security: Checkpoint after requiring signData to supply the certificateName.
diff --git a/ndn-cpp/security/identity/identity-manager.cpp b/ndn-cpp/security/identity/identity-manager.cpp
index 0378c5f..a5adfc3 100644
--- a/ndn-cpp/security/identity/identity-manager.cpp
+++ b/ndn-cpp/security/identity/identity-manager.cpp
@@ -5,38 +5,20 @@
* See COPYING for copyright and distribution information.
*/
-#if 1
-#include "../../c/util/crypto.h"
-#endif
#include "../../sha256-with-rsa-signature.hpp"
#include "identity-manager.hpp"
-namespace ndn {
+using namespace std;
+using namespace ndn::ptr_lib;
-#if 1
-static unsigned char DEFAULT_PUBLIC_KEY_DER[] = {
-0x30, 0x81, 0x9F, 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x81,
-0x8D, 0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xE1, 0x7D, 0x30, 0xA7, 0xD8, 0x28, 0xAB, 0x1B, 0x84, 0x0B, 0x17,
-0x54, 0x2D, 0xCA, 0xF6, 0x20, 0x7A, 0xFD, 0x22, 0x1E, 0x08, 0x6B, 0x2A, 0x60, 0xD1, 0x6C, 0xB7, 0xF5, 0x44, 0x48, 0xBA,
-0x9F, 0x3F, 0x08, 0xBC, 0xD0, 0x99, 0xDB, 0x21, 0xDD, 0x16, 0x2A, 0x77, 0x9E, 0x61, 0xAA, 0x89, 0xEE, 0xE5, 0x54, 0xD3,
-0xA4, 0x7D, 0xE2, 0x30, 0xBC, 0x7A, 0xC5, 0x90, 0xD5, 0x24, 0x06, 0x7C, 0x38, 0x98, 0xBB, 0xA6, 0xF5, 0xDC, 0x43, 0x60,
-0xB8, 0x45, 0xED, 0xA4, 0x8C, 0xBD, 0x9C, 0xF1, 0x26, 0xA7, 0x23, 0x44, 0x5F, 0x0E, 0x19, 0x52, 0xD7, 0x32, 0x5A, 0x75,
-0xFA, 0xF5, 0x56, 0x14, 0x4F, 0x9A, 0x98, 0xAF, 0x71, 0x86, 0xB0, 0x27, 0x86, 0x85, 0xB8, 0xE2, 0xC0, 0x8B, 0xEA, 0x87,
-0x17, 0x1B, 0x4D, 0xEE, 0x58, 0x5C, 0x18, 0x28, 0x29, 0x5B, 0x53, 0x95, 0xEB, 0x4A, 0x17, 0x77, 0x9F, 0x02, 0x03, 0x01,
-0x00, 01
-};
-#endif
+namespace ndn {
void
IdentityManager::signByCertificate(Data &data, const Name &certificateName, WireFormat& wireFormat)
{
-#if 0
- Name keyName = m_publicStorage->getKeyNameForCertificate(certName);
-
- Ptr<Publickey> publickey = m_privateStorage->getPublickey (keyName.toUri());
-#else
- Name keyName;
-#endif
+ Name keyName = identityStorage_->getKeyNameForCertificate(certificateName);
+
+ shared_ptr<PublicKey> publicKey = privateKeyStorage_->getPublicKey(keyName);
// For temporary usage, we support RSA + SHA256 only, but will support more.
data.setSignature(Sha256WithRsaSignature());
@@ -46,24 +28,16 @@
signature->getKeyLocator().setType(ndn_KeyLocatorType_KEYNAME);
signature->getKeyLocator().setKeyName(certificateName);
- signature->getKeyLocator().setKeyNameType(ndn_KeyNameType_PUBLISHER_CERTIFICATE_DIGEST);
-#if 0
- signature->getKeyLocator().setKeyData(certificateDigest);
-#endif
+ // Omit the certificate digest.
+ signature->getKeyLocator().setKeyNameType((ndn_KeyNameType)-1);
// Ignore witness and leave the digestAlgorithm as the default.
-#if 0
- signature->getPublisherPublicKeyDigest().setPublisherKeyDigest (*publickey->getDigest ());
-#else
- unsigned char publicKeyDigest[SHA256_DIGEST_LENGTH];
- ndn_digestSha256(DEFAULT_PUBLIC_KEY_DER, sizeof(DEFAULT_PUBLIC_KEY_DER), publicKeyDigest);
- signature->getPublisherPublicKeyDigest().setPublisherPublicKeyDigest(publicKeyDigest, sizeof(publicKeyDigest));
-#endif
+ signature->getPublisherPublicKeyDigest().setPublisherPublicKeyDigest(publicKey->getDigest());
// Encode once to get the signed portion.
SignedBlob encoding = data.wireEncode(wireFormat);
signature->setSignature
- (privateKeyStorage_->sign(encoding.signedBuf(), encoding.signedSize(), keyName.toUri(), digestAlgorithm));
+ (privateKeyStorage_->sign(encoding.signedBuf(), encoding.signedSize(), keyName, digestAlgorithm));
// Encode again to include the signature.
data.wireEncode(wireFormat);
diff --git a/ndn-cpp/security/identity/identity-manager.hpp b/ndn-cpp/security/identity/identity-manager.hpp
index 2db82b1..fee8b99 100644
--- a/ndn-cpp/security/identity/identity-manager.hpp
+++ b/ndn-cpp/security/identity/identity-manager.hpp
@@ -9,6 +9,7 @@
#define NDN_IDENTITY_MANAGER_HPP
#include "../../data.hpp"
+#include "identity-storage.hpp"
#include "private-key-storage.hpp"
namespace ndn {
@@ -18,11 +19,163 @@
*/
class IdentityManager {
public:
- IdentityManager(const ptr_lib::shared_ptr<PrivateKeyStorage> &privateKeyStorage)
- : privateKeyStorage_(privateKeyStorage)
+ IdentityManager(const ptr_lib::shared_ptr<IdentityStorage>& identityStorage, const ptr_lib::shared_ptr<PrivateKeyStorage>& privateKeyStorage)
+ : identityStorage_(identityStorage), privateKeyStorage_(privateKeyStorage)
{
}
+#if 0
+ /**
+ * Create identity, by default it will create a pair of Key-Signing-Key(KSK) for this identity and a self-signed certificate of the KSK
+ * @param identityName the name of the identity
+ * @return the key name of the auto-generated KSK of the identity
+ */
+ Name
+ createIdentity(const Name& identityName);
+#endif
+
+ /**
+ * Get the default identity.
+ * @return The default identity name.
+ */
+ Name
+ getDefaultIdentity()
+ {
+ return identityStorage_->getDefaultIdentity();
+ }
+
+#if 0
+ /**
+ * Generate a pair of RSA keys for the specified identity
+ * @param identityName the name of the identity
+ * @param ksk create a KSK or not, true for KSK, false for DSK
+ * @param keySize the size of the key
+ * @return the generated key name
+ */
+ Name
+ generateRSAKeyPair(const Name& identityName, bool ksk = false, int keySize = 2048);
+
+ /**
+ * Set a key as the default key of an identity
+ * @param keyName the name of the key
+ * @param identityName the name of the identity, if not specified the identity name can be inferred from the keyName
+ */
+ void
+ setDefaultKeyForIdentity(const Name& keyName, const Name& identityName = Name());
+
+ /**
+ * Generate a pair of RSA keys for the specified identity and set it as default key of the identity
+ * @param identityName the name of the identity
+ * @param ksk create a KSK or not, true for KSK, false for DSK
+ * @param keySize the size of the key
+ * @return the generated key name
+ */
+ Name
+ generateRSAKeyPairAsDefault(const Name& identityName, bool ksk = false, int keySize = 2048);
+
+ /**
+ * Get public key with the specified name
+ * @param keyName name of the key
+ * @return the public key
+ */
+ Ptr<Publickey>
+ getPublickey(const Name& keyName);
+
+ /**
+ * Add a certificate into the public storage
+ * @param certificate the certificate to to added
+ */
+ void
+ addCertificate(Ptr<Certificate> certificate);
+
+ /**
+ * Set the certificate as the default of its corresponding key
+ * @param certificateName name of the certificate
+ */
+ void
+ setDefaultCertificateForKey(const Name& certificateName);
+
+ /**
+ * Add a certificate into the public storage and set the certificate as the default of its corresponding identity
+ * @param certificate the certificate to be added
+ */
+ void
+ addCertificateAsIdentityDefault(const Certificate& certificate);
+
+ /**
+ * Add a certificate into the public storage and set the certificate as the default of its corresponding key
+ * certificate the certificate to be added
+ */
+ void
+ addCertificateAsDefault(const Certificate& certificate);
+
+ /**
+ * Get a certificate with the specified name
+ * @param certificateName name of the requested certificate
+ * @return the requested certificate
+ */
+ Ptr<Certificate>
+ getCertificate(const Name& certificateName);
+
+ /**
+ * Get a certificate even if the certificate is not valid anymore
+ * @param certificateName name of the requested certificate
+ * @return the requested certificate
+ */
+ Ptr<Certificate>
+ getAnyCertificate(const Name& certificateName);
+#endif
+
+ /**
+ * Get the default certificate name for the specified identity, which will be used when signing is performed based on identity.
+ * @param identityName The name of the specified identity.
+ * @return The requested certificate name.
+ */
+ Name
+ getDefaultCertificateNameForIdentity(const Name& identityName)
+ {
+ return identityStorage_->getDefaultCertificateNameForIdentity(identityName);
+ }
+
+ /**
+ * Get the default certificate name of the default identity, which will be used when signing is based on identity and
+ * the identity is not specified.
+ * @return The requested certificate name.
+ */
+ Name
+ getDefaultCertificateName()
+ {
+ return identityStorage_->getDefaultCertificateNameForIdentity(getDefaultIdentity());
+ }
+
+#if 0
+ /**
+ * Sign blob based on identity
+ * @param blob the blob to be signed
+ * @param identityName the signing identity name
+ * @return the generated signature
+ */
+ Ptr<Signature>
+ signByIdentity(const Blob& blob, const Name& identityName);
+
+ /**
+ * Sign data based on identity
+ * @param data the data packet to be signed, on return the Signature inside the data packet will be set
+ * @param identityName the signing identity name
+ */
+ void
+ signByIdentity(Data& data, const Name& identityName);
+
+ /**
+ * sign blob based on certificate name
+ * @param blob the blob to be signed
+ * @param certificateName the signing certificate name
+ * @return the generated signature
+ */
+ Ptr<Signature>
+ signByCertificate(const Blob& blob, const Name& certificateName);
+#endif
+
/**
* Sign data packet based on the certificate name.
* Note: the caller must make sure the timestamp in data is correct, for example with
@@ -35,6 +188,7 @@
signByCertificate(Data& data, const Name& certificateName, WireFormat& wireFormat = *WireFormat::getDefaultWireFormat());
private:
+ ptr_lib::shared_ptr<IdentityStorage> identityStorage_;
ptr_lib::shared_ptr<PrivateKeyStorage> privateKeyStorage_;
};