9 CIPHER_NONE, //e.g. no cipher based digests
12 CIPHER_DESX, //only CBC blockmode
18 CIPHER_SKIPJACK,//unsafe
21 CIPHER_RSA, //RSA cert - md5+sha1 is signed
22 CIPHER_DSA, //DSA cert - sha1 is signed
23 CIPHER_KEA, //key pair generation, TEK derivation (Token Encryption Key)
24 CIPHER_DH, //key pair generation, TEK derivation
25 CIPHER_EC, //eliptic curve
26 CIPHER_ECDH, //eliptic curve
31 BLOCKMODE_EBC, // Electronic Codeblock, unsafe
32 BLOCKMODE_CBC, // Cipher Block Chaining
33 BLOCKMODE_CFB, // Cipher Feedback
34 BLOCKMODE_OFB, // Output Feedback
35 BLOCKMODE_CTR, // Counter (DES,AES) [RFC 3686]
36 BLOCKMODE_GCM, // Galois Counter Mode (AES)
37 BLOCKMODE_OCB, // Offest Codebook Mode (AES)
38 BLOCKMODE_CCM, // CBC-MAC Mode (AES)
42 DIGEST_MD5, /**< Message digest algorithm MD5 */
43 DIGEST_SHA1, /**< Message digest algorithm SHA1 */
44 DIGEST_SHA224, /**< Message digest algorithm SHA2, 224bit */
45 DIGEST_SHA256, /**< Message digest algorithm SHA2, 256bit */
46 DIGEST_SHA384, /**< Message digest algorithm SHA2, 384bit */
47 DIGEST_SHA512 /**< Message digest algorithm SHA2, 512bit */
51 PADDING_NONE, // total number of data MUST multiple of block size
52 PADDING_ZEROS, // pad with zores
55 PADDING_ANSIX931, // same as zero padding ?
56 PADDING_PKCS1, // RSA signature creation
57 PADDING_PKCS7, // Byte padding for symetric algos (RFC 5652), (PKCS5 padding is the same)
61 KEYFORMAT_RAW, // key is clear from
62 KEYFORMAT_BASE64, // key is encoded in ASCII-base64
63 KEYFORMAT_PEM, // key is in PEM file format
64 KEYFORMAT_DER, // key is in DER file format
71 PARAM_IV, // Initial Vector
75 PARAM_CTR_CNT, // CTR Counter bits
76 PARAM_GCM_TAG, // GCM Tag bits
77 PARAM_GCM_ADD, // GCM Additional Authentication Data
78 PARAM_CCM_NONCE,// Nonce
79 PARAM_CCM_ADD, // Additional Authentication Data
80 PARAM_CCM_MAC, // MAC length in bytes
88 //internal key info struct
89 typedef struct __crypt_key_info crypt_key_h;
91 // cryptograohic module initialization (crypt_module_init must be first func)
92 int crypt_module_init();
93 int crypt_module_exit();
96 int crypt_init(crypt_key_h**, cipher_t);
97 int crypt_destroy(crypt_key_h *);
99 //*******************************************
100 // various parameters, depends on used cipher
101 //*******************************************
103 // optional parameters (research needed for what we need)
104 // note: internally it is stored as list of tag,length,value (TLV)
105 int crypt_setparam(crypt_key_h *, param_t p, const void *v, size_t len);
106 int crypt_getparam(crypt_key_h *, param_t p, void *v, size_t len);
107 //param_t : key, iv, padding method, block mode ….
109 // set of functions for known parameters
110 int crypt_setparam_digest_algo(crypt_key_h *, const digest_algo_t algo);
111 int crypt_setparam_iv(crypt_key_h *, const void *iv, size_t len);
112 int crypt_setparam_padding(crypt_key_h *, padding_t v);
113 int crypt_setparam_blockmode(crypt_key_h *, blockmode_t v);
114 // Note: GCM concat message len, message, and ADD (3 update calls)
115 // (https://wiki.openssl.org/index.php/EVP_Authenticated_Encryption_and_Decryption)
116 int crypt_setparam_gcm_tag(crypt_key_h *, const void *tag, size_t len);
117 int crypt_setparam_gcm_aad(crypt_key_h *, const void *add, size_t len);
119 int crypt_getparam_iv(crypt_key_h *, void *iv, size_t *len);
120 int crypt_getparam_gcm_tag(crypt_key_h *, void *tag, size_t len);
122 //*******************************************
123 // top level (simple) interface
124 //*******************************************
126 int crypt_import_key(crypt_key_h *key, keyformat_t format, void *blob, size_t size);
127 int crypt_export_key(crypt_key_h *key, keyformat_t format, void *blob, size_t size);
129 // possible static predefined digests contexts like SHA1,SHA224,SHA256
130 // digests (no key, default iv=<zeros>)
131 int crypt_digest_calc(const digest_algo_t algo, const void *data, size_t len, void **digest, size_t *digest_len);
133 // encryptions (key is mandatory, default iv=<zeros>), symmetric or asymetric
134 int crypt_encrypt(crypt_key_h *key, const void *data, size_t len, void **enc_data, size_t * enc_len);
135 int crypt_decrypt(crypt_key_h *key, const void *enc_data, size_t enc_len, void **data, size_t * len);
137 // message authentication (key is mandatory, padding method, default iv=<zeros>)
138 // note: this is, in fact, the same as diggest with key set up
139 int crypt_sign_verify(crypt_key_h *key, const void *data, size_t len, const void *mac, size_t mac_len);
140 int crypt_sign_calc(crypt_key_h *key, const void *data, size_t len, void **mac, size_t mac_len);
142 // deallocete memory allocated by crypto library
143 int crypto_free(void *buf);
145 // seal creates symkey (with set param iv, ivlen)
146 int crypt_seal(crypt_key_h *pubkey, crypt_key_h *symkey, const void *data, size_t len, void **enc_data, size_t *enc_len);
147 // open uses symkey taken from seal
148 int crypt_open(crypt_key_h *prvkey, crypt_key_h *symkey, const void *enc_data, size_t enc_len, void **data, size_t *len);
151 //*******************************************
152 // low level (advanced) interface
153 //*******************************************
155 //key material generation (depends on context cipher)
156 // key - store generated key bytes
158 // read byte sequence from /dev/urandom, until got not trivial key
159 int crypt_generate_key(crypt_key_h *key, size_t key_len);
160 // keypub = (n,e) keyprv = (n,d)
161 // where n is modulus, e is public key exponents, d is private key exponent
162 int crypt_generate_pkey(crypt_key_h *pub, crypt_key_h *priv, size_t key_len);
164 int crypt_digest_update(crypt_key_h *dig, const void *data, size_t len);
165 int crypt_digest_final(crypt_key_h *dig, void **digest, size_t *digest_len);
167 int crypt_encrypt_update(crypt_key_h *key, const void *indata, size_t inlen, void **outdata, size_t *outlen);
168 int crypt_encrypt_final(crypt_key_h *key, void **outdata, size_t *outlen);
170 int crypt_decrypt_update(crypt_key_h *key, const void *indata, size_t inlen, void **outdata, size_t *outlen);
171 int crypt_decrypt_final(crypt_key_h *key, void **outdata, size_t *outlen);
173 int crypt_sign_init(crypt_key_h *key, sign_dir_t);
174 int crypt_sign_update(crypt_key_h *key, const void *data, size_t len);
175 int crypt_sign_final(crypt_key_h *key, void **mac, size_t *mac_len);
177 int crypt_derive_key(crypt_key_h *dk, crypt_key_h *key);
179 int crypt_derive_pkey(crypt_key_h *dk, crypt_key_h *key);