'
+    assert protocol.subpacket_byte(0xAB, 0xCD) == b'\xAB\xCD'
+    assert protocol.subpackets() == b'\x00\x00'
+    assert protocol.subpackets(b'ABC', b'12345') == b'\x00\x0A\x03ABC\x0512345'
+
+
+def test_mpi():
+    assert protocol.mpi(0x123) == b'\x00\x09\x01\x23'
+
+
+def test_armor():
+    data = bytearray(range(256))
+    assert protocol.armor(data, 'TEST') == '''-----BEGIN PGP TEST-----
+Version: GnuPG v2
+
+AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4v
+MDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5f
+YGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn+AgYKDhIWGh4iJiouMjY6P
+kJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/
+wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v
+8PHy8/T19vf4+fr7/P3+/w==
+=W700
+-----END PGP TEST-----
+'''
+
+
+def test_make_signature():
+    def signer_func(digest):
+        assert digest == (b'\xd0\xe5]|\x8bP\xe6\x91\xb3\xe8+\xf4A\xf0`(\xb1'
+                          b'\xc7\xf4;\x86\x97s\xdb\x9a\xda\xee< \xcb\x9e\x00')
+        return (7, 8)
+
+    sig = protocol.make_signature(
+        signer_func=signer_func,
+        data_to_sign=b'Hello World!',
+        public_algo=22,
+        hashed_subpackets=[protocol.subpacket_time(1)],
+        unhashed_subpackets=[],
+        sig_type=25)
+    assert sig == (b'\x04\x19\x16\x08\x00\x06\x05\x02'
+                   b'\x00\x00\x00\x01\x00\x00\xd0\xe5\x00\x03\x07\x00\x04\x08')
+
+
+def test_nist256p1():
+    sk = ecdsa.SigningKey.from_secret_exponent(secexp=1, curve=ecdsa.NIST256p)
+    vk = sk.get_verifying_key()
+    pk = protocol.PublicKey(curve_name=formats.CURVE_NIST256,
+                            created=42, verifying_key=vk)
+    assert repr(pk) == 'GPG public key nist256p1/F82361D9'
+    assert pk.keygrip() == b'\x95\x85.\x91\x7f\xe2\xc3\x91R\xba\x99\x81\x92\xb5y\x1d\xb1\\\xdc\xf0'
+
+
+def test_nist256p1_ecdh():
+    sk = ecdsa.SigningKey.from_secret_exponent(secexp=1, curve=ecdsa.NIST256p)
+    vk = sk.get_verifying_key()
+    pk = protocol.PublicKey(curve_name=formats.CURVE_NIST256,
+                            created=42, verifying_key=vk, ecdh=True)
+    assert repr(pk) == 'GPG public key nist256p1/5811DF46'
+    assert pk.keygrip() == b'\x95\x85.\x91\x7f\xe2\xc3\x91R\xba\x99\x81\x92\xb5y\x1d\xb1\\\xdc\xf0'
+
+
+def test_ed25519():
+    sk = ed25519.SigningKey(b'\x00' * 32)
+    vk = sk.get_verifying_key()
+    pk = protocol.PublicKey(curve_name=formats.CURVE_ED25519,
+                            created=42, verifying_key=vk)
+    assert repr(pk) == 'GPG public key ed25519/36B40FE6'
+    assert pk.keygrip() == b'\xbf\x01\x90l\x17\xb64\xa3-\xf4\xc0gr\x99\x18<\xddBQ?'
+
+
+def test_curve25519():
+    sk = ed25519.SigningKey(b'\x00' * 32)
+    vk = sk.get_verifying_key()
+    pk = protocol.PublicKey(curve_name=formats.ECDH_CURVE25519,
+                            created=42, verifying_key=vk)
+    assert repr(pk) == 'GPG public key curve25519/69460384'
+    assert pk.keygrip() == b'x\xd6\x86\xe4\xa6\xfc;\x0fY\xe1}Lw\xc4\x9ed\xf1Q\x8a\x00'
+
+
+def test_get_curve_name_by_oid():
+    for name, info in protocol.SUPPORTED_CURVES.items():
+        assert protocol.get_curve_name_by_oid(info['oid']) == name
+    with pytest.raises(KeyError):
+        protocol.get_curve_name_by_oid('BAD_OID')

libagent/server.py

@@ -0,0 +1,129 @@
+"""UNIX-domain socket server for ssh-agent implementation."""
+import contextlib
+import logging
+import os
+import socket
+import subprocess
+import threading
+
+from . import util
+
+log = logging.getLogger(__name__)
+
+
+def remove_file(path, remove=os.remove, exists=os.path.exists):
+    """Remove file, and raise OSError if still exists."""
+    try:
+        remove(path)
+    except OSError:
+        if exists(path):
+            raise
+
+
+@contextlib.contextmanager
+def unix_domain_socket_server(sock_path):
+    """
+    Create UNIX-domain socket on specified path.
+
+    Listen on it, and delete it after the generated context is over.
+    """
+    log.debug('serving on %s', sock_path)
+    remove_file(sock_path)
+
+    server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    server.bind(sock_path)
+    server.listen(1)
+    try:
+        yield server
+    finally:
+        remove_file(sock_path)
+
+
+def handle_connection(conn, handler, mutex):
+    """
+    Handle a single connection using the specified protocol handler in a loop.
+
+    Since this function may be called concurrently from server_thread,
+    the specified mutex is used to synchronize the device handling.
+
+    Exit when EOFError is raised.
+    All other exceptions are logged as warnings.
+    """
+    try:
+        log.debug('welcome agent')
+        with contextlib.closing(conn):
+            while True:
+                msg = util.read_frame(conn)
+                with mutex:
+                    reply = handler.handle(msg=msg)
+                util.send(conn, reply)
+    except EOFError:
+        log.debug('goodbye agent')
+    except Exception as e:  # pylint: disable=broad-except
+        log.warning('error: %s', e, exc_info=True)
+
+
+def retry(func, exception_type, quit_event):
+    """
+    Run the function, retrying when the specified exception_type occurs.
+
+    Poll quit_event on each iteration, to be responsive to an external
+    exit request.
+    """
+    while True:
+        if quit_event.is_set():
+            raise StopIteration
+        try:
+            return func()
+        except exception_type:
+            pass
+
+
+def server_thread(sock, handle_conn, quit_event):
+    """Run a server on the specified socket."""
+    log.debug('server thread started')
+
+    def accept_connection():
+        conn, _ = sock.accept()
+        conn.settimeout(None)
+        return conn
+
+    while True:
+        log.debug('waiting for connection on %s', sock.getsockname())
+        try:
+            conn = retry(accept_connection, socket.timeout, quit_event)
+        except StopIteration:
+            log.debug('server stopped')
+            break
+        # Handle connections from SSH concurrently.
+        threading.Thread(target=handle_conn,
+                         kwargs=dict(conn=conn)).start()
+    log.debug('server thread stopped')
+
+
+@contextlib.contextmanager
+def spawn(func, kwargs):
+    """Spawn a thread, and join it after the context is over."""
+    t = threading.Thread(target=func, kwargs=kwargs)
+    t.start()
+    yield
+    t.join()
+
+
+def run_process(command, environ):
+    """
+    Run the specified process and wait until it finishes.
+
+    Use environ dict for environment variables.
+    """
+    log.info('running %r with %r', command, environ)
+    env = dict(os.environ)
+    env.update(environ)
+    try:
+        p = subprocess.Popen(args=command, env=env)
+    except OSError as e:
+        raise OSError('cannot run %r: %s' % (command, e))
+    log.debug('subprocess %d is running', p.pid)
+    ret = p.wait()
+    log.debug('subprocess %d exited: %d', p.pid, ret)
+    return ret

libagent/ssh/__init__.py

@@ -0,0 +1,222 @@
+"""SSH-agent implementation using hardware authentication devices."""
+import argparse
+import contextlib
+import functools
+import io
+import logging
+import os
+import re
+import subprocess
+import sys
+import tempfile
+import threading
+
+
+from .. import device, formats, server, util
+from . import client, protocol
+
+log = logging.getLogger(__name__)
+
+UNIX_SOCKET_TIMEOUT = 0.1
+
+
+def ssh_args(label):
+    """Create SSH command for connecting specified server."""
+    identity = device.interface.string_to_identity(label)
+
+    args = []
+    if 'port' in identity:
+        args += ['-p', identity['port']]
+    if 'user' in identity:
+        args += ['-l', identity['user']]
+
+    return args + [identity['host']]
+
+
+def mosh_args(label):
+    """Create SSH command for connecting specified server."""
+    identity = device.interface.string_to_identity(label)
+
+    args = []
+    if 'port' in identity:
+        args += ['-p', identity['port']]
+    if 'user' in identity:
+        args += [identity['user']+'@'+identity['host']]
+    else:
+        args += [identity['host']]
+
+    return args
+
+
+def create_agent_parser():
+    """Create an ArgumentParser for this tool."""
+    p = argparse.ArgumentParser()
+    p.add_argument('-v', '--verbose', default=0, action='count')
+
+    curve_names = [name for name in formats.SUPPORTED_CURVES]
+    curve_names = ', '.join(sorted(curve_names))
+    p.add_argument('-e', '--ecdsa-curve-name', metavar='CURVE',
+                   default=formats.CURVE_NIST256,
+                   help='specify ECDSA curve name: ' + curve_names)
+    p.add_argument('--timeout',
+                   default=UNIX_SOCKET_TIMEOUT, type=float,
+                   help='Timeout for accepting SSH client connections')
+    p.add_argument('--debug', default=False, action='store_true',
+                   help='Log SSH protocol messages for debugging.')
+
+    g = p.add_mutually_exclusive_group()
+    g.add_argument('-s', '--shell', default=False, action='store_true',
+                   help='run ${SHELL} as subprocess under SSH agent')
+    g.add_argument('-c', '--connect', default=False, action='store_true',
+                   help='connect to specified host via SSH')
+    g.add_argument('--mosh', default=False, action='store_true',
+                   help='connect to specified host via using Mosh')
+
+    p.add_argument('identity', type=str, default=None,
+                   help='proto://[user@]host[:port][/path]')
+    p.add_argument('command', type=str, nargs='*', metavar='ARGUMENT',
+                   help='command to run under the SSH agent')
+    return p
+
+
+@contextlib.contextmanager
+def serve(handler, sock_path=None, timeout=UNIX_SOCKET_TIMEOUT):
+    """
+    Start the ssh-agent server on a UNIX-domain socket.
+
+    If no connection is made during the specified timeout,
+    retry until the context is over.
+    """
+    ssh_version = subprocess.check_output(['ssh', '-V'],
+                                          stderr=subprocess.STDOUT)
+    log.debug('local SSH version: %r', ssh_version)
+    if sock_path is None:
+        sock_path = tempfile.mktemp(prefix='trezor-ssh-agent-')
+
+    environ = {'SSH_AUTH_SOCK': sock_path, 'SSH_AGENT_PID': str(os.getpid())}
+    device_mutex = threading.Lock()
+    with server.unix_domain_socket_server(sock_path) as sock:
+        sock.settimeout(timeout)
+        quit_event = threading.Event()
+        handle_conn = functools.partial(server.handle_connection,
+                                        handler=handler,
+                                        mutex=device_mutex)
+        kwargs = dict(sock=sock,
+                      handle_conn=handle_conn,
+                      quit_event=quit_event)
+        with server.spawn(server.server_thread, kwargs):
+            try:
+                yield environ
+            finally:
+                log.debug('closing server')
+                quit_event.set()
+
+
+def run_server(conn, command, debug, timeout):
+    """Common code for run_agent and run_git below."""
+    try:
+        handler = protocol.Handler(conn=conn, debug=debug)
+        with serve(handler=handler, timeout=timeout) as env:
+            return server.run_process(command=command, environ=env)
+    except KeyboardInterrupt:
+        log.info('server stopped')
+
+
+def handle_connection_error(func):
+    """Fail with non-zero exit code."""
+    @functools.wraps(func)
+    def wrapper(*args, **kwargs):
+        try:
+            return func(*args, **kwargs)
+        except IOError as e:
+            log.error('Connection error (try unplugging and replugging your device): %s', e)
+            return 1
+    return wrapper
+
+
+def parse_config(contents):
+    """Parse config file into a list of Identity objects."""
+    for identity_str, curve_name in re.findall(r'\<(.*?)\|(.*?)\>', contents):
+        yield device.interface.Identity(identity_str=identity_str,
+                                        curve_name=curve_name)
+
+
+def import_public_keys(contents):
+    """Load (previously exported) SSH public keys from a file's contents."""
+    for line in io.StringIO(contents):
+        # Verify this line represents valid SSH public key
+        formats.import_public_key(line)
+        yield line
+
+
+class JustInTimeConnection(object):
+    """Connect to the device just before the needed operation."""
+
+    def __init__(self, conn_factory, identities, public_keys=None):
+        """Create a JIT connection object."""
+        self.conn_factory = conn_factory
+        self.identities = identities
+        self.public_keys_cache = public_keys
+
+    def public_keys(self):
+        """Return a list of SSH public keys (in textual format)."""
+        if not self.public_keys_cache:
+            conn = self.conn_factory()
+            self.public_keys_cache = conn.export_public_keys(self.identities)
+        return self.public_keys_cache
+
+    def parse_public_keys(self):
+        """Parse SSH public keys into dictionaries."""
+        public_keys = [formats.import_public_key(pk)
+                       for pk in self.public_keys()]
+        for pk, identity in zip(public_keys, self.identities):
+            pk['identity'] = identity
+        return public_keys
+
+    def sign(self, blob, identity):
+        """Sign a given blob using the specified identity on the device."""
+        conn = self.conn_factory()
+        return conn.sign_ssh_challenge(blob=blob, identity=identity)
+
+
+@handle_connection_error
+def main(device_type):
+    """Run ssh-agent using given hardware client factory."""
+    args = create_agent_parser().parse_args()
+    util.setup_logging(verbosity=args.verbose)
+
+    public_keys = None
+    if args.identity.startswith('/'):
+        filename = args.identity
+        contents = open(filename, 'rb').read().decode('utf-8')
+        # Allow loading previously exported SSH public keys
+        if filename.endswith('.pub'):
+            public_keys = list(import_public_keys(contents))
+        identities = list(parse_config(contents))
+    else:
+        identities = [device.interface.Identity(
+            identity_str=args.identity, curve_name=args.ecdsa_curve_name)]
+    for index, identity in enumerate(identities):
+        identity.identity_dict['proto'] = 'ssh'
+        log.info('identity #%d: %s', index, identity)
+
+    if args.connect:
+        command = ['ssh'] + ssh_args(args.identity) + args.command
+    elif args.mosh:
+        command = ['mosh'] + mosh_args(args.identity) + args.command
+    else:
+        command = args.command
+
+    use_shell = bool(args.shell)
+    if use_shell:
+        command = os.environ['SHELL']
+
+    conn = JustInTimeConnection(
+        conn_factory=lambda: client.Client(device_type()),
+        identities=identities, public_keys=public_keys)
+    if command:
+        return run_server(conn=conn, command=command, debug=args.debug,
+                          timeout=args.timeout)
+    else:
+        for pk in conn.public_keys():
+            sys.stdout.write(pk)

libagent/ssh/client.py

@@ -0,0 +1,64 @@
+"""
+Connection to hardware authentication device.
+
+It is used for getting SSH public keys and ECDSA signing of server requests.
+"""
+import io
+import logging
+
+from . import formats, util
+
+log = logging.getLogger(__name__)
+
+
+class Client(object):
+    """Client wrapper for SSH authentication device."""
+
+    def __init__(self, device):
+        """Connect to hardware device."""
+        self.device = device
+
+    def export_public_keys(self, identities):
+        """Export SSH public keys from the device."""
+        public_keys = []
+        with self.device:
+            for i in identities:
+                pubkey = self.device.pubkey(identity=i)
+                vk = formats.decompress_pubkey(pubkey=pubkey,
+                                               curve_name=i.curve_name)
+                public_keys.append(formats.export_public_key(vk=vk,
+                                                             label=str(i)))
+        return public_keys
+
+    def sign_ssh_challenge(self, blob, identity):
+        """Sign given blob using a private key on the device."""
+        msg = _parse_ssh_blob(blob)
+        log.debug('%s: user %r via %r (%r)',
+                  msg['conn'], msg['user'], msg['auth'], msg['key_type'])
+        log.debug('nonce: %r', msg['nonce'])
+        fp = msg['public_key']['fingerprint']
+        log.debug('fingerprint: %s', fp)
+        log.debug('hidden challenge size: %d bytes', len(blob))
+
+        log.info('please confirm user "%s" login to "%s" using %s...',
+                 msg['user'].decode('ascii'), identity,
+                 self.device)
+
+        with self.device:
+            return self.device.sign(blob=blob, identity=identity)
+
+
+def _parse_ssh_blob(data):
+    res = {}
+    i = io.BytesIO(data)
+    res['nonce'] = util.read_frame(i)
+    i.read(1)  # SSH2_MSG_USERAUTH_REQUEST == 50 (from ssh2.h, line 108)
+    res['user'] = util.read_frame(i)
+    res['conn'] = util.read_frame(i)
+    res['auth'] = util.read_frame(i)
+    i.read(1)  # have_sig == 1 (from sshconnect2.c, line 1056)
+    res['key_type'] = util.read_frame(i)
+    public_key = util.read_frame(i)
+    res['public_key'] = formats.parse_pubkey(public_key)
+    assert not i.read()
+    return res

libagent/ssh/protocol.py

@@ -0,0 +1,160 @@
+"""
+SSH-agent protocol implementation library.
+
+See https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.agent and
+http://ptspts.blogspot.co.il/2010/06/how-to-use-ssh-agent-programmatically.html
+for more details.
+The server's source code can be found here:
+https://github.com/openssh/openssh-portable/blob/master/authfd.c
+"""
+import io
+import logging
+
+from . import formats, util
+
+log = logging.getLogger(__name__)
+
+
+# Taken from https://github.com/openssh/openssh-portable/blob/master/authfd.h
+COMMANDS = dict(
+    SSH_AGENTC_REQUEST_RSA_IDENTITIES=1,
+    SSH_AGENT_RSA_IDENTITIES_ANSWER=2,
+    SSH_AGENTC_RSA_CHALLENGE=3,
+    SSH_AGENT_RSA_RESPONSE=4,
+    SSH_AGENT_FAILURE=5,
+    SSH_AGENT_SUCCESS=6,
+    SSH_AGENTC_ADD_RSA_IDENTITY=7,
+    SSH_AGENTC_REMOVE_RSA_IDENTITY=8,
+    SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES=9,
+    SSH2_AGENTC_REQUEST_IDENTITIES=11,
+    SSH2_AGENT_IDENTITIES_ANSWER=12,
+    SSH2_AGENTC_SIGN_REQUEST=13,
+    SSH2_AGENT_SIGN_RESPONSE=14,
+    SSH2_AGENTC_ADD_IDENTITY=17,
+    SSH2_AGENTC_REMOVE_IDENTITY=18,
+    SSH2_AGENTC_REMOVE_ALL_IDENTITIES=19,
+    SSH_AGENTC_ADD_SMARTCARD_KEY=20,
+    SSH_AGENTC_REMOVE_SMARTCARD_KEY=21,
+    SSH_AGENTC_LOCK=22,
+    SSH_AGENTC_UNLOCK=23,
+    SSH_AGENTC_ADD_RSA_ID_CONSTRAINED=24,
+    SSH2_AGENTC_ADD_ID_CONSTRAINED=25,
+    SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED=26,
+)
+
+
+def msg_code(name):
+    """Convert string name into a integer message code."""
+    return COMMANDS[name]
+
+
+def msg_name(code):
+    """Convert integer message code into a string name."""
+    ids = {v: k for k, v in COMMANDS.items()}
+    return ids[code]
+
+
+def failure():
+    """Return error code to SSH binary."""
+    error_msg = util.pack('B', msg_code('SSH_AGENT_FAILURE'))
+    return util.frame(error_msg)
+
+
+def _legacy_pubs(buf):
+    """SSH v1 public keys are not supported."""
+    leftover = buf.read()
+    if leftover:
+        log.warning('skipping leftover: %r', leftover)
+    code = util.pack('B', msg_code('SSH_AGENT_RSA_IDENTITIES_ANSWER'))
+    num = util.pack('L', 0)  # no SSH v1 keys
+    return util.frame(code, num)
+
+
+class Handler(object):
+    """ssh-agent protocol handler."""
+
+    def __init__(self, conn, debug=False):
+        """
+        Create a protocol handler with specified public keys.
+
+        Use specified signer function to sign SSH authentication requests.
+        """
+        self.conn = conn
+        self.debug = debug
+
+        self.methods = {
+            msg_code('SSH_AGENTC_REQUEST_RSA_IDENTITIES'): _legacy_pubs,
+            msg_code('SSH2_AGENTC_REQUEST_IDENTITIES'): self.list_pubs,
+            msg_code('SSH2_AGENTC_SIGN_REQUEST'): self.sign_message,
+        }
+
+    def handle(self, msg):
+        """Handle SSH message from the SSH client and return the response."""
+        debug_msg = ': {!r}'.format(msg) if self.debug else ''
+        log.debug('request: %d bytes%s', len(msg), debug_msg)
+        buf = io.BytesIO(msg)
+        code, = util.recv(buf, '>B')
+        if code not in self.methods:
+            log.warning('Unsupported command: %s (%d)', msg_name(code), code)
+            return failure()
+
+        method = self.methods[code]
+        log.debug('calling %s()', method.__name__)
+        reply = method(buf=buf)
+        debug_reply = ': {!r}'.format(reply) if self.debug else ''
+        log.debug('reply: %d bytes%s', len(reply), debug_reply)
+        return reply
+
+    def list_pubs(self, buf):
+        """SSH v2 public keys are serialized and returned."""
+        assert not buf.read()
+        keys = self.conn.parse_public_keys()
+        code = util.pack('B', msg_code('SSH2_AGENT_IDENTITIES_ANSWER'))
+        num = util.pack('L', len(keys))
+        log.debug('available keys: %s', [k['name'] for k in keys])
+        for i, k in enumerate(keys):
+            log.debug('%2d) %s', i+1, k['fingerprint'])
+        pubs = [util.frame(k['blob']) + util.frame(k['name']) for k in keys]
+        return util.frame(code, num, *pubs)
+
+    def sign_message(self, buf):
+        """
+        SSH v2 public key authentication is performed.
+
+        If the required key is not supported, raise KeyError
+        If the signature is invalid, raise ValueError
+        """
+        key = formats.parse_pubkey(util.read_frame(buf))
+        log.debug('looking for %s', key['fingerprint'])
+        blob = util.read_frame(buf)
+        assert util.read_frame(buf) == b''
+        assert not buf.read()
+
+        for k in self.conn.parse_public_keys():
+            if (k['fingerprint']) == (key['fingerprint']):
+                log.debug('using key %r (%s)', k['name'], k['fingerprint'])
+                key = k
+                break
+        else:
+            raise KeyError('key not found')
+
+        label = key['name'].decode('utf-8')
+        log.debug('signing %d-byte blob with "%s" key', len(blob), label)
+        try:
+            signature = self.conn.sign(blob=blob, identity=key['identity'])
+        except IOError:
+            return failure()
+        log.debug('signature: %r', signature)
+
+        try:
+            sig_bytes = key['verifier'](sig=signature, msg=blob)
+            log.info('signature status: OK')
+        except formats.ecdsa.BadSignatureError:
+            log.exception('signature status: ERROR')
+            raise ValueError('invalid ECDSA signature')
+
+        log.debug('signature size: %d bytes', len(sig_bytes))
+
+        data = util.frame(util.frame(key['type']), util.frame(sig_bytes))
+        code = util.pack('B', msg_code('SSH2_AGENT_SIGN_RESPONSE'))
+        return util.frame(code, data)

libagent/ssh/tests/__init__.py

@@ -0,0 +1 @@
+"""Unit-tests for this package."""

libagent/ssh/tests/test_client.py

@@ -0,0 +1,72 @@
+import io
+
+import mock
+import pytest
+
+from .. import client, device, formats, util
+
+ADDR = [2147483661, 2810943954, 3938368396, 3454558782, 3848009040]
+CURVE = 'nist256p1'
+
+PUBKEY = (b'\x03\xd8(\xb5\xa6`\xbet0\x95\xac:[;]\xdc,\xbd\xdc?\xd7\xc0\xec'
+          b'\xdd\xbc+\xfar~\x9dAis')
+PUBKEY_TEXT = ('ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzd'
+               'HAyNTYAAABBBNgotaZgvnQwlaw6Wztd3Cy93D/XwOzdvCv6cn6dQWlzNMEQeW'
+               'VUfhvrGljR2Z/CMRONY6ejB+9PnpUOPuzYqi8= <localhost:22|nist256p1>\n')
+
+
+class MockDevice(device.interface.Device):  # pylint: disable=abstract-method
+
+    def connect(self):  # pylint: disable=no-self-use
+        return mock.Mock()
+
+    def pubkey(self, identity, ecdh=False):  # pylint: disable=unused-argument
+        assert self.conn
+        return PUBKEY
+
+    def sign(self, identity, blob):
+        """Sign given blob and return the signature (as bytes)."""
+        assert self.conn
+        assert blob == BLOB
+        return SIG
+
+
+BLOB = (b'\x00\x00\x00 \xce\xe0\xc9\xd5\xceu/\xe8\xc5\xf2\xbfR+x\xa1\xcf\xb0'
+        b'\x8e;R\xd3)m\x96\x1b\xb4\xd8s\xf1\x99\x16\xaa2\x00\x00\x00\x05roman'
+        b'\x00\x00\x00\x0essh-connection\x00\x00\x00\tpublickey'
+        b'\x01\x00\x00\x00\x13ecdsa-sha2-nistp256\x00\x00\x00h\x00\x00\x00'
+        b'\x13ecdsa-sha2-nistp256\x00\x00\x00\x08nistp256\x00\x00\x00A'
+        b'\x04\xd8(\xb5\xa6`\xbet0\x95\xac:[;]\xdc,\xbd\xdc?\xd7\xc0\xec'
+        b'\xdd\xbc+\xfar~\x9dAis4\xc1\x10yeT~\x1b\xeb\x1aX\xd1\xd9\x9f\xc21'
+        b'\x13\x8dc\xa7\xa3\x07\xefO\x9e\x95\x0e>\xec\xd8\xaa/')
+
+SIG = (b'R\x19T\xf2\x84$\xef#\x0e\xee\x04X\xc6\xc3\x99T`\xd1\xd8\xf7!'
+       b'\x862@cx\xb8\xb9i@1\x1b3#\x938\x86]\x97*Y\xb2\x02Xa\xdf@\xecK'
+       b'\xdc\xf0H\xab\xa8\xac\xa7? \x8f=C\x88N\xe2')
+
+
+def test_ssh_agent():
+    identity = device.interface.Identity(identity_str='localhost:22',
+                                         curve_name=CURVE)
+    c = client.Client(device=MockDevice())
+    assert c.export_public_keys([identity]) == [PUBKEY_TEXT]
+    signature = c.sign_ssh_challenge(blob=BLOB, identity=identity)
+
+    key = formats.import_public_key(PUBKEY_TEXT)
+    serialized_sig = key['verifier'](sig=signature, msg=BLOB)
+
+    stream = io.BytesIO(serialized_sig)
+    r = util.read_frame(stream)
+    s = util.read_frame(stream)
+    assert not stream.read()
+    assert r[:1] == b'\x00'
+    assert s[:1] == b'\x00'
+    assert r[1:] + s[1:] == SIG
+
+    # pylint: disable=unused-argument
+    def cancel_sign(identity, blob):
+        raise IOError(42, 'ERROR')
+
+    c.device.sign = cancel_sign
+    with pytest.raises(IOError):
+        c.sign_ssh_challenge(blob=BLOB, identity=identity)

libagent/ssh/tests/test_protocol.py

@@ -1,8 +1,8 @@
-from .. import protocol
-from .. import formats
-
+import mock
 import pytest
 
+from .. import device, formats, protocol
+
 # pylint: disable=line-too-long
 
 NIST256_KEY = 'ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEUksojS/qRlTKBKLQO7CBX7a7oqFkysuFn1nJ6gzlR3wNuQXEgd7qb2bjmiiBHsjNxyWvH5SxVi3+fghrqODWo= ssh://localhost'  # nopep8
@@ -16,46 +16,77 @@ NIST256_SIGN_MSG = b'\r\x00\x00\x00h\x00\x00\x00\x13ecdsa-sha2-nistp256\x00\x00\
 NIST256_SIGN_REPLY = b'\x00\x00\x00j\x0e\x00\x00\x00e\x00\x00\x00\x13ecdsa-sha2-nistp256\x00\x00\x00J\x00\x00\x00!\x00\x88G!\x0c\n\x16:\xbeF\xbe\xb9\xd2\xa9&e\x89\xad\xc4}\x10\xf8\xbc\xdc\xef\x0e\x8d_\x8a6.\xb6\x1f\x00\x00\x00!\x00q\xf0\x16>,\x9a\xde\xe7(\xd6\xd7\x93\x1f\xed\xf9\x94ddw\xfe\xbdq\x13\xbb\xfc\xa9K\xea\x9dC\xa1\xe9'  # nopep8
 
 
+def fake_connection(keys, signer):
+    c = mock.Mock()
+    c.parse_public_keys.return_value = keys
+    c.sign = signer
+    return c
+
+
 def test_list():
     key = formats.import_public_key(NIST256_KEY)
-    h = protocol.Handler(keys=[key], signer=None)
+    key['identity'] = device.interface.Identity('ssh://localhost', 'nist256p1')
+    h = protocol.Handler(fake_connection(keys=[key], signer=None))
     reply = h.handle(LIST_MSG)
     assert reply == LIST_NIST256_REPLY
 
 
-def ecdsa_signer(label, blob):
-    assert label == b'ssh://localhost'
+def test_list_legacy_pubs_with_suffix():
+    h = protocol.Handler(fake_connection(keys=[], signer=None))
+    suffix = b'\x00\x00\x00\x06foobar'
+    reply = h.handle(b'\x01' + suffix)
+    assert reply == b'\x00\x00\x00\x05\x02\x00\x00\x00\x00'  # no legacy keys
+
+
+def test_unsupported():
+    h = protocol.Handler(fake_connection(keys=[], signer=None))
+    reply = h.handle(b'\x09')
+    assert reply == b'\x00\x00\x00\x01\x05'
+
+
+def ecdsa_signer(identity, blob):
+    assert str(identity) == '<ssh://localhost|nist256p1>'
     assert blob == NIST256_BLOB
     return NIST256_SIG
 
 
 def test_ecdsa_sign():
     key = formats.import_public_key(NIST256_KEY)
-    h = protocol.Handler(keys=[key], signer=ecdsa_signer)
+    key['identity'] = device.interface.Identity('ssh://localhost', 'nist256p1')
+    h = protocol.Handler(fake_connection(keys=[key], signer=ecdsa_signer))
     reply = h.handle(NIST256_SIGN_MSG)
     assert reply == NIST256_SIGN_REPLY
 
 
 def test_sign_missing():
-    h = protocol.Handler(keys=[], signer=ecdsa_signer)
-
-    with pytest.raises(protocol.MissingKey):
+    h = protocol.Handler(fake_connection(keys=[], signer=ecdsa_signer))
+    with pytest.raises(KeyError):
         h.handle(NIST256_SIGN_MSG)
 
 
 def test_sign_wrong():
-    def wrong_signature(label, blob):
-        assert label == b'ssh://localhost'
+    def wrong_signature(identity, blob):
+        assert str(identity) == '<ssh://localhost|nist256p1>'
         assert blob == NIST256_BLOB
         return b'\x00' * 64
 
     key = formats.import_public_key(NIST256_KEY)
-    h = protocol.Handler(keys=[key], signer=wrong_signature)
-
-    with pytest.raises(protocol.BadSignature):
+    key['identity'] = device.interface.Identity('ssh://localhost', 'nist256p1')
+    h = protocol.Handler(fake_connection(keys=[key], signer=wrong_signature))
+    with pytest.raises(ValueError):
         h.handle(NIST256_SIGN_MSG)
 
 
+def test_sign_cancel():
+    def cancel_signature(identity, blob):  # pylint: disable=unused-argument
+        raise IOError()
+
+    key = formats.import_public_key(NIST256_KEY)
+    key['identity'] = device.interface.Identity('ssh://localhost', 'nist256p1')
+    h = protocol.Handler(fake_connection(keys=[key], signer=cancel_signature))
+    assert h.handle(NIST256_SIGN_MSG) == protocol.failure()
+
+
 ED25519_KEY = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFBdF2tjfSO8nLIi736is+f0erq28RTc7CkM11NZtTKR ssh://localhost'  # nopep8
 ED25519_SIGN_MSG = b'''\r\x00\x00\x003\x00\x00\x00\x0bssh-ed25519\x00\x00\x00 P]\x17kc}#\xbc\x9c\xb2"\xef~\xa2\xb3\xe7\xf4z\xba\xb6\xf1\x14\xdc\xec)\x0c\xd7SY\xb52\x91\x00\x00\x00\x94\x00\x00\x00 i3\xae}yk\\\xa1L\xb9\xe1\xbf\xbc\x8e\x87\r\x0e\xc0\x9f\x97\x0fTC!\x80\x07\x91\xdb^8\xc1\xd62\x00\x00\x00\x05roman\x00\x00\x00\x0essh-connection\x00\x00\x00\tpublickey\x01\x00\x00\x00\x0bssh-ed25519\x00\x00\x003\x00\x00\x00\x0bssh-ed25519\x00\x00\x00 P]\x17kc}#\xbc\x9c\xb2"\xef~\xa2\xb3\xe7\xf4z\xba\xb6\xf1\x14\xdc\xec)\x0c\xd7SY\xb52\x91\x00\x00\x00\x00'''  # nopep8
 ED25519_SIGN_REPLY = b'''\x00\x00\x00X\x0e\x00\x00\x00S\x00\x00\x00\x0bssh-ed25519\x00\x00\x00@\x8eb)\xa6\xe9P\x83VE\xfbq\xc6\xbf\x1dV3\xe3<O\x11\xc0\xfa\xe4\xed\xb8\x81.\x81\xc8\xa6\xba\x10RA'a\xbc\xa9\xd3\xdb\x98\x07\xf0\x1a\x9c4\x84<\xaf\x99\xb7\xe5G\xeb\xf7$\xc1\r\x86f\x16\x8e\x08\x05'''  # nopep8
@@ -64,14 +95,15 @@ ED25519_BLOB = b'''\x00\x00\x00 i3\xae}yk\\\xa1L\xb9\xe1\xbf\xbc\x8e\x87\r\x0e\x
 ED25519_SIG = b'''\x8eb)\xa6\xe9P\x83VE\xfbq\xc6\xbf\x1dV3\xe3<O\x11\xc0\xfa\xe4\xed\xb8\x81.\x81\xc8\xa6\xba\x10RA'a\xbc\xa9\xd3\xdb\x98\x07\xf0\x1a\x9c4\x84<\xaf\x99\xb7\xe5G\xeb\xf7$\xc1\r\x86f\x16\x8e\x08\x05'''  # nopep8
 
 
-def ed25519_signer(label, blob):
-    assert label == b'ssh://localhost'
+def ed25519_signer(identity, blob):
+    assert str(identity) == '<ssh://localhost|ed25519>'
     assert blob == ED25519_BLOB
     return ED25519_SIG
 
 
 def test_ed25519_sign():
     key = formats.import_public_key(ED25519_KEY)
-    h = protocol.Handler(keys=[key], signer=ed25519_signer)
+    key['identity'] = device.interface.Identity('ssh://localhost', 'ed25519')
+    h = protocol.Handler(fake_connection(keys=[key], signer=ed25519_signer))
     reply = h.handle(ED25519_SIGN_MSG)
     assert reply == ED25519_SIGN_REPLY

libagent/tests/__init__.py

@@ -0,0 +1 @@
+"""Unit-tests for this package."""

libagent/tests/test_formats.py

@@ -1,4 +1,5 @@
 import binascii
+
 import pytest
 
 from .. import formats
@@ -28,7 +29,7 @@ def test_parse_public_key():
     assert key['name'] == b'home'
     assert key['point'] == _point
 
-    assert key['curve'] == b'nist256p1'
+    assert key['curve'] == 'nist256p1'
     assert key['fingerprint'] == '4b:19:bc:0f:c8:7e:dc:fa:1a:e3:c2:ff:6f:e0:80:a2'  # nopep8
     assert key['type'] == b'ecdsa-sha2-nistp256'
 
@@ -45,7 +46,7 @@ def test_parse_ed25519():
               'fSO8nLIi736is+f0erq28RTc7CkM11NZtTKR hello\n')
     p = formats.import_public_key(pubkey)
     assert p['name'] == b'hello'
-    assert p['curve'] == b'ed25519'
+    assert p['curve'] == 'ed25519'
 
     BLOB = (b'\x00\x00\x00\x0bssh-ed25519\x00\x00\x00 P]\x17kc}#'
             b'\xbc\x9c\xb2"\xef~\xa2\xb3\xe7\xf4z\xba\xb6\xf1\x14'
@@ -92,3 +93,11 @@ def test_curve_mismatch():
 def test_serialize_error():
     with pytest.raises(TypeError):
         formats.serialize_verifying_key(None)
+
+
+def test_get_ecdh_curve_name():
+    for c in [formats.CURVE_NIST256, formats.ECDH_CURVE25519]:
+        assert c == formats.get_ecdh_curve_name(c)
+
+    assert (formats.ECDH_CURVE25519 ==
+            formats.get_ecdh_curve_name(formats.CURVE_ED25519))

libagent/tests/test_interface.py

@@ -0,0 +1,7 @@
+from ..device import interface
+
+
+def test_unicode():
+    i = interface.Identity(u'ko\u017eu\u0161\u010dek@host', 'ed25519')
+    assert i.to_bytes() == b'kozuscek@host'
+    assert sorted(i.items()) == [('host', 'host'), ('user', 'kozuscek')]

libagent/tests/test_server.py

@@ -0,0 +1,135 @@
+import functools
+import io
+import os
+import socket
+import tempfile
+import threading
+
+import mock
+import pytest
+
+from .. import server, util
+from ..ssh import protocol
+
+
+def test_socket():
+    path = tempfile.mktemp()
+    with server.unix_domain_socket_server(path):
+        pass
+    assert not os.path.isfile(path)
+
+
+class FakeSocket(object):
+
+    def __init__(self, data=b''):
+        self.rx = io.BytesIO(data)
+        self.tx = io.BytesIO()
+
+    def sendall(self, data):
+        self.tx.write(data)
+
+    def recv(self, size):
+        return self.rx.read(size)
+
+    def close(self):
+        pass
+
+    def settimeout(self, value):
+        pass
+
+
+def empty_device():
+    c = mock.Mock(spec=['parse_public_keys'])
+    c.parse_public_keys.return_value = []
+    return c
+
+
+def test_handle():
+    mutex = threading.Lock()
+
+    handler = protocol.Handler(conn=empty_device())
+    conn = FakeSocket()
+    server.handle_connection(conn, handler, mutex)
+
+    msg = bytearray([protocol.msg_code('SSH_AGENTC_REQUEST_RSA_IDENTITIES')])
+    conn = FakeSocket(util.frame(msg))
+    server.handle_connection(conn, handler, mutex)
+    assert conn.tx.getvalue() == b'\x00\x00\x00\x05\x02\x00\x00\x00\x00'
+
+    msg = bytearray([protocol.msg_code('SSH2_AGENTC_REQUEST_IDENTITIES')])
+    conn = FakeSocket(util.frame(msg))
+    server.handle_connection(conn, handler, mutex)
+    assert conn.tx.getvalue() == b'\x00\x00\x00\x05\x0C\x00\x00\x00\x00'
+
+    msg = bytearray([protocol.msg_code('SSH2_AGENTC_ADD_IDENTITY')])
+    conn = FakeSocket(util.frame(msg))
+    server.handle_connection(conn, handler, mutex)
+    conn.tx.seek(0)
+    reply = util.read_frame(conn.tx)
+    assert reply == util.pack('B', protocol.msg_code('SSH_AGENT_FAILURE'))
+
+    conn_mock = mock.Mock(spec=FakeSocket)
+    conn_mock.recv.side_effect = [Exception, EOFError]
+    server.handle_connection(conn=conn_mock, handler=None, mutex=mutex)
+
+
+def test_server_thread():
+    connections = [FakeSocket()]
+    quit_event = threading.Event()
+
+    class FakeServer(object):
+        def accept(self):  # pylint: disable=no-self-use
+            if connections:
+                return connections.pop(), 'address'
+            quit_event.set()
+            raise socket.timeout()
+
+        def getsockname(self):  # pylint: disable=no-self-use
+            return 'fake_server'
+
+    handler = protocol.Handler(conn=empty_device()),
+    handle_conn = functools.partial(server.handle_connection,
+                                    handler=handler,
+                                    mutex=None)
+    server.server_thread(sock=FakeServer(),
+                         handle_conn=handle_conn,
+                         quit_event=quit_event)
+
+
+def test_spawn():
+    obj = []
+
+    def thread(x):
+        obj.append(x)
+
+    with server.spawn(thread, dict(x=1)):
+        pass
+
+    assert obj == [1]
+
+
+def test_run():
+    assert server.run_process(['true'], environ={}) == 0
+    assert server.run_process(['false'], environ={}) == 1
+    assert server.run_process(command=['bash', '-c', 'exit $X'],
+                              environ={'X': '42'}) == 42
+
+    with pytest.raises(OSError):
+        server.run_process([''], environ={})
+
+
+def test_remove():
+    path = 'foo.bar'
+
+    def remove(p):
+        assert p == path
+
+    server.remove_file(path, remove=remove)
+
+    def remove_raise(_):
+        raise OSError('boom')
+
+    server.remove_file(path, remove=remove_raise, exists=lambda _: False)
+
+    with pytest.raises(OSError):
+        server.remove_file(path, remove=remove_raise, exists=lambda _: True)

libagent/tests/test_util.py

@@ -0,0 +1,117 @@
+import io
+
+import mock
+import pytest
+
+from .. import util
+
+
+def test_bytes2num():
+    assert util.bytes2num(b'\x12\x34') == 0x1234
+
+
+def test_num2bytes():
+    assert util.num2bytes(0x1234, size=2) == b'\x12\x34'
+
+
+def test_pack():
+    assert util.pack('BHL', 1, 2, 3) == b'\x01\x00\x02\x00\x00\x00\x03'
+
+
+def test_frames():
+    msgs = [b'aaa', b'bb', b'c' * 0x12340]
+    f = util.frame(*msgs)
+    assert f == b'\x00\x01\x23\x45' + b''.join(msgs)
+    assert util.read_frame(io.BytesIO(f)) == b''.join(msgs)
+
+
+class FakeSocket(object):
+    def __init__(self):
+        self.buf = io.BytesIO()
+
+    def sendall(self, data):
+        self.buf.write(data)
+
+    def recv(self, size):
+        return self.buf.read(size)
+
+
+def test_send_recv():
+    s = FakeSocket()
+    util.send(s, b'123')
+    util.send(s, b'*')
+    assert s.buf.getvalue() == b'123*'
+
+    s.buf.seek(0)
+    assert util.recv(s, 2) == b'12'
+    assert util.recv(s, 2) == b'3*'
+
+    pytest.raises(EOFError, util.recv, s, 1)
+
+
+def test_crc24():
+    assert util.crc24(b'') == b'\xb7\x04\xce'
+    assert util.crc24(b'1234567890') == b'\x8c\x00\x72'
+
+
+def test_bit():
+    assert util.bit(6, 3) == 0
+    assert util.bit(6, 2) == 1
+    assert util.bit(6, 1) == 1
+    assert util.bit(6, 0) == 0
+
+
+def test_split_bits():
+    assert util.split_bits(0x1234, 4, 8, 4) == [0x1, 0x23, 0x4]
+
+
+def test_hexlify():
+    assert util.hexlify(b'\x12\x34\xab\xcd') == '1234ABCD'
+
+
+def test_low_bits():
+    assert util.low_bits(0x1234, 12) == 0x234
+    assert util.low_bits(0x1234, 32) == 0x1234
+    assert util.low_bits(0x1234, 0) == 0
+
+
+def test_readfmt():
+    stream = io.BytesIO(b'ABC\x12\x34')
+    assert util.readfmt(stream, 'B') == (65,)
+    assert util.readfmt(stream, '>2sH') == (b'BC', 0x1234)
+
+
+def test_prefix_len():
+    assert util.prefix_len('>H', b'ABCD') == b'\x00\x04ABCD'
+
+
+def test_reader():
+    stream = io.BytesIO(b'ABC\x12\x34')
+    r = util.Reader(stream)
+    assert r.read(1) == b'A'
+    assert r.readfmt('2s') == b'BC'
+
+    dst = io.BytesIO()
+    with r.capture(dst):
+        assert r.readfmt('>H') == 0x1234
+    assert dst.getvalue() == b'\x12\x34'
+
+    with pytest.raises(EOFError):
+        r.read(1)
+
+
+def test_setup_logging():
+    util.setup_logging(verbosity=10, filename='/dev/null')
+
+
+def test_memoize():
+    f = mock.Mock(side_effect=lambda x: x)
+
+    def func(x):
+        # mock.Mock doesn't work with functools.wraps()
+        return f(x)
+
+    g = util.memoize(func)
+    assert g(1) == g(1)
+    assert g(1) != g(2)
+    assert f.mock_calls == [mock.call(1), mock.call(2)]

libagent/util.py

@@ -0,0 +1,215 @@
+"""Various I/O and serialization utilities."""
+import binascii
+import contextlib
+import functools
+import io
+import logging
+import struct
+
+log = logging.getLogger(__name__)
+
+
+def send(conn, data):
+    """Send data blob to connection socket."""
+    conn.sendall(data)
+
+
+def recv(conn, size):
+    """
+    Receive bytes from connection socket or stream.
+
+    If size is struct.calcsize()-compatible format, use it to unpack the data.
+    Otherwise, return the plain blob as bytes.
+    """
+    try:
+        fmt = size
+        size = struct.calcsize(fmt)
+    except TypeError:
+        fmt = None
+    try:
+        _read = conn.recv
+    except AttributeError:
+        _read = conn.read
+
+    res = io.BytesIO()
+    while size > 0:
+        buf = _read(size)
+        if not buf:
+            raise EOFError
+        size = size - len(buf)
+        res.write(buf)
+    res = res.getvalue()
+    if fmt:
+        return struct.unpack(fmt, res)
+    else:
+        return res
+
+
+def read_frame(conn):
+    """Read size-prefixed frame from connection."""
+    size, = recv(conn, '>L')
+    return recv(conn, size)
+
+
+def bytes2num(s):
+    """Convert MSB-first bytes to an unsigned integer."""
+    res = 0
+    for i, c in enumerate(reversed(bytearray(s))):
+        res += c << (i * 8)
+    return res
+
+
+def num2bytes(value, size):
+    """Convert an unsigned integer to MSB-first bytes with specified size."""
+    res = []
+    for _ in range(size):
+        res.append(value & 0xFF)
+        value = value >> 8
+    assert value == 0
+    return bytes(bytearray(list(reversed(res))))
+
+
+def pack(fmt, *args):
+    """Serialize MSB-first message."""
+    return struct.pack('>' + fmt, *args)
+
+
+def frame(*msgs):
+    """Serialize MSB-first length-prefixed frame."""
+    res = io.BytesIO()
+    for msg in msgs:
+        res.write(msg)
+    msg = res.getvalue()
+    return pack('L', len(msg)) + msg
+
+
+def crc24(blob):
+    """See https://tools.ietf.org/html/rfc4880#section-6.1 for details."""
+    CRC24_INIT = 0x0B704CE
+    CRC24_POLY = 0x1864CFB
+
+    crc = CRC24_INIT
+    for octet in bytearray(blob):
+        crc ^= (octet << 16)
+        for _ in range(8):
+            crc <<= 1
+            if crc & 0x1000000:
+                crc ^= CRC24_POLY
+    assert 0 <= crc < 0x1000000
+    crc_bytes = struct.pack('>L', crc)
+    assert crc_bytes[:1] == b'\x00'
+    return crc_bytes[1:]
+
+
+def bit(value, i):
+    """Extract the i-th bit out of value."""
+    return 1 if value & (1 << i) else 0
+
+
+def low_bits(value, n):
+    """Extract the lowest n bits out of value."""
+    return value & ((1 << n) - 1)
+
+
+def split_bits(value, *bits):
+    """
+    Split integer value into list of ints, according to `bits` list.
+
+    For example, split_bits(0x1234, 4, 8, 4) == [0x1, 0x23, 0x4]
+    """
+    result = []
+    for b in reversed(bits):
+        mask = (1 << b) - 1
+        result.append(value & mask)
+        value = value >> b
+    assert value == 0
+
+    result.reverse()
+    return result
+
+
+def readfmt(stream, fmt):
+    """Read and unpack an object from stream, using a struct format string."""
+    size = struct.calcsize(fmt)
+    blob = stream.read(size)
+    return struct.unpack(fmt, blob)
+
+
+def prefix_len(fmt, blob):
+    """Prefix `blob` with its size, serialized using `fmt` format."""
+    return struct.pack(fmt, len(blob)) + blob
+
+
+def hexlify(blob):
+    """Utility for consistent hexadecimal formatting."""
+    return binascii.hexlify(blob).decode('ascii').upper()
+
+
+class Reader(object):
+    """Read basic type objects out of given stream."""
+
+    def __init__(self, stream):
+        """Create a non-capturing reader."""
+        self.s = stream
+        self._captured = None
+
+    def readfmt(self, fmt):
+        """Read a specified object, using a struct format string."""
+        size = struct.calcsize(fmt)
+        blob = self.read(size)
+        obj, = struct.unpack(fmt, blob)
+        return obj
+
+    def read(self, size=None):
+        """Read `size` bytes from stream."""
+        blob = self.s.read(size)
+        if size is not None and len(blob) < size:
+            raise EOFError
+        if self._captured:
+            self._captured.write(blob)
+        return blob
+
+    @contextlib.contextmanager
+    def capture(self, stream):
+        """Capture all data read during this context."""
+        self._captured = stream
+        try:
+            yield
+        finally:
+            self._captured = None
+
+
+def setup_logging(verbosity, filename=None):
+    """Configure logging for this tool."""
+    levels = [logging.WARNING, logging.INFO, logging.DEBUG]
+    level = levels[min(verbosity, len(levels) - 1)]
+    logging.root.setLevel(level)
+
+    fmt = logging.Formatter('%(asctime)s %(levelname)-12s %(message)-100s '
+                            '[%(filename)s:%(lineno)d]')
+    hdlr = logging.StreamHandler()  # stderr
+    hdlr.setFormatter(fmt)
+    logging.root.addHandler(hdlr)
+
+    if filename:
+        hdlr = logging.FileHandler(filename, 'a')
+        hdlr.setFormatter(fmt)
+        logging.root.addHandler(hdlr)
+
+
+def memoize(func):
+    """Simple caching decorator."""
+    cache = {}
+
+    @functools.wraps(func)
+    def wrapper(*args, **kwargs):
+        """Caching wrapper."""
+        key = (args, tuple(sorted(kwargs.items())))
+        if key in cache:
+            return cache[key]
+        else:
+            result = func(*args, **kwargs)
+            cache[key] = result
+            return result
+
+    return wrapper

scripts/gpg-init

@@ -0,0 +1,57 @@
+#!/bin/bash
+set -eu
+
+gpg2 --version >/dev/null  # verify that GnuPG 2 is installed
+
+USER_ID="${1}"
+DEVICE=${DEVICE:="trezor"}  # or "ledger"
+CURVE=${CURVE:="nist256p1"}  # or "ed25519"
+TIMESTAMP=${TIMESTAMP:=`date +%s`}  # key creation timestamp
+HOMEDIR=~/.gnupg/${DEVICE}
+
+# Prepare new GPG home directory for hardware-based identity
+rm -rf "${HOMEDIR}"
+mkdir -p "${HOMEDIR}"
+chmod 700 "${HOMEDIR}"
+
+# Generate new GPG identity and import into GPG keyring
+$DEVICE-gpg create -v "${USER_ID}" -t "${TIMESTAMP}" -e "${CURVE}" > "${HOMEDIR}/pubkey.asc"
+gpg2 --homedir "${HOMEDIR}" --import < "${HOMEDIR}/pubkey.asc" 2> /dev/null
+rm -f "${HOMEDIR}/S.gpg-agent"  # (otherwise, our agent won't be started automatically)
+
+# Make new GPG identity with "ultimate" trust (via its fingerprint)
+FINGERPRINT=$(gpg2 --homedir "${HOMEDIR}" --list-public-keys --with-fingerprint --with-colons | sed -n -E 's/^fpr:::::::::([0-9A-F]+):$/\1/p' | head -n1)
+echo "${FINGERPRINT}:6" | gpg2 --homedir "${HOMEDIR}" --import-ownertrust 2> /dev/null
+
+AGENT_PATH="$(which ${DEVICE}-gpg-agent)"
+
+# Prepare GPG configuration file
+echo "# Hardware-based GPG configuration
+agent-program ${AGENT_PATH}
+personal-digest-preferences SHA512
+default-key \"${USER_ID}\"
+" > "${HOMEDIR}/gpg.conf"
+
+# Prepare GPG agent configuration file
+echo "# Hardware-based GPG agent emulator
+log-file ${HOMEDIR}/gpg-agent.log
+verbosity 2
+" > "${HOMEDIR}/gpg-agent.conf"
+
+# Prepare a helper script for setting up the new identity
+echo "#!/bin/bash
+set -eu
+export GNUPGHOME=${HOMEDIR}
+COMMAND=\$*
+if [ -z \"\${COMMAND}\" ]
+then
+    \${SHELL}
+else
+    \${COMMAND}
+fi
+" > "${HOMEDIR}/env"
+chmod u+x "${HOMEDIR}/env"
+
+echo "Starting ${DEVICE}-gpg-agent at ${HOMEDIR}..."
+# Load agent and make sure it responds with the new identity
+GNUPGHOME="${HOMEDIR}" gpg2 -K 2> /dev/null

setup.py

@@ -2,28 +2,41 @@
 from setuptools import setup
 
 setup(
-    name='trezor_agent',
-    version='0.5.1',
-    description='Using Trezor as hardware SSH agent',
+    name='libagent',
+    version='0.9.2',
+    description='Using hardware wallets as SSH/GPG agent',
     author='Roman Zeyde',
     author_email='roman.zeyde@gmail.com',
-    license='MIT',
     url='http://github.com/romanz/trezor-agent',
-    packages=['trezor_agent', 'trezor_agent.trezor'],
-    install_requires=['ecdsa>=0.13', 'ed25519>=1.4', 'Cython>=0.23.4', 'trezor>=0.6.6'],
+    packages=[
+        'libagent',
+        'libagent.device',
+        'libagent.gpg',
+        'libagent.ssh'
+    ],
+    install_requires=[
+        'ecdsa>=0.13',
+        'ed25519>=1.4',
+        'semver>=2.2',
+        'unidecode>=0.4.20',
+    ],
     platforms=['POSIX'],
     classifiers=[
-        'Development Status :: 3 - Alpha',
+        'Environment :: Console',
+        'Development Status :: 4 - Beta',
         'Intended Audience :: Developers',
         'Intended Audience :: Information Technology',
-        'License :: OSI Approved :: MIT License',
+        'Intended Audience :: System Administrators',
+        'License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)',
         'Operating System :: POSIX',
         'Programming Language :: Python :: 2.7',
+        'Programming Language :: Python :: 3.4',
+        'Programming Language :: Python :: 3.5',
+        'Programming Language :: Python :: 3.6',
         'Topic :: Software Development :: Libraries :: Python Modules',
         'Topic :: System :: Networking',
         'Topic :: Communications',
+        'Topic :: Security',
+        'Topic :: Utilities',
     ],
-    entry_points={'console_scripts': [
-        'trezor-agent = trezor_agent.__main__:trezor_agent'
-    ]},
 )

tox.ini

@@ -1,5 +1,9 @@
 [tox]
-envlist = py27
+envlist = py27,py3
+[pep8]
+max-line-length = 100
+[pep257]
+add-ignore = D401
 [testenv]
 deps=
     pytest
@@ -7,9 +11,14 @@ deps=
     pep8
     coverage
     pylint
-    six
+    semver
+    pydocstyle
+    isort
 commands=
-    pep8 trezor_agent
-    pylint --report=no --rcfile .pylintrc trezor_agent
-    coverage run --omit='trezor_agent/__main__.py' --source trezor_agent -m py.test -v trezor_agent
+    pep8 libagent
+    isort --skip-glob .tox -c -r libagent
+    pylint --reports=no --rcfile .pylintrc libagent
+    pydocstyle libagent
+    coverage run --source libagent -m py.test -v libagent
     coverage report
+    coverage html

trezor_agent/__main__.py

@@ -1,128 +0,0 @@
-import os
-import re
-import sys
-import argparse
-import subprocess
-import functools
-
-from . import trezor
-from . import server
-from . import formats
-
-import logging
-log = logging.getLogger(__name__)
-
-
-def identity_from_gitconfig():
-    out = subprocess.check_output(args='git config --list --local'.split())
-    config = [line.split('=', 1) for line in out.strip().split('\n')]
-    config_dict = dict(item for item in config if len(item) == 2)
-
-    name_regex = re.compile(r'^remote\..*\.trezor$')
-    names = [item[0] for item in config if name_regex.match(item[0])]
-    if len(names) != 1:
-        log.error('please add "trezor" key '
-                  'to a single remote section at .git/config')
-        sys.exit(1)
-    key_name = names[0]
-    identity_label = config_dict.get(key_name)
-    if identity_label:
-        return identity_label
-
-    # extract remote name marked as TREZOR's
-    section_name, _ = key_name.rsplit('.', 1)
-
-    key_name = section_name + '.url'
-    url = config_dict[key_name]
-    log.debug('using "%s=%s" from git-config', key_name, url)
-
-    user, url = url.split('@', 1)
-    host, path = url.split(':', 1)
-    return 'ssh://{0}@{1}/{2}'.format(user, host, path)
-
-
-def ssh_args(label):
-    identity = trezor.client.string_to_identity(label, identity_type=dict)
-
-    args = []
-    if 'port' in identity:
-        args += ['-p', identity['port']]
-    if 'user' in identity:
-        args += ['-l', identity['user']]
-
-    return ['ssh'] + args + [identity['host']]
-
-
-def create_agent_parser():
-    p = argparse.ArgumentParser()
-    p.add_argument('-v', '--verbose', default=0, action='count')
-
-    p.add_argument('identity', type=str, default=None,
-                   help='proto://[user@]host[:port][/path]')
-
-    g = p.add_mutually_exclusive_group()
-    g.add_argument('-s', '--shell', default=False, action='store_true',
-                   help='run ${SHELL} as subprocess under SSH agent')
-    g.add_argument('-c', '--connect', default=False, action='store_true',
-                   help='connect to specified host via SSH')
-    curves = ', '.join(sorted(formats.SUPPORTED_CURVES))
-    p.add_argument('-e', '--ecdsa-curve-name', metavar='CURVE',
-                   default=formats.CURVE_NIST256,
-                   help='specify ECDSA curve name: ' + curves)
-    p.add_argument('command', type=str, nargs='*', metavar='ARGUMENT',
-                   help='command to run under the SSH agent')
-    return p
-
-
-def setup_logging(verbosity):
-    fmt = ('%(asctime)s %(levelname)-12s %(message)-100s '
-           '[%(filename)s:%(lineno)d]')
-    levels = [logging.WARNING, logging.INFO, logging.DEBUG]
-    level = levels[min(verbosity, len(levels) - 1)]
-    logging.basicConfig(format=fmt, level=level)
-
-
-def ssh_sign(client, label, blob):
-    return client.sign_ssh_challenge(label=label, blob=blob)
-
-
-def run_agent(client_factory):
-    args = create_agent_parser().parse_args()
-    setup_logging(verbosity=args.verbose)
-
-    with client_factory(curve=args.ecdsa_curve_name) as client:
-        label = args.identity
-        command = args.command
-
-        if label == 'git':
-            label = identity_from_gitconfig()
-            log.info('using identity %r for git command %r', label, command)
-            if command:
-                command = ['git'] + command
-
-        public_key = client.get_public_key(label=label)
-
-        use_shell = False
-        if args.connect:
-            command = ssh_args(label) + args.command
-            log.debug('SSH connect: %r', command)
-
-        if args.shell:
-            command, use_shell = os.environ['SHELL'], True
-            log.debug('using shell: %r', command)
-
-        if not command:
-            sys.stdout.write(public_key)
-            return
-
-        try:
-            signer = functools.partial(ssh_sign, client=client)
-            with server.serve(public_keys=[public_key], signer=signer) as env:
-                return server.run_process(command=command, environ=env,
-                                          use_shell=use_shell)
-        except KeyboardInterrupt:
-            log.info('server stopped')
-
-
-def trezor_agent():
-    run_agent(trezor.Client)

trezor_agent/protocol.py

@@ -1,104 +0,0 @@
-import io
-import binascii
-
-from . import util
-from . import formats
-
-import logging
-log = logging.getLogger(__name__)
-
-SSH_AGENTC_REQUEST_RSA_IDENTITIES = 1
-SSH_AGENT_RSA_IDENTITIES_ANSWER = 2
-
-SSH2_AGENTC_REQUEST_IDENTITIES = 11
-SSH2_AGENT_IDENTITIES_ANSWER = 12
-SSH2_AGENTC_SIGN_REQUEST = 13
-SSH2_AGENT_SIGN_RESPONSE = 14
-
-
-class Error(Exception):
-    pass
-
-
-class BadSignature(Error):
-    pass
-
-
-class MissingKey(Error):
-    pass
-
-
-class Handler(object):
-
-    def __init__(self, keys, signer):
-        self.public_keys = keys
-        self.signer = signer
-
-        self.methods = {
-            SSH_AGENTC_REQUEST_RSA_IDENTITIES: Handler.legacy_pubs,
-            SSH2_AGENTC_REQUEST_IDENTITIES: self.list_pubs,
-            SSH2_AGENTC_SIGN_REQUEST: self.sign_message,
-        }
-
-    def handle(self, msg):
-        log.debug('request: %d bytes', len(msg))
-        buf = io.BytesIO(msg)
-        code, = util.recv(buf, '>B')
-        method = self.methods[code]
-        log.debug('calling %s()', method.__name__)
-        reply = method(buf=buf)
-        log.debug('reply: %d bytes', len(reply))
-        return reply
-
-    @staticmethod
-    def legacy_pubs(buf):
-        ''' SSH v1 public keys are not supported '''
-        assert not buf.read()
-        code = util.pack('B', SSH_AGENT_RSA_IDENTITIES_ANSWER)
-        num = util.pack('L', 0)  # no SSH v1 keys
-        return util.frame(code, num)
-
-    def list_pubs(self, buf):
-        ''' SSH v2 public keys are serialized and returned. '''
-        assert not buf.read()
-        keys = self.public_keys
-        code = util.pack('B', SSH2_AGENT_IDENTITIES_ANSWER)
-        num = util.pack('L', len(keys))
-        log.debug('available keys: %s', [k['name'] for k in keys])
-        for i, k in enumerate(keys):
-            log.debug('%2d) %s', i+1, k['fingerprint'])
-        pubs = [util.frame(k['blob']) + util.frame(k['name']) for k in keys]
-        return util.frame(code, num, *pubs)
-
-    def sign_message(self, buf):
-        ''' SSH v2 public key authentication is performed. '''
-        key = formats.parse_pubkey(util.read_frame(buf))
-        log.debug('looking for %s', key['fingerprint'])
-        blob = util.read_frame(buf)
-        assert util.read_frame(buf) == b''
-        assert not buf.read()
-
-        for k in self.public_keys:
-            if (k['fingerprint']) == (key['fingerprint']):
-                log.debug('using key %r (%s)', k['name'], k['fingerprint'])
-                key = k
-                break
-        else:
-            raise MissingKey('key not found')
-
-        log.debug('signing %d-byte blob', len(blob))
-        signature = self.signer(label=key['name'], blob=blob)
-        log.debug('signature: %s', binascii.hexlify(signature))
-
-        try:
-            sig_bytes = key['verifier'](sig=signature, msg=blob)
-            log.info('signature status: OK')
-        except formats.ecdsa.BadSignatureError:
-            log.exception('signature status: ERROR')
-            raise BadSignature('invalid ECDSA signature')
-
-        log.debug('signature size: %d bytes', len(sig_bytes))
-
-        data = util.frame(util.frame(key['type']), util.frame(sig_bytes))
-        code = util.pack('B', SSH2_AGENT_SIGN_RESPONSE)
-        return util.frame(code, data)

trezor_agent/server.py

@@ -1,102 +0,0 @@
-import socket
-import os
-import subprocess
-import tempfile
-import contextlib
-import threading
-
-from . import protocol
-from . import formats
-from . import util
-
-import logging
-log = logging.getLogger(__name__)
-
-
-def remove_file(path, remove=os.remove, exists=os.path.exists):
-    try:
-        remove(path)
-    except OSError:
-        if exists(path):
-            raise
-
-
-@contextlib.contextmanager
-def unix_domain_socket_server(sock_path):
-    log.debug('serving on SSH_AUTH_SOCK=%s', sock_path)
-    remove_file(sock_path)
-
-    server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    server.bind(sock_path)
-    server.listen(1)
-    try:
-        yield server
-    finally:
-        remove_file(sock_path)
-
-
-def handle_connection(conn, handler):
-    try:
-        log.debug('welcome agent')
-        while True:
-            msg = util.read_frame(conn)
-            reply = handler.handle(msg=msg)
-            util.send(conn, reply)
-    except EOFError:
-        log.debug('goodbye agent')
-    except:
-        log.exception('error')
-        raise
-
-
-def server_thread(server, handler):
-    log.debug('server thread started')
-    while True:
-        log.debug('waiting for connection on %s', server.getsockname())
-        try:
-            conn, _ = server.accept()
-        except socket.error as e:
-            log.debug('server stopped: %s', e)
-            break
-        with contextlib.closing(conn):
-            handle_connection(conn, handler)
-    log.debug('server thread stopped')
-
-
-@contextlib.contextmanager
-def spawn(func, **kwargs):
-    t = threading.Thread(target=func, kwargs=kwargs)
-    t.start()
-    yield
-    t.join()
-
-
-@contextlib.contextmanager
-def serve(public_keys, signer, sock_path=None):
-    if sock_path is None:
-        sock_path = tempfile.mktemp(prefix='ssh-agent-')
-
-    keys = [formats.import_public_key(k) for k in public_keys]
-    environ = {'SSH_AUTH_SOCK': sock_path, 'SSH_AGENT_PID': str(os.getpid())}
-    with unix_domain_socket_server(sock_path) as server:
-        handler = protocol.Handler(keys=keys, signer=signer)
-        with spawn(server_thread, server=server, handler=handler):
-            try:
-                yield environ
-            finally:
-                log.debug('closing server')
-                server.shutdown(socket.SHUT_RD)
-
-
-def run_process(command, environ, use_shell=False):
-    log.debug('running %r with %r', command, environ)
-    env = dict(os.environ)
-    env.update(environ)
-    try:
-        p = subprocess.Popen(args=command, env=env, shell=use_shell)
-    except OSError as e:
-        raise OSError('cannot run %r: %s' % (command, e))
-    log.debug('subprocess %d is running', p.pid)
-    ret = p.wait()
-    log.debug('subprocess %d exited: %d', p.pid, ret)
-    return ret

trezor_agent/tests/test_server.py

@@ -1,118 +0,0 @@
-import tempfile
-import socket
-import os
-import io
-import pytest
-
-from .. import server
-from .. import protocol
-from .. import util
-
-
-def test_socket():
-    path = tempfile.mktemp()
-    with server.unix_domain_socket_server(path):
-        pass
-    assert not os.path.isfile(path)
-
-
-class SocketMock(object):
-
-    def __init__(self, data=b''):
-        self.rx = io.BytesIO(data)
-        self.tx = io.BytesIO()
-
-    def sendall(self, data):
-        self.tx.write(data)
-
-    def recv(self, size):
-        return self.rx.read(size)
-
-    def close(self):
-        pass
-
-
-def test_handle():
-    handler = protocol.Handler(keys=[], signer=None)
-    conn = SocketMock()
-    server.handle_connection(conn, handler)
-
-    msg = bytearray([protocol.SSH_AGENTC_REQUEST_RSA_IDENTITIES])
-    conn = SocketMock(util.frame(msg))
-    server.handle_connection(conn, handler)
-    assert conn.tx.getvalue() == b'\x00\x00\x00\x05\x02\x00\x00\x00\x00'
-
-    msg = bytearray([protocol.SSH2_AGENTC_REQUEST_IDENTITIES])
-    conn = SocketMock(util.frame(msg))
-    server.handle_connection(conn, handler)
-    assert conn.tx.getvalue() == b'\x00\x00\x00\x05\x0C\x00\x00\x00\x00'
-
-    with pytest.raises(AttributeError):
-        server.handle_connection(conn=None, handler=None)
-
-
-class ServerMock(object):
-
-    def __init__(self, connections, name):
-        self.connections = connections
-        self.name = name
-
-    def getsockname(self):
-        return self.name
-
-    def accept(self):
-        if self.connections:
-            return self.connections.pop(), 'address'
-        raise socket.error('stop')
-
-
-def test_server_thread():
-    s = ServerMock(connections=[SocketMock()], name='mock')
-    h = protocol.Handler(keys=[], signer=None)
-    server.server_thread(s, h)
-
-
-def test_spawn():
-    obj = []
-
-    def thread(x):
-        obj.append(x)
-
-    with server.spawn(thread, x=1):
-        pass
-
-    assert obj == [1]
-
-
-def test_run():
-    assert server.run_process(['true'], environ={}) == 0
-    assert server.run_process(['false'], environ={}) == 1
-    assert server.run_process(
-        command='exit $X',
-        environ={'X': '42'},
-        use_shell=True) == 42
-
-    with pytest.raises(OSError):
-        server.run_process([''], environ={})
-
-
-def test_serve_main():
-    with server.serve(public_keys=[], signer=None, sock_path=None):
-        pass
-
-
-def test_remove():
-    path = 'foo.bar'
-
-    def remove(p):
-        assert p == path
-
-    server.remove_file(path, remove=remove)
-
-    def remove_raise(_):
-        raise OSError('boom')
-
-    server.remove_file(path, remove=remove_raise, exists=lambda _: False)
-
-    with pytest.raises(OSError):
-        server.remove_file(path, remove=remove_raise, exists=lambda _: True)

trezor_agent/tests/test_trezor.py

@@ -1,134 +0,0 @@
-from ..trezor import client
-from .. import formats
-
-import mock
-import pytest
-
-
-ADDR = [2147483661, 2810943954, 3938368396, 3454558782, 3848009040]
-CURVE = 'nist256p1'
-
-PUBKEY = (b'\x03\xd8(\xb5\xa6`\xbet0\x95\xac:[;]\xdc,\xbd\xdc?\xd7\xc0\xec'
-          b'\xdd\xbc+\xfar~\x9dAis')
-PUBKEY_TEXT = ('ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzd'
-               'HAyNTYAAABBBNgotaZgvnQwlaw6Wztd3Cy93D/XwOzdvCv6cn6dQWlzNMEQeW'
-               'VUfhvrGljR2Z/CMRONY6ejB+9PnpUOPuzYqi8= ssh://localhost:22\n')
-
-
-class ConnectionMock(object):
-
-    def __init__(self, version):
-        self.features = mock.Mock(spec=[])
-        self.features.device_id = '123456789'
-        self.features.label = 'mywallet'
-        self.features.vendor = 'mock'
-        self.features.major_version = version[0]
-        self.features.minor_version = version[1]
-        self.features.patch_version = version[2]
-        self.features.revision = b'456'
-        self.closed = False
-
-    def close(self):
-        self.closed = True
-
-    def clear_session(self):
-        self.closed = True
-
-    def get_public_node(self, n, ecdsa_curve_name=b'secp256k1'):
-        assert not self.closed
-        assert n == ADDR
-        assert ecdsa_curve_name in {b'secp256k1', b'nist256p1'}
-        result = mock.Mock(spec=[])
-        result.node = mock.Mock(spec=[])
-        result.node.public_key = PUBKEY
-        return result
-
-    def ping(self, msg):
-        assert not self.closed
-        return msg
-
-
-class FactoryMock(object):
-
-    @staticmethod
-    def client():
-        return ConnectionMock(version=(1, 3, 4))
-
-    @staticmethod
-    def identity_type(**kwargs):
-        result = mock.Mock(spec=[])
-        result.index = 0
-        result.proto = result.user = result.host = result.port = None
-        result.path = None
-        for k, v in kwargs.items():
-            setattr(result, k, v)
-        return result
-
-
-BLOB = (b'\x00\x00\x00 \xce\xe0\xc9\xd5\xceu/\xe8\xc5\xf2\xbfR+x\xa1\xcf\xb0'
-        b'\x8e;R\xd3)m\x96\x1b\xb4\xd8s\xf1\x99\x16\xaa2\x00\x00\x00\x05roman'
-        b'\x00\x00\x00\x0essh-connection\x00\x00\x00\tpublickey'
-        b'\x01\x00\x00\x00\x13ecdsa-sha2-nistp256\x00\x00\x00h\x00\x00\x00'
-        b'\x13ecdsa-sha2-nistp256\x00\x00\x00\x08nistp256\x00\x00\x00A'
-        b'\x04\xd8(\xb5\xa6`\xbet0\x95\xac:[;]\xdc,\xbd\xdc?\xd7\xc0\xec'
-        b'\xdd\xbc+\xfar~\x9dAis4\xc1\x10yeT~\x1b\xeb\x1aX\xd1\xd9\x9f\xc21'
-        b'\x13\x8dc\xa7\xa3\x07\xefO\x9e\x95\x0e>\xec\xd8\xaa/')
-
-SIG = (b'\x00R\x19T\xf2\x84$\xef#\x0e\xee\x04X\xc6\xc3\x99T`\xd1\xd8\xf7!'
-       b'\x862@cx\xb8\xb9i@1\x1b3#\x938\x86]\x97*Y\xb2\x02Xa\xdf@\xecK'
-       b'\xdc\xf0H\xab\xa8\xac\xa7? \x8f=C\x88N\xe2')
-
-
-def test_ssh_agent():
-    label = 'localhost:22'
-    c = client.Client(factory=FactoryMock)
-    ident = c.get_identity(label=label)
-    assert ident.host == 'localhost'
-    assert ident.proto == 'ssh'
-    assert ident.port == '22'
-    assert ident.user is None
-    assert ident.path is None
-
-    with c:
-        assert c.get_public_key(label) == PUBKEY_TEXT
-
-        def ssh_sign_identity(identity, challenge_hidden,
-                              challenge_visual, ecdsa_curve_name):
-            assert challenge_hidden == BLOB
-            assert challenge_visual == identity.path
-            assert ecdsa_curve_name == b'nist256p1'
-
-            result = mock.Mock(spec=[])
-            result.public_key = PUBKEY
-            result.signature = SIG
-            return result
-
-        c.client.sign_identity = ssh_sign_identity
-        signature = c.sign_ssh_challenge(label=label, blob=BLOB)
-
-        key = formats.import_public_key(PUBKEY_TEXT)
-        assert key['verifier'](sig=signature, msg=BLOB)
-
-
-def test_utils():
-    identity = mock.Mock(spec=[])
-    identity.proto = 'https'
-    identity.user = 'user'
-    identity.host = 'host'
-    identity.port = '443'
-    identity.path = '/path'
-
-    url = 'https://user@host:443/path'
-    assert client.identity_to_string(identity) == url
-
-
-def test_old_version():
-
-    class OldFactoryMock(FactoryMock):
-
-        @staticmethod
-        def client():
-            return ConnectionMock(version=(1, 2, 3))
-
-    with pytest.raises(ValueError):
-        client.Client(factory=OldFactoryMock)

trezor_agent/tests/test_utils.py

@@ -1,47 +0,0 @@
-import io
-import pytest
-
-from .. import util
-
-
-def test_bytes2num():
-    assert util.bytes2num(b'\x12\x34') == 0x1234
-
-
-def test_num2bytes():
-    assert util.num2bytes(0x1234, size=2) == b'\x12\x34'
-
-
-def test_pack():
-    assert util.pack('BHL', 1, 2, 3) == b'\x01\x00\x02\x00\x00\x00\x03'
-
-
-def test_frames():
-    msgs = [b'aaa', b'bb', b'c' * 0x12340]
-    f = util.frame(*msgs)
-    assert f == b'\x00\x01\x23\x45' + b''.join(msgs)
-    assert util.read_frame(io.BytesIO(f)) == b''.join(msgs)
-
-
-class SocketMock(object):
-    def __init__(self):
-        self.buf = io.BytesIO()
-
-    def sendall(self, data):
-        self.buf.write(data)
-
-    def recv(self, size):
-        return self.buf.read(size)
-
-
-def test_send_recv():
-    s = SocketMock()
-    util.send(s, b'123')
-    util.send(s, data=[42], fmt='B')
-    assert s.buf.getvalue() == b'123*'
-
-    s.buf.seek(0)
-    assert util.recv(s, 2) == b'12'
-    assert util.recv(s, 2) == b'3*'
-
-    pytest.raises(EOFError, util.recv, s, 1)

trezor_agent/trezor/__init__.py

@@ -1 +0,0 @@
-from .client import Client

trezor_agent/trezor/_factory.py

@@ -1,23 +0,0 @@
-''' Thin wrapper around trezorlib. '''
-
-
-def client():
-    # pylint: disable=import-error
-    from trezorlib.client import TrezorClient
-    from trezorlib.transport_hid import HidTransport
-    from trezorlib.messages_pb2 import PassphraseAck
-
-    devices = HidTransport.enumerate()
-    if len(devices) != 1:
-        msg = '{:d} Trezor devices found'.format(len(devices))
-        raise IOError(msg)
-
-    t = TrezorClient(HidTransport(devices[0]))
-    t.callback_PassphraseRequest = lambda msg: PassphraseAck(passphrase='')
-    return t
-
-
-def identity_type(**kwargs):
-    # pylint: disable=import-error
-    from trezorlib.types_pb2 import IdentityType
-    return IdentityType(**kwargs)

trezor_agent/trezor/client.py

@@ -1,150 +0,0 @@
-import io
-import re
-import struct
-import binascii
-
-from .. import util
-from .. import formats
-from . import _factory as TrezorFactory
-
-import logging
-log = logging.getLogger(__name__)
-
-
-class Client(object):
-
-    MIN_VERSION = [1, 3, 4]
-
-    def __init__(self, factory=TrezorFactory, curve=formats.CURVE_NIST256):
-        self.curve = curve
-        self.factory = factory
-        self.client = self.factory.client()
-        f = self.client.features
-        log.debug('connected to Trezor %s', f.device_id)
-        log.debug('label    : %s', f.label)
-        log.debug('vendor   : %s', f.vendor)
-        version = [f.major_version, f.minor_version, f.patch_version]
-        version_str = '.'.join([str(v) for v in version])
-        log.debug('version  : %s', version_str)
-        log.debug('revision : %s', binascii.hexlify(f.revision))
-        if version < self.MIN_VERSION:
-            fmt = 'Please upgrade your TREZOR to v{}+ firmware'
-            version_str = '.'.join([str(v) for v in self.MIN_VERSION])
-            raise ValueError(fmt.format(version_str))
-
-    def __enter__(self):
-        msg = 'Hello World!'
-        assert self.client.ping(msg) == msg
-        return self
-
-    def __exit__(self, *args):
-        log.info('disconnected from Trezor')
-        self.client.clear_session()  # forget PIN and shutdown screen
-        self.client.close()
-
-    def get_identity(self, label):
-        identity = string_to_identity(label, self.factory.identity_type)
-        identity.proto = 'ssh'
-        return identity
-
-    def get_public_key(self, label):
-        identity = self.get_identity(label=label)
-        label = identity_to_string(identity)  # canonize key label
-        log.info('getting "%s" public key (%s) from Trezor...',
-                 label, self.curve)
-        addr = _get_address(identity)
-        node = self.client.get_public_node(n=addr,
-                                           ecdsa_curve_name=self.curve)
-
-        pubkey = node.node.public_key
-        vk = formats.decompress_pubkey(pubkey=pubkey, curve_name=self.curve)
-        return formats.export_public_key(vk=vk, label=label)
-
-    def sign_ssh_challenge(self, label, blob):
-        identity = self.get_identity(label=label)
-        msg = _parse_ssh_blob(blob)
-
-        log.info('please confirm user "%s" login to "%s" using Trezor...',
-                 msg['user'], label)
-
-        visual = identity.path  # not signed when proto='ssh'
-        result = self.client.sign_identity(identity=identity,
-                                           challenge_hidden=blob,
-                                           challenge_visual=visual,
-                                           ecdsa_curve_name=self.curve)
-
-        verifying_key = formats.decompress_pubkey(pubkey=result.public_key,
-                                                  curve_name=self.curve)
-        key_type, blob = formats.serialize_verifying_key(verifying_key)
-        assert blob == msg['public_key']['blob']
-        assert key_type == msg['key_type']
-        assert len(result.signature) == 65
-        assert result.signature[:1] == bytearray([0])
-
-        return result.signature[1:]
-
-
-_identity_regexp = re.compile(''.join([
-    '^'
-    r'(?:(?P<proto>.*)://)?',
-    r'(?:(?P<user>.*)@)?',
-    r'(?P<host>.*?)',
-    r'(?::(?P<port>\w*))?',
-    r'(?P<path>/.*)?',
-    '$'
-]))
-
-
-def string_to_identity(s, identity_type):
-    m = _identity_regexp.match(s)
-    result = m.groupdict()
-    log.debug('parsed identity: %s', result)
-    kwargs = {k: v for k, v in result.items() if v}
-    return identity_type(**kwargs)
-
-
-def identity_to_string(identity):
-    result = []
-    if identity.proto:
-        result.append(identity.proto + '://')
-    if identity.user:
-        result.append(identity.user + '@')
-    result.append(identity.host)
-    if identity.port:
-        result.append(':' + identity.port)
-    if identity.path:
-        result.append(identity.path)
-    return ''.join(result)
-
-
-def _get_address(identity):
-    index = struct.pack('<L', identity.index)
-    addr = index + identity_to_string(identity).encode('ascii')
-    log.debug('address string: %r', addr)
-    digest = formats.hashfunc(addr).digest()
-    s = io.BytesIO(bytearray(digest))
-
-    hardened = 0x80000000
-    address_n = [13] + list(util.recv(s, '<LLLL'))
-    return [(hardened | value) for value in address_n]
-
-
-def _parse_ssh_blob(data):
-    res = {}
-    if data:
-        i = io.BytesIO(data)
-        res['nonce'] = util.read_frame(i)
-        i.read(1)  # TBD
-        res['user'] = util.read_frame(i)
-        res['conn'] = util.read_frame(i)
-        res['auth'] = util.read_frame(i)
-        i.read(1)  # TBD
-        res['key_type'] = util.read_frame(i)
-        public_key = util.read_frame(i)
-        res['public_key'] = formats.parse_pubkey(public_key)
-        assert not i.read()
-        log.debug('%s: user %r via %r (%r)',
-                  res['conn'], res['user'], res['auth'], res['key_type'])
-        log.debug('nonce: %s', binascii.hexlify(res['nonce']))
-        log.debug('fingerprint: %s', res['public_key']['fingerprint'])
-    return res

trezor_agent/util.py

@@ -1,66 +0,0 @@
-import struct
-import io
-
-
-def send(conn, data, fmt=None):
-    if fmt:
-        data = struct.pack(fmt, *data)
-    conn.sendall(data)
-
-
-def recv(conn, size):
-    try:
-        fmt = size
-        size = struct.calcsize(fmt)
-    except TypeError:
-        fmt = None
-    try:
-        _read = conn.recv
-    except AttributeError:
-        _read = conn.read
-
-    res = io.BytesIO()
-    while size > 0:
-        buf = _read(size)
-        if not buf:
-            raise EOFError
-        size = size - len(buf)
-        res.write(buf)
-    res = res.getvalue()
-    if fmt:
-        return struct.unpack(fmt, res)
-    else:
-        return res
-
-
-def read_frame(conn):
-    size, = recv(conn, '>L')
-    return recv(conn, size)
-
-
-def bytes2num(s):
-    res = 0
-    for i, c in enumerate(reversed(bytearray(s))):
-        res += c << (i * 8)
-    return res
-
-
-def num2bytes(value, size):
-    res = []
-    for _ in range(size):
-        res.append(value & 0xFF)
-        value = value >> 8
-    assert value == 0
-    return bytearray(list(reversed(res)))
-
-
-def pack(fmt, *args):
-    return struct.pack('>' + fmt, *args)
-
-
-def frame(*msgs):
-    res = io.BytesIO()
-    for msg in msgs:
-        res.write(msg)
-    msg = res.getvalue()
-    return pack('L', len(msg)) + msg