pk.h 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615
  1. /**
  2. * \file pk.h
  3. *
  4. * \brief Public Key abstraction layer
  5. *
  6. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  7. * SPDX-License-Identifier: Apache-2.0
  8. *
  9. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  10. * not use this file except in compliance with the License.
  11. * You may obtain a copy of the License at
  12. *
  13. * http://www.apache.org/licenses/LICENSE-2.0
  14. *
  15. * Unless required by applicable law or agreed to in writing, software
  16. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  17. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  18. * See the License for the specific language governing permissions and
  19. * limitations under the License.
  20. *
  21. * This file is part of mbed TLS (https://tls.mbed.org)
  22. */
  23. #ifndef MBEDTLS_PK_H
  24. #define MBEDTLS_PK_H
  25. #if !defined(MBEDTLS_CONFIG_FILE)
  26. #include "config.h"
  27. #else
  28. #include MBEDTLS_CONFIG_FILE
  29. #endif
  30. #include "md.h"
  31. #if defined(MBEDTLS_RSA_C)
  32. #include "rsa.h"
  33. #endif
  34. #if defined(MBEDTLS_ECP_C)
  35. #include "ecp.h"
  36. #endif
  37. #if defined(MBEDTLS_ECDSA_C)
  38. #include "ecdsa.h"
  39. #endif
  40. #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
  41. !defined(inline) && !defined(__cplusplus)
  42. #define inline __inline
  43. #endif
  44. #define MBEDTLS_ERR_PK_ALLOC_FAILED -0x3F80 /**< Memory allocation failed. */
  45. #define MBEDTLS_ERR_PK_TYPE_MISMATCH -0x3F00 /**< Type mismatch, eg attempt to encrypt with an ECDSA key */
  46. #define MBEDTLS_ERR_PK_BAD_INPUT_DATA -0x3E80 /**< Bad input parameters to function. */
  47. #define MBEDTLS_ERR_PK_FILE_IO_ERROR -0x3E00 /**< Read/write of file failed. */
  48. #define MBEDTLS_ERR_PK_KEY_INVALID_VERSION -0x3D80 /**< Unsupported key version */
  49. #define MBEDTLS_ERR_PK_KEY_INVALID_FORMAT -0x3D00 /**< Invalid key tag or value. */
  50. #define MBEDTLS_ERR_PK_UNKNOWN_PK_ALG -0x3C80 /**< Key algorithm is unsupported (only RSA and EC are supported). */
  51. #define MBEDTLS_ERR_PK_PASSWORD_REQUIRED -0x3C00 /**< Private key password can't be empty. */
  52. #define MBEDTLS_ERR_PK_PASSWORD_MISMATCH -0x3B80 /**< Given private key password does not allow for correct decryption. */
  53. #define MBEDTLS_ERR_PK_INVALID_PUBKEY -0x3B00 /**< The pubkey tag or value is invalid (only RSA and EC are supported). */
  54. #define MBEDTLS_ERR_PK_INVALID_ALG -0x3A80 /**< The algorithm tag or value is invalid. */
  55. #define MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE -0x3A00 /**< Elliptic curve is unsupported (only NIST curves are supported). */
  56. #define MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE -0x3980 /**< Unavailable feature, e.g. RSA disabled for RSA key. */
  57. #define MBEDTLS_ERR_PK_SIG_LEN_MISMATCH -0x3900 /**< The signature is valid but its length is less than expected. */
  58. #ifdef __cplusplus
  59. extern "C" {
  60. #endif
  61. /**
  62. * \brief Public key types
  63. */
  64. typedef enum {
  65. MBEDTLS_PK_NONE=0,
  66. MBEDTLS_PK_RSA,
  67. MBEDTLS_PK_ECKEY,
  68. MBEDTLS_PK_ECKEY_DH,
  69. MBEDTLS_PK_ECDSA,
  70. MBEDTLS_PK_RSA_ALT,
  71. MBEDTLS_PK_RSASSA_PSS,
  72. } mbedtls_pk_type_t;
  73. /**
  74. * \brief Options for RSASSA-PSS signature verification.
  75. * See \c mbedtls_rsa_rsassa_pss_verify_ext()
  76. */
  77. typedef struct
  78. {
  79. mbedtls_md_type_t mgf1_hash_id;
  80. int expected_salt_len;
  81. } mbedtls_pk_rsassa_pss_options;
  82. /**
  83. * \brief Types for interfacing with the debug module
  84. */
  85. typedef enum
  86. {
  87. MBEDTLS_PK_DEBUG_NONE = 0,
  88. MBEDTLS_PK_DEBUG_MPI,
  89. MBEDTLS_PK_DEBUG_ECP,
  90. } mbedtls_pk_debug_type;
  91. /**
  92. * \brief Item to send to the debug module
  93. */
  94. typedef struct
  95. {
  96. mbedtls_pk_debug_type type;
  97. const char *name;
  98. void *value;
  99. } mbedtls_pk_debug_item;
  100. /** Maximum number of item send for debugging, plus 1 */
  101. #define MBEDTLS_PK_DEBUG_MAX_ITEMS 3
  102. /**
  103. * \brief Public key information and operations
  104. */
  105. typedef struct mbedtls_pk_info_t mbedtls_pk_info_t;
  106. /**
  107. * \brief Public key container
  108. */
  109. typedef struct
  110. {
  111. const mbedtls_pk_info_t * pk_info; /**< Public key informations */
  112. void * pk_ctx; /**< Underlying public key context */
  113. } mbedtls_pk_context;
  114. #if defined(MBEDTLS_RSA_C)
  115. /**
  116. * Quick access to an RSA context inside a PK context.
  117. *
  118. * \warning You must make sure the PK context actually holds an RSA context
  119. * before using this function!
  120. */
  121. static inline mbedtls_rsa_context *mbedtls_pk_rsa( const mbedtls_pk_context pk )
  122. {
  123. return( (mbedtls_rsa_context *) (pk).pk_ctx );
  124. }
  125. #endif /* MBEDTLS_RSA_C */
  126. #if defined(MBEDTLS_ECP_C)
  127. /**
  128. * Quick access to an EC context inside a PK context.
  129. *
  130. * \warning You must make sure the PK context actually holds an EC context
  131. * before using this function!
  132. */
  133. static inline mbedtls_ecp_keypair *mbedtls_pk_ec( const mbedtls_pk_context pk )
  134. {
  135. return( (mbedtls_ecp_keypair *) (pk).pk_ctx );
  136. }
  137. #endif /* MBEDTLS_ECP_C */
  138. #if defined(MBEDTLS_PK_RSA_ALT_SUPPORT)
  139. /**
  140. * \brief Types for RSA-alt abstraction
  141. */
  142. typedef int (*mbedtls_pk_rsa_alt_decrypt_func)( void *ctx, int mode, size_t *olen,
  143. const unsigned char *input, unsigned char *output,
  144. size_t output_max_len );
  145. typedef int (*mbedtls_pk_rsa_alt_sign_func)( void *ctx,
  146. int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
  147. int mode, mbedtls_md_type_t md_alg, unsigned int hashlen,
  148. const unsigned char *hash, unsigned char *sig );
  149. typedef size_t (*mbedtls_pk_rsa_alt_key_len_func)( void *ctx );
  150. #endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */
  151. /**
  152. * \brief Return information associated with the given PK type
  153. *
  154. * \param pk_type PK type to search for.
  155. *
  156. * \return The PK info associated with the type or NULL if not found.
  157. */
  158. const mbedtls_pk_info_t *mbedtls_pk_info_from_type( mbedtls_pk_type_t pk_type );
  159. /**
  160. * \brief Initialize a mbedtls_pk_context (as NONE)
  161. */
  162. void mbedtls_pk_init( mbedtls_pk_context *ctx );
  163. /**
  164. * \brief Free a mbedtls_pk_context
  165. */
  166. void mbedtls_pk_free( mbedtls_pk_context *ctx );
  167. /**
  168. * \brief Initialize a PK context with the information given
  169. * and allocates the type-specific PK subcontext.
  170. *
  171. * \param ctx Context to initialize. Must be empty (type NONE).
  172. * \param info Information to use
  173. *
  174. * \return 0 on success,
  175. * MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input,
  176. * MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure.
  177. *
  178. * \note For contexts holding an RSA-alt key, use
  179. * \c mbedtls_pk_setup_rsa_alt() instead.
  180. */
  181. int mbedtls_pk_setup( mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info );
  182. #if defined(MBEDTLS_PK_RSA_ALT_SUPPORT)
  183. /**
  184. * \brief Initialize an RSA-alt context
  185. *
  186. * \param ctx Context to initialize. Must be empty (type NONE).
  187. * \param key RSA key pointer
  188. * \param decrypt_func Decryption function
  189. * \param sign_func Signing function
  190. * \param key_len_func Function returning key length in bytes
  191. *
  192. * \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the
  193. * context wasn't already initialized as RSA_ALT.
  194. *
  195. * \note This function replaces \c mbedtls_pk_setup() for RSA-alt.
  196. */
  197. int mbedtls_pk_setup_rsa_alt( mbedtls_pk_context *ctx, void * key,
  198. mbedtls_pk_rsa_alt_decrypt_func decrypt_func,
  199. mbedtls_pk_rsa_alt_sign_func sign_func,
  200. mbedtls_pk_rsa_alt_key_len_func key_len_func );
  201. #endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */
  202. /**
  203. * \brief Get the size in bits of the underlying key
  204. *
  205. * \param ctx Context to use
  206. *
  207. * \return Key size in bits, or 0 on error
  208. */
  209. size_t mbedtls_pk_get_bitlen( const mbedtls_pk_context *ctx );
  210. /**
  211. * \brief Get the length in bytes of the underlying key
  212. * \param ctx Context to use
  213. *
  214. * \return Key length in bytes, or 0 on error
  215. */
  216. static inline size_t mbedtls_pk_get_len( const mbedtls_pk_context *ctx )
  217. {
  218. return( ( mbedtls_pk_get_bitlen( ctx ) + 7 ) / 8 );
  219. }
  220. /**
  221. * \brief Tell if a context can do the operation given by type
  222. *
  223. * \param ctx Context to test
  224. * \param type Target type
  225. *
  226. * \return 0 if context can't do the operations,
  227. * 1 otherwise.
  228. */
  229. int mbedtls_pk_can_do( const mbedtls_pk_context *ctx, mbedtls_pk_type_t type );
  230. /**
  231. * \brief Verify signature (including padding if relevant).
  232. *
  233. * \param ctx PK context to use
  234. * \param md_alg Hash algorithm used (see notes)
  235. * \param hash Hash of the message to sign
  236. * \param hash_len Hash length or 0 (see notes)
  237. * \param sig Signature to verify
  238. * \param sig_len Signature length
  239. *
  240. * \return 0 on success (signature is valid),
  241. * MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if the signature is
  242. * valid but its actual length is less than sig_len,
  243. * or a specific error code.
  244. *
  245. * \note For RSA keys, the default padding type is PKCS#1 v1.5.
  246. * Use \c mbedtls_pk_verify_ext( MBEDTLS_PK_RSASSA_PSS, ... )
  247. * to verify RSASSA_PSS signatures.
  248. *
  249. * \note If hash_len is 0, then the length associated with md_alg
  250. * is used instead, or an error returned if it is invalid.
  251. *
  252. * \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0
  253. */
  254. int mbedtls_pk_verify( mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg,
  255. const unsigned char *hash, size_t hash_len,
  256. const unsigned char *sig, size_t sig_len );
  257. /**
  258. * \brief Verify signature, with options.
  259. * (Includes verification of the padding depending on type.)
  260. *
  261. * \param type Signature type (inc. possible padding type) to verify
  262. * \param options Pointer to type-specific options, or NULL
  263. * \param ctx PK context to use
  264. * \param md_alg Hash algorithm used (see notes)
  265. * \param hash Hash of the message to sign
  266. * \param hash_len Hash length or 0 (see notes)
  267. * \param sig Signature to verify
  268. * \param sig_len Signature length
  269. *
  270. * \return 0 on success (signature is valid),
  271. * MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be
  272. * used for this type of signatures,
  273. * MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if the signature is
  274. * valid but its actual length is less than sig_len,
  275. * or a specific error code.
  276. *
  277. * \note If hash_len is 0, then the length associated with md_alg
  278. * is used instead, or an error returned if it is invalid.
  279. *
  280. * \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0
  281. *
  282. * \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point
  283. * to a mbedtls_pk_rsassa_pss_options structure,
  284. * otherwise it must be NULL.
  285. */
  286. int mbedtls_pk_verify_ext( mbedtls_pk_type_t type, const void *options,
  287. mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg,
  288. const unsigned char *hash, size_t hash_len,
  289. const unsigned char *sig, size_t sig_len );
  290. /**
  291. * \brief Make signature, including padding if relevant.
  292. *
  293. * \param ctx PK context to use - must hold a private key
  294. * \param md_alg Hash algorithm used (see notes)
  295. * \param hash Hash of the message to sign
  296. * \param hash_len Hash length or 0 (see notes)
  297. * \param sig Place to write the signature
  298. * \param sig_len Number of bytes written
  299. * \param f_rng RNG function
  300. * \param p_rng RNG parameter
  301. *
  302. * \return 0 on success, or a specific error code.
  303. *
  304. * \note For RSA keys, the default padding type is PKCS#1 v1.5.
  305. * There is no interface in the PK module to make RSASSA-PSS
  306. * signatures yet.
  307. *
  308. * \note If hash_len is 0, then the length associated with md_alg
  309. * is used instead, or an error returned if it is invalid.
  310. *
  311. * \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0.
  312. * For ECDSA, md_alg may never be MBEDTLS_MD_NONE.
  313. */
  314. int mbedtls_pk_sign( mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg,
  315. const unsigned char *hash, size_t hash_len,
  316. unsigned char *sig, size_t *sig_len,
  317. int (*f_rng)(void *, unsigned char *, size_t), void *p_rng );
  318. /**
  319. * \brief Decrypt message (including padding if relevant).
  320. *
  321. * \param ctx PK context to use - must hold a private key
  322. * \param input Input to decrypt
  323. * \param ilen Input size
  324. * \param output Decrypted output
  325. * \param olen Decrypted message length
  326. * \param osize Size of the output buffer
  327. * \param f_rng RNG function
  328. * \param p_rng RNG parameter
  329. *
  330. * \note For RSA keys, the default padding type is PKCS#1 v1.5.
  331. *
  332. * \return 0 on success, or a specific error code.
  333. */
  334. int mbedtls_pk_decrypt( mbedtls_pk_context *ctx,
  335. const unsigned char *input, size_t ilen,
  336. unsigned char *output, size_t *olen, size_t osize,
  337. int (*f_rng)(void *, unsigned char *, size_t), void *p_rng );
  338. /**
  339. * \brief Encrypt message (including padding if relevant).
  340. *
  341. * \param ctx PK context to use
  342. * \param input Message to encrypt
  343. * \param ilen Message size
  344. * \param output Encrypted output
  345. * \param olen Encrypted output length
  346. * \param osize Size of the output buffer
  347. * \param f_rng RNG function
  348. * \param p_rng RNG parameter
  349. *
  350. * \note For RSA keys, the default padding type is PKCS#1 v1.5.
  351. *
  352. * \return 0 on success, or a specific error code.
  353. */
  354. int mbedtls_pk_encrypt( mbedtls_pk_context *ctx,
  355. const unsigned char *input, size_t ilen,
  356. unsigned char *output, size_t *olen, size_t osize,
  357. int (*f_rng)(void *, unsigned char *, size_t), void *p_rng );
  358. /**
  359. * \brief Check if a public-private pair of keys matches.
  360. *
  361. * \param pub Context holding a public key.
  362. * \param prv Context holding a private (and public) key.
  363. *
  364. * \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA
  365. */
  366. int mbedtls_pk_check_pair( const mbedtls_pk_context *pub, const mbedtls_pk_context *prv );
  367. /**
  368. * \brief Export debug information
  369. *
  370. * \param ctx Context to use
  371. * \param items Place to write debug items
  372. *
  373. * \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA
  374. */
  375. int mbedtls_pk_debug( const mbedtls_pk_context *ctx, mbedtls_pk_debug_item *items );
  376. /**
  377. * \brief Access the type name
  378. *
  379. * \param ctx Context to use
  380. *
  381. * \return Type name on success, or "invalid PK"
  382. */
  383. const char * mbedtls_pk_get_name( const mbedtls_pk_context *ctx );
  384. /**
  385. * \brief Get the key type
  386. *
  387. * \param ctx Context to use
  388. *
  389. * \return Type on success, or MBEDTLS_PK_NONE
  390. */
  391. mbedtls_pk_type_t mbedtls_pk_get_type( const mbedtls_pk_context *ctx );
  392. #if defined(MBEDTLS_PK_PARSE_C)
  393. /** \ingroup pk_module */
  394. /**
  395. * \brief Parse a private key in PEM or DER format
  396. *
  397. * \param ctx key to be initialized
  398. * \param key input buffer
  399. * \param keylen size of the buffer
  400. * (including the terminating null byte for PEM data)
  401. * \param pwd password for decryption (optional)
  402. * \param pwdlen size of the password
  403. *
  404. * \note On entry, ctx must be empty, either freshly initialised
  405. * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a
  406. * specific key type, check the result with mbedtls_pk_can_do().
  407. *
  408. * \note The key is also checked for correctness.
  409. *
  410. * \return 0 if successful, or a specific PK or PEM error code
  411. */
  412. int mbedtls_pk_parse_key( mbedtls_pk_context *ctx,
  413. const unsigned char *key, size_t keylen,
  414. const unsigned char *pwd, size_t pwdlen );
  415. /** \ingroup pk_module */
  416. /**
  417. * \brief Parse a public key in PEM or DER format
  418. *
  419. * \param ctx key to be initialized
  420. * \param key input buffer
  421. * \param keylen size of the buffer
  422. * (including the terminating null byte for PEM data)
  423. *
  424. * \note On entry, ctx must be empty, either freshly initialised
  425. * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a
  426. * specific key type, check the result with mbedtls_pk_can_do().
  427. *
  428. * \note The key is also checked for correctness.
  429. *
  430. * \return 0 if successful, or a specific PK or PEM error code
  431. */
  432. int mbedtls_pk_parse_public_key( mbedtls_pk_context *ctx,
  433. const unsigned char *key, size_t keylen );
  434. #if defined(MBEDTLS_FS_IO)
  435. /** \ingroup pk_module */
  436. /**
  437. * \brief Load and parse a private key
  438. *
  439. * \param ctx key to be initialized
  440. * \param path filename to read the private key from
  441. * \param password password to decrypt the file (can be NULL)
  442. *
  443. * \note On entry, ctx must be empty, either freshly initialised
  444. * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a
  445. * specific key type, check the result with mbedtls_pk_can_do().
  446. *
  447. * \note The key is also checked for correctness.
  448. *
  449. * \return 0 if successful, or a specific PK or PEM error code
  450. */
  451. int mbedtls_pk_parse_keyfile( mbedtls_pk_context *ctx,
  452. const char *path, const char *password );
  453. /** \ingroup pk_module */
  454. /**
  455. * \brief Load and parse a public key
  456. *
  457. * \param ctx key to be initialized
  458. * \param path filename to read the private key from
  459. *
  460. * \note On entry, ctx must be empty, either freshly initialised
  461. * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a
  462. * specific key type, check the result with mbedtls_pk_can_do().
  463. *
  464. * \note The key is also checked for correctness.
  465. *
  466. * \return 0 if successful, or a specific PK or PEM error code
  467. */
  468. int mbedtls_pk_parse_public_keyfile( mbedtls_pk_context *ctx, const char *path );
  469. #endif /* MBEDTLS_FS_IO */
  470. #endif /* MBEDTLS_PK_PARSE_C */
  471. #if defined(MBEDTLS_PK_WRITE_C)
  472. /**
  473. * \brief Write a private key to a PKCS#1 or SEC1 DER structure
  474. * Note: data is written at the end of the buffer! Use the
  475. * return value to determine where you should start
  476. * using the buffer
  477. *
  478. * \param ctx private to write away
  479. * \param buf buffer to write to
  480. * \param size size of the buffer
  481. *
  482. * \return length of data written if successful, or a specific
  483. * error code
  484. */
  485. int mbedtls_pk_write_key_der( mbedtls_pk_context *ctx, unsigned char *buf, size_t size );
  486. /**
  487. * \brief Write a public key to a SubjectPublicKeyInfo DER structure
  488. * Note: data is written at the end of the buffer! Use the
  489. * return value to determine where you should start
  490. * using the buffer
  491. *
  492. * \param ctx public key to write away
  493. * \param buf buffer to write to
  494. * \param size size of the buffer
  495. *
  496. * \return length of data written if successful, or a specific
  497. * error code
  498. */
  499. int mbedtls_pk_write_pubkey_der( mbedtls_pk_context *ctx, unsigned char *buf, size_t size );
  500. #if defined(MBEDTLS_PEM_WRITE_C)
  501. /**
  502. * \brief Write a public key to a PEM string
  503. *
  504. * \param ctx public key to write away
  505. * \param buf buffer to write to
  506. * \param size size of the buffer
  507. *
  508. * \return 0 if successful, or a specific error code
  509. */
  510. int mbedtls_pk_write_pubkey_pem( mbedtls_pk_context *ctx, unsigned char *buf, size_t size );
  511. /**
  512. * \brief Write a private key to a PKCS#1 or SEC1 PEM string
  513. *
  514. * \param ctx private to write away
  515. * \param buf buffer to write to
  516. * \param size size of the buffer
  517. *
  518. * \return 0 if successful, or a specific error code
  519. */
  520. int mbedtls_pk_write_key_pem( mbedtls_pk_context *ctx, unsigned char *buf, size_t size );
  521. #endif /* MBEDTLS_PEM_WRITE_C */
  522. #endif /* MBEDTLS_PK_WRITE_C */
  523. /*
  524. * WARNING: Low-level functions. You probably do not want to use these unless
  525. * you are certain you do ;)
  526. */
  527. #if defined(MBEDTLS_PK_PARSE_C)
  528. /**
  529. * \brief Parse a SubjectPublicKeyInfo DER structure
  530. *
  531. * \param p the position in the ASN.1 data
  532. * \param end end of the buffer
  533. * \param pk the key to fill
  534. *
  535. * \return 0 if successful, or a specific PK error code
  536. */
  537. int mbedtls_pk_parse_subpubkey( unsigned char **p, const unsigned char *end,
  538. mbedtls_pk_context *pk );
  539. #endif /* MBEDTLS_PK_PARSE_C */
  540. #if defined(MBEDTLS_PK_WRITE_C)
  541. /**
  542. * \brief Write a subjectPublicKey to ASN.1 data
  543. * Note: function works backwards in data buffer
  544. *
  545. * \param p reference to current position pointer
  546. * \param start start of the buffer (for bounds-checking)
  547. * \param key public key to write away
  548. *
  549. * \return the length written or a negative error code
  550. */
  551. int mbedtls_pk_write_pubkey( unsigned char **p, unsigned char *start,
  552. const mbedtls_pk_context *key );
  553. #endif /* MBEDTLS_PK_WRITE_C */
  554. /*
  555. * Internal module functions. You probably do not want to use these unless you
  556. * know you do.
  557. */
  558. #if defined(MBEDTLS_FS_IO)
  559. int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n );
  560. #endif
  561. #ifdef __cplusplus
  562. }
  563. #endif
  564. #endif /* MBEDTLS_PK_H */