summaryrefslogtreecommitdiff
path: root/src/manager/service/key-provider.h
blob: bcc999f2ffe69fa924e5563a5dc2404cdcfec8c3 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
/*
 *  Copyright (c) 2014 - 2019 Samsung Electronics Co., Ltd All Rights Reserved
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License
 */

#pragma once

#include <string.h>
#include <stdint.h>
#include <openssl/rand.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/sha.h>
#include <memory>

#include <ckm/ckm-type.h>

#ifndef SUCCESS
#define SUCCESS               0
#endif
#ifndef ERROR
#define ERROR                -1
#endif
#ifndef INVALID_ARGUMENTS
#define INVALID_ARGUMENTS    -2
#endif
#ifndef VERIFY_DATA_ERROR
#define VERIFY_DATA_ERROR    -3
#endif
#ifndef OPENSSL_ENGINE_ERROR
#define OPENSSL_ENGINE_ERROR -4
#endif
#ifndef UNKNOWN_ERROR
#define UNKNOWN_ERROR        -5
#endif

#define AES256_KEY_LEN_BITS   256
#define AES256_KEY_LEN_BYTSE  (AES256_KEY_LEN_BITS / 8)
// Unused
//#define AES_GCM_TAG_SIZE      32

#define PBKDF2_SALT_LEN       16
#define PBKDF2_ITERATIONS     4096

#define MAX_IV_SIZE           16
#define MAX_SALT_SIZE         16
#define MAX_KEY_SIZE          32
#define MAX_WRAPPED_KEY_SIZE  32
#define MAX_CLIENT_ID_SIZE    32
#define DOMAIN_NAME_SIZE      32

namespace CKM {

typedef struct KeyComponentsInfo_ {
	uint32_t keyLength;
	char client[MAX_CLIENT_ID_SIZE];
	uint8_t salt[MAX_SALT_SIZE];
	uint8_t iv[MAX_IV_SIZE];
	uint8_t tag[MAX_IV_SIZE];
} KeyComponentsInfo;

typedef struct KeyAndInfo_ {
	KeyComponentsInfo keyInfo;
	uint8_t key[MAX_KEY_SIZE];
} KeyAndInfo;

typedef struct WrappedKeyAndInfo_ {
	KeyComponentsInfo keyInfo;
	uint8_t wrappedKey[MAX_WRAPPED_KEY_SIZE];
} WrappedKeyAndInfo;

class WrappedKeyAndInfoContainer {
public:
	WrappedKeyAndInfoContainer();
	WrappedKeyAndInfoContainer(const unsigned char *);
	WrappedKeyAndInfo &getWrappedKeyAndInfo();
	void setKeyInfoKeyLength(const unsigned int);
	void setKeyInfoClient(const std::string);
	void setKeyInfoSalt(const unsigned char *, const int);
	void setKeyInfo(const KeyComponentsInfo *);
	~WrappedKeyAndInfoContainer();

private:
	WrappedKeyAndInfo wrappedKeyAndInfo;
};

class KeyAndInfoContainer {
public:
	KeyAndInfoContainer();
	KeyAndInfoContainer(const unsigned char *);
	KeyAndInfo &getKeyAndInfo();
	void setKeyInfoKeyLength(const unsigned int);
	void setKeyInfo(const KeyComponentsInfo *);
	~KeyAndInfoContainer();

private:
	KeyAndInfo keyAndInfo;
};


// This is internal api so all functions should throw exception on errors.
class KeyProvider {
public:
	// To store in std containers
	KeyProvider();
	// In constructor you must check if SKMM is initialized. On error -> exception
	// keyInWrapForm should be used like this:
	// if (keyInWrapForm.size() != sizeof(WrappedKeyAndInfo))
	//     throw exception; // buffer does not have proper size to store WrappedKeyAndInfo
	// WrappedKeyAndInfo *wkm = static_cast<WrappedKeyAndInfo>(keyInWrapForm.data());
	KeyProvider(const RawBuffer &domainKEKInWrapForm, const Password &password);

	KeyProvider(KeyProvider &&);
	KeyProvider(const KeyProvider &) = delete;
	KeyProvider &operator=(const KeyProvider &) = delete;
	KeyProvider &operator=(KeyProvider &&);

	bool isInitialized();

	// Returns Key used to decrypt database.
	RawBuffer getPureDomainKEK();

	// Returns Key in form used to store key in file
	// Requied by Control::resetPassword(const RawBuffer &newPassword);
	// This api should be used only on Tizen 2.2.1
	RawBuffer getWrappedDomainKEK(const Password &password);

	// EncryptedKey key extracted from database. Used to encrypt application data.
	// This key will be used to decrypt/encrypt data in ROW
	RawBuffer getPureDEK(const RawBuffer &DEKInWrapForm);

	// Returns WRAPPED DEK. This will be written to database.
	// This key will be used to encrypt all application information.
	// All application are identified by client id.
	RawBuffer generateDEK(const ClientId &client);

	// used by change user password. On error -> exception
	static RawBuffer reencrypt(
		const RawBuffer &domainKEKInWrapForm,
		const Password &oldPass,
		const Password &newPass);

	// First run of application for some user. DomainKEK was not created yet. We must create one.
	// This key will be used to encrypt user database.
	static RawBuffer generateDomainKEK(const std::string &user,
									   const Password &userPassword);

	// This will be called by framework at the begin of the program
	static int initializeLibrary();
	// This will be called by framework at the end of the program
	static int closeLibrary();

	virtual ~KeyProvider();

private:
	// KeyAndInfoContainer class
	std::shared_ptr<KeyAndInfoContainer> m_kmcDKEK;
	bool m_isInitialized;

	static int encryptAes256Gcm(
		const unsigned char *plaintext,
		int plaintext_len,
		const unsigned char *key,
		const unsigned char *iv,
		unsigned char *ciphertext,
		unsigned char *tag);

	static int decryptAes256Gcm(
		const unsigned char *ciphertext,
		int ciphertext_len,
		unsigned char *tag,
		const unsigned char *key,
		const unsigned char *iv,
		unsigned char *plaintext);

	static char *concat_password_user(
		const char *user,
		const char *password);
};

} // namespace CKM