Skip to content

PKCS #11: implement identifying keys by label #3416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
SparkiDev wants to merge 5 commits into from
Closed

PKCS #11: implement identifying keys by label #3416

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
63c3258
PKCS #11: implement identifying keys by label
SparkiDev Oct 23, 2020
10397c0
PKCS #11 SSL: detect key size when certificate set
SparkiDev Oct 26, 2020
a49d901
PKCS#11: Label fixes and add support for checking private key
SparkiDev Nov 2, 2020
9ddc799
Fix dynamic type name
SparkiDev Nov 5, 2020
deda3e5
PKCS #11: only open/close session when performing op, use C_Sign for RSA
SparkiDev Nov 16, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
106 changes: 99 additions & 7 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1649,6 +1649,10 @@ int InitSSL_Ctx(WOLFSSL_CTX* ctx, WOLFSSL_METHOD* method, void* heap)
return BAD_MUTEX_E;
}

#ifndef NO_CERTS
ctx->privateKeyDevId = INVALID_DEVID;
#endif

#ifndef NO_DH
ctx->minDhKeySz = MIN_DHKEY_SZ;
ctx->maxDhKeySz = MAX_DHKEY_SZ;
Expand Down Expand Up @@ -5343,6 +5347,7 @@ int SetSSL_CTX(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup)
ssl->buffers.key = ctx->privateKey;
ssl->buffers.keyType = ctx->privateKeyType;
ssl->buffers.keyId = ctx->privateKeyId;
ssl->buffers.keyLabel = ctx->privateKeyLabel;
ssl->buffers.keySz = ctx->privateKeySz;
ssl->buffers.keyDevId = ctx->privateKeyDevId;
#endif
Expand Down Expand Up @@ -19880,6 +19885,76 @@ int PickHashSigAlgo(WOLFSSL* ssl, const byte* hashSigAlgo, word32 hashSigAlgoSz)

#if !defined(NO_CERTS)

#ifdef WOLF_CRYPTO_CB
/* Create a private key for a device.
*
* pkey Key object.
* data Data to identify key.
* length Length of data.
* hsType Type of the key to create.
* heap Custom heap to use for mallocs/frees
* devId Id for device.
* return 0 on success.
* return NOT_COMPILED_IN if algorithm type not supported.
* return MEMORY_E on memory allocation failure.
* return other internal error
*/
int CreateDevPrivateKey(void** pkey, byte* data, word32 length, int hsType,
int label, int id, void* heap, int devId)
{
int ret = NOT_COMPILED_IN;

if (hsType == DYNAMIC_TYPE_RSA) {
#ifndef NO_RSA
RsaKey* rsaKey;

rsaKey = XMALLOC(sizeof(RsaKey), heap, DYNAMIC_TYPE_RSA);
if (rsaKey == NULL) {
return MEMORY_E;
}

if (label) {
ret = wc_InitRsaKey_Label(rsaKey, (char*)data, heap, devId);
}
else if (id) {
ret = wc_InitRsaKey_Id(rsaKey, data, length, heap, devId);
}
if (ret == 0) {
*pkey = (void*)rsaKey;
}
else {
XFREE(rsaKey, heap, DYNAMIC_TYPE_RSA);
Copy link
Copy Markdown

@fencekicker fencekicker Nov 4, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't this be DYNAMIC_TYPE_RSA?

Copy link
Copy Markdown
Contributor Author

@SparkiDev SparkiDev Nov 5, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed. Thanks!

}
#endif
}
else if (hsType == DYNAMIC_TYPE_ECC) {
#ifdef HAVE_ECC
ecc_key* ecKey;

ecKey = XMALLOC(sizeof(ecc_key), heap, DYNAMIC_TYPE_ECC);
if (ecKey == NULL) {
return MEMORY_E;
}

if (label) {
ret = wc_ecc_init_label(ecKey, (char*)data, heap, devId);
}
else if (id) {
ret = wc_ecc_init_id(ecKey, data, length, heap, devId);
}
if (ret == 0) {
*pkey = (void*)ecKey;
}
else {
XFREE(ecKey, heap, DYNAMIC_TYPE_ECC);
Copy link
Copy Markdown

@fencekicker fencekicker Nov 4, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DYNAMIC_TYPE_ECC?

Copy link
Copy Markdown
Contributor Author

@SparkiDev SparkiDev Nov 5, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed. Thanks!

}
#endif
}

return ret;
}
#endif

/* Decode the private key - RSA/ECC/Ed25519/Ed448 - and creates a key object.
* The signature type is set as well.
* The maximum length of a signature is returned.
Expand Down Expand Up @@ -19910,7 +19985,8 @@ int DecodePrivateKey(WOLFSSL *ssl, word16* length)
}

#ifdef HAVE_PKCS11
if (ssl->buffers.keyDevId != INVALID_DEVID && ssl->buffers.keyId) {
if (ssl->buffers.keyDevId != INVALID_DEVID && (ssl->buffers.keyId ||
ssl->buffers.keyLabel)) {
if (ssl->buffers.keyType == rsa_sa_algo)
ssl->hsType = DYNAMIC_TYPE_RSA;
else if (ssl->buffers.keyType == ecc_dsa_sa_algo)
Expand All @@ -19922,9 +19998,17 @@ int DecodePrivateKey(WOLFSSL *ssl, word16* length)

if (ssl->buffers.keyType == rsa_sa_algo) {
#ifndef NO_RSA
ret = wc_InitRsaKey_Id((RsaKey*)ssl->hsKey,
ssl->buffers.key->buffer, ssl->buffers.key->length,
ssl->heap, ssl->buffers.keyDevId);
if (ssl->buffers.keyLabel) {
ret = wc_InitRsaKey_Label((RsaKey*)ssl->hsKey,
(char*)ssl->buffers.key->buffer,
ssl->heap, ssl->buffers.keyDevId);
}
else if (ssl->buffers.keyId) {
ret = wc_InitRsaKey_Id((RsaKey*)ssl->hsKey,
ssl->buffers.key->buffer,
ssl->buffers.key->length, ssl->heap,
ssl->buffers.keyDevId);
}
if (ret == 0) {
if (ssl->buffers.keySz < ssl->options.minRsaKeySz) {
WOLFSSL_MSG("RSA key size too small");
Expand All @@ -19940,9 +20024,17 @@ int DecodePrivateKey(WOLFSSL *ssl, word16* length)
}
else if (ssl->buffers.keyType == ecc_dsa_sa_algo) {
#ifdef HAVE_ECC
ret = wc_ecc_init_id((ecc_key*)ssl->hsKey, ssl->buffers.key->buffer,
ssl->buffers.key->length, ssl->heap,
ssl->buffers.keyDevId);
if (ssl->buffers.keyLabel) {
ret = wc_ecc_init_label((ecc_key*)ssl->hsKey,
(char*)ssl->buffers.key->buffer,
ssl->heap, ssl->buffers.keyDevId);
}
else if (ssl->buffers.keyId) {
ret = wc_ecc_init_id((ecc_key*)ssl->hsKey,
ssl->buffers.key->buffer,
ssl->buffers.key->length, ssl->heap,
ssl->buffers.keyDevId);
}
if (ret == 0) {
if (ssl->buffers.keySz < ssl->options.minEccKeySz) {
WOLFSSL_MSG("ECC key size too small");
Expand Down
Loading