Austin Blackstone / Mbed 2 deprecated client-lwip-lightswitch-demo-expanded

mbed client lightswitch demo

Dependencies:   mbed Socket lwip-eth lwip-sys lwip

Fork of mbed-client-classic-example-lwip by Austin Blackstone

mbedtls/mbedtls/pkcs11.h@11:cada08fc8a70, 2016-06-09 (annotated)

Committer:
mbedAustin
Date:
Thu Jun 09 17:08:36 2016 +0000
Revision:
11:cada08fc8a70
Commit for public Consumption

Who changed what in which revision?

UserRevisionLine numberNew contents of line
mbedAustin 11:cada08fc8a70 1 /**
mbedAustin 11:cada08fc8a70 2 * \file pkcs11.h
mbedAustin 11:cada08fc8a70 3 *
mbedAustin 11:cada08fc8a70 4 * \brief Wrapper for PKCS#11 library libpkcs11-helper
mbedAustin 11:cada08fc8a70 5 *
mbedAustin 11:cada08fc8a70 6 * \author Adriaan de Jong <dejong@fox-it.com>
mbedAustin 11:cada08fc8a70 7 *
mbedAustin 11:cada08fc8a70 8 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
mbedAustin 11:cada08fc8a70 9 * SPDX-License-Identifier: Apache-2.0
mbedAustin 11:cada08fc8a70 10 *
mbedAustin 11:cada08fc8a70 11 * Licensed under the Apache License, Version 2.0 (the "License"); you may
mbedAustin 11:cada08fc8a70 12 * not use this file except in compliance with the License.
mbedAustin 11:cada08fc8a70 13 * You may obtain a copy of the License at
mbedAustin 11:cada08fc8a70 14 *
mbedAustin 11:cada08fc8a70 15 * http://www.apache.org/licenses/LICENSE-2.0
mbedAustin 11:cada08fc8a70 16 *
mbedAustin 11:cada08fc8a70 17 * Unless required by applicable law or agreed to in writing, software
mbedAustin 11:cada08fc8a70 18 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
mbedAustin 11:cada08fc8a70 19 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
mbedAustin 11:cada08fc8a70 20 * See the License for the specific language governing permissions and
mbedAustin 11:cada08fc8a70 21 * limitations under the License.
mbedAustin 11:cada08fc8a70 22 *
mbedAustin 11:cada08fc8a70 23 * This file is part of mbed TLS (https://tls.mbed.org)
mbedAustin 11:cada08fc8a70 24 */
mbedAustin 11:cada08fc8a70 25 #ifndef MBEDTLS_PKCS11_H
mbedAustin 11:cada08fc8a70 26 #define MBEDTLS_PKCS11_H
mbedAustin 11:cada08fc8a70 27
mbedAustin 11:cada08fc8a70 28 #if !defined(MBEDTLS_CONFIG_FILE)
mbedAustin 11:cada08fc8a70 29 #include "config.h"
mbedAustin 11:cada08fc8a70 30 #else
mbedAustin 11:cada08fc8a70 31 #include MBEDTLS_CONFIG_FILE
mbedAustin 11:cada08fc8a70 32 #endif
mbedAustin 11:cada08fc8a70 33
mbedAustin 11:cada08fc8a70 34 #if defined(MBEDTLS_PKCS11_C)
mbedAustin 11:cada08fc8a70 35
mbedAustin 11:cada08fc8a70 36 #include "x509_crt.h"
mbedAustin 11:cada08fc8a70 37
mbedAustin 11:cada08fc8a70 38 #include <pkcs11-helper-1.0/pkcs11h-certificate.h>
mbedAustin 11:cada08fc8a70 39
mbedAustin 11:cada08fc8a70 40 #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
mbedAustin 11:cada08fc8a70 41 !defined(inline) && !defined(__cplusplus)
mbedAustin 11:cada08fc8a70 42 #define inline __inline
mbedAustin 11:cada08fc8a70 43 #endif
mbedAustin 11:cada08fc8a70 44
mbedAustin 11:cada08fc8a70 45 #ifdef __cplusplus
mbedAustin 11:cada08fc8a70 46 extern "C" {
mbedAustin 11:cada08fc8a70 47 #endif
mbedAustin 11:cada08fc8a70 48
mbedAustin 11:cada08fc8a70 49 /**
mbedAustin 11:cada08fc8a70 50 * Context for PKCS #11 private keys.
mbedAustin 11:cada08fc8a70 51 */
mbedAustin 11:cada08fc8a70 52 typedef struct {
mbedAustin 11:cada08fc8a70 53 pkcs11h_certificate_t pkcs11h_cert;
mbedAustin 11:cada08fc8a70 54 int len;
mbedAustin 11:cada08fc8a70 55 } mbedtls_pkcs11_context;
mbedAustin 11:cada08fc8a70 56
mbedAustin 11:cada08fc8a70 57 /**
mbedAustin 11:cada08fc8a70 58 * Initialize a mbedtls_pkcs11_context.
mbedAustin 11:cada08fc8a70 59 * (Just making memory references valid.)
mbedAustin 11:cada08fc8a70 60 */
mbedAustin 11:cada08fc8a70 61 void mbedtls_pkcs11_init( mbedtls_pkcs11_context *ctx );
mbedAustin 11:cada08fc8a70 62
mbedAustin 11:cada08fc8a70 63 /**
mbedAustin 11:cada08fc8a70 64 * Fill in a mbed TLS certificate, based on the given PKCS11 helper certificate.
mbedAustin 11:cada08fc8a70 65 *
mbedAustin 11:cada08fc8a70 66 * \param cert X.509 certificate to fill
mbedAustin 11:cada08fc8a70 67 * \param pkcs11h_cert PKCS #11 helper certificate
mbedAustin 11:cada08fc8a70 68 *
mbedAustin 11:cada08fc8a70 69 * \return 0 on success.
mbedAustin 11:cada08fc8a70 70 */
mbedAustin 11:cada08fc8a70 71 int mbedtls_pkcs11_x509_cert_bind( mbedtls_x509_crt *cert, pkcs11h_certificate_t pkcs11h_cert );
mbedAustin 11:cada08fc8a70 72
mbedAustin 11:cada08fc8a70 73 /**
mbedAustin 11:cada08fc8a70 74 * Set up a mbedtls_pkcs11_context storing the given certificate. Note that the
mbedAustin 11:cada08fc8a70 75 * mbedtls_pkcs11_context will take over control of the certificate, freeing it when
mbedAustin 11:cada08fc8a70 76 * done.
mbedAustin 11:cada08fc8a70 77 *
mbedAustin 11:cada08fc8a70 78 * \param priv_key Private key structure to fill.
mbedAustin 11:cada08fc8a70 79 * \param pkcs11_cert PKCS #11 helper certificate
mbedAustin 11:cada08fc8a70 80 *
mbedAustin 11:cada08fc8a70 81 * \return 0 on success
mbedAustin 11:cada08fc8a70 82 */
mbedAustin 11:cada08fc8a70 83 int mbedtls_pkcs11_priv_key_bind( mbedtls_pkcs11_context *priv_key,
mbedAustin 11:cada08fc8a70 84 pkcs11h_certificate_t pkcs11_cert );
mbedAustin 11:cada08fc8a70 85
mbedAustin 11:cada08fc8a70 86 /**
mbedAustin 11:cada08fc8a70 87 * Free the contents of the given private key context. Note that the structure
mbedAustin 11:cada08fc8a70 88 * itself is not freed.
mbedAustin 11:cada08fc8a70 89 *
mbedAustin 11:cada08fc8a70 90 * \param priv_key Private key structure to cleanup
mbedAustin 11:cada08fc8a70 91 */
mbedAustin 11:cada08fc8a70 92 void mbedtls_pkcs11_priv_key_free( mbedtls_pkcs11_context *priv_key );
mbedAustin 11:cada08fc8a70 93
mbedAustin 11:cada08fc8a70 94 /**
mbedAustin 11:cada08fc8a70 95 * \brief Do an RSA private key decrypt, then remove the message
mbedAustin 11:cada08fc8a70 96 * padding
mbedAustin 11:cada08fc8a70 97 *
mbedAustin 11:cada08fc8a70 98 * \param ctx PKCS #11 context
mbedAustin 11:cada08fc8a70 99 * \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature
mbedAustin 11:cada08fc8a70 100 * \param input buffer holding the encrypted data
mbedAustin 11:cada08fc8a70 101 * \param output buffer that will hold the plaintext
mbedAustin 11:cada08fc8a70 102 * \param olen will contain the plaintext length
mbedAustin 11:cada08fc8a70 103 * \param output_max_len maximum length of the output buffer
mbedAustin 11:cada08fc8a70 104 *
mbedAustin 11:cada08fc8a70 105 * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
mbedAustin 11:cada08fc8a70 106 *
mbedAustin 11:cada08fc8a70 107 * \note The output buffer must be as large as the size
mbedAustin 11:cada08fc8a70 108 * of ctx->N (eg. 128 bytes if RSA-1024 is used) otherwise
mbedAustin 11:cada08fc8a70 109 * an error is thrown.
mbedAustin 11:cada08fc8a70 110 */
mbedAustin 11:cada08fc8a70 111 int mbedtls_pkcs11_decrypt( mbedtls_pkcs11_context *ctx,
mbedAustin 11:cada08fc8a70 112 int mode, size_t *olen,
mbedAustin 11:cada08fc8a70 113 const unsigned char *input,
mbedAustin 11:cada08fc8a70 114 unsigned char *output,
mbedAustin 11:cada08fc8a70 115 size_t output_max_len );
mbedAustin 11:cada08fc8a70 116
mbedAustin 11:cada08fc8a70 117 /**
mbedAustin 11:cada08fc8a70 118 * \brief Do a private RSA to sign a message digest
mbedAustin 11:cada08fc8a70 119 *
mbedAustin 11:cada08fc8a70 120 * \param ctx PKCS #11 context
mbedAustin 11:cada08fc8a70 121 * \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature
mbedAustin 11:cada08fc8a70 122 * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
mbedAustin 11:cada08fc8a70 123 * \param hashlen message digest length (for MBEDTLS_MD_NONE only)
mbedAustin 11:cada08fc8a70 124 * \param hash buffer holding the message digest
mbedAustin 11:cada08fc8a70 125 * \param sig buffer that will hold the ciphertext
mbedAustin 11:cada08fc8a70 126 *
mbedAustin 11:cada08fc8a70 127 * \return 0 if the signing operation was successful,
mbedAustin 11:cada08fc8a70 128 * or an MBEDTLS_ERR_RSA_XXX error code
mbedAustin 11:cada08fc8a70 129 *
mbedAustin 11:cada08fc8a70 130 * \note The "sig" buffer must be as large as the size
mbedAustin 11:cada08fc8a70 131 * of ctx->N (eg. 128 bytes if RSA-1024 is used).
mbedAustin 11:cada08fc8a70 132 */
mbedAustin 11:cada08fc8a70 133 int mbedtls_pkcs11_sign( mbedtls_pkcs11_context *ctx,
mbedAustin 11:cada08fc8a70 134 int mode,
mbedAustin 11:cada08fc8a70 135 mbedtls_md_type_t md_alg,
mbedAustin 11:cada08fc8a70 136 unsigned int hashlen,
mbedAustin 11:cada08fc8a70 137 const unsigned char *hash,
mbedAustin 11:cada08fc8a70 138 unsigned char *sig );
mbedAustin 11:cada08fc8a70 139
mbedAustin 11:cada08fc8a70 140 /**
mbedAustin 11:cada08fc8a70 141 * SSL/TLS wrappers for PKCS#11 functions
mbedAustin 11:cada08fc8a70 142 */
mbedAustin 11:cada08fc8a70 143 static inline int mbedtls_ssl_pkcs11_decrypt( void *ctx, int mode, size_t *olen,
mbedAustin 11:cada08fc8a70 144 const unsigned char *input, unsigned char *output,
mbedAustin 11:cada08fc8a70 145 size_t output_max_len )
mbedAustin 11:cada08fc8a70 146 {
mbedAustin 11:cada08fc8a70 147 return mbedtls_pkcs11_decrypt( (mbedtls_pkcs11_context *) ctx, mode, olen, input, output,
mbedAustin 11:cada08fc8a70 148 output_max_len );
mbedAustin 11:cada08fc8a70 149 }
mbedAustin 11:cada08fc8a70 150
mbedAustin 11:cada08fc8a70 151 static inline int mbedtls_ssl_pkcs11_sign( void *ctx,
mbedAustin 11:cada08fc8a70 152 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
mbedAustin 11:cada08fc8a70 153 int mode, mbedtls_md_type_t md_alg, unsigned int hashlen,
mbedAustin 11:cada08fc8a70 154 const unsigned char *hash, unsigned char *sig )
mbedAustin 11:cada08fc8a70 155 {
mbedAustin 11:cada08fc8a70 156 ((void) f_rng);
mbedAustin 11:cada08fc8a70 157 ((void) p_rng);
mbedAustin 11:cada08fc8a70 158 return mbedtls_pkcs11_sign( (mbedtls_pkcs11_context *) ctx, mode, md_alg,
mbedAustin 11:cada08fc8a70 159 hashlen, hash, sig );
mbedAustin 11:cada08fc8a70 160 }
mbedAustin 11:cada08fc8a70 161
mbedAustin 11:cada08fc8a70 162 static inline size_t mbedtls_ssl_pkcs11_key_len( void *ctx )
mbedAustin 11:cada08fc8a70 163 {
mbedAustin 11:cada08fc8a70 164 return ( (mbedtls_pkcs11_context *) ctx )->len;
mbedAustin 11:cada08fc8a70 165 }
mbedAustin 11:cada08fc8a70 166
mbedAustin 11:cada08fc8a70 167 #ifdef __cplusplus
mbedAustin 11:cada08fc8a70 168 }
mbedAustin 11:cada08fc8a70 169 #endif
mbedAustin 11:cada08fc8a70 170
mbedAustin 11:cada08fc8a70 171 #endif /* MBEDTLS_PKCS11_C */
mbedAustin 11:cada08fc8a70 172
mbedAustin 11:cada08fc8a70 173 #endif /* MBEDTLS_PKCS11_H */