From b1d9279a41b0a0b8de86979ab5363f7c0bda18db Mon Sep 17 00:00:00 2001 From: "Mark J. Cox" Date: Mon, 12 Nov 2001 15:21:55 +0000 Subject: [PATCH] Add initial support for Baltimore SureWare accelerator cards; this works for acceleration only at the moment, but full key management is being worked on for the future. This code has been compiled cross-platform but not extensively tested Submitted by: Mark Cox, Baltimore Technologies Reviewed by: Mark Cox PR: --- CHANGES | 4 + crypto/engine/Makefile.ssl | 26 +- crypto/engine/engine.h | 13 + crypto/engine/engine_int.h | 5 + crypto/engine/engine_list.c | 4 + crypto/engine/hw_sureware.c | 909 ++++++++++++++++++++++++++ crypto/engine/vendor_defns/sureware.h | 239 +++++++ 7 files changed, 1198 insertions(+), 2 deletions(-) create mode 100644 crypto/engine/hw_sureware.c create mode 100644 crypto/engine/vendor_defns/sureware.h diff --git a/CHANGES b/CHANGES index aa98f30cb9..292116be64 100644 --- a/CHANGES +++ b/CHANGES @@ -4,6 +4,10 @@ Changes between 0.9.6b and 0.9.6c [XX xxx XXXX] + *) Add support for SureWare crypto accelerator cards from + Baltimore Technologies. (Use engine 'sureware') + [Baltimore Technologies and Mark Cox] + *) Add support for crypto accelerator cards from Accelerated Encryption Processing, www.aep.ie. (Use engine 'aep') [AEP Inc. and Mark Cox] diff --git a/crypto/engine/Makefile.ssl b/crypto/engine/Makefile.ssl index 31d7fc80bd..8c6964b9d3 100644 --- a/crypto/engine/Makefile.ssl +++ b/crypto/engine/Makefile.ssl @@ -23,9 +23,9 @@ APPS= LIB=$(TOP)/libcrypto.a LIBSRC= engine_err.c engine_lib.c engine_list.c engine_openssl.c \ - hw_atalla.c hw_cswift.c hw_ncipher.c hw_aep.c + hw_atalla.c hw_cswift.c hw_ncipher.c hw_aep.c hw_sureware.c LIBOBJ= engine_err.o engine_lib.o engine_list.o engine_openssl.o \ - hw_atalla.o hw_cswift.o hw_ncipher.o hw_aep.o + hw_atalla.o hw_cswift.o hw_ncipher.o hw_aep.o hw_sureware.o SRC= $(LIBSRC) @@ -237,3 +237,25 @@ hw_ncipher.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h hw_ncipher.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h hw_ncipher.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h hw_ncipher.o: ../cryptlib.h engine_int.h vendor_defns/hwcryptohook.h +hw_sureware.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h +hw_sureware.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h +hw_sureware.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h +hw_sureware.o: ../../include/openssl/crypto.h ../../include/openssl/des.h +hw_sureware.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h +hw_sureware.o: ../../include/openssl/dso.h ../../include/openssl/e_os.h +hw_sureware.o: ../../include/openssl/e_os2.h ../../include/openssl/engine.h +hw_sureware.o: ../../include/openssl/err.h ../../include/openssl/evp.h +hw_sureware.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h +hw_sureware.o: ../../include/openssl/md2.h ../../include/openssl/md4.h +hw_sureware.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h +hw_sureware.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h +hw_sureware.o: ../../include/openssl/opensslconf.h +hw_sureware.o: ../../include/openssl/opensslv.h ../../include/openssl/pem.h +hw_sureware.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs7.h +hw_sureware.o: ../../include/openssl/rand.h ../../include/openssl/rc2.h +hw_sureware.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h +hw_sureware.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h +hw_sureware.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h +hw_sureware.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h +hw_sureware.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h +hw_sureware.o: ../cryptlib.h engine.h engine_int.h vendor_defns/sureware.h diff --git a/crypto/engine/engine.h b/crypto/engine/engine.h index af0740303b..e9baceda74 100644 --- a/crypto/engine/engine.h +++ b/crypto/engine/engine.h @@ -364,6 +364,19 @@ void ERR_load_ENGINE_strings(void); #define ENGINE_F_HWCRHK_RAND_BYTES 139 #define ENGINE_F_HWCRHK_RSA_MOD_EXP 140 #define ENGINE_F_LOG_MESSAGE 141 +#define ENGINE_F_SUREWAREHK_INIT 200 +#define ENGINE_F_SUREWAREHK_FINISH 201 +#define ENGINE_F_SUREWAREHK_RAND_BYTES 202 +#define ENGINE_F_SUREWAREHK_RAND_SEED 203 +#define ENGINE_F_SUREWAREHK_LOAD_PRIVATE_KEY 204 +#define ENGINE_F_SUREWAREHK_LOAD_PUBLIC_KEY 205 +#define ENGINE_F_SUREWAREHK_EX_FREE 206 +#define ENGINE_F_SUREWAREHK_RSA_PRIV_DEC 207 +#define ENGINE_F_SUREWAREHK_RSA_PRIV_ENC 208 +#define ENGINE_F_SUREWAREHK_CTRL 209 +#define ENGINE_F_SUREWAREHK_DH_GEN_KEY 210 +#define ENGINE_F_SUREWAREHK_DSA_DO_SIGN 211 +#define ENGINE_F_SUREWAREHK_MOD_EXP 212 /* Reason codes. */ diff --git a/crypto/engine/engine_int.h b/crypto/engine/engine_int.h index 28d9b4a961..a1ae3df882 100644 --- a/crypto/engine/engine_int.h +++ b/crypto/engine/engine_int.h @@ -156,6 +156,11 @@ ENGINE *ENGINE_atalla(); ENGINE *ENGINE_aep(); #endif /* !NO_HW_AEP */ +#ifndef NO_HW_SUREWARE +/* Returns a structure of atalla methods. */ +ENGINE *ENGINE_sureware(); +#endif /* !NO_HW_SUREWARE */ + #endif /* !NO_HW */ #ifdef __cplusplus diff --git a/crypto/engine/engine_list.c b/crypto/engine/engine_list.c index 582df5a795..f9ce5447e9 100644 --- a/crypto/engine/engine_list.c +++ b/crypto/engine/engine_list.c @@ -202,6 +202,10 @@ static int engine_internal_check(void) if(!engine_list_add(ENGINE_aep())) return 0; #endif /* !NO_HW_AEP */ +#ifndef NO_HW_SUREWARE + if(!engine_list_add(ENGINE_sureware())) + return 0; +#endif /* !NO_HW_SUREWARE */ #endif /* !NO_HW */ engine_list_flag = 1; return 1; diff --git a/crypto/engine/hw_sureware.c b/crypto/engine/hw_sureware.c new file mode 100644 index 0000000000..c4dc524e34 --- /dev/null +++ b/crypto/engine/hw_sureware.c @@ -0,0 +1,909 @@ +/* Written by Corinne Dive-Reclus(cdive@baltimore.com) +* +* +* Redistribution and use in source and binary forms, with or without +* modification, are permitted provided that the following conditions +* are met: +* +* 1. Redistributions of source code must retain the above copyright +* notice, this list of conditions and the following disclaimer. +* +* 2. Redistributions in binary form must reproduce the above copyright +* notice, this list of conditions and the following disclaimer in +* the documentation and/or other materials provided with the +* distribution. +* +* 3. All advertising materials mentioning features or use of this +* software must display the following acknowledgment: +* "This product includes software developed by the OpenSSL Project +* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" +* +* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to +* endorse or promote products derived from this software without +* prior written permission. For written permission, please contact +* licensing@OpenSSL.org. +* +* 5. Products derived from this software may not be called "OpenSSL" +* nor may "OpenSSL" appear in their names without prior written +* permission of the OpenSSL Project. +* +* 6. Redistributions of any form whatsoever must retain the following +* acknowledgment: +* "This product includes software developed by the OpenSSL Project +* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" +* +* Written by Corinne Dive-Reclus(cdive@baltimore.com) +* +* Copyright@2001 Baltimore Technologies Ltd. +* All right Reserved. +* * +* THIS FILE IS PROVIDED BY BALTIMORE TECHNOLOGIES ``AS IS'' AND * +* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * +* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * +* ARE DISCLAIMED. IN NO EVENT SHALL BALTIMORE TECHNOLOGIES BE LIABLE * +* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * +* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * +* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * +* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * +* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * +* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * +* SUCH DAMAGE. * +====================================================================*/ + +#include +#include +#include +#include "cryptlib.h" +#include +#include "engine_int.h" +#include "engine.h" +#include + +#ifndef NO_HW +#ifndef NO_HW_SUREWARE + +#ifdef FLAT_INC +#include "sureware.h" +#else +#include "vendor_defns/sureware.h" +#endif + +static int surewarehk_ctrl(int cmd, long i, void *p, void (*f)()); +static int surewarehk_init(void); +static int surewarehk_finish(void); +static int surewarehk_modexp(BIGNUM *r, BIGNUM *a, const BIGNUM *p, + const BIGNUM *m, BN_CTX *ctx); + +/* RSA stuff */ +static int surewarehk_rsa_priv_dec(int flen,unsigned char *from,unsigned char *to, + RSA *rsa,int padding); +static int surewarehk_rsa_sign(int flen,unsigned char *from,unsigned char *to, + RSA *rsa,int padding); + +/* RAND stuff */ +static int surewarehk_rand_bytes(unsigned char *buf, int num); +static void surewarehk_rand_seed(const void *buf, int num); +static void surewarehk_rand_add(const void *buf, int num, double entropy); + +/* KM stuff */ +static EVP_PKEY *surewarehk_load_privkey(const char *key_id, + const char *passphrase); +static EVP_PKEY *surewarehk_load_pubkey(const char *key_id, + const char *passphrase); +static void surewarehk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad, + int index,long argl, void *argp); +static void surewarehk_dh_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad, + int index,long argl, void *argp); + +/* This function is aliased to mod_exp (with the mont stuff dropped). */ +static int surewarehk_mod_exp_mont(BIGNUM *r, BIGNUM *a, const BIGNUM *p, + const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx) +{ + return surewarehk_modexp(r, a, p, m, ctx); +} + +/* Our internal RSA_METHOD that we provide pointers to */ +static RSA_METHOD surewarehk_rsa = + { + "SureWare RSA method", + NULL, /* pub_enc*/ + NULL, /* pub_dec*/ + surewarehk_rsa_sign, /* our rsa_sign is OpenSSL priv_enc*/ + surewarehk_rsa_priv_dec, /* priv_dec*/ + NULL, /*mod_exp*/ + surewarehk_mod_exp_mont, /*mod_exp_mongomery*/ + NULL, /* init*/ + NULL, /* finish*/ + 0, /* RSA flag*/ + NULL, + NULL, /* OpenSSL sign*/ + NULL /* OpenSSL verify*/ + }; +/* Our internal DH_METHOD that we provide pointers to */ +/* This function is aliased to mod_exp (with the dh and mont dropped). */ +static int surewarehk_modexp_dh(DH *dh, BIGNUM *r, BIGNUM *a, const BIGNUM *p, + const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx) +{ + return surewarehk_modexp(r, a, p, m, ctx); +} +static DH_METHOD surewarehk_dh = + { + "SureWare DH method", + NULL,/*gen_key*/ + NULL,/*agree,*/ + surewarehk_modexp_dh, /*dh mod exp*/ + NULL, /* init*/ + NULL, /* finish*/ + 0, /* flags*/ + NULL + }; +static RAND_METHOD surewarehk_rand = + { + /* "SureWare RAND method", */ + surewarehk_rand_seed, + surewarehk_rand_bytes, + NULL,/*cleanup*/ + surewarehk_rand_add, + surewarehk_rand_bytes, + NULL,/*rand_status*/ + }; +/* DSA stuff */ +static DSA_SIG * surewarehk_dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa); +static int surewarehk_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1, + BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m, + BN_CTX *ctx, BN_MONT_CTX *in_mont) +{ + BIGNUM t; + int to_return = 0; + BN_init(&t); + /* let rr = a1 ^ p1 mod m */ + if (!surewarehk_modexp(rr,a1,p1,m,ctx)) goto end; + /* let t = a2 ^ p2 mod m */ + if (!surewarehk_modexp(&t,a2,p2,m,ctx)) goto end; + /* let rr = rr * t mod m */ + if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end; + to_return = 1; +end: + BN_free(&t); + return to_return; +} + +static DSA_METHOD surewarehk_dsa = + { + "SureWare DSA method", + surewarehk_dsa_do_sign, + NULL,/*sign setup*/ + NULL,/*verify,*/ + surewarehk_dsa_mod_exp,/*mod exp*/ + NULL,/*bn mod exp*/ + NULL, /*init*/ + NULL,/*finish*/ + 0, + NULL, + }; +/* Our ENGINE structure. */ +static ENGINE engine_surewarehk = + { + "sureware", + "SureWare hardware engine support", + &surewarehk_rsa, + &surewarehk_dsa, + &surewarehk_dh, + &surewarehk_rand, + &surewarehk_modexp, + NULL,/* mod exp CRT*/ + surewarehk_init, + surewarehk_finish, + surewarehk_ctrl, /* crtl*/ + surewarehk_load_privkey, + surewarehk_load_pubkey, + 0, /* no flags */ + 0, 0, /* no references */ + NULL, /*unlinked */ + }; +/* Now, to our own code */ + +/* As this is only ever called once, there's no need for locking + * (indeed - the lock will already be held by our caller!!!) */ +ENGINE *ENGINE_sureware() +{ + RSA_METHOD *meth1; + DSA_METHOD *meth2; + DH_METHOD *meth3; + + /* We know that the "PKCS1_SSLeay()" functions hook properly + * to the cswift-specific mod_exp and mod_exp_crt so we use + * those functions. NB: We don't use ENGINE_openssl() or + * anything "more generic" because something like the RSAref + * code may not hook properly, and if you own one of these + * cards then you have the right to do RSA operations on it + * anyway! */ + meth1 = RSA_PKCS1_SSLeay(); + if (meth1) + { + surewarehk_rsa.rsa_pub_enc = meth1->rsa_pub_enc; + surewarehk_rsa.rsa_pub_dec = meth1->rsa_pub_dec; + } + /* Use the DSA_OpenSSL() method and just hook the mod_exp-ish + * bits. */ + meth2 = DSA_OpenSSL(); + if (meth2) + { + surewarehk_dsa.dsa_do_verify = meth2->dsa_do_verify; + } + /* Much the same for Diffie-Hellman */ + meth3 = DH_OpenSSL(); + if (meth3) + { + surewarehk_dh.generate_key = meth3->generate_key; + surewarehk_dh.compute_key = meth3->compute_key; + } + return &engine_surewarehk; +} + +/* This is a process-global DSO handle used for loading and unloading + * the SureWareHook library. NB: This is only set (or unset) during an + * init() or finish() call (reference counts permitting) and they're + * operating with global locks, so this should be thread-safe + * implicitly. */ +static DSO *surewarehk_dso = NULL; +static int rsaHndidx = -1; /* Index for KM handle. Not really used yet. */ +static int dsaHndidx = -1; /* Index for KM handle. Not really used yet. */ + +/* These are the function pointers that are (un)set when the library has + * successfully (un)loaded. */ +static SureWareHook_Init_t *p_surewarehk_Init = NULL; +static SureWareHook_Finish_t *p_surewarehk_Finish = NULL; +static SureWareHook_Rand_Bytes_t *p_surewarehk_Rand_Bytes = NULL; +static SureWareHook_Rand_Seed_t *p_surewarehk_Rand_Seed = NULL; +static SureWareHook_Load_Privkey_t *p_surewarehk_Load_Privkey = NULL; +static SureWareHook_Info_Pubkey_t *p_surewarehk_Info_Pubkey = NULL; +static SureWareHook_Load_Rsa_Pubkey_t *p_surewarehk_Load_Rsa_Pubkey = NULL; +static SureWareHook_Load_Dsa_Pubkey_t *p_surewarehk_Load_Dsa_Pubkey = NULL; +static SureWareHook_Free_t *p_surewarehk_Free=NULL; +static SureWareHook_Rsa_Priv_Dec_t *p_surewarehk_Rsa_Priv_Dec=NULL; +static SureWareHook_Rsa_Sign_t *p_surewarehk_Rsa_Sign=NULL; +static SureWareHook_Dsa_Sign_t *p_surewarehk_Dsa_Sign=NULL; +static SureWareHook_Mod_Exp_t *p_surewarehk_Mod_Exp=NULL; + +/* Used in the DSO operations. */ +static const char *surewarehk_LIBNAME = "SureWareHook"; +static const char *n_surewarehk_Init = "SureWareHook_Init"; +static const char *n_surewarehk_Finish = "SureWareHook_Finish"; +static const char *n_surewarehk_Rand_Bytes="SureWareHook_Rand_Bytes"; +static const char *n_surewarehk_Rand_Seed="SureWareHook_Rand_Seed"; +static const char *n_surewarehk_Load_Privkey="SureWareHook_Load_Privkey"; +static const char *n_surewarehk_Info_Pubkey="SureWareHook_Info_Pubkey"; +static const char *n_surewarehk_Load_Rsa_Pubkey="SureWareHook_Load_Rsa_Pubkey"; +static const char *n_surewarehk_Load_Dsa_Pubkey="SureWareHook_Load_Dsa_Pubkey"; +static const char *n_surewarehk_Free="SureWareHook_Free"; +static const char *n_surewarehk_Rsa_Priv_Dec="SureWareHook_Rsa_Priv_Dec"; +static const char *n_surewarehk_Rsa_Sign="SureWareHook_Rsa_Sign"; +static const char *n_surewarehk_Dsa_Sign="SureWareHook_Dsa_Sign"; +static const char *n_surewarehk_Mod_Exp="SureWareHook_Mod_Exp"; +static BIO *logstream = NULL; + +/* SureWareHook library functions and mechanics - these are used by the + * higher-level functions further down. NB: As and where there's no + * error checking, take a look lower down where these functions are + * called, the checking and error handling is probably down there. +*/ +static int threadsafe=1; +static int surewarehk_ctrl(int cmd, long i, void *p, void (*f)()) +{ + int to_return = 1; + + switch(cmd) + { + case ENGINE_CTRL_SET_LOGSTREAM: + { + BIO *bio = (BIO *)p; + CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); + if (logstream) + { + BIO_free(logstream); + logstream = NULL; + } + if (CRYPTO_add(&bio->references,1,CRYPTO_LOCK_BIO) > 1) + logstream = bio; + else + ENGINEerr(ENGINE_F_HWCRHK_CTRL,ENGINE_R_BIO_WAS_FREED); + } + CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); + break; + /* This will prevent the initialisation function from "installing" + * the mutex-handling callbacks, even if they are available from + * within the library (or were provided to the library from the + * calling application). This is to remove any baggage for + * applications not using multithreading. */ + case ENGINE_CTRL_CHIL_NO_LOCKING: + CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); + threadsafe = 0; + CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); + break; + + /* The command isn't understood by this engine */ + default: + ENGINEerr(ENGINE_F_SUREWAREHK_CTRL, + ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED); + to_return = 0; + break; + } + + return to_return; +} + +/* (de)initialisation functions. */ +static int surewarehk_init() +{ + char msg[64]="ENGINE_init"; + SureWareHook_Init_t *p1=NULL; + SureWareHook_Finish_t *p2=NULL; + SureWareHook_Rand_Bytes_t *p3=NULL; + SureWareHook_Rand_Seed_t *p4=NULL; + SureWareHook_Load_Privkey_t *p5=NULL; + SureWareHook_Load_Rsa_Pubkey_t *p6=NULL; + SureWareHook_Free_t *p7=NULL; + SureWareHook_Rsa_Priv_Dec_t *p8=NULL; + SureWareHook_Rsa_Sign_t *p9=NULL; + SureWareHook_Dsa_Sign_t *p12=NULL; + SureWareHook_Info_Pubkey_t *p13=NULL; + SureWareHook_Load_Dsa_Pubkey_t *p14=NULL; + SureWareHook_Mod_Exp_t *p15=NULL; + + if(surewarehk_dso != NULL) + { + ENGINEerr(ENGINE_F_SUREWAREHK_INIT,ENGINE_R_ALREADY_LOADED); + goto err; + } + /* Attempt to load libsurewarehk.so/surewarehk.dll/whatever. */ + surewarehk_dso = DSO_load(NULL, surewarehk_LIBNAME, NULL, + DSO_FLAG_NAME_TRANSLATION); + if(surewarehk_dso == NULL) + { + ENGINEerr(ENGINE_F_SUREWAREHK_INIT,ENGINE_R_DSO_FAILURE); + goto err; + } + if(!(p1=(SureWareHook_Init_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Init)) || + !(p2=(SureWareHook_Finish_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Finish)) || + !(p3=(SureWareHook_Rand_Bytes_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rand_Bytes)) || + !(p4=(SureWareHook_Rand_Seed_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rand_Seed)) || + !(p5=(SureWareHook_Load_Privkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Load_Privkey)) || + !(p6=(SureWareHook_Load_Rsa_Pubkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Load_Rsa_Pubkey)) || + !(p7=(SureWareHook_Free_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Free)) || + !(p8=(SureWareHook_Rsa_Priv_Dec_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rsa_Priv_Dec)) || + !(p9=(SureWareHook_Rsa_Sign_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rsa_Sign)) || + !(p12=(SureWareHook_Dsa_Sign_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Dsa_Sign)) || + !(p13=(SureWareHook_Info_Pubkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Info_Pubkey)) || + !(p14=(SureWareHook_Load_Dsa_Pubkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Load_Dsa_Pubkey)) || + !(p15=(SureWareHook_Mod_Exp_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Mod_Exp))) + { + ENGINEerr(ENGINE_F_SUREWAREHK_INIT,ENGINE_R_DSO_FAILURE); + goto err; + } + /* Copy the pointers */ + p_surewarehk_Init = p1; + p_surewarehk_Finish = p2; + p_surewarehk_Rand_Bytes = p3; + p_surewarehk_Rand_Seed = p4; + p_surewarehk_Load_Privkey = p5; + p_surewarehk_Load_Rsa_Pubkey = p6; + p_surewarehk_Free = p7; + p_surewarehk_Rsa_Priv_Dec = p8; + p_surewarehk_Rsa_Sign = p9; + p_surewarehk_Dsa_Sign = p12; + p_surewarehk_Info_Pubkey = p13; + p_surewarehk_Load_Dsa_Pubkey = p14; + p_surewarehk_Mod_Exp = p15; + /* Contact the hardware and initialises it. */ + if(p_surewarehk_Init(msg,threadsafe)==SUREWAREHOOK_ERROR_UNIT_FAILURE) + { + ENGINEerr(ENGINE_F_SUREWAREHK_INIT,ENGINE_R_UNIT_FAILURE); + goto err; + } + if(p_surewarehk_Init(msg,threadsafe)==SUREWAREHOOK_ERROR_UNIT_FAILURE) + { + ENGINEerr(ENGINE_F_SUREWAREHK_INIT,ENGINE_R_UNIT_FAILURE); + goto err; + } + /* try to load the default private key, if failed does not return a failure but + wait for an explicit ENGINE_load_privakey */ + surewarehk_load_privkey(NULL,NULL); + + /* Everything's fine. */ + if (rsaHndidx == -1) + rsaHndidx = RSA_get_ex_new_index(0, + "SureWareHook RSA key handle", + NULL, NULL, surewarehk_ex_free); + if (dsaHndidx == -1) + dsaHndidx = DSA_get_ex_new_index(0, + "SureWareHook DSA key handle", + NULL, NULL, surewarehk_ex_free); + return 1; +err: + if(surewarehk_dso) + DSO_free(surewarehk_dso); + surewarehk_dso = NULL; + p_surewarehk_Init = NULL; + p_surewarehk_Finish = NULL; + p_surewarehk_Rand_Bytes = NULL; + p_surewarehk_Rand_Seed = NULL; + p_surewarehk_Load_Privkey = NULL; + p_surewarehk_Load_Rsa_Pubkey = NULL; + p_surewarehk_Free = NULL; + p_surewarehk_Rsa_Priv_Dec = NULL; + p_surewarehk_Rsa_Sign = NULL; + p_surewarehk_Dsa_Sign = NULL; + p_surewarehk_Info_Pubkey = NULL; + p_surewarehk_Load_Dsa_Pubkey = NULL; + p_surewarehk_Mod_Exp = NULL; + return 0; +} + +static int surewarehk_finish() +{ + int to_return = 1; + if(surewarehk_dso == NULL) + { + ENGINEerr(ENGINE_F_SUREWAREHK_FINISH,ENGINE_R_NOT_LOADED); + to_return = 0; + goto err; + } + p_surewarehk_Finish(); + if(!DSO_free(surewarehk_dso)) + { + ENGINEerr(ENGINE_F_SUREWAREHK_FINISH,ENGINE_R_DSO_FAILURE); + to_return = 0; + goto err; + } + err: + if (logstream) + BIO_free(logstream); + surewarehk_dso = NULL; + p_surewarehk_Init = NULL; + p_surewarehk_Finish = NULL; + p_surewarehk_Rand_Bytes = NULL; + p_surewarehk_Rand_Seed = NULL; + p_surewarehk_Load_Privkey = NULL; + p_surewarehk_Load_Rsa_Pubkey = NULL; + p_surewarehk_Free = NULL; + p_surewarehk_Rsa_Priv_Dec = NULL; + p_surewarehk_Rsa_Sign = NULL; + p_surewarehk_Dsa_Sign = NULL; + p_surewarehk_Info_Pubkey = NULL; + p_surewarehk_Load_Dsa_Pubkey = NULL; + p_surewarehk_Mod_Exp = NULL; + return to_return; +} +static void surewarehk_error_handling(char *const msg,int func,int ret) +{ + switch (ret) + { + case SUREWAREHOOK_ERROR_UNIT_FAILURE: + ENGINEerr(func,ENGINE_R_UNIT_FAILURE); + break; + case SUREWAREHOOK_ERROR_FALLBACK: + ENGINEerr(func,ENGINE_R_REQUEST_FALLBACK); + break; + case SUREWAREHOOK_ERROR_DATA_SIZE: + ENGINEerr(func,ENGINE_R_SIZE_TOO_LARGE_OR_TOO_SMALL); + break; + case SUREWAREHOOK_ERROR_INVALID_PAD: + ENGINEerr(func,RSA_R_PADDING_CHECK_FAILED); + break; + default: + ENGINEerr(func,ENGINE_R_REQUEST_FAILED); + break; + case 1:/*nothing*/ + msg[0]='\0'; + } + if (*msg) + { + ERR_add_error_data(1,msg); + if (logstream) + { + CRYPTO_w_lock(CRYPTO_LOCK_BIO); + BIO_write(logstream, msg, strlen(msg)); + CRYPTO_w_unlock(CRYPTO_LOCK_BIO); + } + } +} +static int surewarehk_rand_bytes(unsigned char *buf, int num) +{ + int ret=0; + char msg[64]="ENGINE_rand_bytes"; + if(!p_surewarehk_Rand_Bytes) + { + ENGINEerr(ENGINE_F_SUREWAREHK_RAND_BYTES,ENGINE_R_NOT_INITIALISED); + } + else + { + ret = p_surewarehk_Rand_Bytes(msg,buf, num); + surewarehk_error_handling(msg,ENGINE_F_SUREWAREHK_RAND_BYTES,ret); + } + return ret==1 ? 1 : 0; +} + +static void surewarehk_rand_seed(const void *buf, int num) +{ + int ret=0; + char msg[64]="ENGINE_rand_seed"; + if(!p_surewarehk_Rand_Seed) + { + ENGINEerr(ENGINE_F_SUREWAREHK_RAND_SEED,ENGINE_R_NOT_INITIALISED); + } + else + { + ret = p_surewarehk_Rand_Seed(msg,buf, num); + surewarehk_error_handling(msg,ENGINE_F_SUREWAREHK_RAND_SEED,ret); + } +} +static void surewarehk_rand_add(const void *buf, int num, double entropy) +{ + surewarehk_rand_seed(buf,num); +} +static EVP_PKEY* sureware_load_public(const char *key_id,char *hptr,unsigned long el,char keytype) +{ + EVP_PKEY *res = NULL; + RSA *rsatmp = NULL; + DSA *dsatmp=NULL; + char msg[64]="sureware_load_public"; + int ret=0; + if(!p_surewarehk_Load_Rsa_Pubkey || !p_surewarehk_Load_Dsa_Pubkey) + { + ENGINEerr(ENGINE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ENGINE_R_NOT_INITIALISED); + goto err; + } + switch (keytype) + { + case 1: /*RSA*/ + /* set private external reference */ + rsatmp = RSA_new_method(&engine_surewarehk); + RSA_set_ex_data(rsatmp,rsaHndidx,hptr); + rsatmp->flags |= RSA_FLAG_EXT_PKEY; + + /* set public big nums*/ + rsatmp->e = BN_new(); + rsatmp->n = BN_new(); + bn_expand2(rsatmp->e, el/sizeof(BN_ULONG)); + bn_expand2(rsatmp->n, el/sizeof(BN_ULONG)); + if (!rsatmp->e || rsatmp->e->dmax!=(int)(el/sizeof(BN_ULONG))|| + !rsatmp->n || rsatmp->n->dmax!=(int)(el/sizeof(BN_ULONG))) + goto err; + ret=p_surewarehk_Load_Rsa_Pubkey(msg,key_id,el,rsatmp->n->d, rsatmp->e->d); + surewarehk_error_handling(msg,ENGINE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ret); + if (ret!=1) + { + ENGINEerr(ENGINE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_FAILED_LOADING_PUBLIC_KEY); + goto err; + } + /* normalise pub e and pub n */ + rsatmp->e->top=el/sizeof(BN_ULONG); + bn_fix_top(rsatmp->e); + rsatmp->n->top=el/sizeof(BN_ULONG); + bn_fix_top(rsatmp->n); + /* create an EVP object: engine + rsa key */ + res = EVP_PKEY_new(); + EVP_PKEY_assign_RSA(res, rsatmp); + break; + case 2:/*DSA*/ + /* set private/public external reference */ + dsatmp = DSA_new_method(&engine_surewarehk); + DSA_set_ex_data(dsatmp,dsaHndidx,hptr); + /*dsatmp->flags |= DSA_FLAG_EXT_PKEY;*/ + + /* set public key*/ + dsatmp->pub_key = BN_new(); + dsatmp->p = BN_new(); + dsatmp->q = BN_new(); + dsatmp->g = BN_new(); + bn_expand2(dsatmp->pub_key, el/sizeof(BN_ULONG)); + bn_expand2(dsatmp->p, el/sizeof(BN_ULONG)); + bn_expand2(dsatmp->q, 20/sizeof(BN_ULONG)); + bn_expand2(dsatmp->g, el/sizeof(BN_ULONG)); + if (!dsatmp->pub_key || dsatmp->pub_key->dmax!=(int)(el/sizeof(BN_ULONG))|| + !dsatmp->p || dsatmp->p->dmax!=(int)(el/sizeof(BN_ULONG)) || + !dsatmp->q || dsatmp->q->dmax!=20/sizeof(BN_ULONG) || + !dsatmp->g || dsatmp->g->dmax!=(int)(el/sizeof(BN_ULONG))) + goto err; + + ret=p_surewarehk_Load_Dsa_Pubkey(msg,key_id,el, + dsatmp->pub_key->d, + dsatmp->p->d, + dsatmp->q->d, + dsatmp->g->d); + surewarehk_error_handling(msg,ENGINE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ret); + if (ret!=1) + { + ENGINEerr(ENGINE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_FAILED_LOADING_PUBLIC_KEY); + goto err; + } + /* set parameters */ + /* normalise pubkey and parameters in case of */ + dsatmp->pub_key->top=el/sizeof(BN_ULONG); + bn_fix_top(dsatmp->pub_key); + dsatmp->p->top=el/sizeof(BN_ULONG); + bn_fix_top(dsatmp->p); + dsatmp->q->top=20/sizeof(BN_ULONG); + bn_fix_top(dsatmp->q); + dsatmp->g->top=el/sizeof(BN_ULONG); + bn_fix_top(dsatmp->g); + + /* create an EVP object: engine + rsa key */ + res = EVP_PKEY_new(); + EVP_PKEY_assign_DSA(res, dsatmp); + break; + default: + ENGINEerr(ENGINE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_FAILED_LOADING_PRIVATE_KEY); + goto err; + } + return res; + err: + if (res) + EVP_PKEY_free(res); + if (rsatmp) + RSA_free(rsatmp); + if (dsatmp) + DSA_free(dsatmp); + return NULL; +} +static EVP_PKEY *surewarehk_load_privkey(const char *key_id, + const char *passphrase) +{ + EVP_PKEY *res = NULL; + int ret=0; + unsigned long el=0; + char *hptr=NULL; + char keytype=0; + char msg[64]="ENGINE_load_privkey"; + + if(!p_surewarehk_Load_Privkey) + { + ENGINEerr(ENGINE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_NOT_INITIALISED); + } + else + { + ret=p_surewarehk_Load_Privkey(msg,key_id,&hptr,&el,&keytype); + if (ret!=1) + { + ENGINEerr(ENGINE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_FAILED_LOADING_PRIVATE_KEY); + ERR_add_error_data(1,msg); + } + else + res=sureware_load_public(key_id,hptr,el,keytype); + } + return res; +} +static EVP_PKEY *surewarehk_load_pubkey(const char *key_id, + const char *passphrase) +{ + EVP_PKEY *res = NULL; + int ret=0; + unsigned long el=0; + char *hptr=NULL; + char keytype=0; + char msg[64]="ENGINE_load_pubkey"; + + if(!p_surewarehk_Info_Pubkey) + { + ENGINEerr(ENGINE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ENGINE_R_NOT_INITIALISED); + } + else + { + /* call once to identify if DSA or RSA */ + ret=p_surewarehk_Info_Pubkey(msg,key_id,&el,&keytype); + if (ret!=1) + { + ENGINEerr(ENGINE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ENGINE_R_FAILED_LOADING_PUBLIC_KEY); + ERR_add_error_data(1,msg); + } + else + res=sureware_load_public(key_id,hptr,el,keytype); + } + return res; +} + +/* This cleans up an RSA/DSA KM key(do not destroy the key into the hardware) +, called when ex_data is freed */ +static void surewarehk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad, + int index,long argl, void *argp) +{ + if(!p_surewarehk_Free) + { + ENGINEerr(ENGINE_F_SUREWAREHK_EX_FREE,ENGINE_R_NOT_INITIALISED); + } + else + p_surewarehk_Free((char *)item,0); +} +/* This cleans up an DH KM key (destroys the key into hardware), +called when ex_data is freed */ +static void surewarehk_dh_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad, + int index,long argl, void *argp) +{ + if(!p_surewarehk_Free) + { + ENGINEerr(ENGINE_F_SUREWAREHK_EX_FREE,ENGINE_R_NOT_INITIALISED); + } + else + p_surewarehk_Free((char *)item,1); +} +/* +* return number of decrypted bytes +*/ +static int surewarehk_rsa_priv_dec(int flen,unsigned char *from,unsigned char *to, + RSA *rsa,int padding) +{ + int ret=0,tlen; + char *buf=NULL,*hptr=NULL; + char msg[64]="ENGINE_rsa_priv_dec"; + if (!p_surewarehk_Rsa_Priv_Dec) + { + ENGINEerr(ENGINE_F_SUREWAREHK_RSA_PRIV_DEC,ENGINE_R_NOT_INITIALISED); + } + /* extract ref to private key */ + else if (!(hptr=RSA_get_ex_data(rsa, rsaHndidx))) + { + ENGINEerr(ENGINE_F_SUREWAREHK_RSA_PRIV_DEC,ENGINE_R_MISSING_KEY_COMPONENTS); + goto err; + } + /* analyse what padding we can do into the hardware */ + if (padding==RSA_PKCS1_PADDING) + { + /* do it one shot */ + ret=p_surewarehk_Rsa_Priv_Dec(msg,flen,from,&tlen,to,hptr,SUREWARE_PKCS1_PAD); + surewarehk_error_handling(msg,ENGINE_F_SUREWAREHK_RSA_PRIV_DEC,ret); + if (ret!=1) + goto err; + ret=tlen; + } + else /* do with no padding into hardware */ + { + ret=p_surewarehk_Rsa_Priv_Dec(msg,flen,from,&tlen,to,hptr,SUREWARE_NO_PAD); + surewarehk_error_handling(msg,ENGINE_F_SUREWAREHK_RSA_PRIV_DEC,ret); + if (ret!=1) + goto err; + /* intermediate buffer for padding */ + if ((buf=(unsigned char *)OPENSSL_malloc(tlen)) == NULL) + { + RSAerr(ENGINE_F_SUREWAREHK_RSA_PRIV_DEC,ERR_R_MALLOC_FAILURE); + goto err; + } + memcpy(buf,to,tlen);/* transfert to into buf */ + switch (padding) /* check padding in software */ + { +#ifndef NO_SHA + case RSA_PKCS1_OAEP_PADDING: + ret=RSA_padding_check_PKCS1_OAEP(to,tlen,buf,tlen,tlen,NULL,0); + break; +#endif + case RSA_SSLV23_PADDING: + ret=RSA_padding_check_SSLv23(to,tlen,buf,flen,tlen); + break; + case RSA_NO_PADDING: + ret=RSA_padding_check_none(to,tlen,buf,flen,tlen); + break; + default: + RSAerr(ENGINE_F_SUREWAREHK_RSA_PRIV_DEC,RSA_R_UNKNOWN_PADDING_TYPE); + goto err; + } + if (ret < 0) + RSAerr(ENGINE_F_SUREWAREHK_RSA_PRIV_DEC,RSA_R_PADDING_CHECK_FAILED); + } +err: + if (buf) + { + memset(buf,0,tlen); + OPENSSL_free(buf); + } + return ret; +} +/* +* Does what OpenSSL rsa_priv_enc does. +*/ +static int surewarehk_rsa_sign(int flen,unsigned char *from,unsigned char *to, + RSA *rsa,int padding) +{ + int ret=0,tlen; + char *hptr=NULL; + char msg[64]="ENGINE_rsa_sign"; + if (!p_surewarehk_Rsa_Sign) + { + ENGINEerr(ENGINE_F_SUREWAREHK_RSA_PRIV_ENC,ENGINE_R_NOT_INITIALISED); + } + /* extract ref to private key */ + else if (!(hptr=RSA_get_ex_data(rsa, rsaHndidx))) + { + ENGINEerr(ENGINE_F_SUREWAREHK_RSA_PRIV_ENC,ENGINE_R_MISSING_KEY_COMPONENTS); + } + else + { + switch (padding) + { + case RSA_PKCS1_PADDING: /* do it in one shot */ + ret=p_surewarehk_Rsa_Sign(msg,flen,from,&tlen,to,hptr,SUREWARE_PKCS1_PAD); + surewarehk_error_handling(msg,ENGINE_F_SUREWAREHK_RSA_PRIV_ENC,ret); + break; + case RSA_NO_PADDING: + default: + RSAerr(ENGINE_F_SUREWAREHK_RSA_PRIV_ENC,RSA_R_UNKNOWN_PADDING_TYPE); + } + } + return ret==1 ? tlen : ret; +} +/* DSA sign and verify */ +static DSA_SIG * surewarehk_dsa_do_sign(const unsigned char *from, int flen, DSA *dsa) +{ + int ret=0; + char *hptr=NULL; + unsigned char *to=NULL; + DSA_SIG *psign=NULL; + char msg[64]="ENGINE_dsa_do_sign"; + if (!p_surewarehk_Dsa_Sign) + { + ENGINEerr(ENGINE_F_SUREWAREHK_DSA_DO_SIGN,ENGINE_R_NOT_INITIALISED); + } + /* extract ref to private key */ + else if (!(hptr=DSA_get_ex_data(dsa, dsaHndidx))) + { + ENGINEerr(ENGINE_F_SUREWAREHK_DSA_DO_SIGN,ENGINE_R_MISSING_KEY_COMPONENTS); + } + else + { + if((psign = DSA_SIG_new()) == NULL) + { + ENGINEerr(ENGINE_F_SUREWAREHK_DSA_DO_SIGN,ERR_R_MALLOC_FAILURE); + goto err; + } + psign->r=BN_new(); + psign->s=BN_new(); + bn_expand2(psign->r, 20/sizeof(BN_ULONG)); + bn_expand2(psign->s, 20/sizeof(BN_ULONG)); + if (!psign->r || psign->r->dmax!=20/sizeof(BN_ULONG) || + !psign->s || psign->s->dmax!=20/sizeof(BN_ULONG)) + goto err; + ret=p_surewarehk_Dsa_Sign(msg,flen,from,psign->r->d,psign->s->d,hptr); + surewarehk_error_handling(msg,ENGINE_F_SUREWAREHK_DSA_DO_SIGN,ret); + } + psign->r->top=20/sizeof(BN_ULONG); + bn_fix_top(psign->r); + psign->s->top=20/sizeof(BN_ULONG); + bn_fix_top(psign->s); + +err: + if (to) + { + DSA_SIG_free(psign); + psign=NULL; + } + return psign; +} +static int surewarehk_modexp(BIGNUM *r, BIGNUM *a, const BIGNUM *p, + const BIGNUM *m, BN_CTX *ctx) +{ + int ret=0; + char msg[64]="ENGINE_modexp"; + if (!p_surewarehk_Mod_Exp) + { + ENGINEerr(ENGINE_F_SUREWAREHK_MOD_EXP,ENGINE_R_NOT_INITIALISED); + } + else + { + bn_expand2(r,m->top); + if (r && r->dmax==m->top) + { + /* do it*/ + ret=p_surewarehk_Mod_Exp(msg,m->top*sizeof(BN_ULONG),m->d,p->top*sizeof(BN_ULONG), + p->d,a->top*sizeof(BN_ULONG),a->d,r->d); + surewarehk_error_handling(msg,ENGINE_F_SUREWAREHK_MOD_EXP,ret); + if (ret==1) + { + /* normalise result */ + r->top=m->top; + bn_fix_top(r); + } + } + } + return ret; +} +#endif /* !NO_HW_SureWare */ +#endif /* !NO_HW */ diff --git a/crypto/engine/vendor_defns/sureware.h b/crypto/engine/vendor_defns/sureware.h new file mode 100644 index 0000000000..1d3789219d --- /dev/null +++ b/crypto/engine/vendor_defns/sureware.h @@ -0,0 +1,239 @@ +/* +* Written by Corinne Dive-Reclus(cdive@baltimore.com) +* +* Copyright@2001 Baltimore Technologies Ltd. +* * +* THIS FILE IS PROVIDED BY BALTIMORE TECHNOLOGIES ``AS IS'' AND * +* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * +* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * +* ARE DISCLAIMED. IN NO EVENT SHALL BALTIMORE TECHNOLOGIES BE LIABLE * +* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * +* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * +* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * +* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * +* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * +* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * +* SUCH DAMAGE. * +* +* +*/ +#ifdef WIN32 +#define SW_EXPORT __declspec ( dllexport ) +#else +#define SW_EXPORT +#endif + +/* +* List of exposed SureWare errors +*/ +#define SUREWAREHOOK_ERROR_FAILED -1 +#define SUREWAREHOOK_ERROR_FALLBACK -2 +#define SUREWAREHOOK_ERROR_UNIT_FAILURE -3 +#define SUREWAREHOOK_ERROR_DATA_SIZE -4 +#define SUREWAREHOOK_ERROR_INVALID_PAD -5 +/* +* -----------------WARNING----------------------------------- +* In all the following functions: +* msg is a string with at least 24 bytes free. +* A 24 bytes string will be concatenated to the existing content of msg. +*/ +/* +* SureWare Initialisation function +* in param threadsafe, if !=0, thread safe enabled +* return SureWareHOOK_ERROR_UNIT_FAILURE if failure, 1 if success +*/ +typedef int SureWareHook_Init_t(char*const msg,int threadsafe); +extern SW_EXPORT SureWareHook_Init_t SureWareHook_Init; +/* +* SureWare Finish function +*/ +typedef void SureWareHook_Finish_t(); +extern SW_EXPORT SureWareHook_Finish_t SureWareHook_Finish; +/* +* PRE_CONDITION: +* DO NOT CALL ANY OF THE FOLLOWING FUNCTIONS IN CASE OF INIT FAILURE +*/ +/* +* SureWare RAND Bytes function +* In case of failure, the content of buf is unpredictable. +* return 1 if success +* SureWareHOOK_ERROR_FALLBACK if function not available in hardware +* SureWareHOOK_ERROR_FAILED if error while processing +* SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure +* SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf +* +* in/out param buf : a num bytes long buffer where random bytes will be put +* in param num : the number of bytes into buf +*/ +typedef int SureWareHook_Rand_Bytes_t(char*const msg,unsigned char *buf, int num); +extern SW_EXPORT SureWareHook_Rand_Bytes_t SureWareHook_Rand_Bytes; + +/* +* SureWare RAND Seed function +* Adds some seed to the Hardware Random Number Generator +* return 1 if success +* SureWareHOOK_ERROR_FALLBACK if function not available in hardware +* SureWareHOOK_ERROR_FAILED if error while processing +* SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure +* SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf +* +* in param buf : the seed to add into the HRNG +* in param num : the number of bytes into buf +*/ +typedef int SureWareHook_Rand_Seed_t(char*const msg,const void *buf, int num); +extern SW_EXPORT SureWareHook_Rand_Seed_t SureWareHook_Rand_Seed; + +/* +* SureWare Load Private Key function +* return 1 if success +* SureWareHOOK_ERROR_FAILED if error while processing +* No hardware is contact for this function. +* +* in param key_id :the name of the private protected key file without the extension + ".sws" +* out param hptr : a pointer to a buffer allocated by SureWare_Hook +* out param num: the effective key length in bytes +* out param keytype: 1 if RSA 2 if DSA +*/ +typedef int SureWareHook_Load_Privkey_t(char*const msg,const char *key_id,char **hptr,unsigned long *num,char *keytype); +extern SW_EXPORT SureWareHook_Load_Privkey_t SureWareHook_Load_Privkey; + +/* +* SureWare Info Public Key function +* return 1 if success +* SureWareHOOK_ERROR_FAILED if error while processing +* No hardware is contact for this function. +* +* in param key_id :the name of the private protected key file without the extension + ".swp" +* out param hptr : a pointer to a buffer allocated by SureWare_Hook +* out param num: the effective key length in bytes +* out param keytype: 1 if RSA 2 if DSA +*/ +typedef int SureWareHook_Info_Pubkey_t(char*const msg,const char *key_id,unsigned long *num, + char *keytype); +extern SW_EXPORT SureWareHook_Info_Pubkey_t SureWareHook_Info_Pubkey; + +/* +* SureWare Load Public Key function +* return 1 if success +* SureWareHOOK_ERROR_FAILED if error while processing +* No hardware is contact for this function. +* +* in param key_id :the name of the public protected key file without the extension + ".swp" +* in param num : the bytes size of n and e +* out param n: where to write modulus in bn format +* out param e: where to write exponent in bn format +*/ +typedef int SureWareHook_Load_Rsa_Pubkey_t(char*const msg,const char *key_id,unsigned long num, + unsigned long *n, unsigned long *e); +extern SW_EXPORT SureWareHook_Load_Rsa_Pubkey_t SureWareHook_Load_Rsa_Pubkey; + +/* +* SureWare Load DSA Public Key function +* return 1 if success +* SureWareHOOK_ERROR_FAILED if error while processing +* No hardware is contact for this function. +* +* in param key_id :the name of the public protected key file without the extension + ".swp" +* in param num : the bytes size of n and e +* out param pub: where to write pub key in bn format +* out param p: where to write prime in bn format +* out param q: where to write sunprime (length 20 bytes) in bn format +* out param g: where to write base in bn format +*/ +typedef int SureWareHook_Load_Dsa_Pubkey_t(char*const msg,const char *key_id,unsigned long num, + unsigned long *pub, unsigned long *p,unsigned long*q, + unsigned long *g); +extern SW_EXPORT SureWareHook_Load_Dsa_Pubkey_t SureWareHook_Load_Dsa_Pubkey; + +/* +* SureWare Free function +* Destroy the key into the hardware if destroy==1 +*/ +typedef void SureWareHook_Free_t(char *p,int destroy); +extern SW_EXPORT SureWareHook_Free_t SureWareHook_Free; + +#define SUREWARE_PKCS1_PAD 1 +#define SUREWARE_ISO9796_PAD 2 +#define SUREWARE_NO_PAD 0 +/* +* SureWare RSA Private Decryption +* return 1 if success +* SureWareHOOK_ERROR_FAILED if error while processing +* SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure +* SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf +* +* in param flen : byte size of from and to +* in param from : encrypted data buffer, should be a not-null valid pointer +* out param tlen: byte size of decrypted data, if error, unexpected value +* out param to : decrypted data buffer, should be a not-null valid pointer +* in param prsa: a protected key pointer, should be a not-null valid pointer +* int padding: padding id as follow +* SUREWARE_PKCS1_PAD +* SUREWARE_NO_PAD +* +*/ +typedef int SureWareHook_Rsa_Priv_Dec_t(char*const msg,int flen,unsigned char *from, + int *tlen,unsigned char *to, + char *prsa,int padding); +extern SW_EXPORT SureWareHook_Rsa_Priv_Dec_t SureWareHook_Rsa_Priv_Dec; +/* +* SureWare RSA Signature +* return 1 if success +* SureWareHOOK_ERROR_FAILED if error while processing +* SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure +* SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf +* +* in param flen : byte size of from and to +* in param from : encrypted data buffer, should be a not-null valid pointer +* out param tlen: byte size of decrypted data, if error, unexpected value +* out param to : decrypted data buffer, should be a not-null valid pointer +* in param prsa: a protected key pointer, should be a not-null valid pointer +* int padding: padding id as follow +* SUREWARE_PKCS1_PAD +* SUREWARE_ISO9796_PAD +* +*/ +typedef int SureWareHook_Rsa_Sign_t(char*const msg,int flen,unsigned char *from, + int *tlen,unsigned char *to, + char *prsa,int padding); +extern SW_EXPORT SureWareHook_Rsa_Sign_t SureWareHook_Rsa_Sign; +/* +* SureWare DSA Signature +* return 1 if success +* SureWareHOOK_ERROR_FAILED if error while processing +* SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure +* SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf +* +* in param flen : byte size of from and to +* in param from : encrypted data buffer, should be a not-null valid pointer +* out param to : decrypted data buffer, should be a 40bytes valid pointer +* in param pdsa: a protected key pointer, should be a not-null valid pointer +* +*/ +typedef int SureWareHook_Dsa_Sign_t(char*const msg,int flen,const unsigned char *from, + unsigned long *r,unsigned long *s,char *pdsa); +extern SW_EXPORT SureWareHook_Dsa_Sign_t SureWareHook_Dsa_Sign; + + +/* +* SureWare Mod Exp +* return 1 if success +* SureWareHOOK_ERROR_FAILED if error while processing +* SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure +* SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf +* +* mod and res are mlen bytes long. +* exp is elen bytes long +* data is dlen bytes long +* mlen,elen and dlen are all multiple of sizeof(unsigned long) +*/ +typedef int SureWareHook_Mod_Exp_t(char*const msg,int mlen,const unsigned long *mod, + int elen,const unsigned long *exp, + int dlen,unsigned long *data, + unsigned long *res); +extern SW_EXPORT SureWareHook_Mod_Exp_t SureWareHook_Mod_Exp; + -- 2.25.1