kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

libekmfweb: Generate an identity key

Browse Source 
To identify the client with EKMF Web, the client generates a secure
ECC or RSA identity key. This identity key is then used to
cryptographically sign certain requests sent to EKMF Web.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2020-04-07 17:42:38 +02:00
committed by Jan Höppner
parent d8089e69fa
commit 5fb30f1e6f
8 changed files with 796 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/ekmfweb/ekmfweb.h
+58
View File
@@ -48,6 +48,25 @@ struct ekmf_config {
/** File name of the login token (JSON Web Token) used for the last
* login. */
const char *login_token;
/** File name of a file containing the client identity secure key blob.
* This key represents the client identity against EKMFWeb. Some
* requests sent to EKMFWeb are signed with this (secure) key */
const char *identity_secure_key;
};
struct ekmf_cca_lib {
void *cca_lib; /* Handle of CCA host library loaded via dlopen */
};
enum ekmf_ext_lib_type {
EKMF_EXT_LIB_CCA = 1,
};
struct ekmf_ext_lib {
enum ekmf_ext_lib_type type;
union {
struct ekmf_cca_lib *cca; /* Used if type = EKMF_EXT_LIB_CCA */
};
};
/**
@@ -112,4 +131,43 @@ int ekmf_print_certificates(const char *cert_pem, bool verbose);
int ekmf_check_login_token(const struct ekmf_config *config, bool *valid,
char **login_token, bool verbose);
enum ekmf_key_type {
EKMF_KEY_TYPE_ECC = 1,
EKMF_KEY_TYPE_RSA = 2,
};
struct ekmf_key_gen_info {
enum ekmf_key_type type;
union {
struct {
int curve_nid;
} ecc;
struct {
size_t modulus_bits;
unsigned int pub_exp;
} rsa;
} params;
};
/**
* Generate a secure identity key used to identify the client to EKMFWeb.
* The secure key blob is stored in a file specified in field
* identity_secure_key of the config structure. If an secure key already exists
* at that location, it is overwritten.
*
* @param config the configuration structure. Only field
* identity_secure_key must be specified, all others
* are optional.
* @param info key generation info, such as key type (ECC or RSA)
* and key parameters.
* @param ext_lib External secure key crypto library to use
* @param verbose if true, verbose messages are printed
*
* @returns a negative errno in case of an error, 0 if success.
*/
int ekmf_generate_identity_key(const struct ekmf_config *config,
const struct ekmf_key_gen_info *info,
const struct ekmf_ext_lib *ext_lib,
bool verbose);
#endif