add HASH_NONE and NO_PADDING algo for createSignature and verifySignature

Change-Id: I34c615ad23a32290d1bc8891290c019e0ba1630a
Signed-off-by: Dongsun Lee <ds73.lee@samsung.com>

diff --git a/src/include/ckm/ckm-type.h b/src/include/ckm/ckm-type.h
index 34956dc..17a4c39 100644 (file)
--- a/src/include/ckm/ckm-type.h
+++ b/src/include/ckm/ckm-type.h
@@ -35,7 +35,7 @@ typedef std::string Alias;
 typedef std::vector<Alias> AliasVector;
 
 enum class KeyType : int {
-    KEY_NONE,
+    KEY_NONE = 0,
     KEY_RSA_PUBLIC,
     KEY_RSA_PRIVATE,
     KEY_ECDSA_PUBLIC,
@@ -46,19 +46,19 @@ enum class KeyType : int {
 };
 
 enum class DataFormat : int {
-    FORM_DER_BASE64,
+    FORM_DER_BASE64 = 0,
     FORM_DER,
     FORM_PEM
 };
 
 enum class ElipticCurve : int {
-    prime192v1,
+    prime192v1 = 0,
     prime256v1,
     secp384r1
 };
 
 enum class CertificateFieldId : int {
-    ISSUER,
+    ISSUER = 0,
     SUBJECT
 };
 
@@ -72,25 +72,22 @@ struct Policy {
     bool extractable;   // if true key may be extracted from storage
 };
 
-// Added by Dongsun Lee
 enum class HashAlgorithm : int {
+    NONE = 0,
     SHA1,
     SHA256,
     SHA384,
     SHA512
 };
 
-// Added by Dongsun Lee
 enum class RSAPaddingAlgorithm : int {
+    NONE = 0,
     PKCS1,
-//  SSLV23, // not supported
-//  NONE, // not supported
-//  PKCS1_OAEP, // not supported
     X931
 };
 
 enum class DBCMAlgType : int {
-    NONE,
+    NONE = 0,
     AES_GCM_256,
     COUNT
 };

diff --git a/src/include/ckmc/ckmc-type.h b/src/include/ckmc/ckmc-type.h
index c459b1f..f8f59d1 100644 (file)
--- a/src/include/ckmc/ckmc-type.h
+++ b/src/include/ckmc/ckmc-type.h
@@ -77,7 +77,8 @@ typedef enum __ckmc_ec_type {
  * @since_tizen 2.3
  */
 typedef enum __ckmc_hash_algo {
-    CKMC_HASH_SHA1 = 0, /**< Hash Algorithm SHA1  */
+    CKMC_HASH_NONE = 0, /**< No Hash Algorithm  */
+    CKMC_HASH_SHA1,     /**< Hash Algorithm SHA1  */
     CKMC_HASH_SHA256,   /**< Hash Algorithm SHA256  */
     CKMC_HASH_SHA384,   /**< Hash Algorithm SHA384  */
     CKMC_HASH_SHA512    /**< Hash Algorithm SHA512  */
@@ -88,7 +89,8 @@ typedef enum __ckmc_hash_algo {
  * @since_tizen 2.3
  */
 typedef enum __ckmc_rsa_padding_algo {
-    CKMC_PKCS1_PADDING = 0, /**< PKCS#1 Padding */
+    CKMC_NONE_PADDING = 0,  /**< No Padding */
+    CKMC_PKCS1_PADDING,     /**< PKCS#1 Padding */
     CKMC_X931_PADDING       /**< X9.31 padding */
 } ckmc_rsa_padding_algo_e;
 
@@ -97,8 +99,8 @@ typedef enum __ckmc_rsa_padding_algo {
  * @since_tizen 2.3
  */
 typedef struct __ckmc_raw_buff {
-       unsigned char* data; /**< Byte array containing binary data */
-       size_t size;         /**< The size of the binary data */
+    unsigned char* data; /**< Byte array containing binary data */
+    size_t size;         /**< The size of the binary data */
 } ckmc_raw_buffer_s;
 
 /**
@@ -106,8 +108,8 @@ typedef struct __ckmc_raw_buff {
  * @since_tizen 2.3
  */
 typedef struct __ckmc_policy {
-       char* password;   /**< Byte array used to encrypt data inside CKM. If it is not null, the data(or key, or certificate) is stored encrypted with this password inside key manager */
-       bool extractable; /**< If true key may be extracted from storage */
+    char* password;   /**< Byte array used to encrypt data inside CKM. If it is not null, the data(or key, or certificate) is stored encrypted with this password inside key manager */
+    bool extractable; /**< If true key may be extracted from storage */
 } ckmc_policy_s;
 
 /**
@@ -115,10 +117,10 @@ typedef struct __ckmc_policy {
  * @since_tizen 2.3
  */
 typedef struct __ckmc_key {
-       unsigned char* raw_key;   /**< Byte array of key. raw_key may be encrypted with password */
-       size_t key_size;          /**< The byte size of raw_key */
-       ckmc_key_type_e key_type; /**< The raw_key's type */
-       char* password;           /**< Byte array used to decrypt data raw_key inside key manager. */
+    unsigned char* raw_key;   /**< Byte array of key. raw_key may be encrypted with password */
+    size_t key_size;          /**< The byte size of raw_key */
+    ckmc_key_type_e key_type; /**< The raw_key's type */
+    char* password;           /**< Byte array used to decrypt data raw_key inside key manager. */
 } ckmc_key_s;
 
 /**
@@ -126,9 +128,9 @@ typedef struct __ckmc_key {
  * @since_tizen 2.3
  */
 typedef struct __ckmc_cert {
-       unsigned char* raw_cert;  /**< Byte array of certificate */
-       size_t cert_size;         /**< Byte size of raw_cert */
-       ckmc_data_format_e data_format; /**< Raw_cert's encoding format */
+    unsigned char* raw_cert;  /**< Byte array of certificate */
+    size_t cert_size;         /**< Byte size of raw_cert */
+    ckmc_data_format_e data_format; /**< Raw_cert's encoding format */
 } ckmc_cert_s;
 
 /**
@@ -136,8 +138,8 @@ typedef struct __ckmc_cert {
  * @since_tizen 2.3
  */
 typedef struct __ckmc_alias_list {
-       char *alias;  /**< The name of key, certificate or data stored in key manager */
-       struct __ckmc_alias_list *next; /**< The pointer pointing to the next ckmc_alias_list_s */
+    char *alias;  /**< The name of key, certificate or data stored in key manager */
+    struct __ckmc_alias_list *next; /**< The pointer pointing to the next ckmc_alias_list_s */
 } ckmc_alias_list_s;
 
 /**
@@ -145,8 +147,8 @@ typedef struct __ckmc_alias_list {
  * @since_tizen 2.3
  */
 typedef struct __ckmc_cert_list {
-       ckmc_cert_s *cert; /**< The pointer of ckmc_cert_s */
-       struct __ckmc_cert_list *next; /**< The pointer pointing to the next ckmc_cert_list_s */
+    ckmc_cert_s *cert; /**< The pointer of ckmc_cert_s */
+    struct __ckmc_cert_list *next; /**< The pointer pointing to the next ckmc_cert_list_s */
 } ckmc_cert_list_s;
 
 /**

diff --git a/src/manager/service/CryptoService.cpp b/src/manager/service/CryptoService.cpp
index 431296b..3152f2a 100644 (file)
--- a/src/manager/service/CryptoService.cpp
+++ b/src/manager/service/CryptoService.cpp
@@ -40,121 +40,163 @@ CryptoService::~CryptoService(){
 
 
 int CryptoService::initialize() {
-       int mode = 0;
-       int rc = 0;
-       int hw_rand_ret = 0, u_rand_ret = 0;
+    int mode = 0;
+    int rc = 0;
+    int hw_rand_ret = 0, u_rand_ret = 0;
 
-       // try to initialize using ERR_load_crypto_strings and OpenSSL_add_all_algorithms
-       ERR_load_crypto_strings();
-       OpenSSL_add_all_algorithms();
+    // try to initialize using ERR_load_crypto_strings and OpenSSL_add_all_algorithms
+    ERR_load_crypto_strings();
+    OpenSSL_add_all_algorithms();
 
-       // turn on FIPS_mode
-       mode = FIPS_mode();
+    // turn on FIPS_mode
+    mode = FIPS_mode();
 
-       if(mode == 0) {
-               rc = FIPS_mode_set(1);
+    if(mode == 0) {
+        rc = FIPS_mode_set(1);
 
-               if(rc == 0) {
-                       LogError("Error in FIPS_mode_set function");
-               }
-       }
+        if(rc == 0) {
+            LogError("Error in FIPS_mode_set function");
+        }
+    }
 
-       // initialize entropy
-       std::ifstream ifile(DEV_HW_RANDOM_FILE);
-       if(ifile.is_open()) {
-               u_rand_ret= RAND_load_file(DEV_HW_RANDOM_FILE, 32);
-       }
-       if(u_rand_ret != 32 ){
-               LogError("Error in HW_RAND file load");
-               hw_rand_ret = RAND_load_file(DEV_URANDOM_FILE, 32);
+    // initialize entropy
+    std::ifstream ifile(DEV_HW_RANDOM_FILE);
+    if(ifile.is_open()) {
+        u_rand_ret= RAND_load_file(DEV_HW_RANDOM_FILE, 32);
+    }
+    if(u_rand_ret != 32 ){
+        LogError("Error in HW_RAND file load");
+        hw_rand_ret = RAND_load_file(DEV_URANDOM_FILE, 32);
 
-               if(hw_rand_ret != 32) {
-                       LogError("Error in U_RAND_file_load");
-                       ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in U_RAND_file_load");
-               }
-       }
+        if(hw_rand_ret != 32) {
+            LogError("Error in U_RAND_file_load");
+            ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in U_RAND_file_load");
+        }
+    }
 
-       return CKM_CRYPTO_INIT_SUCCESS;
+    return CKM_CRYPTO_INIT_SUCCESS;
 }
 
+const EVP_MD *CryptoService::getMdAlgo(const HashAlgorithm hashAlgo) {
+    const EVP_MD *md_algo=NULL;
+    switch(hashAlgo) {
+    case HashAlgorithm::NONE:
+        md_algo = NULL;
+        break;
+    case HashAlgorithm::SHA1:
+        md_algo = EVP_sha1();
+         break;
+    case HashAlgorithm::SHA256:
+         md_algo = EVP_sha256();
+         break;
+    case HashAlgorithm::SHA384:
+         md_algo = EVP_sha384();
+         break;
+    case HashAlgorithm::SHA512:
+         md_algo = EVP_sha512();
+         break;
+    default:
+        LogError("Error in hashAlgorithm value");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in hashAlgorithm value");
+    }
+    return md_algo;
+}
 
+int CryptoService::getRsaPadding(const RSAPaddingAlgorithm padAlgo) {
+    int rsa_padding = -1;
+    switch(padAlgo) {
+    case RSAPaddingAlgorithm::NONE:
+        rsa_padding = RSA_NO_PADDING;
+        break;
+    case RSAPaddingAlgorithm::PKCS1:
+        rsa_padding = RSA_PKCS1_PADDING;
+        break;
+    case RSAPaddingAlgorithm::X931:
+        rsa_padding = RSA_X931_PADDING;
+        break;
+    default:
+        LogError("Error in RSAPaddingAlgorithm value");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in RSAPaddingAlgorithm value");
+    }
+    return rsa_padding;
+}
 
 int CryptoService::createKeyPairRSA(const int size, // size in bits [1024, 2048, 4096]
-               KeyImpl &createdPrivateKey,  // returned value
-               KeyImpl &createdPublicKey)  // returned value
+        KeyImpl &createdPrivateKey,  // returned value
+        KeyImpl &createdPublicKey)  // returned value
 {
-       EVP_PKEY_CTX *ctx = NULL;
-       EVP_PKEY *pkey = NULL;
-       EVP_PKEY *pparam = NULL;
-
-       // check the parameters of functions
-       if(size != 1024 && size !=2048 && size != 4096) {
-               LogError("Error in RSA input size");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in RSA input size");
-       }
+    EVP_PKEY_CTX *ctx = NULL;
+    EVP_PKEY *pkey = NULL;
+    EVP_PKEY *pparam = NULL;
+
+    // check the parameters of functions
+    if(size != 1024 && size !=2048 && size != 4096) {
+        LogError("Error in RSA input size");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in RSA input size");
+    }
 
-       // check the parameters of functions
-       if(&createdPrivateKey == NULL) {
-               LogError("Error in createdPrivateKey value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in createdPrivateKey value");
-       }
+    // check the parameters of functions
+    if(&createdPrivateKey == NULL) {
+        LogError("Error in createdPrivateKey value");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in createdPrivateKey value");
+    }
 
-       // check the parameters of functions
-       if(&createdPublicKey == NULL) {
-               LogError("Error in createdPrivateKey value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in createdPublicKey value");
-       }
+    // check the parameters of functions
+    if(&createdPublicKey == NULL) {
+        LogError("Error in createdPrivateKey value");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in createdPublicKey value");
+    }
 
-       Try {
-               if(!(ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL))) {
-                       LogError("Error in EVP_PKEY_CTX_new_id function !!");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_new_id function !!");
-               }
+    Try {
+        if(!(ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL))) {
+            LogError("Error in EVP_PKEY_CTX_new_id function !!");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_new_id function !!");
+        }
 
-               if(EVP_PKEY_keygen_init(ctx) <= 0) {
-                       LogError("Error in EVP_PKEY_keygen_init function !!");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen_init function !!");
-               }
+        if(EVP_PKEY_keygen_init(ctx) <= 0) {
+            LogError("Error in EVP_PKEY_keygen_init function !!");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen_init function !!");
+        }
 
-               if(EVP_PKEY_CTX_set_rsa_keygen_bits(ctx,size) <= 0) {
-                       LogError("Error in EVP_PKEY_CTX_set_rsa_keygen_bits function !!");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_set_rsa_keygen_bits function !!");
-               }
+        if(EVP_PKEY_CTX_set_rsa_keygen_bits(ctx,size) <= 0) {
+            LogError("Error in EVP_PKEY_CTX_set_rsa_keygen_bits function !!");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_set_rsa_keygen_bits function !!");
+        }
 
-               if(!EVP_PKEY_keygen(ctx, &pkey)) {
-                       LogError("Error in EVP_PKEY_keygen function !!");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen function !!");
-               }
-       } Catch(CryptoService::Exception::opensslError) {
-               if(pkey) {
-                       EVP_PKEY_free(pkey);
-               }
+        if(!EVP_PKEY_keygen(ctx, &pkey)) {
+            LogError("Error in EVP_PKEY_keygen function !!");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen function !!");
+        }
+    } Catch(CryptoService::Exception::opensslError) {
+        if(pkey) {
+            EVP_PKEY_free(pkey);
+        }
 
-               if(pparam) {
-                       EVP_PKEY_free(pparam);
-               }
+        if(pparam) {
+            EVP_PKEY_free(pparam);
+        }
 
-               if(ctx) {
-                       EVP_PKEY_CTX_free(ctx);
-               }
+        if(ctx) {
+            EVP_PKEY_CTX_free(ctx);
+        }
 
-               ReThrowMsg(CryptoService::Exception::opensslError,"Error in opensslError function !!");
-       }
+        ReThrowMsg(CryptoService::Exception::opensslError,"Error in opensslError function !!");
+    }
 
-       KeyImpl::EvpShPtr ptr(pkey, EVP_PKEY_free); // shared ptr will free pkey
+    KeyImpl::EvpShPtr ptr(pkey, EVP_PKEY_free); // shared ptr will free pkey
 
-       createdPrivateKey = KeyImpl(ptr, KeyType::KEY_RSA_PRIVATE);
-       createdPublicKey = KeyImpl(ptr, KeyType::KEY_RSA_PUBLIC);
+    createdPrivateKey = KeyImpl(ptr, KeyType::KEY_RSA_PRIVATE);
+    createdPublicKey = KeyImpl(ptr, KeyType::KEY_RSA_PUBLIC);
 
-       if(pparam) {
-               EVP_PKEY_free(pparam);
-       }
+    if(pparam) {
+        EVP_PKEY_free(pparam);
+    }
 
-       if(ctx) {
-               EVP_PKEY_CTX_free(ctx);
-       }
+    if(ctx) {
+        EVP_PKEY_CTX_free(ctx);
+    }
 
-       return CKM_CRYPTO_CREATEKEY_SUCCESS;
+    return CKM_CRYPTO_CREATEKEY_SUCCESS;
 }
 
 
@@ -268,480 +310,549 @@ int CryptoService::createKeyPairDSA(const int size, // size in bits [1024, 2048,
 
 
 int CryptoService::createKeyPairECDSA(ElipticCurve type,
-               KeyImpl &createdPrivateKey,  // returned value
-               KeyImpl &createdPublicKey)  // returned value
+        KeyImpl &createdPrivateKey,  // returned value
+        KeyImpl &createdPublicKey)  // returned value
 {
-       int ecCurve = NOT_DEFINED;
-       EVP_PKEY_CTX *pctx = NULL;
-       EVP_PKEY_CTX *kctx = NULL;
-       EVP_PKEY *pkey = NULL;
-       EVP_PKEY *pparam = NULL;
-
-       switch(type) {
-       case ElipticCurve::prime192v1:
-               ecCurve = NID_X9_62_prime192v1;
-               break;
-       case ElipticCurve::prime256v1:
-               ecCurve = NID_X9_62_prime256v1;
-               break;
-       case ElipticCurve::secp384r1:
-               ecCurve = NID_secp384r1;
-               break;
-       default:
-               LogError("Error in EC type");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in EC type");
-       }
+    int ecCurve = NOT_DEFINED;
+    EVP_PKEY_CTX *pctx = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+    EVP_PKEY *pkey = NULL;
+    EVP_PKEY *pparam = NULL;
+
+    switch(type) {
+    case ElipticCurve::prime192v1:
+        ecCurve = NID_X9_62_prime192v1;
+        break;
+    case ElipticCurve::prime256v1:
+        ecCurve = NID_X9_62_prime256v1;
+        break;
+    case ElipticCurve::secp384r1:
+        ecCurve = NID_secp384r1;
+        break;
+    default:
+        LogError("Error in EC type");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in EC type");
+    }
 
-       // check the parameters of functions
-       if(&createdPrivateKey == NULL) {
-               LogError("Error in createdPrivateKey value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in createdPrivateKey value");
-       }
+    // check the parameters of functions
+    if(&createdPrivateKey == NULL) {
+        LogError("Error in createdPrivateKey value");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in createdPrivateKey value");
+    }
 
-       // check the parameters of functions
-       if(&createdPublicKey == NULL) {
-               LogError("Error in createdPrivateKey value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in createdPublicKey value");
-       }
+    // check the parameters of functions
+    if(&createdPublicKey == NULL) {
+        LogError("Error in createdPrivateKey value");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in createdPublicKey value");
+    }
 
-       Try {
-               /* Create the context for generating the parameters */
-               if(!(pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL))) {
-                       LogError("Error in EVP_PKEY_CTX_new_id function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_new_id function");
-               }
+    Try {
+        /* Create the context for generating the parameters */
+        if(!(pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL))) {
+            LogError("Error in EVP_PKEY_CTX_new_id function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_new_id function");
+        }
 
-               if(EVP_SUCCESS != EVP_PKEY_paramgen_init(pctx)) {
-                       LogError("Error in EVP_PKEY_paramgen_init function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_paramgen_init function");
-               }
+        if(EVP_SUCCESS != EVP_PKEY_paramgen_init(pctx)) {
+            LogError("Error in EVP_PKEY_paramgen_init function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_paramgen_init function");
+        }
 
-               if(EVP_SUCCESS != EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, ecCurve)) {
-                       LogError("Error in EVP_PKEY_CTX_set_ec_paramgen_curve_nid function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_set_ec_paramgen_curve_nid function");
-               }
+        if(EVP_SUCCESS != EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, ecCurve)) {
+            LogError("Error in EVP_PKEY_CTX_set_ec_paramgen_curve_nid function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_set_ec_paramgen_curve_nid function");
+        }
 
-               /* Generate parameters */
-               if(EVP_SUCCESS != EVP_PKEY_paramgen(pctx, &pparam)) {
-                       LogError("Error in EVP_PKEY_paramgen function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_paramgen function");
-               }
+        /* Generate parameters */
+        if(EVP_SUCCESS != EVP_PKEY_paramgen(pctx, &pparam)) {
+            LogError("Error in EVP_PKEY_paramgen function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_paramgen function");
+        }
 
-               // Start to generate key
-               if(!(kctx = EVP_PKEY_CTX_new(pparam, NULL))) {
-                       LogError("Error in EVP_PKEY_CTX_new function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_new function");
-               }
+        // Start to generate key
+        if(!(kctx = EVP_PKEY_CTX_new(pparam, NULL))) {
+            LogError("Error in EVP_PKEY_CTX_new function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_new function");
+        }
 
-               if(EVP_SUCCESS != EVP_PKEY_keygen_init(kctx)) {
-                       LogError("Error in EVP_PKEY_keygen_init function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen_init function");
-               }
+        if(EVP_SUCCESS != EVP_PKEY_keygen_init(kctx)) {
+            LogError("Error in EVP_PKEY_keygen_init function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen_init function");
+        }
 
-               /* Generate the key */
-               if(EVP_SUCCESS != EVP_PKEY_keygen(kctx, &pkey)) {
-                       LogError("Error in EVP_PKEY_keygen function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen function");
-               }
-       } Catch(CryptoService::Exception::opensslError) {
-               if(pkey) {
-                       EVP_PKEY_free(pkey);
-               }
+        /* Generate the key */
+        if(EVP_SUCCESS != EVP_PKEY_keygen(kctx, &pkey)) {
+            LogError("Error in EVP_PKEY_keygen function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen function");
+        }
+    } Catch(CryptoService::Exception::opensslError) {
+        if(pkey) {
+            EVP_PKEY_free(pkey);
+        }
 
-               if(pparam) {
-                       EVP_PKEY_free(pparam);
-               }
+        if(pparam) {
+            EVP_PKEY_free(pparam);
+        }
 
-               if(pctx) {
-                       EVP_PKEY_CTX_free(pctx);
-               }
+        if(pctx) {
+            EVP_PKEY_CTX_free(pctx);
+        }
 
-               if(kctx) {
-                       EVP_PKEY_CTX_free(kctx);
-               }
+        if(kctx) {
+            EVP_PKEY_CTX_free(kctx);
+        }
 
-               ReThrowMsg(CryptoService::Exception::opensslError,"Error in openssl function !!");
-       }
+        ReThrowMsg(CryptoService::Exception::opensslError,"Error in openssl function !!");
+    }
 
-       KeyImpl::EvpShPtr ptr(pkey, EVP_PKEY_free); // shared ptr will free pkey
+    KeyImpl::EvpShPtr ptr(pkey, EVP_PKEY_free); // shared ptr will free pkey
 
-       createdPrivateKey = KeyImpl(ptr, KeyType::KEY_ECDSA_PRIVATE);
-       createdPublicKey = KeyImpl(ptr, KeyType::KEY_ECDSA_PUBLIC);
+    createdPrivateKey = KeyImpl(ptr, KeyType::KEY_ECDSA_PRIVATE);
+    createdPublicKey = KeyImpl(ptr, KeyType::KEY_ECDSA_PUBLIC);
 
-       if(pparam) {
-               EVP_PKEY_free(pparam);
-       }
+    if(pparam) {
+        EVP_PKEY_free(pparam);
+    }
 
-       if(pctx) {
-               EVP_PKEY_CTX_free(pctx);
-       }
+    if(pctx) {
+        EVP_PKEY_CTX_free(pctx);
+    }
 
-       if(kctx) {
-               EVP_PKEY_CTX_free(kctx);
-       }
+    if(kctx) {
+        EVP_PKEY_CTX_free(kctx);
+    }
 
-       return CKM_CRYPTO_CREATEKEY_SUCCESS;
+    return CKM_CRYPTO_CREATEKEY_SUCCESS;
 }
 
 int CryptoService::createSignature(const KeyImpl &privateKey,
-               const RawBuffer &message,
-               const HashAlgorithm hashAlgo,
-               const RSAPaddingAlgorithm padAlgo,
-               RawBuffer &signature)
+        const RawBuffer &message,
+        const HashAlgorithm hashAlgo,
+        const RSAPaddingAlgorithm padAlgo,
+        RawBuffer &signature)
 {
-       EVP_MD_CTX *mdctx = NULL;
-       EVP_PKEY_CTX *pctx = NULL;
-       int rsa_padding = NOT_DEFINED;
-       RawBuffer data;
-       const EVP_MD *md_algo = NULL;
+    int retCode = CKM_API_SUCCESS;
+    int rsa_padding = NOT_DEFINED;
+    const EVP_MD *md_algo = NULL;
 
-       // check the parameters of functions
-       if(&privateKey == NULL) {
-               LogError("Error in privateKey value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in privateKey value");
-       }
+    md_algo = getMdAlgo(hashAlgo);
 
-       if(&message == NULL) {
-               LogError("Error in message value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in message value");
-       }
 
-       switch(hashAlgo) {
-       case HashAlgorithm::SHA1:
-               md_algo = EVP_sha1();
-               break;
-       case HashAlgorithm::SHA256:
-               md_algo = EVP_sha256();
-               break;
-       case HashAlgorithm::SHA384:
-               md_algo = EVP_sha384();
-               break;
-       case HashAlgorithm::SHA512:
-               md_algo = EVP_sha512();
-               break;
-       default:
-               LogError("Error in hashAlgorithm value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in hashAlgorithm value");
-       }
+    if((privateKey.getType() != KeyType::KEY_RSA_PRIVATE) &&
+       (privateKey.getType() != KeyType::KEY_DSA_PRIVATE) &&
+       (privateKey.getType() != KeyType::KEY_ECDSA_PRIVATE))
+    {
+        LogError("Error in private key type");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in private key type");
+    }
 
-       if((privateKey.getType() != KeyType::KEY_RSA_PRIVATE) &&
-          (privateKey.getType() != KeyType::KEY_DSA_PRIVATE) &&
-          (privateKey.getType() != KeyType::KEY_ECDSA_PRIVATE))
-       {
-               LogError("Error in private key type");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in private key type");
-       }
+    if(privateKey.getType()==KeyType::KEY_RSA_PRIVATE) {
+        rsa_padding = getRsaPadding(padAlgo);
+    }
 
-       if(privateKey.getType()==KeyType::KEY_RSA_PRIVATE) {
-               switch(padAlgo) {
-               case RSAPaddingAlgorithm::PKCS1:
-                       rsa_padding = RSA_PKCS1_PADDING;
-                       break;
-               case RSAPaddingAlgorithm::X931:
-                       rsa_padding = RSA_X931_PADDING;
-                       break;
-               default:
-                       LogError("Error in padding Algorithm value");
-                       ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in padding Algorithm value");
-               }
-       }
+    auto shrPKey = privateKey.getEvpShPtr();
+    if (NULL == shrPKey.get()) {
+        LogError("Error in EVP_PKEY_keygen function");
+        ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen function");
+    }
 
-       auto shrPKey = privateKey.getEvpShPtr();
+    if(md_algo == NULL) {
+        retCode = signMessage(shrPKey.get(), message, rsa_padding, signature);
+    }else {
+        retCode = digestSignMessage(shrPKey.get(),message, md_algo, rsa_padding, signature);
+    }
 
-       Try {
-               if (NULL == shrPKey.get()) {
-                       LogError("Error in EVP_PKEY_keygen function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen function");
-               }
+    return retCode;
+}
 
-               // Create the Message Digest Context
-               if(!(mdctx = EVP_MD_CTX_create())) {
-                       LogError("Error in EVP_MD_CTX_create function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_MD_CTX_create function");
-               }
+int CryptoService::signMessage(EVP_PKEY *privKey,
+        const RawBuffer &message,
+        const int rsa_padding,
+        RawBuffer &signature)
+{
+    int retCode = CKM_API_SUCCESS;
+    EVP_PKEY_CTX *pctx = NULL;
 
-               if(EVP_SUCCESS != EVP_DigestSignInit(mdctx, &pctx, md_algo, NULL, shrPKey.get())) {
-                       LogError("Error in EVP_DigestSignInit function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_DigestSignInit function");
-               }
+    Try {
+        if(!(pctx = EVP_PKEY_CTX_new(privKey, NULL))) {
+            LogError("Error in EVP_PKEY_CTX_new function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_new function");
+        }
 
-               /* Set padding algorithm */
-               if(privateKey.getType()==KeyType::KEY_RSA_PRIVATE) {
-                       if(EVP_SUCCESS != EVP_PKEY_CTX_set_rsa_padding(pctx, rsa_padding)) {
-                               LogError("Error in EVP_PKEY_CTX_set_rsa_padding function");
-                               ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_set_rsa_padding function");
-                       }
-               }
+        if(EVP_PKEY_sign_init(pctx) != EVP_SUCCESS) {
+            LogError("Error in EVP_PKEY_sign_init function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_sign_init function");
+        }
 
-               /* Call update with the message */
-               char msg[message.size()];
-               memcpy(msg, message.data(),message.size());
-               if(EVP_SUCCESS != EVP_DigestSignUpdate(mdctx, msg, message.size())) {
-                       LogError("Error in EVP_DigestSignUpdate function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_DigestSignUpdate function");
-               }
+        /* Set padding algorithm */
+        if(EVP_PKEY_type(privKey->type) == EVP_PKEY_RSA) {
+            if(EVP_SUCCESS != EVP_PKEY_CTX_set_rsa_padding(pctx, rsa_padding)) {
+                LogError("Error in EVP_PKEY_CTX_set_rsa_padding function");
+                ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_set_rsa_padding function");
+            }
+        }
 
-               /* Finalize the DigestSign operation */
-               /* First call EVP_DigestSignFinal with a NULL sig parameter to obtain the length of the
-                * signature. Length is returned in slen */
-               size_t slen;
-               if(EVP_SUCCESS != EVP_DigestSignFinal(mdctx, NULL, &slen)) {
-                       LogError("Error in EVP_DigestSignFinal function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_DigestSignFinal function");
-               }
-               /* Allocate memory for the signature based on size in slen */
-               unsigned char sig[slen];
+        /* Finalize the Sign operation */
+        /* First call EVP_PKEY_sign with a NULL sig parameter to obtain the length of the
+         * signature. Length is returned in slen */
+        size_t slen;
+        if(EVP_SUCCESS != EVP_PKEY_sign(pctx, NULL, &slen, message.data(), message.size())) {
+            LogError("Error in EVP_PKEY_sign function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_sign function");
+        }
 
-               /* Obtain the signature */
-               if(EVP_SUCCESS != EVP_DigestSignFinal(mdctx, sig, &slen)) {
-                       LogError("Error in EVP_DigestSignFinal function");
-                       ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_DigestSignFinal function");
-               }
+        /* Allocate memory for the signature based on size in slen */
+        unsigned char sig[slen];
 
-               // Set value to return RawData
-               signature.assign(sig, sig+slen);
-       } Catch(CryptoService::Exception::opensslError) {
-               if(mdctx != NULL) {
-                       EVP_MD_CTX_destroy(mdctx);
-               }
+        if(EVP_SUCCESS == EVP_PKEY_sign(pctx, sig, &slen, message.data(), message.size())) {
+            // Set value to return RawData
+            signature.assign(sig, sig+slen);
+            retCode = CKM_API_SUCCESS;
+        }else {
+            LogError("Error in EVP_PKEY_sign function: check input parameter");
+            retCode = CKM_API_ERROR_INPUT_PARAM;
+        }
+    } Catch(CryptoService::Exception::opensslError) {
+        if(pctx != NULL) {
+            EVP_PKEY_CTX_free(pctx);
+        }
+        ReThrowMsg(CryptoService::Exception::opensslError,"Error in openssl function !!");
+    }
 
-               ReThrowMsg(CryptoService::Exception::opensslError,"Error in openssl function !!");
-       }
+    if(pctx != NULL) {
+        EVP_PKEY_CTX_free(pctx);
+    }
+    return retCode;
+}
 
-       if(mdctx != NULL) {
-               EVP_MD_CTX_destroy(mdctx);
-       }
+int CryptoService::digestSignMessage(EVP_PKEY *privKey,
+        const RawBuffer &message,
+        const EVP_MD *md_algo,
+        const int rsa_padding,
+        RawBuffer &signature)
+{
+    EVP_MD_CTX *mdctx = NULL;
+    EVP_PKEY_CTX *pctx = NULL;
+
+    Try {
+        // Create the Message Digest Context
+        if(!(mdctx = EVP_MD_CTX_create())) {
+            LogError("Error in EVP_MD_CTX_create function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_MD_CTX_create function");
+        }
+
+        if(EVP_SUCCESS != EVP_DigestSignInit(mdctx, &pctx, md_algo, NULL, privKey)) {
+            LogError("Error in EVP_DigestSignInit function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_DigestSignInit function");
+        }
+
+        /* Set padding algorithm */
+        if(EVP_PKEY_type(privKey->type) == EVP_PKEY_RSA) {
+            if(EVP_SUCCESS != EVP_PKEY_CTX_set_rsa_padding(pctx, rsa_padding)) {
+                LogError("Error in EVP_PKEY_CTX_set_rsa_padding function");
+                ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_set_rsa_padding function");
+            }
+        }
+
+        /* Call update with the message */
+        if(EVP_SUCCESS != EVP_DigestSignUpdate(mdctx, message.data(), message.size())) {
+            LogError("Error in EVP_DigestSignUpdate function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_DigestSignUpdate function");
+        }
+
+        /* Finalize the DigestSign operation */
+        /* First call EVP_DigestSignFinal with a NULL sig parameter to obtain the length of the
+         * signature. Length is returned in slen */
+        size_t slen;
+        if(EVP_SUCCESS != EVP_DigestSignFinal(mdctx, NULL, &slen)) {
+            LogError("Error in EVP_DigestSignFinal function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_DigestSignFinal function");
+        }
+        /* Allocate memory for the signature based on size in slen */
+        unsigned char sig[slen];
+
+        /* Obtain the signature */
+        if(EVP_SUCCESS != EVP_DigestSignFinal(mdctx, sig, &slen)) {
+            LogError("Error in EVP_DigestSignFinal function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_DigestSignFinal function");
+        }
+
+        // Set value to return RawData
+        signature.assign(sig, sig+slen);
+    } Catch(CryptoService::Exception::opensslError) {
+        if(mdctx != NULL) {
+            EVP_MD_CTX_destroy(mdctx);
+        }
+
+        ReThrowMsg(CryptoService::Exception::opensslError,"Error in openssl function !!");
+    }
+
+    if(mdctx != NULL) {
+        EVP_MD_CTX_destroy(mdctx);
+    }
 
-       return CKM_CREATE_SIGNATURE_SUCCESS;
+    return CKM_API_SUCCESS;
 }
 
 int CryptoService::verifySignature(const KeyImpl &publicKey,
-               const RawBuffer &message,
-               const RawBuffer &signature,
-               const HashAlgorithm hashAlgo,
-               const RSAPaddingAlgorithm padAlgo)
+        const RawBuffer &message,
+        const RawBuffer &signature,
+        const HashAlgorithm hashAlgo,
+        const RSAPaddingAlgorithm padAlgo)
 {
-       EVP_PKEY_CTX *pctx = NULL;
-       int rsa_padding = NOT_DEFINED;
-       const EVP_MD *md_algo;
+    int rsa_padding = NOT_DEFINED;
+    const EVP_MD *md_algo;
     int retCode = CKM_API_ERROR_VERIFICATION_FAILED;
-    std::unique_ptr<EVP_MD_CTX, std::function<void(EVP_MD_CTX*)>> mdctx(nullptr, EVP_MD_CTX_destroy);
-
-    if(&publicKey == NULL) {
-               LogError("Error in publicKey value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in publicKey value");
-       }
 
-       if(&message == NULL) {
-               LogError("Error in message value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in message value");
-       }
+    md_algo = getMdAlgo(hashAlgo);
 
-       if(&signature == NULL) {
-               LogError("Error in signature value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in signature value");
-       }
-
-       switch(hashAlgo) {
-       case HashAlgorithm::SHA1:
-               md_algo = EVP_sha1();
-               break;
-       case HashAlgorithm::SHA256:
-               md_algo = EVP_sha256();
-               break;
-       case HashAlgorithm::SHA384:
-               md_algo = EVP_sha384();
-               break;
-       case HashAlgorithm::SHA512:
-               md_algo = EVP_sha512();
-               break;
-       default:
-               LogError("Error in hashAlgorithm value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in hashAlgorithm value");
-       }
 
-       if((publicKey.getType() != KeyType::KEY_RSA_PUBLIC) &&
-          (publicKey.getType() != KeyType::KEY_DSA_PUBLIC) &&
-          (publicKey.getType() != KeyType::KEY_ECDSA_PUBLIC))
-       {
-               LogError("Error in private key type");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in private key type");
-       }
-
-       if(publicKey.getType()==KeyType::KEY_RSA_PUBLIC) {
-               switch(padAlgo) {
-               case RSAPaddingAlgorithm::PKCS1:
-                       rsa_padding = RSA_PKCS1_PADDING;
-                       break;
-               case RSAPaddingAlgorithm::X931:
-                       rsa_padding = RSA_X931_PADDING;
-                       break;
-               default:
-                       LogError("Error in padding Algorithm value");
-                       ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in padding Algorithm value");
-               }
-       }
+    if((publicKey.getType() != KeyType::KEY_RSA_PUBLIC) &&
+       (publicKey.getType() != KeyType::KEY_DSA_PUBLIC) &&
+       (publicKey.getType() != KeyType::KEY_ECDSA_PUBLIC))
+    {
+        LogError("Error in private key type");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in private key type");
+    }
 
-    auto public_pkey = publicKey.getEvpShPtr();
+    if(publicKey.getType()==KeyType::KEY_RSA_PUBLIC) {
+        rsa_padding = getRsaPadding(padAlgo);
+    }
 
-    if (NULL == public_pkey.get()) {
+    auto shrPKey = publicKey.getEvpShPtr();
+    if (NULL == shrPKey.get()) {
         LogError("Error in getEvpShPtr function");
         ThrowMsg(CryptoService::Exception::opensslError, "Error in getEvpShPtr function");
     }
 
-    /* Create the Message Digest Context */
-    mdctx.reset(EVP_MD_CTX_create());
+    if(md_algo == NULL) {
+        retCode = verifyMessage(shrPKey.get(), message, signature, rsa_padding);
+    }else {
+        retCode = digestVerifyMessage(shrPKey.get(),message, signature, md_algo, rsa_padding);
+    }
+
+    return retCode;
+}
+
+int CryptoService::verifyMessage(EVP_PKEY *pubKey,
+        const RawBuffer &message,
+        const RawBuffer &signature,
+        const int rsa_padding)
+{
+    int ret = CKM_API_ERROR_VERIFICATION_FAILED;
+    EVP_PKEY_CTX *pctx = NULL;
+
+    Try {
+        if(!(pctx = EVP_PKEY_CTX_new(pubKey, NULL))) {
+            LogError("Error in EVP_PKEY_CTX_new function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_new function");
+        }
+
+        if(EVP_PKEY_verify_init(pctx) != EVP_SUCCESS) {
+            LogError("Error in EVP_PKEY_verify_init function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_verify_init function");
+        }
+
+        /* Set padding algorithm  */
+        if(EVP_PKEY_type(pubKey->type) == EVP_PKEY_RSA) {
+            if(EVP_SUCCESS != EVP_PKEY_CTX_set_rsa_padding(pctx, rsa_padding)) {
+                LogError("Error in EVP_PKEY_CTX_set_rsa_padding function");
+                ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_set_rsa_padding function");
+            }
+        }
 
-    if(!(mdctx.get())) {
-        LogError("Error in EVP_MD_CTX_create function");
-        ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_MD_CTX_create function");
+        if(EVP_SUCCESS == EVP_PKEY_verify(pctx, signature.data(), signature.size(), message.data(), message.size())) {
+            ret = CKM_API_SUCCESS;
+        }else {
+            LogError("EVP_PKEY_verify Failed");
+            ret = CKM_API_ERROR_VERIFICATION_FAILED;
+        }
+    } Catch(CryptoService::Exception::opensslError) {
+        if(pctx != NULL) {
+            EVP_PKEY_CTX_free(pctx);
+        }
+        ReThrowMsg(CryptoService::Exception::opensslError,"Error in openssl function !!");
     }
 
-    if(EVP_SUCCESS != EVP_DigestVerifyInit(mdctx.get(), &pctx, md_algo, NULL, public_pkey.get())) {
-        LogError("Error in EVP_DigestVerifyInit function");
-        ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_DigestVerifyInit function");
+    if(pctx != NULL) {
+        EVP_PKEY_CTX_free(pctx);
     }
 
-    if(publicKey.getType()==KeyType::KEY_RSA_PUBLIC) {
-        if(EVP_SUCCESS != EVP_PKEY_CTX_set_rsa_padding(pctx, rsa_padding))  {
-            LogError("Error in EVP_PKEY_CTX_set_rsa_padding function");
-            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_set_rsa_padding function");
+    return ret;
+}
+
+int CryptoService::digestVerifyMessage(EVP_PKEY *pubKey,
+        const RawBuffer &message,
+        const RawBuffer &signature,
+        const EVP_MD *md_algo,
+        const int rsa_padding)
+{
+    int ret = CKM_API_ERROR_VERIFICATION_FAILED;
+    EVP_MD_CTX *mdctx = NULL;
+    EVP_PKEY_CTX *pctx = NULL;
+
+    Try {
+        /* Create the Message Digest Context */
+        if(!(mdctx = EVP_MD_CTX_create())) {
+            LogError("Error in EVP_MD_CTX_create function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_MD_CTX_create function");
+        }
+
+        if(EVP_SUCCESS != EVP_DigestVerifyInit(mdctx, &pctx, md_algo, NULL, pubKey)) {
+            LogError("Error in EVP_DigestVerifyInit function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_DigestVerifyInit function");
+        }
+
+        if(EVP_PKEY_type(pubKey->type) == EVP_PKEY_RSA) {
+            if(EVP_SUCCESS != EVP_PKEY_CTX_set_rsa_padding(pctx, rsa_padding)) {
+                LogError("Error in EVP_PKEY_CTX_set_rsa_padding function");
+                ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_set_rsa_padding function");
+            }
+        }
+
+        if(EVP_SUCCESS != EVP_DigestVerifyUpdate(mdctx, message.data(), message.size()) ) {
+            LogError("Error in EVP_DigestVerifyUpdate function");
+            ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_DigestVerifyUpdate function");
         }
-    }
 
-    if(EVP_SUCCESS != EVP_DigestVerifyUpdate(mdctx.get(), message.data(), message.size()) ) {
-        LogError("Error in EVP_DigestVerifyUpdate function");
-        ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_DigestVerifyUpdate function");
+        if(EVP_SUCCESS == EVP_DigestVerifyFinal(mdctx, const_cast<unsigned char*>(signature.data()), signature.size()) ) {
+            ret = CKM_API_SUCCESS;
+        }else {
+            LogError("EVP_PKEY_verify Failed");
+            ret = CKM_API_ERROR_VERIFICATION_FAILED;
+        }
+    } Catch(CryptoService::Exception::opensslError) {
+        if(mdctx != NULL) {
+            EVP_MD_CTX_destroy(mdctx);
+        }
+        ReThrowMsg(CryptoService::Exception::opensslError,"Error in openssl function !!");
     }
 
-    if(EVP_SUCCESS == EVP_DigestVerifyFinal(mdctx.get(), const_cast<unsigned char*>(signature.data()), signature.size()) ) {
-        retCode = CKM_API_SUCCESS;
-    } else {
-        LogError("Error in EVP_DigestVerifyFinal function");
+    if(mdctx != NULL) {
+        EVP_MD_CTX_destroy(mdctx);
     }
 
-       return retCode;
+    return ret;
 }
 
-
 int CryptoService::verifyCertificateChain(const CertificateImpl &certificate,
-               const CertificateImplVector &untrustedCertificates,
-               const CertificateImplVector &userTrustedCertificates,
-               CertificateImplVector &certificateChainVector) {
+        const CertificateImplVector &untrustedCertificates,
+        const CertificateImplVector &userTrustedCertificates,
+        CertificateImplVector &certificateChainVector) {
 
-       X509 *cert = X509_new();
-       X509 *tempCert;
-       rawBufferToX509(&cert, certificate.getDER());
+    X509 *cert = X509_new();
+    X509 *tempCert;
+    rawBufferToX509(&cert, certificate.getDER());
 
-       std::vector<X509 *> trustedCerts;
-       std::vector<X509 *> userTrustedCerts;
-       std::vector<X509 *> untrustedChain;
+    std::vector<X509 *> trustedCerts;
+    std::vector<X509 *> userTrustedCerts;
+    std::vector<X509 *> untrustedChain;
 
-       STACK_OF(X509) *sysCerts = loadSystemCerts(CKM_SYSTEM_CERTS_PATH);
+    STACK_OF(X509) *sysCerts = loadSystemCerts(CKM_SYSTEM_CERTS_PATH);
 
-       // check the parameters of functions
-       if(&certificate == NULL) {
-               LogError("Error in certificate value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in certificate value");
-       }
+    // check the parameters of functions
+    if(&certificate == NULL) {
+        LogError("Error in certificate value");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in certificate value");
+    }
 
-       // check the parameters of functions
-       if(&untrustedCertificates == NULL) {
-               LogError("Error in untrustedCertificates value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in untrustedCertificates value");
-       }
+    // check the parameters of functions
+    if(&untrustedCertificates == NULL) {
+        LogError("Error in untrustedCertificates value");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in untrustedCertificates value");
+    }
 
-       // check the parameters of functions
-       if(&userTrustedCertificates == NULL) {
-               LogError("Error in userTrustedCertificates value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in userTrustedCertificates value");
-       }
+    // check the parameters of functions
+    if(&userTrustedCertificates == NULL) {
+        LogError("Error in userTrustedCertificates value");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in userTrustedCertificates value");
+    }
 
-       // check the parameters of functions
-       if(&certificateChainVector == NULL) {
-               LogError("Error in certificateChainVector value");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in certificateChainVector value");
-       }
+    // check the parameters of functions
+    if(&certificateChainVector == NULL) {
+        LogError("Error in certificateChainVector value");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in certificateChainVector value");
+    }
 
-       Try {
-               while((tempCert = sk_X509_pop(sysCerts)) != NULL) {
-                       trustedCerts.push_back(tempCert);
-               }
+    Try {
+        while((tempCert = sk_X509_pop(sysCerts)) != NULL) {
+            trustedCerts.push_back(tempCert);
+        }
 
-               for(unsigned int i=0;i<userTrustedCertificates.size();i++) {
-                       if((tempCert = X509_new()) == NULL) {
-                               LogError("Error in X509_new function");
-                               ThrowMsg(CryptoService::Exception::opensslError, "Error in X509_new function");
-                       }
-                       rawBufferToX509(&tempCert, userTrustedCertificates[i].getDER());
-                       userTrustedCerts.push_back(tempCert);
-               }
+        for(unsigned int i=0;i<userTrustedCertificates.size();i++) {
+            if((tempCert = X509_new()) == NULL) {
+                LogError("Error in X509_new function");
+                ThrowMsg(CryptoService::Exception::opensslError, "Error in X509_new function");
+            }
+            rawBufferToX509(&tempCert, userTrustedCertificates[i].getDER());
+            userTrustedCerts.push_back(tempCert);
+        }
 
-               for(unsigned int i=0;i<untrustedCertificates.size();i++) {
-                       if((tempCert = X509_new()) == NULL) {
-                               LogError("Error in X509_new function");
-                               ThrowMsg(CryptoService::Exception::opensslError, "Error in X509_new function");
-                       }
-                       rawBufferToX509(&tempCert, untrustedCertificates[i].getDER());
-                       untrustedChain.push_back(tempCert);
-               }
+        for(unsigned int i=0;i<untrustedCertificates.size();i++) {
+            if((tempCert = X509_new()) == NULL) {
+                LogError("Error in X509_new function");
+                ThrowMsg(CryptoService::Exception::opensslError, "Error in X509_new function");
+            }
+            rawBufferToX509(&tempCert, untrustedCertificates[i].getDER());
+            untrustedChain.push_back(tempCert);
+        }
 
-               std::vector<X509 *> chain = verifyCertChain(cert, trustedCerts, userTrustedCerts, untrustedChain);
+        std::vector<X509 *> chain = verifyCertChain(cert, trustedCerts, userTrustedCerts, untrustedChain);
 
-               RawBuffer tmpBuf;
-               for(unsigned int i=0;i<chain.size();i++) {
-                       x509ToRawBuffer(tmpBuf, chain[i]);
-                       CertificateImpl tmpCertImpl((const RawBuffer)tmpBuf, DataFormat::FORM_DER);
-                       certificateChainVector.push_back(tmpCertImpl);
-               }
-       } Catch(CryptoService::Exception::opensslError) {
-               if(cert != NULL) {
-                       X509_free(cert);
-               }
+        RawBuffer tmpBuf;
+        for(unsigned int i=0;i<chain.size();i++) {
+            x509ToRawBuffer(tmpBuf, chain[i]);
+            CertificateImpl tmpCertImpl((const RawBuffer)tmpBuf, DataFormat::FORM_DER);
+            certificateChainVector.push_back(tmpCertImpl);
+        }
+    } Catch(CryptoService::Exception::opensslError) {
+        if(cert != NULL) {
+            X509_free(cert);
+        }
 
-               for(unsigned int i=0;i<trustedCerts.size();i++) {
-                       if(trustedCerts[i] != NULL) {
-                               X509_free(trustedCerts[i]);
-                       }
-               }
+        for(unsigned int i=0;i<trustedCerts.size();i++) {
+            if(trustedCerts[i] != NULL) {
+                X509_free(trustedCerts[i]);
+            }
+        }
 
-               for(unsigned int i=0;i<untrustedChain.size();i++) {
-                       if(untrustedChain[i] != NULL) {
-                               X509_free(untrustedChain[i]);
-                       }
-               }
+        for(unsigned int i=0;i<untrustedChain.size();i++) {
+            if(untrustedChain[i] != NULL) {
+                X509_free(untrustedChain[i]);
+            }
+        }
 
-               for(unsigned int i=0;i<userTrustedCerts.size();i++) {
-                       if(userTrustedCerts[i] != NULL) {
-                               X509_free(userTrustedCerts[i]);
-                       }
-               }
-               ReThrowMsg(CryptoService::Exception::opensslError,"Error in openssl function !!");
-       }
+        for(unsigned int i=0;i<userTrustedCerts.size();i++) {
+            if(userTrustedCerts[i] != NULL) {
+                X509_free(userTrustedCerts[i]);
+            }
+        }
+        ReThrowMsg(CryptoService::Exception::opensslError,"Error in openssl function !!");
+    }
 
-       if(cert != NULL) {
-               X509_free(cert);
-       }
+    if(cert != NULL) {
+        X509_free(cert);
+    }
 
-       for(unsigned int i=0;i<trustedCerts.size();i++) {
-               if(trustedCerts[i] != NULL) {
-                       X509_free(trustedCerts[i]);
-               }
-       }
+    for(unsigned int i=0;i<trustedCerts.size();i++) {
+        if(trustedCerts[i] != NULL) {
+            X509_free(trustedCerts[i]);
+        }
+    }
 
-       for(unsigned int i=0;i<untrustedChain.size();i++) {
-               if(untrustedChain[i] != NULL) {
-                       X509_free(untrustedChain[i]);
-               }
-       }
+    for(unsigned int i=0;i<untrustedChain.size();i++) {
+        if(untrustedChain[i] != NULL) {
+            X509_free(untrustedChain[i]);
+        }
+    }
 
-       for(unsigned int i=0;i<userTrustedCerts.size();i++) {
-               if(userTrustedCerts[i] != NULL) {
-                       X509_free(userTrustedCerts[i]);
-               }
-       }
+    for(unsigned int i=0;i<userTrustedCerts.size();i++) {
+        if(userTrustedCerts[i] != NULL) {
+            X509_free(userTrustedCerts[i]);
+        }
+    }
 
-       return CKM_VERIFY_CHAIN_SUCCESS;
+    return CKM_VERIFY_CHAIN_SUCCESS;
 }
 
 /*
@@ -750,80 +861,80 @@ int CryptoService::verifyCertificateChain(const CertificateImpl &certificate,
  */
 
 std::vector<X509 *> CryptoService::verifyCertChain(X509 *cert,
-               std::vector<X509 *> &trustedCerts,
-               std::vector<X509 *> &userTrustedCerts,
-               std::vector<X509 *> &untrustedchain){
+        std::vector<X509 *> &trustedCerts,
+        std::vector<X509 *> &userTrustedCerts,
+        std::vector<X509 *> &untrustedchain){
 
-       std::vector<X509 *> certChain;
-       X509_STORE *tstore = X509_STORE_new();
-       STACK_OF(X509) *uchain = sk_X509_new_null();
-       std::vector<X509 *>::iterator iVec_it;
+    std::vector<X509 *> certChain;
+    X509_STORE *tstore = X509_STORE_new();
+    STACK_OF(X509) *uchain = sk_X509_new_null();
+    std::vector<X509 *>::iterator iVec_it;
 
-       for(iVec_it = trustedCerts.begin(); iVec_it != trustedCerts.end(); iVec_it++) {
-               X509_STORE_add_cert(tstore, *iVec_it);
-       }
-       for(iVec_it = userTrustedCerts.begin(); iVec_it != userTrustedCerts.end(); iVec_it++) {
-               X509_STORE_add_cert(tstore, *iVec_it);
-       }
+    for(iVec_it = trustedCerts.begin(); iVec_it != trustedCerts.end(); iVec_it++) {
+        X509_STORE_add_cert(tstore, *iVec_it);
+    }
+    for(iVec_it = userTrustedCerts.begin(); iVec_it != userTrustedCerts.end(); iVec_it++) {
+        X509_STORE_add_cert(tstore, *iVec_it);
+    }
 
-       for(iVec_it = untrustedchain.begin(); iVec_it != untrustedchain.end(); iVec_it++) {
-               sk_X509_push(uchain, *iVec_it);
-       }
+    for(iVec_it = untrustedchain.begin(); iVec_it != untrustedchain.end(); iVec_it++) {
+        sk_X509_push(uchain, *iVec_it);
+    }
 
-       // Create the context to verify the certificate.
-       X509_STORE_CTX *ctx = X509_STORE_CTX_new();
+    // Create the context to verify the certificate.
+    X509_STORE_CTX *ctx = X509_STORE_CTX_new();
 
-       // Initial the store to verify the certificate.
-       X509_STORE_CTX_init(ctx, tstore, cert, uchain);
+    // Initial the store to verify the certificate.
+    X509_STORE_CTX_init(ctx, tstore, cert, uchain);
 
-       int verified = X509_verify_cert(ctx);
+    int verified = X509_verify_cert(ctx);
 
-       if(verified == OPENSSL_SUCCESS) {
-               STACK_OF(X509) *chain = X509_STORE_CTX_get1_chain(ctx);
-               X509 *cert;
-               while((cert = sk_X509_pop(chain))) {
-                       certChain.insert(certChain.begin(),cert);
-               }
-       }
+    if(verified == OPENSSL_SUCCESS) {
+        STACK_OF(X509) *chain = X509_STORE_CTX_get1_chain(ctx);
+        X509 *cert;
+        while((cert = sk_X509_pop(chain))) {
+            certChain.insert(certChain.begin(),cert);
+        }
+    }
 
-       X509_STORE_CTX_cleanup(ctx);
-       X509_STORE_CTX_free(ctx);
-       X509_STORE_free(tstore);
-       sk_X509_free(uchain);
-       ctx = NULL;
-       tstore = NULL;
-       uchain = NULL;
-
-       if(verified != OPENSSL_SUCCESS) {
-               LogError("Error in verifying certification chain");
-               ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in verifying certification chain");
-       }
+    X509_STORE_CTX_cleanup(ctx);
+    X509_STORE_CTX_free(ctx);
+    X509_STORE_free(tstore);
+    sk_X509_free(uchain);
+    ctx = NULL;
+    tstore = NULL;
+    uchain = NULL;
+
+    if(verified != OPENSSL_SUCCESS) {
+        LogError("Error in verifying certification chain");
+        ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in verifying certification chain");
+    }
 
-       return certChain;
+    return certChain;
 }
 
 bool CryptoService::hasValidCAFlag(std::vector<X509 *> &certChain) {
-       // KeyUsage if present should allow cert signing;
-       // If basicConstraints says not a CA then say so.
-
-       X509 *cert = NULL;
-       int isCA;
-
-       if(certChain.size() < 2) // certChain should have more than 2 certs.
-               return false;
-
-       std::vector<X509 *>::iterator it;
-       for(it = certChain.begin()+1; it != certChain.end(); it++) { // start from the second cert
-               cert = *it;
-               isCA = X509_check_ca(cert);
-               // For MDPP compliance.
-               // if it returns 1, this means that the cert has the basicConstraints and CAFlag=true.
-               // X509_check_ca can return 0(is not CACert), 1(is CACert), 3, 4, 5(may be CACert).
-               if(isCA != 1) {
-                       return false;
-               }
-       }
+    // KeyUsage if present should allow cert signing;
+    // If basicConstraints says not a CA then say so.
+
+    X509 *cert = NULL;
+    int isCA;
+
+    if(certChain.size() < 2) // certChain should have more than 2 certs.
+        return false;
+
+    std::vector<X509 *>::iterator it;
+    for(it = certChain.begin()+1; it != certChain.end(); it++) { // start from the second cert
+        cert = *it;
+        isCA = X509_check_ca(cert);
+        // For MDPP compliance.
+        // if it returns 1, this means that the cert has the basicConstraints and CAFlag=true.
+        // X509_check_ca can return 0(is not CACert), 1(is CACert), 3, 4, 5(may be CACert).
+        if(isCA != 1) {
+            return false;
+        }
+    }
 
-       return true;
+    return true;
 }
 }

diff --git a/src/manager/service/CryptoService.h b/src/manager/service/CryptoService.h
index 039527a..7a77b13 100644 (file)
--- a/src/manager/service/CryptoService.h
+++ b/src/manager/service/CryptoService.h
@@ -17,16 +17,14 @@
 #include <openssl/err.h>
 #include <dpl/exception.h>
 
-#define DEV_HW_RANDOM_FILE     "/dev/hwrng"
-#define DEV_URANDOM_FILE       "/dev/urandom"
+#define DEV_HW_RANDOM_FILE    "/dev/hwrng"
+#define DEV_URANDOM_FILE    "/dev/urandom"
 
 #define EVP_SUCCESS 1  // DO NOTCHANGE THIS VALUE
 #define EVP_FAIL    0  // DO NOTCHANGE THIS VALUE
 
 #define CKM_CRYPTO_INIT_SUCCESS 1
 #define CKM_CRYPTO_CREATEKEY_SUCCESS 2
-#define CKM_CREATE_SIGNATURE_SUCCESS 3
-#define CKM_VERIFY_SIGNATURE_SUCCESS 4
 #define CKM_VERIFY_CHAIN_SUCCESS 5
 #define NOT_DEFINED -1
 
@@ -88,6 +86,29 @@ private:
                                         std::vector<X509 *> &untrustedchain);
 
     bool hasValidCAFlag(std::vector<X509 *> &certChain);
+
+    const EVP_MD *getMdAlgo(const HashAlgorithm hashAlgo);
+    int getRsaPadding(const RSAPaddingAlgorithm padAlgo);
+
+    int signMessage(EVP_PKEY *privKey,
+            const RawBuffer &message,
+            const int rsa_padding,
+            RawBuffer &signature);
+    int digestSignMessage(EVP_PKEY *privKey,
+            const RawBuffer &message,
+            const EVP_MD *md_algo,
+            const int rsa_padding,
+            RawBuffer &signature);
+
+    int verifyMessage(EVP_PKEY *pubKey,
+            const RawBuffer &message,
+            const RawBuffer &signature,
+            const int rsa_padding);
+    int digestVerifyMessage(EVP_PKEY *pubKey,
+            const RawBuffer &message,
+            const RawBuffer &signature,
+            const EVP_MD *md_algo,
+            const int rsa_padding);
 };
 }
 

diff --git a/src/manager/service/ckm-logic.cpp b/src/manager/service/ckm-logic.cpp
index 649440f..9c60b0e 100644 (file)
--- a/src/manager/service/ckm-logic.cpp
+++ b/src/manager/service/ckm-logic.cpp
@@ -680,7 +680,7 @@ RawBuffer CKMLogic::createSignature(
 
     try {
         do {
-            retCode = getDataHelper(cred, DBDataType::KEY_RSA_PUBLIC, privateKeyAlias, password, row);
+            retCode = getDataHelper(cred, DBDataType::DB_KEY_FIRST, privateKeyAlias, password, row);
             if (CKM_API_SUCCESS != retCode) {
                 LogError("getDataHelper return error");
                 break;
@@ -690,7 +690,7 @@ RawBuffer CKMLogic::createSignature(
             if (keyParsed.empty())
                 retCode = CKM_API_ERROR_SERVER_ERROR;
             else
-                cs.createSignature(keyParsed, message, hash, padding, signature);
+                retCode = cs.createSignature(keyParsed, message, hash, padding, signature);
         } while(0);
     } catch (const KeyProvider::Exception::Base &e) {
         LogError("KeyProvider failed with message: " << e.GetMessage());