diff options
author | Richard Levitte <levitte@openssl.org> | 2019-07-05 00:31:42 +0200 |
---|---|---|
committer | Richard Levitte <levitte@openssl.org> | 2019-07-22 06:17:38 +0200 |
commit | a94a3e0d91378b5c478f687a0dbc51914d4ed497 (patch) | |
tree | a649885fc1d6560a2928c610d9adaaf4ec6dbfcc /include | |
parent | 7312ef3fc4a7d391272f3ba8075eabf81a229ad2 (diff) |
Add basic EVP_KEYMGMT API and libcrypto <-> provider interface
The idea with the key management "operation" is to support the
following set of functionality:
- Key domain parameter generation
- Key domain parameter import
- Key domain parameter export
- Key generation
- Key import
- Key export
- Key loading (HSM / hidden key support)
With that set of function, we can support handling domain parameters
on one provider, key handling on another, and key usage on a third,
with transparent export / import of applicable data. Of course, if a
provider doesn't offer export / import functionality, then all
operations surrounding a key must be performed with the same
provider.
This method also avoids having to do anything special with legacy
assignment of libcrypto key structures, i.e. EVP_PKEY_assign_RSA().
They will simply be used as keys to be exported from whenever they are
used with provider based operations.
This change only adds the EVP_KEYMGMT API and the libcrypto <->
provider interface. Further changes will integrate them into existing
libcrypto functionality.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9312)
Diffstat (limited to 'include')
-rw-r--r-- | include/openssl/core_numbers.h | 73 | ||||
-rw-r--r-- | include/openssl/evp.h | 6 | ||||
-rw-r--r-- | include/openssl/ossl_typ.h | 2 |
3 files changed, 80 insertions, 1 deletions
diff --git a/include/openssl/core_numbers.h b/include/openssl/core_numbers.h index c5892431e4..f45b8f1084 100644 --- a/include/openssl/core_numbers.h +++ b/include/openssl/core_numbers.h @@ -229,9 +229,80 @@ OSSL_CORE_MAKE_FUNC(int, OP_cipher_ctx_get_params, (void *cctx, OSSL_CORE_MAKE_FUNC(int, OP_cipher_ctx_set_params, (void *cctx, const OSSL_PARAM params[])) +/*- + * Key management + * + * Key domain parameter references can be created in several manners: + * - by importing the domain parameter material via an OSSL_PARAM array. + * - by generating key domain parameters, given input via an OSSL_PARAM + * array. + * + * Key references can be created in several manners: + * - by importing the key material via an OSSL_PARAM array. + * - by generating a key, given optional domain parameters and + * additional keygen parameters. + * If domain parameters are given, they must have been generated using + * the domain parameter generator functions. + * If the domain parameters comes from a different provider, results + * are undefined. + * THE CALLER MUST ENSURE THAT CORRECT DOMAIN PARAMETERS ARE USED. + * - by loading an internal key, given a binary blob that forms an identity. + * THE CALLER MUST ENSURE THAT A CORRECT IDENTITY IS USED. + */ + +# define OSSL_OP_KEYMGMT 10 + +/* Key domain parameter creation and destruction */ +# define OSSL_FUNC_KEYMGMT_IMPORTDOMPARAMS 1 +# define OSSL_FUNC_KEYMGMT_GENDOMPARAMS 2 +# define OSSL_FUNC_KEYMGMT_FREEDOMPARAMS 3 +OSSL_CORE_MAKE_FUNC(void *, OP_keymgmt_importdomparams, + (void *provctx, const OSSL_PARAM params[])) +OSSL_CORE_MAKE_FUNC(void *, OP_keymgmt_gendomparams, + (void *provctx, const OSSL_PARAM params[])) +OSSL_CORE_MAKE_FUNC(void, OP_keymgmt_freedomparams, (void *domparams)) + +/* Key domain parameter export */ +# define OSSL_FUNC_KEYMGMT_EXPORTDOMPARAMS 4 +OSSL_CORE_MAKE_FUNC(int, OP_keymgmt_exportdomparams, + (void *domparams, OSSL_PARAM params[])) + +/* Key domain parameter discovery */ +# define OSSL_FUNC_KEYMGMT_IMPORTDOMPARAM_TYPES 5 +# define OSSL_FUNC_KEYMGMT_EXPORTDOMPARAM_TYPES 6 +OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *, OP_keymgmt_importdomparam_types, + (void)) +OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *, OP_keymgmt_exportdomparam_types, + (void)) + +/* Key creation and destruction */ +# define OSSL_FUNC_KEYMGMT_IMPORTKEY 10 +# define OSSL_FUNC_KEYMGMT_GENKEY 11 +# define OSSL_FUNC_KEYMGMT_LOADKEY 12 +# define OSSL_FUNC_KEYMGMT_FREEKEY 13 +OSSL_CORE_MAKE_FUNC(void *, OP_keymgmt_importkey, + (void *provctx, const OSSL_PARAM params[])) +OSSL_CORE_MAKE_FUNC(void *, OP_keymgmt_genkey, + (void *provctx, + void *domparams, const OSSL_PARAM genkeyparams[])) +OSSL_CORE_MAKE_FUNC(void *, OP_keymgmt_loadkey, + (void *provctx, void *id, size_t idlen)) +OSSL_CORE_MAKE_FUNC(void, OP_keymgmt_freekey, (void *key)) + +/* Key export */ +# define OSSL_FUNC_KEYMGMT_EXPORTKEY 14 +OSSL_CORE_MAKE_FUNC(int, OP_keymgmt_exportkey, + (void *key, OSSL_PARAM params[])) + +/* Key discovery */ +# define OSSL_FUNC_KEYMGMT_IMPORTKEY_TYPES 15 +# define OSSL_FUNC_KEYMGMT_EXPORTKEY_TYPES 16 +OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *, OP_keymgmt_importkey_types, (void)) +OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *, OP_keymgmt_exportkey_types, (void)) + /* Key Exchange */ -# define OSSL_OP_KEYEXCH 3 +# define OSSL_OP_KEYEXCH 11 # define OSSL_FUNC_KEYEXCH_NEWCTX 1 # define OSSL_FUNC_KEYEXCH_INIT 2 diff --git a/include/openssl/evp.h b/include/openssl/evp.h index 377b4b16c0..d014a2e3cf 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h @@ -1411,6 +1411,12 @@ int EVP_PKEY_meth_remove(const EVP_PKEY_METHOD *pmeth); size_t EVP_PKEY_meth_get_count(void); const EVP_PKEY_METHOD *EVP_PKEY_meth_get0(size_t idx); +EVP_KEYMGMT *EVP_KEYMGMT_fetch(OPENSSL_CTX *ctx, const char *algorithm, + const char *properties); +int EVP_KEYMGMT_up_ref(EVP_KEYMGMT *keymgmt); +void EVP_KEYMGMT_free(EVP_KEYMGMT *keymgmt); +const OSSL_PROVIDER *EVP_KEYMGMT_provider(const EVP_KEYMGMT *keymgmt); + EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e); EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e); EVP_PKEY_CTX *EVP_PKEY_CTX_dup(const EVP_PKEY_CTX *ctx); diff --git a/include/openssl/ossl_typ.h b/include/openssl/ossl_typ.h index 76a9bee78d..7eec053bee 100644 --- a/include/openssl/ossl_typ.h +++ b/include/openssl/ossl_typ.h @@ -101,6 +101,8 @@ typedef struct evp_pkey_asn1_method_st EVP_PKEY_ASN1_METHOD; typedef struct evp_pkey_method_st EVP_PKEY_METHOD; typedef struct evp_pkey_ctx_st EVP_PKEY_CTX; +typedef struct evp_keymgmt_st EVP_KEYMGMT; + typedef struct evp_kdf_st EVP_KDF; typedef struct evp_kdf_ctx_st EVP_KDF_CTX; |