--- /dev/null
+#include "crypt.h"
+#include <string.h>
+#include <stdio.h>
+
+// Use case 1
+// encypt buffer of bytes with defined buffers
+void use_case_1() {
+ char buf[200] = "The quick brown fox jumps over the lazy dog";
+ char out[200];
+ size_t len = strlen(buf);
+ size_t outlen=sizeof(out);
+ crypt_key_h *key = NULL;
+
+ crypt_init(&key, CIPHER_DES);
+ crypt_import_key(key, KEYFORMAT_RAW, "012345678", 8); // setup 64-bit key for DES operation
+
+ // encrypt
+ int r = crypt_encrypt(key, buf, len, (void**)(&out), &outlen);
+ if (r < 0) { printf("context is incorect"); }
+ if (r < len) { printf("Out but to short"); }
+
+ // decrypt
+ len = sizeof(buf);
+ r = crypt_decrypt(key, out, outlen, (void**)(&buf), &len);
+
+ crypt_destroy(key);
+}
--- /dev/null
+#include <sys/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum {
+ //symetric
+ CIPHER_NONE, //e.g. no cipher based digests
+ CIPHER_DES, //unsafe
+ CIPHER_DES3,
+ CIPHER_DESX, //only CBC blockmode
+ CIPHER_AES,
+ CIPHER_RC2, //unsafe
+ CIPHER_RC4, //unsafe
+ CIPHER_RC5,
+ CIPHER_CAST5,
+ CIPHER_SKIPJACK,//unsafe
+
+ //aymetric
+ CIPHER_RSA, //RSA cert - md5+sha1 is signed
+ CIPHER_DSA, //DSA cert - sha1 is signed
+ CIPHER_KEA, //key pair generation, TEK derivation (Token Encryption Key)
+ CIPHER_DH, //key pair generation, TEK derivation
+ CIPHER_EC, //eliptic curve
+ CIPHER_ECDH, //eliptic curve
+} cipher_t;
+
+typedef enum {
+ BLOCKMODE_NONE,
+ BLOCKMODE_EBC, // Electronic Codeblock, unsafe
+ BLOCKMODE_CBC, // Cipher Block Chaining
+ BLOCKMODE_CFB, // Cipher Feedback
+ BLOCKMODE_OFB, // Output Feedback
+ BLOCKMODE_CTR, // Counter (DES,AES) [RFC 3686]
+ BLOCKMODE_GCM, // Galois Counter Mode (AES)
+ BLOCKMODE_OCB, // Offest Codebook Mode (AES)
+ BLOCKMODE_CCM, // CBC-MAC Mode (AES)
+} blockmode_t;
+
+typedef enum {
+ DIGEST_MD5, /**< Message digest algorithm MD5 */
+ DIGEST_SHA1, /**< Message digest algorithm SHA1 */
+ DIGEST_SHA224, /**< Message digest algorithm SHA2, 224bit */
+ DIGEST_SHA256, /**< Message digest algorithm SHA2, 256bit */
+ DIGEST_SHA384, /**< Message digest algorithm SHA2, 384bit */
+ DIGEST_SHA512 /**< Message digest algorithm SHA2, 512bit */
+} digest_algo_t;
+
+typedef enum {
+ PADDING_NONE, // total number of data MUST multiple of block size
+ PADDING_ZEROS, // pad with zores
+ PADDING_ISO10126,
+ PADDING_ANSIX923,
+ PADDING_ANSIX931, // same as zero padding ?
+ PADDING_PKCS1, // RSA signature creation
+ PADDING_PKCS7, // Byte padding for symetric algos (RFC 5652), (PKCS5 padding is the same)
+} padding_t;
+
+typedef enum {
+ KEYFORMAT_RAW, // key is clear from
+ KEYFORMAT_BASE64, // key is encoded in ASCII-base64
+ KEYFORMAT_PEM, // key is in PEM file format
+ KEYFORMAT_DER, // key is in DER file format
+} keyformat_t;
+
+typedef enum {
+ //common params
+ PARAM_DIGEST_ALGO,
+ PARAM_KEY,
+ PARAM_IV, // Initial Vector
+ PARAM_PADDING,
+ PARAM_BLOCKMODE,
+ //specific params
+ PARAM_CTR_CNT, // CTR Counter bits
+ PARAM_GCM_TAG, // GCM Tag bits
+ PARAM_GCM_ADD, // GCM Additional Authentication Data
+ PARAM_CCM_NONCE,// Nonce
+ PARAM_CCM_ADD, // Additional Authentication Data
+ PARAM_CCM_MAC, // MAC length in bytes
+} param_t;
+
+typedef enum {
+ SIGN_CALC,
+ SIGN_VERIFY,
+} sign_dir_t;
+
+//internal key info struct
+typedef struct __crypt_key_info crypt_key_h;
+
+// cryptograohic module initialization (crypt_module_init must be first func)
+int crypt_module_init();
+int crypt_module_exit();
+
+// context init/reset
+int crypt_init(crypt_key_h**, cipher_t);
+int crypt_destroy(crypt_key_h *);
+
+//*******************************************
+// various parameters, depends on used cipher
+//*******************************************
+
+// optional parameters (research needed for what we need)
+// note: internally it is stored as list of tag,length,value (TLV)
+int crypt_setparam(crypt_key_h *, param_t p, const void *v, size_t len);
+int crypt_getparam(crypt_key_h *, param_t p, void *v, size_t len);
+//param_t : key, iv, padding method, block mode ….
+
+// set of functions for known parameters
+int crypt_setparam_digest_algo(crypt_key_h *, const digest_algo_t algo);
+int crypt_setparam_iv(crypt_key_h *, const void *iv, size_t len);
+int crypt_setparam_padding(crypt_key_h *, padding_t v);
+int crypt_setparam_blockmode(crypt_key_h *, blockmode_t v);
+// Note: GCM concat message len, message, and ADD (3 update calls)
+// (https://wiki.openssl.org/index.php/EVP_Authenticated_Encryption_and_Decryption)
+int crypt_setparam_gcm_tag(crypt_key_h *, const void *tag, size_t len);
+int crypt_setparam_gcm_aad(crypt_key_h *, const void *add, size_t len);
+
+int crypt_getparam_iv(crypt_key_h *, void *iv, size_t *len);
+int crypt_getparam_gcm_tag(crypt_key_h *, void *tag, size_t len);
+
+//*******************************************
+// top level (simple) interface
+//*******************************************
+
+int crypt_import_key(crypt_key_h *key, keyformat_t format, void *blob, size_t size);
+int crypt_export_key(crypt_key_h *key, keyformat_t format, void *blob, size_t size);
+
+// possible static predefined digests contexts like SHA1,SHA224,SHA256
+// digests (no key, default iv=<zeros>)
+int crypt_digest_calc(const digest_algo_t algo, const void *data, size_t len, void **digest, size_t *digest_len);
+
+// encryptions (key is mandatory, default iv=<zeros>), symmetric or asymetric
+int crypt_encrypt(crypt_key_h *key, const void *data, size_t len, void **enc_data, size_t * enc_len);
+int crypt_decrypt(crypt_key_h *key, const void *enc_data, size_t enc_len, void **data, size_t * len);
+
+// message authentication (key is mandatory, padding method, default iv=<zeros>)
+// note: this is, in fact, the same as diggest with key set up
+int crypt_sign_verify(crypt_key_h *key, const void *data, size_t len, const void *mac, size_t mac_len);
+int crypt_sign_calc(crypt_key_h *key, const void *data, size_t len, void **mac, size_t mac_len);
+
+// deallocete memory allocated by crypto library
+int crypto_free(void *buf);
+
+// seal creates symkey (with set param iv, ivlen)
+int crypt_seal(crypt_key_h *pubkey, crypt_key_h *symkey, const void *data, size_t len, void **enc_data, size_t *enc_len);
+// open uses symkey taken from seal
+int crypt_open(crypt_key_h *prvkey, crypt_key_h *symkey, const void *enc_data, size_t enc_len, void **data, size_t *len);
+
+
+//*******************************************
+// low level (advanced) interface
+//*******************************************
+
+//key material generation (depends on context cipher)
+// key - store generated key bytes
+//implememtation:
+// read byte sequence from /dev/urandom, until got not trivial key
+int crypt_generate_key(crypt_key_h *key, size_t key_len);
+// keypub = (n,e) keyprv = (n,d)
+// where n is modulus, e is public key exponents, d is private key exponent
+int crypt_generate_pkey(crypt_key_h *pub, crypt_key_h *priv, size_t key_len);
+
+int crypt_digest_update(crypt_key_h *dig, const void *data, size_t len);
+int crypt_digest_final(crypt_key_h *dig, void **digest, size_t *digest_len);
+
+int crypt_encrypt_update(crypt_key_h *key, const void *indata, size_t inlen, void **outdata, size_t *outlen);
+int crypt_encrypt_final(crypt_key_h *key, void **outdata, size_t *outlen);
+
+int crypt_decrypt_update(crypt_key_h *key, const void *indata, size_t inlen, void **outdata, size_t *outlen);
+int crypt_decrypt_final(crypt_key_h *key, void **outdata, size_t *outlen);
+
+int crypt_sign_init(crypt_key_h *key, sign_dir_t);
+int crypt_sign_update(crypt_key_h *key, const void *data, size_t len);
+int crypt_sign_final(crypt_key_h *key, void **mac, size_t *mac_len);
+
+int crypt_derive_key(crypt_key_h *dk, crypt_key_h *key);
+
+int crypt_derive_pkey(crypt_key_h *dk, crypt_key_h *key);
+
+#ifdef __cplusplus
+}
+#endif
+
--- /dev/null
+#ifndef CRYPTO_FINAL_H
+#define CRYPTO_FINAL_H
+
+// TODO: discussion about params
+// A: digest_init etc are helpers,
+// internally they use crypto_init + set param
+///
+#endif // CRYPTO_FINAL_H
--- /dev/null
+
+void RSA_gen() {
+ EVP_PKEY_CTX *ctx;
+ EVP_PKEY *pkey = NULL;
+ ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
+ // or ctx from param (wchich is set before)
+ // ctx = EVP_PKEY_CTX_new(param);
+ if (!ctx)
+ /* Error occurred */
+ if (EVP_PKEY_keygen_init(ctx) <= 0)
+ /* Error */
+ if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 2048) <= 0)
+ /* Error */
+
+ /* Generate key */
+ if (EVP_PKEY_keygen(ctx, &pkey) <= 0)
+ /* Error */
+}
+
+void DH_gen() {
+ /* Use built-in parameters */
+ if(NULL == (params = EVP_PKEY_new())) handleErrors();
+ if(1 != EVP_PKEY_set1_DH(params,DH_get_2048_256())) handleErrors();
+
+ /* Create context for the key generation */
+ if(!(kctx = EVP_PKEY_CTX_new(params, NULL))) handleErrors();
+
+ /* Generate a new key */
+ if(1 != EVP_PKEY_keygen_init(kctx)) handleErrors();
+ if(1 != EVP_PKEY_keygen(kctx, &dhkey)) handleErrors();
+};
+
+
+void DH_key_exchange() {
+ //1. create DH public params (generator: 2 or 5, numbits)
+
+ //2. each user uses public params to create their own key_pair (pub+prv)
+ // e.g. dhkey1 for user1 and dhkey2 for user2
+
+ //3. the users must exchange their public keys (user1_pub,user2_pub)
+
+ //4. after exchanging public keys users can derive shared secret keya (symetric)
+ //shared_key = dh_derive(user1_pub, user2_prv); //shared key derived by user1
+ //shared_key = dh_derive(user2_pub, user1_prv); //shared key derived by user2
+
+ shared_len = DH_compute_key(shared_key, pubkey, privkey)
+}
--- /dev/null
+/*
+ * Copyright (c) 2016 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Contact: Krzysztof Jackiewicz <k.jackiewicz@samsung.com>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+/**
+ * @file crypto.h
+ * @brief
+ */
+
+#ifndef CRYPTO_H
+#define CRYPTO_H
+
+#include <stddef.h>
+#include <crypto/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @defgroup Non-Crypto Non crypto related functions.
+ *
+ * TODO: extended description and examples.
+ *
+ * @{
+ */
+
+/**
+ * @brief CRYPTO_CTX_NULL NULL value for the crypto context.
+ */
+#define CRYPTO_CTX_NULL ((crypto_ctx_h) NULL)
+
+/**
+ * @brief crypto_init Initializes the library. Must be called before any other crypto function.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_init(void);
+
+/**
+ * @brief crypto_exit Closes the library. Must be called before exiting the application.
+ *
+ */
+void crypto_exit(void);
+
+/**
+ * @brief crypto_alloc Allocates memory.
+ *
+ * @param[in] size Size of the allocation (bytes).
+ *
+ * @return NULL on failure, pointer to allocated memory otherwise.
+ */
+void *crypto_alloc(size_t size);
+
+/**
+ * @brief crypto_free Frees the memory allocated by @see crypto_alloc
+ * or one of the cryptographics operations.
+ *
+ * @param[in] ptr Pointer to the memory to be freed.
+ *
+ */
+void crypto_free(void *ptr);
+
+/**
+ * @brief crypto_rand_bytes Generates random data.
+ *
+ * @param[in,out] data Pointer to the memory to be randomized.
+ * @param[in] data_len Length of the memory to be randomized.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_rand_bytes(char *data, size_t data_len);
+
+/**
+ * @brief crypto_ctx_set_param Sets the extended context parameters.
+ * Can only be called on an initialized context.
+ *
+ * @param[in,out] ctx Previously initialized crypto context.
+ * @param[in] param Parameter to be set.
+ * @param[in] value Parameter value.
+ * @param[in] value_len Length of the parameter value.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_ctx_set_param(crypto_ctx_h ctx, crypto_ex_param_e param,
+ const void *value, size_t value_len);
+
+/**
+ * @brief crypto_ctx_get_param Returns the extended context parameters.
+ * Can only be called on an initialized context.
+ *
+ * @param[in] ctx Previously initialized crypto context.
+ * @param[in] param Parameter to be read.
+ * @param[out] value Copy of the parameter value (must be freed with @see crypto_free).
+ * @param[out] value_len Length of the parameter value will be returned here.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_ctx_get_param(const crypto_ctx_h ctx, crypto_ex_param_e param,
+ void **value, size_t *value_len);
+
+/**
+ * @brief crypto_ctx_free Destroys the crypto context. Must be called
+ * on all contexts that are no longer used.
+ * Passing CRYPTO_CTX_NULL is allowed.
+ *
+ * @param[in,out] ctx Crypto context.
+ *
+ */
+void crypto_ctx_free(crypto_ctx_h ctx);
+
+/**
+ * @brief crypto_get_output_length Returns the output length for a given algorithm.
+ * Can only be called on an initialized context.
+ *
+ * @param[in] ctx Previously initialized crypto context.
+ * @param[in] input_len Length of the input data to be processed.
+ *
+ * @return negative on error (@see error.h) or length of output.
+ */
+int crypto_get_output_length(const crypto_ctx_h ctx, size_t input_len);
+
+/**
+ * @brief crypto_get_digest_length Wrapper - returns the length of the digest (for a given context).
+ */
+#define crypto_get_digest_length(ctxa) crypto_get_output_length((ctxa), 0)
+
+/**
+ * @brief crypto_get_sign_length Wrapper - returns the length of the signature (for a given context).
+ */
+#define crypto_get_sign_length(ctxa) crypto_get_output_length((ctxa), 0)
+
+/**
+ * @brief crypto_get_block_length Wrapper - returns the length of the block (for a given context).
+ */
+#define crypto_get_block_length(ctxa) crypto_get_output_length((ctxa), 0)
+
+/**
+ * @brief crypto_get_iv_length Returns the recomended/default length of the IV for a given encryption configuration.
+ *
+ * @param[in] algo Encryption algorithm.
+ * @param[in] bcm Chain mode.
+ * @param[in] len Key length (@see crypto_key_len_e).
+ *
+ * @return negative on error (@see error.h) or the IV length.
+ */
+int crypto_get_iv_length(crypto_enc_algo_e algo,
+ crypto_block_cipher_mode_e bcm,
+ size_t key_len);
+
+/**@}*/
+#ifdef __cplusplus
+} /* extern */
+#endif
+
+#endif /* CRYPTO_H */
--- /dev/null
+/*
+ * Copyright (c) 2016 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Contact: Krzysztof Jackiewicz <k.jackiewicz@samsung.com>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+/**
+ * @file digest.h
+ * @brief
+ */
+
+#ifndef DIGEST_H
+#define DIGEST_H
+
+#include <stddef.h>
+#include <crypto/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @defgroup Advanced-Digest Advanced API for the message digests.
+ *
+ * TODO: extended description and examples.
+ *
+ * @{
+ */
+
+/**
+ * @brief crypto_digest_init Initializes a digest context.
+ *
+ * @param[out] ctx Newly created context (must be freed with @see crypto_ctx_free).
+ * @param[in] algo Digest algorithm that will be used.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_digest_init(crypto_ctx_h *ctx, crypto_digest_algo_e algo);
+
+/**
+ * @brief crypto_digest_update Feeds the data into the message digest algorithm.
+ *
+ * @param[in,out] ctx Context created by @see crypto_digest_init.
+ * @param[in] data Data from which the digest is to be calculated.
+ * @param[in] data_len Length of the data.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_digest_update(crypto_ctx_h ctx, const char *data, size_t data_len);
+
+/**
+ * @brief crypto_digest_final Calculates the final digest.
+ *
+ * @param[in,out] ctx A valid digest context.
+ * @param[out] digest Buffer for the message digest (must be allocated by client, @see crypto_get_digest_length).
+ * @param[out] digest_len Length of the digest, actual number of bytes written will be returned here.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_digest_final(crypto_ctx_h ctx, char *digest, size_t *digest_len);
+
+/**@}*/
+#ifdef __cplusplus
+} /* extern */
+#endif
+
+#endif /* DIGEST_H */
--- /dev/null
+/*
+ * Copyright (c) 2016 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Contact: Krzysztof Jackiewicz <k.jackiewicz@samsung.com>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+/**
+ * @file encrypt.h
+ * @brief
+ */
+
+#ifndef ENCRYPT_H
+#define ENCRYPT_H
+
+#include <stddef.h>
+#include <crypto/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @defgroup Advanced-Encryption-Symmetric Advanced API for the symmetric encryption.
+ *
+ * TODO: extended description and examples.
+ *
+ * TODO: Let's describe how to set additional params (like GCM, CCM)
+ *
+ * @{
+ */
+
+/**
+ * @brief crypto_encrypt_init Initializes an encryption context.
+ *
+ * @param[out] ctx Newly created context (must be freed with @see crypto_ctx_free).
+ * @param[in] algo Encryption algorithm that will be used.
+ * @param[in] bcm Chaining mode that will be used.
+ * @param[in] sym_key Symmetric key that will be used.
+ * @param[in] iv Initialization vector that will be used.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_encrypt_init(crypto_ctx_h *ctx,
+ crypto_enc_algo_e algo,
+ crypto_block_cipher_mode_e bcm,
+ const crypto_key_h sym_key,
+ const crypto_key_h iv);
+
+/**
+ * @brief crypto_encrypt_update Encrypts chunk of the data.
+ *
+ * @param[in,out] ctx Context created by @see crypto_encrypt_init.
+ * @param[in] plain Plain text to be encrypted.
+ * @param[in] plain_len Length of the plain text.
+ * @param[out] cipher Buffer for the encrypted data (must be allocated by client, @see crypto_get_output_length).
+ * @param[out] cipher_len Length of the encrypted data, actual number of bytes written will be returned here.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_encrypt_update(crypto_ctx_h ctx,
+ const char *plain,
+ size_t plain_len,
+ char *cipher,
+ size_t *cipher_len);
+
+/**
+ * @brief crypto_encrypt_final Encrypts the final chunk of the data.
+ *
+ * @param[in,out] ctx A valid encrypt context.
+ * @param[out] cipher Final piece of the encrypted data (must be allocated by client, @see crypto_get_block_length).
+ * @param[out] cipher_len Length of the final piece, actual number of bytes written will be returned here.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_encrypt_final(crypto_ctx_h ctx,
+ char *cipher,
+ size_t *cipher_len);
+
+/**
+ * @brief crypto_decrypt_init Initializes an decryption context.
+ *
+ * @param[out] ctx Newly created context (must be freed with @see crypto_ctx_free).
+ * @param[in] algo Encryption algorithm that was used to encrypt the data.
+ * @param[in] bcm Chaining mode that was used to encrypt the data.
+ * @param[in] sym_key Symmetric key that was used to encrypt the data.
+ * @param[in] iv Initialization vector that was used to encrypt the data.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_decrypt_init(crypto_ctx_h *ctx,
+ crypto_enc_algo_e algo,
+ crypto_block_cipher_mode_e bcm,
+ const crypto_key_h sym_key,
+ const crypto_key_h iv);
+
+/**
+ * @brief crypto_decrypt_update Decrypts chunk of the data.
+ *
+ * @param[in,out] ctx Context created by @see crypto_decrypt_init.
+ * @param[in] cipher Cipher text to be decrypted.
+ * @param[in] cipher_len Length of the cipher text.
+ * @param[out] plain Buffer for the decrypted data (must be allocated by client, @see crypto_get_output_length).
+ * @param[out] plain_len Length of the decrypted data, actual number of bytes written will be returned here.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_decrypt_update(crypto_ctx_h ctx,
+ const char *cipher,
+ size_t cipher_len,
+ char *plain,
+ size_t *plain_len);
+
+/**
+ * @brief crypto_decrypt_final Decrypts the final chunk of the data.
+ *
+ * @param[in,out] ctx A valid decrypt context.
+ * @param[out] plain Final piece of the decrypted data (must be allocated by client, @see crypto_get_block_length).
+ * @param[out] plain_len Length of the final piece, actual number of bytes written will be returned here.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_decrypt_final(crypto_ctx_h ctx,
+ char *plain,
+ size_t *plain_len);
+
+/**@}*/
+
+/**
+ * @defgroup Advanced-Encryption-Asymmetric Advanced API for the asymmetric encryption.
+ *
+ * TODO: extended description and examples.
+ *
+ * TODO: Seal does more than just encrypt. It first generates the encryption key and IV,
+ * then encrypts whole message using this key (and selected symmetric algorithm).
+ * Finally it encrypts symmetric key with public key.
+ *
+ * @{
+ */
+
+/**
+ * @brief crypto_seal_init Initializes an asymmetric encryption context.
+ *
+ * @param[out] ctx Newly created context (must be freed with @see crypto_ctx_free).
+ * @param[in] pub_key Public key of the peer that will receive the encrypted data.
+ * @param[in] algo Symmetric algorithm that will be used.
+ * @param[in] bcm Block chaining mode for the symmetric algorithm.
+ * @param[out] sym_key Generated symmetric key that will be used. It is encrypted with peer's public key.
+ * @param[out] iv Generated initialization vector that will be used.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_seal_init(crypto_ctx_h *ctx,
+ const crypto_key_h pub_key,
+ crypto_enc_algo_e algo,
+ crypto_block_cipher_mode_e bcm,
+ crypto_key_h *sym_key,
+ crypto_key_h *iv);
+
+/**
+ * @brief crypto_seal_update Encrypts piece of the data.
+ *
+ * @param[in,out] ctx Context created by @see crypto_seal_init.
+ * @param[in] plain Plain text to be encrypted.
+ * @param[in] plain_len Length of the plain text.
+ * @param[out] cipher Buffer for the encrypted data (must be allocated by client, @see crypto_get_output_length).
+ * @param[out] cipher_len Length of the encrypted data, actual number of bytes written will be returned here.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_seal_update(crypto_ctx_h ctx,
+ const char *plain,
+ size_t plain_len,
+ char *cipher,
+ size_t *cipher_len);
+
+/**
+ * @brief crypto_seal_final Encrypts the final piece of the data.
+ *
+ * @param[in,out] ctx A valid seal context.
+ * @param[out] cipher Final piece of the encrypted data (must be allocated by client, @see crypto_get_block_length).
+ * @param[out] cipher_len Length of the final piece, actual number of bytes written will be returned here.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_seal_final(crypto_ctx_h ctx,
+ char *cipher,
+ size_t *cipher_len);
+
+/**
+ * @brief crypto_open_init Initializes an asymmetric decryption context.
+ *
+ * @param[out] ctx Newly created context. Must be freed by @see crypto_ctx_free.
+ * @param[in] prv_key Private key, part of the pair that was used for the encryption.
+ * @param[in] algo Symmetric algorithm that was used for the encryption.
+ * @param[in] bcm Block chaining mode for the symmetric algorithm.
+ * @param[in] sym_key Symmetric key, encrypted with the public key, that was used to encrypt the data.
+ * @param[in] iv Initialization vector that was used for the encryption.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_open_init(crypto_ctx_h *ctx,
+ const crypto_key_h prv_key,
+ crypto_enc_algo_e algo,
+ crypto_block_cipher_mode_e bcm,
+ const crypto_key_h sym_key,
+ const crypto_key_h iv);
+
+/**
+ * @brief crypto_open_update Decrypts piece of the data.
+ *
+ * @param[in,out] ctx Context created by @see crypto_open_init.
+ * @param[in] cipher Cipher text to be decrypted.
+ * @param[in] cipher_len Length of the cipher text.
+ * @param[out] plain Buffer for the decrypted data (must be allocated by client, @see crypto_get_output_length).
+ * @param[out] plain_len Length of the decrypted data, actual number of bytes written will be returned here.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_open_update(crypto_ctx_h ctx,
+ const char *cipher,
+ size_t cipher_len,
+ char *plain,
+ size_t *plain_len);
+
+/**
+ * @brief crypto_open_final Decrypts last chunk of sealed message.
+ *
+ * @param[in,out] ctx A valid open context.
+ * @param[out] plain Final piece of the decrypted data (must be allocated by client, @see crypto_get_block_length).
+ * @param[out] plain_len Length of the final piece, actual number of bytes written will be returned here.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_open_final(crypto_ctx_h ctx,
+ char *plain,
+ size_t *plain_len);
+
+/**@}*/
+#ifdef __cplusplus
+} /* extern */
+#endif
+
+#endif /* ENCRYPT_H */
--- /dev/null
+/*
+ * Copyright (c) 2016 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Contact: Krzysztof Jackiewicz <k.jackiewicz@samsung.com>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+/**
+ * @file error.h
+ * @brief
+ */
+
+#ifndef ERROR_H
+#define ERROR_H
+
+/*
+ TODO: Error enums should be placed here
+ */
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef __cplusplus
+} /* extern */
+#endif
+
+#endif /* ERROR_H */
--- /dev/null
+/*
+ * Copyright (c) 2016 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Contact: Krzysztof Jackiewicz <k.jackiewicz@samsung.com>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+/**
+ * @file key.h
+ * @brief
+ */
+
+#ifndef KEY_H
+#define KEY_H
+
+#include <stddef.h>
+#include <crypto/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @defgroup Key Key and IV handling functions
+ *
+ * TODO: extended description and examples.
+ *
+ * @{
+ */
+
+#define CRYPTO_KEY_NULL ((crypto_key_h) NULL)
+
+// TODO: We need a way to import keys encrypted with hw (or other) keys. New function like crypto_key_load or sth??
+
+/**
+ * @brief crypto_key_get_length Get key's length.
+ *
+ * @param[in] key Key which length we return.
+ *
+ * @return negative on error (@see error.h) or key length.
+ */
+int crypto_key_get_length(const crypto_key_h *key);
+
+/**
+ * @brief crypto_key_import Imports a key from the arbitrary format.
+ *
+ * @param[out] key Returned key (must be freed with @see crypto_key_free).
+ * @param[in] key_fmt Format of the key.
+ * @param[in] key_type Type of the key.
+ * @param[in] data Blob containing the key.
+ * @param[in] data_len Size of the blob.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_key_import(crypto_key_h *key,
+ crypto_key_fmt_e key_fmt,
+ crypto_key_type_e key_type,
+ const char *data,
+ size_t data_len);
+
+/**
+ * @brief crypto_key_export Exports a key to arbitrary format. Export may fail if key is HW-based.
+ *
+ * @param[in] key Key to be exported.
+ * @param[in] key_fmt Format of the key.
+ * @param[out] data Data, allocated by the library, containing exported key (must be freed with @see crypto_free).
+ * @param[out] data_len Size of the output data.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_key_export(const crypto_key_h key,
+ crypto_key_fmt_e key_fmt,
+ char **data,
+ size_t *data_len);
+
+// TODO: still a matter of ordering, should the key in key_gen functions be first or last?
+
+/**
+ * @brief crypto_key_gen Generates a secure symmetric key (or an initialization vector).
+ *
+ * @param[out] sym_key Newly generated key (must be freed with @see crypto_key_free).
+ * @param[in] key_type Type of the key to be generated.
+ * @param[in] key_len Length of the key to be generated.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_key_gen(crypto_key_h *sym_key,
+ crypto_key_type_e key_type,
+ size_t key_len);
+
+/**
+ * @brief crypto_key_gen_pair Generates a new key pair.
+ *
+ * @param[out] prv_key Newly generated private key (must be freed with @see crypto_key_free).
+ * @param[out] pub_key Newly generated public key (must be freed with @see crypto_key_free).
+ * @param[in] key_type Type of the key to be generated (must be CRYPTO_KEY_TYPE_PAIR*).
+ * @param[in] key_len Length of the key to be generated.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_key_gen_pair(crypto_key_h *prv_key,
+ crypto_key_h *pub_key,
+ crypto_key_type_e key_type,
+ size_t key_len);
+
+/**
+ * @brief crypto_key_free Frees the key created by the library.
+ * Passing CRYPTO_KEY_NULL is allowed.
+ *
+ * @param key Key to be freed.
+ *
+ */
+void crypto_key_free(crypto_key_h key);
+
+/**@}*/
+
+/**
+ * @defgroup Key-Derivation Key derivation functions
+ *
+ * TODO: rethink separate group.
+ * TODO: extended description and examples.
+ *
+ * @{
+ */
+
+/**
+ * @brief crypto_key_derive_dh Derives a key using Diffie-Helmann or EC Diffie-Helmann key exchange protocol.
+ *
+ * @param[in] prv_key Our private key.
+ * @param[in] pub_key Peer public key.
+ * @param[out] sym_key Shared secret, that can be used as a symmetric key (must be freed with @see crypto_key_free).
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_key_derive_dh(const crypto_key_h prv_key,
+ const crypto_key_h pub_key,
+ crypto_key_h *sym_key);
+
+/**
+ * @brief crypto_key_derive_kea Derives a key using KEA key exchange protocol.
+ *
+ * @param[in] prv_key Our DH private component.
+ * @param[in] pub_key Peers' DH public component.
+ * @param[in] prv_key_auth Our private key used to create signature on our
+ * DH public component sent to peer to verify our identity.
+ * @param[in] pub_key_auth Peers' public key used for signature verification
+ * of pub_key from peer (peer authentication).
+ * @param[out] sym_key Shared secret, that can be used as a symmetric key (must be freed with @see crypto_key_free).
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_key_derive_kea(const crypto_key_h prv_key,
+ const crypto_key_h pub_key,
+ const crypto_key_h prv_key_auth,
+ const crypto_key_h pub_key_auth,
+ crypto_key_h *sym_key);
+
+/**
+ * @brief crypto_key_derive_pbkdf2 Derives a key from user password (PKCS #5 a.k.a. pbkdf2 algorithm).
+ *
+ * @param[in] password User password as a NULL-terminated string.
+ * @param[in] salt Salt, should be non-zero.
+ * @param[in] salt_len Length of the salt.
+ * @param[in] iter Number of iterations. (TODO: add enum to proposed number of iterations, pick sane defaults).
+ * @param[in] algo Digest algorithm that should be used in key generation. (TODO: sane defaults).
+ * @param[in] key_len Length of a key to be generated.
+ * @param[out] key Newly generated key (must be freed with @see crypto_key_free).
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_key_derive_pbkdf2(const char *password,
+ const char *salt,
+ size_t salt_len,
+ int iter,
+ crypto_digest_algo_e algo,
+ crypto_key_len_e key_len,
+ crypto_key_h *key);
+
+// TODO: specify
+//int crypto_key_wrap(crypto_key_h key, ??);
+//int crypto_key_unwrap(crypto_key_h key, ??);
+
+/**@}*/
+#ifdef __cplusplus
+} /* extern */
+#endif
+
+#endif /* KEY_H */
--- /dev/null
+/*
+ * Copyright (c) 2016 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Contact: Krzysztof Jackiewicz <k.jackiewicz@samsung.com>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+/**
+ * @file sign.h
+ * @brief
+ */
+
+#ifndef SIGN_H
+#define SIGN_H
+
+#include <stddef.h>
+#include <crypto/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @defgroup Advanced-Integrity Advanced API for the integrity handling - HMAC, CMAC and digital signature.
+ *
+ * TODO: extended description and examples.
+ * TODO: add documentation how to set padding etc
+ *
+ * @{
+ */
+
+/**
+ * @brief crypto_sign_init Initializes a signature context.
+ *
+ * @param[out] ctx Newly created context (must be freed with @see crypto_ctx_free).
+ * @param[in] algo Digest algorithm that will be used.
+ * @param[in] key Private or symmetric key that will be used (algorithm is deduced based on key type).
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_sign_init(crypto_ctx_h *ctx,
+ crypto_digest_algo_e algo,
+ const crypto_key_h key);
+
+/**
+ * @brief crypto_sign_update Feeds the data into the digital signature algorithm.
+ *
+ * @param[in,out] ctx Context created by @see crypto_sign_init.
+ * @param[in] data Data to be signed.
+ * @param[in] data_len Length of the data.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_sign_update(crypto_ctx_h ctx,
+ const char *data,
+ size_t data_len);
+
+/**
+ * @brief crypto_sign_final Calculates the final signature.
+ *
+ * @param[in,out] ctx A valid sign context.
+ * @param[out] mac Buffer for the MAC or the signature (must be allocated by client, @see crypto_get_sign_length).
+ * @param[out] mac_len Length of the MAC or the signature, actual number of bytes written will be returned here.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_sign_final(crypto_ctx_h ctx,
+ char *mac,
+ size_t *mac_len);
+
+/**
+ * @brief crypto_verify_init Initializes a signature verification context.
+ *
+ * @param[out] ctx Newly created context (must be freed with @see crypto_ctx_free).
+ * @param[in] algo Digest algorithm that will be used.
+ * @param[in] key Private or symmetric key that will be used (algorithm is deduced based on key type).
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_verify_init(crypto_ctx_h *ctx,
+ crypto_digest_algo_e algo,
+ const crypto_key_h key);
+
+/**
+ * @brief crypto_verify_update Feeds the data into the digital signature verification algorithm.
+ *
+ * @param[in,out] ctx Context created by @see crypto_verify_init.
+ * @param[in] data Data to be verified.
+ * @param[in] data_len Length of the data.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_verify_update(crypto_ctx_h ctx,
+ const char *data,
+ size_t data_len);
+
+/**
+ * @brief crypto_verify_final Performs the verification.
+ *
+ * @param[in,out] ctx A valid verify context.
+ * @param[in] mac Input MAC or signature (returned by @see crypto_sign_final).
+ * @param[in] mac_len Size of the MAC or the signature.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ * TODO: CRYTPO_ERROR_SIGNATURE_INVALID when verification fails.
+ */
+int crypto_verify_final(crypto_ctx_h ctx,
+ const char *mac,
+ size_t mac_len);
+
+/**@}*/
+#ifdef __cplusplus
+} /* extern */
+#endif
+
+#endif /* SIGN_H */
--- /dev/null
+/*
+ * Copyright (c) 2016 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Contact: Krzysztof Jackiewicz <k.jackiewicz@samsung.com>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+/**
+ * @file simple.h
+ * @brief
+ */
+
+#ifndef SIMPLE_H
+#define SIMPLE_H
+
+#include <stddef.h>
+#include <crypto/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @defgroup Simple-API Simple API.
+ *
+ * This is simple API.
+ * Design constraints:
+ * - All operations are single-shot (no streaming possible)
+ * - Context is not used
+ * - For now only digest and symmetric ciphers are supported
+ * - GCM chaining is not supported
+ * - All outputs are allocated by the library
+ *
+ * TODO: extended description and examples.
+ *
+ * @{
+ */
+
+/**
+ * @brief crypto_digest_calc Calculate a digest of a buffer.
+ *
+ * @param[in] algo Digest algorithm (select @see CRYPTO_DIGEST_SHA256 if unsure).
+ * @param[in] data Data from which the digest is to be calculated.
+ * @param[in] data_len Length of the data.
+ * @param[out] digest Message digest, will be allocated by the library (should be freed with @see crypto_free).
+ * @param[out] digest_len Length of message digest (depends on algorithm).
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_digest_calc(crypto_digest_algo_e algo,
+ const char *data,
+ size_t data_len,
+ char **digest,
+ size_t *digest_len);
+
+/**
+ * @brief crypto_encrypt Encrypt data using a symmetric cipher.
+ *
+ * @param[in] algo Encryption algorithm (select @see CRYPTO_ENC_AES if unsure).
+ * @param[in] bcm Chaining mode (select @see CRYPTO_BCM_CBC if unsure).
+ * @param[in] sym_key Symmetric encryption key (@see key.h for key generation functions).
+ * @param[in] iv Initialization vector.
+ * @param[in] plain Plain text to be encrypted.
+ * @param[in] plain_len Length of the plain text.
+ * @param[out] cipher Encrypted data, will be allocated by the library (should be freed with @see crypto_free).
+ * @param[out] cipher_len Length of the encrypted data (may be larger than decrypted).
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_encrypt(crypto_enc_algo_e algo,
+ crypto_block_cipher_mode_e bcm,
+ const crypto_key_h sym_key,
+ const crypto_key_h iv,
+ const char *plain,
+ size_t plain_len,
+ char **cipher,
+ size_t *cipher_len);
+
+/**
+ * @brief crypto_decrypt Decrypta data using a symmetric cipher.
+ *
+ * @param[in] algo Decryption algorithm that was used to encrypt the data.
+ * @param[in] bcm Chaining mode that was used to encrypt the data.
+ * @param[in] sym_key Symmetric encryption key that was used to encrypt the data.
+ * @param[in] iv Initialization vector that was used to encrypt the data.
+ * @param[in] cipher Cipher text to be decrypted.
+ * @param[in] cipher_len Length of cipher text.
+ * @param[out] plain Decrypted data, will be allocated by the library (should be freed with @see crypto_free).
+ * @param[out] plain_len Length of the decrypted data.
+ *
+ * @return 0 on success, negative on error (@see error.h).
+ */
+int crypto_decrypt(crypto_enc_algo_e algo,
+ crypto_block_cipher_mode_e bcm,
+ const crypto_key_h sym_key,
+ const crypto_key_h iv,
+ const char *cipher,
+ size_t cipher_len,
+ char **plain,
+ size_t * plain_len);
+
+// TODO: sign/verify
+
+/**@}*/
+#ifdef __cplusplus
+} /* extern */
+#endif
+
+#endif /* SIMPLE_H */
--- /dev/null
+/*
+ * Copyright (c) 2016 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Contact: Krzysztof Jackiewicz <k.jackiewicz@samsung.com>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+/**
+ * @file types.h
+ * @brief
+ */
+
+#ifndef TYPES_H
+#define TYPES_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @defgroup Crypto-Types Enumerations for CryptoAPI
+ *
+ * TODO: extended description.
+ *
+ * @{
+ */
+
+/**
+ * @brief Context
+ */
+typedef struct __crypto_ctx *crypto_ctx_h;
+
+/**
+ * @brief Key
+ */
+typedef struct __crypto_key_s *crypto_key_h;
+
+/**
+ * @brief Key formats
+ */
+typedef enum {
+ CRYPTO_KEY_FORMAT_RAW, /**< key is in clear format */
+ CRYPTO_KEY_FORMAT_BASE64, /**< key is encoded in ASCII-base64 */
+ CRYPTO_KEY_FORMAT_PEM, /**< key is in PEM file format */
+ CRYPTO_KEY_FORMAT_DER /**< key is in DER file format */
+} crypto_key_fmt_e;
+
+/**
+ * @brief Key types, IV is considered as key
+ */
+typedef enum {
+ CRYPTO_KEY_TYPE_SYMMETRIC, /**< Generic symmetric cipher KEY */
+ CRYPTO_KEY_TYPE_DES, /**< DES* key - must be handled differently because of parity bits */
+ CRYPTO_KEY_TYPE_IV, /**< IV for symmetric algorithms */
+
+ CRYPTO_KEY_TYPE_RSA_PUB, /**< RSA public key */
+ CRYPTO_KEY_TYPE_RSA_PRIV, /**< RSA private key */
+
+ CRYPTO_KEY_TYPE_DSA_PUB, /**< DSA public key */
+ CRYPTO_KEY_TYPE_DSA_PRIV, /**< DSA private key */
+
+ CRYPTO_KEY_TYPE_DH_PUB, /**< Diffie-Hellman public key */
+ CRYPTO_KEY_TYPE_DH_PRIV, /**< Diffie-Hellman private key */
+
+ CRYPTO_KEY_TYPE_ECC_PUB, /**< ECC public key */
+ CRYPTO_KEY_TYPE_ECC_PRIV, /**< ECC private key */
+
+ CRYPTO_KEY_TYPE_PAIR_RSA, /**< Pair of RSA keys */
+ CRYPTO_KEY_TYPE_PAIR_DSA, /**< Pair of DSA keys */
+ CRYPTO_KEY_TYPE_PAIR_DH, /**< Pair of Diffie-Hellman keys */
+ CRYPTO_KEY_TYPE_PAIR_ECC /**< Pair of ECC keys */
+} crypto_key_type_e;
+
+/**
+ * @brief Key length, It is possible to use arbitrary integer instead, this enums are placed here to avoid magic numbers.
+ */
+typedef enum {
+ CRYPTO_KEY_IV_UNSAFE_24BIT = 24, /**< 24-bit IV */
+ CRYPTO_KEY_IV_64BIT = 64, /**< 64-bit IV */
+ CRYPTO_KEY_IV_128BIT = 128, /**< 128-bit IV */
+ CRYPTO_KEY_IV_256BIT = 256, /**< 256-bit IV */
+ CRYPTO_KEY_CURVE_P192 = 192, /**< ECC: P192 curve */
+ CRYPTO_KEY_CURVE_P256 = 256, /**< ECC: P-256 curve */
+ CRYPTO_KEY_CURVE_P384 = 384, /**< ECC: SECP-384 curve */
+ CRYPTO_KEY_UNSAFE_40BIT = 40,
+ CRYPTO_KEY_UNSAFE_56BIT = 56,
+ CRYPTO_KEY_UNSAFE_80BIT = 80,
+ CRYPTO_KEY_UNSAFE_112BIT = 112,
+ CRYPTO_KEY_UNSAFE_128BIT = 128,
+ CRYPTO_KEY_192BIT = 192,
+ CRYPTO_KEY_256BIT = 256,
+ CRYPTO_KEY_512BIT = 512,
+ CRYPTO_KEY_1024BIT = 1024,
+ CRYPTO_KEY_2048BIT = 2048,
+ CRYPTO_KEY_3072BIT = 3072,
+ CRYPTO_KEY_4096BIT = 4096
+} crypto_key_len_e;
+
+/**
+ * @brief Message digest algorithms. CMAC is included to simplify API
+ */
+typedef enum {
+ CRYPTO_DIGEST_MD5, /**< Message digest algorithm MD5 */
+ CRYPTO_DIGEST_SHA1, /**< Message digest algorithm SHA1 */
+ CRYPTO_DIGEST_SHA224, /**< Message digest algorithm SHA2, 224bit */
+ CRYPTO_DIGEST_SHA256, /**< Message digest algorithm SHA2, 256bit */
+ CRYPTO_DIGEST_SHA384, /**< Message digest algorithm SHA2, 384bit */
+ CRYPTO_DIGEST_SHA512, /**< Message digest algorithm SHA2, 512bit */
+ CRYPTO_DIGEST_CMAC /**< TODO: perhaps CMAC should be handled differently */
+} crypto_digest_algo_e;
+
+/**
+ * @brief Symmetric encryption algorithms
+ */
+typedef enum {
+ CRYPTO_ENC_AES = 0, /**< AES encryption.
+ - see #crypto_block_cipher_mode_e for details on additional parameters (mandatory)
+ Supported key lengths: @c 128, @c 192 and @c 256 */
+
+ CRYPTO_ENC_UNSAFE_DES, /**< DES encryption.
+ - see #crypto_block_cipher_mode_e for details on additional parameters (mandatory)
+ Supported key lengths: @c 56 */
+
+ CRYPTO_ENC_UNSAFE_3DES_2TDEA, /**< 3DES 2-key encryption.
+ - see #crypto_block_cipher_mode_e for details on additional parameters (mandatory)
+ Use double DES keys to perform corresponding 2-key 3DES encryption. Supported key lengths: @c 112 */
+
+ CRYPTO_ENC_3DES_3TDEA, /**< 3DES 3-key encryption.
+ - see #crypto_block_cipher_mode_e for details on additional parameters (mandatory)
+ Use triple DES keys to perform corresponding 3-key 3DES encryption. Supported key lengths: @c 168 */
+
+ CRYPTO_ENC_UNSAFE_RC2, /**< RC2 encryption.
+ - see #crypto_block_cipher_mode_e for details on additional parameters (mandatory)
+ The key length is extracted from the key buffer. Supported key lengths: 8-1024 bits in steps of 8 bits. */
+
+ CRYPTO_ENC_UNSAFE_RC4, /**< RC4 encryption.
+ The key length is extracted from the key buffer. Supported key lengths: 40–2048 bits in steps of 8 bits */
+
+ CRYPTO_ENC_CAST5, /**< CAST5 encryption.
+ - see #crypto_block_cipher_mode_e for details on additional parameters (mandatory)
+ The key length is extracted from the key buffer. Supported key lengths: 40-128 bits in steps of 8 bits */
+
+ CRYPTO_ENC_UNSAFE_SKIPJACK /**< SKIPJACK algorithm
+ - see #crypto_block_cipher_mode_e for details on additional parameters (mandatory)
+ Supported key length: 80 bits */
+} crypto_enc_algo_e;
+
+/**
+ * @brief Chaining modes for block ciphers
+ */
+typedef enum {
+ CRYPTO_BCM_ECB, /**< ECB block cipher mode. Encrypts 64 bit at a time. No IV is used. */
+
+ CRYPTO_BCM_CTR, /**< CTR block cipher mode. 16-byte initialization vector is mandatory.
+ Supported parameters:
+ - CRYPTO_PARAM_CTR_CNT = length of counter block in bits
+ (optional, only 128b is supported at the moment) */
+
+ CRYPTO_BCM_CBC, /**< CBC block cipher mode. 16-byte initialization vector is mandatory. */
+
+ CRYPTO_BCM_GCM, /**< GCM block cipher mode. IV is needed.
+ Supported parameters:
+ - CRYPTO_PARAM_TAG = GCM tag
+ - CRYPTO_PARAM_AAD = additional authentication data(optional) */
+
+ CRYPTO_BCM_CFB, /**< CFB block cipher mode. 16-byte initialization vector is mandatory. */
+
+ CRYPTO_BCM_OFB, /**< OFB block cipher mode. 16-byte initialization vector is mandatory. */
+
+ CRYPTO_BCM_OCB, /**< Offest Codebook Mode (AES) */
+
+ CRYPTO_BCM_CCM /**< CBC-MAC Mode (AES) */
+
+} crypto_block_cipher_mode_e;
+
+
+/**
+ * @brief Non-standard parameters for algorithms
+ */
+typedef enum {
+ CRYPTO_PARAM_PADDING, /**< Padding */
+
+ CRYPTO_PARAM_CTR_CNT, /**< CTR Counter bits */
+
+ CRYPTO_PARAM_GCM_AAD, /**< GCM Additional Authentication Data */
+ CRYPTO_PARAM_GCM_TAG, /**< GCM Tag bits */
+ CRYPTO_PARAM_GCM_TAG_LEN, /**< GCM Tag length */
+
+ CRYPTO_PARAM_CCM_AAD, /**< CCM Additional Authentication Data */
+ CRYPTO_PARAM_CCM_TAG, /**< CCM Tag bits */
+ CRYPTO_PARAM_CCM_TAG_LEN, /**< CCM Tag length */
+} crypto_ex_param_e;
+
+/**
+ * @brief Paddings supported by CryptoAPI
+ */
+typedef enum {
+ CRYPTO_PADDING_NONE = 0, /**< total number of data MUST multiple of block size, Default */
+ CRYPTO_PADDING_ZEROS, /**< pad with zeros */
+ CRYPTO_PADDING_ISO10126, /**< ISO 10126 */
+ CRYPTO_PADDING_ANSIX923, /**< ANSI X.923 padding*/
+ CRYPTO_PADDING_ANSIX931, /**< ANSI X.931 padding*/
+ CRYPTO_PADDING_PKCS1, /**< RSA signature creation */
+ CRYPTO_PADDING_PKCS7 /**< Byte padding for symetric algos (RFC 5652), (PKCS5 padding is the same) */
+} crypto_padding_e;
+
+/**@}*/
+#ifdef __cplusplus
+} /* extern */
+#endif
+
+#endif /* TYPES_H */
projects / platform / core / security / yaca.git / commitdiff