eac.h

Go to the documentation of this file.

/*
 * Copyright (c) 2010-2012 Frank Morgner and Dominik Oepen
 *
 * This file is part of OpenPACE.
 *
 * OpenPACE is free software: you can redistribute it and/or modify it under
 * the terms of the GNU General Public License as published by the Free
 * Software Foundation, either version 3 of the License, or (at your option)
 * any later version.
 *
 * OpenPACE is distributed in the hope that it will be useful, but WITHOUT ANY
 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
 * details.
 *
 * You should have received a copy of the GNU General Public License along with
 * OpenPACE.  If not, see <http://www.gnu.org/licenses/>.
 *
 * Additional permission under GNU GPL version 3 section 7
 *
 * If you modify this Program, or any covered work, by linking or combining it
 * with OpenSSL (or a modified version of that library), containing
 * parts covered by the terms of OpenSSL's license, the licensors of
 * this Program grant you additional permission to convey the resulting work.
 * Corresponding Source for a non-source form of such a combination shall include
 * the source code for the parts of OpenSSL used as well as that of the
 * covered work.
 *
 * If you modify this Program, or any covered work, by linking or combining it
 * with OpenSC (or a modified version of that library), containing
 * parts covered by the terms of OpenSC's license, the licensors of
 * this Program grant you additional permission to convey the resulting work. 
 * Corresponding Source for a non-source form of such a combination shall include
 * the source code for the parts of OpenSC used as well as that of the
 * covered work.
 */
 
#ifndef EAC_H_
#define EAC_H_
 
#ifdef __cplusplus
extern "C" {
#endif
 
#include <eac/cv_cert.h>
#include <eac/objects.h>
#include <openssl/asn1.h>
#include <openssl/buffer.h>
#include <openssl/cmac.h>
#include <openssl/ec.h>
#include <openssl/evp.h>
 
enum eac_tr_version {
    EAC_TR_VERSION = 0,
    EAC_TR_VERSION_2_01,
    EAC_TR_VERSION_2_02,
};
 
typedef struct ka_ctx {
        const EVP_MD * md;
        ENGINE * md_engine;
        CMAC_CTX * cmac_ctx;
        const EVP_CIPHER * cipher;
        ENGINE * cipher_engine;
        unsigned char * iv;
        int mac_keylen;
        int enc_keylen;
 
        BUF_MEM * (*generate_key)(EVP_PKEY *key, BN_CTX *bn_ctx);
        BUF_MEM * (*compute_key)(EVP_PKEY *key, const BUF_MEM *in, BN_CTX *bn_ctx);
 
        EVP_PKEY *key;
 
        BUF_MEM *shared_secret;
        BUF_MEM *k_enc;
        BUF_MEM *k_mac;
} KA_CTX;
 
typedef struct pace_ctx {
    int protocol;
    unsigned char version;
    int id;
    BUF_MEM * (*map_generate_key)(const struct pace_ctx *ctx, BN_CTX *bn_ctx);
    int (*map_compute_key)(struct pace_ctx * ctx, const BUF_MEM * s,
                    const BUF_MEM * in, BN_CTX *bn_ctx);
 
    EVP_PKEY *static_key;
    KA_CTX *ka_ctx;
    BUF_MEM *nonce;
    BUF_MEM *my_eph_pubkey;
} PACE_CTX;
 
typedef struct ri_ctx {
    int protocol;
    int id;
    const EVP_MD * md;
    BUF_MEM * (*generate_key)(EVP_PKEY *key, BN_CTX *bn_ctx);
    BUF_MEM * (*compute_key)(EVP_PKEY *key, const BUF_MEM *in, BN_CTX *bn_ctx);
    EVP_PKEY *static_key;
} RI_CTX;
 
typedef CVC_CERT * (*CVC_lookup_cvca_cert) (const unsigned char *chr, size_t car_len);
 
typedef struct ta_ctx {
    unsigned char version;
    int protocol;
    ENGINE *key_engine;
    EVP_PKEY *priv_key;
    EVP_PKEY *pub_key;
    BUF_MEM *pk_pcd;
    BUF_MEM *nonce;
    CVC_CERT *trust_anchor;
    CVC_CERT *current_cert;
    CVC_CERT *new_trust_anchor;
    int flags;
 
    CVC_lookup_cvca_cert lookup_cvca_cert;
} TA_CTX;
 
typedef X509_STORE * (*X509_lookup_csca_cert) (unsigned long issuer_name_hash);
 
typedef struct ca_ctx {
    unsigned char version;
    int protocol;
    int id;
    int flags;
    KA_CTX *ka_ctx;
 
    X509_lookup_csca_cert lookup_csca_cert;
} CA_CTX;
 
typedef struct eac_ctx {
    enum eac_tr_version tr_version;
    BN_CTX * bn_ctx;
    EVP_MD_CTX * md_ctx;
    EVP_CIPHER_CTX * cipher_ctx;
    PACE_CTX *pace_ctx;
    STACK_OF(PACE_CTX *) pace_ctxs;
    RI_CTX *ri_ctx;
    STACK_OF(RI_CTX *) ri_ctxs;
    TA_CTX *ta_ctx;
    CA_CTX *ca_ctx;
    STACK_OF(CA_CTX *) ca_ctxs;
    KA_CTX *key_ctx;
    BIGNUM *ssc;
} EAC_CTX;
 
#define EAC_AES_MAC_LENGTH 8
 
void EAC_init(void);
 
void EAC_cleanup(void);
 
EAC_CTX *
EAC_CTX_new(void);
 
void EAC_CTX_clear_free(EAC_CTX *ctx);
 
int
EAC_CTX_init_pace(EAC_CTX *ctx, int protocol, int curve);
 
int
EAC_CTX_init_ta(const EAC_CTX *ctx,
           const unsigned char *privkey, size_t privkey_len,
           const unsigned char *cvca, size_t cvca_len);
 
int EAC_CTX_init_ca(EAC_CTX *ctx, int protocol, int curve);
 
int
EAC_CTX_init_ri(EAC_CTX *ctx, int protocol, int stnd_dp);
 
int EAC_CTX_init_ef_cardaccess(unsigned const char * in, size_t in_len,
        EAC_CTX *ctx);
 
int EAC_CTX_init_ef_cardsecurity(
        const unsigned char *ef_cardsecurity, size_t ef_cardsecurity_len,
        EAC_CTX *ctx);
 
int EAC_CTX_get_cvca_lookup(const EAC_CTX *ctx, CVC_lookup_cvca_cert *lookup_cvca_cert);
int EAC_CTX_set_cvca_lookup(EAC_CTX *ctx, CVC_lookup_cvca_cert lookup_cvca_cert);
CVC_lookup_cvca_cert EAC_get_default_cvca_lookup(void);
 
void EAC_set_cvc_default_dir(const char *default_dir);
 
int EAC_CTX_get_csca_lookup_cert(const EAC_CTX *ctx, X509_lookup_csca_cert *lookup_cvca_cert);
int EAC_CTX_set_csca_lookup_cert(EAC_CTX *ctx, X509_lookup_csca_cert lookup_cvca_cert);
X509_lookup_csca_cert EAC_get_default_csca_lookup(void);
 
void EAC_set_x509_default_dir(const char *default_dir);
 
BUF_MEM *
EAC_add_iso_pad(const EAC_CTX *ctx, const BUF_MEM * unpadded);
BUF_MEM *
EAC_remove_iso_pad(const BUF_MEM * padded);
 
int EAC_increment_ssc(const EAC_CTX *ctx);
 
int EAC_reset_ssc(const EAC_CTX *ctx);
int EAC_set_ssc(const EAC_CTX *ctx, unsigned long ssc);
 
BUF_MEM *
EAC_encrypt(const EAC_CTX *ctx, const BUF_MEM *data);
 
BUF_MEM *
EAC_decrypt(const EAC_CTX *ctx, const BUF_MEM *data);
 
BUF_MEM *
EAC_authenticate(const EAC_CTX *ctx, const BUF_MEM *data);
int
EAC_verify_authentication(const EAC_CTX *ctx, const BUF_MEM *data,
        const BUF_MEM *mac);
 
BUF_MEM *
EAC_Comp(const EAC_CTX *ctx, int id, const BUF_MEM *pub);
 
BUF_MEM *
EAC_hash_certificate_description(const unsigned char *cert_desc,
        size_t cert_desc_len);
 
#define EAC_ID_PACE 0
 
#define EAC_ID_CA 1
 
#define EAC_ID_TA 2
 
#define EAC_ID_EAC 3
 
int
EAC_CTX_set_encryption_ctx(EAC_CTX *ctx, int id);
 
int EAC_CTX_print_private(BIO *out, const EAC_CTX *ctx, int indent);
int BUF_MEM_print(BIO *out, const BUF_MEM *buf, int indent);
 
void
BUF_MEM_clear_free(BUF_MEM *b);
 
#ifdef __cplusplus
}
#endif
#endif