2 * GnuTLS PKCS#11 support
3 * Copyright (C) 2010 Free Software Foundation
5 * Author: Nikos Mavrogiannopoulos
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Library General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Library General Public License for more details.
17 * You should have received a copy of the GNU Library General Public
18 * License along with this library; if not, write to the Free
19 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
23 #include <gnutls_int.h>
24 #include <pakchois/pakchois.h>
25 #include <gnutls/pkcs11.h>
28 #include <gnutls_errors.h>
29 #include <gnutls_datum.h>
30 #include <pkcs11_int.h>
31 #include <gnutls/abstract.h>
32 #include <gnutls_pk.h>
34 #include <openpgp/openpgp_int.h>
35 #include <openpgp/gnutls_openpgp.h>
36 #include <gnutls_sig.h>
37 #include <abstract_int.h>
39 struct gnutls_privkey_st
41 gnutls_privkey_type_t type
;
42 gnutls_pk_algorithm_t pk_algorithm
;
46 gnutls_x509_privkey_t x509
;
47 gnutls_pkcs11_privkey_t pkcs11
;
49 gnutls_openpgp_privkey_t openpgp
;
57 * gnutls_privkey_get_type:
58 * @key: should contain a #gnutls_privkey_t structure
60 * This function will return the type of the private key. This is
61 * actually the type of the subsystem used to set this private key.
63 * Returns: a member of the #gnutls_privkey_type_t enumeration on
64 * success, or a negative value on error.
67 gnutls_privkey_get_type (gnutls_privkey_t key
)
73 * gnutls_privkey_get_pk_algorithm:
74 * @key: should contain a #gnutls_privkey_t structure
75 * @bits: If set will return the number of bits of the parameters (may be NULL)
77 * This function will return the public key algorithm of a private
78 * key and if possible will return a number of bits that indicates
79 * the security parameter of the key.
81 * Returns: a member of the #gnutls_pk_algorithm_t enumeration on
82 * success, or a negative value on error.
85 gnutls_privkey_get_pk_algorithm (gnutls_privkey_t key
, unsigned int *bits
)
90 case GNUTLS_PRIVKEY_OPENPGP
:
91 return gnutls_openpgp_privkey_get_pk_algorithm (key
->key
.openpgp
, bits
);
93 case GNUTLS_PRIVKEY_PKCS11
:
94 return gnutls_pkcs11_privkey_get_pk_algorithm (key
->key
.pkcs11
, bits
);
95 case GNUTLS_PRIVKEY_X509
:
97 *bits
= _gnutls_mpi_get_nbits (key
->key
.x509
->params
[0]);
98 return gnutls_x509_privkey_get_pk_algorithm (key
->key
.x509
);
101 return GNUTLS_E_INVALID_REQUEST
;
107 privkey_to_pubkey (gnutls_pk_algorithm_t pk
,
108 const bigint_t
* params
, int params_size
,
109 bigint_t
* new_params
, int *new_params_size
)
116 if (*new_params_size
< RSA_PUBLIC_PARAMS
117 || params_size
< RSA_PRIVATE_PARAMS
)
120 return GNUTLS_E_INVALID_REQUEST
;
123 new_params
[0] = _gnutls_mpi_copy (params
[0]);
124 new_params
[1] = _gnutls_mpi_copy (params
[1]);
126 *new_params_size
= RSA_PUBLIC_PARAMS
;
128 if (new_params
[0] == NULL
|| new_params
[1] == NULL
)
131 ret
= GNUTLS_E_MEMORY_ERROR
;
137 if (*new_params_size
< DSA_PUBLIC_PARAMS
138 || params_size
< DSA_PRIVATE_PARAMS
)
141 return GNUTLS_E_INVALID_REQUEST
;
144 new_params
[0] = _gnutls_mpi_copy (params
[0]);
145 new_params
[1] = _gnutls_mpi_copy (params
[1]);
146 new_params
[2] = _gnutls_mpi_copy (params
[2]);
147 new_params
[3] = _gnutls_mpi_copy (params
[3]);
149 *new_params_size
= DSA_PUBLIC_PARAMS
;
151 if (new_params
[0] == NULL
|| new_params
[1] == NULL
||
152 new_params
[2] == NULL
|| new_params
[3] == NULL
)
155 ret
= GNUTLS_E_MEMORY_ERROR
;
162 return GNUTLS_E_INVALID_REQUEST
;
167 for (i
= 0; i
< *new_params_size
; i
++)
168 _gnutls_mpi_release (new_params
[i
]);
173 /* Returns the public key of the private key (if possible)
176 _gnutls_privkey_get_public_mpis (gnutls_privkey_t key
,
177 bigint_t
* params
, int *params_size
)
180 gnutls_pk_algorithm_t pk
= gnutls_privkey_get_pk_algorithm (key
, NULL
);
184 #ifdef ENABLE_OPENPGP
185 case GNUTLS_PRIVKEY_OPENPGP
:
187 bigint_t tmp_params
[MAX_PRIV_PARAMS_SIZE
];
188 int tmp_params_size
= MAX_PRIV_PARAMS_SIZE
;
190 uint8_t keyid
[GNUTLS_OPENPGP_KEYID_SIZE
];
193 gnutls_openpgp_privkey_get_preferred_key_id (key
->key
.openpgp
,
197 KEYID_IMPORT (kid
, keyid
);
198 ret
= _gnutls_openpgp_privkey_get_mpis (key
->key
.openpgp
, kid
,
203 ret
= _gnutls_openpgp_privkey_get_mpis (key
->key
.openpgp
, NULL
,
213 ret
= privkey_to_pubkey (pk
,
214 tmp_params
, tmp_params_size
,
215 params
, params_size
);
217 for (i
= 0; i
< tmp_params_size
; i
++)
218 _gnutls_mpi_release (&tmp_params
[i
]);
224 case GNUTLS_PRIVKEY_X509
:
225 ret
= privkey_to_pubkey (pk
,
226 key
->key
.x509
->params
,
227 key
->key
.x509
->params_size
, params
,
232 return GNUTLS_E_INVALID_REQUEST
;
239 * gnutls_privkey_init:
240 * @key: The structure to be initialized
242 * This function will initialize an private key structure.
244 * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
245 * negative error value.
248 gnutls_privkey_init (gnutls_privkey_t
* key
)
250 *key
= gnutls_calloc (1, sizeof (struct gnutls_privkey_st
));
254 return GNUTLS_E_MEMORY_ERROR
;
261 * gnutls_privkey_deinit:
262 * @key: The structure to be deinitialized
264 * This function will deinitialize a private key structure.
267 gnutls_privkey_deinit (gnutls_privkey_t key
)
269 if (key
== NULL
) return;
271 if (key
->flags
& GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE
)
274 #ifdef ENABLE_OPENPGP
275 case GNUTLS_PRIVKEY_OPENPGP
:
276 gnutls_openpgp_privkey_deinit (key
->key
.openpgp
);
279 case GNUTLS_PRIVKEY_PKCS11
:
280 gnutls_pkcs11_privkey_deinit (key
->key
.pkcs11
);
282 case GNUTLS_PRIVKEY_X509
:
283 gnutls_x509_privkey_deinit (key
->key
.x509
);
289 /* will fail if the private key contains an actual key.
291 static int check_if_clean(gnutls_privkey_t key
)
294 return GNUTLS_E_INVALID_REQUEST
;
300 * gnutls_privkey_import_pkcs11:
301 * @pkey: The private key
302 * @key: The private key to be imported
303 * @flags: should be zero
305 * This function will import the given private key to the abstract
306 * #gnutls_privkey_t structure.
308 * The #gnutls_pkcs11_privkey_t object must not be deallocated
309 * during the lifetime of this structure.
311 * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
312 * negative error value.
315 gnutls_privkey_import_pkcs11 (gnutls_privkey_t pkey
,
316 gnutls_pkcs11_privkey_t key
, unsigned int flags
)
320 ret
= check_if_clean(pkey
);
327 pkey
->key
.pkcs11
= key
;
328 pkey
->type
= GNUTLS_PRIVKEY_PKCS11
;
329 pkey
->pk_algorithm
= gnutls_pkcs11_privkey_get_pk_algorithm (key
, NULL
);
336 * gnutls_privkey_import_x509:
337 * @pkey: The private key
338 * @key: The private key to be imported
339 * @flags: should be zero
341 * This function will import the given private key to the abstract
342 * #gnutls_privkey_t structure.
344 * The #gnutls_x509_privkey_t object must not be deallocated
345 * during the lifetime of this structure.
347 * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
348 * negative error value.
351 gnutls_privkey_import_x509 (gnutls_privkey_t pkey
,
352 gnutls_x509_privkey_t key
, unsigned int flags
)
356 ret
= check_if_clean(pkey
);
363 pkey
->key
.x509
= key
;
364 pkey
->type
= GNUTLS_PRIVKEY_X509
;
365 pkey
->pk_algorithm
= gnutls_x509_privkey_get_pk_algorithm (key
);
371 #ifdef ENABLE_OPENPGP
373 * gnutls_privkey_import_openpgp:
374 * @pkey: The private key
375 * @key: The private key to be imported
376 * @flags: should be zero
378 * This function will import the given private key to the abstract
379 * #gnutls_privkey_t structure.
381 * The #gnutls_openpgp_privkey_t object must not be deallocated
382 * during the lifetime of this structure. The subkey set as
383 * preferred will be used, or the master key otherwise.
385 * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
386 * negative error value.
389 gnutls_privkey_import_openpgp (gnutls_privkey_t pkey
,
390 gnutls_openpgp_privkey_t key
,
394 uint8_t keyid
[GNUTLS_OPENPGP_KEYID_SIZE
];
396 ret
= check_if_clean(pkey
);
403 pkey
->key
.openpgp
= key
;
404 pkey
->type
= GNUTLS_PRIVKEY_OPENPGP
;
406 ret
= gnutls_openpgp_privkey_get_preferred_key_id (key
, keyid
);
407 if (ret
== GNUTLS_E_OPENPGP_PREFERRED_KEY_ERROR
)
409 pkey
->pk_algorithm
= gnutls_openpgp_privkey_get_pk_algorithm(key
, NULL
);
414 return gnutls_assert_val(ret
);
416 idx
= gnutls_openpgp_privkey_get_subkey_idx (key
, keyid
);
418 pkey
->pk_algorithm
= gnutls_openpgp_privkey_get_subkey_pk_algorithm (key
, idx
, NULL
);
428 * gnutls_privkey_sign_data:
429 * @signer: Holds the key
430 * @hash: should be a digest algorithm
431 * @flags: should be 0 for now
432 * @data: holds the data to be signed
433 * @signature: will contain the signature allocate with gnutls_malloc()
435 * This function will sign the given data using a signature algorithm
436 * supported by the private key. Signature algorithms are always used
437 * together with a hash functions. Different hash functions may be
438 * used for the RSA algorithm, but only SHA-1 for the DSA keys.
440 * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
441 * negative error value.
446 gnutls_privkey_sign_data (gnutls_privkey_t signer
,
447 gnutls_digest_algorithm_t hash
,
449 const gnutls_datum_t
* data
,
450 gnutls_datum_t
* signature
)
453 gnutls_datum_t digest
;
455 ret
= pk_hash_data (signer
->pk_algorithm
, hash
, NULL
, data
, &digest
);
462 ret
= pk_prepare_hash (signer
->pk_algorithm
, hash
, &digest
);
469 ret
= _gnutls_privkey_sign_hash (signer
, &digest
, signature
);
470 _gnutls_free_datum (&digest
);
481 _gnutls_free_datum (&digest
);
486 * gnutls_privkey_sign_hash:
487 * @signer: Holds the signer's key
488 * @hash_algo: The hash algorithm used
489 * @flags: zero for now
490 * @hash_data: holds the data to be signed
491 * @signature: will contain newly allocated signature
493 * This function will sign the given hashed data using a signature algorithm
494 * supported by the private key. Signature algorithms are always used
495 * together with a hash functions. Different hash functions may be
496 * used for the RSA algorithm, but only SHA-XXX for the DSA keys.
498 * Use gnutls_x509_crt_get_preferred_hash_algorithm() to determine
499 * the hash algorithm.
501 * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
502 * negative error value.
507 gnutls_privkey_sign_hash (gnutls_privkey_t signer
,
508 gnutls_digest_algorithm_t hash_algo
,
510 const gnutls_datum_t
* hash_data
,
511 gnutls_datum_t
* signature
)
514 gnutls_datum_t digest
;
516 digest
.data
= gnutls_malloc (hash_data
->size
);
517 if (digest
.data
== NULL
)
520 return GNUTLS_E_MEMORY_ERROR
;
522 digest
.size
= hash_data
->size
;
523 memcpy (digest
.data
, hash_data
->data
, digest
.size
);
525 ret
= pk_prepare_hash (signer
->pk_algorithm
, hash_algo
, &digest
);
532 ret
= _gnutls_privkey_sign_hash (signer
, &digest
, signature
);
542 _gnutls_free_datum (&digest
);
547 * _gnutls_privkey_sign_hash:
548 * @key: Holds the key
549 * @data: holds the data to be signed
550 * @signature: will contain the signature allocate with gnutls_malloc()
552 * This function will sign the given data using a signature algorithm
553 * supported by the private key.
555 * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
556 * negative error value.
559 _gnutls_privkey_sign_hash (gnutls_privkey_t key
,
560 const gnutls_datum_t
* hash
,
561 gnutls_datum_t
* signature
)
565 #ifdef ENABLE_OPENPGP
566 case GNUTLS_PRIVKEY_OPENPGP
:
567 return gnutls_openpgp_privkey_sign_hash (key
->key
.openpgp
,
570 case GNUTLS_PRIVKEY_PKCS11
:
571 return _gnutls_pkcs11_privkey_sign_hash (key
->key
.pkcs11
,
573 case GNUTLS_PRIVKEY_X509
:
574 return _gnutls_soft_sign (key
->key
.x509
->pk_algorithm
,
575 key
->key
.x509
->params
,
576 key
->key
.x509
->params_size
, hash
, signature
);
579 return GNUTLS_E_INVALID_REQUEST
;
584 * gnutls_privkey_decrypt_data:
585 * @key: Holds the key
586 * @flags: zero for now
587 * @ciphertext: holds the data to be decrypted
588 * @plaintext: will contain the decrypted data, allocated with gnutls_malloc()
590 * This function will decrypt the given data using the algorithm
591 * supported by the private key.
593 * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
594 * negative error value.
597 gnutls_privkey_decrypt_data (gnutls_privkey_t key
,
599 const gnutls_datum_t
* ciphertext
,
600 gnutls_datum_t
* plaintext
)
602 if (key
->pk_algorithm
!= GNUTLS_PK_RSA
)
605 return GNUTLS_E_INVALID_REQUEST
;
610 #ifdef ENABLE_OPENPGP
611 case GNUTLS_PRIVKEY_OPENPGP
:
612 return _gnutls_openpgp_privkey_decrypt_data (key
->key
.openpgp
, flags
,
613 ciphertext
, plaintext
);
615 case GNUTLS_PRIVKEY_X509
:
616 return _gnutls_pkcs1_rsa_decrypt (plaintext
, ciphertext
,
617 key
->key
.x509
->params
,
618 key
->key
.x509
->params_size
, 2);
619 case GNUTLS_PRIVKEY_PKCS11
:
620 return _gnutls_pkcs11_privkey_decrypt_data (key
->key
.pkcs11
,
622 ciphertext
, plaintext
);
625 return GNUTLS_E_INVALID_REQUEST
;