mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
Ingo Franzki
8137128a96
To identify the client with EKMF Web, an X.509 certificate must be generated using the identity key, and must be made known to EKMF Web. Either a self signed certificate can be generated, or a certificate signing request (CSR) that is then passed to a certificate authority (CA) to have a certificate issued. The certificate is then used to register the client with EKMF Web, so that EKMF Web knows the public part of the client's identity key. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
136 lines
4.1 KiB
C
136 lines
4.1 KiB
C
/*
|
|
* libekmfweb - EKMFWeb client library
|
|
*
|
|
* Copyright IBM Corp. 2020
|
|
*
|
|
* s390-tools is free software; you can redistribute it and/or modify
|
|
* it under the terms of the MIT license. See LICENSE for details.
|
|
*/
|
|
|
|
#ifndef CCA_H
|
|
#define CCA_H
|
|
|
|
#include <stddef.h>
|
|
#include <stdbool.h>
|
|
|
|
#include <openssl/evp.h>
|
|
|
|
#include "ekmfweb/ekmfweb.h"
|
|
|
|
/* CCA PKA Key Generate function */
|
|
typedef void (*CSNDPKG_t)(long *return_code,
|
|
long *reason_code,
|
|
long *exit_data_length,
|
|
unsigned char *exit_data,
|
|
long *rule_array_count,
|
|
unsigned char *rule_array,
|
|
long *regeneration_data_length,
|
|
unsigned char *regeneration_data,
|
|
long *skeleton_key_token_length,
|
|
unsigned char *skeleton_key_token,
|
|
unsigned char *transport_key_identifier,
|
|
long *generated_key_identifier_length,
|
|
unsigned char *generated_key_identifier);
|
|
|
|
/* CCA PKA Key Token Build function */
|
|
typedef void (*CSNDPKB_t)(long *return_code,
|
|
long *reason_code,
|
|
long *exit_data_length,
|
|
unsigned char *exit_data,
|
|
long *rule_array_count,
|
|
unsigned char *rule_array,
|
|
long *key_values_structure_length,
|
|
unsigned char *key_values_structure,
|
|
long *key_name_ln,
|
|
unsigned char *key_name,
|
|
long *reserved_1_length,
|
|
unsigned char *reserved_1,
|
|
long *reserved_2_length,
|
|
unsigned char *reserved_2,
|
|
long *reserved_3_length,
|
|
unsigned char *reserved_3,
|
|
long *reserved_4_length,
|
|
unsigned char *reserved_4,
|
|
long *reserved_5_length,
|
|
unsigned char *reserved_5,
|
|
long *token_length, unsigned char *token);
|
|
|
|
/* CCA PKA Key Token Change function */
|
|
typedef void (*CSNDKTC_t)(long *return_code,
|
|
long *reason_code,
|
|
long *exit_data_length,
|
|
unsigned char *exit_data,
|
|
long *rule_array_count,
|
|
unsigned char *rule_array,
|
|
long *key_identifier_length,
|
|
unsigned char *key_identifier);
|
|
|
|
/* CCA Digital Signature Generate function */
|
|
typedef void (*CSNDDSG_t)(long *return_code,
|
|
long *reason_code,
|
|
long *exit_data_length,
|
|
unsigned char *exit_data,
|
|
long *rule_array_count,
|
|
unsigned char *rule_array,
|
|
long *PKA_private_key_identifier_length,
|
|
unsigned char *PKA_private_key_identifier,
|
|
long *hash_length,
|
|
unsigned char *hash,
|
|
long *signature_field_length,
|
|
long *signature_bit_length,
|
|
unsigned char *signature_field);
|
|
|
|
struct cca_lib {
|
|
CSNDPKB_t dll_CSNDPKB;
|
|
CSNDPKG_t dll_CSNDPKG;
|
|
CSNDKTC_t dll_CSNDKTC;
|
|
CSNDDSG_t dll_CSNDDSG;
|
|
};
|
|
|
|
#define CCA_MAX_PKA_KEY_TOKEN_SIZE 3500
|
|
|
|
int cca_generate_ecc_key_pair(const struct ekmf_cca_lib *cca_lib,
|
|
int curve_nid, unsigned char *key_token,
|
|
size_t *key_token_length, bool verbose);
|
|
|
|
int cca_generate_rsa_key_pair(const struct ekmf_cca_lib *cca_lib,
|
|
size_t modulus_bits, unsigned int pub_exp,
|
|
unsigned char *key_token,
|
|
size_t *key_token_length, bool verbose);
|
|
|
|
int cca_get_key_type(const unsigned char *key_token, size_t key_token_length,
|
|
int *pkey_type);
|
|
|
|
int cca_reencipher_key(const struct ekmf_cca_lib *cca_lib,
|
|
const unsigned char *key_token, size_t key_token_length,
|
|
bool to_new, bool verbose);
|
|
|
|
int cca_get_ecc_pub_key_as_pkey(const unsigned char *key_token,
|
|
size_t key_token_length,
|
|
EVP_PKEY **pkey, bool verbose);
|
|
|
|
int cca_get_rsa_pub_key_as_pkey(const unsigned char *key_token,
|
|
size_t key_token_length,
|
|
int pkey_type, EVP_PKEY **pkey, bool verbose);
|
|
|
|
int cca_rsa_sign(const struct ekmf_cca_lib *cca_lib,
|
|
const unsigned char *key_token, size_t key_token_length,
|
|
unsigned char *sig, size_t *siglen,
|
|
const unsigned char *tbs, size_t tbslen,
|
|
int padding_type, int digest_nid, bool verbose);
|
|
|
|
int cca_rsa_pss_sign(const struct ekmf_cca_lib *cca_lib,
|
|
const unsigned char *key_token, size_t key_token_length,
|
|
unsigned char *sig, size_t *siglen,
|
|
const unsigned char *tbs, size_t tbslen,
|
|
int digest_nid, int mgf_digest_nid, int saltlen,
|
|
bool verbose);
|
|
|
|
int cca_ecdsa_sign(const struct ekmf_cca_lib *cca_lib,
|
|
const unsigned char *key_token, size_t key_token_length,
|
|
unsigned char *sig, size_t *siglen,
|
|
const unsigned char *tbs, size_t tbslen, int digest_nid,
|
|
bool verbose);
|
|
|
|
#endif
|