crmf_local.h 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394
  1. /*-
  2. * Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright Nokia 2007-2019
  4. * Copyright Siemens AG 2015-2019
  5. *
  6. * Licensed under the Apache License 2.0 (the "License"). You may not use
  7. * this file except in compliance with the License. You can obtain a copy
  8. * in the file LICENSE in the source distribution or at
  9. * https://www.openssl.org/source/license.html
  10. *
  11. * CRMF implementation by Martin Peylo, Miikka Viljanen, and David von Oheimb.
  12. */
  13. #ifndef OSSL_CRYPTO_CRMF_LOCAL_H
  14. # define OSSL_CRYPTO_CRMF_LOCAL_H
  15. # include <openssl/crmf.h>
  16. # include <openssl/err.h>
  17. /* explicit #includes not strictly needed since implied by the above: */
  18. # include <openssl/types.h>
  19. # include <openssl/safestack.h>
  20. # include <openssl/x509.h>
  21. # include <openssl/x509v3.h>
  22. /*-
  23. * EncryptedValue ::= SEQUENCE {
  24. * intendedAlg [0] AlgorithmIdentifier OPTIONAL,
  25. * -- the intended algorithm for which the value will be used
  26. * symmAlg [1] AlgorithmIdentifier OPTIONAL,
  27. * -- the symmetric algorithm used to encrypt the value
  28. * encSymmKey [2] BIT STRING OPTIONAL,
  29. * -- the (encrypted) symmetric key used to encrypt the value
  30. * keyAlg [3] AlgorithmIdentifier OPTIONAL,
  31. * -- algorithm used to encrypt the symmetric key
  32. * valueHint [4] OCTET STRING OPTIONAL,
  33. * -- a brief description or identifier of the encValue content
  34. * -- (may be meaningful only to the sending entity, and
  35. * -- used only if EncryptedValue might be re-examined
  36. * -- by the sending entity in the future)
  37. * encValue BIT STRING
  38. * -- the encrypted value itself
  39. * }
  40. */
  41. struct ossl_crmf_encryptedvalue_st {
  42. X509_ALGOR *intendedAlg; /* 0 */
  43. X509_ALGOR *symmAlg; /* 1 */
  44. ASN1_BIT_STRING *encSymmKey; /* 2 */
  45. X509_ALGOR *keyAlg; /* 3 */
  46. ASN1_OCTET_STRING *valueHint; /* 4 */
  47. ASN1_BIT_STRING *encValue;
  48. } /* OSSL_CRMF_ENCRYPTEDVALUE */;
  49. /*-
  50. * Attributes ::= SET OF Attribute
  51. * => X509_ATTRIBUTE
  52. *
  53. * PrivateKeyInfo ::= SEQUENCE {
  54. * version INTEGER,
  55. * privateKeyAlgorithm AlgorithmIdentifier,
  56. * privateKey OCTET STRING,
  57. * attributes [0] IMPLICIT Attributes OPTIONAL
  58. * }
  59. */
  60. typedef struct ossl_crmf_privatekeyinfo_st {
  61. ASN1_INTEGER *version;
  62. X509_ALGOR *privateKeyAlgorithm;
  63. ASN1_OCTET_STRING *privateKey;
  64. STACK_OF(X509_ATTRIBUTE) *attributes; /* [ 0 ] */
  65. } OSSL_CRMF_PRIVATEKEYINFO;
  66. DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_PRIVATEKEYINFO)
  67. /*-
  68. * section 4.2.1 Private Key Info Content Type
  69. * id-ct-encKeyWithID OBJECT IDENTIFIER ::= {id-ct 21}
  70. *
  71. * EncKeyWithID ::= SEQUENCE {
  72. * privateKey PrivateKeyInfo,
  73. * identifier CHOICE {
  74. * string UTF8String,
  75. * generalName GeneralName
  76. * } OPTIONAL
  77. * }
  78. */
  79. typedef struct ossl_crmf_enckeywithid_identifier_st {
  80. int type;
  81. union {
  82. ASN1_UTF8STRING *string;
  83. GENERAL_NAME *generalName;
  84. } value;
  85. } OSSL_CRMF_ENCKEYWITHID_IDENTIFIER;
  86. DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_ENCKEYWITHID_IDENTIFIER)
  87. typedef struct ossl_crmf_enckeywithid_st {
  88. OSSL_CRMF_PRIVATEKEYINFO *privateKey;
  89. /* [0] */
  90. OSSL_CRMF_ENCKEYWITHID_IDENTIFIER *identifier;
  91. } OSSL_CRMF_ENCKEYWITHID;
  92. DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_ENCKEYWITHID)
  93. /*-
  94. * CertId ::= SEQUENCE {
  95. * issuer GeneralName,
  96. * serialNumber INTEGER
  97. * }
  98. */
  99. struct ossl_crmf_certid_st {
  100. GENERAL_NAME *issuer;
  101. ASN1_INTEGER *serialNumber;
  102. } /* OSSL_CRMF_CERTID */;
  103. DECLARE_ASN1_DUP_FUNCTION(OSSL_CRMF_CERTID)
  104. /*-
  105. * SinglePubInfo ::= SEQUENCE {
  106. * pubMethod INTEGER {
  107. * dontCare (0),
  108. * x500 (1),
  109. * web (2),
  110. * ldap (3) },
  111. * pubLocation GeneralName OPTIONAL
  112. * }
  113. */
  114. struct ossl_crmf_singlepubinfo_st {
  115. ASN1_INTEGER *pubMethod;
  116. GENERAL_NAME *pubLocation;
  117. } /* OSSL_CRMF_SINGLEPUBINFO */;
  118. DEFINE_STACK_OF(OSSL_CRMF_SINGLEPUBINFO)
  119. typedef STACK_OF(OSSL_CRMF_SINGLEPUBINFO) OSSL_CRMF_PUBINFOS;
  120. /*-
  121. * PKIPublicationInfo ::= SEQUENCE {
  122. * action INTEGER {
  123. * dontPublish (0),
  124. * pleasePublish (1) },
  125. * pubInfos SEQUENCE SIZE (1..MAX) OF SinglePubInfo OPTIONAL
  126. * -- pubInfos MUST NOT be present if action is "dontPublish"
  127. * -- (if action is "pleasePublish" and pubInfos is omitted,
  128. * -- "dontCare" is assumed)
  129. * }
  130. */
  131. struct ossl_crmf_pkipublicationinfo_st {
  132. ASN1_INTEGER *action;
  133. OSSL_CRMF_PUBINFOS *pubInfos;
  134. } /* OSSL_CRMF_PKIPUBLICATIONINFO */;
  135. DECLARE_ASN1_DUP_FUNCTION(OSSL_CRMF_PKIPUBLICATIONINFO)
  136. /*-
  137. * PKMACValue ::= SEQUENCE {
  138. * algId AlgorithmIdentifier,
  139. * -- algorithm value shall be PasswordBasedMac {1 2 840 113533 7 66 13}
  140. * -- parameter value is PBMParameter
  141. * value BIT STRING
  142. * }
  143. */
  144. typedef struct ossl_crmf_pkmacvalue_st {
  145. X509_ALGOR *algId;
  146. ASN1_BIT_STRING *value;
  147. } OSSL_CRMF_PKMACVALUE;
  148. DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_PKMACVALUE)
  149. /*-
  150. * SubsequentMessage ::= INTEGER {
  151. * encrCert (0),
  152. * -- requests that resulting certificate be encrypted for the
  153. * -- end entity (following which, POP will be proven in a
  154. * -- confirmation message)
  155. * challengeResp (1)
  156. * -- requests that CA engage in challenge-response exchange with
  157. * -- end entity in order to prove private key possession
  158. * }
  159. *
  160. * POPOPrivKey ::= CHOICE {
  161. * thisMessage [0] BIT STRING, -- Deprecated
  162. * -- possession is proven in this message (which contains the private
  163. * -- key itself (encrypted for the CA))
  164. * subsequentMessage [1] SubsequentMessage,
  165. * -- possession will be proven in a subsequent message
  166. * dhMAC [2] BIT STRING, -- Deprecated
  167. * agreeMAC [3] PKMACValue,
  168. * encryptedKey [4] EnvelopedData
  169. * }
  170. */
  171. typedef struct ossl_crmf_popoprivkey_st {
  172. int type;
  173. union {
  174. ASN1_BIT_STRING *thisMessage; /* 0 */ /* Deprecated */
  175. ASN1_INTEGER *subsequentMessage; /* 1 */
  176. ASN1_BIT_STRING *dhMAC; /* 2 */ /* Deprecated */
  177. OSSL_CRMF_PKMACVALUE *agreeMAC; /* 3 */
  178. /*
  179. * TODO: This is not ASN1_NULL but CMS_ENVELOPEDDATA which should be
  180. * somehow taken from crypto/cms which exists now
  181. * - this is not used anywhere so far
  182. */
  183. ASN1_NULL *encryptedKey; /* 4 */
  184. } value;
  185. } OSSL_CRMF_POPOPRIVKEY;
  186. DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_POPOPRIVKEY)
  187. /*-
  188. * PBMParameter ::= SEQUENCE {
  189. * salt OCTET STRING,
  190. * owf AlgorithmIdentifier,
  191. * -- AlgId for a One-Way Function (SHA-1 recommended)
  192. * iterationCount INTEGER,
  193. * -- number of times the OWF is applied
  194. * mac AlgorithmIdentifier
  195. * -- the MAC AlgId (e.g., DES-MAC, Triple-DES-MAC [PKCS11],
  196. * -- or HMAC [HMAC, RFC2202])
  197. * }
  198. */
  199. struct ossl_crmf_pbmparameter_st {
  200. ASN1_OCTET_STRING *salt;
  201. X509_ALGOR *owf;
  202. ASN1_INTEGER *iterationCount;
  203. X509_ALGOR *mac;
  204. } /* OSSL_CRMF_PBMPARAMETER */;
  205. #define OSSL_CRMF_PBM_MAX_ITERATION_COUNT 100000 /* if too large allows DoS */
  206. /*-
  207. * POPOSigningKeyInput ::= SEQUENCE {
  208. * authInfo CHOICE {
  209. * sender [0] GeneralName,
  210. * -- used only if an authenticated identity has been
  211. * -- established for the sender (e.g., a DN from a
  212. * -- previously-issued and currently-valid certificate)
  213. * publicKeyMAC PKMACValue },
  214. * -- used if no authenticated GeneralName currently exists for
  215. * -- the sender; publicKeyMAC contains a password-based MAC
  216. * -- on the DER-encoded value of publicKey
  217. * publicKey SubjectPublicKeyInfo -- from CertTemplate
  218. * }
  219. */
  220. typedef struct ossl_crmf_poposigningkeyinput_authinfo_st {
  221. int type;
  222. union {
  223. /* 0 */ GENERAL_NAME *sender;
  224. /* 1 */ OSSL_CRMF_PKMACVALUE *publicKeyMAC;
  225. } value;
  226. } OSSL_CRMF_POPOSIGNINGKEYINPUT_AUTHINFO;
  227. DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_POPOSIGNINGKEYINPUT_AUTHINFO)
  228. typedef struct ossl_crmf_poposigningkeyinput_st {
  229. OSSL_CRMF_POPOSIGNINGKEYINPUT_AUTHINFO *authInfo;
  230. X509_PUBKEY *publicKey;
  231. } OSSL_CRMF_POPOSIGNINGKEYINPUT;
  232. DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_POPOSIGNINGKEYINPUT)
  233. /*-
  234. * POPOSigningKey ::= SEQUENCE {
  235. * poposkInput [0] POPOSigningKeyInput OPTIONAL,
  236. * algorithmIdentifier AlgorithmIdentifier,
  237. * signature BIT STRING
  238. * }
  239. */
  240. struct ossl_crmf_poposigningkey_st {
  241. OSSL_CRMF_POPOSIGNINGKEYINPUT *poposkInput;
  242. X509_ALGOR *algorithmIdentifier;
  243. ASN1_BIT_STRING *signature;
  244. } /* OSSL_CRMF_POPOSIGNINGKEY */;
  245. DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_POPOSIGNINGKEY)
  246. /*-
  247. * ProofOfPossession ::= CHOICE {
  248. * raVerified [0] NULL,
  249. * -- used if the RA has already verified that the requester is in
  250. * -- possession of the private key
  251. * signature [1] POPOSigningKey,
  252. * keyEncipherment [2] POPOPrivKey,
  253. * keyAgreement [3] POPOPrivKey
  254. * }
  255. */
  256. typedef struct ossl_crmf_popo_st {
  257. int type;
  258. union {
  259. ASN1_NULL *raVerified; /* 0 */
  260. OSSL_CRMF_POPOSIGNINGKEY *signature; /* 1 */
  261. OSSL_CRMF_POPOPRIVKEY *keyEncipherment; /* 2 */
  262. OSSL_CRMF_POPOPRIVKEY *keyAgreement; /* 3 */
  263. } value;
  264. } OSSL_CRMF_POPO;
  265. DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_POPO)
  266. /*-
  267. * OptionalValidity ::= SEQUENCE {
  268. * notBefore [0] Time OPTIONAL,
  269. * notAfter [1] Time OPTIONAL -- at least one MUST be present
  270. * }
  271. */
  272. struct ossl_crmf_optionalvalidity_st {
  273. /* 0 */ ASN1_TIME *notBefore;
  274. /* 1 */ ASN1_TIME *notAfter;
  275. } /* OSSL_CRMF_OPTIONALVALIDITY */;
  276. DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_OPTIONALVALIDITY)
  277. /*-
  278. * CertTemplate ::= SEQUENCE {
  279. * version [0] Version OPTIONAL,
  280. * serialNumber [1] INTEGER OPTIONAL,
  281. * signingAlg [2] AlgorithmIdentifier OPTIONAL,
  282. * issuer [3] Name OPTIONAL,
  283. * validity [4] OptionalValidity OPTIONAL,
  284. * subject [5] Name OPTIONAL,
  285. * publicKey [6] SubjectPublicKeyInfo OPTIONAL,
  286. * issuerUID [7] UniqueIdentifier OPTIONAL,
  287. * subjectUID [8] UniqueIdentifier OPTIONAL,
  288. * extensions [9] Extensions OPTIONAL
  289. * }
  290. */
  291. struct ossl_crmf_certtemplate_st {
  292. ASN1_INTEGER *version; /* 0 */
  293. ASN1_INTEGER *serialNumber; /* 1 */ /* serialNumber MUST be omitted */
  294. /* This field is assigned by the CA during certificate creation */
  295. X509_ALGOR *signingAlg; /* 2 */ /* signingAlg MUST be omitted */
  296. /* This field is assigned by the CA during certificate creation */
  297. X509_NAME *issuer; /* 3 */
  298. OSSL_CRMF_OPTIONALVALIDITY *validity; /* 4 */
  299. X509_NAME *subject; /* 5 */
  300. X509_PUBKEY *publicKey; /* 6 */
  301. ASN1_BIT_STRING *issuerUID; /* 7 */ /* deprecated in version 2 */
  302. /* According to rfc 3280: UniqueIdentifier ::= BIT STRING */
  303. ASN1_BIT_STRING *subjectUID; /* 8 */ /* deprecated in version 2 */
  304. /* Could be X509_EXTENSION*S*, but that's only cosmetic */
  305. STACK_OF(X509_EXTENSION) *extensions; /* 9 */
  306. } /* OSSL_CRMF_CERTTEMPLATE */;
  307. /*-
  308. * CertRequest ::= SEQUENCE {
  309. * certReqId INTEGER, -- ID for matching request and reply
  310. * certTemplate CertTemplate, -- Selected fields of cert to be issued
  311. * controls Controls OPTIONAL -- Attributes affecting issuance
  312. * }
  313. */
  314. struct ossl_crmf_certrequest_st {
  315. ASN1_INTEGER *certReqId;
  316. OSSL_CRMF_CERTTEMPLATE *certTemplate;
  317. /* TODO: make OSSL_CRMF_CONTROLS out of that - but only cosmetical */
  318. STACK_OF(OSSL_CRMF_ATTRIBUTETYPEANDVALUE) *controls;
  319. } /* OSSL_CRMF_CERTREQUEST */;
  320. DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_CERTREQUEST)
  321. DECLARE_ASN1_DUP_FUNCTION(OSSL_CRMF_CERTREQUEST)
  322. /* TODO: isn't there a better way to have this for ANY type? */
  323. struct ossl_crmf_attributetypeandvalue_st {
  324. ASN1_OBJECT *type;
  325. union {
  326. /* NID_id_regCtrl_regToken */
  327. ASN1_UTF8STRING *regToken;
  328. /* NID_id_regCtrl_authenticator */
  329. ASN1_UTF8STRING *authenticator;
  330. /* NID_id_regCtrl_pkiPublicationInfo */
  331. OSSL_CRMF_PKIPUBLICATIONINFO *pkiPublicationInfo;
  332. /* NID_id_regCtrl_oldCertID */
  333. OSSL_CRMF_CERTID *oldCertID;
  334. /* NID_id_regCtrl_protocolEncrKey */
  335. X509_PUBKEY *protocolEncrKey;
  336. /* NID_id_regInfo_utf8Pairs */
  337. ASN1_UTF8STRING *utf8Pairs;
  338. /* NID_id_regInfo_certReq */
  339. OSSL_CRMF_CERTREQUEST *certReq;
  340. ASN1_TYPE *other;
  341. } value;
  342. } /* OSSL_CRMF_ATTRIBUTETYPEANDVALUE */;
  343. DECLARE_ASN1_FUNCTIONS(OSSL_CRMF_ATTRIBUTETYPEANDVALUE)
  344. DEFINE_STACK_OF(OSSL_CRMF_ATTRIBUTETYPEANDVALUE)
  345. DECLARE_ASN1_DUP_FUNCTION(OSSL_CRMF_ATTRIBUTETYPEANDVALUE)
  346. /*-
  347. * CertReqMessages ::= SEQUENCE SIZE (1..MAX) OF CertReqMsg
  348. * CertReqMsg ::= SEQUENCE {
  349. * certReq CertRequest,
  350. * popo ProofOfPossession OPTIONAL,
  351. * -- content depends upon key type
  352. * regInfo SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue OPTIONAL
  353. * }
  354. */
  355. struct ossl_crmf_msg_st {
  356. OSSL_CRMF_CERTREQUEST *certReq;
  357. /* 0 */
  358. OSSL_CRMF_POPO *popo;
  359. /* 1 */
  360. STACK_OF(OSSL_CRMF_ATTRIBUTETYPEANDVALUE) *regInfo;
  361. } /* OSSL_CRMF_MSG */;
  362. /* DEFINE_STACK_OF(OSSL_CRMF_MSG) */
  363. #endif