src/include/k5-int-pkinit.h

   1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
   2 /*
   3  * COPYRIGHT (C) 2006
   4  * THE REGENTS OF THE UNIVERSITY OF MICHIGAN
   5  * ALL RIGHTS RESERVED
   6  *
   7  * Permission is granted to use, copy, create derivative works
   8  * and redistribute this software and such derivative works
   9  * for any purpose, so long as the name of The University of
  10  * Michigan is not used in any advertising or publicity
  11  * pertaining to the use of distribution of this software
  12  * without specific, written prior authorization.  If the
  13  * above copyright notice or any other identification of the
  14  * University of Michigan is included in any copy of any
  15  * portion of this software, then the disclaimer below must
  16  * also be included.
  17  *
  18  * THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION
  19  * FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY
  20  * PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF
  21  * MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING
  22  * WITHOUT LIMITATION THE IMPLIED WARRANTIES OF
  23  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
  24  * REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE
  25  * FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR
  26  * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING
  27  * OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN
  28  * IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGES.
  30  */
  31
  32 #ifndef _KRB5_INT_PKINIT_H
  33 #define _KRB5_INT_PKINIT_H
  34
  35 /*
  36  * pkinit structures
  37  */
  38
  39 /* PKAuthenticator */
  40 typedef struct _krb5_pk_authenticator {
  41     krb5_int32      cusec;  /* (0..999999) */
  42     krb5_timestamp  ctime;
  43     krb5_int32      nonce;  /* (0..4294967295) */
  44     krb5_checksum   paChecksum;
  45     krb5_data      *freshnessToken;
  46 } krb5_pk_authenticator;
  47
  48 /* PKAuthenticator draft9 */
  49 typedef struct _krb5_pk_authenticator_draft9 {
  50     krb5_principal  kdcName;
  51     krb5_int32      cusec;  /* (0..999999) */
  52     krb5_timestamp  ctime;
  53     krb5_int32      nonce;  /* (0..4294967295) */
  54 } krb5_pk_authenticator_draft9;
  55
  56 /* AlgorithmIdentifier */
  57 typedef struct _krb5_algorithm_identifier {
  58     krb5_data algorithm;      /* OID */
  59     krb5_data parameters; /* Optional */
  60 } krb5_algorithm_identifier;
  61
  62 /* SubjectPublicKeyInfo */
  63 typedef struct _krb5_subject_pk_info {
  64     krb5_algorithm_identifier   algorithm;
  65     krb5_data                   subjectPublicKey; /* BIT STRING */
  66 } krb5_subject_pk_info;
  67
  68 /** AuthPack from RFC 4556*/
  69 typedef struct _krb5_auth_pack {
  70     krb5_pk_authenticator       pkAuthenticator;
  71     krb5_subject_pk_info        *clientPublicValue; /* Optional */
  72     krb5_algorithm_identifier   **supportedCMSTypes; /* Optional */
  73     krb5_data                   clientDHNonce; /* Optional */
  74     krb5_data                   **supportedKDFs; /* OIDs of KDFs; OPTIONAL */
  75 } krb5_auth_pack;
  76
  77 /* AuthPack draft9 */
  78 typedef struct _krb5_auth_pack_draft9 {
  79     krb5_pk_authenticator_draft9 pkAuthenticator;
  80     krb5_subject_pk_info        *clientPublicValue; /* Optional */
  81 } krb5_auth_pack_draft9;
  82
  83 /* ExternalPrincipalIdentifier */
  84 typedef struct _krb5_external_principal_identifier {
  85     krb5_data subjectName; /* Optional */
  86     krb5_data issuerAndSerialNumber; /* Optional */
  87     krb5_data subjectKeyIdentifier; /* Optional */
  88 } krb5_external_principal_identifier;
  89
  90 /* PA-PK-AS-REQ (Draft 9 -- PA TYPE 14) */
  91 /* This has four fields, but we only care about the first and third for
  92  * encoding, and the only about the first for decoding. */
  93 typedef struct _krb5_pa_pk_as_req_draft9 {
  94     krb5_data signedAuthPack;
  95     krb5_data kdcCert; /* Optional */
  96 } krb5_pa_pk_as_req_draft9;
  97
  98 /* PA-PK-AS-REQ (rfc4556 -- PA TYPE 16) */
  99 typedef struct _krb5_pa_pk_as_req {
 100     krb5_data signedAuthPack;
 101     krb5_external_principal_identifier **trustedCertifiers; /* Optional array */
 102     krb5_data kdcPkId; /* Optional */
 103 } krb5_pa_pk_as_req;
 104
 105 /** Pkinit DHRepInfo */
 106 typedef struct _krb5_dh_rep_info {
 107     krb5_data dhSignedData;
 108     krb5_data serverDHNonce; /* Optional */
 109     krb5_data *kdfID; /* OID of selected KDF OPTIONAL */
 110 } krb5_dh_rep_info;
 111
 112 /* KDCDHKeyInfo */
 113 typedef struct _krb5_kdc_dh_key_info {
 114     krb5_data       subjectPublicKey; /* BIT STRING */
 115     krb5_int32      nonce;  /* (0..4294967295) */
 116     krb5_timestamp  dhKeyExpiration; /* Optional */
 117 } krb5_kdc_dh_key_info;
 118
 119 /* KDCDHKeyInfo draft9*/
 120 typedef struct _krb5_kdc_dh_key_info_draft9 {
 121     krb5_data       subjectPublicKey; /* BIT STRING */
 122     krb5_int32      nonce;  /* (0..4294967295) */
 123 } krb5_kdc_dh_key_info_draft9;
 124
 125 /* ReplyKeyPack */
 126 typedef struct _krb5_reply_key_pack {
 127     krb5_keyblock   replyKey;
 128     krb5_checksum   asChecksum;
 129 } krb5_reply_key_pack;
 130
 131 /* ReplyKeyPack */
 132 typedef struct _krb5_reply_key_pack_draft9 {
 133     krb5_keyblock   replyKey;
 134     krb5_int32      nonce;
 135 } krb5_reply_key_pack_draft9;
 136
 137 /* PA-PK-AS-REP (Draft 9 -- PA TYPE 15) */
 138 typedef struct _krb5_pa_pk_as_rep_draft9 {
 139     enum krb5_pa_pk_as_rep_draft9_selection {
 140         choice_pa_pk_as_rep_draft9_UNKNOWN = -1,
 141         choice_pa_pk_as_rep_draft9_dhSignedData = 0,
 142         choice_pa_pk_as_rep_draft9_encKeyPack = 1
 143     } choice;
 144     union krb5_pa_pk_as_rep_draft9_choices {
 145         krb5_data dhSignedData;
 146         krb5_data encKeyPack;
 147     } u;
 148 } krb5_pa_pk_as_rep_draft9;
 149
 150 /* PA-PK-AS-REP (rfc4556 -- PA TYPE 17) */
 151 typedef struct _krb5_pa_pk_as_rep {
 152     enum krb5_pa_pk_as_rep_selection {
 153         choice_pa_pk_as_rep_UNKNOWN = -1,
 154         choice_pa_pk_as_rep_dhInfo = 0,
 155         choice_pa_pk_as_rep_encKeyPack = 1
 156     } choice;
 157     union krb5_pa_pk_as_rep_choices {
 158         krb5_dh_rep_info    dh_Info;
 159         krb5_data           encKeyPack;
 160     } u;
 161 } krb5_pa_pk_as_rep;
 162
 163 /* SP80056A OtherInfo, for pkinit algorithm agility */
 164 typedef struct _krb5_sp80056a_other_info {
 165     krb5_algorithm_identifier algorithm_identifier;
 166     krb5_principal  party_u_info;
 167     krb5_principal  party_v_info;
 168     krb5_data supp_pub_info;
 169 } krb5_sp80056a_other_info;
 170
 171 /* PkinitSuppPubInfo, for pkinit algorithm agility */
 172 typedef struct _krb5_pkinit_supp_pub_info {
 173     krb5_enctype      enctype;
 174     krb5_data         as_req;
 175     krb5_data         pk_as_rep;
 176 } krb5_pkinit_supp_pub_info;
 177
 178 /*
 179  * Begin "asn1.h"
 180  */
 181
 182 /*************************************************************************
 183  * Prototypes for pkinit asn.1 encode routines
 184  *************************************************************************/
 185
 186 krb5_error_code
 187 encode_krb5_pa_pk_as_req(const krb5_pa_pk_as_req *rep, krb5_data **code);
 188
 189 krb5_error_code
 190 encode_krb5_pa_pk_as_req_draft9(const krb5_pa_pk_as_req_draft9 *rep,
 191                                 krb5_data **code);
 192
 193 krb5_error_code
 194 encode_krb5_pa_pk_as_rep(const krb5_pa_pk_as_rep *rep, krb5_data **code);
 195
 196 krb5_error_code
 197 encode_krb5_pa_pk_as_rep_draft9(const krb5_pa_pk_as_rep_draft9 *rep,
 198                                 krb5_data **code);
 199
 200 krb5_error_code
 201 encode_krb5_auth_pack(const krb5_auth_pack *rep, krb5_data **code);
 202
 203 krb5_error_code
 204 encode_krb5_auth_pack_draft9(const krb5_auth_pack_draft9 *rep,
 205                              krb5_data **code);
 206
 207 krb5_error_code
 208 encode_krb5_kdc_dh_key_info(const krb5_kdc_dh_key_info *rep, krb5_data **code);
 209
 210 krb5_error_code
 211 encode_krb5_reply_key_pack(const krb5_reply_key_pack *, krb5_data **code);
 212
 213 krb5_error_code
 214 encode_krb5_reply_key_pack_draft9(const krb5_reply_key_pack_draft9 *,
 215                                   krb5_data **code);
 216
 217 krb5_error_code
 218 encode_krb5_td_trusted_certifiers(krb5_external_principal_identifier *const *,
 219                                   krb5_data **code);
 220
 221 krb5_error_code
 222 encode_krb5_td_dh_parameters(krb5_algorithm_identifier *const *,
 223                              krb5_data **code);
 224
 225 krb5_error_code
 226 encode_krb5_sp80056a_other_info(const krb5_sp80056a_other_info *,
 227                                 krb5_data **);
 228
 229 krb5_error_code
 230 encode_krb5_pkinit_supp_pub_info(const krb5_pkinit_supp_pub_info *,
 231                                  krb5_data **);
 232
 233 /*************************************************************************
 234  * Prototypes for pkinit asn.1 decode routines
 235  *************************************************************************/
 236
 237 krb5_error_code
 238 decode_krb5_pa_pk_as_req(const krb5_data *, krb5_pa_pk_as_req **);
 239
 240 krb5_error_code
 241 decode_krb5_pa_pk_as_req_draft9(const krb5_data *,
 242                                 krb5_pa_pk_as_req_draft9 **);
 243
 244 krb5_error_code
 245 decode_krb5_pa_pk_as_rep(const krb5_data *, krb5_pa_pk_as_rep **);
 246
 247 krb5_error_code
 248 decode_krb5_auth_pack(const krb5_data *, krb5_auth_pack **);
 249
 250 krb5_error_code
 251 decode_krb5_auth_pack_draft9(const krb5_data *, krb5_auth_pack_draft9 **);
 252
 253 krb5_error_code
 254 decode_krb5_kdc_dh_key_info(const krb5_data *, krb5_kdc_dh_key_info **);
 255
 256 krb5_error_code
 257 decode_krb5_principal_name(const krb5_data *, krb5_principal_data **);
 258
 259 krb5_error_code
 260 decode_krb5_reply_key_pack(const krb5_data *, krb5_reply_key_pack **);
 261
 262 krb5_error_code
 263 decode_krb5_reply_key_pack_draft9(const krb5_data *,
 264                                   krb5_reply_key_pack_draft9 **);
 265
 266 krb5_error_code
 267 decode_krb5_td_trusted_certifiers(const krb5_data *,
 268                                   krb5_external_principal_identifier ***);
 269
 270 krb5_error_code
 271 decode_krb5_td_dh_parameters(const krb5_data *, krb5_algorithm_identifier ***);
 272
 273 krb5_error_code
 274 encode_krb5_enc_data(const krb5_enc_data *, krb5_data **);
 275
 276 krb5_error_code
 277 encode_krb5_encryption_key(const krb5_keyblock *rep, krb5_data **code);
 278
 279 krb5_error_code
 280 krb5_encrypt_helper(krb5_context context, const krb5_keyblock *key,
 281                     krb5_keyusage keyusage, const krb5_data *plain,
 282                     krb5_enc_data *cipher);
 283
 284 #endif /* _KRB5_INT_PKINIT_H */