asymmetric-type.h 2.7 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788
  1. /* SPDX-License-Identifier: GPL-2.0-or-later */
  2. /* Asymmetric Public-key cryptography key type interface
  3. *
  4. * See Documentation/crypto/asymmetric-keys.txt
  5. *
  6. * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
  7. * Written by David Howells (dhowells@redhat.com)
  8. */
  9. #ifndef _KEYS_ASYMMETRIC_TYPE_H
  10. #define _KEYS_ASYMMETRIC_TYPE_H
  11. #ifndef __UBOOT__
  12. #include <linux/key-type.h>
  13. #include <linux/verification.h>
  14. extern struct key_type key_type_asymmetric;
  15. /*
  16. * The key payload is four words. The asymmetric-type key uses them as
  17. * follows:
  18. */
  19. enum asymmetric_payload_bits {
  20. asym_crypto, /* The data representing the key */
  21. asym_subtype, /* Pointer to an asymmetric_key_subtype struct */
  22. asym_key_ids, /* Pointer to an asymmetric_key_ids struct */
  23. asym_auth /* The key's authorisation (signature, parent key ID) */
  24. };
  25. #endif /* !__UBOOT__ */
  26. /*
  27. * Identifiers for an asymmetric key ID. We have three ways of looking up a
  28. * key derived from an X.509 certificate:
  29. *
  30. * (1) Serial Number & Issuer. Non-optional. This is the only valid way to
  31. * map a PKCS#7 signature to an X.509 certificate.
  32. *
  33. * (2) Issuer & Subject Unique IDs. Optional. These were the original way to
  34. * match X.509 certificates, but have fallen into disuse in favour of (3).
  35. *
  36. * (3) Auth & Subject Key Identifiers. Optional. SKIDs are only provided on
  37. * CA keys that are intended to sign other keys, so don't appear in end
  38. * user certificates unless forced.
  39. *
  40. * We could also support an PGP key identifier, which is just a SHA1 sum of the
  41. * public key and certain parameters, but since we don't support PGP keys at
  42. * the moment, we shall ignore those.
  43. *
  44. * What we actually do is provide a place where binary identifiers can be
  45. * stashed and then compare against them when checking for an id match.
  46. */
  47. struct asymmetric_key_id {
  48. unsigned short len;
  49. unsigned char data[];
  50. };
  51. struct asymmetric_key_ids {
  52. void *id[2];
  53. };
  54. extern bool asymmetric_key_id_same(const struct asymmetric_key_id *kid1,
  55. const struct asymmetric_key_id *kid2);
  56. extern bool asymmetric_key_id_partial(const struct asymmetric_key_id *kid1,
  57. const struct asymmetric_key_id *kid2);
  58. extern struct asymmetric_key_id *asymmetric_key_generate_id(const void *val_1,
  59. size_t len_1,
  60. const void *val_2,
  61. size_t len_2);
  62. #ifndef __UBOOT__
  63. static inline
  64. const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
  65. {
  66. return key->payload.data[asym_key_ids];
  67. }
  68. extern struct key *find_asymmetric_key(struct key *keyring,
  69. const struct asymmetric_key_id *id_0,
  70. const struct asymmetric_key_id *id_1,
  71. bool partial);
  72. #endif
  73. /*
  74. * The payload is at the discretion of the subtype.
  75. */
  76. #endif /* _KEYS_ASYMMETRIC_TYPE_H */