yaca_key import/export API change - passwords

Change-Id: Ifcc7c3eca1323cb4418190867bedf1a197b08f73

diff --git a/api/yaca/error.h b/api/yaca/error.h
index 55656bd..acdc2cb 100644 (file)
--- a/api/yaca/error.h
+++ b/api/yaca/error.h
@@ -43,7 +43,8 @@ enum __yaca_error_code {
        YACA_ERROR_INTERNAL           = -3,
        YACA_ERROR_TOO_BIG_ARGUMENT   = -4,
        YACA_ERROR_OUT_OF_MEMORY      = -5,
-       YACA_ERROR_SIGNATURE_INVALID  = -6
+       YACA_ERROR_SIGNATURE_INVALID  = -6,
+       YACA_ERROR_PASSWORD_INVALID   = -7,
 };
 
 // TODO disable debug function in release?

diff --git a/api/yaca/key.h b/api/yaca/key.h
index ce69f21..d6a34d2 100644 (file)
--- a/api/yaca/key.h
+++ b/api/yaca/key.h
@@ -67,16 +67,23 @@ int yaca_key_get_bits(const yaca_key_h key);
  * format. Additionally it is possible to import public RSA key from
  * X509 certificate.
  *
+ * If the key is encrypted the algorithm will be autodetected and password
+ * used. If it's not known if the key is encrypted one should pass NULL as
+ * password and check for the YACA_ERROR_PASSWORD_INVALID return code.
+ *
  * @param[out] key       Returned key (must be freed with yaca_key_free()).
  * @param[in]  key_type  Type of the key.
+ * @param[in]  password  null terminated password for the key (can be NULL).
  * @param[in]  data      Blob containing the key.
  * @param[in]  data_len  Size of the blob.
  *
- * @return 0 on success, negative on error.
+ * @return 0 on success, YACA_ERROR_PASSWORD_INVALID if wrong password given,
+ *         negative on error.
  * @see #yaca_key_type_e, yaca_key_export(), yaca_key_free()
  */
 int yaca_key_import(yaca_key_h *key,
                     yaca_key_type_e key_type,
+                    const char *password,
                     const char *data,
                     size_t data_len);
 
@@ -96,9 +103,16 @@ int yaca_key_import(yaca_key_h *key,
  * - #YACA_KEY_FILE_FORMAT_PEM:    used only for asymmetric, PEM file format
  * - #YACA_KEY_FILE_FORMAT_DER:    used only for asymmetric, DER file format
  *
+ * If no password is provided the exported key will be unencrypted. Only private
+ * RSA/DSA exported as PEM can be encrypted.
+ *
+ * TODO: document the default encryption algorithm (AES256 for FORMAT_DEFAULT,
+ * unknown yet for the FORMAT_PKCS8)
+ *
  * @param[in]  key           Key to be exported.
  * @param[in]  key_fmt       Format of the key.
  * @param[in]  key_file_fmt  Format of the key file.
+ * @param[in]  password      Password used for the encryption (can be NULL).
  * @param[out] data          Data, allocated by the library, containing exported key
  *                           (must be freed with yaca_free()).
  * @param[out] data_len      Size of the output data.
@@ -109,6 +123,7 @@ int yaca_key_import(yaca_key_h *key,
 int yaca_key_export(const yaca_key_h key,
                     yaca_key_fmt_e key_fmt,
                     yaca_key_file_fmt_e key_file_fmt,
+                    const char *password,
                     char **data,
                     size_t *data_len);
 

diff --git a/examples/encrypt_aes_gcm.c b/examples/encrypt_aes_gcm.c
index 9fc1234..86da336 100644 (file)
--- a/examples/encrypt_aes_gcm.c
+++ b/examples/encrypt_aes_gcm.c
@@ -71,7 +71,7 @@ void encrypt_decrypt_aes_gcm(void)
                goto clean;
 
        // generate and export aad?
-       ret = yaca_key_export(aad_key, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_RAW, &aad, &aad_len);
+       ret = yaca_key_export(aad_key, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_RAW, NULL, &aad, &aad_len);
        if (ret < 0)
                goto clean;
 

diff --git a/examples/key_exchange.c b/examples/key_exchange.c
index b3e4f05..9464732 100644 (file)
--- a/examples/key_exchange.c
+++ b/examples/key_exchange.c
@@ -69,7 +69,7 @@ void key_exchange_dh(void)
        if (1 != fread(buffer, size, 1, fp))
                goto clean;
 
-       ret = yaca_key_import(&peer_key, YACA_KEY_TYPE_DH_PUB,
+       ret = yaca_key_import(&peer_key, YACA_KEY_TYPE_DH_PUB, NULL,
                              buffer, size);
        if (ret < 0)
                goto clean;
@@ -129,7 +129,7 @@ void key_exchange_ecdh(void)
        if (1 != fread(buffer, size, 1, fp))
                goto clean;
 
-       ret = yaca_key_import(&peer_key, YACA_KEY_TYPE_ECDH_PUB, buffer, size);
+       ret = yaca_key_import(&peer_key, YACA_KEY_TYPE_ECDH_PUB, NULL, buffer, size);
        if (ret < 0)
                goto clean;
 

diff --git a/examples/key_import_export.c b/examples/key_import_export.c
index 1c4db07..9d005c2 100644 (file)
--- a/examples/key_import_export.c
+++ b/examples/key_import_export.c
@@ -46,10 +46,10 @@ int key_import_export_sym(yaca_key_h sym)
 
        /* BASE64 */
 
-       ret = yaca_key_export(sym, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_BASE64, &b64, &b64_len);
+       ret = yaca_key_export(sym, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_BASE64, NULL, &b64, &b64_len);
        if (ret != 0)
                return ret;
-       ret = yaca_key_import(&b64_imported, YACA_KEY_TYPE_SYMMETRIC, b64, b64_len);
+       ret = yaca_key_import(&b64_imported, YACA_KEY_TYPE_SYMMETRIC, NULL, b64, b64_len);
        if (ret != 0)
                goto free;
 
@@ -57,7 +57,7 @@ int key_import_export_sym(yaca_key_h sym)
        yaca_free(b64);
        b64 = NULL;
 
-       ret = yaca_key_export(b64_imported, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_BASE64, &b64, &b64_len);
+       ret = yaca_key_export(b64_imported, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_BASE64, NULL, &b64, &b64_len);
        if (ret != 0)
                goto free;
 
@@ -66,10 +66,10 @@ int key_import_export_sym(yaca_key_h sym)
 
        /* RAW */
 
-       ret = yaca_key_export(sym, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_RAW, &raw, &raw_len);
+       ret = yaca_key_export(sym, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_RAW, NULL, &raw, &raw_len);
        if (ret != 0)
                goto free;
-       ret = yaca_key_import(&raw_imported, YACA_KEY_TYPE_SYMMETRIC, raw, raw_len);
+       ret = yaca_key_import(&raw_imported, YACA_KEY_TYPE_SYMMETRIC, NULL, raw, raw_len);
        if (ret != 0)
                goto free;
 
@@ -77,7 +77,7 @@ int key_import_export_sym(yaca_key_h sym)
        yaca_free(raw);
        raw = NULL;
 
-       ret = yaca_key_export(raw_imported, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_RAW, &raw, &raw_len);
+       ret = yaca_key_export(raw_imported, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_RAW, NULL, &raw, &raw_len);
        if (ret != 0)
                goto free;
 
@@ -118,10 +118,10 @@ int key_import_export_asym(yaca_key_h priv, yaca_key_h pub,
 
        /* PEM private */
 
-       ret = yaca_key_export(priv, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_PEM, &pem_prv, &pem_prv_len);
+       ret = yaca_key_export(priv, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_PEM, NULL, &pem_prv, &pem_prv_len);
        if (ret != 0)
                return ret;
-       ret = yaca_key_import(&pem_prv_imported, priv_type, pem_prv, pem_prv_len);
+       ret = yaca_key_import(&pem_prv_imported, priv_type, NULL, pem_prv, pem_prv_len);
        if (ret != 0)
                goto free;
 
@@ -129,7 +129,7 @@ int key_import_export_asym(yaca_key_h priv, yaca_key_h pub,
        yaca_free(pem_prv);
        pem_prv = NULL;
 
-       ret = yaca_key_export(pem_prv_imported, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_PEM, &pem_prv, &pem_prv_len);
+       ret = yaca_key_export(pem_prv_imported, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_PEM, NULL, &pem_prv, &pem_prv_len);
        if (ret != 0)
                goto free;
 
@@ -138,10 +138,10 @@ int key_import_export_asym(yaca_key_h priv, yaca_key_h pub,
 
        /* DER private */
 
-       ret = yaca_key_export(priv, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_DER, &der_prv, &der_prv_len);
+       ret = yaca_key_export(priv, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_DER, NULL, &der_prv, &der_prv_len);
        if (ret != 0)
                goto free;
-       ret = yaca_key_import(&der_prv_imported, priv_type, der_prv, der_prv_len);
+       ret = yaca_key_import(&der_prv_imported, priv_type, NULL, der_prv, der_prv_len);
        if (ret != 0)
                goto free;
 
@@ -149,7 +149,7 @@ int key_import_export_asym(yaca_key_h priv, yaca_key_h pub,
        yaca_free(der_prv);
        der_prv = NULL;
 
-       ret = yaca_key_export(der_prv_imported, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_DER, &der_prv, &der_prv_len);
+       ret = yaca_key_export(der_prv_imported, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_DER, NULL, &der_prv, &der_prv_len);
        if (ret != 0)
                goto free;
 
@@ -158,10 +158,10 @@ int key_import_export_asym(yaca_key_h priv, yaca_key_h pub,
 
        /* PEM public */
 
-       ret = yaca_key_export(pub, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_PEM, &pem_pub, &pem_pub_len);
+       ret = yaca_key_export(pub, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_PEM, NULL, &pem_pub, &pem_pub_len);
        if (ret != 0)
                goto free;
-       ret = yaca_key_import(&pem_pub_imported, pub_type, pem_pub, pem_pub_len);
+       ret = yaca_key_import(&pem_pub_imported, pub_type, NULL, pem_pub, pem_pub_len);
        if (ret != 0)
                goto free;
 
@@ -169,7 +169,7 @@ int key_import_export_asym(yaca_key_h priv, yaca_key_h pub,
        yaca_free(pem_pub);
        pem_pub = NULL;
 
-       ret = yaca_key_export(pem_pub_imported, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_PEM, &pem_pub, &pem_pub_len);
+       ret = yaca_key_export(pem_pub_imported, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_PEM, NULL, &pem_pub, &pem_pub_len);
        if (ret != 0)
                goto free;
 
@@ -178,10 +178,10 @@ int key_import_export_asym(yaca_key_h priv, yaca_key_h pub,
 
        /* DER public */
 
-       ret = yaca_key_export(pub, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_DER, &der_pub, &der_pub_len);
+       ret = yaca_key_export(pub, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_DER, NULL, &der_pub, &der_pub_len);
        if (ret != 0)
                goto free;
-       ret = yaca_key_import(&der_pub_imported, pub_type, der_pub, der_pub_len);
+       ret = yaca_key_import(&der_pub_imported, pub_type, NULL, der_pub, der_pub_len);
        if (ret != 0)
                goto free;
 
@@ -189,7 +189,7 @@ int key_import_export_asym(yaca_key_h priv, yaca_key_h pub,
        yaca_free(der_pub);
        der_pub = NULL;
 
-       ret = yaca_key_export(der_pub_imported, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_DER, &der_pub, &der_pub_len);
+       ret = yaca_key_export(der_pub_imported, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_DER, NULL, &der_pub, &der_pub_len);
        if (ret != 0)
                goto free;
 
@@ -225,14 +225,14 @@ int key_import_x509(void)
                return ret;
        }
 
-       ret = yaca_key_import(&rsa_pub_from_cert, YACA_KEY_TYPE_RSA_PUB, pub, pub_len);
+       ret = yaca_key_import(&rsa_pub_from_cert, YACA_KEY_TYPE_RSA_PUB, NULL, pub, pub_len);
        if (ret != 0)
                goto free;
 
        yaca_free(pub);
        pub = NULL;
 
-       ret = yaca_key_export(rsa_pub_from_cert, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_PEM, &pub, &pub_len);
+       ret = yaca_key_export(rsa_pub_from_cert, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_PEM, NULL, &pub, &pub_len);
        if (ret != 0)
                goto free;
 

diff --git a/examples/test.c b/examples/test.c
index 6f1bdf4..4e6f7f0 100644 (file)
--- a/examples/test.c
+++ b/examples/test.c
@@ -45,7 +45,7 @@ int main(int argc, char* argv[])
        printf("done (%d)\n", ret);
 
        printf("Exporting key using CryptoAPI.. ");
-       ret = yaca_key_export(key, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_RAW, &k, &kl);
+       ret = yaca_key_export(key, YACA_KEY_FORMAT_DEFAULT, YACA_KEY_FILE_FORMAT_RAW, NULL, &k, &kl);
        if (ret < 0)
                return ret;
        printf("done (%d)\n", ret);

diff --git a/src/key.c b/src/key.c
index bb6bc32..c906d5a 100644 (file)
--- a/src/key.c
+++ b/src/key.c
@@ -850,6 +850,7 @@ API int yaca_key_get_bits(const yaca_key_h key)
 
 API int yaca_key_import(yaca_key_h *key,
                         yaca_key_type_e key_type,
+                        const char *password,
                         const char *data,
                         size_t data_len)
 {
@@ -881,6 +882,7 @@ API int yaca_key_import(yaca_key_h *key,
 API int yaca_key_export(const yaca_key_h key,
                         yaca_key_fmt_e key_fmt,
                         yaca_key_file_fmt_e key_file_fmt,
+                        const char *password,
                         char **data,
                         size_t *data_len)
 {