pkcs11.h 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173
  1. /**
  2. * \file pkcs11.h
  3. *
  4. * \brief Wrapper for PKCS#11 library libpkcs11-helper
  5. *
  6. * \author Adriaan de Jong <dejong@fox-it.com>
  7. *
  8. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  9. * SPDX-License-Identifier: Apache-2.0
  10. *
  11. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  12. * not use this file except in compliance with the License.
  13. * You may obtain a copy of the License at
  14. *
  15. * http://www.apache.org/licenses/LICENSE-2.0
  16. *
  17. * Unless required by applicable law or agreed to in writing, software
  18. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  19. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  20. * See the License for the specific language governing permissions and
  21. * limitations under the License.
  22. *
  23. * This file is part of mbed TLS (https://tls.mbed.org)
  24. */
  25. #ifndef MBEDTLS_PKCS11_H
  26. #define MBEDTLS_PKCS11_H
  27. #if !defined(MBEDTLS_CONFIG_FILE)
  28. #include "config.h"
  29. #else
  30. #include MBEDTLS_CONFIG_FILE
  31. #endif
  32. #if defined(MBEDTLS_PKCS11_C)
  33. #include "x509_crt.h"
  34. #include <pkcs11-helper-1.0/pkcs11h-certificate.h>
  35. #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
  36. !defined(inline) && !defined(__cplusplus)
  37. #define inline __inline
  38. #endif
  39. #ifdef __cplusplus
  40. extern "C" {
  41. #endif
  42. /**
  43. * Context for PKCS #11 private keys.
  44. */
  45. typedef struct {
  46. pkcs11h_certificate_t pkcs11h_cert;
  47. int len;
  48. } mbedtls_pkcs11_context;
  49. /**
  50. * Initialize a mbedtls_pkcs11_context.
  51. * (Just making memory references valid.)
  52. */
  53. void mbedtls_pkcs11_init( mbedtls_pkcs11_context *ctx );
  54. /**
  55. * Fill in a mbed TLS certificate, based on the given PKCS11 helper certificate.
  56. *
  57. * \param cert X.509 certificate to fill
  58. * \param pkcs11h_cert PKCS #11 helper certificate
  59. *
  60. * \return 0 on success.
  61. */
  62. int mbedtls_pkcs11_x509_cert_bind( mbedtls_x509_crt *cert, pkcs11h_certificate_t pkcs11h_cert );
  63. /**
  64. * Set up a mbedtls_pkcs11_context storing the given certificate. Note that the
  65. * mbedtls_pkcs11_context will take over control of the certificate, freeing it when
  66. * done.
  67. *
  68. * \param priv_key Private key structure to fill.
  69. * \param pkcs11_cert PKCS #11 helper certificate
  70. *
  71. * \return 0 on success
  72. */
  73. int mbedtls_pkcs11_priv_key_bind( mbedtls_pkcs11_context *priv_key,
  74. pkcs11h_certificate_t pkcs11_cert );
  75. /**
  76. * Free the contents of the given private key context. Note that the structure
  77. * itself is not freed.
  78. *
  79. * \param priv_key Private key structure to cleanup
  80. */
  81. void mbedtls_pkcs11_priv_key_free( mbedtls_pkcs11_context *priv_key );
  82. /**
  83. * \brief Do an RSA private key decrypt, then remove the message
  84. * padding
  85. *
  86. * \param ctx PKCS #11 context
  87. * \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature
  88. * \param input buffer holding the encrypted data
  89. * \param output buffer that will hold the plaintext
  90. * \param olen will contain the plaintext length
  91. * \param output_max_len maximum length of the output buffer
  92. *
  93. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  94. *
  95. * \note The output buffer must be as large as the size
  96. * of ctx->N (eg. 128 bytes if RSA-1024 is used) otherwise
  97. * an error is thrown.
  98. */
  99. int mbedtls_pkcs11_decrypt( mbedtls_pkcs11_context *ctx,
  100. int mode, size_t *olen,
  101. const unsigned char *input,
  102. unsigned char *output,
  103. size_t output_max_len );
  104. /**
  105. * \brief Do a private RSA to sign a message digest
  106. *
  107. * \param ctx PKCS #11 context
  108. * \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature
  109. * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
  110. * \param hashlen message digest length (for MBEDTLS_MD_NONE only)
  111. * \param hash buffer holding the message digest
  112. * \param sig buffer that will hold the ciphertext
  113. *
  114. * \return 0 if the signing operation was successful,
  115. * or an MBEDTLS_ERR_RSA_XXX error code
  116. *
  117. * \note The "sig" buffer must be as large as the size
  118. * of ctx->N (eg. 128 bytes if RSA-1024 is used).
  119. */
  120. int mbedtls_pkcs11_sign( mbedtls_pkcs11_context *ctx,
  121. int mode,
  122. mbedtls_md_type_t md_alg,
  123. unsigned int hashlen,
  124. const unsigned char *hash,
  125. unsigned char *sig );
  126. /**
  127. * SSL/TLS wrappers for PKCS#11 functions
  128. */
  129. static inline int mbedtls_ssl_pkcs11_decrypt( void *ctx, int mode, size_t *olen,
  130. const unsigned char *input, unsigned char *output,
  131. size_t output_max_len )
  132. {
  133. return mbedtls_pkcs11_decrypt( (mbedtls_pkcs11_context *) ctx, mode, olen, input, output,
  134. output_max_len );
  135. }
  136. static inline int mbedtls_ssl_pkcs11_sign( void *ctx,
  137. int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
  138. int mode, mbedtls_md_type_t md_alg, unsigned int hashlen,
  139. const unsigned char *hash, unsigned char *sig )
  140. {
  141. ((void) f_rng);
  142. ((void) p_rng);
  143. return mbedtls_pkcs11_sign( (mbedtls_pkcs11_context *) ctx, mode, md_alg,
  144. hashlen, hash, sig );
  145. }
  146. static inline size_t mbedtls_ssl_pkcs11_key_len( void *ctx )
  147. {
  148. return ( (mbedtls_pkcs11_context *) ctx )->len;
  149. }
  150. #ifdef __cplusplus
  151. }
  152. #endif
  153. #endif /* MBEDTLS_PKCS11_C */
  154. #endif /* MBEDTLS_PKCS11_H */