kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

libseckey: Add a secure key library

Browse Source 
The libseckey is a secure key library to perform secure key operations
with OpenSSL. It provides a framework to create OpenSSL PKEYs with a
secure key attached. Such a PKEY contains the public key parts in clear,
but the private key as secure key blob. Only the private key operations
are actually performed with the secure key, public key operations are
performed in software by OpenSSL. It supports CCA and EP11 secure
keys for RSA and ECC crypto operations.

Because many PKEY method related functions are deprecated since OpenSSL
3.0, two versions of the OpenSSL secure key support are needed. One (using
a PKEY method override) for OpenSSL 1.1.1, and another one (using an own
OpenSSL provider) for OpenSSL 3.0 and later. The desired implementation is
selected automatically at compile time, using OpenSSL version defines. The
interface of both implementations is the same, so a user does not need to
care which one is used.

Reviewed-by: Juergen Christ <jchrist@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2021-04-08 11:33:53 +02:00
committed by Jan Höppner
parent fff83fc116
commit e70cde2c5d
14 changed files with 11901 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
include/libseckey/sk_cca.h Normal file
View File

@@ -0,0 +1,48 @@
/*
* libseckey - Secure key library
*
* Copyright IBM Corp. 2021
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*/
#ifndef SK_CCA_H
#define SK_CCA_H
#include <stddef.h>
#include <stdbool.h>
#include <openssl/evp.h>
#include "libseckey/sk_openssl.h"
#define CCA_MAX_PKA_KEY_TOKEN_SIZE 3500
int SK_CCA_generate_ec_key_pair(const struct sk_ext_cca_lib *cca_lib,
int curve_nid, unsigned char *key_token,
size_t *key_token_length, bool debug);
int SK_CCA_generate_rsa_key_pair(const struct sk_ext_cca_lib *cca_lib,
size_t modulus_bits, unsigned int pub_exp,
unsigned char *key_token,
size_t *key_token_length, bool debug);
int SK_CCA_get_key_type(const unsigned char *key_token, size_t key_token_length,
int *pkey_type);
int SK_CCA_get_secure_key_as_pkey(const struct sk_ext_cca_lib *cca_lib,
const unsigned char *key_token,
size_t key_token_length,
bool rsa_pss, EVP_PKEY **pkey, bool debug);
int SK_CCA_get_public_from_secure_key(const unsigned char *key_token,
size_t key_token_length,
sk_pub_key_func_t pub_key_cb,
void *private,
bool debug);
int SK_CCA_reencipher_key(const struct sk_ext_cca_lib *cca_lib,
unsigned char *key_token, size_t key_token_length,
bool to_new, bool debug);
#endif

177
include/libseckey/sk_ep11.h Normal file
View File

@@ -0,0 +1,177 @@
/*
* libseckey - Secure key library
*
* Copyright IBM Corp. 2021
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*/
#ifndef SK_EP11_H
#define SK_EP11_H
#include <stddef.h>
#include <stdbool.h>
#include <openssl/evp.h>
#include "libseckey/sk_openssl.h"
#define EP11_MAX_KEY_TOKEN_SIZE 8192
int SK_EP11_generate_ec_key_pair(const struct sk_ext_ep11_lib *ep11_lib,
int curve_nid, unsigned char *key_token,
size_t *key_token_length, bool debug);
int SK_EP11_generate_rsa_key_pair(const struct sk_ext_ep11_lib *ep11_lib,
size_t modulus_bits, unsigned int pub_exp,
bool x9_31, unsigned char *key_token,
size_t *key_token_length, bool debug);
int SK_EP11_get_key_type(const unsigned char *key_token,
size_t key_token_length,
int *pkey_type);
const unsigned char *SK_EP11_get_key_blob(const unsigned char *key_token,
size_t key_token_length);
size_t SK_EP11_get_key_blob_size(const unsigned char *key_token,
size_t key_token_length);
int SK_EP11_get_secure_key_as_pkey(const struct sk_ext_ep11_lib *ep11_lib,
const unsigned char *key_token,
size_t key_token_length,
bool rsa_pss, EVP_PKEY **pkey, bool debug);
int SK_EP11_get_public_from_secure_key(const unsigned char *key_token,
size_t key_token_length,
sk_pub_key_func_t pub_key_cb,
void *private,
bool debug);
int SK_EP11_reencipher_key(const struct sk_ext_ep11_lib *ep11_lib,
unsigned char *key_token, size_t key_token_length,
bool debug);
/* PKCS#11 definitions */
#define CK_PTR *
typedef unsigned char CK_BYTE;
typedef CK_BYTE CK_CHAR;
typedef CK_BYTE CK_UTF8CHAR;
typedef CK_BYTE CK_BBOOL;
typedef unsigned long CK_ULONG;
typedef long CK_LONG;
typedef CK_ULONG CK_FLAGS;
typedef CK_ULONG CK_RV;
typedef CK_ULONG CK_SLOT_ID;
typedef CK_ULONG CK_MECHANISM_TYPE;
typedef CK_ULONG CK_ATTRIBUTE_TYPE;
typedef CK_ULONG CK_OBJECT_CLASS;
typedef CK_ULONG CK_KEY_TYPE;
typedef CK_ULONG CK_RSA_PKCS_OAEP_SOURCE_TYPE;
typedef CK_ULONG CK_RSA_PKCS_MGF_TYPE;
typedef CK_BYTE CK_PTR CK_BYTE_PTR;
typedef CK_CHAR CK_PTR CK_CHAR_PTR;
typedef CK_UTF8CHAR CK_PTR CK_UTF8CHAR_PTR;
typedef CK_ULONG CK_PTR CK_ULONG_PTR;
typedef void CK_PTR CK_VOID_PTR;
typedef CK_SLOT_ID CK_PTR CK_SLOT_ID_PTR;
typedef CK_MECHANISM_TYPE CK_PTR CK_MECHANISM_TYPE_PTR;
typedef CK_RSA_PKCS_MGF_TYPE CK_PTR CK_RSA_PKCS_MGF_TYPE_PTR;
typedef struct CK_MECHANISM {
CK_MECHANISM_TYPE mechanism;
CK_VOID_PTR pParameter;
CK_ULONG ulParameterLen;
} CK_MECHANISM;
typedef CK_MECHANISM CK_PTR CK_MECHANISM_PTR;
typedef struct CK_ATTRIBUTE {
CK_ATTRIBUTE_TYPE type;
CK_VOID_PTR pValue;
CK_ULONG ulValueLen;
} CK_ATTRIBUTE;
typedef CK_ATTRIBUTE CK_PTR CK_ATTRIBUTE_PTR;
typedef struct CK_RSA_PKCS_PSS_PARAMS {
CK_MECHANISM_TYPE hashAlg;
CK_RSA_PKCS_MGF_TYPE mgf;
CK_ULONG sLen;
} CK_RSA_PKCS_PSS_PARAMS;
typedef CK_RSA_PKCS_PSS_PARAMS CK_PTR CK_RSA_PKCS_PSS_PARAMS_PTR;
typedef struct CK_RSA_PKCS_OAEP_PARAMS {
CK_MECHANISM_TYPE hashAlg;
CK_RSA_PKCS_MGF_TYPE mgf;
CK_RSA_PKCS_OAEP_SOURCE_TYPE source;
CK_VOID_PTR pSourceData;
CK_ULONG ulSourceDataLen;
} CK_RSA_PKCS_OAEP_PARAMS;
typedef CK_RSA_PKCS_OAEP_PARAMS CK_PTR CK_RSA_PKCS_OAEP_PARAMS_PTR;
#define CKZ_DATA_SPECIFIED 0x00000001
#define CKG_MGF1_SHA1 0x00000001
#define CKG_MGF1_SHA224 0x00000005
#define CKG_MGF1_SHA256 0x00000002
#define CKG_MGF1_SHA384 0x00000003
#define CKG_MGF1_SHA512 0x00000004
#define CKG_VENDOR_DEFINED 0x80000000UL
#define CKG_IBM_MGF1_SHA3_224 (CKG_VENDOR_DEFINED + 1)
#define CKG_IBM_MGF1_SHA3_256 (CKG_VENDOR_DEFINED + 2)
#define CKG_IBM_MGF1_SHA3_384 (CKG_VENDOR_DEFINED + 3)
#define CKG_IBM_MGF1_SHA3_512 (CKG_VENDOR_DEFINED + 4)
#define CKR_OK 0x00000000
#define CKR_VENDOR_DEFINED 0x80000000
#define CKO_PUBLIC_KEY 0x00000002
#define CKO_PRIVATE_KEY 0x00000003
#define CKK_EC 0x00000003
#define CKM_RSA_PKCS_KEY_PAIR_GEN 0x00000000
#define CKM_RSA_PKCS 0x00000001
#define CKM_RSA_PKCS_OAEP 0x00000009
#define CKM_RSA_X9_31_KEY_PAIR_GEN 0x0000000A
#define CKM_RSA_X9_31 0x0000000B
#define CKM_RSA_PKCS_PSS 0x0000000D
#define CKM_SHA_1 0x00000220
#define CKM_SHA256 0x00000250
#define CKM_SHA224 0x00000255
#define CKM_SHA384 0x00000260
#define CKM_SHA512 0x00000270
#define CKM_SHA512_224 0x00000048
#define CKM_SHA512_256 0x0000004C
#define CKM_EC_KEY_PAIR_GEN 0x00001040
#define CKM_ECDSA 0x00001041
#define CKM_VENDOR_DEFINED 0x80000000
#define CKM_IBM_SHA3_224 (CKM_VENDOR_DEFINED + 0x00010001)
#define CKM_IBM_SHA3_256 (CKM_VENDOR_DEFINED + 0x00010002)
#define CKM_IBM_SHA3_384 (CKM_VENDOR_DEFINED + 0x00010003)
#define CKM_IBM_SHA3_512 (CKM_VENDOR_DEFINED + 0x00010004)
#define CKA_CLASS 0x00000000
#define CKA_KEY_TYPE 0x00000100
#define CKA_SENSITIVE 0x00000103
#define CKA_ENCRYPT 0x00000104
#define CKA_DECRYPT 0x00000105
#define CKA_SIGN 0x00000108
#define CKA_VERIFY 0x0000010A
#define CKA_DERIVE 0x0000010C
#define CKA_DECRYPT 0x00000105
#define CKA_WRAP 0x00000106
#define CKA_UNWRAP 0x00000107
#define CKA_MODULUS_BITS 0x00000121
#define CKA_PUBLIC_EXPONENT 0x00000122
#define CKA_EC_PARAMS 0x00000180
#endif

234
include/libseckey/sk_openssl.h Normal file
View File

@@ -0,0 +1,234 @@
/*
* libseckey - Secure key library
*
* Copyright IBM Corp. 2021
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*/
#ifndef SK_OPENSSL_H
#define SK_OPENSSL_H
#include <stddef.h>
#include <stdbool.h>
#include <openssl/evp.h>
#include <openssl/opensslv.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#ifndef OPENSSL_VERSION_PREREQ
#if defined(OPENSSL_VERSION_MAJOR) && defined(OPENSSL_VERSION_MINOR)
#define OPENSSL_VERSION_PREREQ(maj, min) \
((OPENSSL_VERSION_MAJOR << 16) + \
OPENSSL_VERSION_MINOR >= ((maj) << 16) + (min))
#else
#define OPENSSL_VERSION_PREREQ(maj, min) \
(OPENSSL_VERSION_NUMBER >= (((maj) << 28) | \
((min) << 20)))
#endif
#endif
/**
* External crypto library definitions
*/
struct sk_ext_cca_lib {
void *cca_lib; /* Handle of CCA host library loaded via dlopen */
};
typedef uint64_t target_t;
struct sk_ext_ep11_lib {
void *ep11_lib; /* Handle of EP11 host library loaded via dlopen */
target_t target; /* single or group target handle */
};
enum sk_ext_lib_type {
SK_EXT_LIB_CCA = 1,
SK_EXT_LIB_EP11 = 2,
};
struct sk_ext_lib {
enum sk_ext_lib_type type;
union {
struct sk_ext_cca_lib *cca; /* Used if type = EXT_LIB_CCA */
struct sk_ext_ep11_lib *ep11; /* Used if type = EXT_LIB_EP11 */
};
};
/*
* Secure key library initialization and termination functions
*/
int SK_OPENSSL_init(bool debug);
void SK_OPENSSL_term(void);
/*
* Secure key generation and reenciphering definitions and functions
*/
enum sk_key_type {
SK_KEY_TYPE_EC = 1,
SK_KEY_TYPE_RSA = 2,
};
struct sk_key_gen_info {
enum sk_key_type type;
union {
struct {
int curve_nid;
} ec;
struct {
size_t modulus_bits;
unsigned int pub_exp;
bool x9_31;
} rsa;
};
};
int SK_OPENSSL_generate_secure_key(unsigned char *secure_key,
size_t *secure_key_size,
const struct sk_key_gen_info *info,
const struct sk_ext_lib *ext_lib,
bool debug);
int SK_OPENSSL_reencipher_secure_key(unsigned char *secure_key,
size_t secure_key_size, bool to_new,
const struct sk_ext_lib *ext_lib,
bool debug);
/*
* Get an OpenSSL PKEY from a secure key to be used with OpenSSL.
*/
int SK_OPENSSL_get_secure_key_as_pkey(const unsigned char *secure_key,
size_t secure_key_size, bool rsa_pss,
EVP_PKEY **pkey,
const struct sk_ext_lib *ext_lib,
bool debug);
/*
* Get the public key parts from a secure key.
*/
struct sk_pub_key_info {
enum sk_key_type type;
union {
struct {
int curve_nid;
size_t prime_len;
const unsigned char *x;
const unsigned char *y;
} ec;
struct {
size_t modulus_len;
const unsigned char *modulus;
size_t pub_exp_len;
const unsigned char *pub_exp;
} rsa;
};
};
typedef int (*sk_pub_key_func_t)(const struct sk_pub_key_info *pub_key,
void *private);
int SK_OPENSSL_get_public_from_secure_key(const unsigned char *secure_key,
size_t secure_key_size,
sk_pub_key_func_t pub_key_cb,
void *private,
const struct sk_ext_lib *ext_lib,
bool debug);
/*
* Helper functions to setup a secure key sign context and to generate
* certificate signing requests or self signed certificates with the secure key
*/
struct sk_rsa_pss_params {
/*
* salt length in bytes, or OpenSSL constants
* RSA_PSS_SALTLEN_DIGEST (-1), RSA_PSS_SALTLEN_AUTO (-2), or
* RSA_PSS_SALTLEN_MAX(-3)
*/
int salt_len;
/*
* OpenSSl digest nid, or NID_undef to use the same digest algorithm
* as the signature algorithm
*/
int mgf_digest_nid;
};
int SK_OPENSSL_setup_sign_context(EVP_PKEY *pkey, bool verify, int digest_nid,
struct sk_rsa_pss_params *rsa_pss_params,
EVP_MD_CTX **md_ctx, EVP_PKEY_CTX **pkey_ctx,
bool debug);
int SK_OPENSSL_generate_csr(const unsigned char *secure_key,
size_t secure_key_size,
const char *subject_rdns[], size_t num_subject_rdns,
bool subject_utf8, const X509 *renew_cert,
const char *extensions[], size_t num_extensions,
int digest_nid,
struct sk_rsa_pss_params *rsa_pss_params,
X509_REQ **csr,
const struct sk_ext_lib *ext_lib, bool debug);
int SK_OPENSSL_generate_ss_cert(const unsigned char *secure_key,
size_t secure_key_size,
const char *subject_rdns[],
size_t num_subject_rdns, bool subject_utf8,
const X509 *renew_cert,
const char *extensions[], size_t num_extensions,
int validity_days, int digest_nid,
struct sk_rsa_pss_params *rsa_pss_params,
X509 **ss_cert,
const struct sk_ext_lib *ext_lib, bool debug);
/*
* Import secure keys as PKEY, or import clear public keys as PKEY
*/
typedef int (*sk_rsa_sign_t)(const unsigned char *key_blob,
size_t key_blob_length,
unsigned char *sig, size_t *siglen,
const unsigned char *tbs, size_t tbslen,
int padding_type, int md_nid,
void *private, bool debug);
typedef int (*sk_rsa_pss_sign_t)(const unsigned char *key_blob,
size_t key_blob_length, unsigned char *sig,
size_t *siglen, const unsigned char *tbs,
size_t tbslen, int md_nid, int mfgmd_nid,
int saltlen, void *private, bool debug);
typedef int (*sk_ecdsa_sign_t)(const unsigned char *key_blob,
size_t key_blob_length, unsigned char *sig,
size_t *siglen, const unsigned char *tbs,
size_t tbslen, int md_nid, void *private,
bool debug);
typedef int (*sk_rsa_decrypt_t)(const unsigned char *key_blob,
size_t key_blob_length,
unsigned char *to, size_t *tolen,
const unsigned char *from, size_t fromlen,
int padding_type, void *private, bool debug);
typedef int (*sk_rsa_decrypt_oaep_t)(const unsigned char *key_blob,
size_t key_blob_length,
unsigned char *to, size_t *tolen,
const unsigned char *from, size_t fromlen,
int oaep_md_nid, int mgfmd_nid,
unsigned char *label, int label_len,
void *private, bool debug);
struct sk_funcs {
sk_rsa_sign_t rsa_sign;
sk_rsa_pss_sign_t rsa_pss_sign;
sk_ecdsa_sign_t ecdsa_sign;
sk_rsa_decrypt_t rsa_decrypt;
sk_rsa_decrypt_oaep_t rsa_decrypt_oaep;
};
int SK_OPENSSL_get_pkey(const unsigned char *secure_key, size_t secure_key_size,
const struct sk_pub_key_info *pub_key, bool rsa_pss,
const struct sk_funcs *sk_funcs, const void *private,
EVP_PKEY **pkey, bool debug);
int SK_OPENSSL_get_curve_from_ec_pkey(EVP_PKEY *pkey);
#endif

89
include/libseckey/sk_utilities.h Normal file
View File

@@ -0,0 +1,89 @@
/*
* libseckey - Secure key library
*
* Copyright IBM Corp. 2021
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*/
#ifndef SK_UTILITIES_H
#define SK_UTILITIES_H
#include <stddef.h>
#include <stdbool.h>
#include <openssl/x509.h>
#include <openssl/obj_mac.h>
#include <openssl/evp.h>
#include "libseckey/sk_openssl.h"
void SK_UTIL_warnx(const char *func, const char *fmt, ...);
#define sk_debug(debug, fmt...) \
do { \
if (debug) \
SK_UTIL_warnx(__func__, fmt); \
} while (0)
/* EC curve information definitions and functions */
struct sk_ec_curve_info {
int curve_nid;
enum {
SK_EC_TYPE_PRIME = 0,
SK_EC_TYPE_BRAINPOOL = 1,
} type;
size_t prime_bits;
size_t prime_len;
const unsigned char *der; /* DER encoded OID */
size_t der_size;
};
const struct sk_ec_curve_info *SK_UTIL_ec_get_curve_info(int curve_nid);
int SK_UTIL_ec_get_prime_curve_by_prime_bits(size_t prime_bits);
int SK_UTIL_ec_get_brainpool_curve_by_prime_bits(size_t prime_bits);
int SK_UTIL_ec_calculate_y_coordinate(int nid, size_t prime_len,
const unsigned char *x, int y_bit,
unsigned char *y);
/* Digest information definitions and functions */
struct sk_digest_info {
int digest_nid;
size_t digest_size;
const char *cca_keyword;
const unsigned char *der; /* DER encoded SEQ of OID and OCT-STRING */
size_t der_size;
unsigned long pkcs11_mech;
unsigned long pkcs11_mgf;
unsigned char x9_31_md; /* X9.31 digest identifier */
};
const struct sk_digest_info *SK_UTIL_get_digest_info(int digest_nid);
/* Helper functions for certificate and CSR handling */
int SK_UTIL_build_subject_name(X509_NAME **name, const char *rdns[],
size_t num_rdns, bool utf8);
int SK_UTIL_build_certificate_extensions(X509 *cert, X509_REQ *req,
const char *exts[], size_t num_exts,
const STACK_OF(X509_EXTENSION)
*addl_exts);
int SK_UTIL_generate_x509_serial_number(X509 *cert, size_t sn_bit_size);
int SK_UTIL_build_ecdsa_signature(const unsigned char *raw_sig,
size_t raw_sig_len,
unsigned char *sig, size_t *sig_len);
/* Functions to read and write keys, certificates, requests, etc. */
int SK_UTIL_read_x509_certificate(const char *pem_filename, X509 **cert);
int SK_UTIL_write_x509_certificate(const char *pem_filename, X509 *cert);
int SK_UTIL_write_x509_request(const char *pem_filename, X509_REQ *req,
bool new_hdr);
int SK_UTIL_read_key_blob(const char *filename, unsigned char *key_blob,
size_t *key_blob_len);
int SK_UTIL_write_key_blob(const char *filename, unsigned char *key_blob,
size_t key_blob_len);
int SK_UTIL_read_public_key(const char *pem_filename, EVP_PKEY **pkey);
int SK_UTIL_write_public_key(const char *pem_filename, EVP_PKEY *pkey);
#endif