1 /* 2 * Copyright 2015 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef SYSTEM_KEYMASTER_KEYMASTER0_ENGINE_H_ 18 #define SYSTEM_KEYMASTER_KEYMASTER0_ENGINE_H_ 19 20 #include <memory> 21 22 #include <openssl/ec.h> 23 #include <openssl/engine.h> 24 #include <openssl/ex_data.h> 25 #include <openssl/rsa.h> 26 27 #include <hardware/keymaster0.h> 28 #include <hardware/keymaster_defs.h> 29 30 namespace keymaster { 31 32 struct KeymasterKeyBlob; 33 34 /* Keymaster0Engine is a BoringSSL ENGINE that implements RSA & EC by forwarding the requested 35 * operations to a keymaster0 module. */ 36 class Keymaster0Engine { 37 public: 38 /** 39 * Create a Keymaster0Engine, wrapping the provided keymaster0_device. The engine takes 40 * ownership of the device, and will close it during destruction. 41 */ 42 explicit Keymaster0Engine(const keymaster0_device_t* keymaster0_device); 43 ~Keymaster0Engine(); 44 45 bool supports_ec() const { return supports_ec_; } 46 47 bool GenerateRsaKey(uint64_t public_exponent, uint32_t public_modulus, 48 KeymasterKeyBlob* key_material) const; 49 bool GenerateEcKey(uint32_t key_size, KeymasterKeyBlob* key_material) const; 50 51 bool ImportKey(keymaster_key_format_t key_format, const KeymasterKeyBlob& to_import, 52 KeymasterKeyBlob* imported_key_material) const; 53 bool DeleteKey(const KeymasterKeyBlob& blob) const; 54 bool DeleteAllKeys() const; 55 56 RSA* BlobToRsaKey(const KeymasterKeyBlob& blob) const; 57 EC_KEY* BlobToEcKey(const KeymasterKeyBlob& blob) const; 58 59 const keymaster_key_blob_t* RsaKeyToBlob(const RSA* rsa) const; 60 const keymaster_key_blob_t* EcKeyToBlob(const EC_KEY* rsa) const; 61 62 const keymaster0_device_t* device() { return keymaster0_device_; } 63 64 EVP_PKEY* GetKeymaster0PublicKey(const KeymasterKeyBlob& blob) const; 65 66 private: 67 Keymaster0Engine(const Keymaster0Engine&); // Uncopyable 68 void operator=(const Keymaster0Engine&); // Unassignable 69 70 static int keyblob_dup(CRYPTO_EX_DATA* to, const CRYPTO_EX_DATA* from, void** from_d, int index, 71 long argl, void* argp); 72 static void keyblob_free(void* parent, void* ptr, CRYPTO_EX_DATA* data, int index, long argl, 73 void* argp); 74 static int rsa_private_transform(RSA* rsa, uint8_t* out, const uint8_t* in, size_t len); 75 static int ecdsa_sign(const uint8_t* digest, size_t digest_len, uint8_t* sig, 76 unsigned int* sig_len, EC_KEY* ec_key); 77 78 struct Malloc_Delete { 79 void operator()(void* p) { free(p); } 80 }; 81 82 bool Keymaster0Sign(const void* signing_params, const keymaster_key_blob_t& key_blob, 83 const uint8_t* data, const size_t data_length, 84 std::unique_ptr<uint8_t[], Malloc_Delete>* signature, 85 size_t* signature_length) const; 86 87 int RsaPrivateTransform(RSA* rsa, uint8_t* out, const uint8_t* in, size_t len) const; 88 int EcdsaSign(const uint8_t* digest, size_t digest_len, uint8_t* sig, unsigned int* sig_len, 89 EC_KEY* ec_key) const; 90 91 const keymaster0_device_t* keymaster0_device_; 92 ENGINE* const engine_; 93 int rsa_index_, ec_key_index_; 94 bool supports_ec_; 95 RSA_METHOD rsa_method_; 96 ECDSA_METHOD ecdsa_method_; 97 98 static Keymaster0Engine* instance_; 99 }; 100 101 } // namespace keymaster 102 103 #endif // SYSTEM_KEYMASTER_KEYMASTER0_ENGINE_H_ 104
