security/nss/lib/softoken/softoken.h

   1 /*
   2  * softoken.h - private data structures and prototypes for the softoken lib
   3  *
   4  * ***** BEGIN LICENSE BLOCK *****
   5  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
   6  *
   7  * The contents of this file are subject to the Mozilla Public License Version
   8  * 1.1 (the "License"); you may not use this file except in compliance with
   9  * the License. You may obtain a copy of the License at
  10  * http://www.mozilla.org/MPL/
  11  *
  12  * Software distributed under the License is distributed on an "AS IS" basis,
  13  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  14  * for the specific language governing rights and limitations under the
  15  * License.
  16  *
  17  * The Original Code is the Netscape security libraries.
  18  *
  19  * The Initial Developer of the Original Code is
  20  * Netscape Communications Corporation.
  21  * Portions created by the Initial Developer are Copyright (C) 1994-2000
  22  * the Initial Developer. All Rights Reserved.
  23  *
  24  * Contributor(s):
  25  *
  26  * Alternatively, the contents of this file may be used under the terms of
  27  * either the GNU General Public License Version 2 or later (the "GPL"), or
  28  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  29  * in which case the provisions of the GPL or the LGPL are applicable instead
  30  * of those above. If you wish to allow use of your version of this file only
  31  * under the terms of either the GPL or the LGPL, and not to allow others to
  32  * use your version of this file under the terms of the MPL, indicate your
  33  * decision by deleting the provisions above and replace them with the notice
  34  * and other provisions required by the GPL or the LGPL. If you do not delete
  35  * the provisions above, a recipient may use your version of this file under
  36  * the terms of any one of the MPL, the GPL or the LGPL.
  37  *
  38  * ***** END LICENSE BLOCK ***** */
  39 /* $Id: softoken.h,v 1.17 2008/02/05 05:33:37 julien.pierre.boogz%sun.com Exp $ */
  40
  41 #ifndef _SOFTOKEN_H_
  42 #define _SOFTOKEN_H_
  43
  44 #include "blapi.h"
  45 #include "lowkeyti.h"
  46 #include "softoknt.h"
  47 #include "secoidt.h"
  48
  49 #include "pkcs11t.h"     /* CK_RV Required for sftk_fipsPowerUpSelfTest(). */
  50
  51 SEC_BEGIN_PROTOS
  52
  53 /*
  54 ** RSA encryption/decryption. When encrypting/decrypting the output
  55 ** buffer must be at least the size of the public key modulus.
  56 */
  57
  58 /*
  59 ** Format some data into a PKCS#1 encryption block, preparing the
  60 ** data for RSA encryption.
  61 **      "result" where the formatted block is stored (memory is allocated)
  62 **      "modulusLen" the size of the formatted block
  63 **      "blockType" what block type to use (SEC_RSABlock*)
  64 **      "data" the data to format
  65 */
  66 extern SECStatus RSA_FormatBlock(SECItem *result,
  67                                  unsigned int modulusLen,
  68                                  RSA_BlockType blockType,
  69                                  SECItem *data);
  70 /*
  71 ** Similar, but just returns a pointer to the allocated memory, *and*
  72 ** will *only* format one block, even if we (in the future) modify
  73 ** RSA_FormatBlock() to loop over multiples of modulusLen.
  74 */
  75 extern unsigned char *RSA_FormatOneBlock(unsigned int modulusLen,
  76                                          RSA_BlockType blockType,
  77                                          SECItem *data);
  78
  79
  80
  81 /*
  82  * convenience wrappers for doing single RSA operations. They create the
  83  * RSA context internally and take care of the formatting
  84  * requirements. Blinding happens automagically within RSA_Sign and
  85  * RSA_DecryptBlock.
  86  */
  87 extern
  88 SECStatus RSA_Sign(NSSLOWKEYPrivateKey *key, unsigned char *output,
  89                        unsigned int *outputLen, unsigned int maxOutputLen,
  90                        unsigned char *input, unsigned int inputLen);
  91 extern
  92 SECStatus RSA_HashSign(SECOidTag hashOid,
  93                         NSSLOWKEYPrivateKey *key, unsigned char *sig,
  94                         unsigned int *sigLen, unsigned int maxLen,
  95                         unsigned char *hash, unsigned int hashLen);
  96 extern
  97 SECStatus RSA_CheckSign(NSSLOWKEYPublicKey *key, unsigned char *sign,
  98                             unsigned int signLength, unsigned char *hash,
  99                             unsigned int hashLength);
 100 extern
 101 SECStatus RSA_HashCheckSign(SECOidTag hashOid,
 102                             NSSLOWKEYPublicKey *key, unsigned char *sig,
 103                             unsigned int sigLen, unsigned char *digest,
 104                             unsigned int digestLen);
 105 extern
 106 SECStatus RSA_CheckSignRecover(NSSLOWKEYPublicKey *key, unsigned char *data,
 107                             unsigned int *data_len,unsigned int max_output_len,
 108                             unsigned char *sign, unsigned int sign_len);
 109 extern
 110 SECStatus RSA_EncryptBlock(NSSLOWKEYPublicKey *key, unsigned char *output,
 111                            unsigned int *outputLen, unsigned int maxOutputLen,
 112                            unsigned char *input, unsigned int inputLen);
 113 extern
 114 SECStatus RSA_DecryptBlock(NSSLOWKEYPrivateKey *key, unsigned char *output,
 115                            unsigned int *outputLen, unsigned int maxOutputLen,
 116                            unsigned char *input, unsigned int inputLen);
 117
 118 /*
 119  * added to make pkcs #11 happy
 120  *   RAW is RSA_X_509
 121  */
 122 extern
 123 SECStatus RSA_SignRaw( NSSLOWKEYPrivateKey *key, unsigned char *output,
 124                          unsigned int *output_len, unsigned int maxOutputLen,
 125                          unsigned char *input, unsigned int input_len);
 126 extern
 127 SECStatus RSA_CheckSignRaw( NSSLOWKEYPublicKey *key, unsigned char *sign,
 128                             unsigned int sign_len, unsigned char *hash,
 129                             unsigned int hash_len);
 130 extern
 131 SECStatus RSA_CheckSignRecoverRaw( NSSLOWKEYPublicKey *key, unsigned char *data,
 132                             unsigned int *data_len, unsigned int max_output_len,
 133                             unsigned char *sign, unsigned int sign_len);
 134 extern
 135 SECStatus RSA_EncryptRaw( NSSLOWKEYPublicKey *key, unsigned char *output,
 136                             unsigned int *output_len,
 137                             unsigned int max_output_len,
 138                             unsigned char *input, unsigned int input_len);
 139 extern
 140 SECStatus RSA_DecryptRaw(NSSLOWKEYPrivateKey *key, unsigned char *output,
 141                              unsigned int *output_len,
 142                              unsigned int max_output_len,
 143                              unsigned char *input, unsigned int input_len);
 144 #ifdef NSS_ENABLE_ECC
 145 /*
 146 ** pepare an ECParam structure from DEREncoded params
 147  */
 148 extern SECStatus EC_FillParams(PRArenaPool *arena,
 149                                const SECItem *encodedParams, ECParams *params);
 150 extern SECStatus EC_DecodeParams(const SECItem *encodedParams,
 151                                 ECParams **ecparams);
 152 extern SECStatus EC_CopyParams(PRArenaPool *arena, ECParams *dstParams,
 153                                 const ECParams *srcParams);
 154 #endif
 155
 156
 157 /*
 158 ** Prepare a buffer for padded CBC encryption, growing to the appropriate
 159 ** boundary, filling with the appropriate padding.
 160 **
 161 ** blockSize must be a power of 2.
 162 **
 163 ** We add from 1 to blockSize bytes -- we *always* grow.
 164 ** The extra bytes contain the value of the length of the padding:
 165 ** if we have 2 bytes of padding, then the padding is "0x02, 0x02".
 166 **
 167 ** NOTE: If arena is non-NULL, we re-allocate from there, otherwise
 168 ** we assume (and use) PR memory (re)allocation.
 169 */
 170 extern unsigned char * CBC_PadBuffer(PRArenaPool *arena, unsigned char *inbuf,
 171                                      unsigned int inlen, unsigned int *outlen,
 172                                      int blockSize);
 173
 174
 175 /****************************************/
 176 /*
 177 ** Power-Up selftests required for FIPS and invoked only
 178 ** under PKCS #11 FIPS mode.
 179 */
 180 extern CK_RV sftk_fipsPowerUpSelfTest( void );
 181
 182 /*
 183 ** make known fixed PKCS #11 key types to their sizes in bytes
 184 */
 185 unsigned long sftk_MapKeySize(CK_KEY_TYPE keyType);
 186
 187 /*
 188 ** FIPS 140-2 auditing
 189 */
 190 extern PRBool sftk_audit_enabled;
 191
 192 extern void sftk_LogAuditMessage(NSSAuditSeverity severity, const char *msg);
 193
 194 extern void sftk_AuditCreateObject(CK_SESSION_HANDLE hSession,
 195                         CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
 196                         CK_OBJECT_HANDLE_PTR phObject, CK_RV rv);
 197
 198 extern void sftk_AuditCopyObject(CK_SESSION_HANDLE hSession,
 199                         CK_OBJECT_HANDLE hObject,
 200                         CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
 201                         CK_OBJECT_HANDLE_PTR phNewObject, CK_RV rv);
 202
 203 extern void sftk_AuditDestroyObject(CK_SESSION_HANDLE hSession,
 204                         CK_OBJECT_HANDLE hObject, CK_RV rv);
 205
 206 extern void sftk_AuditGetObjectSize(CK_SESSION_HANDLE hSession,
 207                         CK_OBJECT_HANDLE hObject, CK_ULONG_PTR pulSize,
 208                         CK_RV rv);
 209
 210 extern void sftk_AuditGetAttributeValue(CK_SESSION_HANDLE hSession,
 211                         CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate,
 212                         CK_ULONG ulCount, CK_RV rv);
 213
 214 extern void sftk_AuditSetAttributeValue(CK_SESSION_HANDLE hSession,
 215                         CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate,
 216                         CK_ULONG ulCount, CK_RV rv);
 217
 218 extern void sftk_AuditCryptInit(const char *opName,
 219                         CK_SESSION_HANDLE hSession,
 220                         CK_MECHANISM_PTR pMechanism,
 221                         CK_OBJECT_HANDLE hKey, CK_RV rv);
 222
 223 extern void sftk_AuditGenerateKey(CK_SESSION_HANDLE hSession,
 224                         CK_MECHANISM_PTR pMechanism,
 225                         CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
 226                         CK_OBJECT_HANDLE_PTR phKey, CK_RV rv);
 227
 228 extern void sftk_AuditGenerateKeyPair(CK_SESSION_HANDLE hSession,
 229                         CK_MECHANISM_PTR pMechanism,
 230                         CK_ATTRIBUTE_PTR pPublicKeyTemplate,
 231                         CK_ULONG ulPublicKeyAttributeCount,
 232                         CK_ATTRIBUTE_PTR pPrivateKeyTemplate,
 233                         CK_ULONG ulPrivateKeyAttributeCount,
 234                         CK_OBJECT_HANDLE_PTR phPublicKey,
 235                         CK_OBJECT_HANDLE_PTR phPrivateKey, CK_RV rv);
 236
 237 extern void sftk_AuditWrapKey(CK_SESSION_HANDLE hSession,
 238                         CK_MECHANISM_PTR pMechanism,
 239                         CK_OBJECT_HANDLE hWrappingKey, CK_OBJECT_HANDLE hKey,
 240                         CK_BYTE_PTR pWrappedKey,
 241                         CK_ULONG_PTR pulWrappedKeyLen, CK_RV rv);
 242
 243 extern void sftk_AuditUnwrapKey(CK_SESSION_HANDLE hSession,
 244                         CK_MECHANISM_PTR pMechanism,
 245                         CK_OBJECT_HANDLE hUnwrappingKey,
 246                         CK_BYTE_PTR pWrappedKey, CK_ULONG ulWrappedKeyLen,
 247                         CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount,
 248                         CK_OBJECT_HANDLE_PTR phKey, CK_RV rv);
 249
 250 extern void sftk_AuditDeriveKey(CK_SESSION_HANDLE hSession,
 251                         CK_MECHANISM_PTR pMechanism,
 252                         CK_OBJECT_HANDLE hBaseKey,
 253                         CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount,
 254                         CK_OBJECT_HANDLE_PTR phKey, CK_RV rv);
 255
 256 extern void sftk_AuditDigestKey(CK_SESSION_HANDLE hSession,
 257                         CK_OBJECT_HANDLE hKey, CK_RV rv);
 258
 259 /*
 260 ** FIPS 140-2 Error state
 261 */
 262 extern PRBool sftk_fatalError;
 263
 264 /*
 265 ** macros to check for forked child after C_Initialize
 266 */
 267 #if defined(XP_UNIX) && !defined(NO_PTHREADS)
 268
 269 extern PRBool forked;
 270
 271 extern void ForkedChild(void);
 272
 273 #define CHECK_FORK() \
 274     do { if (forked) return CKR_DEVICE_ERROR; } while (0)
 275
 276 #else
 277
 278 #define CHECK_FORK()
 279
 280 #endif
 281
 282 SEC_END_PROTOS
 283
 284 #endif /* _SOFTOKEN_H_ */