2 * Copyright (c) 2000 - 2019 Samsung Electronics Co., Ltd All Rights Reserved
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License
18 * @author Bartlomiej Grzelewski (b.grzelewski@samsung.com)
20 * @brief Main header file for client library.
27 #include <ckm/ckm-certificate.h>
28 #include <ckm/ckm-error.h>
29 #include <ckm/ckm-key.h>
30 #include <ckm/ckm-pkcs12.h>
31 #include <ckm/ckm-type.h>
33 // Central Key Manager namespace
37 typedef std::shared_ptr<Manager> ManagerShPtr;
39 class KEY_MANAGER_API Manager {
44 Manager(const Manager &) = delete;
45 Manager &operator=(const Manager &) = delete;
49 int saveKey(const Alias &alias, const KeyShPtr &key, const Policy &policy);
50 int saveCertificate(const Alias &alias, const CertificateShPtr &cert,
51 const Policy &policy);
54 const PKCS12ShPtr &pkcs,
55 const Policy &keyPolicy,
56 const Policy &certPolicy);
59 * Data must be extractable. If you set extractable bit to false function will
60 * return ERROR_INPUT_PARAM.
62 int saveData(const Alias &alias, const RawBuffer &data, const Policy &policy);
64 int removeAlias(const Alias &alias);
66 int getKey(const Alias &alias, const Password &password, KeyShPtr &key);
69 const Password &password,
70 CertificateShPtr &certificate);
71 int getData(const Alias &alias, const Password &password, RawBuffer &data);
72 int getPKCS12(const Alias &alias, PKCS12ShPtr &pkcs);
75 const Password &keyPass,
76 const Password &certPass,
79 // send request for list of all keys/certificates/data that application/user may use
80 int getKeyAliasVector(AliasVector &aliasVector);
81 int getKeyAliasPwdVector(AliasPwdVector &aliasPwdVector);
82 int getKeyEncryptionStatus(const Alias &alias, bool &status);
83 int getCertificateAliasVector(AliasVector &aliasVector);
84 int getCertificateAliasPwdVector(AliasPwdVector &aliasPwdVector);
85 int getCertificateEncryptionStatus(const Alias &alias, bool &status);
86 int getDataAliasVector(AliasVector &aliasVector);
87 int getDataAliasPwdVector(AliasPwdVector &aliasPwdVector);
88 int getDataEncryptionStatus(const Alias &alias, bool &status);
91 const int size, // size in bits [1024, 2048, 4096]
92 const Alias &privateKeyAlias,
93 const Alias &publicKeyAlias,
94 const Policy &policyPrivateKey = Policy(),
95 const Policy &policyPublicKey = Policy());
98 const int size, // size in bits [1024, 2048, 3072, 4096]
99 const Alias &privateKeyAlias,
100 const Alias &publicKeyAlias,
101 const Policy &policyPrivateKey = Policy(),
102 const Policy &policyPublicKey = Policy());
104 int createKeyPairECDSA(
105 const ElipticCurve type,
106 const Alias &privateKeyAlias,
107 const Alias &publicKeyAlias,
108 const Policy &policyPrivateKey = Policy(),
109 const Policy &policyPublicKey = Policy());
112 const int size, // size in bits [128, 192, 256]
113 const Alias &keyAlias,
114 const Policy &policyKey = Policy());
116 int getCertificateChain(
117 const CertificateShPtr &certificate,
118 const CertificateShPtrVector &untrustedCertificates,
119 const CertificateShPtrVector &trustedCertificates,
120 bool useTrustedSystemCertificates,
121 CertificateShPtrVector &certificateChainVector);
123 int getCertificateChain(
124 const CertificateShPtr &certificate,
125 const AliasVector &untrustedCertificates,
126 const AliasVector &trustedCertificates,
127 bool useTrustedSystemCertificates,
128 CertificateShPtrVector &certificateChainVector);
131 const Alias &privateKeyAlias,
132 const Password &password, // password for private_key
133 const RawBuffer &message,
134 const HashAlgorithm hash,
135 const RSAPaddingAlgorithm padding,
136 RawBuffer &signature);
139 const Alias &publicKeyOrCertAlias,
140 const Password &password, // password for public_key (optional)
141 const RawBuffer &message,
142 const RawBuffer &signature,
143 const HashAlgorithm hash,
144 const RSAPaddingAlgorithm padding);
146 // This function will check all certificates in chain except Root CA.
147 // This function will delegate task to service. You may use this even
148 // if application does not have permission to use network.
149 int ocspCheck(const CertificateShPtrVector &certificateChainVector,
152 int setPermission(const Alias &alias, const ClientId &accessor,
153 PermissionMask permissionMask);
155 // This function will encrypt data.
156 // Since Tizen 5.0, on chosen images using TEE backend:
157 // * maximum size of data can be limited to TEE-specific value; minimum 500 kB is supported)
158 // * GCM modes with short tags (32 and 64 bits) are not supported
159 // In these cases, key-manager can return a CKM_API_ERROR_SERVER_ERROR
160 int encrypt(const CryptoAlgorithm &algo,
161 const Alias &keyAlias,
162 const Password &password,
163 const RawBuffer &plain,
164 RawBuffer &encrypted);
166 // This function will decrypt data.
167 // Since Tizen 5.0, on chosen images using TEE backend:
168 // * maximum size of data can be limited to TEE-specific value; minimum 500 kB is supported)
169 // * GCM modes with short tags (32 and 64 bits) are not supported
170 // In these cases, key-manager can return a CKM_API_ERROR_SERVER_ERROR
171 int decrypt(const CryptoAlgorithm &algo,
172 const Alias &keyAlias,
173 const Password &password,
174 const RawBuffer &encrypted,
175 RawBuffer &decrypted);
177 static ManagerShPtr create();
180 std::unique_ptr<Impl> m_impl;