blob: aedd85c1c2882bc5844ed4671d514f3f765a4352
1 | /* |
2 | * Copyright 2015 The Android Open Source Project |
3 | * |
4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
5 | * you may not use this file except in compliance with the License. |
6 | * You may obtain a copy of the License at |
7 | * |
8 | * http://www.apache.org/licenses/LICENSE-2.0 |
9 | * |
10 | * Unless required by applicable law or agreed to in writing, software |
11 | * distributed under the License is distributed on an "AS IS" BASIS, |
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
13 | * See the License for the specific language governing permissions and |
14 | * limitations under the License. |
15 | */ |
16 | |
17 | #ifndef SYSTEM_KEYMASTER_KEYMASTER0_ENGINE_H_ |
18 | #define SYSTEM_KEYMASTER_KEYMASTER0_ENGINE_H_ |
19 | |
20 | #include <memory> |
21 | |
22 | #include <openssl/ec.h> |
23 | #include <openssl/engine.h> |
24 | #include <openssl/ex_data.h> |
25 | #include <openssl/rsa.h> |
26 | |
27 | #include <hardware/keymaster0.h> |
28 | #include <hardware/keymaster_defs.h> |
29 | |
30 | namespace keymaster { |
31 | |
32 | struct KeymasterKeyBlob; |
33 | |
34 | /* Keymaster0Engine is a BoringSSL ENGINE that implements RSA & EC by forwarding the requested |
35 | * operations to a keymaster0 module. */ |
36 | class Keymaster0Engine { |
37 | public: |
38 | /** |
39 | * Create a Keymaster0Engine, wrapping the provided keymaster0_device. The engine takes |
40 | * ownership of the device, and will close it during destruction. |
41 | */ |
42 | explicit Keymaster0Engine(const keymaster0_device_t* keymaster0_device); |
43 | ~Keymaster0Engine(); |
44 | |
45 | bool supports_ec() const { return supports_ec_; } |
46 | |
47 | bool GenerateRsaKey(uint64_t public_exponent, uint32_t public_modulus, |
48 | KeymasterKeyBlob* key_material) const; |
49 | bool GenerateEcKey(uint32_t key_size, KeymasterKeyBlob* key_material) const; |
50 | |
51 | bool ImportKey(keymaster_key_format_t key_format, const KeymasterKeyBlob& to_import, |
52 | KeymasterKeyBlob* imported_key_material) const; |
53 | bool DeleteKey(const KeymasterKeyBlob& blob) const; |
54 | bool DeleteAllKeys() const; |
55 | |
56 | RSA* BlobToRsaKey(const KeymasterKeyBlob& blob) const; |
57 | EC_KEY* BlobToEcKey(const KeymasterKeyBlob& blob) const; |
58 | |
59 | const keymaster_key_blob_t* RsaKeyToBlob(const RSA* rsa) const; |
60 | const keymaster_key_blob_t* EcKeyToBlob(const EC_KEY* rsa) const; |
61 | |
62 | const keymaster0_device_t* device() { return keymaster0_device_; } |
63 | |
64 | EVP_PKEY* GetKeymaster0PublicKey(const KeymasterKeyBlob& blob) const; |
65 | |
66 | private: |
67 | Keymaster0Engine(const Keymaster0Engine&); // Uncopyable |
68 | void operator=(const Keymaster0Engine&); // Unassignable |
69 | |
70 | static int keyblob_dup(CRYPTO_EX_DATA* to, const CRYPTO_EX_DATA* from, void** from_d, int index, |
71 | long argl, void* argp); |
72 | static void keyblob_free(void* parent, void* ptr, CRYPTO_EX_DATA* data, int index, long argl, |
73 | void* argp); |
74 | static int rsa_private_transform(RSA* rsa, uint8_t* out, const uint8_t* in, size_t len); |
75 | static int ecdsa_sign(const uint8_t* digest, size_t digest_len, uint8_t* sig, |
76 | unsigned int* sig_len, EC_KEY* ec_key); |
77 | |
78 | struct Malloc_Delete { |
79 | void operator()(void* p) { free(p); } |
80 | }; |
81 | |
82 | bool Keymaster0Sign(const void* signing_params, const keymaster_key_blob_t& key_blob, |
83 | const uint8_t* data, const size_t data_length, |
84 | std::unique_ptr<uint8_t[], Malloc_Delete>* signature, |
85 | size_t* signature_length) const; |
86 | |
87 | int RsaPrivateTransform(RSA* rsa, uint8_t* out, const uint8_t* in, size_t len) const; |
88 | int EcdsaSign(const uint8_t* digest, size_t digest_len, uint8_t* sig, unsigned int* sig_len, |
89 | EC_KEY* ec_key) const; |
90 | |
91 | const keymaster0_device_t* keymaster0_device_; |
92 | ENGINE* const engine_; |
93 | int rsa_index_, ec_key_index_; |
94 | bool supports_ec_; |
95 | RSA_METHOD rsa_method_; |
96 | ECDSA_METHOD ecdsa_method_; |
97 | |
98 | static Keymaster0Engine* instance_; |
99 | }; |
100 | |
101 | } // namespace keymaster |
102 | |
103 | #endif // SYSTEM_KEYMASTER_KEYMASTER0_ENGINE_H_ |
104 |