blob: 6c270774a7f48593d847b40dc6e85cf7ca25908f [file] [log] [blame]
Alexander Afanasyevc169a812014-05-20 20:37:29 -04001/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
Jeff Thompson7b79eb62013-09-12 18:48:29 -07002/**
Alexander Afanasyevaf99f462015-01-19 21:43:09 -08003 * Copyright (c) 2013-2015 Regents of the University of California.
Alexander Afanasyevdfa52c42014-04-24 21:10:11 -07004 *
5 * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
Alexander Afanasyevdfa52c42014-04-24 21:10:11 -07006 *
Alexander Afanasyevc169a812014-05-20 20:37:29 -04007 * ndn-cxx library is free software: you can redistribute it and/or modify it under the
8 * terms of the GNU Lesser General Public License as published by the Free Software
9 * Foundation, either version 3 of the License, or (at your option) any later version.
10 *
11 * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
12 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
13 * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
14 *
15 * You should have received copies of the GNU General Public License and GNU Lesser
16 * General Public License along with ndn-cxx, e.g., in COPYING.md file. If not, see
17 * <http://www.gnu.org/licenses/>.
18 *
19 * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
Alexander Afanasyevdfa52c42014-04-24 21:10:11 -070020 *
21 * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
Jeff Thompson7b79eb62013-09-12 18:48:29 -070022 */
23
Yingdi Yufc40d872014-02-18 12:56:04 -080024#ifndef NDN_SECURITY_SEC_TPM_HPP
25#define NDN_SECURITY_SEC_TPM_HPP
Jeff Thompson7b79eb62013-09-12 18:48:29 -070026
Alexander Afanasyeve2dcdfd2014-02-07 15:53:28 -080027#include "../common.hpp"
Yingdi Yu4f324632014-01-15 18:10:03 -080028#include "security-common.hpp"
29#include "../name.hpp"
30#include "../data.hpp"
31#include "public-key.hpp"
Yingdi Yu7036ce22014-06-19 18:53:37 -070032#include "key-params.hpp"
Jeff Thompson7b79eb62013-09-12 18:48:29 -070033
34namespace ndn {
35
Yingdi Yufc40d872014-02-18 12:56:04 -080036/**
37 * @brief SecTpm is the base class of the TPM classes.
38 *
39 * It specifies the interfaces of private/secret key related operations.
40 */
Yingdi Yuf56c68f2014-04-24 21:50:13 -070041class SecTpm : noncopyable
Alexander Afanasyev2a7f7202014-04-23 14:25:29 -070042{
Jeff Thompsona50703f2013-09-17 14:24:15 -070043public:
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -070044 class Error : public std::runtime_error
45 {
46 public:
47 explicit
48 Error(const std::string& what)
49 : std::runtime_error(what)
50 {
51 }
52 };
Alexander Afanasyeve64788e2014-01-05 22:38:21 -080053
Yingdi Yu41546342014-11-30 23:37:53 -080054 explicit
55 SecTpm(const std::string& location);
56
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -070057 virtual
Yingdi Yu41546342014-11-30 23:37:53 -080058 ~SecTpm();
59
60 std::string
61 getTpmLocator();
Jeff Thompson7b79eb62013-09-12 18:48:29 -070062
Jeff Thompson7b79eb62013-09-12 18:48:29 -070063 /**
Yingdi Yube4150e2014-02-18 13:02:46 -080064 * @brief set password of TPM
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -070065 *
Yingdi Yube4150e2014-02-18 13:02:46 -080066 * Password is used to unlock TPM when it is locked.
Yingdi Yu4b8c6a22014-04-15 23:00:54 -070067 * You should be cautious when using this method, because remembering password is kind of
68 * dangerous.
Yingdi Yube4150e2014-02-18 13:02:46 -080069 *
Alexander Afanasyev770827c2014-05-13 17:42:55 -070070 * @param password The password
71 * @param passwordLength The length of password
Yingdi Yube4150e2014-02-18 13:02:46 -080072 */
73 virtual void
74 setTpmPassword(const uint8_t* password, size_t passwordLength) = 0;
75
76 /**
77 * @brief reset password of TPM
78 */
79 virtual void
80 resetTpmPassword() = 0;
81
82 /**
Davide Pesavento18cf81b2015-09-12 23:36:43 +020083 * @brief Set inTerminal flag to @p inTerminal
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -070084 *
Yingdi Yube4150e2014-02-18 13:02:46 -080085 * If the inTerminal flag is set, and password is not set, TPM may ask for password via terminal.
86 * inTerminal flag is set by default.
Yingdi Yube4150e2014-02-18 13:02:46 -080087 */
88 virtual void
89 setInTerminal(bool inTerminal) = 0;
90
91 /**
Alexander Afanasyev770827c2014-05-13 17:42:55 -070092 * @brief Get value of inTerminal flag
Yingdi Yube4150e2014-02-18 13:02:46 -080093 */
94 virtual bool
Alexander Afanasyev770827c2014-05-13 17:42:55 -070095 getInTerminal() const = 0;
Yingdi Yube4150e2014-02-18 13:02:46 -080096
97 /**
Alexander Afanasyev770827c2014-05-13 17:42:55 -070098 * @brief Check if TPM is locked
Yingdi Yube4150e2014-02-18 13:02:46 -080099 */
100 virtual bool
Yingdi Yuf56c68f2014-04-24 21:50:13 -0700101 isLocked() = 0;
Yingdi Yube4150e2014-02-18 13:02:46 -0800102
103 /**
Alexander Afanasyev770827c2014-05-13 17:42:55 -0700104 * @brief Unlock the TPM
Yingdi Yube4150e2014-02-18 13:02:46 -0800105 *
106 * @param password The password.
107 * @param passwordLength The password size. 0 indicates no password.
108 * @param usePassword True if we want to use the supplied password to unlock the TPM.
Yingdi Yu2e57a582014-02-20 23:34:43 -0800109 * @return true if TPM is unlocked, otherwise false.
Yingdi Yube4150e2014-02-18 13:02:46 -0800110 */
Yingdi Yu2e57a582014-02-20 23:34:43 -0800111 virtual bool
Yingdi Yube4150e2014-02-18 13:02:46 -0800112 unlockTpm(const char* password, size_t passwordLength, bool usePassword) = 0;
113
114 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800115 * @brief Generate a pair of asymmetric keys.
116 *
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700117 * @param keyName The name of the key pair.
Yingdi Yu7036ce22014-06-19 18:53:37 -0700118 * @param params The parameters of key.
Yingdi Yufc40d872014-02-18 12:56:04 -0800119 * @throws SecTpm::Error if fails.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700120 */
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700121 virtual void
Yingdi Yu7036ce22014-06-19 18:53:37 -0700122 generateKeyPairInTpm(const Name& keyName, const KeyParams& params) = 0;
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700123
Yingdi Yu28fd32f2014-01-28 19:03:03 -0800124 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800125 * @brief Delete a key pair of asymmetric keys.
126 *
Yingdi Yu28fd32f2014-01-28 19:03:03 -0800127 * @param keyName The name of the key pair.
128 */
129 virtual void
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700130 deleteKeyPairInTpm(const Name& keyName) = 0;
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700131
132 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800133 * @brief Get a public key.
134 *
135 * @param keyName The public key name.
Yingdi Yu2e57a582014-02-20 23:34:43 -0800136 * @return The public key.
137 * @throws SecTpm::Error if public key does not exist in TPM.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700138 */
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700139 virtual shared_ptr<PublicKey>
Yingdi Yu31b4af22014-01-14 14:13:00 -0800140 getPublicKeyFromTpm(const Name& keyName) = 0;
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700141
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700142 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800143 * @brief Sign data.
144 *
145 * @param data Pointer to the byte array to be signed.
Jeff Thompson4c11b9f2013-09-13 11:05:28 -0700146 * @param dataLength The length of data.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700147 * @param keyName The name of the signing key.
148 * @param digestAlgorithm the digest algorithm.
Yingdi Yu3c5887c2014-01-21 18:19:49 -0800149 * @return The signature block.
Yingdi Yufc40d872014-02-18 12:56:04 -0800150 * @throws SecTpm::Error if signing fails.
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700151 */
Alexander Afanasyeve64788e2014-01-05 22:38:21 -0800152 virtual Block
Yingdi Yu4b8c6a22014-04-15 23:00:54 -0700153 signInTpm(const uint8_t* data, size_t dataLength,
154 const Name& keyName,
155 DigestAlgorithm digestAlgorithm) = 0;
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700156
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700157 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800158 * @brief Decrypt data.
159 *
160 * @param data Pointer to the byte arry to be decrypted.
161 * @param dataLength The length of data.
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700162 * @param keyName The name of the decrypting key.
Yingdi Yufc40d872014-02-18 12:56:04 -0800163 * @param isSymmetric If true symmetric encryption is used, otherwise asymmetric encryption.
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700164 * @return The decrypted data.
Yingdi Yufc40d872014-02-18 12:56:04 -0800165 * @throws SecTpm::Error if decryption fails.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700166 */
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700167 virtual ConstBufferPtr
Yingdi Yufc40d872014-02-18 12:56:04 -0800168 decryptInTpm(const uint8_t* data, size_t dataLength, const Name& keyName, bool isSymmetric) = 0;
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700169
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700170 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800171 * @brief Encrypt data.
172 *
173 * @param data Pointer to the byte arry to be decrypted.
174 * @param dataLength The length of data.
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700175 * @param keyName The name of the encrypting key.
Yingdi Yufc40d872014-02-18 12:56:04 -0800176 * @param isSymmetric If true symmetric encryption is used, otherwise asymmetric encryption.
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700177 * @return The encrypted data.
Yingdi Yufc40d872014-02-18 12:56:04 -0800178 * @throws SecTpm::Error if encryption fails.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700179 */
Alexander Afanasyev64a3d812014-01-05 23:35:05 -0800180 virtual ConstBufferPtr
Yingdi Yufc40d872014-02-18 12:56:04 -0800181 encryptInTpm(const uint8_t* data, size_t dataLength, const Name& keyName, bool isSymmetric) = 0;
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700182
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700183 /**
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700184 * @brief Generate a symmetric key.
Yingdi Yufc40d872014-02-18 12:56:04 -0800185 *
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700186 * @param keyName The name of the key.
Yingdi Yu7036ce22014-06-19 18:53:37 -0700187 * @param params The parameter of the key.
Yingdi Yu2e57a582014-02-20 23:34:43 -0800188 * @throws SecTpm::Error if key generating fails.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700189 */
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700190 virtual void
Yingdi Yu7036ce22014-06-19 18:53:37 -0700191 generateSymmetricKeyInTpm(const Name& keyName, const KeyParams& params) = 0;
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700192
193 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800194 * @brief Check if a particular key exists.
195 *
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700196 * @param keyName The name of the key.
Yingdi Yu4b8c6a22014-04-15 23:00:54 -0700197 * @param keyClass The class of the key, e.g. KEY_CLASS_PUBLIC, KEY_CLASS_PRIVATE.
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700198 * @return True if the key exists, otherwise false.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700199 */
200 virtual bool
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700201 doesKeyExistInTpm(const Name& keyName, KeyClass keyClass) = 0;
Yingdi Yu4b752752014-02-18 12:24:03 -0800202
203 /**
Alexander Afanasyev770827c2014-05-13 17:42:55 -0700204 * @brief Generate a random block
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700205 *
Alexander Afanasyev770827c2014-05-13 17:42:55 -0700206 * @param res The pointer to the generated block
207 * @param size The random block size
208 * @return true for success, otherwise false
Yingdi Yu4b752752014-02-18 12:24:03 -0800209 */
210 virtual bool
211 generateRandomBlock(uint8_t* res, size_t size) = 0;
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800212
213 /**
Alexander Afanasyev770827c2014-05-13 17:42:55 -0700214 * @brief Add the application into the ACL of a particular key
Yingdi Yu2e57a582014-02-20 23:34:43 -0800215 *
216 * @param keyName the name of key
217 * @param keyClass the class of key, e.g. Private Key
218 * @param appPath the absolute path to the application
219 * @param acl the new acl of the key
220 */
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700221 virtual void
Yingdi Yuf56c68f2014-04-24 21:50:13 -0700222 addAppToAcl(const Name& keyName, KeyClass keyClass, const std::string& appPath, AclType acl) = 0;
Yingdi Yu2e57a582014-02-20 23:34:43 -0800223
224 /**
Alexander Afanasyev770827c2014-05-13 17:42:55 -0700225 * @brief Export a private key in PKCS#5 format
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700226 *
Alexander Afanasyev770827c2014-05-13 17:42:55 -0700227 * @param keyName The private key name
228 * @param password The password to encrypt the private key
229 * @return The private key info (in PKCS8 format) if exist
230 * @throws SecTpm::Error if private key cannot be exported
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800231 */
232 ConstBufferPtr
Yingdi Yu5e96e002014-04-23 18:32:15 -0700233 exportPrivateKeyPkcs5FromTpm(const Name& keyName, const std::string& password);
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800234
235 /**
Davide Pesavento18cf81b2015-09-12 23:36:43 +0200236 * @brief Import a private key in PKCS#5 formatted buffer of size @p bufferSize
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700237 *
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800238 * Also recover the public key and installed it in TPM.
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700239 *
Alexander Afanasyev770827c2014-05-13 17:42:55 -0700240 * @param keyName The private key name
241 * @param buffer Pointer to the first byte of the buffer containing PKCS#5-encoded
242 * private key info
243 * @param bufferSize Size of the buffer
244 * @param password The password to encrypt the private key
245 * @return false if import fails
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800246 */
247 bool
Yingdi Yu5e96e002014-04-23 18:32:15 -0700248 importPrivateKeyPkcs5IntoTpm(const Name& keyName,
Alexander Afanasyev770827c2014-05-13 17:42:55 -0700249 const uint8_t* buffer, size_t bufferSize,
Yingdi Yu4b8c6a22014-04-15 23:00:54 -0700250 const std::string& password);
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800251
252protected:
Yingdi Yu41546342014-11-30 23:37:53 -0800253 virtual std::string
254 getScheme() = 0;
255
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800256 /**
Yingdi Yu5e96e002014-04-23 18:32:15 -0700257 * @brief Export a private key in PKCS#8 format.
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700258 *
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800259 * @param keyName The private key name.
Yingdi Yu5e96e002014-04-23 18:32:15 -0700260 * @return The private key info (in PKCS#8 format) if exist, otherwise a NULL pointer.
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800261 */
262 virtual ConstBufferPtr
Yingdi Yu5e96e002014-04-23 18:32:15 -0700263 exportPrivateKeyPkcs8FromTpm(const Name& keyName) = 0;
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800264
265 /**
Davide Pesavento18cf81b2015-09-12 23:36:43 +0200266 * @brief Import a private key from PKCS#8 formatted buffer of size @p bufferSize
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700267 *
Alexander Afanasyev770827c2014-05-13 17:42:55 -0700268 * @param keyName The private key name.
269 * @param buffer Pointer to the first byte of the buffer containing PKCS#8-encoded
270 * private key info
271 * @param bufferSize Size of the buffer
272 * @return false if import fails
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800273 */
274 virtual bool
Alexander Afanasyev770827c2014-05-13 17:42:55 -0700275 importPrivateKeyPkcs8IntoTpm(const Name& keyName, const uint8_t* buffer, size_t bufferSize) = 0;
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800276
277 /**
Davide Pesavento18cf81b2015-09-12 23:36:43 +0200278 * @brief Import a public key in PKCS#1 formatted buffer of size @p bufferSize
Alexander Afanasyevfdbfc6d2014-04-14 15:12:11 -0700279 *
Alexander Afanasyev770827c2014-05-13 17:42:55 -0700280 * @param keyName The public key name
281 * @param buffer Pointer to the first byte of the buffer containing PKCS#1-encoded
282 * private key info
283 * @param bufferSize Size of the buffer
284 * @return false if import fails
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800285 */
286 virtual bool
Alexander Afanasyev770827c2014-05-13 17:42:55 -0700287 importPublicKeyPkcs1IntoTpm(const Name& keyName, const uint8_t* buffer, size_t bufferSize) = 0;
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800288
289 /**
Yingdi Yube4150e2014-02-18 13:02:46 -0800290 * @brief Get import/export password.
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800291 *
292 * @param password On return, the password.
293 * @param prompt Prompt for password, i.e., "Password for key:"
294 * @return true if password has been obtained.
295 */
Yingdi Yu7036ce22014-06-19 18:53:37 -0700296 virtual bool
Yingdi Yube4150e2014-02-18 13:02:46 -0800297 getImpExpPassWord(std::string& password, const std::string& prompt);
Yingdi Yu41546342014-11-30 23:37:53 -0800298
299protected:
300 std::string m_location;
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700301};
302
Yingdi Yufc40d872014-02-18 12:56:04 -0800303} // namespace ndn
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700304
Yingdi Yu41546342014-11-30 23:37:53 -0800305#endif // NDN_SECURITY_SEC_TPM_HPP