2 * Code for PuTTY to import and export private key files in other
3 * SSH clients' formats.
14 #define PUT_32BIT(cp, value) do { \
16 (cp)[2] = (value) >> 8; \
17 (cp)[1] = (value) >> 16; \
18 (cp)[0] = (value) >> 24; } while (0)
20 #define GET_32BIT(cp) \
21 (((unsigned long)(unsigned char)(cp)[0] << 24) | \
22 ((unsigned long)(unsigned char)(cp)[1] << 16) | \
23 ((unsigned long)(unsigned char)(cp)[2] << 8) | \
24 ((unsigned long)(unsigned char)(cp)[3]))
26 int openssh_encrypted(char *filename);
27 struct ssh2_userkey *openssh_read(char *filename, char *passphrase);
29 int sshcom_encrypted(char *filename, char **comment);
30 struct ssh2_userkey *sshcom_read(char *filename, char *passphrase);
33 * Given a key type, determine whether we know how to import it.
35 int import_possible(int type)
37 if (type == SSH_KEYTYPE_OPENSSH)
39 if (type == SSH_KEYTYPE_SSHCOM)
45 * Given a key type, determine what native key type
46 * (SSH_KEYTYPE_SSH1 or SSH_KEYTYPE_SSH2) it will come out as once
49 int import_target_type(int type)
52 * There are no known foreign SSH1 key formats.
54 return SSH_KEYTYPE_SSH2;
58 * Determine whether a foreign key is encrypted.
60 int import_encrypted(char *filename, int type, char **comment)
62 if (type == SSH_KEYTYPE_OPENSSH) {
63 *comment = filename; /* OpenSSH doesn't do key comments */
64 return openssh_encrypted(filename);
66 if (type == SSH_KEYTYPE_SSHCOM) {
67 return sshcom_encrypted(filename, comment);
75 int import_ssh1(char *filename, int type, struct RSAKey *key, char *passphrase)
83 struct ssh2_userkey *import_ssh2(char *filename, int type, char *passphrase)
85 if (type == SSH_KEYTYPE_OPENSSH)
86 return openssh_read(filename, passphrase);
87 if (type == SSH_KEYTYPE_SSHCOM)
88 return sshcom_read(filename, passphrase);
92 /* ----------------------------------------------------------------------
93 * Helper routines. (The base64 ones are defined in sshpubk.c.)
96 #define isbase64(c) ( ((c) >= 'A' && (c) <= 'Z') || \
97 ((c) >= 'a' && (c) <= 'z') || \
98 ((c) >= '0' && (c) <= '9') || \
99 (c) == '+' || (c) == '/' || (c) == '=' \
102 extern int base64_decode_atom(char *atom, unsigned char *out);
103 extern int base64_lines(int datalen);
104 extern void base64_encode_atom(unsigned char *data, int n, char *out);
105 extern void base64_encode(FILE * fp, unsigned char *data, int datalen);
108 * Read an ASN.1/BER identifier and length pair.
110 * Flags are a combination of the #defines listed below.
112 * Returns -1 if unsuccessful; otherwise returns the number of
113 * bytes used out of the source data.
116 /* ASN.1 tag classes. */
117 #define ASN1_CLASS_UNIVERSAL (0 << 6)
118 #define ASN1_CLASS_APPLICATION (1 << 6)
119 #define ASN1_CLASS_CONTEXT_SPECIFIC (2 << 6)
120 #define ASN1_CLASS_PRIVATE (3 << 6)
121 #define ASN1_CLASS_MASK (3 << 6)
123 /* Primitive versus constructed bit. */
124 #define ASN1_CONSTRUCTED (1 << 5)
126 int ber_read_id_len(void *source, int sourcelen,
127 int *id, int *length, int *flags)
129 unsigned char *p = (unsigned char *) source;
134 *flags = (*p & 0xE0);
135 if ((*p & 0x1F) == 0x1F) {
138 *id = (*id << 7) | (*p & 0x7F);
143 *id = (*id << 7) | (*p & 0x7F);
160 *length = (*length << 8) | (*p++);
167 return p - (unsigned char *) source;
170 static int put_string(void *target, void *data, int len)
172 unsigned char *d = (unsigned char *)target;
175 memcpy(d+4, data, len);
179 static int put_mp(void *target, void *data, int len)
181 unsigned char *d = (unsigned char *)target;
182 unsigned char *i = (unsigned char *)data;
187 memcpy(d+5, data, len);
191 memcpy(d+4, data, len);
196 /* ----------------------------------------------------------------------
197 * Code to read OpenSSH private keys.
200 enum { OSSH_DSA, OSSH_RSA };
205 unsigned char *keyblob;
206 int keyblob_len, keyblob_size;
209 struct openssh_key *load_openssh_key(char *filename)
211 struct openssh_key *ret;
217 ret = smalloc(sizeof(*ret));
219 ret->keyblob_len = ret->keyblob_size = 0;
221 memset(ret->iv, 0, sizeof(ret->iv));
223 fp = fopen(filename, "r");
225 errmsg = "Unable to open key file";
228 if (!fgets(buffer, sizeof(buffer), fp) ||
229 0 != strncmp(buffer, "-----BEGIN ", 11) ||
230 0 != strcmp(buffer+strlen(buffer)-17, "PRIVATE KEY-----\n")) {
231 errmsg = "File does not begin with OpenSSH key header";
234 if (!strcmp(buffer, "-----BEGIN RSA PRIVATE KEY-----\n"))
235 ret->type = OSSH_RSA;
236 else if (!strcmp(buffer, "-----BEGIN DSA PRIVATE KEY-----\n"))
237 ret->type = OSSH_DSA;
239 errmsg = "Unrecognised key type";
245 if (!fgets(buffer, sizeof(buffer), fp)) {
246 errmsg = "Unexpected end of file";
249 if (0 == strncmp(buffer, "-----END ", 9) &&
250 0 == strcmp(buffer+strlen(buffer)-17, "PRIVATE KEY-----\n"))
252 if ((p = strchr(buffer, ':')) != NULL) {
254 errmsg = "Header found in body of key data";
258 while (*p && isspace((unsigned char)*p)) p++;
259 if (!strcmp(buffer, "Proc-Type")) {
260 if (p[0] != '4' || p[1] != ',') {
261 errmsg = "Proc-Type is not 4 (only 4 is supported)";
265 if (!strcmp(p, "ENCRYPTED\n"))
267 } else if (!strcmp(buffer, "DEK-Info")) {
270 if (strncmp(p, "DES-EDE3-CBC,", 13)) {
271 errmsg = "Ciphers other than DES-EDE3-CBC not supported";
275 for (i = 0; i < 8; i++) {
276 if (1 != sscanf(p, "%2x", &j))
282 errmsg = "Expected 16-digit iv in DEK-Info";
290 while (isbase64(p[0]) && isbase64(p[1]) &&
291 isbase64(p[2]) && isbase64(p[3])) {
293 unsigned char out[3];
295 len = base64_decode_atom(p, out);
298 errmsg = "Invalid base64 encoding";
302 if (ret->keyblob_len + len > ret->keyblob_size) {
303 ret->keyblob_size = ret->keyblob_len + len + 256;
304 ret->keyblob = srealloc(ret->keyblob, ret->keyblob_size);
307 memcpy(ret->keyblob + ret->keyblob_len, out, len);
308 ret->keyblob_len += len;
314 errmsg = "base64 characters left at end of line";
320 if (ret->keyblob_len == 0 || !ret->keyblob) {
321 errmsg = "Key body not present";
325 if (ret->encrypted && ret->keyblob_len % 8 != 0) {
326 errmsg = "Encrypted key blob is not a multiple of cipher block size";
334 if (ret->keyblob) sfree(ret->keyblob);
340 int openssh_encrypted(char *filename)
342 struct openssh_key *key = load_openssh_key(filename);
347 ret = key->encrypted;
353 struct ssh2_userkey *openssh_read(char *filename, char *passphrase)
355 struct openssh_key *key = load_openssh_key(filename);
356 struct ssh2_userkey *retkey;
358 int ret, id, len, flags;
360 struct ssh2_userkey *retval = NULL;
363 int blobptr, privptr;
370 if (key->encrypted) {
372 * Derive encryption key from passphrase and iv/salt:
374 * - let block A equal MD5(passphrase || iv)
375 * - let block B equal MD5(A || passphrase || iv)
376 * - block C would be MD5(B || passphrase || iv) and so on
377 * - encryption key is the first N bytes of A || B
379 struct MD5Context md5c;
380 unsigned char keybuf[32];
383 MD5Update(&md5c, passphrase, strlen(passphrase));
384 MD5Update(&md5c, key->iv, 8);
385 MD5Final(keybuf, &md5c);
388 MD5Update(&md5c, keybuf, 16);
389 MD5Update(&md5c, passphrase, strlen(passphrase));
390 MD5Update(&md5c, key->iv, 8);
391 MD5Final(keybuf+16, &md5c);
394 * Now decrypt the key blob.
396 des3_decrypt_pubkey_ossh(keybuf, key->iv,
397 key->keyblob, key->keyblob_len);
401 * Now we have a decrypted key blob, which contains an ASN.1
402 * encoded private key. We must now untangle the ASN.1.
404 * We expect the whole key blob to be formatted as a SEQUENCE
405 * (0x30 followed by a length code indicating that the rest of
406 * the blob is part of the sequence). Within that SEQUENCE we
407 * expect to see a bunch of INTEGERs. What those integers mean
408 * depends on the key type:
410 * - For RSA, we expect the integers to be 0, n, e, d, p, q,
411 * dmp1, dmq1, iqmp in that order. (The last three are d mod
412 * (p-1), d mod (q-1), inverse of q mod p respectively.)
414 * - For DSA, we expect them to be 0, p, q, g, y, x in that
420 /* Expect the SEQUENCE header. Take its absence as a failure to decrypt. */
421 ret = ber_read_id_len(p, key->keyblob_len, &id, &len, &flags);
423 if (ret < 0 || id != 16) {
424 errmsg = "ASN.1 decoding failure";
425 retval = SSH2_WRONG_PASSPHRASE;
429 /* Expect a load of INTEGERs. */
430 if (key->type == OSSH_RSA)
432 else if (key->type == OSSH_DSA)
436 * Space to create key blob in.
438 blob = smalloc(256+key->keyblob_len);
440 if (key->type == OSSH_DSA)
441 memcpy(blob+4, "ssh-dss", 7);
442 else if (key->type == OSSH_RSA)
443 memcpy(blob+4, "ssh-rsa", 7);
447 for (i = 0; i < num_integers; i++) {
448 ret = ber_read_id_len(p, key->keyblob+key->keyblob_len-p,
451 if (ret < 0 || id != 2 ||
452 key->keyblob+key->keyblob_len-p < len) {
453 errmsg = "ASN.1 decoding failure";
459 * The first integer should be zero always (I think
460 * this is some sort of version indication).
462 if (len != 1 || p[0] != 0) {
463 errmsg = "Version number mismatch";
466 } else if (key->type == OSSH_RSA) {
468 * Integers 1 and 2 go into the public blob but in the
469 * opposite order; integers 3, 4, 5 and 8 go into the
470 * private blob. The other two (6 and 7) are ignored.
473 /* Save the details for after we deal with number 2. */
476 } else if (i != 6 && i != 7) {
477 PUT_32BIT(blob+blobptr, len);
478 memcpy(blob+blobptr+4, p, len);
481 PUT_32BIT(blob+blobptr, modlen);
482 memcpy(blob+blobptr+4, modptr, modlen);
487 } else if (key->type == OSSH_DSA) {
489 * Integers 1-4 go into the public blob; integer 5 goes
490 * into the private blob.
492 PUT_32BIT(blob+blobptr, len);
493 memcpy(blob+blobptr+4, p, len);
499 /* Skip past the number. */
504 * Now put together the actual key. Simplest way to do this is
505 * to assemble our own key blobs and feed them to the createkey
506 * functions; this is a bit faffy but it does mean we get all
507 * the sanity checks for free.
509 assert(privptr > 0); /* should have bombed by now if not */
510 retkey = smalloc(sizeof(struct ssh2_userkey));
511 retkey->alg = (key->type == OSSH_RSA ? &ssh_rsa : &ssh_dss);
512 retkey->data = retkey->alg->createkey(blob, privptr,
513 blob+privptr, blobptr-privptr);
516 errmsg = "unable to create key data structure";
520 retkey->comment = dupstr("imported-openssh-key");
521 if (blob) sfree(blob);
527 if (blob) sfree(blob);
533 /* ----------------------------------------------------------------------
534 * Code to read ssh.com private keys.
538 * The format of the base64 blob is largely ssh2-packet-formatted,
539 * except that mpints are a bit different: they're more like the
540 * old ssh1 mpint. You have a 32-bit bit count N, followed by
541 * (N+7)/8 bytes of data.
543 * So. The blob contains:
545 * - uint32 0x3f6ff9eb (magic number)
546 * - uint32 size (total blob size)
547 * - string key-type (see below)
548 * - string cipher-type (tells you if key is encrypted)
549 * - string encrypted-blob
551 * (The first size field includes the size field itself and the
552 * magic number before it. All other size fields are ordinary ssh2
553 * strings, so the size field indicates how much data is to
556 * The encrypted blob, once decrypted, contains a single string
557 * which in turn contains the payload. (This allows padding to be
558 * added after that string while still making it clear where the
559 * real payload ends. Also it probably makes for a reasonable
562 * The payload blob, for an RSA key, contains:
565 * - mpint n (yes, the public and private stuff is intermixed)
566 * - mpint u (presumably inverse of p mod q)
567 * - mpint p (p is the smaller prime)
568 * - mpint q (q is the larger)
570 * For a DSA key, the payload blob contains:
578 * Alternatively, if the parameters are `predefined', that
579 * (0,p,g,q) sequence can be replaced by a uint32 1 and a string
580 * containing some predefined parameter specification. *shudder*,
581 * but I doubt we'll encounter this in real life.
583 * The key type strings are ghastly. The RSA key I looked at had a
586 * `if-modn{sign{rsa-pkcs1-sha1},encrypt{rsa-pkcs1v2-oaep}}'
588 * and the DSA key wasn't much better:
590 * `dl-modp{sign{dsa-nist-sha1},dh{plain}}'
592 * It isn't clear that these will always be the same. I think it
593 * might be wise just to look at the `if-modn{sign{rsa' and
594 * `dl-modp{sign{dsa' prefixes.
596 * Finally, the encryption. The cipher-type string appears to be
597 * either `none' or `3des-cbc'. Looks as if this is SSH2-style
598 * 3des-cbc (i.e. outer cbc rather than inner). The key is created
599 * from the passphrase by means of yet another hashing faff:
601 * - first 16 bytes are MD5(passphrase)
602 * - next 16 bytes are MD5(passphrase || first 16 bytes)
603 * - if there were more, they'd be MD5(passphrase || first 32),
608 char comment[256]; /* allowing any length is overkill */
609 unsigned char *keyblob;
610 int keyblob_len, keyblob_size;
613 struct sshcom_key *load_sshcom_key(char *filename)
615 struct sshcom_key *ret;
622 int base64_chars = 0;
624 ret = smalloc(sizeof(*ret));
625 ret->comment[0] = '\0';
627 ret->keyblob_len = ret->keyblob_size = 0;
629 fp = fopen(filename, "r");
631 errmsg = "Unable to open key file";
634 if (!fgets(buffer, sizeof(buffer), fp) ||
635 0 != strcmp(buffer, "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----\n")) {
636 errmsg = "File does not begin with ssh.com key header";
642 if (!fgets(buffer, sizeof(buffer), fp)) {
643 errmsg = "Unexpected end of file";
646 if (!strcmp(buffer, "---- END SSH2 ENCRYPTED PRIVATE KEY ----\n"))
648 if ((p = strchr(buffer, ':')) != NULL) {
650 errmsg = "Header found in body of key data";
654 while (*p && isspace((unsigned char)*p)) p++;
656 * Header lines can end in a trailing backslash for
659 while ((len = strlen(p)) > sizeof(buffer) - (p-buffer) -1 ||
660 p[len-1] != '\n' || p[len-2] == '\\') {
661 if (len > (p-buffer) + sizeof(buffer)-2) {
662 errmsg = "Header line too long to deal with";
665 if (!fgets(p+len-2, sizeof(buffer)-(p-buffer)-(len-2), fp)) {
666 errmsg = "Unexpected end of file";
670 p[strcspn(p, "\n")] = '\0';
671 if (!strcmp(buffer, "Comment")) {
672 /* Strip quotes in comment if present. */
673 if (p[0] == '"' && p[strlen(p)-1] == '"') {
675 p[strlen(p)-1] = '\0';
677 strncpy(ret->comment, p, sizeof(ret->comment));
678 ret->comment[sizeof(ret->comment)-1] = '\0';
684 while (isbase64(*p)) {
685 base64_bit[base64_chars++] = *p;
686 if (base64_chars == 4) {
687 unsigned char out[3];
691 len = base64_decode_atom(base64_bit, out);
694 errmsg = "Invalid base64 encoding";
698 if (ret->keyblob_len + len > ret->keyblob_size) {
699 ret->keyblob_size = ret->keyblob_len + len + 256;
700 ret->keyblob = srealloc(ret->keyblob, ret->keyblob_size);
703 memcpy(ret->keyblob + ret->keyblob_len, out, len);
704 ret->keyblob_len += len;
712 if (ret->keyblob_len == 0 || !ret->keyblob) {
713 errmsg = "Key body not present";
721 if (ret->keyblob) sfree(ret->keyblob);
727 int sshcom_encrypted(char *filename, char **comment)
729 struct sshcom_key *key = load_sshcom_key(filename);
730 int pos, len, answer;
737 * Check magic number.
739 if (GET_32BIT(key->keyblob) != 0x3f6ff9eb)
740 return 0; /* key is invalid */
743 * Find the cipher-type string.
747 if (key->keyblob_len < pos+4)
748 goto done; /* key is far too short */
749 pos += 4 + GET_32BIT(key->keyblob + pos); /* skip key type */
750 if (key->keyblob_len < pos+4)
751 goto done; /* key is far too short */
752 len = GET_32BIT(key->keyblob + pos); /* find cipher-type length */
753 if (key->keyblob_len < pos+4+len)
754 goto done; /* cipher type string is incomplete */
755 if (len != 4 || 0 != memcmp(key->keyblob + pos + 4, "none", 4))
759 *comment = dupstr(key->comment);
765 struct mpint_pos { void *start; int bytes; };
767 int sshcom_read_mpint(void *data, int len, struct mpint_pos *ret)
771 unsigned char *d = (unsigned char *) data;
777 bytes = (bits + 7) / 8;
788 return len; /* ensure further calls fail as well */
791 struct ssh2_userkey *sshcom_read(char *filename, char *passphrase)
793 struct sshcom_key *key = load_sshcom_key(filename);
796 const char prefix_rsa[] = "if-modn{sign{rsa";
797 const char prefix_dsa[] = "dl-modp{sign{dsa";
798 enum { RSA, DSA } type;
802 struct ssh2_userkey *ret = NULL, *retkey;
803 const struct ssh_signkey *alg;
804 unsigned char *blob = NULL;
811 * Check magic number.
813 if (GET_32BIT(key->keyblob) != 0x3f6ff9eb) {
814 errmsg = "Key does not begin with magic number";
819 * Determine the key type.
822 if (key->keyblob_len < pos+4 ||
823 (len = GET_32BIT(key->keyblob + pos)) > key->keyblob_len - pos - 4) {
824 errmsg = "Key blob does not contain a key type string";
827 if (len > sizeof(prefix_rsa) - 1 &&
828 !memcmp(key->keyblob+pos+4, prefix_rsa, sizeof(prefix_rsa) - 1)) {
830 } else if (len > sizeof(prefix_dsa) - 1 &&
831 !memcmp(key->keyblob+pos+4, prefix_dsa, sizeof(prefix_dsa) - 1)) {
834 errmsg = "Key is of unknown type";
840 * Determine the cipher type.
842 if (key->keyblob_len < pos+4 ||
843 (len = GET_32BIT(key->keyblob + pos)) > key->keyblob_len - pos - 4) {
844 errmsg = "Key blob does not contain a cipher type string";
847 if (len == 4 && !memcmp(key->keyblob+pos+4, "none", 4))
849 else if (len == 8 && !memcmp(key->keyblob+pos+4, "3des-cbc", 8))
852 errmsg = "Key encryption is of unknown type";
858 * Get hold of the encrypted part of the key.
860 if (key->keyblob_len < pos+4 ||
861 (len = GET_32BIT(key->keyblob + pos)) > key->keyblob_len - pos - 4) {
862 errmsg = "Key blob does not contain actual key data";
865 ciphertext = key->keyblob + pos + 4;
867 if (cipherlen == 0) {
868 errmsg = "Length of key data is zero";
873 * Decrypt it if necessary.
877 * Derive encryption key from passphrase and iv/salt:
879 * - let block A equal MD5(passphrase)
880 * - let block B equal MD5(passphrase || A)
881 * - block C would be MD5(passphrase || A || B) and so on
882 * - encryption key is the first N bytes of A || B
884 struct MD5Context md5c;
885 unsigned char keybuf[32], iv[8];
887 if (cipherlen % 8 != 0) {
888 errmsg = "Encrypted part of key is not a multiple of cipher block"
894 MD5Update(&md5c, passphrase, strlen(passphrase));
895 MD5Final(keybuf, &md5c);
898 MD5Update(&md5c, passphrase, strlen(passphrase));
899 MD5Update(&md5c, keybuf, 16);
900 MD5Final(keybuf+16, &md5c);
903 * Now decrypt the key blob.
906 des3_decrypt_pubkey_ossh(keybuf, iv, ciphertext, cipherlen);
909 * Hereafter we return WRONG_PASSPHRASE for any parsing
910 * error. (But not if we haven't just tried to decrypt it!)
913 ret = SSH2_WRONG_PASSPHRASE;
917 * Strip away the containing string to get to the real meat.
919 len = GET_32BIT(ciphertext);
920 if (len > cipherlen-4) {
921 errmsg = "containing string was ill-formed";
928 * Now we break down into RSA versus DSA. In either case we'll
929 * construct public and private blobs in our own format, and
930 * end up feeding them to alg->createkey().
932 blob = smalloc(cipherlen + 256);
935 struct mpint_pos n, e, d, u, p, q;
937 pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &e);
938 pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &d);
939 pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &n);
940 pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &u);
941 pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &p);
942 pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &q);
944 errmsg = "key data did not contain six integers";
950 pos += put_string(blob+pos, "ssh-rsa", 7);
951 pos += put_mp(blob+pos, e.start, e.bytes);
952 pos += put_mp(blob+pos, n.start, n.bytes);
954 pos += put_string(blob+pos, d.start, d.bytes);
955 pos += put_mp(blob+pos, q.start, q.bytes);
956 pos += put_mp(blob+pos, p.start, p.bytes);
957 pos += put_mp(blob+pos, u.start, u.bytes);
958 privlen = pos - publen;
959 } else if (type == DSA) {
960 struct mpint_pos p, q, g, x, y;
962 if (GET_32BIT(ciphertext) != 0) {
963 errmsg = "predefined DSA parameters not supported";
966 pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &p);
967 pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &g);
968 pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &q);
969 pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &y);
970 pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &x);
972 errmsg = "key data did not contain five integers";
978 pos += put_string(blob+pos, "ssh-dss", 7);
979 pos += put_mp(blob+pos, p.start, p.bytes);
980 pos += put_mp(blob+pos, q.start, q.bytes);
981 pos += put_mp(blob+pos, g.start, g.bytes);
982 pos += put_mp(blob+pos, y.start, y.bytes);
984 pos += put_mp(blob+pos, x.start, x.bytes);
985 privlen = pos - publen;
988 assert(privlen > 0); /* should have bombed by now if not */
990 retkey = smalloc(sizeof(struct ssh2_userkey));
992 retkey->data = alg->createkey(blob, publen, blob+publen, privlen);
995 errmsg = "unable to create key data structure";
998 retkey->comment = dupstr(key->comment);
1000 errmsg = NULL; /* no error */
1004 if (blob) sfree(blob);
1005 sfree(key->keyblob);