Eric Tsai / mbedtls

Modified mbed TLS headers for AES functionality only to reduce build size

Dependents:   BLE_Gateway_Linker_fix BLE_Gateway

Fork of mbedtls by sandbox

mbedtls/pkcs11.h@5:f09f5ed830ca, 2017-07-10 (annotated)

Committer:
electronichamsters
Date:
Mon Jul 10 04:00:25 2017 +0000
Revision:
5:f09f5ed830ca
Parent:
1:24750b9ad5ef 
working gateway

Who changed what in which revision?

UserRevisionLine numberNew contents of line
Christopher Haster 1:24750b9ad5ef 1 /**
Christopher Haster 1:24750b9ad5ef 2 * \file pkcs11.h
Christopher Haster 1:24750b9ad5ef 3 *
Christopher Haster 1:24750b9ad5ef 4 * \brief Wrapper for PKCS#11 library libpkcs11-helper
Christopher Haster 1:24750b9ad5ef 5 *
Christopher Haster 1:24750b9ad5ef 6 * \author Adriaan de Jong <dejong@fox-it.com>
Christopher Haster 1:24750b9ad5ef 7 *
Christopher Haster 1:24750b9ad5ef 8 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Christopher Haster 1:24750b9ad5ef 9 * SPDX-License-Identifier: Apache-2.0
Christopher Haster 1:24750b9ad5ef 10 *
Christopher Haster 1:24750b9ad5ef 11 * Licensed under the Apache License, Version 2.0 (the "License"); you may
Christopher Haster 1:24750b9ad5ef 12 * not use this file except in compliance with the License.
Christopher Haster 1:24750b9ad5ef 13 * You may obtain a copy of the License at
Christopher Haster 1:24750b9ad5ef 14 *
Christopher Haster 1:24750b9ad5ef 15 * http://www.apache.org/licenses/LICENSE-2.0
Christopher Haster 1:24750b9ad5ef 16 *
Christopher Haster 1:24750b9ad5ef 17 * Unless required by applicable law or agreed to in writing, software
Christopher Haster 1:24750b9ad5ef 18 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
Christopher Haster 1:24750b9ad5ef 19 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
Christopher Haster 1:24750b9ad5ef 20 * See the License for the specific language governing permissions and
Christopher Haster 1:24750b9ad5ef 21 * limitations under the License.
Christopher Haster 1:24750b9ad5ef 22 *
Christopher Haster 1:24750b9ad5ef 23 * This file is part of mbed TLS (https://tls.mbed.org)
Christopher Haster 1:24750b9ad5ef 24 */
Christopher Haster 1:24750b9ad5ef 25 #ifndef MBEDTLS_PKCS11_H
Christopher Haster 1:24750b9ad5ef 26 #define MBEDTLS_PKCS11_H
Christopher Haster 1:24750b9ad5ef 27
Christopher Haster 1:24750b9ad5ef 28 #if !defined(MBEDTLS_CONFIG_FILE)
Christopher Haster 1:24750b9ad5ef 29 #include "config.h"
Christopher Haster 1:24750b9ad5ef 30 #else
Christopher Haster 1:24750b9ad5ef 31 #include MBEDTLS_CONFIG_FILE
Christopher Haster 1:24750b9ad5ef 32 #endif
Christopher Haster 1:24750b9ad5ef 33
Christopher Haster 1:24750b9ad5ef 34 #if defined(MBEDTLS_PKCS11_C)
Christopher Haster 1:24750b9ad5ef 35
Christopher Haster 1:24750b9ad5ef 36 #include "x509_crt.h"
Christopher Haster 1:24750b9ad5ef 37
Christopher Haster 1:24750b9ad5ef 38 #include <pkcs11-helper-1.0/pkcs11h-certificate.h>
Christopher Haster 1:24750b9ad5ef 39
Christopher Haster 1:24750b9ad5ef 40 #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
Christopher Haster 1:24750b9ad5ef 41 !defined(inline) && !defined(__cplusplus)
Christopher Haster 1:24750b9ad5ef 42 #define inline __inline
Christopher Haster 1:24750b9ad5ef 43 #endif
Christopher Haster 1:24750b9ad5ef 44
Christopher Haster 1:24750b9ad5ef 45 #ifdef __cplusplus
Christopher Haster 1:24750b9ad5ef 46 extern "C" {
Christopher Haster 1:24750b9ad5ef 47 #endif
Christopher Haster 1:24750b9ad5ef 48
Christopher Haster 1:24750b9ad5ef 49 /**
Christopher Haster 1:24750b9ad5ef 50 * Context for PKCS #11 private keys.
Christopher Haster 1:24750b9ad5ef 51 */
Christopher Haster 1:24750b9ad5ef 52 typedef struct {
Christopher Haster 1:24750b9ad5ef 53 pkcs11h_certificate_t pkcs11h_cert;
Christopher Haster 1:24750b9ad5ef 54 int len;
Christopher Haster 1:24750b9ad5ef 55 } mbedtls_pkcs11_context;
Christopher Haster 1:24750b9ad5ef 56
Christopher Haster 1:24750b9ad5ef 57 /**
Christopher Haster 1:24750b9ad5ef 58 * Initialize a mbedtls_pkcs11_context.
Christopher Haster 1:24750b9ad5ef 59 * (Just making memory references valid.)
Christopher Haster 1:24750b9ad5ef 60 */
Christopher Haster 1:24750b9ad5ef 61 void mbedtls_pkcs11_init( mbedtls_pkcs11_context *ctx );
Christopher Haster 1:24750b9ad5ef 62
Christopher Haster 1:24750b9ad5ef 63 /**
Christopher Haster 1:24750b9ad5ef 64 * Fill in a mbed TLS certificate, based on the given PKCS11 helper certificate.
Christopher Haster 1:24750b9ad5ef 65 *
Christopher Haster 1:24750b9ad5ef 66 * \param cert X.509 certificate to fill
Christopher Haster 1:24750b9ad5ef 67 * \param pkcs11h_cert PKCS #11 helper certificate
Christopher Haster 1:24750b9ad5ef 68 *
Christopher Haster 1:24750b9ad5ef 69 * \return 0 on success.
Christopher Haster 1:24750b9ad5ef 70 */
Christopher Haster 1:24750b9ad5ef 71 int mbedtls_pkcs11_x509_cert_bind( mbedtls_x509_crt *cert, pkcs11h_certificate_t pkcs11h_cert );
Christopher Haster 1:24750b9ad5ef 72
Christopher Haster 1:24750b9ad5ef 73 /**
Christopher Haster 1:24750b9ad5ef 74 * Set up a mbedtls_pkcs11_context storing the given certificate. Note that the
Christopher Haster 1:24750b9ad5ef 75 * mbedtls_pkcs11_context will take over control of the certificate, freeing it when
Christopher Haster 1:24750b9ad5ef 76 * done.
Christopher Haster 1:24750b9ad5ef 77 *
Christopher Haster 1:24750b9ad5ef 78 * \param priv_key Private key structure to fill.
Christopher Haster 1:24750b9ad5ef 79 * \param pkcs11_cert PKCS #11 helper certificate
Christopher Haster 1:24750b9ad5ef 80 *
Christopher Haster 1:24750b9ad5ef 81 * \return 0 on success
Christopher Haster 1:24750b9ad5ef 82 */
Christopher Haster 1:24750b9ad5ef 83 int mbedtls_pkcs11_priv_key_bind( mbedtls_pkcs11_context *priv_key,
Christopher Haster 1:24750b9ad5ef 84 pkcs11h_certificate_t pkcs11_cert );
Christopher Haster 1:24750b9ad5ef 85
Christopher Haster 1:24750b9ad5ef 86 /**
Christopher Haster 1:24750b9ad5ef 87 * Free the contents of the given private key context. Note that the structure
Christopher Haster 1:24750b9ad5ef 88 * itself is not freed.
Christopher Haster 1:24750b9ad5ef 89 *
Christopher Haster 1:24750b9ad5ef 90 * \param priv_key Private key structure to cleanup
Christopher Haster 1:24750b9ad5ef 91 */
Christopher Haster 1:24750b9ad5ef 92 void mbedtls_pkcs11_priv_key_free( mbedtls_pkcs11_context *priv_key );
Christopher Haster 1:24750b9ad5ef 93
Christopher Haster 1:24750b9ad5ef 94 /**
Christopher Haster 1:24750b9ad5ef 95 * \brief Do an RSA private key decrypt, then remove the message
Christopher Haster 1:24750b9ad5ef 96 * padding
Christopher Haster 1:24750b9ad5ef 97 *
Christopher Haster 1:24750b9ad5ef 98 * \param ctx PKCS #11 context
Christopher Haster 1:24750b9ad5ef 99 * \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature
Christopher Haster 1:24750b9ad5ef 100 * \param input buffer holding the encrypted data
Christopher Haster 1:24750b9ad5ef 101 * \param output buffer that will hold the plaintext
Christopher Haster 1:24750b9ad5ef 102 * \param olen will contain the plaintext length
Christopher Haster 1:24750b9ad5ef 103 * \param output_max_len maximum length of the output buffer
Christopher Haster 1:24750b9ad5ef 104 *
Christopher Haster 1:24750b9ad5ef 105 * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
Christopher Haster 1:24750b9ad5ef 106 *
Christopher Haster 1:24750b9ad5ef 107 * \note The output buffer must be as large as the size
Christopher Haster 1:24750b9ad5ef 108 * of ctx->N (eg. 128 bytes if RSA-1024 is used) otherwise
Christopher Haster 1:24750b9ad5ef 109 * an error is thrown.
Christopher Haster 1:24750b9ad5ef 110 */
Christopher Haster 1:24750b9ad5ef 111 int mbedtls_pkcs11_decrypt( mbedtls_pkcs11_context *ctx,
Christopher Haster 1:24750b9ad5ef 112 int mode, size_t *olen,
Christopher Haster 1:24750b9ad5ef 113 const unsigned char *input,
Christopher Haster 1:24750b9ad5ef 114 unsigned char *output,
Christopher Haster 1:24750b9ad5ef 115 size_t output_max_len );
Christopher Haster 1:24750b9ad5ef 116
Christopher Haster 1:24750b9ad5ef 117 /**
Christopher Haster 1:24750b9ad5ef 118 * \brief Do a private RSA to sign a message digest
Christopher Haster 1:24750b9ad5ef 119 *
Christopher Haster 1:24750b9ad5ef 120 * \param ctx PKCS #11 context
Christopher Haster 1:24750b9ad5ef 121 * \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature
Christopher Haster 1:24750b9ad5ef 122 * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
Christopher Haster 1:24750b9ad5ef 123 * \param hashlen message digest length (for MBEDTLS_MD_NONE only)
Christopher Haster 1:24750b9ad5ef 124 * \param hash buffer holding the message digest
Christopher Haster 1:24750b9ad5ef 125 * \param sig buffer that will hold the ciphertext
Christopher Haster 1:24750b9ad5ef 126 *
Christopher Haster 1:24750b9ad5ef 127 * \return 0 if the signing operation was successful,
Christopher Haster 1:24750b9ad5ef 128 * or an MBEDTLS_ERR_RSA_XXX error code
Christopher Haster 1:24750b9ad5ef 129 *
Christopher Haster 1:24750b9ad5ef 130 * \note The "sig" buffer must be as large as the size
Christopher Haster 1:24750b9ad5ef 131 * of ctx->N (eg. 128 bytes if RSA-1024 is used).
Christopher Haster 1:24750b9ad5ef 132 */
Christopher Haster 1:24750b9ad5ef 133 int mbedtls_pkcs11_sign( mbedtls_pkcs11_context *ctx,
Christopher Haster 1:24750b9ad5ef 134 int mode,
Christopher Haster 1:24750b9ad5ef 135 mbedtls_md_type_t md_alg,
Christopher Haster 1:24750b9ad5ef 136 unsigned int hashlen,
Christopher Haster 1:24750b9ad5ef 137 const unsigned char *hash,
Christopher Haster 1:24750b9ad5ef 138 unsigned char *sig );
Christopher Haster 1:24750b9ad5ef 139
Christopher Haster 1:24750b9ad5ef 140 /**
Christopher Haster 1:24750b9ad5ef 141 * SSL/TLS wrappers for PKCS#11 functions
Christopher Haster 1:24750b9ad5ef 142 */
Christopher Haster 1:24750b9ad5ef 143 static inline int mbedtls_ssl_pkcs11_decrypt( void *ctx, int mode, size_t *olen,
Christopher Haster 1:24750b9ad5ef 144 const unsigned char *input, unsigned char *output,
Christopher Haster 1:24750b9ad5ef 145 size_t output_max_len )
Christopher Haster 1:24750b9ad5ef 146 {
Christopher Haster 1:24750b9ad5ef 147 return mbedtls_pkcs11_decrypt( (mbedtls_pkcs11_context *) ctx, mode, olen, input, output,
Christopher Haster 1:24750b9ad5ef 148 output_max_len );
Christopher Haster 1:24750b9ad5ef 149 }
Christopher Haster 1:24750b9ad5ef 150
Christopher Haster 1:24750b9ad5ef 151 static inline int mbedtls_ssl_pkcs11_sign( void *ctx,
Christopher Haster 1:24750b9ad5ef 152 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
Christopher Haster 1:24750b9ad5ef 153 int mode, mbedtls_md_type_t md_alg, unsigned int hashlen,
Christopher Haster 1:24750b9ad5ef 154 const unsigned char *hash, unsigned char *sig )
Christopher Haster 1:24750b9ad5ef 155 {
Christopher Haster 1:24750b9ad5ef 156 ((void) f_rng);
Christopher Haster 1:24750b9ad5ef 157 ((void) p_rng);
Christopher Haster 1:24750b9ad5ef 158 return mbedtls_pkcs11_sign( (mbedtls_pkcs11_context *) ctx, mode, md_alg,
Christopher Haster 1:24750b9ad5ef 159 hashlen, hash, sig );
Christopher Haster 1:24750b9ad5ef 160 }
Christopher Haster 1:24750b9ad5ef 161
Christopher Haster 1:24750b9ad5ef 162 static inline size_t mbedtls_ssl_pkcs11_key_len( void *ctx )
Christopher Haster 1:24750b9ad5ef 163 {
Christopher Haster 1:24750b9ad5ef 164 return ( (mbedtls_pkcs11_context *) ctx )->len;
Christopher Haster 1:24750b9ad5ef 165 }
Christopher Haster 1:24750b9ad5ef 166
Christopher Haster 1:24750b9ad5ef 167 #ifdef __cplusplus
Christopher Haster 1:24750b9ad5ef 168 }
Christopher Haster 1:24750b9ad5ef 169 #endif
Christopher Haster 1:24750b9ad5ef 170
Christopher Haster 1:24750b9ad5ef 171 #endif /* MBEDTLS_PKCS11_C */
Christopher Haster 1:24750b9ad5ef 172
Christopher Haster 1:24750b9ad5ef 173 #endif /* MBEDTLS_PKCS11_H */