src/include/k5-int-pkinit.h

   1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
   2 /*
   3  * COPYRIGHT (C) 2006
   4  * THE REGENTS OF THE UNIVERSITY OF MICHIGAN
   5  * ALL RIGHTS RESERVED
   6  *
   7  * Permission is granted to use, copy, create derivative works
   8  * and redistribute this software and such derivative works
   9  * for any purpose, so long as the name of The University of
  10  * Michigan is not used in any advertising or publicity
  11  * pertaining to the use of distribution of this software
  12  * without specific, written prior authorization.  If the
  13  * above copyright notice or any other identification of the
  14  * University of Michigan is included in any copy of any
  15  * portion of this software, then the disclaimer below must
  16  * also be included.
  17  *
  18  * THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION
  19  * FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY
  20  * PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF
  21  * MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING
  22  * WITHOUT LIMITATION THE IMPLIED WARRANTIES OF
  23  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
  24  * REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE
  25  * FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR
  26  * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING
  27  * OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN
  28  * IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGES.
  30  */
  31
  32 #ifndef _KRB5_INT_PKINIT_H
  33 #define _KRB5_INT_PKINIT_H
  34
  35 /*
  36  * pkinit structures
  37  */
  38
  39 /* PKAuthenticator */
  40 typedef struct _krb5_pk_authenticator {
  41     krb5_int32      cusec;  /* (0..999999) */
  42     krb5_timestamp  ctime;
  43     krb5_int32      nonce;  /* (0..4294967295) */
  44     krb5_checksum   paChecksum;
  45 } krb5_pk_authenticator;
  46
  47 /* PKAuthenticator draft9 */
  48 typedef struct _krb5_pk_authenticator_draft9 {
  49     krb5_principal  kdcName;
  50     krb5_int32      cusec;  /* (0..999999) */
  51     krb5_timestamp  ctime;
  52     krb5_int32      nonce;  /* (0..4294967295) */
  53 } krb5_pk_authenticator_draft9;
  54
  55 /* AlgorithmIdentifier */
  56 typedef struct _krb5_algorithm_identifier {
  57     krb5_data algorithm;      /* OID */
  58     krb5_data parameters; /* Optional */
  59 } krb5_algorithm_identifier;
  60
  61 /* SubjectPublicKeyInfo */
  62 typedef struct _krb5_subject_pk_info {
  63     krb5_algorithm_identifier   algorithm;
  64     krb5_data                   subjectPublicKey; /* BIT STRING */
  65 } krb5_subject_pk_info;
  66
  67 /** AuthPack from RFC 4556*/
  68 typedef struct _krb5_auth_pack {
  69     krb5_pk_authenticator       pkAuthenticator;
  70     krb5_subject_pk_info        *clientPublicValue; /* Optional */
  71     krb5_algorithm_identifier   **supportedCMSTypes; /* Optional */
  72     krb5_data                   clientDHNonce; /* Optional */
  73     krb5_data                   **supportedKDFs; /* OIDs of KDFs; OPTIONAL */
  74 } krb5_auth_pack;
  75
  76 /* AuthPack draft9 */
  77 typedef struct _krb5_auth_pack_draft9 {
  78     krb5_pk_authenticator_draft9 pkAuthenticator;
  79     krb5_subject_pk_info        *clientPublicValue; /* Optional */
  80 } krb5_auth_pack_draft9;
  81
  82 /* ExternalPrincipalIdentifier */
  83 typedef struct _krb5_external_principal_identifier {
  84     krb5_data subjectName; /* Optional */
  85     krb5_data issuerAndSerialNumber; /* Optional */
  86     krb5_data subjectKeyIdentifier; /* Optional */
  87 } krb5_external_principal_identifier;
  88
  89 /* TrustedCas */
  90 typedef struct _krb5_trusted_ca {
  91     enum krb5_trusted_ca_selection {
  92         choice_trusted_cas_UNKNOWN = -1,
  93         choice_trusted_cas_principalName = 0,
  94         choice_trusted_cas_caName = 1,
  95         choice_trusted_cas_issuerAndSerial = 2
  96     } choice;
  97     union krb5_trusted_ca_choices {
  98         krb5_principal  principalName;
  99         krb5_data caName; /* fully-qualified X.500 "Name" as defined by X.509 (der-encoded) */
 100         krb5_data issuerAndSerial; /* Optional -- IssuerAndSerialNumber (der-encoded) */
 101     } u;
 102 } krb5_trusted_ca;
 103
 104 /* PA-PK-AS-REQ (Draft 9 -- PA TYPE 14) */
 105 typedef struct _krb5_pa_pk_as_req_draft9 {
 106     krb5_data signedAuthPack;
 107     krb5_trusted_ca **trustedCertifiers; /* Optional array */
 108     krb5_data kdcCert; /* Optional */
 109     krb5_data encryptionCert;
 110 } krb5_pa_pk_as_req_draft9;
 111
 112 /* PA-PK-AS-REQ (rfc4556 -- PA TYPE 16) */
 113 typedef struct _krb5_pa_pk_as_req {
 114     krb5_data signedAuthPack;
 115     krb5_external_principal_identifier **trustedCertifiers; /* Optional array */
 116     krb5_data kdcPkId; /* Optional */
 117 } krb5_pa_pk_as_req;
 118
 119 /** Pkinit DHRepInfo */
 120 typedef struct _krb5_dh_rep_info {
 121     krb5_data dhSignedData;
 122     krb5_data serverDHNonce; /* Optional */
 123     krb5_data *kdfID; /* OID of selected KDF OPTIONAL */
 124 } krb5_dh_rep_info;
 125
 126 /* KDCDHKeyInfo */
 127 typedef struct _krb5_kdc_dh_key_info {
 128     krb5_data       subjectPublicKey; /* BIT STRING */
 129     krb5_int32      nonce;  /* (0..4294967295) */
 130     krb5_timestamp  dhKeyExpiration; /* Optional */
 131 } krb5_kdc_dh_key_info;
 132
 133 /* KDCDHKeyInfo draft9*/
 134 typedef struct _krb5_kdc_dh_key_info_draft9 {
 135     krb5_data       subjectPublicKey; /* BIT STRING */
 136     krb5_int32      nonce;  /* (0..4294967295) */
 137 } krb5_kdc_dh_key_info_draft9;
 138
 139 /* ReplyKeyPack */
 140 typedef struct _krb5_reply_key_pack {
 141     krb5_keyblock   replyKey;
 142     krb5_checksum   asChecksum;
 143 } krb5_reply_key_pack;
 144
 145 /* ReplyKeyPack */
 146 typedef struct _krb5_reply_key_pack_draft9 {
 147     krb5_keyblock   replyKey;
 148     krb5_int32      nonce;
 149 } krb5_reply_key_pack_draft9;
 150
 151 /* PA-PK-AS-REP (Draft 9 -- PA TYPE 15) */
 152 typedef struct _krb5_pa_pk_as_rep_draft9 {
 153     enum krb5_pa_pk_as_rep_draft9_selection {
 154         choice_pa_pk_as_rep_draft9_UNKNOWN = -1,
 155         choice_pa_pk_as_rep_draft9_dhSignedData = 0,
 156         choice_pa_pk_as_rep_draft9_encKeyPack = 1
 157     } choice;
 158     union krb5_pa_pk_as_rep_draft9_choices {
 159         krb5_data dhSignedData;
 160         krb5_data encKeyPack;
 161     } u;
 162 } krb5_pa_pk_as_rep_draft9;
 163
 164 /* PA-PK-AS-REP (rfc4556 -- PA TYPE 17) */
 165 typedef struct _krb5_pa_pk_as_rep {
 166     enum krb5_pa_pk_as_rep_selection {
 167         choice_pa_pk_as_rep_UNKNOWN = -1,
 168         choice_pa_pk_as_rep_dhInfo = 0,
 169         choice_pa_pk_as_rep_encKeyPack = 1
 170     } choice;
 171     union krb5_pa_pk_as_rep_choices {
 172         krb5_dh_rep_info    dh_Info;
 173         krb5_data           encKeyPack;
 174     } u;
 175 } krb5_pa_pk_as_rep;
 176
 177 /* SP80056A OtherInfo, for pkinit algorithm agility */
 178 typedef struct _krb5_sp80056a_other_info {
 179     krb5_algorithm_identifier algorithm_identifier;
 180     krb5_principal  party_u_info;
 181     krb5_principal  party_v_info;
 182     krb5_data supp_pub_info;
 183 } krb5_sp80056a_other_info;
 184
 185 /* PkinitSuppPubInfo, for pkinit algorithm agility */
 186 typedef struct _krb5_pkinit_supp_pub_info {
 187     krb5_enctype      enctype;
 188     krb5_data         as_req;
 189     krb5_data         pk_as_rep;
 190 } krb5_pkinit_supp_pub_info;
 191
 192 /*
 193  * Begin "asn1.h"
 194  */
 195
 196 /*************************************************************************
 197  * Prototypes for pkinit asn.1 encode routines
 198  *************************************************************************/
 199
 200 krb5_error_code
 201 encode_krb5_pa_pk_as_req(const krb5_pa_pk_as_req *rep, krb5_data **code);
 202
 203 krb5_error_code
 204 encode_krb5_pa_pk_as_req_draft9(const krb5_pa_pk_as_req_draft9 *rep,
 205                                 krb5_data **code);
 206
 207 krb5_error_code
 208 encode_krb5_pa_pk_as_rep(const krb5_pa_pk_as_rep *rep, krb5_data **code);
 209
 210 krb5_error_code
 211 encode_krb5_pa_pk_as_rep_draft9(const krb5_pa_pk_as_rep_draft9 *rep,
 212                                 krb5_data **code);
 213
 214 krb5_error_code
 215 encode_krb5_auth_pack(const krb5_auth_pack *rep, krb5_data **code);
 216
 217 krb5_error_code
 218 encode_krb5_auth_pack_draft9(const krb5_auth_pack_draft9 *rep,
 219                              krb5_data **code);
 220
 221 krb5_error_code
 222 encode_krb5_kdc_dh_key_info(const krb5_kdc_dh_key_info *rep, krb5_data **code);
 223
 224 krb5_error_code
 225 encode_krb5_reply_key_pack(const krb5_reply_key_pack *, krb5_data **code);
 226
 227 krb5_error_code
 228 encode_krb5_reply_key_pack_draft9(const krb5_reply_key_pack_draft9 *,
 229                                   krb5_data **code);
 230
 231 krb5_error_code
 232 encode_krb5_td_trusted_certifiers(krb5_external_principal_identifier *const *,
 233                                   krb5_data **code);
 234
 235 krb5_error_code
 236 encode_krb5_td_dh_parameters(krb5_algorithm_identifier *const *,
 237                              krb5_data **code);
 238
 239 krb5_error_code
 240 encode_krb5_sp80056a_other_info(const krb5_sp80056a_other_info *,
 241                                 krb5_data **);
 242
 243 krb5_error_code
 244 encode_krb5_pkinit_supp_pub_info(const krb5_pkinit_supp_pub_info *,
 245                                  krb5_data **);
 246
 247 /*************************************************************************
 248  * Prototypes for pkinit asn.1 decode routines
 249  *************************************************************************/
 250
 251 krb5_error_code
 252 decode_krb5_pa_pk_as_req(const krb5_data *, krb5_pa_pk_as_req **);
 253
 254 krb5_error_code
 255 decode_krb5_pa_pk_as_req_draft9(const krb5_data *,
 256                                 krb5_pa_pk_as_req_draft9 **);
 257
 258 krb5_error_code
 259 decode_krb5_pa_pk_as_rep(const krb5_data *, krb5_pa_pk_as_rep **);
 260
 261 krb5_error_code
 262 decode_krb5_pa_pk_as_rep_draft9(const krb5_data *,
 263                                 krb5_pa_pk_as_rep_draft9 **);
 264
 265 krb5_error_code
 266 decode_krb5_auth_pack(const krb5_data *, krb5_auth_pack **);
 267
 268 krb5_error_code
 269 decode_krb5_auth_pack_draft9(const krb5_data *, krb5_auth_pack_draft9 **);
 270
 271 krb5_error_code
 272 decode_krb5_kdc_dh_key_info(const krb5_data *, krb5_kdc_dh_key_info **);
 273
 274 krb5_error_code
 275 decode_krb5_principal_name(const krb5_data *, krb5_principal_data **);
 276
 277 krb5_error_code
 278 decode_krb5_reply_key_pack(const krb5_data *, krb5_reply_key_pack **);
 279
 280 krb5_error_code
 281 decode_krb5_reply_key_pack_draft9(const krb5_data *,
 282                                   krb5_reply_key_pack_draft9 **);
 283
 284 krb5_error_code
 285 decode_krb5_td_trusted_certifiers(const krb5_data *,
 286                                   krb5_external_principal_identifier ***);
 287
 288 krb5_error_code
 289 decode_krb5_td_dh_parameters(const krb5_data *, krb5_algorithm_identifier ***);
 290
 291 krb5_error_code
 292 encode_krb5_enc_data(const krb5_enc_data *, krb5_data **);
 293
 294 krb5_error_code
 295 encode_krb5_encryption_key(const krb5_keyblock *rep, krb5_data **code);
 296
 297 krb5_error_code
 298 krb5_encrypt_helper(krb5_context context, const krb5_keyblock *key,
 299                     krb5_keyusage keyusage, const krb5_data *plain,
 300                     krb5_enc_data *cipher);
 301
 302 #endif /* _KRB5_INT_PKINIT_H */