mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
9f99706c26
To retrieve a secure key from EKMF Web, a Elliptic-curve Diffie-Hellman (EC-DH) protocol is used to securely transport the key, without revealing the key to be transported in clear. The key to be transported remains encrypted all the time, either encrypted with the master key of the cryptographic adapter on the source or target side, or with a transport key, that is derived using the EC-DH key agreement protocol. The transport key is also a secure key, itself encrypted with the master key of the cryptographic adapters on both sides. To generate the transport key, each side generates a new secure ECC session key with its cryptographic adapter. This session keys are then used with EC-DH to derive the secure transport key. The secure key to be transported is then exported by EKMF Web under the transport key, is sent to the client, and is then imported using the transport key. The key retrieval request is signed using the identity key of the client. EKMF Web knows the public key of the client's identity key through a one time registration process, and can therefore verify the signature with the client's public key. The response is also signed by the EKMF Web server's identity key, and the client can verify the signature with the server's public key that it retrieved once during registration. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
248 lines
8.0 KiB
C
248 lines
8.0 KiB
C
/*
|
|
* libekmfweb - EKMFWeb client library
|
|
*
|
|
* Copyright IBM Corp. 2020
|
|
*
|
|
* s390-tools is free software; you can redistribute it and/or modify
|
|
* it under the terms of the MIT license. See LICENSE for details.
|
|
*/
|
|
|
|
#ifndef CCA_H
|
|
#define CCA_H
|
|
|
|
#include <stddef.h>
|
|
#include <stdbool.h>
|
|
|
|
#include <openssl/evp.h>
|
|
|
|
#include <json-c/json.h>
|
|
|
|
#include "ekmfweb/ekmfweb.h"
|
|
|
|
/* CCA PKA Key Generate function */
|
|
typedef void (*CSNDPKG_t)(long *return_code,
|
|
long *reason_code,
|
|
long *exit_data_length,
|
|
unsigned char *exit_data,
|
|
long *rule_array_count,
|
|
unsigned char *rule_array,
|
|
long *regeneration_data_length,
|
|
unsigned char *regeneration_data,
|
|
long *skeleton_key_token_length,
|
|
unsigned char *skeleton_key_token,
|
|
unsigned char *transport_key_identifier,
|
|
long *generated_key_identifier_length,
|
|
unsigned char *generated_key_identifier);
|
|
|
|
/* CCA PKA Key Token Build function */
|
|
typedef void (*CSNDPKB_t)(long *return_code,
|
|
long *reason_code,
|
|
long *exit_data_length,
|
|
unsigned char *exit_data,
|
|
long *rule_array_count,
|
|
unsigned char *rule_array,
|
|
long *key_values_structure_length,
|
|
unsigned char *key_values_structure,
|
|
long *key_name_ln,
|
|
unsigned char *key_name,
|
|
long *reserved_1_length,
|
|
unsigned char *reserved_1,
|
|
long *reserved_2_length,
|
|
unsigned char *reserved_2,
|
|
long *reserved_3_length,
|
|
unsigned char *reserved_3,
|
|
long *reserved_4_length,
|
|
unsigned char *reserved_4,
|
|
long *reserved_5_length,
|
|
unsigned char *reserved_5,
|
|
long *token_length, unsigned char *token);
|
|
|
|
/* CCA PKA Key Token Change function */
|
|
typedef void (*CSNDKTC_t)(long *return_code,
|
|
long *reason_code,
|
|
long *exit_data_length,
|
|
unsigned char *exit_data,
|
|
long *rule_array_count,
|
|
unsigned char *rule_array,
|
|
long *key_identifier_length,
|
|
unsigned char *key_identifier);
|
|
|
|
/* CCA Digital Signature Generate function */
|
|
typedef void (*CSNDDSG_t)(long *return_code,
|
|
long *reason_code,
|
|
long *exit_data_length,
|
|
unsigned char *exit_data,
|
|
long *rule_array_count,
|
|
unsigned char *rule_array,
|
|
long *PKA_private_key_identifier_length,
|
|
unsigned char *PKA_private_key_identifier,
|
|
long *hash_length,
|
|
unsigned char *hash,
|
|
long *signature_field_length,
|
|
long *signature_bit_length,
|
|
unsigned char *signature_field);
|
|
|
|
/* CCA Key Token Build2 function */
|
|
typedef void (*CSNBKTB2_t)(long *return_code,
|
|
long *reason_code,
|
|
long *exit_data_length,
|
|
unsigned char *exit_data,
|
|
long *rule_array_count,
|
|
unsigned char *rule_array,
|
|
long *clear_key_bit_length,
|
|
unsigned char *clear_key_value,
|
|
long *key_name_length,
|
|
unsigned char *key_name,
|
|
long *user_associated_data_length,
|
|
unsigned char *user_associated_data,
|
|
long *token_data_length,
|
|
unsigned char *token_data,
|
|
long *verb_data_length,
|
|
unsigned char *verb_data,
|
|
long *target_key_token_length,
|
|
unsigned char *target_key_token);
|
|
|
|
/* CCA EC Diffie-Hellman function */
|
|
typedef void (*CSNDEDH_t)(long *return_code,
|
|
long *reason_code,
|
|
long *exit_data_length,
|
|
unsigned char *exit_data,
|
|
long *rule_array_count,
|
|
unsigned char *rule_array,
|
|
long *private_key_identifier_length,
|
|
unsigned char *private_key_identifier,
|
|
long *private_KEK_key_identifier_length,
|
|
unsigned char *private_KEK_key_identifier,
|
|
long *public_key_identifier_length,
|
|
unsigned char *public_key_identifier,
|
|
long *chaining_vector_length,
|
|
unsigned char *chaining_vector,
|
|
long *party_info_length,
|
|
unsigned char *party_info,
|
|
long *key_bit_length,
|
|
long *reserved_1_length,
|
|
unsigned char *reserved_1,
|
|
long *reserved_2_length,
|
|
unsigned char *reserved_2,
|
|
long *reserved_3_length,
|
|
unsigned char *reserved_3,
|
|
long *reserved_4_length,
|
|
unsigned char *reserved_4,
|
|
long *reserved_5_length,
|
|
unsigned char *reserved_5,
|
|
long *output_KEK_key_identifier_length,
|
|
unsigned char *output_KEK_key_identifier,
|
|
long *output_key_identifier_length,
|
|
unsigned char *output_key_identifier);
|
|
|
|
/* CCA Symmetric Key Import2 function */
|
|
typedef void (*CSNDSYI2_t)(long *return_code,
|
|
long *reason_code,
|
|
long *exit_data_length,
|
|
unsigned char *exit_data,
|
|
long *rule_array_count,
|
|
unsigned char *rule_array,
|
|
long *enciphered_key_length,
|
|
unsigned char *enciphered_key,
|
|
long *transport_key_identifier_length,
|
|
unsigned char *transport_key_identifier,
|
|
long *key_name_length,
|
|
unsigned char *key_name,
|
|
long *target_key_identifier_length,
|
|
unsigned char *target_key_identifier);
|
|
|
|
struct cca_lib {
|
|
CSNDPKB_t dll_CSNDPKB;
|
|
CSNDPKG_t dll_CSNDPKG;
|
|
CSNDKTC_t dll_CSNDKTC;
|
|
CSNDDSG_t dll_CSNDDSG;
|
|
CSNBKTB2_t dll_CSNBKTB2;
|
|
CSNDEDH_t dll_CSNDEDH;
|
|
CSNDSYI2_t dll_CSNDSYI2;
|
|
};
|
|
|
|
#define CCA_MAX_PKA_KEY_TOKEN_SIZE 3500
|
|
#define CCA_MAX_SYM_KEY_TOKEN_SIZE 725
|
|
|
|
int cca_generate_ecc_key_pair(const struct ekmf_cca_lib *cca_lib,
|
|
int curve_nid, unsigned char *key_token,
|
|
size_t *key_token_length, bool verbose);
|
|
|
|
int cca_generate_rsa_key_pair(const struct ekmf_cca_lib *cca_lib,
|
|
size_t modulus_bits, unsigned int pub_exp,
|
|
unsigned char *key_token,
|
|
size_t *key_token_length, bool verbose);
|
|
|
|
int cca_get_key_type(const unsigned char *key_token, size_t key_token_length,
|
|
int *pkey_type);
|
|
|
|
int cca_reencipher_key(const struct ekmf_cca_lib *cca_lib,
|
|
const unsigned char *key_token, size_t key_token_length,
|
|
bool to_new, bool verbose);
|
|
|
|
int cca_get_ecc_pub_key_as_pkey(const unsigned char *key_token,
|
|
size_t key_token_length,
|
|
EVP_PKEY **pkey, bool verbose);
|
|
|
|
int cca_get_ecc_pub_key_as_json_web_key(const unsigned char *key_token,
|
|
size_t key_token_length,
|
|
json_object **jwk, bool verbose);
|
|
|
|
int cca_get_rsa_pub_key_as_pkey(const unsigned char *key_token,
|
|
size_t key_token_length,
|
|
int pkey_type, EVP_PKEY **pkey, bool verbose);
|
|
|
|
int cca_import_key_from_json_web_key(const struct ekmf_cca_lib *cca_lib,
|
|
json_object *jwk, unsigned char *key_token,
|
|
size_t *key_token_length, bool verbose);
|
|
|
|
enum cca_kdf {
|
|
CCA_KDF_ANS_X9_63_CCA = 1, /* CCA DERIVE01 method */
|
|
CCA_KDF_ANS_X9_63_SHA224 = 2, /* CCA DERIVE02 method with SHA-224 */
|
|
CCA_KDF_ANS_X9_63_SHA256 = 3, /* CCA DERIVE02 method with SHA-256 */
|
|
CCA_KDF_ANS_X9_63_SHA384 = 4, /* CCA DERIVE02 method with SHA-284 */
|
|
CCA_KDF_ANS_X9_63_SHA512 = 5, /* CCA DERIVE02 method with SHA-512 */
|
|
};
|
|
|
|
int cca_ec_dh_derive_importer(const struct ekmf_cca_lib *cca_lib,
|
|
const unsigned char *priv_ecc_key_token,
|
|
size_t priv_ecc_key_token_length,
|
|
const unsigned char *pub_ecc_key_token,
|
|
size_t pub_ecc_key_token_length,
|
|
const unsigned char *party_info,
|
|
size_t party_info_length,
|
|
enum cca_kdf kdf,
|
|
unsigned char *derived_key_token,
|
|
size_t *derived_key_token_length,
|
|
bool verbose);
|
|
|
|
int cca_import_external_key(const struct ekmf_cca_lib *cca_lib,
|
|
const unsigned char *external_key_token,
|
|
size_t external_key_token_length,
|
|
const unsigned char *importer_key_token,
|
|
size_t importer_key_token_length,
|
|
unsigned char *imported_key_token,
|
|
size_t *imported_key_token_length,
|
|
bool verbose);
|
|
|
|
int cca_rsa_sign(const struct ekmf_cca_lib *cca_lib,
|
|
const unsigned char *key_token, size_t key_token_length,
|
|
unsigned char *sig, size_t *siglen,
|
|
const unsigned char *tbs, size_t tbslen,
|
|
int padding_type, int digest_nid, bool verbose);
|
|
|
|
int cca_rsa_pss_sign(const struct ekmf_cca_lib *cca_lib,
|
|
const unsigned char *key_token, size_t key_token_length,
|
|
unsigned char *sig, size_t *siglen,
|
|
const unsigned char *tbs, size_t tbslen,
|
|
int digest_nid, int mgf_digest_nid, int saltlen,
|
|
bool verbose);
|
|
|
|
int cca_ecdsa_sign(const struct ekmf_cca_lib *cca_lib,
|
|
const unsigned char *key_token, size_t key_token_length,
|
|
unsigned char *sig, size_t *siglen,
|
|
const unsigned char *tbs, size_t tbslen, int digest_nid,
|
|
bool verbose);
|
|
|
|
#endif
|