Add ML-KEM (en/de)capsulation sw-backend implementation

Change-Id: I50f72fec57e89f8898ff904d94a77236f131506f

diff --git a/src/include/ckm/ckm-manager.h b/src/include/ckm/ckm-manager.h
index 9bc04f4e5bf44046aebf63d64ef6e70d5e68dd60..9b7994f781c014ad2c2efcf1f000e9fc2f30a860 100644 (file)
--- a/src/include/ckm/ckm-manager.h
+++ b/src/include/ckm/ckm-manager.h
@@ -216,6 +216,20 @@ public:
                                                           const Policy &policy,
                                                           RawBuffer &data);
 
+       int encapsulateKey(const CryptoAlgorithm &params,
+                                          const Alias &publicKeyAlias,
+                                          const Password &publicKeyPassword,
+                                          const Alias &sharedSecretAlias,
+                                          const Policy &sharedSecretPolicy,
+                                          RawBuffer &ciphertext);
+
+       int decapsulateKey(const CryptoAlgorithm &params,
+                                          const Alias &privateKeyAlias,
+                                          const Password &privateKeyPassword,
+                                          const Alias &sharedSecretAlias,
+                                          const Policy &sharedSecretPolicy,
+                                          const RawBuffer &ciphertext);
+
        int initializeCipher(const CryptoAlgorithm &params,
                                                 const Alias &keyAlias,
                                                 const Password &keyPassword,

diff --git a/src/manager/client-capi/ckmc-manager.cpp b/src/manager/client-capi/ckmc-manager.cpp
index aee627f45f48354a146ab2c506d88766eb28fc52..49fcbb3e3136549a5904acbcb04ff18093972702 100644 (file)
--- a/src/manager/client-capi/ckmc-manager.cpp
+++ b/src/manager/client-capi/ckmc-manager.cpp
@@ -1396,14 +1396,35 @@ int ckmc_encapsulate_key(const ckmc_param_list_h params,
                          const ckmc_policy_s shared_secret_policy,
                          ckmc_raw_buffer_s **ppciphertext)
 {
-       (void) params;
-       (void) public_key_alias;
-       (void) public_key_password;
-       (void) shared_secret_alias;
-       (void) shared_secret_policy;
-       (void) ppciphertext;
+       EXCEPTION_GUARD_START_CAPI
 
-       return CKMC_ERROR_NONE;
+       if (params == nullptr || public_key_alias == nullptr ||
+               shared_secret_alias == nullptr || ppciphertext == nullptr)
+               return CKMC_ERROR_INVALID_PARAMETER;
+
+       const CKM::CryptoAlgorithm *ca = reinterpret_cast<const CKM::CryptoAlgorithm *>
+                                                                        (params);
+
+       int ret = 0;
+       CKM::RawBuffer ciphertextBuffer;
+       auto mgr = CKM::Manager::create();
+
+       ret = to_ckmc_error(
+               mgr->encapsulateKey(*ca,
+                                                       CKM::Alias(public_key_alias),
+                                                       _tostring(public_key_password),
+                                                       CKM::Alias(shared_secret_alias),
+                                                       _toCkmPolicy(shared_secret_policy),
+                                                       ciphertextBuffer));
+
+       if (ret == CKMC_ERROR_NONE) {
+               ret = ckmc_buffer_new(ciphertextBuffer.data(),
+                                                         ciphertextBuffer.size(),
+                                                         ppciphertext);
+       }
+
+       return ret;
+       EXCEPTION_GUARD_END
 }
 
 KEY_MANAGER_CAPI
@@ -1414,14 +1435,28 @@ int ckmc_decapsulate_key(const ckmc_param_list_h params,
                          const ckmc_policy_s shared_secret_policy,
                          const ckmc_raw_buffer_s *ciphertext)
 {
-       (void) params;
-       (void) private_key_alias;
-       (void) private_key_password;
-       (void) shared_secret_alias;
-       (void) shared_secret_policy;
-       (void) ciphertext;
+       EXCEPTION_GUARD_START_CAPI
 
-       return CKMC_ERROR_NONE;
+       if (params == nullptr || private_key_alias == nullptr ||
+               shared_secret_alias == nullptr || ciphertext == nullptr)
+               return CKMC_ERROR_INVALID_PARAMETER;
+
+       const CKM::CryptoAlgorithm *ca = reinterpret_cast<const CKM::CryptoAlgorithm *>
+                                                                        (params);
+
+       int ret = 0;
+       auto mgr = CKM::Manager::create();
+
+       ret = to_ckmc_error(
+               mgr->decapsulateKey(*ca,
+                                                       CKM::Alias(private_key_alias),
+                                                       _tostring(private_key_password),
+                                                       CKM::Alias(shared_secret_alias),
+                                                       _toCkmPolicy(shared_secret_policy),
+                                                       CKM::RawBuffer(ciphertext->data, ciphertext->data + ciphertext->size)));
+
+       return ret;
+       EXCEPTION_GUARD_END
 }
 
 KEY_MANAGER_CAPI

diff --git a/src/manager/client-capi/ckmc-type.cpp b/src/manager/client-capi/ckmc-type.cpp
index f0a137aacb197caeb28205418ca9be0d5d8ad2f9..98dc6314a1857c57dcc01515134aa0e5c8725f28 100644 (file)
--- a/src/manager/client-capi/ckmc-type.cpp
+++ b/src/manager/client-capi/ckmc-type.cpp
@@ -849,6 +849,7 @@ int ckmc_generate_new_params(ckmc_algo_type_e type, ckmc_param_list_h *pparams)
 
        case CKMC_ALGO_KBKDF:
        case CKMC_ALGO_ECDH:
+       case CKMC_ALGO_KEM:
                break;
 
        default:

diff --git a/src/manager/client/client-manager-impl.cpp b/src/manager/client/client-manager-impl.cpp
index e60c49811a292ab2cd4256dfb9cad8462d3f8a91..56e2de22fa060f3f5cbe81aacfa9086f4890cffe 100644 (file)
--- a/src/manager/client/client-manager-impl.cpp
+++ b/src/manager/client/client-manager-impl.cpp
@@ -908,6 +908,61 @@ int Manager::Impl::unwrapConcatenatedData(const CryptoAlgorithm &params,
        EXCEPTION_GUARD_END
 }
 
+int Manager::Impl::encapsulateKey(const CryptoAlgorithm &params,
+                                                                 const Alias &publicKeyAlias,
+                                                                 const Password &publicKeyPassword,
+                                                                 const Alias &sharedSecretAlias,
+                                                                 const Policy &sharedSecretPolicy,
+                                                                 RawBuffer &ciphertext)
+{
+       EXCEPTION_GUARD_START_CPPAPI
+
+       AliasSupport keyAliasHelper(publicKeyAlias);
+       AliasSupport secretAliasHelper(sharedSecretAlias);
+
+       return Request(*this,
+               LogicCommand::ENCAPSULATE_KEY,
+               m_extendedConnection,
+               CryptoAlgorithmSerializable(params),
+               keyAliasHelper.getName(),
+               keyAliasHelper.getOwner(),
+               publicKeyPassword,
+               secretAliasHelper.getName(),
+               secretAliasHelper.getOwner(),
+               PolicySerializable(sharedSecretPolicy)
+       ).maybeDeserialize(ciphertext);
+
+       EXCEPTION_GUARD_END
+}
+
+int Manager::Impl::decapsulateKey(const CryptoAlgorithm &params,
+                                                                 const Alias &privateKeyAlias,
+                                                                 const Password &privateKeyPassword,
+                                                                 const Alias &sharedSecretAlias,
+                                                                 const Policy &sharedSecretPolicy,
+                                                                 const RawBuffer &ciphertext)
+{
+       EXCEPTION_GUARD_START_CPPAPI
+
+       AliasSupport keyAliasHelper(privateKeyAlias);
+       AliasSupport secretAliasHelper(sharedSecretAlias);
+
+       return Request(*this,
+               LogicCommand::DECAPSULATE_KEY,
+               m_extendedConnection,
+               CryptoAlgorithmSerializable(params),
+               keyAliasHelper.getName(),
+               keyAliasHelper.getOwner(),
+               privateKeyPassword,
+               secretAliasHelper.getName(),
+               secretAliasHelper.getOwner(),
+               PolicySerializable(sharedSecretPolicy),
+               ciphertext
+       ).maybeDeserialize();
+
+       EXCEPTION_GUARD_END
+}
+
 int Manager::Impl::initializeCipher(
        const CryptoAlgorithm &params,
        const Alias &keyAlias,

diff --git a/src/manager/client/client-manager-impl.h b/src/manager/client/client-manager-impl.h
index c78b91d9f45d73c4f5bded749385d7e205e7072d..88969a3dba8d7d3af2a57e21bc7433bc78317590 100644 (file)
--- a/src/manager/client/client-manager-impl.h
+++ b/src/manager/client/client-manager-impl.h
@@ -181,6 +181,20 @@ public:
                                                           const Policy &policy,
                                                           RawBuffer &data);
 
+       int encapsulateKey(const CryptoAlgorithm &params,
+                                          const Alias &publicKeyAlias,
+                                          const Password &publicKeyPassword,
+                                          const Alias &sharedSecretAlias,
+                                          const Policy &sharedSecretPolicy,
+                                          RawBuffer &ciphertext);
+
+       int decapsulateKey(const CryptoAlgorithm &params,
+                                          const Alias &privateKeyAlias,
+                                          const Password &privateKeyPassword,
+                                          const Alias &sharedSecretAlias,
+                                          const Policy &sharedSecretPolicy,
+                                          const RawBuffer &ciphertext);
+
        int initializeCipher(const CryptoAlgorithm &params,
                                                 const Alias &keyAlias,
                                                 const Password &keyPassword,

diff --git a/src/manager/client/client-manager.cpp b/src/manager/client/client-manager.cpp
index 2aa26dd6843a89eebe932fb7d3a5c53bbea54358..dc1c065b09de305a8f0caaf7858f735593d77803 100644 (file)
--- a/src/manager/client/client-manager.cpp
+++ b/src/manager/client/client-manager.cpp
@@ -387,6 +387,40 @@ int Manager::unwrapConcatenatedData(
        );
 }
 
+int Manager::encapsulateKey(const CryptoAlgorithm &params,
+                                                       const Alias &publicKeyAlias,
+                                                       const Password &publicKeyPassword,
+                                                       const Alias &sharedSecretAlias,
+                                                       const Policy &sharedSecretPolicy,
+                                                       RawBuffer &ciphertext)
+{
+       return m_impl->encapsulateKey(
+               params,
+               publicKeyAlias,
+               publicKeyPassword,
+               sharedSecretAlias,
+               sharedSecretPolicy,
+               ciphertext
+       );
+}
+
+int Manager::decapsulateKey(const CryptoAlgorithm &params,
+                                                       const Alias &privateKeyAlias,
+                                                       const Password &privateKeyPassword,
+                                                       const Alias &sharedSecretAlias,
+                                                       const Policy &sharedSecretPolicy,
+                                                       const RawBuffer &ciphertext)
+{
+       return m_impl->decapsulateKey(
+               params,
+               privateKeyAlias,
+               privateKeyPassword,
+               sharedSecretAlias,
+               sharedSecretPolicy,
+               ciphertext
+       );
+}
+
 int Manager::initializeCipher(
        const CryptoAlgorithm &params,
        const Alias &keyAlias,

diff --git a/src/manager/common/protocols.h b/src/manager/common/protocols.h
index 047a77fc14c53e52f19b28d4b3c08a944ad210c1..072967984b0c03b6cf524af1ed82d8885cb65bd7 100644 (file)
--- a/src/manager/common/protocols.h
+++ b/src/manager/common/protocols.h
@@ -74,7 +74,9 @@ enum class LogicCommand : int {
        EXPORT_WRAPPED_KEY,
        WRAP_CONCATENATED_DATA,
        UNWRAP_CONCATENATED_DATA,
-       GET_BACKEND_INFO
+       GET_BACKEND_INFO,
+       ENCAPSULATE_KEY,
+       DECAPSULATE_KEY
 };
 
 enum class EncryptionCommand : int {

diff --git a/src/manager/crypto/generic-backend/gobj.h b/src/manager/crypto/generic-backend/gobj.h
index 300498057597499bc7e8ec505c38a7ca3134f880..5167ca05696656e7434b1846d9ebe6b5b4ff047c 100644 (file)
--- a/src/manager/crypto/generic-backend/gobj.h
+++ b/src/manager/crypto/generic-backend/gobj.h
@@ -109,6 +109,25 @@ public:
                ThrowErr(Exc::Crypto::OperationNotSupported);
        }
 
+       virtual std::tuple<Token, RawBuffer> encapsulateKey(const CryptoAlgorithm &,
+                                                                                                               const Token &,
+                                                                                                               const Password &,
+                                                                                                               const Password &,
+                                                                                                               const RawBuffer &)
+       {
+               ThrowErr(Exc::Crypto::OperationNotSupported);
+       }
+
+       virtual Token decapsulateKey(const CryptoAlgorithm &,
+                                                                const Token &,
+                                                                const Password &,
+                                                                const Password &,
+                                                                const RawBuffer &,
+                                                                const RawBuffer &)
+       {
+               ThrowErr(Exc::Crypto::OperationNotSupported);
+       }
+
        // onward = true for encryption/signing, false for decryption/verification
        virtual GCtxShPtr initContext(const CryptoAlgorithm &, bool /*onward*/)
        {

diff --git a/src/manager/crypto/sw-backend/obj.cpp b/src/manager/crypto/sw-backend/obj.cpp
index c95702f429d8a24fb0482b417791a7a34b9d4950..9263e9c73388c646cf9c635699d49750685355c3 100644 (file)
--- a/src/manager/crypto/sw-backend/obj.cpp
+++ b/src/manager/crypto/sw-backend/obj.cpp
@@ -28,11 +28,13 @@
 #include <utils.h>
 
 #include <generic-backend/exception.h>
+#include <generic-backend/algo-validation.h>
 #include <sw-backend/obj.h>
 #include <sw-backend/store.h>
 #include <sw-backend/internals.h>
 #include <sw-backend/ctx.h>
 #include <ckm/ckm-key.h>
+#include <ckm/ckm-type.h>
 
 namespace CKM {
 namespace Crypto {
@@ -40,6 +42,7 @@ namespace SW {
 
 namespace {
 
+
 AlgoType key2algo(DataType type)
 {
        switch (type) {
@@ -255,6 +258,67 @@ std::tuple<Token, RawBuffer> AKey::unwrapConcatenated(const CryptoAlgorithm &par
        return std::make_tuple(Token(backendId(), wrappedKey.type, Store::pack(key, pass)), data);
 }
 
+std::tuple<Token, RawBuffer> AKey::encapsulateKey(const CryptoAlgorithm &params,
+                                                                                                 const Token &pubKey,
+                                                                                                 const Password &pubKeyPass,
+                                                                                                 const Password &sharedSecretPass,
+                                                                                                 const RawBuffer &)
+{
+       KemType kemType = unpack<KemType>(params, ParamName::GEN_KEM_TYPE);
+       Internals::OqsKemPtr kem = Internals::createNewKem(kemType);
+
+       RawBuffer ciphertext(kem->length_ciphertext, 0x00);
+       RawBuffer sharedSecret(kem->length_shared_secret, 0x00);
+       RawBuffer pubKeyBuffer = Store::unpack(pubKey.data, pubKeyPass);
+
+       if (pubKeyBuffer.size() != kem->length_public_key) {
+               ThrowErr(Exc::Crypto::InputParam, "KEM type differs from public key KEM type");
+       }
+
+       OQS_STATUS rc = OQS_KEM_encaps(kem.get(), ciphertext.data(), sharedSecret.data(), pubKeyBuffer.data());
+       if (rc != OQS_SUCCESS) {
+               ThrowErr(Exc::Crypto::InternalError, "Error in KEM key encapsulation");
+       }
+
+       KeyShPtr outputKey = CKM::Key::createAES(sharedSecret);
+       if (!outputKey) {
+               ThrowErr(Exc::Crypto::InputParam, "Encapsulated key is not a valid AES key");
+       }
+
+       return std::make_tuple(Token(backendId(), DataType::KEY_AES,
+                                                  Store::pack(outputKey.get()->getDER(), sharedSecretPass)), ciphertext);
+}
+
+Token AKey::decapsulateKey(const CryptoAlgorithm &params,
+                                                  const Token &privKey,
+                                                  const Password &privKeyPass,
+                                                  const Password &sharedSecretPass,
+                                                  const RawBuffer &ciphertext,
+                                                  const RawBuffer &)
+{
+       KemType kemType = unpack<KemType>(params, ParamName::GEN_KEM_TYPE);
+       Internals::OqsKemPtr kem = Internals::createNewKem(kemType);
+
+       RawBuffer privKeyBuffer = Store::unpack(privKey.data, privKeyPass);
+       RawBuffer sharedSecret(kem->length_shared_secret, 0x00);
+
+       if (privKeyBuffer.size() != kem->length_secret_key) {
+               ThrowErr(Exc::Crypto::InputParam, "KEM type differs from private key KEM type");
+       }
+
+       OQS_STATUS rc = OQS_KEM_decaps(kem.get(), sharedSecret.data(), ciphertext.data(), privKeyBuffer.data());
+       if (rc != OQS_SUCCESS) {
+               ThrowErr(Exc::Crypto::InternalError, "Error in KEM key decapsulation");
+       }
+
+       KeyShPtr outputKey = CKM::Key::createAES(sharedSecret);
+       if (!outputKey) {
+               ThrowErr(Exc::Crypto::InputParam, "Decapsulated key is not a valid AES key");
+       }
+
+       return Token(backendId(), DataType::KEY_AES, Store::pack(outputKey.get()->getDER(), sharedSecretPass));
+}
+
 EvpShPtr Cert::getEvpShPtr()
 {
        if (m_evp)
@@ -304,6 +368,25 @@ std::tuple<Token, RawBuffer> Cert::unwrapConcatenated(const CryptoAlgorithm &,
        ThrowErr(Exc::Crypto::OperationNotSupported);
 }
 
+std::tuple<Token, RawBuffer> Cert::encapsulateKey(const CryptoAlgorithm &,
+                                                                                                 const Token &,
+                                                                                                 const Password &,
+                                                                                                 const Password &,
+                                                                                                 const RawBuffer &)
+{
+       ThrowErr(Exc::Crypto::OperationNotSupported);
+}
+
+Token Cert::decapsulateKey(const CryptoAlgorithm &,
+                                                  const Token &,
+                                                  const Password &,
+                                                  const Password &,
+                                                  const RawBuffer &,
+                                                  const RawBuffer &)
+{
+       ThrowErr(Exc::Crypto::OperationNotSupported);
+}
+
 } // namespace SW
 } // namespace Crypto
 } // namespace CKM

diff --git a/src/manager/crypto/sw-backend/obj.h b/src/manager/crypto/sw-backend/obj.h
index 37cc1777b84b7b0e2f51f96268d85a971b8fa8a9..86cb02013d04e00788ac3aee61f7161174d9143b 100644 (file)
--- a/src/manager/crypto/sw-backend/obj.h
+++ b/src/manager/crypto/sw-backend/obj.h
@@ -96,6 +96,19 @@ public:
                                                                                                        size_t size,
                                                                                                        const RawBuffer &data) override;
 
+       std::tuple<Token, RawBuffer> encapsulateKey(const CryptoAlgorithm &params,
+                                                                                               const Token &pubKey,
+                                                                                               const Password &pubKeyPass,
+                                                                                               const Password &sharedSecretPass,
+                                                                                               const RawBuffer &) override;
+
+       Token decapsulateKey(const CryptoAlgorithm &params,
+                                                const Token &privKey,
+                                                const Password &privKeyPass,
+                                                const Password &sharedSecretPass,
+                                                const RawBuffer &ciphertext,
+                                                const RawBuffer &) override;
+
 protected:
        virtual EvpShPtr getEvpShPtr();
 
@@ -125,6 +138,19 @@ public:
                                                                                                        size_t,
                                                                                                        const RawBuffer &) override;
 
+       std::tuple<Token, RawBuffer> encapsulateKey(const CryptoAlgorithm &,
+                                                                                               const Token &,
+                                                                                               const Password &,
+                                                                                               const Password &,
+                                                                                               const RawBuffer &) override;
+
+       Token decapsulateKey(const CryptoAlgorithm &,
+                                                const Token &,
+                                                const Password &,
+                                                const Password &,
+                                                const RawBuffer &,
+                                                const RawBuffer &) override;
+
 protected:
        EvpShPtr getEvpShPtr() override;
 };

diff --git a/src/manager/service/ckm-logic.cpp b/src/manager/service/ckm-logic.cpp
index 515847d779fe8b1366ebfd5d765eb1b0e08b1522..5aad7bafbe2329900a74f5e7d3a165de06711b58 100644 (file)
--- a/src/manager/service/ckm-logic.cpp
+++ b/src/manager/service/ckm-logic.cpp
@@ -1799,6 +1799,105 @@ RawBuffer CKMLogic::unwrapConcatenatedData(
        return SerializeMessage(msgID, retCode, data);
 }
 
+RawBuffer CKMLogic::encapsulateKey(
+       const Credentials &cred,
+       const int msgID,
+       const CryptoAlgorithm &params,
+       const Name &publicKeyAlias,
+       const ClientId &publicKeyOwner,
+       const Password &publicKeyPassword,
+       const Name &sharedSecretAlias,
+       const ClientId &sharedSecretOwner,
+       const PolicySerializable &sharedSecretPolicy)
+{
+       DB::Row publicKeyRow;
+       DataType publicKeyType;
+       RawBuffer ciphertext;
+       Password sharedSecretPassword = sharedSecretPolicy.password;
+
+       auto retCode = tryRet([&] {
+               Crypto::GObjUPtr key;
+
+               auto [dbOp, digest, retCode2] = beginSaveAndGetHash(cred, sharedSecretAlias, sharedSecretOwner);
+               if (retCode2 != CKM_API_SUCCESS)
+                       return retCode2;
+
+               retCode2 = readDataHelper(false, cred, DataType::DB_KEY_FIRST, publicKeyAlias,
+                                                                 publicKeyOwner, publicKeyPassword, key);
+               if (retCode2 != CKM_API_SUCCESS)
+                       return retCode2;
+
+               retCode2 = readRowHelper(false, cred, DataType::KEY_KEM_PUBLIC, publicKeyAlias, publicKeyOwner,
+                                                                publicKeyPassword, publicKeyRow, publicKeyType);
+               if (retCode2 != CKM_API_SUCCESS)
+                       return retCode2;
+
+               if (!publicKeyType.isKemPublicKey()) {
+                       LogError("Only public KEM key should be used!");
+                       return CKM_API_ERROR_INPUT_PARAM;
+               }
+
+               std::tuple<Token, RawBuffer> tokenWithData =
+                       key->encapsulateKey(params, publicKeyRow, publicKeyPassword, sharedSecretPassword, digest);
+
+               ciphertext = std::get<1>(tokenWithData);
+
+               dbOp.finalize(std::move(std::get<0>(tokenWithData)), sharedSecretPolicy);
+
+               return retCode2;
+       });
+
+       return SerializeMessage(msgID, retCode, ciphertext);
+}
+
+RawBuffer CKMLogic::decapsulateKey(
+       const Credentials &cred,
+       const int msgID,
+       const CryptoAlgorithm &params,
+       const Name &privateKeyAlias,
+       const ClientId &privateKeyOwner,
+       const Password &privateKeyPassword,
+       const Name &sharedSecretAlias,
+       const ClientId &sharedSecretOwner,
+       const PolicySerializable &sharedSecretPolicy,
+       const RawBuffer &ciphertext)
+{
+       DB::Row privateKeyRow;
+       DataType privateKeyType;
+       Password sharedSecretPassword = sharedSecretPolicy.password;
+
+       auto retCode = tryRet([&] {
+               Crypto::GObjUPtr key;
+               auto [dbOp, digest, retCode2] = beginSaveAndGetHash(cred, sharedSecretAlias, sharedSecretOwner);
+               if (retCode2 != CKM_API_SUCCESS)
+                       return retCode2;
+
+               retCode2 = readDataHelper(false, cred, DataType::DB_KEY_FIRST, privateKeyAlias,
+                                                                 privateKeyOwner, privateKeyPassword, key);
+               if (retCode2 != CKM_API_SUCCESS)
+                       return retCode2;
+
+               retCode2 = readRowHelper(false, cred, DataType::KEY_KEM_PRIVATE, privateKeyAlias, privateKeyOwner,
+                                                                privateKeyPassword, privateKeyRow, privateKeyType);
+
+               if (retCode2 != CKM_API_SUCCESS)
+                       return retCode2;
+
+               if (!privateKeyType.isKemPrivateKey()) {
+                       LogError("Only private KEM key should be used!");
+                       return CKM_API_ERROR_INPUT_PARAM;
+               }
+
+               Token token = key->decapsulateKey(params, privateKeyRow, privateKeyPassword,
+                                                                                 sharedSecretPassword, ciphertext, digest);
+
+               dbOp.finalize(std::move(token), sharedSecretPolicy);
+               return retCode2;
+       });
+
+       return SerializeMessage(msgID, retCode);
+}
+
 RawBuffer CKMLogic::getBackendInfo(const int msgID, BackendId backend)
 {
        BackendInfo info;

diff --git a/src/manager/service/ckm-logic.h b/src/manager/service/ckm-logic.h
index 4188bb25e229a11db792a57e01b42e8f960e6ce4..c75b9f1bd44ac1e50077c4d47e01d07d3a1f49a5 100644 (file)
--- a/src/manager/service/ckm-logic.h
+++ b/src/manager/service/ckm-logic.h
@@ -251,6 +251,29 @@ public:
                size_t size,
                const PolicySerializable &policy);
 
+       RawBuffer encapsulateKey(
+               const Credentials &cred,
+               const int msgID,
+               const CryptoAlgorithm &params,
+               const Name &publicKeyAlias,
+               const ClientId &publicKeyOwner,
+               const Password &publicKeyPassword,
+               const Name &sharedSecretAlias,
+               const ClientId &sharedSecretOwner,
+               const PolicySerializable &sharedSecretPolicy);
+
+       RawBuffer decapsulateKey(
+               const Credentials &cred,
+               const int msgID,
+               const CryptoAlgorithm &params,
+               const Name &privateKeyAlias,
+               const ClientId &privateKeyOwner,
+               const Password &privateKeyPassword,
+               const Name &sharedSecretAlias,
+               const ClientId &sharedSecretOwner,
+               const PolicySerializable &sharedSecretPolicy,
+               const RawBuffer &ciphertext);
+
        RawBuffer getBackendInfo(
                const int msgID,
                BackendId backend);

diff --git a/src/manager/service/ckm-service.cpp b/src/manager/service/ckm-service.cpp
index 5ebe54d18aa5a5a008612d7cfc92578b12b657e5..0e1e77c577c6b7c11c21d6b7bc0528fb145201af 100644 (file)
--- a/src/manager/service/ckm-service.cpp
+++ b/src/manager/service/ckm-service.cpp
@@ -671,6 +671,75 @@ RawBuffer CKMService::ProcessExtended(Credentials &cred, MessageBuffer &buffer,
                break;
        }
 
+       case LogicCommand::ENCAPSULATE_KEY: {
+               CryptoAlgorithmSerializable params;
+               Name publicKeyAlias;
+               ClientId publicKeyOwner;
+               Password publicKeyPassword;
+               Name sharedSecretAlias;
+               ClientId sharedSecretOwner;
+               PolicySerializable sharedSecretPolicy;
+
+               buffer.Deserialize(params,
+                                                  publicKeyAlias,
+                                                  publicKeyOwner,
+                                                  publicKeyPassword,
+                                                  sharedSecretAlias,
+                                                  sharedSecretOwner,
+                                                  sharedSecretPolicy);
+
+               logicFunc = [&, params, publicKeyAlias, publicKeyOwner, publicKeyPassword, sharedSecretAlias,
+                                               sharedSecretOwner, sharedSecretPolicy]() {
+                       return m_logic->encapsulateKey(
+                                               cred,
+                                               msgId,
+                                               params,
+                                               publicKeyAlias,
+                                               cred.effectiveOwner(publicKeyOwner),
+                                               publicKeyPassword,
+                                               sharedSecretAlias,
+                                               cred.effectiveOwner(sharedSecretOwner),
+                                               sharedSecretPolicy);
+               };
+               break;
+       }
+
+       case LogicCommand::DECAPSULATE_KEY: {
+               CryptoAlgorithmSerializable params;
+               Name privateKeyAlias;
+               ClientId privateKeyOwner;
+               Password privateKeyPassword;
+               Name sharedSecretAlias;
+               ClientId sharedSecretOwner;
+               PolicySerializable sharedSecretPolicy;
+               RawBuffer ciphertext;
+
+               buffer.Deserialize(params,
+                                                  privateKeyAlias,
+                                                  privateKeyOwner,
+                                                  privateKeyPassword,
+                                                  sharedSecretAlias,
+                                                  sharedSecretOwner,
+                                                  sharedSecretPolicy,
+                                                  ciphertext);
+
+               logicFunc = [&, params, privateKeyAlias, privateKeyOwner, privateKeyPassword, sharedSecretAlias,
+                                               sharedSecretOwner, sharedSecretPolicy, ciphertext]() {
+                       return m_logic->decapsulateKey(
+                                               cred,
+                                               msgId,
+                                               params,
+                                               privateKeyAlias,
+                                               cred.effectiveOwner(privateKeyOwner),
+                                               privateKeyPassword,
+                                               sharedSecretAlias,
+                                               cred.effectiveOwner(sharedSecretOwner),
+                                               sharedSecretPolicy,
+                                               ciphertext);
+               };
+               break;
+       }
+
        default:
                Throw(Exception::BrokenProtocol);
        }