pal_crypto.h 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168
  1. /* Copyright (C) 2014 Stony Brook University
  2. This file is part of Graphene Library OS.
  3. Graphene Library OS is free software: you can redistribute it and/or
  4. modify it under the terms of the GNU Lesser General Public License
  5. as published by the Free Software Foundation, either version 3 of the
  6. License, or (at your option) any later version.
  7. Graphene Library OS is distributed in the hope that it will be useful,
  8. but WITHOUT ANY WARRANTY; without even the implied warranty of
  9. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  10. GNU Lesser General Public License for more details.
  11. You should have received a copy of the GNU Lesser General Public License
  12. along with this program. If not, see <http://www.gnu.org/licenses/>. */
  13. /*
  14. * Cryptographic primitive abstractions. This layer provides a way to
  15. * change the crypto library without changing the rest of Graphene code
  16. * by providing a small crypto library adaptor implementing these methods.
  17. */
  18. #ifndef PAL_CRYPTO_H
  19. #define PAL_CRYPTO_H
  20. #include <stddef.h>
  21. #include <stdint.h>
  22. #include <stdbool.h>
  23. #define SHA256_DIGEST_LEN 32
  24. #ifdef CRYPTO_USE_MBEDTLS
  25. #define CRYPTO_PROVIDER_SPECIFIED
  26. #include "crypto/mbedtls/include/mbedtls/cmac.h"
  27. typedef struct AES LIB_AES_CONTEXT;
  28. #include "crypto/mbedtls/include/mbedtls/dhm.h"
  29. #include "crypto/mbedtls/include/mbedtls/rsa.h"
  30. #include "crypto/mbedtls/include/mbedtls/sha256.h"
  31. typedef mbedtls_sha256_context LIB_SHA256_CONTEXT;
  32. /* DH_SIZE is tied to the choice of parameters in mbedtls_dh.c. */
  33. #define DH_SIZE 256
  34. #include "crypto/mbedtls/include/mbedtls/dhm.h"
  35. typedef mbedtls_dhm_context LIB_DH_CONTEXT;
  36. typedef mbedtls_rsa_context LIB_RSA_KEY;
  37. typedef struct {
  38. mbedtls_cipher_type_t cipher;
  39. mbedtls_cipher_context_t ctx;
  40. } LIB_AESCMAC_CONTEXT;
  41. #include "crypto/mbedtls/include/mbedtls/ctr_drbg.h"
  42. #include "crypto/mbedtls/include/mbedtls/entropy.h"
  43. #include "crypto/mbedtls/include/mbedtls/ssl.h"
  44. typedef struct {
  45. mbedtls_entropy_context entropy;
  46. mbedtls_ctr_drbg_context ctr_drbg;
  47. mbedtls_ssl_config conf;
  48. mbedtls_ssl_context ssl;
  49. int ciphersuites[2]; /* [0] is actual ciphersuite, [1] must be 0 to indicate end of array */
  50. int (*pal_recv_cb)(int fd, void* buf, uint32_t len);
  51. int (*pal_send_cb)(int fd, const void* buf, uint32_t len);
  52. int stream_fd;
  53. } LIB_SSL_CONTEXT;
  54. #endif /* CRYPTO_USE_MBEDTLS */
  55. #ifndef CRYPTO_PROVIDER_SPECIFIED
  56. # error "Unknown crypto provider. Set CRYPTO_PROVIDER in Makefile"
  57. #endif
  58. /* SHA256 */
  59. int lib_SHA256Init(LIB_SHA256_CONTEXT *context);
  60. int lib_SHA256Update(LIB_SHA256_CONTEXT *context, const uint8_t *data,
  61. uint64_t len);
  62. int lib_SHA256Final(LIB_SHA256_CONTEXT *context, uint8_t *output);
  63. /* Diffie-Hellman Key Exchange */
  64. int lib_DhInit(LIB_DH_CONTEXT *context);
  65. int lib_DhCreatePublic(LIB_DH_CONTEXT *context, uint8_t *public,
  66. uint64_t *public_size);
  67. int lib_DhCalcSecret(LIB_DH_CONTEXT *context, uint8_t *peer, uint64_t peer_size,
  68. uint8_t *secret, uint64_t *secret_size);
  69. void lib_DhFinal(LIB_DH_CONTEXT *context);
  70. /* AES-CMAC */
  71. int lib_AESCMAC(const uint8_t *key, uint64_t key_len, const uint8_t *input,
  72. uint64_t input_len, uint8_t *mac, uint64_t mac_len);
  73. /* note: 'lib_AESCMAC' is the combination of 'lib_AESCMACInit',
  74. * 'lib_AESCMACUpdate', and 'lib_AESCMACFinish'. */
  75. int lib_AESCMACInit(LIB_AESCMAC_CONTEXT * context,
  76. const uint8_t *key, uint64_t key_len);
  77. int lib_AESCMACUpdate(LIB_AESCMAC_CONTEXT * context, const uint8_t * input,
  78. uint64_t input_len);
  79. int lib_AESCMACFinish(LIB_AESCMAC_CONTEXT * context, uint8_t * mac,
  80. uint64_t mac_len);
  81. /* RSA. Limited functionality. */
  82. // Initializes the key structure
  83. int lib_RSAInitKey(LIB_RSA_KEY *key);
  84. // Must call lib_RSAInitKey first
  85. int lib_RSAGenerateKey(LIB_RSA_KEY *key, uint64_t length_in_bits,
  86. uint64_t exponent);
  87. int lib_RSAExportPublicKey(LIB_RSA_KEY *key, uint8_t *e, uint64_t *e_size,
  88. uint8_t *n, uint64_t *n_size);
  89. int lib_RSAImportPublicKey(LIB_RSA_KEY *key, const uint8_t *e, uint64_t e_size,
  90. const uint8_t *n, uint64_t n_size);
  91. // Sign and verify signatures.
  92. // This function must implement RSA signature verification using PKCS#1 v1.5
  93. // padding, with SHA256 as the hash mechanism. These signatures are generated
  94. // by the Graphene filesystem build (so outside of a running Graphene
  95. // application), but are verified within the Graphene application.
  96. int lib_RSAVerifySHA256(LIB_RSA_KEY* key, const uint8_t* hash, uint64_t hash_len,
  97. const uint8_t* signature, uint64_t signature_len);
  98. // Frees memory allocated in lib_RSAInitKey.
  99. int lib_RSAFreeKey(LIB_RSA_KEY *key);
  100. // Encode and decode Base64 messages.
  101. // These two functions can be used to query encode and decode sizes if dst is given NULL
  102. int lib_Base64Encode(const uint8_t* src, size_t slen, char* dst, size_t* dlen);
  103. int lib_Base64Decode(const char *src, size_t slen, uint8_t* dst, size_t* dlen);
  104. #ifdef CRYPTO_USE_MBEDTLS
  105. #include "crypto/mbedtls/include/mbedtls/asn1.h"
  106. enum asn1_tag {
  107. ASN1_BOOLEAN = MBEDTLS_ASN1_BOOLEAN,
  108. ASN1_INTEGET = MBEDTLS_ASN1_INTEGER,
  109. ASN1_BIT_STRING = MBEDTLS_ASN1_BIT_STRING,
  110. ASN1_OCTET_STRING = MBEDTLS_ASN1_OCTET_STRING,
  111. ASN1_NULL = MBEDTLS_ASN1_NULL,
  112. ASN1_OID = MBEDTLS_ASN1_OID,
  113. ASN1_UTF8_STRING = MBEDTLS_ASN1_UTF8_STRING,
  114. ASN1_SEQUENCE = MBEDTLS_ASN1_SEQUENCE,
  115. ASN1_SET = MBEDTLS_ASN1_SET,
  116. ASN1_PRINTABLE_STRING = MBEDTLS_ASN1_PRINTABLE_STRING,
  117. ASN1_T61_STRING = MBEDTLS_ASN1_T61_STRING,
  118. ASN1_IA5_STRING = MBEDTLS_ASN1_IA5_STRING,
  119. ASN1_UTC_TIME = MBEDTLS_ASN1_UTC_TIME,
  120. ASN1_GENERALIZED_TIME = MBEDTLS_ASN1_GENERALIZED_TIME,
  121. ASN1_UNIVERSAL_STRING = MBEDTLS_ASN1_UNIVERSAL_STRING,
  122. ASN1_BMP_STRING = MBEDTLS_ASN1_BMP_STRING,
  123. };
  124. #endif /* CRYPTO_USE_MBEDTLS */
  125. int lib_ASN1GetSerial(uint8_t** ptr, const uint8_t* end, enum asn1_tag* tag, bool* is_construct,
  126. uint8_t** buf, size_t* len);
  127. int lib_ASN1GetBitstring(uint8_t** ptr, const uint8_t* end, uint8_t** str, size_t* len);
  128. int lib_ASN1GetLargeNumberLength(uint8_t** ptr, const uint8_t* end, size_t* len);
  129. /* SSL/TLS */
  130. int lib_SSLInit(LIB_SSL_CONTEXT* ssl_ctx, int stream_fd, bool is_server,
  131. const uint8_t* psk, size_t psk_size,
  132. int (*pal_recv_cb)(int fd, void* buf, uint32_t len),
  133. int (*pal_send_cb)(int fd, const void* buf, uint32_t len));
  134. int lib_SSLFree(LIB_SSL_CONTEXT* ssl_ctx);
  135. int lib_SSLRead(LIB_SSL_CONTEXT* ssl_ctx, uint8_t* buf, size_t len);
  136. int lib_SSLWrite(LIB_SSL_CONTEXT* ssl_ctx, const uint8_t* buf, size_t len);
  137. #endif