blob: 97547a49470a66f6b7c2576741b064201da10414 [file] [log] [blame]
Jeff Thompson25b4e612013-10-10 16:03:24 -07001/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil -*- */
Jeff Thompson7b79eb62013-09-12 18:48:29 -07002/**
Jeff Thompson7687dc02013-09-13 11:54:07 -07003 * Copyright (C) 2013 Regents of the University of California.
Jeff Thompson7b79eb62013-09-12 18:48:29 -07004 * @author: Yingdi Yu <yingdi@cs.ucla.edu>
Jeff Thompson7687dc02013-09-13 11:54:07 -07005 * @author: Jeff Thompson <jefft0@remap.ucla.edu>
Jeff Thompson7b79eb62013-09-12 18:48:29 -07006 * See COPYING for copyright and distribution information.
7 */
8
Yingdi Yufc40d872014-02-18 12:56:04 -08009#ifndef NDN_SECURITY_SEC_TPM_HPP
10#define NDN_SECURITY_SEC_TPM_HPP
Jeff Thompson7b79eb62013-09-12 18:48:29 -070011
Alexander Afanasyeve2dcdfd2014-02-07 15:53:28 -080012#include "../common.hpp"
Yingdi Yu4f324632014-01-15 18:10:03 -080013#include "security-common.hpp"
14#include "../name.hpp"
15#include "../data.hpp"
16#include "public-key.hpp"
Jeff Thompson7b79eb62013-09-12 18:48:29 -070017
18namespace ndn {
19
Yingdi Yufc40d872014-02-18 12:56:04 -080020/**
21 * @brief SecTpm is the base class of the TPM classes.
22 *
23 * It specifies the interfaces of private/secret key related operations.
24 */
Yingdi Yu31b4af22014-01-14 14:13:00 -080025class SecTpm {
Jeff Thompsona50703f2013-09-17 14:24:15 -070026public:
Alexander Afanasyeve64788e2014-01-05 22:38:21 -080027 struct Error : public std::runtime_error { Error(const std::string &what) : std::runtime_error(what) {} };
28
Jeff Thompson7b79eb62013-09-12 18:48:29 -070029 virtual
Yingdi Yu31b4af22014-01-14 14:13:00 -080030 ~SecTpm() {}
Jeff Thompson7b79eb62013-09-12 18:48:29 -070031
Jeff Thompson7b79eb62013-09-12 18:48:29 -070032 /**
Yingdi Yube4150e2014-02-18 13:02:46 -080033 * @brief set password of TPM
34 *
35 * Password is used to unlock TPM when it is locked.
36 * You should be cautious when using this method, because remembering password is kind of dangerous.
37 *
38 * @param password The password.
39 * @param passwordLength The length of password.
40 */
41 virtual void
42 setTpmPassword(const uint8_t* password, size_t passwordLength) = 0;
43
44 /**
45 * @brief reset password of TPM
46 */
47 virtual void
48 resetTpmPassword() = 0;
49
50 /**
51 * @brief set inTerminal flag
52 *
53 * If the inTerminal flag is set, and password is not set, TPM may ask for password via terminal.
54 * inTerminal flag is set by default.
55 *
56 * @param inTerminal.
57 */
58 virtual void
59 setInTerminal(bool inTerminal) = 0;
60
61 /**
62 * @brief get inTerminal flag
63 *
64 * @return inTerminal flag.
65 */
66 virtual bool
67 getInTerminal() = 0;
68
69 /**
70 * @brief check if TPM is locked.
71 *
72 * @return true if locked, false otherwise
73 */
74 virtual bool
75 locked() = 0;
76
77 /**
78 * @brief Unlock the TPM.
79 *
80 * @param password The password.
81 * @param passwordLength The password size. 0 indicates no password.
82 * @param usePassword True if we want to use the supplied password to unlock the TPM.
Yingdi Yu2e57a582014-02-20 23:34:43 -080083 * @return true if TPM is unlocked, otherwise false.
Yingdi Yube4150e2014-02-18 13:02:46 -080084 */
Yingdi Yu2e57a582014-02-20 23:34:43 -080085 virtual bool
Yingdi Yube4150e2014-02-18 13:02:46 -080086 unlockTpm(const char* password, size_t passwordLength, bool usePassword) = 0;
87
88 /**
Yingdi Yufc40d872014-02-18 12:56:04 -080089 * @brief Generate a pair of asymmetric keys.
90 *
Jeff Thompson6c314bc2013-09-23 18:09:38 -070091 * @param keyName The name of the key pair.
92 * @param keyType The type of the key pair, e.g. KEY_TYPE_RSA.
93 * @param keySize The size of the key pair.
Yingdi Yufc40d872014-02-18 12:56:04 -080094 * @throws SecTpm::Error if fails.
Jeff Thompson7b79eb62013-09-12 18:48:29 -070095 */
96 virtual void
Yingdi Yu31b4af22014-01-14 14:13:00 -080097 generateKeyPairInTpm(const Name& keyName, KeyType keyType, int keySize) = 0;
Yingdi Yu28fd32f2014-01-28 19:03:03 -080098
99 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800100 * @brief Delete a key pair of asymmetric keys.
101 *
Yingdi Yu28fd32f2014-01-28 19:03:03 -0800102 * @param keyName The name of the key pair.
103 */
104 virtual void
105 deleteKeyPairInTpm(const Name &keyName) = 0;
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700106
107 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800108 * @brief Get a public key.
109 *
110 * @param keyName The public key name.
Yingdi Yu2e57a582014-02-20 23:34:43 -0800111 * @return The public key.
112 * @throws SecTpm::Error if public key does not exist in TPM.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700113 */
Yingdi Yufc40d872014-02-18 12:56:04 -0800114 virtual shared_ptr<PublicKey>
Yingdi Yu31b4af22014-01-14 14:13:00 -0800115 getPublicKeyFromTpm(const Name& keyName) = 0;
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700116
117 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800118 * @brief Sign data.
119 *
120 * @param data Pointer to the byte array to be signed.
Jeff Thompson4c11b9f2013-09-13 11:05:28 -0700121 * @param dataLength The length of data.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700122 * @param keyName The name of the signing key.
123 * @param digestAlgorithm the digest algorithm.
Yingdi Yu3c5887c2014-01-21 18:19:49 -0800124 * @return The signature block.
Yingdi Yufc40d872014-02-18 12:56:04 -0800125 * @throws SecTpm::Error if signing fails.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700126 */
Alexander Afanasyeve64788e2014-01-05 22:38:21 -0800127 virtual Block
Yingdi Yub4bb85a2014-01-16 10:11:04 -0800128 signInTpm(const uint8_t *data, size_t dataLength, const Name& keyName, DigestAlgorithm digestAlgorithm) = 0;
Alexander Afanasyevbf1a67a2014-01-05 23:36:13 -0800129
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700130 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800131 * @brief Decrypt data.
132 *
133 * @param data Pointer to the byte arry to be decrypted.
134 * @param dataLength The length of data.
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700135 * @param keyName The name of the decrypting key.
Yingdi Yufc40d872014-02-18 12:56:04 -0800136 * @param isSymmetric If true symmetric encryption is used, otherwise asymmetric encryption.
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700137 * @return The decrypted data.
Yingdi Yufc40d872014-02-18 12:56:04 -0800138 * @throws SecTpm::Error if decryption fails.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700139 */
Alexander Afanasyev64a3d812014-01-05 23:35:05 -0800140 virtual ConstBufferPtr
Yingdi Yufc40d872014-02-18 12:56:04 -0800141 decryptInTpm(const uint8_t* data, size_t dataLength, const Name& keyName, bool isSymmetric) = 0;
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700142
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700143 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800144 * @brief Encrypt data.
145 *
146 * @param data Pointer to the byte arry to be decrypted.
147 * @param dataLength The length of data.
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700148 * @param keyName The name of the encrypting key.
Yingdi Yufc40d872014-02-18 12:56:04 -0800149 * @param isSymmetric If true symmetric encryption is used, otherwise asymmetric encryption.
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700150 * @return The encrypted data.
Yingdi Yufc40d872014-02-18 12:56:04 -0800151 * @throws SecTpm::Error if encryption fails.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700152 */
Alexander Afanasyev64a3d812014-01-05 23:35:05 -0800153 virtual ConstBufferPtr
Yingdi Yufc40d872014-02-18 12:56:04 -0800154 encryptInTpm(const uint8_t* data, size_t dataLength, const Name& keyName, bool isSymmetric) = 0;
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700155
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700156 /**
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700157 * @brief Generate a symmetric key.
Yingdi Yufc40d872014-02-18 12:56:04 -0800158 *
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700159 * @param keyName The name of the key.
160 * @param keyType The type of the key, e.g. KEY_TYPE_AES.
161 * @param keySize The size of the key.
Yingdi Yu2e57a582014-02-20 23:34:43 -0800162 * @throws SecTpm::Error if key generating fails.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700163 */
164 virtual void
Yingdi Yub4bb85a2014-01-16 10:11:04 -0800165 generateSymmetricKeyInTpm(const Name& keyName, KeyType keyType, int keySize) = 0;
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700166
167 /**
Yingdi Yufc40d872014-02-18 12:56:04 -0800168 * @brief Check if a particular key exists.
169 *
Jeff Thompson6c314bc2013-09-23 18:09:38 -0700170 * @param keyName The name of the key.
171 * @param keyClass The class of the key, e.g. KEY_CLASS_PUBLIC, KEY_CLASS_PRIVATE, or KEY_CLASS_SYMMETRIC.
172 * @return True if the key exists, otherwise false.
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700173 */
174 virtual bool
Yingdi Yub4bb85a2014-01-16 10:11:04 -0800175 doesKeyExistInTpm(const Name& keyName, KeyClass keyClass) = 0;
Yingdi Yu4b752752014-02-18 12:24:03 -0800176
177 /**
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800178 * @brief Generate a random block.
Yingdi Yu4b752752014-02-18 12:24:03 -0800179 *
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800180 * @param res The pointer to the generated block.
181 * @param size The random block size.
Yingdi Yu4b752752014-02-18 12:24:03 -0800182 * @return true for success, otherwise false.
183 */
184 virtual bool
185 generateRandomBlock(uint8_t* res, size_t size) = 0;
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800186
187 /**
Yingdi Yu2e57a582014-02-20 23:34:43 -0800188 * @brief Add the application into the ACL of a particular key.
189 *
190 * @param keyName the name of key
191 * @param keyClass the class of key, e.g. Private Key
192 * @param appPath the absolute path to the application
193 * @param acl the new acl of the key
194 */
195 virtual void
196 addAppToACL(const Name& keyName, KeyClass keyClass, const std::string& appPath, AclType acl) = 0;
197
198 /**
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800199 * @brief Export a private key in PKCS#8 format.
200 *
201 * @param keyName The private key name.
202 * @param password The password to encrypt the private key.
Yingdi Yu2e57a582014-02-20 23:34:43 -0800203 * @return The private key info (in PKCS8 format) if exist.
204 * @throws SecTpm::Error if private key cannot be exported.
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800205 */
206 ConstBufferPtr
Yingdi Yube4150e2014-02-18 13:02:46 -0800207 exportPrivateKeyPkcs8FromTpm(const Name& keyName, const std::string& password);
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800208
209 /**
210 * @brief Import a private key in PKCS#8 format.
211 *
212 * Also recover the public key and installed it in TPM.
213 *
214 * @param keyName The private key name.
215 * @param key The encoded private key info.
216 * @param password The password to encrypt the private key.
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800217 * @return False if import fails.
218 */
219 bool
Yingdi Yube4150e2014-02-18 13:02:46 -0800220 importPrivateKeyPkcs8IntoTpm(const Name& keyName, const uint8_t* buf, size_t size, const std::string& password);
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800221
222protected:
223 /**
224 * @brief Export a private key in PKCS#1 format.
225 *
226 * @param keyName The private key name.
227 * @return The private key info (in PKCS#1 format) if exist, otherwise a NULL pointer.
228 */
229 virtual ConstBufferPtr
230 exportPrivateKeyPkcs1FromTpm(const Name& keyName) = 0;
231
232 /**
233 * @brief Import a private key in PKCS#1 format.
234 *
235 * @param keyName The private key name.
236 * @param key The encoded private key info.
237 * @return False if import fails.
238 */
239 virtual bool
240 importPrivateKeyPkcs1IntoTpm(const Name& keyName, const uint8_t* buf, size_t size) = 0;
241
242 /**
243 * @brief Import a public key in PKCS#1 format.
244 *
245 * @param keyName The public key name.
246 * @param key The encoded public key info.
247 * @return False if import fails.
248 */
249 virtual bool
250 importPublicKeyPkcs1IntoTpm(const Name& keyName, const uint8_t* buf, size_t size) = 0;
251
252
253 /**
Yingdi Yube4150e2014-02-18 13:02:46 -0800254 * @brief Get import/export password.
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800255 *
256 * @param password On return, the password.
257 * @param prompt Prompt for password, i.e., "Password for key:"
258 * @return true if password has been obtained.
259 */
260 inline virtual bool
Yingdi Yube4150e2014-02-18 13:02:46 -0800261 getImpExpPassWord(std::string& password, const std::string& prompt);
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700262};
263
Yingdi Yuf8fc8de2014-02-25 15:45:39 -0800264inline bool
Yingdi Yube4150e2014-02-18 13:02:46 -0800265SecTpm::getImpExpPassWord(std::string& password, const std::string& prompt)
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800266{
267 int result = false;
268
269 char* pw0 = NULL;
270
271 pw0 = getpass(prompt.c_str());
272 if(!pw0)
273 return false;
274 std::string password1 = pw0;
275 memset(pw0, 0, strlen(pw0));
276
277 pw0 = getpass("Confirm:");
278 if(!pw0)
279 {
280 char* pw1 = const_cast<char*>(password1.c_str());
281 memset(pw1, 0, password1.size());
282 return false;
283 }
284
285 if(!password1.compare(pw0))
286 {
287 result = true;
288 password.swap(password1);
289 }
290
291 char* pw1 = const_cast<char*>(password1.c_str());
292 memset(pw1, 0, password1.size());
Yingdi Yube4150e2014-02-18 13:02:46 -0800293 memset(pw0, 0, strlen(pw0));
294
295 if(password.empty())
296 return false;
297
Yingdi Yu8dceb1d2014-02-18 12:45:10 -0800298 return result;
299}
300
Yingdi Yufc40d872014-02-18 12:56:04 -0800301} // namespace ndn
Jeff Thompson7b79eb62013-09-12 18:48:29 -0700302
Yingdi Yufc40d872014-02-18 12:56:04 -0800303#endif //NDN_SECURITY_SEC_TPM_HPP