pkcs11_key_store.h revision 594849c7cf872d055575277b930f4f596bef1988
1d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// Copyright 2015 The Chromium OS Authors. All rights reserved. 2d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// Use of this source code is governed by a BSD-style license that can be 3d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// found in the LICENSE file. 4d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 5d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn#ifndef ATTESTATION_SERVER_PKCS11_KEY_STORE_H_ 6d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn#define ATTESTATION_SERVER_PKCS11_KEY_STORE_H_ 7d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 8d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn#include "attestation/server/key_store.h" 9d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 10d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn#include <string> 11d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 12d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn#include <base/callback_forward.h> 13d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn#include <base/macros.h> 14d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn#include <chaps/pkcs11/cryptoki.h> 15d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn#include <chaps/token_manager_client.h> 16d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 17d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahnnamespace attestation { 18d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 19d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// This class uses a PKCS #11 token as storage for key data. The key data is 20d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// stored in data objects with the following attributes: 21d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// CKA_CLASS - CKO_DATA 22d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// CKA_LABEL - A key name. 23d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// CKA_VALUE - Binary key data (opaque to this class and the PKCS #11 token). 24d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// CKA_APPLICATION - A constant value associated with this class. 25d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// CKA_TOKEN - True 26d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// CKA_PRIVATE - True 27d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// CKA_MODIFIABLE - False 28d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// There is no barrier between the objects created by this class and any other 29d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// objects residing in the same token. In practice, this means that any 30d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// component with access to the PKCS #11 token also has access to read or delete 31d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn// key data. 32d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahnclass Pkcs11KeyStore : public KeyStore { 33d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn public: 34d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // Does not take ownership of pointers. 35d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn explicit Pkcs11KeyStore(chaps::TokenManagerClient* token_manager); 36d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn ~Pkcs11KeyStore() override; 37d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 38d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // KeyStore interface. 39d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn bool Read(const std::string& username, 40d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& key_name, 41d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn std::string* key_data) override; 42d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn bool Write(const std::string& username, 43d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& key_name, 44d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& key_data) override; 45d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn bool Delete(const std::string& username, 46d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& key_name) override; 47d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn bool DeleteByPrefix(const std::string& username, 48d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& key_prefix) override; 49d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn bool Register(const std::string& username, 50d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& label, 51594849c7cf872d055575277b930f4f596bef1988Darren Krahn KeyType key_type, 52594849c7cf872d055575277b930f4f596bef1988Darren Krahn KeyUsage key_usage, 53d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& private_key_blob, 54d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& public_key_der, 55d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& certificate) override; 56d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn bool RegisterCertificate(const std::string& username, 57d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& certificate) override; 58d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 59d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn private: 60d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn using EnumObjectsCallback = 61d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn base::Callback<bool(const std::string& key_name, 62d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn CK_OBJECT_HANDLE object_handle)>; 63d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 64d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // Searches for a PKCS #11 object for a given key name. If one exists, the 65d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // object handle is returned, otherwise CK_INVALID_HANDLE is returned. 66d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn CK_OBJECT_HANDLE FindObject(CK_SESSION_HANDLE session_handle, 67d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& key_name); 68d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 69d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // Gets a slot for the given |username| if |is_user_specific| or the system 70d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // slot otherwise. Returns false if no appropriate slot is found. 71d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn bool GetUserSlot(const std::string& username, 72d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn CK_SLOT_ID_PTR slot); 73d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 74d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // Enumerates all PKCS #11 objects associated with keys. The |callback| is 75d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // called once for each object. 76d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn bool EnumObjects(CK_SESSION_HANDLE session_handle, 77d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const EnumObjectsCallback& callback); 78d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 79d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // Looks up the key name for the given |object_handle| which is associated 80d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // with a key. Returns true on success. 81d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn bool GetKeyName(CK_SESSION_HANDLE session_handle, 82d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn CK_OBJECT_HANDLE object_handle, 83d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn std::string* key_name); 84d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 85d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // An EnumObjectsCallback for use with DeleteByPrefix. Destroys the key 86d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // object identified by |object_handle| if |key_name| matches |key_prefix|. 87d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // Returns true on success. 88d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn bool DeleteIfMatchesPrefix(CK_SESSION_HANDLE session_handle, 89d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& key_prefix, 90d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& key_name, 91d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn CK_OBJECT_HANDLE object_handle); 92d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 93594849c7cf872d055575277b930f4f596bef1988Darren Krahn // Extracts the |subject|, |issuer|, and |serial_number| information from an 94594849c7cf872d055575277b930f4f596bef1988Darren Krahn // X.509 |certificate|. Returns false if the value cannot be determined. 95594849c7cf872d055575277b930f4f596bef1988Darren Krahn bool GetCertificateFields(const std::string& certificate, 96594849c7cf872d055575277b930f4f596bef1988Darren Krahn std::string* subject, 97594849c7cf872d055575277b930f4f596bef1988Darren Krahn std::string* issuer, 98594849c7cf872d055575277b930f4f596bef1988Darren Krahn std::string* serial_number); 99d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 100d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn // Returns true iff the given certificate already exists in the token. 101d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn bool DoesCertificateExist(CK_SESSION_HANDLE session_handle, 102d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn const std::string& certificate); 103d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 104d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn chaps::TokenManagerClient* token_manager_; 105d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 106d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn DISALLOW_COPY_AND_ASSIGN(Pkcs11KeyStore); 107d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn}; 108d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 109d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn} // namespace attestation 110d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn 111d7ae21ca48a717fec15836b62701da26d9ec519dDarren Krahn#endif // ATTESTATION_SERVER_PKCS11_KEY_STORE_H_ 112