asymmetric-type.h 2.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384
  1. /* SPDX-License-Identifier: GPL-2.0-or-later */
  2. /* Asymmetric Public-key cryptography key type interface
  3. *
  4. * See Documentation/crypto/asymmetric-keys.rst
  5. *
  6. * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
  7. * Written by David Howells (dhowells@redhat.com)
  8. */
  9. #ifndef _KEYS_ASYMMETRIC_TYPE_H
  10. #define _KEYS_ASYMMETRIC_TYPE_H
  11. #include <linux/key-type.h>
  12. #include <linux/verification.h>
  13. extern struct key_type key_type_asymmetric;
  14. /*
  15. * The key payload is four words. The asymmetric-type key uses them as
  16. * follows:
  17. */
  18. enum asymmetric_payload_bits {
  19. asym_crypto, /* The data representing the key */
  20. asym_subtype, /* Pointer to an asymmetric_key_subtype struct */
  21. asym_key_ids, /* Pointer to an asymmetric_key_ids struct */
  22. asym_auth /* The key's authorisation (signature, parent key ID) */
  23. };
  24. /*
  25. * Identifiers for an asymmetric key ID. We have three ways of looking up a
  26. * key derived from an X.509 certificate:
  27. *
  28. * (1) Serial Number & Issuer. Non-optional. This is the only valid way to
  29. * map a PKCS#7 signature to an X.509 certificate.
  30. *
  31. * (2) Issuer & Subject Unique IDs. Optional. These were the original way to
  32. * match X.509 certificates, but have fallen into disuse in favour of (3).
  33. *
  34. * (3) Auth & Subject Key Identifiers. Optional. SKIDs are only provided on
  35. * CA keys that are intended to sign other keys, so don't appear in end
  36. * user certificates unless forced.
  37. *
  38. * We could also support an PGP key identifier, which is just a SHA1 sum of the
  39. * public key and certain parameters, but since we don't support PGP keys at
  40. * the moment, we shall ignore those.
  41. *
  42. * What we actually do is provide a place where binary identifiers can be
  43. * stashed and then compare against them when checking for an id match.
  44. */
  45. struct asymmetric_key_id {
  46. unsigned short len;
  47. unsigned char data[];
  48. };
  49. struct asymmetric_key_ids {
  50. void *id[2];
  51. };
  52. extern bool asymmetric_key_id_same(const struct asymmetric_key_id *kid1,
  53. const struct asymmetric_key_id *kid2);
  54. extern bool asymmetric_key_id_partial(const struct asymmetric_key_id *kid1,
  55. const struct asymmetric_key_id *kid2);
  56. extern struct asymmetric_key_id *asymmetric_key_generate_id(const void *val_1,
  57. size_t len_1,
  58. const void *val_2,
  59. size_t len_2);
  60. static inline
  61. const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
  62. {
  63. return key->payload.data[asym_key_ids];
  64. }
  65. extern struct key *find_asymmetric_key(struct key *keyring,
  66. const struct asymmetric_key_id *id_0,
  67. const struct asymmetric_key_id *id_1,
  68. bool partial);
  69. /*
  70. * The payload is at the discretion of the subtype.
  71. */
  72. #endif /* _KEYS_ASYMMETRIC_TYPE_H */