From: Krzysztof Jackiewicz <k.jackiewicz@samsung.com>
Date: Fri, 3 Apr 2015 12:30:14 +0000 (+0200)
Subject: Initial values format adjusted
X-Git-Tag: accepted/tizen/common/20150416.164946~4
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=9228a7207fb7a5512a9ed460e0e605f9edc96b3a;p=platform%2Fcore%2Fsecurity%2Fkey-manager.git

Initial values format adjusted

[Issue#] N/A
[Feature/Bug] N/A
[Problem] Symmetric keys should not hold information about encryption
algorithm. Initial data will be stored as system user but has to be accessible
by ordinary users
[Cause] N/A
[Solution] Symmetric encryption params can be stored separately from key as
data. Encryption params removed from schema. Added permission tag allowing
other users to access system database. XML structure redesigned. Example
updated.

[Verification] Validate example with:
xmllint -schema initial_values.xsd example.xml

Change-Id: I36149b15d6f786e37cec370d632ab74e40efc162
---

diff --git a/doc/example.xml b/doc/example.xml
index e3071b4..cf7ef94 100644
--- a/doc/example.xml
+++ b/doc/example.xml
@@ -1,36 +1,38 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <InitialValues version="0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="initial_values.xsd ">
-  <Key name="key1" owner="label1" password="123" encoding="PEM">
-    -----BEGIN PUBLIC KEY-----
-    MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2b1bXDa+S8/MGWnMkru4
-    T4tUddtZNi0NVjQn9RFH1NMa220GsRhRO56F77FlSVFKfSfVZKIiWg6C+DVCkcLf
-    zXJ/Z0pvwOQYBAqVMFjV6efQGN0JzJ1Unu7pPRiZl7RKGEI+cyzzrcDyrLLrQ2W7
-    0ZySkNEOv6Frx9JgC5NExuYY4lk2fQQa38JXiZkfyzif2em0px7mXbyf5LjccsKq
-    v1e+XLtMsL0ZefRcqsP++NzQAI8fKX7WBT+qK0HJDLiHrKOTWYzx6CwJ66LD/vvf
-    j55xtsKDLVDbsotvf8/m6VLMab+vqKk11TP4tq6yo0mwyTADvgl1zowQEO9I1W6o
-    zQIDAQAB
-    -----END PUBLIC KEY-----
+  <Key name="key1" type="RSA_PRV" password="123">
+    <PEM>
+      -----BEGIN PUBLIC KEY-----
+      MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2b1bXDa+S8/MGWnMkru4
+      T4tUddtZNi0NVjQn9RFH1NMa220GsRhRO56F77FlSVFKfSfVZKIiWg6C+DVCkcLf
+      zXJ/Z0pvwOQYBAqVMFjV6efQGN0JzJ1Unu7pPRiZl7RKGEI+cyzzrcDyrLLrQ2W7
+      0ZySkNEOv6Frx9JgC5NExuYY4lk2fQQa38JXiZkfyzif2em0px7mXbyf5LjccsKq
+      v1e+XLtMsL0ZefRcqsP++NzQAI8fKX7WBT+qK0HJDLiHrKOTWYzx6CwJ66LD/vvf
+      j55xtsKDLVDbsotvf8/m6VLMab+vqKk11TP4tq6yo0mwyTADvgl1zowQEO9I1W6o
+      zQIDAQAB
+      -----END PUBLIC KEY-----
+    </PEM>
   </Key>
-  <Cert extractable="true" name="cert1" owner="label1" encoding="DER">
-    MIIEgDCCA2igAwIBAgIIcjtBYJGQtOAwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE
-    BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
-    cm5ldCBBdXRob3JpdHkgRzIwHhcNMTQwNTIyMTEyOTQyWhcNMTQwODIwMDAwMDAw
-    WjBtMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
-    TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEcMBoGA1UEAwwTYWNj
-    rHva8A==
+  <Cert exportable="true" name="cert1">
+    <DER>
+      MIIEgDCCA2igAwIBAgIIcjtBYJGQtOAwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE
+      BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
+      cm5ldCBBdXRob3JpdHkgRzIwHhcNMTQwNTIyMTEyOTQyWhcNMTQwODIwMDAwMDAw
+      WjBtMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
+      TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEcMBoGA1UEAwwTYWNj
+      rHva8A==
+    </DER>
   </Cert>
-  <Data name="data1" owner="label2" encoding="ASCII">
-    My secret data
+  <Data name="data1">
+    <ASCII>
+      My secret data
+    </ASCII>
   </Data>
-  <AesCbcKey name="aes1" owner="label2" encoding="Base64" iv="9vZ2xlIEluYzEcMB9vZ2xlIEluYzEcMB9vZ2xlIEluYzEcMB9vZ2xlIEluYzEcMB">
-    MIIEgDCCA2igAwIBAgIIcjtBYJGQtOAwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE
-  </AesCbcKey>
-  <AesGcmKey name="aes2" owner="label2" encoding="Base64" iv="9vZ2xlIEluYzEcMB9vZ2xlIEluYzEcMB9vZ2xlIEluYzEcMB9vZ2xlIEluYzEcMB" additionalData="9vZ2xlIEluYzEcMB9vZ2xlIEluYzEcMB9vZ2xlIEluYzEcMB9vZ2xlIEluYzEcMB" tagLength="128">
-    MIIEgDCCA2igAwIBAgIIcjtBYJGQtOAwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE
-  </AesGcmKey>
-  <AesCtrKey name="aes3" owner="label2" encoding="PEM">
-    -----BEGIN PRIVATE KEY-----
-    MIIEgDCCA2igAwIBAgIIcjtBYJGQtOAwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE
-    -----END PRIVATE KEY-----
-  </AesCtrKey>
+  <Key name="aes1" type="AES">
+    <Base64>
+      MIIEgDCCA2igAwIBAgIIcjtBYJGQtOAwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE
+    </Base64>
+    <Permission accessor="web_app1"/>
+    <Permission accessor="web_app2"/>
+  </Key>
 </InitialValues>
\ No newline at end of file
diff --git a/doc/initial_values.xsd b/doc/initial_values.xsd
index 7e063cf..a587beb 100644
--- a/doc/initial_values.xsd
+++ b/doc/initial_values.xsd
@@ -2,59 +2,16 @@
 <xsd:schema elementFormDefault="qualified" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
 	<xsd:element name="InitialValues" type="InitialValuesType"></xsd:element>
 
-	<xsd:complexType name="ValueType">
-		<xsd:simpleContent>
-			<xsd:extension base="xsd:string">
-				<xsd:attribute name="name" use="required">
-					<xsd:simpleType>
-						<xsd:restriction base="xsd:string">
-							<xsd:minLength value="1"></xsd:minLength>
-						</xsd:restriction>
-					</xsd:simpleType>
-				</xsd:attribute>
-				<xsd:attribute name="owner" use="required">
-					<xsd:simpleType>
-						<xsd:restriction base="xsd:string">
-							<xsd:minLength value="1"></xsd:minLength>
-						</xsd:restriction>
-					</xsd:simpleType>
-				</xsd:attribute>
-				<xsd:attribute name="password" use="optional"
-					type="xsd:string">
-				</xsd:attribute>
-				<xsd:attribute name="extractable" use="optional"
-					default="false">
-					<xsd:simpleType>
-						<xsd:restriction base="xsd:boolean"></xsd:restriction>
-					</xsd:simpleType>
-				</xsd:attribute>
-
-			</xsd:extension>
-		</xsd:simpleContent>
-	</xsd:complexType>
-
 	<xsd:complexType name="InitialValuesType">
 		<xsd:sequence>
 			<xsd:choice maxOccurs="unbounded" minOccurs="1">
-				<xsd:element name="AesCtrKey" type="AesCtrKeyType"
-					maxOccurs="1" minOccurs="1">
-				</xsd:element>
-				<xsd:element name="AesCbcKey" type="AesCbcKeyType"
-					maxOccurs="1" minOccurs="1">
-				</xsd:element>
-				<xsd:element name="AesGcmKey" type="AesGcmKeyType"
-					maxOccurs="1" minOccurs="1">
-				</xsd:element>
-				<xsd:element name="AesCfbKey" type="AesCfbKeyType"
-					maxOccurs="1" minOccurs="1">
-				</xsd:element>
 				<xsd:element name="Data" type="DataType"
 					maxOccurs="1" minOccurs="1">
 				</xsd:element>
-				<xsd:element name="Key" type="KeyCertType"
+				<xsd:element name="Key" type="KeyType"
 					maxOccurs="1" minOccurs="1">
 				</xsd:element>
-				<xsd:element name="Cert" type="KeyCertType"
+				<xsd:element name="Cert" type="CertType"
 					maxOccurs="1" minOccurs="1">
 				</xsd:element>
 			</xsd:choice>
@@ -62,102 +19,110 @@
 		<xsd:attribute name="version" type="xsd:int" use="required"></xsd:attribute>
 	</xsd:complexType>
 
-	<xsd:complexType name="AesCtrKeyType">
-		<xsd:simpleContent>
-			<xsd:extension base="ValueType">
-				<xsd:attribute name="encoding" use="required">
-					<xsd:simpleType>
-						<xsd:restriction base="xsd:string">
-							<xsd:enumeration value="Base64"></xsd:enumeration>
-							<xsd:enumeration value="PEM"></xsd:enumeration>
-						</xsd:restriction>
-					</xsd:simpleType>
-				</xsd:attribute>
-			</xsd:extension>
-		</xsd:simpleContent>
+	<xsd:complexType name="ObjectType">
+		<xsd:attribute name="name" use="required">
+			<xsd:simpleType>
+				<xsd:restriction base="xsd:string">
+					<xsd:minLength value="1"></xsd:minLength>
+				</xsd:restriction>
+			</xsd:simpleType>
+		</xsd:attribute>
+		<xsd:attribute name="password" use="optional"
+			type="xsd:string">
+		</xsd:attribute>
+		<xsd:attribute name="exportable" use="optional"
+			default="false">
+			<xsd:simpleType>
+				<xsd:restriction base="xsd:boolean"></xsd:restriction>
+			</xsd:simpleType>
+		</xsd:attribute>
 	</xsd:complexType>
 
-	<xsd:complexType name="AesCbcKeyType">
-		<xsd:simpleContent>
-			<xsd:extension base="ValueType">
-				<xsd:attribute name="encoding" use="required">
+	<xsd:complexType name="KeyType">
+		<xsd:complexContent>
+			<xsd:extension base="ObjectType">
+				<xsd:sequence>
+					<xsd:choice maxOccurs="1" minOccurs="1">
+						<xsd:element name="PEM"
+							type="EncodingPemType" maxOccurs="1" minOccurs="1">
+						</xsd:element>
+						<xsd:element name="DER"
+							type="EncodingDerType" maxOccurs="1" minOccurs="1">
+						</xsd:element>
+						<xsd:element name="Base64"
+							type="EncodingRawType" maxOccurs="1" minOccurs="1">
+						</xsd:element>
+					</xsd:choice>
+					<xsd:element name="Permission" type="PermissionType" maxOccurs="unbounded" minOccurs="0"></xsd:element>
+				</xsd:sequence>
+				<xsd:attribute name="type">
 					<xsd:simpleType>
 						<xsd:restriction base="xsd:string">
-							<xsd:enumeration value="Base64"></xsd:enumeration>
-							<xsd:enumeration value="PEM"></xsd:enumeration>
+							<xsd:enumeration value="RSA_PRV"></xsd:enumeration>
+							<xsd:enumeration value="RSA_PUB"></xsd:enumeration>
+							<xsd:enumeration value="ECDSA_PRV"></xsd:enumeration>
+							<xsd:enumeration value="ECDSA_PUB"></xsd:enumeration>
+							<xsd:enumeration value="DSA_PRV"></xsd:enumeration>
+							<xsd:enumeration value="DSA_PUB"></xsd:enumeration>
+							<xsd:enumeration value="AES"></xsd:enumeration>
 						</xsd:restriction>
 					</xsd:simpleType>
 				</xsd:attribute>
-				<xsd:attribute name="iv" type="xsd:base64Binary" use="required"></xsd:attribute>
 			</xsd:extension>
-		</xsd:simpleContent>
+		</xsd:complexContent>
 	</xsd:complexType>
 
-	<xsd:complexType name="AesGcmKeyType">
-		<xsd:simpleContent>
-			<xsd:extension base="ValueType">
-				<xsd:attribute name="encoding" use="required">
-					<xsd:simpleType>
-						<xsd:restriction base="xsd:string">
-							<xsd:enumeration value="Base64"></xsd:enumeration>
-							<xsd:enumeration value="PEM"></xsd:enumeration>
-						</xsd:restriction>
-					</xsd:simpleType>
-				</xsd:attribute>
-				<xsd:attribute name="iv" type="xsd:base64Binary"
-					use="required">
-				</xsd:attribute>
-				<xsd:attribute name="additionalData"
-					type="xsd:string">
-				</xsd:attribute>
-				<xsd:attribute name="tagLength" type="xsd:int"></xsd:attribute>
+	<xsd:complexType name="CertType">
+		<xsd:complexContent>
+			<xsd:extension base="ObjectType">
+				<xsd:sequence>
+					<xsd:choice maxOccurs="1" minOccurs="1">
+						<xsd:element name="PEM" type="EncodingPemType"
+							maxOccurs="1" minOccurs="1">
+						</xsd:element>
+						<xsd:element name="DER"
+							type="EncodingDerType" maxOccurs="1" minOccurs="1">
+						</xsd:element>
+					</xsd:choice>
+					<xsd:element name="Permission" type="PermissionType" maxOccurs="unbounded" minOccurs="0"></xsd:element>
+				</xsd:sequence>
 			</xsd:extension>
-		</xsd:simpleContent>
+		</xsd:complexContent>
 	</xsd:complexType>
 
-	<xsd:complexType name="AesCfbKeyType">
-		<xsd:simpleContent>
-			<xsd:extension base="ValueType">
-				<xsd:attribute name="encoding" use="required">
-					<xsd:simpleType>
-						<xsd:restriction base="xsd:string">
-							<xsd:enumeration value="Base64"></xsd:enumeration>
-							<xsd:enumeration value="PEM"></xsd:enumeration>
-						</xsd:restriction>
-					</xsd:simpleType>
-				</xsd:attribute>
-				<xsd:attribute name="iv" type="xsd:base64Binary" use="required"></xsd:attribute>
+	<xsd:complexType name="DataType">
+		<xsd:complexContent>
+			<xsd:extension base="ObjectType">
+				<xsd:sequence>
+					<xsd:choice maxOccurs="1" minOccurs="1">
+						<xsd:element name="ASCII"
+							type="EncodingAsciiType" maxOccurs="1" minOccurs="1">
+						</xsd:element>
+						<xsd:element name="Base64"
+							type="EncodingRawType" maxOccurs="1" minOccurs="1">
+						</xsd:element>
+					</xsd:choice>
+					<xsd:element name="Permission" type="PermissionType" maxOccurs="unbounded" minOccurs="0"></xsd:element>
+				</xsd:sequence>
 			</xsd:extension>
-		</xsd:simpleContent>
+		</xsd:complexContent>
 	</xsd:complexType>
 
-	<xsd:complexType name="KeyCertType">
-		<xsd:simpleContent>
-			<xsd:extension base="ValueType">
-				<xsd:attribute name="encoding">
-					<xsd:simpleType>
-						<xsd:restriction base="xsd:string">
-							<xsd:enumeration value="PEM"></xsd:enumeration>
-							<xsd:enumeration value="DER"></xsd:enumeration>
-						</xsd:restriction>
-					</xsd:simpleType>
-				</xsd:attribute>
-			</xsd:extension>
-		</xsd:simpleContent>
-	</xsd:complexType>
+	<xsd:simpleType name="EncodingAsciiType">
+		<xsd:restriction base="xsd:string"></xsd:restriction>
+	</xsd:simpleType>
+	<xsd:simpleType name="EncodingDerType">
+		<xsd:restriction base="xsd:string"></xsd:restriction>
+	</xsd:simpleType>
+	<xsd:simpleType name="EncodingPemType">
+		<xsd:restriction base="xsd:string"></xsd:restriction>
+	</xsd:simpleType>
+	<xsd:simpleType name="EncodingRawType">
+		<xsd:restriction base="xsd:string"></xsd:restriction>
+	</xsd:simpleType>
 
-	<xsd:complexType name="DataType">
-		<xsd:simpleContent>
-			<xsd:extension base="ValueType">
-				<xsd:attribute name="encoding">
-					<xsd:simpleType>
-						<xsd:restriction base="xsd:string">
-							<xsd:enumeration value="ASCII"></xsd:enumeration>
-							<xsd:enumeration value="Base64"></xsd:enumeration>
-						</xsd:restriction>
-					</xsd:simpleType>
-				</xsd:attribute>
-			</xsd:extension>
-		</xsd:simpleContent>
+	<xsd:complexType name="PermissionType">
+		<xsd:attribute name="accessor" type="xsd:string"></xsd:attribute>
 	</xsd:complexType>
+
 </xsd:schema>
\ No newline at end of file