diff --git a/src/asymmetric_cipher.c b/src/asymmetric_cipher.c index ecb39b7e..6ab26437 100644 --- a/src/asymmetric_cipher.c +++ b/src/asymmetric_cipher.c @@ -2,11 +2,15 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "asymmetric_cipher.h" #include #include "openssl/prov_ssl.h" #include "openssl/rsa.h" #include "openssl/rand.h" +#define DISPATCH_RSAENC_FN(name) \ + DECL_DISPATCH_FUNC(asym_cipher, p11prov_rsaenc, name) + DISPATCH_RSAENC_FN(newctx); DISPATCH_RSAENC_FN(freectx); DISPATCH_RSAENC_FN(dupctx); @@ -751,6 +755,9 @@ static const OSSL_PARAM *p11prov_rsaenc_settable_ctx_params(void *ctx, return params; } +#define DISPATCH_RSAENC_ELEM(NAME, name) \ + { OSSL_FUNC_ASYM_CIPHER_##NAME, (void (*)(void))p11prov_rsaenc_##name } + const OSSL_DISPATCH p11prov_rsa_asym_cipher_functions[] = { DISPATCH_RSAENC_ELEM(NEWCTX, newctx), DISPATCH_RSAENC_ELEM(FREECTX, freectx), @@ -764,3 +771,25 @@ const OSSL_DISPATCH p11prov_rsa_asym_cipher_functions[] = { DISPATCH_RSAENC_ELEM(SET_CTX_PARAMS, set_ctx_params), DISPATCH_RSAENC_ELEM(SETTABLE_CTX_PARAMS, settable_ctx_params), }; + +const OSSL_ALGORITHM asym_cipher_algorithms[1] = { + DEFAULT_ALGORITHM(RSA, p11prov_rsa_asym_cipher_functions), +}; + +CK_RV p11prov_register_asym_ciphers(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + OSSL_ALGORITHM *algs = NULL; + + if (mechs[TBID_RSA_PKCS] || mechs[TBID_RSA_PKCS_OAEP] + || mechs[TBID_RSA_X_509] || mechs[TBID_RSA_X9_31]) { + algs = OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * 2); + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + p11prov_assign_alg(&algs[0], asym_cipher_algorithms, 0, + fips_property ? P11PROV_FIPS_PROPERTIES : NULL); + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_ASYM_CIPHER, algs); +} diff --git a/src/asymmetric_cipher.h b/src/asymmetric_cipher.h index e3825c01..54d11554 100644 --- a/src/asymmetric_cipher.h +++ b/src/asymmetric_cipher.h @@ -4,13 +4,7 @@ #ifndef _ASYM_CIPH_H #define _ASYM_CIPH_H -/* rsa encrypt/decrypt */ -#define DISPATCH_RSAENC_FN(name) \ - DECL_DISPATCH_FUNC(asym_cipher, p11prov_rsaenc, name) -#define DISPATCH_RSAENC_ELEM(NAME, name) \ - { \ - OSSL_FUNC_ASYM_CIPHER_##NAME, (void (*)(void))p11prov_rsaenc_##name \ - } -extern const OSSL_DISPATCH p11prov_rsa_asym_cipher_functions[]; +CK_RV p11prov_register_asym_ciphers(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); #endif /* _ASYM_CIPH_H */ diff --git a/src/cipher.c b/src/cipher.c index 4ccd3ad7..357701a4 100644 --- a/src/cipher.c +++ b/src/cipher.c @@ -28,6 +28,29 @@ #define IVSIZE_ofb AESBLOCK #define IVSIZE_poly1305 12 +#define MODE_modes_mask 0x00FF +#define MODE_flags_mask 0xFF00 + +#define MODE_flag_aead 0x0100 +#define MODE_flag_custom_iv 0x0200 +#define MODE_flag_cts 0x0400 +#define MODE_flag_tls1_mb 0x0800 +#define MODE_flag_rand_key 0x1000 + +#define MODE_ecb 0x01 +#define MODE_cbc 0x02 +#define MODE_ofb 0x04 +#define MODE_cfb 0x08 +#define MODE_cfb1 MODE_cfb +#define MODE_cfb8 MODE_cfb +#define MODE_ctr 0x10 +#define MODE_cts MODE_flag_cts | MODE_cbc +#define MODE_gcm 0x20 +#define MODE_poly1305 0x21 + +#define DISPATCH_CIPHER_FN(alg, name) \ + DECL_DISPATCH_FUNC(cipher, p11prov_##alg, name) + DISPATCH_CIPHER_FN(cipher, freectx); DISPATCH_CIPHER_FN(common, dupctx); DISPATCH_CIPHER_FN(cipher, encrypt_init); @@ -190,9 +213,6 @@ static int p11prov_cipher_get_params(OSSL_PARAM params[], unsigned int mode, return RET_OSSL_OK; } -#define p11prov_aes_get_params p11prov_common_get_params -#define p11prov_chacha20_get_params p11prov_common_get_params - static int p11prov_common_get_params(OSSL_PARAM params[], int size, size_t ivsize, int mode, CK_ULONG mechanism) @@ -239,6 +259,9 @@ static int p11prov_common_get_params(OSSL_PARAM params[], int size, blocksize); }; +#define p11prov_aes_get_params p11prov_common_get_params +#define p11prov_chacha20_get_params p11prov_common_get_params + static void p11prov_cipher_free_mech(CK_MECHANISM_PTR mech) { if (!mech->pParameter) { @@ -832,7 +855,7 @@ static CK_RV tls_aead_get_data(CK_MECHANISM_PTR mech, data_buffer *explicitiv, { /* In TLS 1.2, OpenSSL provides a buffer with this layout: * [explicit IV] [plaintext] [authentication tag] - * + * * In the encryption case, it expects the provider to fill in * the explicit IV and tag, and to overwrite the plaintext with * ciphertext. Explicit IV can be either: @@ -1672,6 +1695,49 @@ static const OSSL_PARAM *p11prov_common_settable_ctx_params(void *vctx, return NULL; } +#define DISPATCH_TABLE_CIPHER_FN(cipher, size, mode, mechanism) \ + static void *p11prov_##cipher##size##mode##_newctx(void *provctx) \ + { \ + return p11prov_cipher_newctx(provctx, size, IVSIZE_##mode, mechanism); \ + } \ + static int p11prov_##cipher##size##mode##_get_params(OSSL_PARAM params[]) \ + { \ + return p11prov_##cipher##_get_params(params, size, IVSIZE_##mode, \ + MODE_##mode, mechanism); \ + } \ + const OSSL_DISPATCH p11prov_##cipher##size##mode##_functions[] = { \ + { OSSL_FUNC_CIPHER_NEWCTX, \ + (void (*)(void))p11prov_##cipher##size##mode##_newctx }, \ + { OSSL_FUNC_CIPHER_FREECTX, (void (*)(void))p11prov_cipher_freectx }, \ + { OSSL_FUNC_CIPHER_DUPCTX, \ + (void (*)(void))p11prov_##cipher##_dupctx }, \ + { OSSL_FUNC_CIPHER_ENCRYPT_INIT, \ + (void (*)(void))p11prov_cipher_encrypt_init }, \ + { OSSL_FUNC_CIPHER_DECRYPT_INIT, \ + (void (*)(void))p11prov_cipher_decrypt_init }, \ + { OSSL_FUNC_CIPHER_UPDATE, (void (*)(void))p11prov_cipher_update }, \ + { OSSL_FUNC_CIPHER_FINAL, (void (*)(void))p11prov_cipher_final }, \ + { OSSL_FUNC_CIPHER_CIPHER, \ + (void (*)(void))p11prov_##cipher##_cipher }, \ + { OSSL_FUNC_CIPHER_GET_PARAMS, \ + (void (*)(void))p11prov_##cipher##size##mode##_get_params }, \ + { OSSL_FUNC_CIPHER_GET_CTX_PARAMS, \ + (void (*)(void))p11prov_##cipher##_get_ctx_params }, \ + { OSSL_FUNC_CIPHER_SET_CTX_PARAMS, \ + (void (*)(void))p11prov_##cipher##_set_ctx_params }, \ + { OSSL_FUNC_CIPHER_GETTABLE_PARAMS, \ + (void (*)(void))p11prov_cipher_gettable_params }, \ + { OSSL_FUNC_CIPHER_GETTABLE_CTX_PARAMS, \ + (void (*)(void))p11prov_##cipher##_gettable_ctx_params }, \ + { OSSL_FUNC_CIPHER_SETTABLE_CTX_PARAMS, \ + (void (*)(void))p11prov_##cipher##_settable_ctx_params }, \ + { OSSL_FUNC_CIPHER_ENCRYPT_SKEY_INIT, \ + (void (*)(void))p11prov_cipher_encrypt_skey_init }, \ + { OSSL_FUNC_CIPHER_DECRYPT_SKEY_INIT, \ + (void (*)(void))p11prov_cipher_decrypt_skey_init }, \ + OSSL_DISPATCH_END \ + }; + DISPATCH_TABLE_CIPHER_FN(aes, 128, ecb, CKM_AES_ECB); DISPATCH_TABLE_CIPHER_FN(aes, 192, ecb, CKM_AES_ECB); DISPATCH_TABLE_CIPHER_FN(aes, 256, ecb, CKM_AES_ECB); @@ -1701,4 +1767,196 @@ DISPATCH_TABLE_CIPHER_FN(aes, 192, gcm, CKM_AES_GCM); DISPATCH_TABLE_CIPHER_FN(aes, 256, gcm, CKM_AES_GCM); DISPATCH_TABLE_CIPHER_FN(chacha20, 256, poly1305, CKM_CHACHA20_POLY1305); +enum p11prov_cipher_algorithms { + P11PROV_CIPHER_AES_128_ECB = 0, + P11PROV_CIPHER_AES_192_ECB, + P11PROV_CIPHER_AES_256_ECB, + P11PROV_CIPHER_AES_128_CBC, + P11PROV_CIPHER_AES_192_CBC, + P11PROV_CIPHER_AES_256_CBC, + P11PROV_CIPHER_AES_128_OFB, + P11PROV_CIPHER_AES_192_OFB, + P11PROV_CIPHER_AES_256_OFB, + P11PROV_CIPHER_AES_128_CFB, + P11PROV_CIPHER_AES_192_CFB, + P11PROV_CIPHER_AES_256_CFB, + P11PROV_CIPHER_AES_128_CFB1, + P11PROV_CIPHER_AES_192_CFB1, + P11PROV_CIPHER_AES_256_CFB1, + P11PROV_CIPHER_AES_128_CFB8, + P11PROV_CIPHER_AES_192_CFB8, + P11PROV_CIPHER_AES_256_CFB8, + P11PROV_CIPHER_AES_128_CTR, + P11PROV_CIPHER_AES_192_CTR, + P11PROV_CIPHER_AES_256_CTR, + P11PROV_CIPHER_AES_128_CTS, + P11PROV_CIPHER_AES_192_CTS, + P11PROV_CIPHER_AES_256_CTS, + P11PROV_CIPHER_AES_128_GCM, + P11PROV_CIPHER_AES_192_GCM, + P11PROV_CIPHER_AES_256_GCM, + P11PROV_CIPHER_CHACHA20_256_POLY1305, + P11PROV_CIPHER_NUM_ALGS +}; + +const OSSL_ALGORITHM cipher_algorithms[P11PROV_CIPHER_NUM_ALGS] = { + [P11PROV_CIPHER_AES_128_ECB] = + DEFAULT_ALGORITHM(AES_128_ECB, p11prov_aes128ecb_functions), + [P11PROV_CIPHER_AES_192_ECB] = + DEFAULT_ALGORITHM(AES_192_ECB, p11prov_aes192ecb_functions), + [P11PROV_CIPHER_AES_256_ECB] = + DEFAULT_ALGORITHM(AES_256_ECB, p11prov_aes256ecb_functions), + [P11PROV_CIPHER_AES_128_CBC] = + DEFAULT_ALGORITHM(AES_128_CBC, p11prov_aes128cbc_functions), + [P11PROV_CIPHER_AES_192_CBC] = + DEFAULT_ALGORITHM(AES_192_CBC, p11prov_aes192cbc_functions), + [P11PROV_CIPHER_AES_256_CBC] = + DEFAULT_ALGORITHM(AES_256_CBC, p11prov_aes256cbc_functions), + [P11PROV_CIPHER_AES_128_OFB] = + DEFAULT_ALGORITHM(AES_128_OFB, p11prov_aes128ofb_functions), + [P11PROV_CIPHER_AES_192_OFB] = + DEFAULT_ALGORITHM(AES_192_OFB, p11prov_aes192ofb_functions), + [P11PROV_CIPHER_AES_256_OFB] = + DEFAULT_ALGORITHM(AES_256_OFB, p11prov_aes256ofb_functions), + [P11PROV_CIPHER_AES_128_CFB] = + DEFAULT_ALGORITHM(AES_128_CFB, p11prov_aes128cfb_functions), + [P11PROV_CIPHER_AES_192_CFB] = + DEFAULT_ALGORITHM(AES_192_CFB, p11prov_aes192cfb_functions), + [P11PROV_CIPHER_AES_256_CFB] = + DEFAULT_ALGORITHM(AES_256_CFB, p11prov_aes256cfb_functions), + [P11PROV_CIPHER_AES_128_CFB1] = + DEFAULT_ALGORITHM(AES_128_CFB1, p11prov_aes128cfb1_functions), + [P11PROV_CIPHER_AES_192_CFB1] = + DEFAULT_ALGORITHM(AES_192_CFB1, p11prov_aes192cfb1_functions), + [P11PROV_CIPHER_AES_256_CFB1] = + DEFAULT_ALGORITHM(AES_256_CFB1, p11prov_aes256cfb1_functions), + [P11PROV_CIPHER_AES_128_CFB8] = + DEFAULT_ALGORITHM(AES_128_CFB8, p11prov_aes128cfb8_functions), + [P11PROV_CIPHER_AES_192_CFB8] = + DEFAULT_ALGORITHM(AES_192_CFB8, p11prov_aes192cfb8_functions), + [P11PROV_CIPHER_AES_256_CFB8] = + DEFAULT_ALGORITHM(AES_256_CFB8, p11prov_aes256cfb8_functions), + [P11PROV_CIPHER_AES_128_CTR] = + DEFAULT_ALGORITHM(AES_128_CTR, p11prov_aes128ctr_functions), + [P11PROV_CIPHER_AES_192_CTR] = + DEFAULT_ALGORITHM(AES_192_CTR, p11prov_aes192ctr_functions), + [P11PROV_CIPHER_AES_256_CTR] = + DEFAULT_ALGORITHM(AES_256_CTR, p11prov_aes256ctr_functions), + [P11PROV_CIPHER_AES_128_CTS] = + DEFAULT_ALGORITHM(AES_128_CTS, p11prov_aes128cts_functions), + [P11PROV_CIPHER_AES_192_CTS] = + DEFAULT_ALGORITHM(AES_192_CTS, p11prov_aes192cts_functions), + [P11PROV_CIPHER_AES_256_CTS] = + DEFAULT_ALGORITHM(AES_256_CTS, p11prov_aes256cts_functions), + [P11PROV_CIPHER_AES_128_GCM] = + DEFAULT_ALGORITHM(AES_128_GCM, p11prov_aes128gcm_functions), + [P11PROV_CIPHER_AES_192_GCM] = + DEFAULT_ALGORITHM(AES_192_GCM, p11prov_aes192gcm_functions), + [P11PROV_CIPHER_AES_256_GCM] = + DEFAULT_ALGORITHM(AES_256_GCM, p11prov_aes256gcm_functions), + [P11PROV_CIPHER_CHACHA20_256_POLY1305] = DEFAULT_ALGORITHM( + CHACHA20_256_POLY1305, p11prov_chacha20256poly1305_functions), +}; + +CK_RV p11prov_register_ciphers(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_CIPHER_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + if (mechs[TBID_AES_ECB]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_ECB, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_ECB, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_ECB, property); + } + if (mechs[TBID_AES_CBC] || mechs[TBID_AES_CBC_PAD]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_CBC, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_CBC, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_CBC, property); + } + if (mechs[TBID_AES_OFB]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_OFB, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_OFB, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_OFB, property); + } + if (mechs[TBID_AES_CFB128]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_CFB, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_CFB, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_CFB, property); + } + if (mechs[TBID_AES_CFB1]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_CFB1, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_CFB1, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_CFB1, property); + } + if (mechs[TBID_AES_CFB8]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_CFB8, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_CFB8, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_CFB8, property); + } + if (mechs[TBID_AES_CTR]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_CTR, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_CTR, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_CTR, property); + } + if (mechs[TBID_AES_CTS]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_CTS, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_CTS, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_CTS, property); + } + if (mechs[TBID_AES_GCM]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_GCM, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_GCM, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_GCM, property); + } + if (mechs[TBID_CHACHA20_POLY1305]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_CHACHA20_256_POLY1305, property); + } + + if (i == 0) { + OPENSSL_free(algs); + algs = NULL; + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_CIPHER, algs); +} + #endif diff --git a/src/cipher.h b/src/cipher.h index d5d7ef49..fd0cbbeb 100644 --- a/src/cipher.h +++ b/src/cipher.h @@ -5,99 +5,7 @@ #ifndef _CIPHER_H #define _CIPHER_H -#define MODE_modes_mask 0x00FF -#define MODE_flags_mask 0xFF00 - -#define MODE_flag_aead 0x0100 -#define MODE_flag_custom_iv 0x0200 -#define MODE_flag_cts 0x0400 -#define MODE_flag_tls1_mb 0x0800 -#define MODE_flag_rand_key 0x1000 - -#define MODE_ecb 0x01 -#define MODE_cbc 0x02 -#define MODE_ofb 0x04 -#define MODE_cfb 0x08 -#define MODE_cfb1 MODE_cfb -#define MODE_cfb8 MODE_cfb -#define MODE_ctr 0x10 -#define MODE_cts MODE_flag_cts | MODE_cbc -#define MODE_gcm 0x20 -#define MODE_poly1305 0x21 - -#define DISPATCH_CIPHER_FN(alg, name) \ - DECL_DISPATCH_FUNC(cipher, p11prov_##alg, name) - -#define DISPATCH_TABLE_CIPHER_FN(cipher, size, mode, mechanism) \ - static void *p11prov_##cipher##size##mode##_newctx(void *provctx) \ - { \ - return p11prov_cipher_newctx(provctx, size, IVSIZE_##mode, mechanism); \ - } \ - static int p11prov_##cipher##size##mode##_get_params(OSSL_PARAM params[]) \ - { \ - return p11prov_##cipher##_get_params(params, size, IVSIZE_##mode, \ - MODE_##mode, mechanism); \ - } \ - const OSSL_DISPATCH p11prov_##cipher##size##mode##_cipher_functions[] = { \ - { OSSL_FUNC_CIPHER_NEWCTX, \ - (void (*)(void))p11prov_##cipher##size##mode##_newctx }, \ - { OSSL_FUNC_CIPHER_FREECTX, (void (*)(void))p11prov_cipher_freectx }, \ - { OSSL_FUNC_CIPHER_DUPCTX, \ - (void (*)(void))p11prov_##cipher##_dupctx }, \ - { OSSL_FUNC_CIPHER_ENCRYPT_INIT, \ - (void (*)(void))p11prov_cipher_encrypt_init }, \ - { OSSL_FUNC_CIPHER_DECRYPT_INIT, \ - (void (*)(void))p11prov_cipher_decrypt_init }, \ - { OSSL_FUNC_CIPHER_UPDATE, (void (*)(void))p11prov_cipher_update }, \ - { OSSL_FUNC_CIPHER_FINAL, (void (*)(void))p11prov_cipher_final }, \ - { OSSL_FUNC_CIPHER_CIPHER, \ - (void (*)(void))p11prov_##cipher##_cipher }, \ - { OSSL_FUNC_CIPHER_GET_PARAMS, \ - (void (*)(void))p11prov_##cipher##size##mode##_get_params }, \ - { OSSL_FUNC_CIPHER_GET_CTX_PARAMS, \ - (void (*)(void))p11prov_##cipher##_get_ctx_params }, \ - { OSSL_FUNC_CIPHER_SET_CTX_PARAMS, \ - (void (*)(void))p11prov_##cipher##_set_ctx_params }, \ - { OSSL_FUNC_CIPHER_GETTABLE_PARAMS, \ - (void (*)(void))p11prov_cipher_gettable_params }, \ - { OSSL_FUNC_CIPHER_GETTABLE_CTX_PARAMS, \ - (void (*)(void))p11prov_##cipher##_gettable_ctx_params }, \ - { OSSL_FUNC_CIPHER_SETTABLE_CTX_PARAMS, \ - (void (*)(void))p11prov_##cipher##_settable_ctx_params }, \ - { OSSL_FUNC_CIPHER_ENCRYPT_SKEY_INIT, \ - (void (*)(void))p11prov_cipher_encrypt_skey_init }, \ - { OSSL_FUNC_CIPHER_DECRYPT_SKEY_INIT, \ - (void (*)(void))p11prov_cipher_decrypt_skey_init }, \ - OSSL_DISPATCH_END \ - }; - -extern const OSSL_DISPATCH p11prov_aes128ecb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192ecb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256ecb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128cbc_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192cbc_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256cbc_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128ofb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192ofb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256ofb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128cfb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192cfb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256cfb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128cfb1_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192cfb1_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256cfb1_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128cfb8_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192cfb8_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256cfb8_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128ctr_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192ctr_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256ctr_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128cts_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192cts_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256cts_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128gcm_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192gcm_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256gcm_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_chacha20256poly1305_cipher_functions[]; +CK_RV p11prov_register_ciphers(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); #endif /* _CIPHER_H */ diff --git a/src/decoder.c b/src/decoder.c index 72b52630..cfe5f893 100644 --- a/src/decoder.c +++ b/src/decoder.c @@ -9,6 +9,9 @@ #include "pk11_uri.h" #include #include +#include + +#define RET_OSSL_CARRY_ON_DECODING 1 typedef struct p11prov_decoder_ctx { P11PROV_CTX *provctx; @@ -206,6 +209,17 @@ static int p11prov_pem_decoder_p11prov_der_decode( return ret; } +#define P11PROV_DER_COMMON_DECODE_FN(FORMAT_NAME, format) \ + static int p11prov_der_decoder_p11prov_##format##_decode( \ + void *inctx, OSSL_CORE_BIO *cin, int selection, \ + OSSL_CALLBACK *object_cb, void *object_cbarg, \ + OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg) \ + { \ + return p11prov_der_decoder_p11prov_obj_decode( \ + FORMAT_NAME, inctx, cin, selection, object_cb, object_cbarg, \ + pw_cb, pw_cbarg); \ + } + P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_RSA, rsa) P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_EC, ec) P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_ED25519, ed25519) @@ -213,6 +227,40 @@ P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_ED448, ed448) P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_X25519, x25519) P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_X448, x448) +P11PROV_DER_COMMON_DECODE_FN("ML-DSA-44", ml_dsa_44) +P11PROV_DER_COMMON_DECODE_FN("ML-DSA-65", ml_dsa_65) +P11PROV_DER_COMMON_DECODE_FN("ML-DSA-87", ml_dsa_87) +P11PROV_DER_COMMON_DECODE_FN("ML-KEM-512", ml_kem_512) +P11PROV_DER_COMMON_DECODE_FN("ML-KEM-768", ml_kem_768) +P11PROV_DER_COMMON_DECODE_FN("ML-KEM-1024", ml_kem_1024) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHA2-128s", slh_dsa_sha2_128s) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHA2-128f", slh_dsa_sha2_128f) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHA2-192s", slh_dsa_sha2_192s) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHA2-192f", slh_dsa_sha2_192f) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHA2-256s", slh_dsa_sha2_256s) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHA2-256f", slh_dsa_sha2_256f) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHAKE-128s", slh_dsa_shake_128s) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHAKE-128f", slh_dsa_shake_128f) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHAKE-192s", slh_dsa_shake_192s) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHAKE-192f", slh_dsa_shake_192f) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHAKE-256s", slh_dsa_shake_256s) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHAKE-256f", slh_dsa_shake_256f) + +#define DISPATCH_BASE_DECODER_ELEM(NAME, name) \ + { OSSL_FUNC_DECODER_##NAME, (void (*)(void))p11prov_decoder_##name } +#define DISPATCH_DECODER_ELEM(NAME, type, structure, format, name) \ + { OSSL_FUNC_DECODER_##NAME, \ + (void (*)( \ + void))p11prov_##type##_decoder_##structure##_##format##_##name } +#define DISPATCH_DECODER_FN_LIST(type, structure, format) \ + const OSSL_DISPATCH \ + p11prov_##type##_decoder_##structure##_##format##_functions[] = { \ + DISPATCH_BASE_DECODER_ELEM(NEWCTX, newctx), \ + DISPATCH_BASE_DECODER_ELEM(FREECTX, freectx), \ + DISPATCH_DECODER_ELEM(DECODE, type, structure, format, decode), \ + { 0, NULL } \ + }; + DISPATCH_DECODER_FN_LIST(pem, p11prov, der); DISPATCH_DECODER_FN_LIST(der, p11prov, rsa); DISPATCH_DECODER_FN_LIST(der, p11prov, ec); @@ -220,3 +268,295 @@ DISPATCH_DECODER_FN_LIST(der, p11prov, ed25519); DISPATCH_DECODER_FN_LIST(der, p11prov, ed448); DISPATCH_DECODER_FN_LIST(der, p11prov, x25519); DISPATCH_DECODER_FN_LIST(der, p11prov, x448); +DISPATCH_DECODER_FN_LIST(der, p11prov, ml_dsa_44); +DISPATCH_DECODER_FN_LIST(der, p11prov, ml_dsa_65); +DISPATCH_DECODER_FN_LIST(der, p11prov, ml_dsa_87); +DISPATCH_DECODER_FN_LIST(der, p11prov, ml_kem_512); +DISPATCH_DECODER_FN_LIST(der, p11prov, ml_kem_768); +DISPATCH_DECODER_FN_LIST(der, p11prov, ml_kem_1024); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_sha2_128s); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_sha2_128f); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_sha2_192s); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_sha2_192f); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_sha2_256s); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_sha2_256f); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_shake_128s); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_shake_128f); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_shake_192s); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_shake_192f); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_shake_256s); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_shake_256f); + +enum p11prov_decoder_algorithms { + P11PROV_DECODER_DER, + P11PROV_DECODER_RSA, + P11PROV_DECODER_RSAPSS, + P11PROV_DECODER_EC, + P11PROV_DECODER_ED25519, + P11PROV_DECODER_ED448, + P11PROV_DECODER_X25519, + P11PROV_DECODER_X448, + P11PROV_DECODER_ML_DSA_44, + P11PROV_DECODER_ML_DSA_65, + P11PROV_DECODER_ML_DSA_87, + P11PROV_DECODER_ML_KEM_512, + P11PROV_DECODER_ML_KEM_768, + P11PROV_DECODER_ML_KEM_1024, + P11PROV_DECODER_SLH_DSA_SHA2_128S, + P11PROV_DECODER_SLH_DSA_SHA2_128F, + P11PROV_DECODER_SLH_DSA_SHA2_192S, + P11PROV_DECODER_SLH_DSA_SHA2_192F, + P11PROV_DECODER_SLH_DSA_SHA2_256S, + P11PROV_DECODER_SLH_DSA_SHA2_256F, + P11PROV_DECODER_SLH_DSA_SHAKE_128S, + P11PROV_DECODER_SLH_DSA_SHAKE_128F, + P11PROV_DECODER_SLH_DSA_SHAKE_192S, + P11PROV_DECODER_SLH_DSA_SHAKE_192F, + P11PROV_DECODER_SLH_DSA_SHAKE_256S, + P11PROV_DECODER_SLH_DSA_SHAKE_256F, + P11PROV_DECODER_NUM_ALGS +}; + +#define P11PROV_NAMES_DER "DER" +#define P11PROV_DESCS_DER "DER decoder implementation in PKCS11 provider" + +#define PEM_DECODER_PROP P11PROV_DEFAULT_PROPERTIES ",input=pem" +#define DER_DECODER_PROP \ + P11PROV_DEFAULT_PROPERTIES ",input=der,structure=" P11PROV_DER_STRUCTURE + +#define PEM_DECODER_FIPS P11PROV_FIPS_PROPERTIES ",input=pem" +#define DER_DECODER_FIPS \ + P11PROV_FIPS_PROPERTIES ",input=der,structure=" P11PROV_DER_STRUCTURE + +const OSSL_ALGORITHM decoder_algorithms[P11PROV_DECODER_NUM_ALGS] = { + [P11PROV_DECODER_DER] = { + P11PROV_NAMES_DER, + PEM_DECODER_PROP, + p11prov_pem_decoder_p11prov_der_functions, + P11PROV_DESCS_DER, + }, + [P11PROV_DECODER_RSA] = { + P11PROV_NAME_RSA, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_rsa_functions, + "RSA decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_RSAPSS] = { + P11PROV_NAME_RSAPSS, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_rsa_functions, + "RSA-PSS decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_EC] = { + P11PROV_NAME_EC, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ec_functions, + "EC decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ED25519] = { + P11PROV_NAME_ED25519, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ed25519_functions, + "ED25519 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ED448] = { + P11PROV_NAME_ED448, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ed448_functions, + "ED448 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_X25519] = { + P11PROV_NAME_X25519, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_x25519_functions, + "X25519 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_X448] = { + P11PROV_NAME_X448, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_x448_functions, + "X448 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ML_DSA_44] = { + "ML-DSA-44", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ml_dsa_44_functions, + "ML-DSA-44 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ML_DSA_65] = { + "ML-DSA-65", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ml_dsa_65_functions, + "ML-DSA-65 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ML_DSA_87] = { + "ML-DSA-87", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ml_dsa_87_functions, + "ML-DSA-87 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ML_KEM_512] = { + "ML-KEM-512", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ml_kem_512_functions, + "ML-KEM-512 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ML_KEM_768] = { + "ML-KEM-768", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ml_kem_768_functions, + "ML-KEM-768 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ML_KEM_1024] = { + "ML-KEM-1024", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ml_kem_1024_functions, + "ML-KEM-1024 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHA2_128S] = { + "SLH-DSA-SHA2-128s", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_sha2_128s_functions, + "SLH-DSA-SHA2-128s decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHA2_128F] = { + "SLH-DSA-SHA2-128f", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_sha2_128f_functions, + "SLH-DSA-SHA2-128f decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHA2_192S] = { + "SLH-DSA-SHA2-192s", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_sha2_192s_functions, + "SLH-DSA-SHA2-192s decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHA2_192F] = { + "SLH-DSA-SHA2-192f", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_sha2_192f_functions, + "SLH-DSA-SHA2-192f decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHA2_256S] = { + "SLH-DSA-SHA2-256s", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_sha2_256s_functions, + "SLH-DSA-SHA2-256s decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHA2_256F] = { + "SLH-DSA-SHA2-256f", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_sha2_256f_functions, + "SLH-DSA-SHA2-256f decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHAKE_128S] = { + "SLH-DSA-SHAKE-128s", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_shake_128s_functions, + "SLH-DSA-SHAKE-128s decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHAKE_128F] = { + "SLH-DSA-SHAKE-128f", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_shake_128f_functions, + "SLH-DSA-SHAKE-128f decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHAKE_192S] = { + "SLH-DSA-SHAKE-192s", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_shake_192s_functions, + "SLH-DSA-SHAKE-192s decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHAKE_192F] = { + "SLH-DSA-SHAKE-192f", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_shake_192f_functions, + "SLH-DSA-SHAKE-192f decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHAKE_256S] = { + "SLH-DSA-SHAKE-256s", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_shake_256s_functions, + "SLH-DSA-SHAKE-256s decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHAKE_256F] = { + "SLH-DSA-SHAKE-256f", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_shake_256f_functions, + "SLH-DSA-SHAKE-256f decoder implementation in PKCS11 provider", + }, +}; + +CK_RV p11prov_register_decoders(P11PROV_CTX *ctx, bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_DECODER_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = PEM_DECODER_FIPS; + } + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_DER, + property); + + if (fips_property) { + property = DER_DECODER_FIPS; + } + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_RSA, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_RSAPSS, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_EC, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_ED25519, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_ED448, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_X25519, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_X448, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_ML_DSA_44, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_ML_DSA_65, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_ML_DSA_87, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_ML_KEM_512, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_ML_KEM_768, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_ML_KEM_1024, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHA2_128S, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHA2_128F, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHA2_192S, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHA2_192F, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHA2_256S, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHA2_256F, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHAKE_128S, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHAKE_128F, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHAKE_192S, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHAKE_192F, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHAKE_256S, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHAKE_256F, property); + + return p11prov_ctx_add_algs(ctx, OSSL_OP_DECODER, algs); +} diff --git a/src/decoder.h b/src/decoder.h index 57d1bf15..e8f427bb 100644 --- a/src/decoder.h +++ b/src/decoder.h @@ -4,47 +4,6 @@ #ifndef _DECODER_H #define _DECODER_H -#include - -#define RET_OSSL_CARRY_ON_DECODING 1 -#define RET_OSSL_STOP_DECODING 0 - -/* DECODERs */ -#define DISPATCH_BASE_DECODER_ELEM(NAME, name) \ - { \ - OSSL_FUNC_DECODER_##NAME, (void (*)(void))p11prov_decoder_##name \ - } -#define DISPATCH_DECODER_ELEM(NAME, type, structure, format, name) \ - { \ - OSSL_FUNC_DECODER_##NAME, \ - (void (*)( \ - void))p11prov_##type##_decoder_##structure##_##format##_##name \ - } -#define DISPATCH_DECODER_FN_LIST(type, structure, format) \ - const OSSL_DISPATCH \ - p11prov_##type##_decoder_##structure##_##format##_functions[] = { \ - DISPATCH_BASE_DECODER_ELEM(NEWCTX, newctx), \ - DISPATCH_BASE_DECODER_ELEM(FREECTX, freectx), \ - DISPATCH_DECODER_ELEM(DECODE, type, structure, format, decode), \ - { 0, NULL } \ - }; -#define P11PROV_DER_COMMON_DECODE_FN(FORMAT_NAME, format) \ - static int p11prov_der_decoder_p11prov_##format##_decode( \ - void *inctx, OSSL_CORE_BIO *cin, int selection, \ - OSSL_CALLBACK *object_cb, void *object_cbarg, \ - OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg) \ - { \ - return p11prov_der_decoder_p11prov_obj_decode( \ - FORMAT_NAME, inctx, cin, selection, object_cb, object_cbarg, \ - pw_cb, pw_cbarg); \ - } - -extern const OSSL_DISPATCH p11prov_pem_decoder_p11prov_der_functions[]; -extern const OSSL_DISPATCH p11prov_der_decoder_p11prov_rsa_functions[]; -extern const OSSL_DISPATCH p11prov_der_decoder_p11prov_ec_functions[]; -extern const OSSL_DISPATCH p11prov_der_decoder_p11prov_ed25519_functions[]; -extern const OSSL_DISPATCH p11prov_der_decoder_p11prov_ed448_functions[]; -extern const OSSL_DISPATCH p11prov_der_decoder_p11prov_x25519_functions[]; -extern const OSSL_DISPATCH p11prov_der_decoder_p11prov_x448_functions[]; +CK_RV p11prov_register_decoders(P11PROV_CTX *ctx, bool fips_property); #endif /* _DECODER_H */ diff --git a/src/digests.c b/src/digests.c index cecca645..cb0659d0 100644 --- a/src/digests.c +++ b/src/digests.c @@ -130,6 +130,8 @@ typedef struct p11prov_digest_ctx P11PROV_DIGEST_CTX; dctx->session = CK_INVALID_HANDLE; \ return dctx; \ } +#define DISPATCH_DIGEST_COMMON_FN(name) \ + DECL_DISPATCH_FUNC(digest, p11prov_digest, name) DISPATCH_DIGEST_NEWCTX_FN(CKM_SHA_1, sha1); DISPATCH_DIGEST_NEWCTX_FN(CKM_SHA224, sha224); @@ -469,8 +471,12 @@ static const OSSL_PARAM *p11prov_digest_gettable_params(void *provctx) return digest_params; } -#define DISPATCH_FUNCTION_TABLE(digest) \ - const OSSL_DISPATCH p11prov_##digest##_digest_functions[] = { \ +#define DISPATCH_DIGEST_ELEM(digest, NAME, name) \ + { OSSL_FUNC_DIGEST_##NAME, (void (*)(void))p11prov_##digest##_##name } +#define DISPATCH_DIGEST_COMMON(NAME, name) \ + { OSSL_FUNC_DIGEST_##NAME, (void (*)(void))p11prov_digest_##name } +#define DISPATCH_FUNCTIONS(digest) \ + const OSSL_DISPATCH p11prov_##digest##_functions[] = { \ DISPATCH_DIGEST_ELEM(digest, NEWCTX, newctx), \ DISPATCH_DIGEST_COMMON(DUPCTX, dupctx), \ DISPATCH_DIGEST_COMMON(FREECTX, freectx), \ @@ -482,14 +488,122 @@ static const OSSL_PARAM *p11prov_digest_gettable_params(void *provctx) { 0, NULL }, \ } -DISPATCH_FUNCTION_TABLE(sha1); -DISPATCH_FUNCTION_TABLE(sha224); -DISPATCH_FUNCTION_TABLE(sha256); -DISPATCH_FUNCTION_TABLE(sha384); -DISPATCH_FUNCTION_TABLE(sha512); -DISPATCH_FUNCTION_TABLE(sha512_224); -DISPATCH_FUNCTION_TABLE(sha512_256); -DISPATCH_FUNCTION_TABLE(sha3_224); -DISPATCH_FUNCTION_TABLE(sha3_256); -DISPATCH_FUNCTION_TABLE(sha3_384); -DISPATCH_FUNCTION_TABLE(sha3_512); +DISPATCH_FUNCTIONS(sha1); +DISPATCH_FUNCTIONS(sha224); +DISPATCH_FUNCTIONS(sha256); +DISPATCH_FUNCTIONS(sha384); +DISPATCH_FUNCTIONS(sha512); +DISPATCH_FUNCTIONS(sha512_224); +DISPATCH_FUNCTIONS(sha512_256); +DISPATCH_FUNCTIONS(sha3_224); +DISPATCH_FUNCTIONS(sha3_256); +DISPATCH_FUNCTIONS(sha3_384); +DISPATCH_FUNCTIONS(sha3_512); + +enum p11prov_digest_algorithms { + P11PROV_DIGEST_SHA1 = 0, + P11PROV_DIGEST_SHA224, + P11PROV_DIGEST_SHA256, + P11PROV_DIGEST_SHA384, + P11PROV_DIGEST_SHA512, + P11PROV_DIGEST_SHA512_224, + P11PROV_DIGEST_SHA512_256, + P11PROV_DIGEST_SHA3_224, + P11PROV_DIGEST_SHA3_256, + P11PROV_DIGEST_SHA3_384, + P11PROV_DIGEST_SHA3_512, + P11PROV_DIGEST_NUM_ALGS +}; + +const OSSL_ALGORITHM digest_algorithms[P11PROV_DIGEST_NUM_ALGS] = { + [P11PROV_DIGEST_SHA1] = DEFAULT_ALGORITHM(SHA1, p11prov_sha1_functions), + [P11PROV_DIGEST_SHA224] = + DEFAULT_ALGORITHM(SHA224, p11prov_sha224_functions), + [P11PROV_DIGEST_SHA256] = + DEFAULT_ALGORITHM(SHA256, p11prov_sha256_functions), + [P11PROV_DIGEST_SHA384] = + DEFAULT_ALGORITHM(SHA384, p11prov_sha384_functions), + [P11PROV_DIGEST_SHA512] = + DEFAULT_ALGORITHM(SHA512, p11prov_sha512_functions), + [P11PROV_DIGEST_SHA512_224] = + DEFAULT_ALGORITHM(SHA512_224, p11prov_sha512_224_functions), + [P11PROV_DIGEST_SHA512_256] = + DEFAULT_ALGORITHM(SHA512_256, p11prov_sha512_256_functions), + [P11PROV_DIGEST_SHA3_224] = + DEFAULT_ALGORITHM(SHA3_224, p11prov_sha3_224_functions), + [P11PROV_DIGEST_SHA3_256] = + DEFAULT_ALGORITHM(SHA3_256, p11prov_sha3_256_functions), + [P11PROV_DIGEST_SHA3_384] = + DEFAULT_ALGORITHM(SHA3_384, p11prov_sha3_384_functions), + [P11PROV_DIGEST_SHA3_512] = + DEFAULT_ALGORITHM(SHA3_512, p11prov_sha3_512_functions), +}; + +CK_RV p11prov_register_digests(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_DIGEST_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + if (mechs[TBID_SHA_1]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, P11PROV_DIGEST_SHA1, + property); + } + if (mechs[TBID_SHA224]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, P11PROV_DIGEST_SHA224, + property); + } + if (mechs[TBID_SHA256]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, P11PROV_DIGEST_SHA256, + property); + } + if (mechs[TBID_SHA384]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, P11PROV_DIGEST_SHA384, + property); + } + if (mechs[TBID_SHA512]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, P11PROV_DIGEST_SHA512, + property); + } + if (mechs[TBID_SHA512_224]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, + P11PROV_DIGEST_SHA512_224, property); + } + if (mechs[TBID_SHA512_256]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, + P11PROV_DIGEST_SHA512_256, property); + } + if (mechs[TBID_SHA3_224]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, + P11PROV_DIGEST_SHA3_224, property); + } + if (mechs[TBID_SHA3_256]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, + P11PROV_DIGEST_SHA3_256, property); + } + if (mechs[TBID_SHA3_384]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, + P11PROV_DIGEST_SHA3_384, property); + } + if (mechs[TBID_SHA3_512]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, + P11PROV_DIGEST_SHA3_512, property); + } + + if (i == 0) { + OPENSSL_free(algs); + algs = NULL; + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_DIGEST, algs); +} diff --git a/src/digests.h b/src/digests.h index a96b7a63..47a88fbb 100644 --- a/src/digests.h +++ b/src/digests.h @@ -4,56 +4,6 @@ #ifndef _DIGESTS_H #define _DIGESTS_H -/* Digests */ -#define DISPATCH_DIGEST_COMMON_FN(name) \ - DECL_DISPATCH_FUNC(digest, p11prov_digest, name) -#define DISPATCH_DIGEST_COMMON(NAME, name) \ - { \ - OSSL_FUNC_DIGEST_##NAME, (void (*)(void))p11prov_digest_##name \ - } -#define DISPATCH_DIGEST_FN(type, name) \ - DECL_DISPATCH_FUNC(digest, p11prov_##type, name) -#define DISPATCH_DIGEST_ELEM(digest, NAME, name) \ - { \ - OSSL_FUNC_DIGEST_##NAME, (void (*)(void))p11prov_##digest##_##name \ - } -extern const OSSL_DISPATCH p11prov_sha1_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha224_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha256_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha384_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha512_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha512_224_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha512_256_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha3_224_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha3_256_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha3_384_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha3_512_digest_functions[]; - -#define P11PROV_NAMES_SHA1 "SHA1:SHA-1:SSL3-SHA1:1.3.14.3.2.26" -#define P11PROV_DESCS_SHA1 "PKCS11 SHA1 Implementation" -#define P11PROV_NAMES_SHA2_224 "SHA2-224:SHA-224:SHA224:2.16.840.1.101.3.4.2.4" -#define P11PROV_DESCS_SHA2_224 "PKCS11 SHA2-224 Implementation" -#define P11PROV_NAMES_SHA2_256 "SHA2-256:SHA-256:SHA256:2.16.840.1.101.3.4.2.1" -#define P11PROV_DESCS_SHA2_256 "PKCS11 SHA2-256 Implementation" -#define P11PROV_NAMES_SHA2_384 "SHA2-384:SHA-384:SHA384:2.16.840.1.101.3.4.2.2" -#define P11PROV_DESCS_SHA2_384 "PKCS11 SHA2-384 Implementation" -#define P11PROV_NAMES_SHA2_512 "SHA2-512:SHA-512:SHA512:2.16.840.1.101.3.4.2.3" -#define P11PROV_DESCS_SHA2_512 "PKCS11 SHA2-512 Implementation" -#define P11PROV_NAMES_SHA2_512_224 \ - "SHA2-512/224:SHA-512/224:SHA512-224:2.16.840.1.101.3.4.2.5" -#define P11PROV_DESCS_SHA2_512_224 "PKCS11 SHA2-512/224 Implementation" -#define P11PROV_NAMES_SHA2_512_256 \ - "SHA2-512/256:SHA-512/256:SHA512-256:2.16.840.1.101.3.4.2.6" -#define P11PROV_DESCS_SHA2_512_256 "PKCS11 SHA2-512/224 Implementation" -#define P11PROV_NAMES_SHA3_224 "SHA3-224:2.16.840.1.101.3.4.2.7" -#define P11PROV_DESCS_SHA3_224 "PKCS11 SHA3-224 Implementation" -#define P11PROV_NAMES_SHA3_256 "SHA3-256:2.16.840.1.101.3.4.2.8" -#define P11PROV_DESCS_SHA3_256 "PKCS11 SHA3-256 Implementation" -#define P11PROV_NAMES_SHA3_384 "SHA3-384:2.16.840.1.101.3.4.2.9" -#define P11PROV_DESCS_SHA3_384 "PKCS11 SHA3-384 Implementation" -#define P11PROV_NAMES_SHA3_512 "SHA3-512:2.16.840.1.101.3.4.2.10" -#define P11PROV_DESCS_SHA3_512 "PKCS11 SHA3-512 Implementation" - CK_RV p11prov_digest_get_block_size(CK_MECHANISM_TYPE digest, size_t *block_size); CK_RV p11prov_digest_get_digest_size(CK_MECHANISM_TYPE digest, @@ -61,4 +11,7 @@ CK_RV p11prov_digest_get_digest_size(CK_MECHANISM_TYPE digest, CK_RV p11prov_digest_get_name(CK_MECHANISM_TYPE digest, const char **name); CK_RV p11prov_digest_get_by_name(const char *name, CK_MECHANISM_TYPE *digest); +CK_RV p11prov_register_digests(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); + #endif /* _DIGESTS_H */ diff --git a/src/encoder.c b/src/encoder.c index 50999e0f..3fa9b2e5 100644 --- a/src/encoder.c +++ b/src/encoder.c @@ -2,11 +2,27 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "encoder.h" #include "pk11_uri.h" #include #include #include +#define DISPATCH_TEXT_ENCODER_ELEM(NAME, type, name) \ + { OSSL_FUNC_ENCODER_##NAME, \ + (void (*)(void))p11prov_##type##_encoder_##name } +#define DISPATCH_BASE_ENCODER_FN(name) \ + DECL_DISPATCH_FUNC(encoder, p11prov_encoder, name) +#define DISPATCH_BASE_ENCODER_ELEM(NAME, name) \ + { OSSL_FUNC_ENCODER_##NAME, (void (*)(void))p11prov_encoder_##name } +#define DISPATCH_ENCODER_FN(type, structure, format, name) \ + DECL_DISPATCH_FUNC(encoder, \ + p11prov_##type##_encoder_##structure##_##format, name) +#define DISPATCH_ENCODER_ELEM(NAME, type, structure, format, name) \ + { OSSL_FUNC_ENCODER_##NAME, \ + (void (*)( \ + void))p11prov_##type##_encoder_##structure##_##format##_##name } + static int p11prov_print_bn(BIO *out, const OSSL_PARAM *p, const char *str, int indent) { @@ -1692,3 +1708,613 @@ const OSSL_DISPATCH p11prov_mlkem_encoder_text_functions[] = { DISPATCH_TEXT_ENCODER_ELEM(ENCODE, common, encode_text), { 0, NULL }, }; + +#define OUTTEXT "output=text" +#define OUTDER "output=der" +#define OUTPEM "output=pem" +#define STRPKCS1 "structure=pkcs1" +#define STRSPKI "structure=SubjectPublicKeyInfo" +#define STRPRIV "structure=PrivateKeyInfo" + +#define TEXT_PROP P11PROV_DEFAULT_PROPERTIES "," OUTTEXT +#define DER_PKCS1_PROP P11PROV_DEFAULT_PROPERTIES "," OUTDER "," STRPKCS1 +#define PEM_PKCS1_PROP P11PROV_DEFAULT_PROPERTIES "," OUTPEM "," STRPKCS1 +#define DER_SPKI_PROP P11PROV_DEFAULT_PROPERTIES "," OUTDER "," STRSPKI +#define PEM_SPKI_PROP P11PROV_DEFAULT_PROPERTIES "," OUTPEM "," STRSPKI +#define PEM_PRIVK_PROP P11PROV_DEFAULT_PROPERTIES "," OUTPEM "," STRPRIV + +#define TEXT_FIPS P11PROV_FIPS_PROPERTIES "," OUTTEXT +#define DER_PKCS1_FIPS P11PROV_FIPS_PROPERTIES "," OUTDER "," STRPKCS1 +#define PEM_PKCS1_FIPS P11PROV_FIPS_PROPERTIES "," OUTPEM "," STRPKCS1 +#define DER_SPKI_FIPS P11PROV_FIPS_PROPERTIES "," OUTDER "," STRSPKI +#define PEM_SPKI_FIPS P11PROV_FIPS_PROPERTIES "," OUTPEM "," STRSPKI +#define PEM_PRIVK_FIPS P11PROV_FIPS_PROPERTIES "," OUTPEM "," STRPRIV + +enum p11prov_encoder_algorithms { + P11PROV_ENCODER_RSA_TEXT, + P11PROV_ENCODER_RSA_DER_PKCS1, + P11PROV_ENCODER_RSA_PEM_PKCS1, + P11PROV_ENCODER_RSA_DER_SPKI, + P11PROV_ENCODER_RSA_PEM_SPKI, + P11PROV_ENCODER_RSA_PEM_PRIVK, + + P11PROV_ENCODER_RSAPSS_TEXT, + P11PROV_ENCODER_RSAPSS_DER_PKCS1, + P11PROV_ENCODER_RSAPSS_PEM_PKCS1, + P11PROV_ENCODER_RSAPSS_DER_SPKI, + P11PROV_ENCODER_RSAPSS_PEM_SPKI, + P11PROV_ENCODER_RSAPSS_PEM_PRIVK, + + P11PROV_ENCODER_EC_TEXT, + P11PROV_ENCODER_EC_DER_PKCS1, + P11PROV_ENCODER_EC_PEM_PKCS1, + P11PROV_ENCODER_EC_DER_SPKI, + P11PROV_ENCODER_EC_PEM_PRIVK, + + P11PROV_ENCODER_ED25519_TEXT, + P11PROV_ENCODER_ED25519_PEM_PRIVK, + + P11PROV_ENCODER_ED448_TEXT, + P11PROV_ENCODER_ED448_PEM_PRIVK, + + P11PROV_ENCODER_X25519_TEXT, + P11PROV_ENCODER_X25519_PEM_PRIVK, + + P11PROV_ENCODER_X448_TEXT, + P11PROV_ENCODER_X448_PEM_PRIVK, + + P11PROV_ENCODER_ML_DSA_44_TEXT, + P11PROV_ENCODER_ML_DSA_44_DER_SPKI, + P11PROV_ENCODER_ML_DSA_44_PEM_PRIVK, + + P11PROV_ENCODER_ML_DSA_65_TEXT, + P11PROV_ENCODER_ML_DSA_65_DER_SPKI, + P11PROV_ENCODER_ML_DSA_65_PEM_PRIVK, + + P11PROV_ENCODER_ML_DSA_87_TEXT, + P11PROV_ENCODER_ML_DSA_87_DER_SPKI, + P11PROV_ENCODER_ML_DSA_87_PEM_PRIVK, + + P11PROV_ENCODER_ML_KEM_512_TEXT, + P11PROV_ENCODER_ML_KEM_512_DER_SPKI, + P11PROV_ENCODER_ML_KEM_512_PEM_PRIVK, + + P11PROV_ENCODER_ML_KEM_768_TEXT, + P11PROV_ENCODER_ML_KEM_768_DER_SPKI, + P11PROV_ENCODER_ML_KEM_768_PEM_PRIVK, + + P11PROV_ENCODER_ML_KEM_1024_TEXT, + P11PROV_ENCODER_ML_KEM_1024_DER_SPKI, + P11PROV_ENCODER_ML_KEM_1024_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHA2_128S_TEXT, + P11PROV_ENCODER_SLH_DSA_SHA2_128S_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHA2_128S_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHA2_128F_TEXT, + P11PROV_ENCODER_SLH_DSA_SHA2_128F_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHA2_128F_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHA2_192S_TEXT, + P11PROV_ENCODER_SLH_DSA_SHA2_192S_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHA2_192S_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHA2_192F_TEXT, + P11PROV_ENCODER_SLH_DSA_SHA2_192F_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHA2_192F_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHA2_256S_TEXT, + P11PROV_ENCODER_SLH_DSA_SHA2_256S_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHA2_256S_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHA2_256F_TEXT, + P11PROV_ENCODER_SLH_DSA_SHA2_256F_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHA2_256F_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHAKE_128S_TEXT, + P11PROV_ENCODER_SLH_DSA_SHAKE_128S_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHAKE_128S_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHAKE_128F_TEXT, + P11PROV_ENCODER_SLH_DSA_SHAKE_128F_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHAKE_128F_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHAKE_192S_TEXT, + P11PROV_ENCODER_SLH_DSA_SHAKE_192S_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHAKE_192S_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHAKE_192F_TEXT, + P11PROV_ENCODER_SLH_DSA_SHAKE_192F_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHAKE_192F_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHAKE_256S_TEXT, + P11PROV_ENCODER_SLH_DSA_SHAKE_256S_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHAKE_256S_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHAKE_256F_TEXT, + P11PROV_ENCODER_SLH_DSA_SHAKE_256F_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHAKE_256F_PEM_PRIVK, + + P11PROV_ENCODER_NUM_ALGS +}; + +#define TEXT_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + TEXT_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + } +#define DER_PKCS1_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + DER_PKCS1_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + } +#define PEM_PKCS1_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + PEM_PKCS1_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + } +#define DER_SPKI_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + DER_SPKI_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + } +#define PEM_SPKI_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + PEM_SPKI_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + } +#define PEM_PRIVK_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + PEM_PRIVK_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + } + +const OSSL_ALGORITHM encoder_algorithms[P11PROV_ENCODER_NUM_ALGS] = { + [P11PROV_ENCODER_RSA_TEXT] = + TEXT_ALGORITHM(RSA, p11prov_rsa_encoder_text_functions), + [P11PROV_ENCODER_RSA_DER_PKCS1] = + DER_PKCS1_ALGORITHM(RSA, p11prov_rsa_encoder_pkcs1_der_functions), + [P11PROV_ENCODER_RSA_PEM_PKCS1] = + PEM_PKCS1_ALGORITHM(RSA, p11prov_rsa_encoder_pkcs1_pem_functions), + [P11PROV_ENCODER_RSA_DER_SPKI] = + DER_SPKI_ALGORITHM(RSA, p11prov_rsa_encoder_spki_der_functions), + [P11PROV_ENCODER_RSA_PEM_SPKI] = + PEM_SPKI_ALGORITHM(RSA, p11prov_rsa_encoder_spki_pem_functions), + [P11PROV_ENCODER_RSA_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + RSA, p11prov_rsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_RSAPSS_TEXT] = + TEXT_ALGORITHM(RSAPSS, p11prov_rsa_encoder_text_functions), + [P11PROV_ENCODER_RSAPSS_DER_PKCS1] = + DER_PKCS1_ALGORITHM(RSAPSS, p11prov_rsa_encoder_pkcs1_der_functions), + [P11PROV_ENCODER_RSAPSS_PEM_PKCS1] = + PEM_PKCS1_ALGORITHM(RSAPSS, p11prov_rsa_encoder_pkcs1_pem_functions), + [P11PROV_ENCODER_RSAPSS_DER_SPKI] = + DER_SPKI_ALGORITHM(RSAPSS, p11prov_rsa_encoder_spki_der_functions), + [P11PROV_ENCODER_RSAPSS_PEM_SPKI] = + PEM_SPKI_ALGORITHM(RSAPSS, p11prov_rsa_encoder_spki_pem_functions), + [P11PROV_ENCODER_RSAPSS_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + RSAPSS, p11prov_rsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_EC_TEXT] = + TEXT_ALGORITHM(EC, p11prov_ec_encoder_text_functions), + [P11PROV_ENCODER_EC_DER_PKCS1] = + DER_PKCS1_ALGORITHM(EC, p11prov_ec_encoder_pkcs1_der_functions), + [P11PROV_ENCODER_EC_PEM_PKCS1] = + PEM_PKCS1_ALGORITHM(EC, p11prov_ec_encoder_pkcs1_pem_functions), + [P11PROV_ENCODER_EC_DER_SPKI] = + DER_SPKI_ALGORITHM(EC, p11prov_ec_encoder_spki_der_functions), + [P11PROV_ENCODER_EC_PEM_PRIVK] = + PEM_PRIVK_ALGORITHM(EC, p11prov_ec_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ED25519_TEXT] = + TEXT_ALGORITHM(ED25519, p11prov_ec_edwards_encoder_text_functions), + [P11PROV_ENCODER_ED25519_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + ED25519, p11prov_ec_edwards_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ED448_TEXT] = + TEXT_ALGORITHM(ED448, p11prov_ec_edwards_encoder_text_functions), + [P11PROV_ENCODER_ED448_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + ED448, p11prov_ec_edwards_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_X25519_TEXT] = + TEXT_ALGORITHM(X25519, p11prov_ec_montgomery_encoder_text_functions), + [P11PROV_ENCODER_X25519_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + X25519, p11prov_ec_montgomery_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_X448_TEXT] = + TEXT_ALGORITHM(X448, p11prov_ec_montgomery_encoder_text_functions), + [P11PROV_ENCODER_X448_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + X448, p11prov_ec_montgomery_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ML_DSA_44_TEXT] = + TEXT_ALGORITHM(MLDSA_44, p11prov_mldsa_encoder_text_functions), + [P11PROV_ENCODER_ML_DSA_44_DER_SPKI] = + DER_SPKI_ALGORITHM(MLDSA_44, p11prov_mldsa_encoder_spki_der_functions), + [P11PROV_ENCODER_ML_DSA_44_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + MLDSA_44, p11prov_mldsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ML_DSA_65_TEXT] = + TEXT_ALGORITHM(MLDSA_65, p11prov_mldsa_encoder_text_functions), + [P11PROV_ENCODER_ML_DSA_65_DER_SPKI] = + DER_SPKI_ALGORITHM(MLDSA_65, p11prov_mldsa_encoder_spki_der_functions), + [P11PROV_ENCODER_ML_DSA_65_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + MLDSA_65, p11prov_mldsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ML_DSA_87_TEXT] = + TEXT_ALGORITHM(MLDSA_87, p11prov_mldsa_encoder_text_functions), + [P11PROV_ENCODER_ML_DSA_87_DER_SPKI] = + DER_SPKI_ALGORITHM(MLDSA_87, p11prov_mldsa_encoder_spki_der_functions), + [P11PROV_ENCODER_ML_DSA_87_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + MLDSA_87, p11prov_mldsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ML_KEM_512_TEXT] = + TEXT_ALGORITHM(ML_KEM_512, p11prov_mlkem_encoder_text_functions), + [P11PROV_ENCODER_ML_KEM_512_DER_SPKI] = DER_SPKI_ALGORITHM( + ML_KEM_512, p11prov_mlkem_encoder_spki_der_functions), + [P11PROV_ENCODER_ML_KEM_512_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + ML_KEM_512, p11prov_mlkem_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ML_KEM_768_TEXT] = + TEXT_ALGORITHM(ML_KEM_768, p11prov_mlkem_encoder_text_functions), + [P11PROV_ENCODER_ML_KEM_768_DER_SPKI] = DER_SPKI_ALGORITHM( + ML_KEM_768, p11prov_mlkem_encoder_spki_der_functions), + [P11PROV_ENCODER_ML_KEM_768_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + ML_KEM_768, p11prov_mlkem_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ML_KEM_1024_TEXT] = + TEXT_ALGORITHM(ML_KEM_1024, p11prov_mlkem_encoder_text_functions), + [P11PROV_ENCODER_ML_KEM_1024_DER_SPKI] = DER_SPKI_ALGORITHM( + ML_KEM_1024, p11prov_mlkem_encoder_spki_der_functions), + [P11PROV_ENCODER_ML_KEM_1024_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + ML_KEM_1024, p11prov_mlkem_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHA2_128S_TEXT] = + TEXT_ALGORITHM(SLHDSA_SHA2_128S, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_128S_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHA2_128S, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_128S_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHA2_128S, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHA2_128F_TEXT] = + TEXT_ALGORITHM(SLHDSA_SHA2_128F, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_128F_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHA2_128F, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_128F_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHA2_128F, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHA2_192S_TEXT] = + TEXT_ALGORITHM(SLHDSA_SHA2_192S, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_192S_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHA2_192S, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_192S_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHA2_192S, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHA2_192F_TEXT] = + TEXT_ALGORITHM(SLHDSA_SHA2_192F, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_192F_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHA2_192F, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_192F_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHA2_192F, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHA2_256S_TEXT] = + TEXT_ALGORITHM(SLHDSA_SHA2_256S, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_256S_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHA2_256S, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_256S_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHA2_256S, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHA2_256F_TEXT] = + TEXT_ALGORITHM(SLHDSA_SHA2_256F, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_256F_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHA2_256F, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_256F_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHA2_256F, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHAKE_128S_TEXT] = TEXT_ALGORITHM( + SLHDSA_SHAKE_128S, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_128S_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHAKE_128S, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_128S_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHAKE_128S, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHAKE_128F_TEXT] = TEXT_ALGORITHM( + SLHDSA_SHAKE_128F, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_128F_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHAKE_128F, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_128F_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHAKE_128F, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHAKE_192S_TEXT] = TEXT_ALGORITHM( + SLHDSA_SHAKE_192S, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_192S_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHAKE_192S, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_192S_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHAKE_192S, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHAKE_192F_TEXT] = TEXT_ALGORITHM( + SLHDSA_SHAKE_192F, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_192F_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHAKE_192F, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_192F_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHAKE_192F, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHAKE_256S_TEXT] = TEXT_ALGORITHM( + SLHDSA_SHAKE_256S, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_256S_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHAKE_256S, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_256S_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHAKE_256S, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHAKE_256F_TEXT] = TEXT_ALGORITHM( + SLHDSA_SHAKE_256F, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_256F_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHAKE_256F, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_256F_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHAKE_256F, p11prov_slhdsa_encoder_priv_key_info_pem_functions), +}; + +CK_RV p11prov_register_encoders(P11PROV_CTX *ctx, bool fips_property, + bool encode_pkey_as_pk11_uri) +{ + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_ENCODER_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + p11prov_assign_alg(&algs[i++], encoder_algorithms, P11PROV_ENCODER_RSA_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSA_DER_PKCS1, + fips_property ? DER_PKCS1_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSA_PEM_PKCS1, + fips_property ? PEM_PKCS1_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSA_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSA_PEM_SPKI, + fips_property ? PEM_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSAPSS_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSAPSS_DER_PKCS1, + fips_property ? DER_PKCS1_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSAPSS_PEM_PKCS1, + fips_property ? PEM_PKCS1_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSAPSS_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSAPSS_PEM_SPKI, + fips_property ? PEM_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, P11PROV_ENCODER_EC_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_EC_DER_PKCS1, + fips_property ? DER_PKCS1_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_EC_PEM_PKCS1, + fips_property ? PEM_PKCS1_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_EC_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ED25519_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ED448_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_X25519_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_X448_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_44_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_44_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_65_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_65_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_87_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_87_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_512_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_512_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_768_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_768_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_1024_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_1024_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_128S_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_128S_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_128F_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_128F_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_192S_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_192S_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_192F_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_192F_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_256S_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_256S_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_256F_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_256F_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_128S_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_128S_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_128F_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_128F_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_192S_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_192S_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_192F_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_192F_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_256S_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_256S_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_256F_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_256F_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + + if (encode_pkey_as_pk11_uri) { + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSA_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSAPSS_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_EC_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ED25519_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ED448_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_X25519_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_X448_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_44_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_65_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_87_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_512_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_768_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_1024_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_128S_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_128F_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_192S_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_192F_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_256S_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_256F_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_128S_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_128F_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_192S_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_192F_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_256S_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_256F_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_ENCODER, algs); +} diff --git a/src/encoder.h b/src/encoder.h index 5f8ee2c8..d4a952f3 100644 --- a/src/encoder.h +++ b/src/encoder.h @@ -4,65 +4,9 @@ #ifndef _ENCODER_H #define _ENCODER_H -/* Encoders */ -#define DISPATCH_TEXT_ENCODER_FN(type, name) \ - static OSSL_FUNC_encoder_##name##_fn p11prov_##type##_encoder_##name##_text -#define DISPATCH_TEXT_ENCODER_ELEM(NAME, type, name) \ - { \ - OSSL_FUNC_ENCODER_##NAME, \ - (void (*)(void))p11prov_##type##_encoder_##name \ - } -#define DISPATCH_BASE_ENCODER_FN(name) \ - DECL_DISPATCH_FUNC(encoder, p11prov_encoder, name) -#define DISPATCH_BASE_ENCODER_ELEM(NAME, name) \ - { \ - OSSL_FUNC_ENCODER_##NAME, (void (*)(void))p11prov_encoder_##name \ - } -#define DISPATCH_ENCODER_FN(type, structure, format, name) \ - DECL_DISPATCH_FUNC(encoder, \ - p11prov_##type##_encoder_##structure##_##format, name) -#define DISPATCH_ENCODER_ELEM(NAME, type, structure, format, name) \ - { \ - OSSL_FUNC_ENCODER_##NAME, \ - (void (*)( \ - void))p11prov_##type##_encoder_##structure##_##format##_##name \ - } -extern const OSSL_DISPATCH p11prov_rsa_encoder_text_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_encoder_pkcs1_der_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_encoder_pkcs1_pem_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_encoder_spki_der_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_encoder_spki_pem_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH p11prov_ec_encoder_text_functions[]; -extern const OSSL_DISPATCH p11prov_ec_encoder_pkcs1_der_functions[]; -extern const OSSL_DISPATCH p11prov_ec_encoder_pkcs1_pem_functions[]; -extern const OSSL_DISPATCH p11prov_ec_encoder_spki_der_functions[]; -extern const OSSL_DISPATCH p11prov_ec_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH - p11prov_ec_edwards_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH p11prov_ec_edwards_encoder_text_functions[]; -extern const OSSL_DISPATCH - p11prov_ec_montgomery_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH p11prov_ec_montgomery_encoder_text_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_encoder_pkcs1_der_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_encoder_pkcs1_pem_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_encoder_spki_der_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_encoder_spki_pem_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_encoder_text_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem_encoder_pkcs1_der_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem_encoder_pkcs1_pem_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem_encoder_spki_der_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem_encoder_spki_pem_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem_encoder_text_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_encoder_pkcs1_der_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_encoder_pkcs1_pem_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_encoder_spki_der_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_encoder_spki_pem_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_encoder_text_functions[]; CK_RV rsa_pkeyinfo_to_attrs(CK_ATTRIBUTE *pkeyinfo, CK_ATTRIBUTE *attrs); +CK_RV p11prov_register_encoders(P11PROV_CTX *ctx, bool fips_property, + bool encode_pkey_as_pk11_uri); #endif /* _ENCODER_H */ diff --git a/src/exchange.c b/src/exchange.c index 4d4c5588..6ae30306 100644 --- a/src/exchange.c +++ b/src/exchange.c @@ -2,9 +2,10 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "exchange.h" +#include "kdf.h" #include #include -#include "kdf.h" struct p11prov_exch_ctx { P11PROV_CTX *provctx; @@ -59,6 +60,9 @@ static CK_ULONG p11prov_ecdh_digest_to_kdf(CK_MECHANISM_TYPE digest) return CK_UNAVAILABLE_INFORMATION; } +#define DISPATCH_KEYEXCH_FN(prefix, name) \ + DECL_DISPATCH_FUNC(keyexch, p11prov_##prefix, name) + DISPATCH_KEYEXCH_FN(ecdh, newctx); DISPATCH_KEYEXCH_FN(ecdh, dupctx); DISPATCH_KEYEXCH_FN(ecdh, freectx); @@ -573,7 +577,10 @@ static const OSSL_PARAM *p11prov_ecdh_gettable_ctx_params(void *ctx, void *prov) return params; } -const OSSL_DISPATCH p11prov_ecdh_exchange_functions[] = { +#define DISPATCH_KEYEXCH_ELEM(prefix, NAME, name) \ + { OSSL_FUNC_KEYEXCH_##NAME, (void (*)(void))p11prov_##prefix##_##name } + +const OSSL_DISPATCH p11prov_ecdh_functions[] = { DISPATCH_KEYEXCH_ELEM(ecdh, NEWCTX, newctx), DISPATCH_KEYEXCH_ELEM(ecdh, DUPCTX, dupctx), DISPATCH_KEYEXCH_ELEM(ecdh, FREECTX, freectx), @@ -590,7 +597,7 @@ const OSSL_DISPATCH p11prov_ecdh_exchange_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_x25519_exchange_functions[] = { +const OSSL_DISPATCH p11prov_x25519_functions[] = { DISPATCH_KEYEXCH_ELEM(ecdh, NEWCTX, newctx), DISPATCH_KEYEXCH_ELEM(ecdh, DUPCTX, dupctx), DISPATCH_KEYEXCH_ELEM(ecdh, FREECTX, freectx), @@ -603,7 +610,7 @@ const OSSL_DISPATCH p11prov_x25519_exchange_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_x448_exchange_functions[] = { +const OSSL_DISPATCH p11prov_x448_functions[] = { DISPATCH_KEYEXCH_ELEM(ecdh, NEWCTX, newctx), DISPATCH_KEYEXCH_ELEM(ecdh, DUPCTX, dupctx), DISPATCH_KEYEXCH_ELEM(ecdh, FREECTX, freectx), @@ -621,6 +628,9 @@ const OSSL_DISPATCH p11prov_x448_exchange_functions[] = { * because for some reason they want the command line -derive command * to be able to handle both key exchanges like ECDH and symmetric key * derivation done by KDFs via the -kdf selector */ +#define DISPATCH_EXCHHKDF_FN(name) \ + DECL_DISPATCH_FUNC(keyexch, p11prov_exch_hkdf, name) + DISPATCH_EXCHHKDF_FN(newctx); DISPATCH_EXCHHKDF_FN(freectx); DISPATCH_EXCHHKDF_FN(init); @@ -633,9 +643,9 @@ DISPATCH_EXCHHKDF_FN(settable_ctx_params); static void *fetch_hkdf_function(int func_id) { - for (int i = 0; p11prov_hkdf_kdf_functions[i].function_id != 0; i++) { - if (p11prov_hkdf_kdf_functions[i].function_id == func_id) { - return p11prov_hkdf_kdf_functions[i].function; + for (int i = 0; p11prov_hkdf_functions[i].function_id != 0; i++) { + if (p11prov_hkdf_functions[i].function_id == func_id) { + return p11prov_hkdf_functions[i].function; } } return NULL; @@ -802,7 +812,10 @@ static const OSSL_PARAM *p11prov_exch_hkdf_settable_ctx_params(void *ctx, return hkdf_settable_ctx_params(NULL, provctx); } -const OSSL_DISPATCH p11prov_hkdf_exchange_functions[] = { +#define DISPATCH_EXCHHKDF_ELEM(prefix, NAME, name) \ + { OSSL_FUNC_KEYEXCH_##NAME, (void (*)(void))p11prov_##prefix##_##name } + +const OSSL_DISPATCH p11prov_exch_hkdf_functions[] = { DISPATCH_EXCHHKDF_ELEM(exch_hkdf, NEWCTX, newctx), DISPATCH_EXCHHKDF_ELEM(exch_hkdf, FREECTX, freectx), DISPATCH_EXCHHKDF_ELEM(exch_hkdf, INIT, init), @@ -814,3 +827,59 @@ const OSSL_DISPATCH p11prov_hkdf_exchange_functions[] = { DISPATCH_EXCHHKDF_ELEM(exch_hkdf, SETTABLE_CTX_PARAMS, settable_ctx_params), { 0, NULL }, }; + +enum p11prov_keyexch_algorithms { + P11PROV_KEYEXCH_ECDH = 0, + P11PROV_KEYEXCH_X25519, + P11PROV_KEYEXCH_X448, + P11PROV_KEYEXCH_HKDF, + P11PROV_KEYEXCH_NUM_ALGS +}; + +const OSSL_ALGORITHM keyexch_algorithms[P11PROV_KEYEXCH_NUM_ALGS] = { + [P11PROV_KEYEXCH_ECDH] = DEFAULT_ALGORITHM(ECDH, p11prov_ecdh_functions), + [P11PROV_KEYEXCH_X25519] = + DEFAULT_ALGORITHM(X25519, p11prov_x25519_functions), + [P11PROV_KEYEXCH_X448] = DEFAULT_ALGORITHM(X448, p11prov_x448_functions), + [P11PROV_KEYEXCH_HKDF] = + DEFAULT_ALGORITHM(HKDF, p11prov_exch_hkdf_functions), +}; + +CK_RV p11prov_register_keyexch(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_KEYEXCH_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + if (mechs[TBID_ECDH1_DERIVE] || mechs[TBID_ECDH1_COFACTOR_DERIVE]) { + p11prov_assign_alg(&algs[i++], keyexch_algorithms, P11PROV_KEYEXCH_ECDH, + property); + } + if (mechs[TBID_EC_MONTGOMERY_KEY_PAIR_GEN]) { + p11prov_assign_alg(&algs[i++], keyexch_algorithms, + P11PROV_KEYEXCH_X25519, property); + p11prov_assign_alg(&algs[i++], keyexch_algorithms, P11PROV_KEYEXCH_X448, + property); + } + if (mechs[TBID_HKDF_DERIVE]) { + p11prov_assign_alg(&algs[i++], keyexch_algorithms, P11PROV_KEYEXCH_HKDF, + property); + } + + if (i == 0) { + OPENSSL_free(algs); + algs = NULL; + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_KEYEXCH, algs); +} diff --git a/src/exchange.h b/src/exchange.h index dd4d1901..8bbb33c9 100644 --- a/src/exchange.h +++ b/src/exchange.h @@ -4,22 +4,7 @@ #ifndef _EXCHANGE_H #define _EXCHANGE_H -/* ecdh derivation */ -#define DISPATCH_KEYEXCH_FN(prefix, name) \ - DECL_DISPATCH_FUNC(keyexch, p11prov_##prefix, name) -#define DISPATCH_KEYEXCH_ELEM(prefix, NAME, name) \ - { OSSL_FUNC_KEYEXCH_##NAME, (void (*)(void))p11prov_##prefix##_##name } -extern const OSSL_DISPATCH p11prov_ecdh_exchange_functions[]; -extern const OSSL_DISPATCH p11prov_x25519_exchange_functions[]; -extern const OSSL_DISPATCH p11prov_x448_exchange_functions[]; - -/* HKDF exchange fns */ -#define DISPATCH_EXCHHKDF_FN(name) \ - DECL_DISPATCH_FUNC(keyexch, p11prov_exch_hkdf, name) -#define DISPATCH_EXCHHKDF_ELEM(prefix, NAME, name) \ - { \ - OSSL_FUNC_KEYEXCH_##NAME, (void (*)(void))p11prov_##prefix##_##name \ - } -extern const OSSL_DISPATCH p11prov_hkdf_exchange_functions[]; +CK_RV p11prov_register_keyexch(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); #endif /* _EXCHANGE_H */ diff --git a/src/interface.c b/src/interface.c index 87b0434f..8e0cd616 100644 --- a/src/interface.c +++ b/src/interface.c @@ -22,7 +22,6 @@ struct p11prov_module_ctx { CK_INFO ck_info; - pthread_mutex_t lock; bool initialized; bool reinit; }; @@ -265,7 +264,6 @@ CK_RV p11prov_module_new(P11PROV_CTX *ctx, const char *path, { struct p11prov_module_ctx *mctx; const char *env_module; - CK_RV ret; mctx = OPENSSL_zalloc(sizeof(struct p11prov_module_ctx)); if (!mctx) { @@ -303,12 +301,6 @@ CK_RV p11prov_module_new(P11PROV_CTX *ctx, const char *path, } } - ret = MUTEX_INIT(mctx); - if (ret != CKR_OK) { - p11prov_module_free(mctx); - return ret; - } - *_mctx = mctx; return CKR_OK; } @@ -317,22 +309,19 @@ CK_RV p11prov_module_new(P11PROV_CTX *ctx, const char *path, #define RTLD_DEEPBIND 0 #endif -CK_RV p11prov_module_init(P11PROV_MODULE *mctx) +CK_RV p11prov_module_init(P11PROV_CTX *ctx) { + P11PROV_MODULE *mctx; P11PROV_SLOTS_CTX *slots; CK_C_INITIALIZE_ARGS args = { 0 }; CK_RV ret; + mctx = p11prov_ctx_get_module(ctx); if (!mctx) { + p11prov_ctx_set_status(ctx, P11PROV_IN_ERROR); return CKR_GENERAL_ERROR; } - ret = MUTEX_LOCK(mctx); - if (ret != CKR_OK) { - return ret; - } - - /* LOCKED SECTION ------------- */ if (mctx->initialized) { ret = CKR_OK; goto done; @@ -383,11 +372,13 @@ CK_RV p11prov_module_init(P11PROV_MODULE *mctx) p11prov_ctx_set_slots(mctx->provctx, slots); + p11prov_ctx_set_status(ctx, P11PROV_OPS_NEEDS_INIT); ret = CKR_OK; done: - (void)MUTEX_UNLOCK(mctx); - /* ------------- LOCKED SECTION */ + if (ret != CKR_OK) { + p11prov_ctx_set_status(ctx, P11PROV_IN_ERROR); + } return ret; } @@ -421,24 +412,22 @@ void p11prov_module_mark_reinit(P11PROV_MODULE *mctx) mctx->reinit = true; } -CK_RV p11prov_module_reinit(P11PROV_MODULE *mctx) +CK_RV p11prov_module_reinit(P11PROV_CTX *ctx) { + P11PROV_MODULE *mctx; CK_C_INITIALIZE_ARGS args = { 0 }; CK_INFO ck_info = { 0 }; CK_RV ret; + mctx = p11prov_ctx_get_module(ctx); if (!mctx) { + p11prov_ctx_set_status(ctx, P11PROV_IN_ERROR); return CKR_GENERAL_ERROR; } - ret = MUTEX_LOCK(mctx); - if (ret != CKR_OK) { - return ret; - } - - /* LOCKED SECTION ------------- */ if (!mctx->reinit) { /* another thread already did it */ + ret = CKR_OK; goto done; } @@ -495,9 +484,11 @@ CK_RV p11prov_module_reinit(P11PROV_MODULE *mctx) ret = CKR_GENERAL_ERROR; } + p11prov_ctx_set_status(ctx, P11PROV_INITIALIZED); done: - (void)MUTEX_UNLOCK(mctx); - /* ------------- LOCKED SECTION */ + if (ret != CKR_OK) { + p11prov_ctx_set_status(ctx, P11PROV_IN_ERROR); + } return ret; } diff --git a/src/interface.h b/src/interface.h index 8e255406..52e9b7e2 100644 --- a/src/interface.h +++ b/src/interface.h @@ -15,11 +15,11 @@ /* interface declarations for PKCS#11 wrapper functions */ CK_RV p11prov_module_new(P11PROV_CTX *ctx, const char *path, const char *init_args, P11PROV_MODULE **_mctx); -CK_RV p11prov_module_init(P11PROV_MODULE *mctx); +CK_RV p11prov_module_init(P11PROV_CTX *ctx); P11PROV_INTERFACE *p11prov_module_get_interface(P11PROV_MODULE *mctx); void p11prov_module_free(P11PROV_MODULE *mctx); void p11prov_module_mark_reinit(P11PROV_MODULE *mctx); -CK_RV p11prov_module_reinit(P11PROV_MODULE *mctx); +CK_RV p11prov_module_reinit(P11PROV_CTX *ctx); CK_RV p11prov_Initialize(P11PROV_CTX *ctx, CK_VOID_PTR pInitArgs); CK_RV p11prov_Finalize(P11PROV_CTX *ctx, CK_VOID_PTR pReserved); CK_RV p11prov_GetInfo(P11PROV_CTX *ctx, CK_INFO_PTR pInfo); diff --git a/src/kdf.c b/src/kdf.c index 0cc54422..e6ef3439 100644 --- a/src/kdf.c +++ b/src/kdf.c @@ -2,6 +2,7 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "kdf.h" #include "platform/endian.h" #include #include @@ -31,6 +32,8 @@ struct p11prov_kdf_ctx { }; typedef struct p11prov_kdf_ctx P11PROV_KDF_CTX; +#define DISPATCH_HKDF_FN(name) DECL_DISPATCH_FUNC(kdf, p11prov_hkdf, name) + DISPATCH_HKDF_FN(newctx); DISPATCH_HKDF_FN(freectx); DISPATCH_HKDF_FN(reset); @@ -939,7 +942,10 @@ static const OSSL_PARAM *p11prov_hkdf_gettable_ctx_params(void *ctx, void *prov) return params; } -const OSSL_DISPATCH p11prov_hkdf_kdf_functions[] = { +#define DISPATCH_HKDF_ELEM(prefix, NAME, name) \ + { OSSL_FUNC_KDF_##NAME, (void (*)(void))p11prov_##prefix##_##name } + +const OSSL_DISPATCH p11prov_hkdf_functions[] = { DISPATCH_HKDF_ELEM(hkdf, NEWCTX, newctx), DISPATCH_HKDF_ELEM(hkdf, FREECTX, freectx), DISPATCH_HKDF_ELEM(hkdf, RESET, reset), @@ -995,3 +1001,47 @@ const OSSL_DISPATCH p11prov_tls13_kdf_functions[] = { #endif { 0, NULL }, }; + +enum p11prov_kdf_algorithms { + P11PROV_KDF_HKDF = 0, + P11PROV_KDF_TLS13_KDF, + P11PROV_KDF_NUM_ALGS +}; + +const OSSL_ALGORITHM kdf_algorithms[P11PROV_KDF_NUM_ALGS] = { + [P11PROV_KDF_HKDF] = DEFAULT_ALGORITHM(HKDF, p11prov_hkdf_functions), + [P11PROV_KDF_TLS13_KDF] = + DEFAULT_ALGORITHM(TLS13_KDF, p11prov_tls13_kdf_functions), +}; + +CK_RV p11prov_register_kdfs(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + const char *property = NULL; + + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_KDF_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + if (mechs[TBID_HKDF_DERIVE]) { + p11prov_assign_alg(&algs[i++], kdf_algorithms, P11PROV_KDF_HKDF, + property); + p11prov_assign_alg(&algs[i++], kdf_algorithms, P11PROV_KDF_TLS13_KDF, + property); + } + + if (i == 0) { + OPENSSL_free(algs); + algs = NULL; + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_KDF, algs); +} diff --git a/src/kdf.h b/src/kdf.h index dfd3cb20..4b0c17c2 100644 --- a/src/kdf.h +++ b/src/kdf.h @@ -4,14 +4,10 @@ #ifndef _KDF_H #define _KDF_H -/* HKDF kdf fns */ -#define DISPATCH_HKDF_FN(name) DECL_DISPATCH_FUNC(kdf, p11prov_hkdf, name) -#define DISPATCH_HKDF_ELEM(prefix, NAME, name) \ - { \ - OSSL_FUNC_KDF_##NAME, (void (*)(void))p11prov_##prefix##_##name \ - } extern const void *p11prov_hkdf_static_ctx; -extern const OSSL_DISPATCH p11prov_hkdf_kdf_functions[]; -extern const OSSL_DISPATCH p11prov_tls13_kdf_functions[]; +extern const OSSL_DISPATCH p11prov_hkdf_functions[]; + +CK_RV p11prov_register_kdfs(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); #endif /* _KDF_H */ diff --git a/src/kem.c b/src/kem.c index 13060e3c..cbb3f82c 100644 --- a/src/kem.c +++ b/src/kem.c @@ -18,6 +18,8 @@ struct p11prov_kem_ctx { }; typedef struct p11prov_kem_ctx P11PROV_KEM_CTX; +#define DISPATCH_MLKEM_FN(name) DECL_DISPATCH_FUNC(kem, p11prov_mlkem, name) + DISPATCH_MLKEM_FN(newctx); DISPATCH_MLKEM_FN(freectx); DISPATCH_MLKEM_FN(encapsulate_init); @@ -379,7 +381,10 @@ p11prov_mlkem_settable_ctx_params(ossl_unused void *vctx, return settable; } -const OSSL_DISPATCH p11prov_mlkem_kem_functions[] = { +#define DISPATCH_MLKEM_ELEM(prefix, NAME, name) \ + { OSSL_FUNC_KEM_##NAME, (void (*)(void))p11prov_##prefix##_##name } + +const OSSL_DISPATCH p11prov_mlkem_functions[] = { DISPATCH_MLKEM_ELEM(mlkem, NEWCTX, newctx), DISPATCH_MLKEM_ELEM(mlkem, FREECTX, freectx), DISPATCH_MLKEM_ELEM(mlkem, ENCAPSULATE_INIT, encapsulate_init), @@ -390,3 +395,52 @@ const OSSL_DISPATCH p11prov_mlkem_kem_functions[] = { DISPATCH_MLKEM_ELEM(mlkem, SETTABLE_CTX_PARAMS, settable_ctx_params), { 0, NULL }, }; + +enum p11prov_kem_algorithms { + P11PROV_KEM_ML_KEM_512, + P11PROV_KEM_ML_KEM_768, + P11PROV_KEM_ML_KEM_1024, + P11PROV_KEM_NUM_ALGS +}; + +const OSSL_ALGORITHM kem_algorithms[P11PROV_KEM_NUM_ALGS] = { + [P11PROV_KEM_ML_KEM_512] = + DEFAULT_ALGORITHM(ML_KEM_512, p11prov_mlkem_functions), + [P11PROV_KEM_ML_KEM_768] = + DEFAULT_ALGORITHM(ML_KEM_768, p11prov_mlkem_functions), + [P11PROV_KEM_ML_KEM_1024] = + DEFAULT_ALGORITHM(ML_KEM_1024, p11prov_mlkem_functions), +}; + +CK_RV p11prov_register_kems(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_KEM_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + if (mechs[TBID_ML_KEM]) { + p11prov_assign_alg(&algs[i++], kem_algorithms, P11PROV_KEM_ML_KEM_512, + property); + p11prov_assign_alg(&algs[i++], kem_algorithms, P11PROV_KEM_ML_KEM_768, + property); + p11prov_assign_alg(&algs[i++], kem_algorithms, P11PROV_KEM_ML_KEM_1024, + property); + } + + if (i == 0) { + OPENSSL_free(algs); + algs = NULL; + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_KEM, algs); +} diff --git a/src/kem.h b/src/kem.h index 43cee05d..09650142 100644 --- a/src/kem.h +++ b/src/kem.h @@ -4,12 +4,7 @@ #ifndef _KEM_H #define _KEM_H -#include "provider.h" - -/* ml-kem kem */ -#define DISPATCH_MLKEM_FN(name) DECL_DISPATCH_FUNC(kem, p11prov_mlkem, name) -#define DISPATCH_MLKEM_ELEM(prefix, NAME, name) \ - { OSSL_FUNC_KEM_##NAME, (void (*)(void))p11prov_##prefix##_##name } -extern const OSSL_DISPATCH p11prov_mlkem_kem_functions[]; +CK_RV p11prov_register_kems(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); #endif /* _KEM_H */ diff --git a/src/kmgmt/common.c b/src/kmgmt/common.c index 4d9c5798..b94444ef 100644 --- a/src/kmgmt/common.c +++ b/src/kmgmt/common.c @@ -504,3 +504,157 @@ int p11prov_kmgmt_export(void *keydata, int selection, OSSL_CALLBACK *cb_fn, /* nothing to export, just return OK */ return RET_OSSL_OK; } + +enum p11prov_kmgmt_algorithms { + P11PROV_KMGMT_RSA = 0, + P11PROV_KMGMT_RSAPSS, + P11PROV_KMGMT_EC, + P11PROV_KMGMT_HKDF, + P11PROV_KMGMT_ED25519, + P11PROV_KMGMT_ED448, + P11PROV_KMGMT_X25519, + P11PROV_KMGMT_X448, + P11PROV_KMGMT_MLDSA_44, + P11PROV_KMGMT_MLDSA_65, + P11PROV_KMGMT_MLDSA_87, + P11PROV_KMGMT_ML_KEM_512, + P11PROV_KMGMT_ML_KEM_768, + P11PROV_KMGMT_ML_KEM_1024, + P11PROV_KMGMT_SLHDSA_SHA2_128S, + P11PROV_KMGMT_SLHDSA_SHA2_128F, + P11PROV_KMGMT_SLHDSA_SHA2_192S, + P11PROV_KMGMT_SLHDSA_SHA2_192F, + P11PROV_KMGMT_SLHDSA_SHA2_256S, + P11PROV_KMGMT_SLHDSA_SHA2_256F, + P11PROV_KMGMT_SLHDSA_SHAKE_128S, + P11PROV_KMGMT_SLHDSA_SHAKE_128F, + P11PROV_KMGMT_SLHDSA_SHAKE_192S, + P11PROV_KMGMT_SLHDSA_SHAKE_192F, + P11PROV_KMGMT_SLHDSA_SHAKE_256S, + P11PROV_KMGMT_SLHDSA_SHAKE_256F, + P11PROV_KMGMT_NUM_ALGS +}; + +const OSSL_ALGORITHM kmgmt_algorithms[P11PROV_KMGMT_NUM_ALGS] = { + [P11PROV_KMGMT_RSA] = DEFAULT_ALGORITHM(RSA, p11prov_rsa_keymgmt_functions), + [P11PROV_KMGMT_RSAPSS] = + DEFAULT_ALGORITHM(RSAPSS, p11prov_rsapss_keymgmt_functions), + [P11PROV_KMGMT_EC] = DEFAULT_ALGORITHM(EC, p11prov_ec_keymgmt_functions), + [P11PROV_KMGMT_HKDF] = + DEFAULT_ALGORITHM(HKDF, p11prov_hkdf_keymgmt_functions), + [P11PROV_KMGMT_ED25519] = + DEFAULT_ALGORITHM(ED25519, p11prov_ed25519_keymgmt_functions), + [P11PROV_KMGMT_ED448] = + DEFAULT_ALGORITHM(ED448, p11prov_ed448_keymgmt_functions), + [P11PROV_KMGMT_X25519] = + DEFAULT_ALGORITHM(X25519, p11prov_x25519_keymgmt_functions), + [P11PROV_KMGMT_X448] = + DEFAULT_ALGORITHM(X448, p11prov_x448_keymgmt_functions), + [P11PROV_KMGMT_MLDSA_44] = + DEFAULT_ALGORITHM(MLDSA_44, p11prov_mldsa44_keymgmt_functions), + [P11PROV_KMGMT_MLDSA_65] = + DEFAULT_ALGORITHM(MLDSA_65, p11prov_mldsa65_keymgmt_functions), + [P11PROV_KMGMT_MLDSA_87] = + DEFAULT_ALGORITHM(MLDSA_87, p11prov_mldsa87_keymgmt_functions), + [P11PROV_KMGMT_ML_KEM_512] = + DEFAULT_ALGORITHM(ML_KEM_512, p11prov_mlkem512_keymgmt_functions), + [P11PROV_KMGMT_ML_KEM_768] = + DEFAULT_ALGORITHM(ML_KEM_768, p11prov_mlkem768_keymgmt_functions), + [P11PROV_KMGMT_ML_KEM_1024] = + DEFAULT_ALGORITHM(ML_KEM_1024, p11prov_mlkem1024_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHA2_128S] = DEFAULT_ALGORITHM( + SLHDSA_SHA2_128S, p11prov_slhdsa_sha2_128s_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHA2_128F] = DEFAULT_ALGORITHM( + SLHDSA_SHA2_128F, p11prov_slhdsa_sha2_128f_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHA2_192S] = DEFAULT_ALGORITHM( + SLHDSA_SHA2_192S, p11prov_slhdsa_sha2_192s_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHA2_192F] = DEFAULT_ALGORITHM( + SLHDSA_SHA2_192F, p11prov_slhdsa_sha2_192f_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHA2_256S] = DEFAULT_ALGORITHM( + SLHDSA_SHA2_256S, p11prov_slhdsa_sha2_256s_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHA2_256F] = DEFAULT_ALGORITHM( + SLHDSA_SHA2_256F, p11prov_slhdsa_sha2_256f_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHAKE_128S] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_128S, p11prov_slhdsa_shake_128s_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHAKE_128F] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_128F, p11prov_slhdsa_shake_128f_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHAKE_192S] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_192S, p11prov_slhdsa_shake_192s_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHAKE_192F] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_192F, p11prov_slhdsa_shake_192f_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHAKE_256S] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_256S, p11prov_slhdsa_shake_256s_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHAKE_256F] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_256F, p11prov_slhdsa_shake_256f_keymgmt_functions), +}; + +CK_RV p11prov_register_kmgmt(P11PROV_CTX *ctx, bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_KMGMT_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_RSA, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_RSAPSS, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_EC, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_HKDF, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ED25519, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ED448, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_X25519, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_X448, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_MLDSA_44, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_MLDSA_65, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_MLDSA_87, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ML_KEM_512, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ML_KEM_768, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ML_KEM_1024, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHA2_128S, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHA2_128F, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHA2_192S, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHA2_192F, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHA2_256S, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHA2_256F, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHAKE_128S, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHAKE_128F, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHAKE_192S, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHAKE_192F, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHAKE_256S, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHAKE_256F, property); + + return p11prov_ctx_add_algs(ctx, OSSL_OP_KEYMGMT, algs); +} diff --git a/src/kmgmt/hkdf.c b/src/kmgmt/hkdf.c index 806fb5b7..e4aeabb0 100644 --- a/src/kmgmt/hkdf.c +++ b/src/kmgmt/hkdf.c @@ -2,6 +2,8 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "exchange.h" +#include "kmgmt/internal.h" DISPATCH_KEYMGMT_FN(hkdf, new); DISPATCH_KEYMGMT_FN(hkdf, free); diff --git a/src/kmgmt/internal.h b/src/kmgmt/internal.h index bb6593c1..8b38f445 100644 --- a/src/kmgmt/internal.h +++ b/src/kmgmt/internal.h @@ -1,6 +1,8 @@ /* Copyright (C) 2022-2025 Simo Sorce SPDX-License-Identifier: Apache-2.0 */ +#include "kmgmt/keymgmt.h" + struct key_generator { P11PROV_CTX *provctx; @@ -72,3 +74,35 @@ int p11prov_kmgmt_import(CK_KEY_TYPE type, CK_ULONG param_set, int selection, const OSSL_PARAM params[]); int p11prov_kmgmt_export(void *keydata, int selection, OSSL_CALLBACK *cb_fn, void *cb_arg); + +#define DISPATCH_KEYMGMT_FN(type, name) \ + DECL_DISPATCH_FUNC(keymgmt, p11prov_##type, name) +#define DISPATCH_KEYMGMT_ELEM(type, NAME, name) \ + { OSSL_FUNC_KEYMGMT_##NAME, (void (*)(void))p11prov_##type##_##name } + +extern const OSSL_DISPATCH p11prov_rsa_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_rsapss_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_ec_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_hkdf_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_ed25519_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_ed448_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_x25519_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_x448_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_mldsa44_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_mldsa65_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_mldsa87_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_mlkem512_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_mlkem768_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_mlkem1024_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128s_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128f_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192s_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192f_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256s_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256f_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_128s_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_128f_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_192s_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_192f_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_256s_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_256f_keymgmt_functions[]; diff --git a/src/kmgmt/keymgmt.h b/src/kmgmt/keymgmt.h index 4d5fed28..4e41df05 100644 --- a/src/kmgmt/keymgmt.h +++ b/src/kmgmt/keymgmt.h @@ -4,42 +4,9 @@ #ifndef _KEYMGMT_H #define _KEYMGMT_H -/* keymgmt */ - #define P11PROV_N_RSAPSS_MECHS 10 extern const CK_MECHANISM_TYPE p11prov_rsapss_mechs[P11PROV_N_RSAPSS_MECHS]; -#define DISPATCH_KEYMGMT_FN(type, name) \ - DECL_DISPATCH_FUNC(keymgmt, p11prov_##type, name) -#define DISPATCH_KEYMGMT_ELEM(type, NAME, name) \ - { \ - OSSL_FUNC_KEYMGMT_##NAME, (void (*)(void))p11prov_##type##_##name \ - } -extern const OSSL_DISPATCH p11prov_rsa_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_rsapss_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_ec_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_hkdf_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_ed25519_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_ed448_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_x25519_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_x448_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa44_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa65_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa87_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem512_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem768_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem1024_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128s_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128f_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192s_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192f_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256s_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256f_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_128s_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_128f_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_192s_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_192f_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_256s_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_256f_keymgmt_functions[]; +CK_RV p11prov_register_kmgmt(P11PROV_CTX *ctx, bool fips_property); #endif /* _KEYMGMT_H */ diff --git a/src/kmgmt/rsa.c b/src/kmgmt/rsa.c index feb344b9..e92d8c55 100644 --- a/src/kmgmt/rsa.c +++ b/src/kmgmt/rsa.c @@ -4,6 +4,7 @@ #include "provider.h" #include "platform/endian.h" #include "kmgmt/internal.h" +#include "sig/signature.h" DISPATCH_KEYMGMT_FN(rsa, new); DISPATCH_KEYMGMT_FN(rsa, gen_cleanup); diff --git a/src/kmgmt/skey.c b/src/kmgmt/skey.c index 7eb21181..35845002 100644 --- a/src/kmgmt/skey.c +++ b/src/kmgmt/skey.c @@ -2,12 +2,16 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "kmgmt/skey.h" #if SKEY_SUPPORT == 1 #include "platform/endian.h" #include +#define DISPATCH_SKEYMGMT_FN(type, name) \ + DECL_DISPATCH_FUNC(skeymgmt, p11prov_##type, name) + DISPATCH_SKEYMGMT_FN(aes, free); DISPATCH_SKEYMGMT_FN(aes, import); DISPATCH_SKEYMGMT_FN(aes, export); @@ -291,7 +295,10 @@ static const OSSL_PARAM *p11prov_aes_gen_settable_params(void *provctx) return aes_generate_params; } -const OSSL_DISPATCH p11prov_aes_skeymgmt_functions[] = { +#define DISPATCH_SKEYMGMT_ELEM(type, NAME, name) \ + { OSSL_FUNC_SKEYMGMT_##NAME, (void (*)(void))p11prov_##type##_##name } + +const OSSL_DISPATCH p11prov_aes_functions[] = { DISPATCH_SKEYMGMT_ELEM(aes, FREE, free), DISPATCH_SKEYMGMT_ELEM(aes, IMPORT, import), DISPATCH_SKEYMGMT_ELEM(aes, EXPORT, export), @@ -651,7 +658,7 @@ p11prov_generic_secret_gen_settable_params(void *provctx) return generic_secret_generate_params; } -const OSSL_DISPATCH p11prov_generic_secret_skeymgmt_functions[] = { +const OSSL_DISPATCH p11prov_generic_secret_functions[] = { DISPATCH_SKEYMGMT_ELEM(generic_secret, FREE, free), DISPATCH_SKEYMGMT_ELEM(generic_secret, IMPORT, import), DISPATCH_SKEYMGMT_ELEM(generic_secret, EXPORT, export), @@ -664,4 +671,39 @@ const OSSL_DISPATCH p11prov_generic_secret_skeymgmt_functions[] = { { 0, NULL }, }; +enum p11prov_skmgmt_algorithms { + P11PROV_SKMGMT_AES = 0, + P11PROV_SKMGMT_GENERIC_SECRET, + P11PROV_SKMGMT_NUM_ALGS +}; + +const OSSL_ALGORITHM skmgmt_algorithms[P11PROV_SKMGMT_NUM_ALGS] = { + [P11PROV_SKMGMT_AES] = DEFAULT_ALGORITHM(AES, p11prov_aes_functions), + [P11PROV_SKMGMT_GENERIC_SECRET] = + DEFAULT_ALGORITHM(GENERIC_SECRET, p11prov_generic_secret_functions), +}; + +CK_RV p11prov_register_skmgmt(P11PROV_CTX *ctx, bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_SKMGMT_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + p11prov_assign_alg(&algs[i++], skmgmt_algorithms, P11PROV_SKMGMT_AES, + property); + p11prov_assign_alg(&algs[i++], skmgmt_algorithms, + P11PROV_SKMGMT_GENERIC_SECRET, property); + + return p11prov_ctx_add_algs(ctx, OSSL_OP_SKEYMGMT, algs); +} + #endif diff --git a/src/kmgmt/skey.h b/src/kmgmt/skey.h index da851e54..1accdece 100644 --- a/src/kmgmt/skey.h +++ b/src/kmgmt/skey.h @@ -4,12 +4,6 @@ #ifndef _SKEYMGMT_H #define _SKEYMGMT_H -/* keymgmt */ -#define DISPATCH_SKEYMGMT_FN(type, name) \ - DECL_DISPATCH_FUNC(skeymgmt, p11prov_##type, name) -#define DISPATCH_SKEYMGMT_ELEM(type, NAME, name) \ - { OSSL_FUNC_SKEYMGMT_##NAME, (void (*)(void))p11prov_##type##_##name } -extern const OSSL_DISPATCH p11prov_aes_skeymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_generic_secret_skeymgmt_functions[]; +CK_RV p11prov_register_skmgmt(P11PROV_CTX *ctx, bool fips_property); #endif /* _SKEYMGMT_H */ diff --git a/src/meson.build b/src/meson.build index aaf6d51b..40d9b3ef 100644 --- a/src/meson.build +++ b/src/meson.build @@ -17,6 +17,7 @@ pkcs11_provider_sources = [ 'kmgmt/slhdsa.c', 'pk11_uri.c', 'interface.c', + 'registration.c', 'obj/create.c', 'obj/export.c', 'obj/keymgmt.c', diff --git a/src/obj/internal.h b/src/obj/internal.h index 909661a6..be5d50d3 100644 --- a/src/obj/internal.h +++ b/src/obj/internal.h @@ -5,6 +5,7 @@ #define _OBJ_INTERNAL_H_ #include "provider.h" +#include "encoder.h" struct p11prov_key { CK_KEY_TYPE type; diff --git a/src/obj/keymgmt.c b/src/obj/keymgmt.c index da741630..8a9ec992 100644 --- a/src/obj/keymgmt.c +++ b/src/obj/keymgmt.c @@ -2,6 +2,7 @@ SPDX-License-Identifier: Apache-2.0 */ #include "obj/internal.h" +#include "kmgmt/keymgmt.h" bool p11prov_obj_is_rsa_pss(P11PROV_OBJ *obj) { diff --git a/src/provider.c b/src/provider.c index 1090b597..32b3553b 100644 --- a/src/provider.c +++ b/src/provider.c @@ -3,22 +3,31 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" -#include "decoder.h" #include #include +#include "asymmetric_cipher.h" +#include "decoder.h" +#include "encoder.h" +#include "exchange.h" +#include "kdf.h" +#include "kem.h" +#include "kmgmt/keymgmt.h" +#include "random.h" +#include "sig/signature.h" +#include "store.h" + +#if SKEY_SUPPORT == 1 +#include "cipher.h" +#include "kmgmt/skey.h" +#endif + struct p11prov_interface; struct quirk; struct p11prov_ctx { - - enum { - P11PROV_UNINITIALIZED = 0, - P11PROV_INITIALIZED, - P11PROV_NEEDS_REINIT, - P11PROV_NO_DEINIT, - P11PROV_IN_ERROR, - } status; + pthread_mutex_t init_lock; + enum p11prov_ctx_status status; /* Provider handles */ const OSSL_CORE_HANDLE *handle; @@ -53,11 +62,10 @@ struct p11prov_ctx { OSSL_ALGORITHM *op_digest; OSSL_ALGORITHM *op_kdf; OSSL_ALGORITHM *op_random; - OSSL_ALGORITHM *op_exchange; + OSSL_ALGORITHM *op_keyexch; OSSL_ALGORITHM *op_signature; OSSL_ALGORITHM *op_asym_cipher; OSSL_ALGORITHM *op_kem; - OSSL_ALGORITHM *op_encoder; OSSL_ALGORITHM *op_decoder; OSSL_ALGORITHM *op_keymgmt; @@ -72,6 +80,19 @@ struct p11prov_ctx { int nquirks; }; +#define INIT_LOCK_INIT(ctx) \ + p11prov_mutex_init(ctx, &ctx->init_lock, "init_lock", OPENSSL_FILE, \ + OPENSSL_LINE, OPENSSL_FUNC) +#define INIT_LOCK_LOCK(obj) \ + p11prov_mutex_lock(ctx, &ctx->init_lock, "init_lock", OPENSSL_FILE, \ + OPENSSL_LINE, OPENSSL_FUNC) +#define INIT_LOCK_UNLOCK(obj) \ + p11prov_mutex_unlock(ctx, &ctx->init_lock, "init_lock", OPENSSL_FILE, \ + OPENSSL_LINE, OPENSSL_FUNC) +#define INIT_LOCK_DESTROY(ctx) \ + p11prov_mutex_destroy(ctx, &ctx->init_lock, "init_lock", OPENSSL_FILE, \ + OPENSSL_LINE, OPENSSL_FUNC) + static struct p11prov_context_pool { struct p11prov_ctx **contexts; int num; @@ -465,6 +486,16 @@ P11PROV_INTERFACE *p11prov_ctx_get_interface(P11PROV_CTX *ctx) return p11prov_module_get_interface(ctx->module); } +P11PROV_MODULE *p11prov_ctx_get_module(P11PROV_CTX *ctx) +{ + return ctx->module; +} + +void p11prov_ctx_set_status(P11PROV_CTX *ctx, enum p11prov_ctx_status status) +{ + ctx->status = status; +} + CK_SLOT_ID p11prov_ctx_get_default_slotid(P11PROV_CTX *ctx) { return ctx->default_slotid; @@ -496,32 +527,54 @@ CK_RV p11prov_ctx_status(P11PROV_CTX *ctx) switch (ctx->status) { case P11PROV_UNINITIALIZED: - ret = p11prov_module_init(ctx->module); + ret = INIT_LOCK_LOCK(ctx); + if (ret != CKR_OK) { + return ret; + } + /* LOCKED SECTION ------------- */ + ret = p11prov_module_init(ctx); + /* optimize lock use and also init operations */ + if (ret == CKR_OK) { + ret = operations_init(ctx); + } + (void)INIT_LOCK_UNLOCK(ctx); + /* ------------- LOCKED SECTION */ if (ret != CKR_OK) { P11PROV_raise(ctx, ret, "Module initialization failed!"); - ctx->status = P11PROV_IN_ERROR; - break; + return ret; + } + break; + case P11PROV_OPS_NEEDS_INIT: + ret = INIT_LOCK_LOCK(ctx); + if (ret != CKR_OK) { + return ret; } + /* LOCKED SECTION ------------- */ ret = operations_init(ctx); + (void)INIT_LOCK_UNLOCK(ctx); + /* ------------- LOCKED SECTION */ if (ret != CKR_OK) { P11PROV_raise(ctx, ret, "Operations initialization failed!"); - ctx->status = P11PROV_IN_ERROR; - break; + return ret; } - ctx->status = P11PROV_INITIALIZED; break; case P11PROV_INITIALIZED: case P11PROV_NO_DEINIT: ret = CKR_OK; break; case P11PROV_NEEDS_REINIT: - ret = p11prov_module_reinit(ctx->module); + ret = INIT_LOCK_LOCK(ctx); + if (ret != CKR_OK) { + return ret; + } + /* LOCKED SECTION ------------- */ + ret = p11prov_module_reinit(ctx); + (void)INIT_LOCK_UNLOCK(ctx); + /* ------------- LOCKED SECTION */ if (ret != CKR_OK) { P11PROV_raise(ctx, ret, "Module re-initialization failed!"); - ctx->status = P11PROV_IN_ERROR; - break; + return ret; } - ctx->status = P11PROV_INITIALIZED; break; case P11PROV_IN_ERROR: P11PROV_raise(ctx, CKR_GENERAL_ERROR, "Module in error state!"); @@ -555,7 +608,7 @@ static void p11prov_ctx_free(P11PROV_CTX *ctx) OPENSSL_free(ctx->op_digest); OPENSSL_free(ctx->op_kdf); OPENSSL_free(ctx->op_random); - OPENSSL_free(ctx->op_exchange); + OPENSSL_free(ctx->op_keyexch); OPENSSL_free(ctx->op_signature); OPENSSL_free(ctx->op_asym_cipher); OPENSSL_free(ctx->op_kem); @@ -616,6 +669,8 @@ static void p11prov_ctx_free(P11PROV_CTX *ctx) /* remove from pool */ context_rm_pool(ctx); + INIT_LOCK_DESTROY(ctx); + OPENSSL_clear_free(ctx, sizeof(P11PROV_CTX)); } @@ -800,897 +855,187 @@ static int p11prov_get_params(void *provctx, OSSL_PARAM params[]) return RET_OSSL_OK; } -/* TODO: this needs to be made dynamic, - * based on what the pkcs11 module supports */ -#define ALGOS_ALLOC 4 -static CK_RV alg_set_op(OSSL_ALGORITHM **op, int idx, OSSL_ALGORITHM *alg) +CK_RV p11prov_ctx_add_algs(P11PROV_CTX *ctx, int operation_id, + OSSL_ALGORITHM *algs) { - if (idx % ALGOS_ALLOC == 0) { - OSSL_ALGORITHM *tmp = - OPENSSL_realloc(*op, sizeof(OSSL_ALGORITHM) * (idx + ALGOS_ALLOC)); - if (!tmp) { - return CKR_HOST_MEMORY; - } - *op = tmp; - } - (*op)[idx] = *alg; - return CKR_OK; -} - -#define ADD_ALGO_EXT(NAME, operation, prop, func) \ - do { \ - CK_RV alg_ret; \ - OSSL_ALGORITHM alg = { P11PROV_NAMES_##NAME, prop, func, \ - P11PROV_DESCS_##NAME }; \ - alg_ret = alg_set_op(&ctx->op_##operation, operation##_idx, &alg); \ - if (alg_ret != CKR_OK) { \ - P11PROV_raise(ctx, alg_ret, "Failed to store mech algo"); \ - return RET_OSSL_ERR; \ - } \ - operation##_idx++; \ - } while (0) - -#define ADD_ALGO(NAME, name, operation, prop) \ - ADD_ALGO_EXT(NAME, operation, prop, \ - p11prov_##name##_##operation##_functions) - -#define TERM_ALGO(operation) \ - if (operation##_idx > 0) { \ - CK_RV alg_ret; \ - OSSL_ALGORITHM alg = { NULL, NULL, NULL, NULL }; \ - alg_ret = alg_set_op(&ctx->op_##operation, operation##_idx, &alg); \ - if (alg_ret != CKR_OK) { \ - P11PROV_raise(ctx, alg_ret, "Failed to terminate mech algo"); \ - return RET_OSSL_ERR; \ - } \ - } \ - operation##_idx = 0 - -#define DIGEST_MECHS \ - CKM_SHA_1, CKM_SHA224, CKM_SHA256, CKM_SHA384, CKM_SHA512, CKM_SHA512_224, \ - CKM_SHA512_256, CKM_SHA3_224, CKM_SHA3_256, CKM_SHA3_384, CKM_SHA3_512 - -#define RSA_SIG_MECHS \ - CKM_RSA_PKCS, CKM_SHA1_RSA_PKCS, CKM_SHA224_RSA_PKCS, CKM_SHA256_RSA_PKCS, \ - CKM_SHA384_RSA_PKCS, CKM_SHA512_RSA_PKCS, CKM_SHA3_224_RSA_PKCS, \ - CKM_SHA3_256_RSA_PKCS, CKM_SHA3_384_RSA_PKCS, CKM_SHA3_512_RSA_PKCS - -#define RSAPSS_SIG_MECHS \ - CKM_RSA_PKCS_PSS, CKM_SHA1_RSA_PKCS_PSS, CKM_SHA224_RSA_PKCS_PSS, \ - CKM_SHA256_RSA_PKCS_PSS, CKM_SHA384_RSA_PKCS_PSS, \ - CKM_SHA512_RSA_PKCS_PSS, CKM_SHA3_224_RSA_PKCS_PSS, \ - CKM_SHA3_256_RSA_PKCS_PSS, CKM_SHA3_384_RSA_PKCS_PSS, \ - CKM_SHA3_512_RSA_PKCS_PSS - -#define RSA_ENC_MECHS \ - CKM_RSA_PKCS, CKM_RSA_PKCS_OAEP, CKM_RSA_X_509, CKM_RSA_X9_31 - -#define ECDSA_SIG_MECHS \ - CKM_ECDSA, CKM_ECDSA_SHA1, CKM_ECDSA_SHA224, CKM_ECDSA_SHA256, \ - CKM_ECDSA_SHA384, CKM_ECDSA_SHA512, CKM_ECDSA_SHA3_224, \ - CKM_ECDSA_SHA3_256, CKM_ECDSA_SHA3_384, CKM_ECDSA_SHA3_512 - -#define PQC_MECHS \ - CKM_ML_DSA, CKM_ML_DSA_KEY_PAIR_GEN, CKM_ML_KEM, CKM_ML_KEM_KEY_PAIR_GEN, \ - CKM_SLH_DSA, CKM_SLH_DSA_KEY_PAIR_GEN - + switch (operation_id) { + case OSSL_OP_DIGEST: + OPENSSL_free(ctx->op_digest); + ctx->op_digest = algs; + break; #if SKEY_SUPPORT == 1 -#define AES_MECHS \ - CKM_AES_ECB, CKM_AES_CBC, CKM_AES_CBC_PAD, CKM_AES_CTR, CKM_AES_CTS, \ - CKM_AES_OFB, CKM_AES_CFB8, CKM_AES_CFB128, CKM_AES_CFB1, CKM_AES_GCM, \ - CKM_CHACHA20_POLY1305 + case OSSL_OP_CIPHER: + OPENSSL_free(ctx->op_cipher); + ctx->op_cipher = algs; + break; #endif - -static void alg_rm_mechs(CK_ULONG *checklist, CK_ULONG *rmlist, int *clsize, - int rmsize) -{ - CK_ULONG tmplist[*clsize]; - int t = 0; - - for (int i = 0; i < *clsize; i++) { - tmplist[t] = checklist[i]; - for (int j = 0; j < rmsize; j++) { - if (tmplist[t] == rmlist[j]) { - tmplist[t] = CK_UNAVAILABLE_INFORMATION; - break; - } - } - if (tmplist[t] != CK_UNAVAILABLE_INFORMATION) { - t++; - } + /* MAC */ + case OSSL_OP_KDF: + OPENSSL_free(ctx->op_kdf); + ctx->op_kdf = algs; + break; + case OSSL_OP_RAND: + OPENSSL_free(ctx->op_random); + ctx->op_random = algs; + break; + case OSSL_OP_KEYMGMT: + OPENSSL_free(ctx->op_keymgmt); + ctx->op_keymgmt = algs; + break; + case OSSL_OP_KEYEXCH: + OPENSSL_free(ctx->op_keyexch); + ctx->op_keyexch = algs; + break; + case OSSL_OP_SIGNATURE: + OPENSSL_free(ctx->op_signature); + ctx->op_signature = algs; + break; + case OSSL_OP_ASYM_CIPHER: + OPENSSL_free(ctx->op_asym_cipher); + ctx->op_asym_cipher = algs; + break; + case OSSL_OP_KEM: + OPENSSL_free(ctx->op_kem); + ctx->op_kem = algs; + break; +#if SKEY_SUPPORT == 1 + case OSSL_OP_SKEYMGMT: + OPENSSL_free(ctx->op_skeymgmt); + ctx->op_skeymgmt = algs; + break; +#endif + case OSSL_OP_ENCODER: + OPENSSL_free(ctx->op_encoder); + ctx->op_encoder = algs; + break; + case OSSL_OP_DECODER: + OPENSSL_free(ctx->op_decoder); + ctx->op_decoder = algs; + break; + case OSSL_OP_STORE: + OPENSSL_free(ctx->op_store); + ctx->op_store = algs; + break; + default: + OPENSSL_free(algs); + return CKR_GENERAL_ERROR; } - memcpy(checklist, tmplist, t * sizeof(CK_ULONG)); - *clsize = t; -} - -#define UNCHECK_MECHS(...) \ - do { \ - CK_ULONG rmlist[] = { __VA_ARGS__ }; \ - int rmsize = sizeof(rmlist) / sizeof(CK_ULONG); \ - alg_rm_mechs(checklist, rmlist, &cl_size, rmsize); \ - } while (0); -static const char *get_default_properties(P11PROV_CTX *ctx) -{ - if (ctx->assume_fips) { - return P11PROV_FIPS_PROPERTIES; - } - return P11PROV_DEFAULT_PROPERTIES; + return CKR_OK; } static CK_RV operations_init(P11PROV_CTX *ctx) { - P11PROV_SLOTS_CTX *slots; - P11PROV_SLOT *slot; - CK_ULONG checklist[] = { CKM_RSA_PKCS_KEY_PAIR_GEN, - RSA_SIG_MECHS, - RSAPSS_SIG_MECHS, - RSA_ENC_MECHS, - CKM_EC_KEY_PAIR_GEN, - CKM_EC_EDWARDS_KEY_PAIR_GEN, - ECDSA_SIG_MECHS, - CKM_ECDH1_DERIVE, - CKM_ECDH1_COFACTOR_DERIVE, - CKM_EC_MONTGOMERY_KEY_PAIR_GEN, - CKM_HKDF_DERIVE, - DIGEST_MECHS, - CKM_EDDSA, - PQC_MECHS, -#if SKEY_SUPPORT == 1 - AES_MECHS -#endif - }; - bool add_rsasig = false; - bool add_rsaenc = false; - bool add_ecdsasig = false; - int cl_size = sizeof(checklist) / sizeof(CK_ULONG); - int digest_idx = 0; - int kdf_idx = 0; - int random_idx = 0; - int exchange_idx = 0; - int signature_idx = 0; - int asym_cipher_idx = 0; - int kem_idx = 0; -#if SKEY_SUPPORT == 1 - int cipher_idx = 0; -#endif - int slot_idx = 0; - const char *prop = get_default_properties(ctx); + bool available_mechs[TBID_SIZE] = { 0 }; CK_RV ret; - ret = p11prov_take_slots(ctx, &slots); + if (ctx->status != P11PROV_OPS_NEEDS_INIT) { + /* another thread did this first */ + ret = CKR_OK; + goto done; + } + + ret = p11prov_get_mech_state_table(ctx, available_mechs); if (ret != CKR_OK) { - return ret; + goto done; } - for (slot = p11prov_fetch_slot(slots, &slot_idx); slot != NULL; - slot = p11prov_fetch_slot(slots, &slot_idx)) { + ret = p11prov_register_digests(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + goto done; + } - CK_MECHANISM_TYPE *mechs; - int nmechs; - nmechs = p11prov_slot_get_mechanisms(slot, &mechs); - for (int ms = 0; ms < nmechs; ms++) { - CK_ULONG mech = CK_UNAVAILABLE_INFORMATION; - if (cl_size == 0) { - /* we are done*/ - break; - } - for (int cl = 0; cl < cl_size; cl++) { - if (mechs[ms] == checklist[cl]) { - mech = mechs[ms]; - /* found */ - break; - } - } - switch (mech) { - case CK_UNAVAILABLE_INFORMATION: - continue; - case CKM_RSA_PKCS_KEY_PAIR_GEN: - UNCHECK_MECHS(CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_RSA_PKCS: - add_rsasig = true; - add_rsaenc = true; - UNCHECK_MECHS(CKM_RSA_PKCS_KEY_PAIR_GEN); - UNCHECK_MECHS(CKM_RSA_PKCS_KEY_PAIR_GEN, RSA_ENC_MECHS); - break; -#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) - case CKM_SHA1_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA1, signature, prop, - p11prov_rsa_sha1_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA1_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA224_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA224, signature, prop, - p11prov_rsa_sha224_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA224_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA256_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA256, signature, prop, - p11prov_rsa_sha256_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA256_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA384_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA384, signature, prop, - p11prov_rsa_sha384_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA384_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA512_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA512, signature, prop, - p11prov_rsa_sha512_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA512_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA3_224_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA3_224, signature, prop, - p11prov_rsa_sha3_224_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA3_224_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA3_256_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA3_256, signature, prop, - p11prov_rsa_sha3_256_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA3_256_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA3_384_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA3_384, signature, prop, - p11prov_rsa_sha3_384_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA3_384_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA3_512_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA3_512, signature, prop, - p11prov_rsa_sha3_512_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA3_512_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; -#else - case CKM_SHA1_RSA_PKCS: - case CKM_SHA224_RSA_PKCS: - case CKM_SHA256_RSA_PKCS: - case CKM_SHA384_RSA_PKCS: - case CKM_SHA512_RSA_PKCS: - case CKM_SHA3_224_RSA_PKCS: - case CKM_SHA3_256_RSA_PKCS: - case CKM_SHA3_384_RSA_PKCS: - case CKM_SHA3_512_RSA_PKCS: - add_rsasig = true; - UNCHECK_MECHS(CKM_RSA_PKCS_KEY_PAIR_GEN, RSA_SIG_MECHS); - break; -#endif - case CKM_RSA_PKCS_PSS: - case CKM_SHA1_RSA_PKCS_PSS: - case CKM_SHA224_RSA_PKCS_PSS: - case CKM_SHA256_RSA_PKCS_PSS: - case CKM_SHA384_RSA_PKCS_PSS: - case CKM_SHA512_RSA_PKCS_PSS: - case CKM_SHA3_224_RSA_PKCS_PSS: - case CKM_SHA3_256_RSA_PKCS_PSS: - case CKM_SHA3_384_RSA_PKCS_PSS: - case CKM_SHA3_512_RSA_PKCS_PSS: - add_rsasig = true; - UNCHECK_MECHS(CKM_RSA_PKCS_KEY_PAIR_GEN, RSAPSS_SIG_MECHS); - break; - case CKM_RSA_PKCS_OAEP: - case CKM_RSA_X_509: - case CKM_RSA_X9_31: - add_rsaenc = true; - UNCHECK_MECHS(CKM_RSA_PKCS_KEY_PAIR_GEN, RSA_ENC_MECHS); - break; - case CKM_EC_KEY_PAIR_GEN: - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN); - break; - case CKM_ECDSA: - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA); - break; -#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) - case CKM_ECDSA_SHA1: - ADD_ALGO_EXT(ECDSA_SHA1, signature, prop, - p11prov_ecdsa_sha1_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA1); - break; - case CKM_ECDSA_SHA224: - ADD_ALGO_EXT(ECDSA_SHA224, signature, prop, - p11prov_ecdsa_sha224_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA224); - break; - case CKM_ECDSA_SHA256: - ADD_ALGO_EXT(ECDSA_SHA256, signature, prop, - p11prov_ecdsa_sha256_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA256); - break; - case CKM_ECDSA_SHA384: - ADD_ALGO_EXT(ECDSA_SHA384, signature, prop, - p11prov_ecdsa_sha384_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA384); - break; - case CKM_ECDSA_SHA512: - ADD_ALGO_EXT(ECDSA_SHA512, signature, prop, - p11prov_ecdsa_sha512_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA512); - break; - case CKM_ECDSA_SHA3_224: - ADD_ALGO_EXT(ECDSA_SHA3_224, signature, prop, - p11prov_ecdsa_sha3_224_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA3_224); - break; - case CKM_ECDSA_SHA3_256: - ADD_ALGO_EXT(ECDSA_SHA3_256, signature, prop, - p11prov_ecdsa_sha3_256_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA3_256); - break; - case CKM_ECDSA_SHA3_384: - ADD_ALGO_EXT(ECDSA_SHA3_384, signature, prop, - p11prov_ecdsa_sha3_384_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA3_384); - break; - case CKM_ECDSA_SHA3_512: - ADD_ALGO_EXT(ECDSA_SHA3_512, signature, prop, - p11prov_ecdsa_sha3_512_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA3_512); - break; -#else - case CKM_ECDSA_SHA1: - case CKM_ECDSA_SHA224: - case CKM_ECDSA_SHA256: - case CKM_ECDSA_SHA384: - case CKM_ECDSA_SHA512: - case CKM_ECDSA_SHA3_224: - case CKM_ECDSA_SHA3_256: - case CKM_ECDSA_SHA3_384: - case CKM_ECDSA_SHA3_512: - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA1, - CKM_ECDSA_SHA224, CKM_ECDSA_SHA256, - CKM_ECDSA_SHA384, CKM_ECDSA_SHA512, - CKM_ECDSA_SHA3_224, CKM_ECDSA_SHA3_256, - CKM_ECDSA_SHA3_384, CKM_ECDSA_SHA3_512); - break; -#endif - case CKM_ECDH1_DERIVE: - case CKM_ECDH1_COFACTOR_DERIVE: - ADD_ALGO(ECDH, ecdh, exchange, prop); - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDH1_DERIVE, - CKM_ECDH1_COFACTOR_DERIVE); - break; - case CKM_HKDF_DERIVE: - ADD_ALGO(HKDF, hkdf, kdf, prop); - ADD_ALGO(TLS13_KDF, tls13, kdf, prop); - ADD_ALGO(HKDF, hkdf, exchange, prop); - UNCHECK_MECHS(CKM_HKDF_DERIVE); - break; - case CKM_SHA_1: - ADD_ALGO(SHA1, sha1, digest, prop); - UNCHECK_MECHS(CKM_SHA_1); - break; - case CKM_SHA224: - ADD_ALGO(SHA2_224, sha224, digest, prop); - UNCHECK_MECHS(CKM_SHA224); - break; - case CKM_SHA256: - ADD_ALGO(SHA2_256, sha256, digest, prop); - UNCHECK_MECHS(CKM_SHA256); - break; - case CKM_SHA384: - ADD_ALGO(SHA2_384, sha384, digest, prop); - UNCHECK_MECHS(CKM_SHA384); - break; - case CKM_SHA512: - ADD_ALGO(SHA2_512, sha512, digest, prop); - UNCHECK_MECHS(CKM_SHA512); - break; - case CKM_SHA512_224: - ADD_ALGO(SHA2_512_224, sha512_224, digest, prop); - UNCHECK_MECHS(CKM_SHA512_224); - break; - case CKM_SHA512_256: - ADD_ALGO(SHA2_512_256, sha512_256, digest, prop); - UNCHECK_MECHS(CKM_SHA512_256); - break; - case CKM_SHA3_224: - ADD_ALGO(SHA3_224, sha3_224, digest, prop); - UNCHECK_MECHS(CKM_SHA3_224); - break; - case CKM_SHA3_256: - ADD_ALGO(SHA3_256, sha3_256, digest, prop); - UNCHECK_MECHS(CKM_SHA3_256); - break; - case CKM_SHA3_384: - ADD_ALGO(SHA3_384, sha3_384, digest, prop); - UNCHECK_MECHS(CKM_SHA3_384); - break; - case CKM_SHA3_512: - ADD_ALGO(SHA3_512, sha3_512, digest, prop); - UNCHECK_MECHS(CKM_SHA3_512); - break; - case CKM_EDDSA: - case CKM_EC_EDWARDS_KEY_PAIR_GEN: - ADD_ALGO_EXT(ED25519, signature, prop, - p11prov_ed25519_signature_functions); - ADD_ALGO_EXT(ED448, signature, prop, - p11prov_ed448_signature_functions); - UNCHECK_MECHS(CKM_EC_EDWARDS_KEY_PAIR_GEN, CKM_EDDSA); -#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) - ADD_ALGO_EXT(ED25519ph, signature, prop, - p11prov_ed25519ph_signature_functions); - ADD_ALGO_EXT(ED25519ctx, signature, prop, - p11prov_ed25519ctx_signature_functions); - ADD_ALGO_EXT(ED448ph, signature, prop, - p11prov_ed448ph_signature_functions); -#endif - break; - case CKM_EC_MONTGOMERY_KEY_PAIR_GEN: - ADD_ALGO(X25519, x25519, exchange, prop); - ADD_ALGO(X448, x448, exchange, prop); - break; - case CKM_ML_DSA: - case CKM_ML_DSA_KEY_PAIR_GEN: - ADD_ALGO_EXT(ML_DSA_44, signature, prop, - p11prov_mldsa_44_signature_functions); - ADD_ALGO_EXT(ML_DSA_65, signature, prop, - p11prov_mldsa_65_signature_functions); - ADD_ALGO_EXT(ML_DSA_87, signature, prop, - p11prov_mldsa_87_signature_functions); - UNCHECK_MECHS(CKM_ML_DSA_KEY_PAIR_GEN, CKM_ML_DSA); - break; - case CKM_ML_KEM: - case CKM_ML_KEM_KEY_PAIR_GEN: - ADD_ALGO_EXT(ML_KEM_512, kem, prop, - p11prov_mlkem_kem_functions); - ADD_ALGO_EXT(ML_KEM_768, kem, prop, - p11prov_mlkem_kem_functions); - ADD_ALGO_EXT(ML_KEM_1024, kem, prop, - p11prov_mlkem_kem_functions); - UNCHECK_MECHS(CKM_ML_KEM_KEY_PAIR_GEN, CKM_ML_KEM); - break; - case CKM_SLH_DSA: - case CKM_SLH_DSA_KEY_PAIR_GEN: - ADD_ALGO_EXT(SLH_DSA_SHA2_128S, signature, prop, - p11prov_slhdsa_sha2_128s_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128F, signature, prop, - p11prov_slhdsa_sha2_128f_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192S, signature, prop, - p11prov_slhdsa_sha2_192s_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192F, signature, prop, - p11prov_slhdsa_sha2_192f_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256S, signature, prop, - p11prov_slhdsa_sha2_256s_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256F, signature, prop, - p11prov_slhdsa_sha2_256f_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128S, signature, prop, - p11prov_slhdsa_shake_128s_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128F, signature, prop, - p11prov_slhdsa_shake_128f_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192S, signature, prop, - p11prov_slhdsa_shake_192s_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192F, signature, prop, - p11prov_slhdsa_shake_192f_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256S, signature, prop, - p11prov_slhdsa_shake_256s_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256F, signature, prop, - p11prov_slhdsa_shake_256f_signature_functions); - UNCHECK_MECHS(CKM_SLH_DSA_KEY_PAIR_GEN, CKM_SLH_DSA); - break; #if SKEY_SUPPORT == 1 - case CKM_AES_ECB: - ADD_ALGO(AES_256_ECB, aes256ecb, cipher, prop); - ADD_ALGO(AES_192_ECB, aes192ecb, cipher, prop); - ADD_ALGO(AES_128_ECB, aes128ecb, cipher, prop); - UNCHECK_MECHS(CKM_AES_ECB); - break; - case CKM_AES_CBC: - case CKM_AES_CBC_PAD: - ADD_ALGO(AES_256_CBC, aes256cbc, cipher, prop); - ADD_ALGO(AES_192_CBC, aes192cbc, cipher, prop); - ADD_ALGO(AES_128_CBC, aes128cbc, cipher, prop); - UNCHECK_MECHS(CKM_AES_CBC); - UNCHECK_MECHS(CKM_AES_CBC_PAD); - break; - case CKM_AES_OFB: - ADD_ALGO(AES_256_OFB, aes256ofb, cipher, prop); - ADD_ALGO(AES_192_OFB, aes192ofb, cipher, prop); - ADD_ALGO(AES_128_OFB, aes128ofb, cipher, prop); - UNCHECK_MECHS(CKM_AES_OFB); - break; - case CKM_AES_CFB128: - ADD_ALGO(AES_256_CFB, aes256cfb, cipher, prop); - ADD_ALGO(AES_192_CFB, aes192cfb, cipher, prop); - ADD_ALGO(AES_128_CFB, aes128cfb, cipher, prop); - UNCHECK_MECHS(CKM_AES_CFB128); - break; - case CKM_AES_CFB1: - ADD_ALGO(AES_256_CFB1, aes256cfb1, cipher, prop); - ADD_ALGO(AES_192_CFB1, aes192cfb1, cipher, prop); - ADD_ALGO(AES_128_CFB1, aes128cfb1, cipher, prop); - UNCHECK_MECHS(CKM_AES_CFB1); - break; - case CKM_AES_CFB8: - ADD_ALGO(AES_256_CFB8, aes256cfb8, cipher, prop); - ADD_ALGO(AES_192_CFB8, aes192cfb8, cipher, prop); - ADD_ALGO(AES_128_CFB8, aes128cfb8, cipher, prop); - UNCHECK_MECHS(CKM_AES_CFB8); - break; - case CKM_AES_CTR: - ADD_ALGO(AES_256_CTR, aes256ctr, cipher, prop); - ADD_ALGO(AES_192_CTR, aes192ctr, cipher, prop); - ADD_ALGO(AES_128_CTR, aes128ctr, cipher, prop); - UNCHECK_MECHS(CKM_AES_CTR); - break; - case CKM_AES_CTS: - ADD_ALGO(AES_256_CTS, aes256cts, cipher, prop); - ADD_ALGO(AES_192_CTS, aes192cts, cipher, prop); - ADD_ALGO(AES_128_CTS, aes128cts, cipher, prop); - UNCHECK_MECHS(CKM_AES_CTS); - break; - case CKM_AES_GCM: - ADD_ALGO(AES_256_GCM, aes256gcm, cipher, prop); - ADD_ALGO(AES_192_GCM, aes192gcm, cipher, prop); - ADD_ALGO(AES_128_GCM, aes128gcm, cipher, prop); - UNCHECK_MECHS(CKM_AES_GCM); - break; - case CKM_CHACHA20_POLY1305: - ADD_ALGO(CHACHA20_POLY1305, chacha20256poly1305, cipher, prop); - UNCHECK_MECHS(CKM_CHACHA20_POLY1305); - break; + ret = p11prov_register_ciphers(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + goto done; + } #endif - default: - P11PROV_raise(ctx, CKR_GENERAL_ERROR, "Unhandled mechanism %lu", - mech); - break; - } - } + + /* mac - none supported yet */ + + ret = p11prov_register_kdfs(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + goto done; } - p11prov_return_slots(slots); + ret = p11prov_register_random(ctx, ctx->assume_fips); + if (ret != CKR_OK) { + goto done; + } + + /* keymgmt -> static */ - if (add_rsasig) { - ADD_ALGO(RSA, rsa, signature, prop); + ret = p11prov_register_keyexch(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + goto done; } - if (add_ecdsasig) { - ADD_ALGO(ECDSA, ecdsa, signature, prop); + + ret = p11prov_register_signatures(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + goto done; } - if (add_rsaenc) { - ADD_ALGO(RSA, rsa, asym_cipher, prop); + + ret = p11prov_register_asym_ciphers(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + goto done; } - /* terminations */ - TERM_ALGO(digest); - TERM_ALGO(kdf); - TERM_ALGO(exchange); - TERM_ALGO(signature); - TERM_ALGO(asym_cipher); - TERM_ALGO(kem); -#if SKEY_SUPPORT == 1 - TERM_ALGO(cipher); -#endif - /* handle random */ - ret = p11prov_check_random(ctx); - if (ret == CKR_OK) { - ADD_ALGO_EXT(RAND, random, prop, p11prov_rand_functions); - TERM_ALGO(random); + ret = p11prov_register_kems(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + goto done; } - return CKR_OK; + /* skeymgmt -> static */ + + /* encoder -> static */ + + /* decoder -> static */ + + /* store -> static */ + + ctx->status = P11PROV_INITIALIZED; + ret = CKR_OK; + +done: + if (ret != CKR_OK) { + ctx->status = P11PROV_IN_ERROR; + } + return ret; } static CK_RV static_operations_init(P11PROV_CTX *ctx) { - int encoder_idx = 0; - int decoder_idx = 0; - int store_idx = 0; - int keymgmt_idx = 0; -#if SKEY_SUPPORT == 1 - int skeymgmt_idx = 0; -#endif - const char *prop = get_default_properties(ctx); - -/* encoder */ -#define DEFAULT_PROPERTY(prop) \ - (ctx->assume_fips ? P11PROV_FIPS_PROPERTIES prop \ - : P11PROV_DEFAULT_PROPERTIES prop) - - ADD_ALGO_EXT(RSA, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_rsa_encoder_text_functions); - ADD_ALGO_EXT(RSA, encoder, DEFAULT_PROPERTY(",output=der,structure=pkcs1"), - p11prov_rsa_encoder_pkcs1_der_functions); - ADD_ALGO_EXT(RSA, encoder, DEFAULT_PROPERTY(",output=pem,structure=pkcs1"), - p11prov_rsa_encoder_pkcs1_pem_functions); - ADD_ALGO_EXT(RSA, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_rsa_encoder_spki_der_functions); - ADD_ALGO_EXT(RSA, encoder, - DEFAULT_PROPERTY(",output=pem,structure=SubjectPublicKeyInfo"), - p11prov_rsa_encoder_spki_pem_functions); - ADD_ALGO_EXT(RSAPSS, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_rsa_encoder_text_functions); - ADD_ALGO_EXT(RSAPSS, encoder, - DEFAULT_PROPERTY(",output=der,structure=pkcs1"), - p11prov_rsa_encoder_pkcs1_der_functions); - ADD_ALGO_EXT(RSAPSS, encoder, - DEFAULT_PROPERTY(",output=pem,structure=pkcs1"), - p11prov_rsa_encoder_pkcs1_pem_functions); - ADD_ALGO_EXT(RSAPSS, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_rsa_encoder_spki_der_functions); - ADD_ALGO_EXT(RSAPSS, encoder, - DEFAULT_PROPERTY(",output=pem,structure=SubjectPublicKeyInfo"), - p11prov_rsa_encoder_spki_pem_functions); - ADD_ALGO_EXT(EC, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_ec_encoder_text_functions); - ADD_ALGO_EXT(EC, encoder, DEFAULT_PROPERTY(",output=der,structure=pkcs1"), - p11prov_ec_encoder_pkcs1_der_functions); - ADD_ALGO_EXT(EC, encoder, DEFAULT_PROPERTY(",output=pem,structure=pkcs1"), - p11prov_ec_encoder_pkcs1_pem_functions); - ADD_ALGO_EXT(EC, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_ec_encoder_spki_der_functions); - ADD_ALGO_EXT(ED25519, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_ec_edwards_encoder_text_functions); - ADD_ALGO_EXT(ED448, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_ec_edwards_encoder_text_functions); - ADD_ALGO_EXT(X25519, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_ec_montgomery_encoder_text_functions); - ADD_ALGO_EXT(X448, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_ec_montgomery_encoder_text_functions); - ADD_ALGO_EXT(ML_DSA_44, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_mldsa_encoder_text_functions); - ADD_ALGO_EXT(ML_DSA_44, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_mldsa_encoder_spki_der_functions); - ADD_ALGO_EXT(ML_DSA_65, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_mldsa_encoder_text_functions); - ADD_ALGO_EXT(ML_DSA_65, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_mldsa_encoder_spki_der_functions); - ADD_ALGO_EXT(ML_DSA_87, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_mldsa_encoder_text_functions); - ADD_ALGO_EXT(ML_DSA_87, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_mldsa_encoder_spki_der_functions); - ADD_ALGO_EXT(ML_KEM_512, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_mlkem_encoder_text_functions); - ADD_ALGO_EXT(ML_KEM_512, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_mlkem_encoder_spki_der_functions); - ADD_ALGO_EXT(ML_KEM_768, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_mlkem_encoder_text_functions); - ADD_ALGO_EXT(ML_KEM_768, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_mlkem_encoder_spki_der_functions); - ADD_ALGO_EXT(ML_KEM_1024, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_mlkem_encoder_text_functions); - ADD_ALGO_EXT(ML_KEM_1024, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_mlkem_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128S, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128S, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128F, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128F, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192S, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192S, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192F, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192F, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256S, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256S, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256F, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256F, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128S, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128S, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128F, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128F, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192S, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192S, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192F, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192F, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256S, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256S, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256F, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256F, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - if (ctx->encode_pkey_as_pk11_uri) { - ADD_ALGO_EXT(RSA, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_rsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(RSAPSS, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_rsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(EC, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_ec_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ED25519, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_ec_edwards_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ED448, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_ec_edwards_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(X25519, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_ec_montgomery_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(X448, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_ec_montgomery_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ML_DSA_44, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_mldsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ML_DSA_65, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_mldsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ML_DSA_87, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_mldsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ML_KEM_512, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_mlkem_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ML_KEM_768, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_mlkem_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ML_KEM_1024, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_mlkem_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128S, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128F, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192S, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192F, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256S, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256F, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128S, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128F, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192S, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192F, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256S, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256F, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - } - - TERM_ALGO(encoder); - -#define DER_DECODER_PROP ",input=der,structure=" P11PROV_DER_STRUCTURE - /* decoder */ - ADD_ALGO_EXT(DER, decoder, DEFAULT_PROPERTY(",input=pem"), - p11prov_pem_decoder_p11prov_der_functions); - ADD_ALGO_EXT(RSA, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_rsa_functions); - ADD_ALGO_EXT(RSAPSS, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_rsa_functions); - ADD_ALGO_EXT(EC, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_ec_functions); - ADD_ALGO_EXT(ED25519, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_ed25519_functions); - ADD_ALGO_EXT(ED448, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_ed448_functions); - ADD_ALGO_EXT(X25519, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_x25519_functions); - ADD_ALGO_EXT(X448, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_x448_functions); - TERM_ALGO(decoder); -#undef DEFAULT_PROPERTY - - /* store */ - ADD_ALGO_EXT(URI, store, prop, p11prov_store_functions); - TERM_ALGO(store); - - /* keymgmt */ - ADD_ALGO(RSA, rsa, keymgmt, prop); - ADD_ALGO(RSAPSS, rsapss, keymgmt, prop); - ADD_ALGO(EC, ec, keymgmt, prop); - ADD_ALGO(HKDF, hkdf, keymgmt, prop); - ADD_ALGO_EXT(ED25519, keymgmt, prop, p11prov_ed25519_keymgmt_functions); - ADD_ALGO_EXT(ED448, keymgmt, prop, p11prov_ed448_keymgmt_functions); - ADD_ALGO_EXT(X25519, keymgmt, prop, p11prov_x25519_keymgmt_functions); - ADD_ALGO_EXT(X448, keymgmt, prop, p11prov_x448_keymgmt_functions); - ADD_ALGO_EXT(ML_DSA_44, keymgmt, prop, p11prov_mldsa44_keymgmt_functions); - ADD_ALGO_EXT(ML_DSA_65, keymgmt, prop, p11prov_mldsa65_keymgmt_functions); - ADD_ALGO_EXT(ML_DSA_87, keymgmt, prop, p11prov_mldsa87_keymgmt_functions); - ADD_ALGO_EXT(ML_KEM_512, keymgmt, prop, p11prov_mlkem512_keymgmt_functions); - ADD_ALGO_EXT(ML_KEM_768, keymgmt, prop, p11prov_mlkem768_keymgmt_functions); - ADD_ALGO_EXT(ML_KEM_1024, keymgmt, prop, - p11prov_mlkem1024_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128S, keymgmt, prop, - p11prov_slhdsa_sha2_128s_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128F, keymgmt, prop, - p11prov_slhdsa_sha2_128f_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192S, keymgmt, prop, - p11prov_slhdsa_sha2_192s_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192F, keymgmt, prop, - p11prov_slhdsa_sha2_192f_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256S, keymgmt, prop, - p11prov_slhdsa_sha2_256s_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256F, keymgmt, prop, - p11prov_slhdsa_sha2_256f_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128S, keymgmt, prop, - p11prov_slhdsa_shake_128s_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128F, keymgmt, prop, - p11prov_slhdsa_shake_128f_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192S, keymgmt, prop, - p11prov_slhdsa_shake_192s_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192F, keymgmt, prop, - p11prov_slhdsa_shake_192f_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256S, keymgmt, prop, - p11prov_slhdsa_shake_256s_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256F, keymgmt, prop, - p11prov_slhdsa_shake_256f_keymgmt_functions); - TERM_ALGO(keymgmt); + CK_RV ret; + + ret = p11prov_register_kmgmt(ctx, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; + } #if SKEY_SUPPORT == 1 - /* skeymgmt */ - ADD_ALGO(AES, aes, skeymgmt, prop); - ADD_ALGO(GENERIC_SECRET, generic_secret, skeymgmt, prop); - TERM_ALGO(skeymgmt); + ret = p11prov_register_skmgmt(ctx, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; + } #endif + ret = p11prov_register_encoders(ctx, ctx->assume_fips, + ctx->encode_pkey_as_pk11_uri); + if (ret != CKR_OK) { + return ret; + } + + ret = p11prov_register_decoders(ctx, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; + } + + ret = p11prov_register_store(ctx, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; + } + return CKR_OK; } @@ -1747,7 +1092,7 @@ p11prov_query_operation(void *provctx, int operation_id, int *no_cache) return ctx->op_keymgmt; case OSSL_OP_KEYEXCH: *no_cache = ctx->status == P11PROV_UNINITIALIZED ? 1 : 0; - return ctx->op_exchange; + return ctx->op_keyexch; case OSSL_OP_SIGNATURE: *no_cache = ctx->status == P11PROV_UNINITIALIZED ? 1 : 0; return ctx->op_signature; @@ -1985,17 +1330,23 @@ int OSSL_provider_init(const OSSL_CORE_HANDLE *handle, const OSSL_DISPATCH *in, P11PROV_debug("Starting provider %s %d.%d", PACKAGE_NAME, PACKAGE_MAJOR, PACKAGE_MINOR); + ret = INIT_LOCK_INIT(ctx); + if (ret != 0) { + OPENSSL_free(ctx); + return RET_OSSL_ERR; + } + ret = pthread_rwlock_init(&ctx->quirk_lock, NULL); if (ret != 0) { ret = errno; P11PROV_debug("rwlock init failed (%d)", ret); - OPENSSL_free(ctx); + p11prov_ctx_free(ctx); return RET_OSSL_ERR; } ctx->libctx = OSSL_LIB_CTX_new_from_dispatch(handle, in); if (ctx->libctx == NULL) { - OPENSSL_free(ctx); + p11prov_ctx_free(ctx); return RET_OSSL_ERR; } diff --git a/src/provider.h b/src/provider.h index d0cf4a26..183d4ae0 100644 --- a/src/provider.h +++ b/src/provider.h @@ -36,260 +36,14 @@ #define RET_OSSL_ERR 0 #define RET_OSSL_BAD -1 -#define P11PROV_DEFAULT_PROPERTIES "provider=pkcs11" -#define P11PROV_FIPS_PROPERTIES "provider=pkcs11,fips=yes" -#define P11PROV_DEFAULT_PROVIDER "provider=default" - -#define P11PROV_NAME_RSA "RSA" -#define P11PROV_NAMES_RSA "RSA:rsaEncryption:1.2.840.113549.1.1.1" -#define P11PROV_DESCS_RSA "PKCS11 RSA Implementation" -#define P11PROV_NAME_RSAPSS "RSA-PSS" -#define P11PROV_NAMES_RSAPSS "RSA-PSS:RSASSA-PSS:1.2.840.113549.1.1.10" -#define P11PROV_DESCS_RSAPSS "PKCS11 RSA PSS Implementation" -#define P11PROV_NAMES_RSA_SHA1 \ - "RSA-SHA1:RSA-SHA-1:sha1WithRSAEncryption:1.2.840.113549.1.1.5" -#define P11PROV_DESCS_RSA_SHA1 "PKCS11 RSA-SHA1 Implementation" -#define P11PROV_NAMES_RSA_SHA256 \ - "RSA-SHA2-256:RSA-SHA256:sha256WithRSAEncryption:1.2.840.113549.1.1.11" -#define P11PROV_DESCS_RSA_SHA256 "PKCS11 RSA-SHA256 Implementation" -#define P11PROV_NAMES_RSA_SHA384 \ - "RSA-SHA2-384:RSA-SHA384:sha384WithRSAEncryption:1.2.840.113549.1.1.12" -#define P11PROV_DESCS_RSA_SHA384 "PKCS11 RSA-SHA384 Implementation" -#define P11PROV_NAMES_RSA_SHA512 \ - "RSA-SHA2-512:RSA-SHA512:sha512WithRSAEncryption:1.2.840.113549.1.1.13" -#define P11PROV_DESCS_RSA_SHA512 "PKCS11 RSA-SHA512 Implementation" -#define P11PROV_NAMES_RSA_SHA224 \ - "RSA-SHA2-224:RSA-SHA224:sha224WithRSAEncryption:1.2.840.113549.1.1.14" -#define P11PROV_DESCS_RSA_SHA224 "PKCS11 RSA-SHA224 Implementation" -#define P11PROV_NAMES_RSA_SHA3_224 \ - "RSA-SHA3-224:id-rsassa-pkcs1-v1_5-with-sha3-224:2.16.840.1.101.3.4.3.13" -#define P11PROV_DESCS_RSA_SHA3_224 "PKCS11 RSA-SHA3_224 Implementation" -#define P11PROV_NAMES_RSA_SHA3_256 \ - "RSA-SHA3-256:id-rsassa-pkcs1-v1_5-with-sha3-256:2.16.840.1.101.3.4.3.14" -#define P11PROV_DESCS_RSA_SHA3_256 "PKCS11 RSA-SHA3_256 Implementation" -#define P11PROV_NAMES_RSA_SHA3_384 \ - "RSA-SHA3-384:id-rsassa-pkcs1-v1_5-with-sha3-384:2.16.840.1.101.3.4.3.15" -#define P11PROV_DESCS_RSA_SHA3_384 "PKCS11 RSA-SHA3_384 Implementation" -#define P11PROV_NAMES_RSA_SHA3_512 \ - "RSA-SHA3-512:id-rsassa-pkcs1-v1_5-with-sha3-512:2.16.840.1.101.3.4.3.16" -#define P11PROV_DESCS_RSA_SHA3_512 "PKCS11 RSA-SHA3_512 Implementation" -#define P11PROV_NAME_EC "EC" -#define P11PROV_NAMES_EC "EC:id-ecPublicKey:1.2.840.10045.2.1" -#define P11PROV_DESCS_EC "PKCS11 EC Implementation" -#define P11PROV_NAME_ECDSA "ECDSA" -#define P11PROV_NAMES_ECDSA P11PROV_NAME_ECDSA -#define P11PROV_DESCS_ECDSA "PKCS11 ECDSA Implementation" -#define P11PROV_NAMES_ECDSA_SHA1 \ - "ECDSA-SHA1:ECDSA-SHA-1:ecdsa-with-SHA1:1.2.840.10045.4.1" -#define P11PROV_DESCS_ECDSA_SHA1 "PKCS11 ECDSA-SHA1 Implementation" -#define P11PROV_NAMES_ECDSA_SHA224 \ - "ECDSA-SHA2-224:ECDSA-SHA224:ecdsa-with-SHA224:1.2.840.10045.4.3.1" -#define P11PROV_DESCS_ECDSA_SHA224 "PKCS11 ECDSA-SHA224 Implementation" -#define P11PROV_NAMES_ECDSA_SHA256 \ - "ECDSA-SHA2-256:ECDSA-SHA256:ecdsa-with-SHA256:1.2.840.10045.4.3.2" -#define P11PROV_DESCS_ECDSA_SHA256 "PKCS11 ECDSA-SHA256 Implementation" -#define P11PROV_NAMES_ECDSA_SHA384 \ - "ECDSA-SHA2-384:ECDSA-SHA384:ecdsa-with-SHA384:1.2.840.10045.4.3.3" -#define P11PROV_DESCS_ECDSA_SHA384 "PKCS11 ECDSA-SHA384 Implementation" -#define P11PROV_NAMES_ECDSA_SHA512 \ - "ECDSA-SHA2-512:ECDSA-SHA512:ecdsa-with-SHA512:1.2.840.10045.4.3.4" -#define P11PROV_DESCS_ECDSA_SHA512 "PKCS11 ECDSA-SHA512 Implementation" -#define P11PROV_NAMES_ECDSA_SHA3_224 \ - "ECDSA-SHA3-224:ecdsa_with_SHA3-224:id-ecdsa-with-sha3-224:2.16.840.1." \ - "101.3.4.3.9" -#define P11PROV_DESCS_ECDSA_SHA3_224 "PKCS11 ECDSA-SHA3_224 Implementation" -#define P11PROV_NAMES_ECDSA_SHA3_256 \ - "ECDSA-SHA3-256:ecdsa_with_SHA3-256:id-ecdsa-with-sha3-256:2.16.840.1." \ - "101.3.4.3.10" -#define P11PROV_DESCS_ECDSA_SHA3_256 "PKCS11 ECDSA-SHA3_256 Implementation" -#define P11PROV_NAMES_ECDSA_SHA3_384 \ - "ECDSA-SHA3-384:ecdsa_with_SHA3-384:id-ecdsa-with-sha3-384:2.16.840.1." \ - "101.3.4.3.11" -#define P11PROV_DESCS_ECDSA_SHA3_384 "PKCS11 ECDSA-SHA3_384 Implementation" -#define P11PROV_NAMES_ECDSA_SHA3_512 \ - "ECDSA-SHA3-512:ecdsa_with_SHA3-512:id-ecdsa-with-sha3-512:2.16.840.1." \ - "101.3.4.3.12" -#define P11PROV_DESCS_ECDSA_SHA3_512 "PKCS11 ECDSA-SHA3_512 Implementation" -#define P11PROV_NAME_ECDH "ECDH" -#define P11PROV_NAMES_ECDH P11PROV_NAME_ECDH -#define P11PROV_DESCS_ECDH "PKCS11 ECDH Implementation" -#define P11PROV_NAME_HKDF "HKDF" -#define P11PROV_NAMES_HKDF P11PROV_NAME_HKDF -#define P11PROV_DESCS_HKDF "PKCS11 HKDF Implementation" -#define P11PROV_NAMES_ED25519 "ED25519:1.3.101.112" -#define P11PROV_NAME_ED25519 "ED25519" -#define P11PROV_DESCS_ED25519 "PKCS11 ED25519 Implementation" -#define P11PROV_NAMES_ED25519ph "ED25519ph" -#define P11PROV_DESCS_ED25519ph "PKCS11 ED25519ph implementation" -#define P11PROV_NAMES_ED25519ctx "ED25519ctx" -#define P11PROV_DESCS_ED25519ctx "PKCS11 ED25519ctx implementation" -#define P11PROV_NAMES_ED448 "ED448:1.3.101.113" -#define P11PROV_NAME_ED448 "ED448" -#define P11PROV_DESCS_ED448 "PKCS11 ED448 Implementation" -#define P11PROV_NAMES_ED448ph "ED448ph" -#define P11PROV_DESCS_ED448ph "PKCS11 ED448ph implementation" -#define P11PROV_NAMES_X25519 "X25519:1.3.101.110" -#define P11PROV_NAME_X25519 "X25519" -#define P11PROV_DESCS_X25519 "PKCS11 X25519 Implementation" -#define P11PROV_NAMES_X448 "X448:1.3.101.111" -#define P11PROV_NAME_X448 "X448" -#define P11PROV_DESCS_X448 "PKCS11 X448 Implementation" -#define P11PROV_NAMES_ML_DSA_44 \ - "ML-DSA-44:MLDSA44:2.16.840.1.101.3.4.3.17:id-ml-dsa-44" -#define P11PROV_DESCS_ML_DSA_44 "PKCS11 ML-DSA-44 implementation" -#define P11PROV_NAMES_ML_DSA_65 \ - "ML-DSA-65:MLDSA65:2.16.840.1.101.3.4.3.18:id-ml-dsa-65" -#define P11PROV_DESCS_ML_DSA_65 "PKCS11 ML-DSA-65 implementation" -#define P11PROV_NAMES_ML_DSA_87 \ - "ML-DSA-87:MLDSA87:2.16.840.1.101.3.4.3.19:id-ml-dsa-87" -#define P11PROV_DESCS_ML_DSA_87 "PKCS11 ML-DSA-87 implementation" -#define P11PROV_NAMES_ML_KEM_512 \ - "ML-KEM-512:MLKEM512:id-alg-ml-kem-512:2.16.840.1.101.3.4.4.1" -#define P11PROV_DESCS_ML_KEM_512 "PKCS11 ML-KEM-512 implementation" -#define P11PROV_NAMES_ML_KEM_768 \ - "ML-KEM-768:MLKEM768:id-alg-ml-kem-768:2.16.840.1.101.3.4.4.2" -#define P11PROV_DESCS_ML_KEM_768 "PKCS11 ML-KEM-768 implementation" -#define P11PROV_NAMES_ML_KEM_1024 \ - "ML-KEM-1024:MLKEM1024:id-alg-ml-kem-1024:2.16.840.1.101.3.4.4.3" -#define P11PROV_DESCS_ML_KEM_1024 "PKCS11 ML-KEM-1024 implementation" -#define P11PROV_NAMES_SLH_DSA_SHA2_128S \ - "SLH-DSA-SHA2-128s:2.16.840.1.101.3.4.3.20" -#define P11PROV_DESCS_SLH_DSA_SHA2_128S \ - "PKCS11 SLH-DSA-SHA2-128s implementation" -#define P11PROV_NAMES_SLH_DSA_SHA2_128F \ - "SLH-DSA-SHA2-128f:2.16.840.1.101.3.4.3.21" -#define P11PROV_DESCS_SLH_DSA_SHA2_128F \ - "PKCS11 SLH-DSA-SHA2-128f implementation" -#define P11PROV_NAMES_SLH_DSA_SHA2_192S \ - "SLH-DSA-SHA2-192s:2.16.840.1.101.3.4.3.22" -#define P11PROV_DESCS_SLH_DSA_SHA2_192S \ - "PKCS11 SLH-DSA-SHA2-192s implementation" -#define P11PROV_NAMES_SLH_DSA_SHA2_192F \ - "SLH-DSA-SHA2-192f:2.16.840.1.101.3.4.3.23" -#define P11PROV_DESCS_SLH_DSA_SHA2_192F \ - "PKCS11 SLH-DSA-SHA2-192f implementation" -#define P11PROV_NAMES_SLH_DSA_SHA2_256S \ - "SLH-DSA-SHA2-256s:2.16.840.1.101.3.4.3.24" -#define P11PROV_DESCS_SLH_DSA_SHA2_256S \ - "PKCS11 SLH-DSA-SHA2-256s implementation" -#define P11PROV_NAMES_SLH_DSA_SHA2_256F \ - "SLH-DSA-SHA2-256f:2.16.840.1.101.3.4.3.25" -#define P11PROV_DESCS_SLH_DSA_SHA2_256F \ - "PKCS11 SLH-DSA-SHA2-256f implementation" -#define P11PROV_NAMES_SLH_DSA_SHAKE_128S \ - "SLH-DSA-SHAKE-128s:2.16.840.1.101.3.4.3.26" -#define P11PROV_DESCS_SLH_DSA_SHAKE_128S \ - "PKCS11 SLH-DSA-SHAKE-128s implementation" -#define P11PROV_NAMES_SLH_DSA_SHAKE_128F \ - "SLH-DSA-SHAKE-128f:2.16.840.1.101.3.4.3.27" -#define P11PROV_DESCS_SLH_DSA_SHAKE_128F \ - "PKCS11 SLH-DSA-SHAKE-128f implementation" -#define P11PROV_NAMES_SLH_DSA_SHAKE_192S \ - "SLH-DSA-SHAKE-192s:2.16.840.1.101.3.4.3.28" -#define P11PROV_DESCS_SLH_DSA_SHAKE_192S \ - "PKCS11 SLH-DSA-SHAKE-192s implementation" -#define P11PROV_NAMES_SLH_DSA_SHAKE_192F \ - "SLH-DSA-SHAKE-192f:2.16.840.1.101.3.4.3.29" -#define P11PROV_DESCS_SLH_DSA_SHAKE_192F \ - "PKCS11 SLH-DSA-SHAKE-192f implementation" -#define P11PROV_NAMES_SLH_DSA_SHAKE_256S \ - "SLH-DSA-SHAKE-256s:2.16.840.1.101.3.4.3.30" -#define P11PROV_DESCS_SLH_DSA_SHAKE_256S \ - "PKCS11 SLH-DSA-SHAKE-256s implementation" -#define P11PROV_NAMES_SLH_DSA_SHAKE_256F \ - "SLH-DSA-SHAKE-256f:2.16.840.1.101.3.4.3.31" -#define P11PROV_DESCS_SLH_DSA_SHAKE_256F \ - "PKCS11 SLH-DSA-SHAKE-256f implementation" -#define P11PROV_NAMES_RAND "PKCS11-RAND" -#define P11PROV_DESCS_RAND "PKCS11 Random Generator" -#define P11PROV_NAME_CERTIFICATE "CERTIFICATE" -#define P11PROV_NAME_TLS13_KDF "TLS13-KDF" -#define P11PROV_NAMES_TLS13_KDF P11PROV_NAME_TLS13_KDF -#define P11PROV_DESCS_TLS13_KDF "PKCS11 TLS 1.3 HKDF Implementation" -#define P11PROV_NAMES_DER "DER" -#define P11PROV_DESCS_DER "DER decoder implementation in PKCS11 provider" -#define P11PROV_NAMES_URI "pkcs11" -#define P11PROV_DESCS_URI "PKCS11 URI Store" - #define P11PROV_PARAM_URI "pkcs11_uri" #define P11PROV_PARAM_EPHEMERAL "pkcs11_ephemeral" #define P11PROV_PARAM_KEY_USAGE "pkcs11_key_usage" #define P11PROV_PARAM_SLOT_ID "pkcs11_slot_id" #if SKEY_SUPPORT == 1 - -#define P11PROV_NAME_GENERIC_SECRET "GENERIC-SECRET" - #define P11PROV_NAME_AES "AES" -#define P11PROV_NAMES_AES "AES:2.16.840.1.101.3.4.1" -#define P11PROV_DESCS_AES "PKCS11 AES Implementation" -#define P11PROV_NAMES_AES_256_ECB "AES-256-ECB:2.16.840.1.101.3.4.1.41" -#define P11PROV_DESCS_AES_256_ECB "AES-256 ECB PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_ECB "AES-192-ECB:2.16.840.1.101.3.4.1.21" -#define P11PROV_DESCS_AES_192_ECB "AES-192 ECB PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_ECB "AES-128-ECB:2.16.840.1.101.3.4.1.1" -#define P11PROV_DESCS_AES_128_ECB "AES-128 ECB PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_CBC \ - "AES-256-CBC:AES256:aes256:2.16.840.1.101.3.4.1.42" -#define P11PROV_DESCS_AES_256_CBC "AES-256 CBC PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_CBC \ - "AES-192-CBC:AES192:aes192:2.16.840.1.101.3.4.1.22" -#define P11PROV_DESCS_AES_192_CBC "AES-192 CBC PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_CBC \ - "AES-128-CBC:AES128:aes128:2.16.840.1.101.3.4.1.2" -#define P11PROV_DESCS_AES_128_CBC "AES-128 CBC PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_OFB "AES-256-OFB:2.16.840.1.101.3.4.1.43" -#define P11PROV_DESCS_AES_256_OFB "AES-256 OFB PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_OFB "AES-192-OFB:2.16.840.1.101.3.4.1.23" -#define P11PROV_DESCS_AES_192_OFB "AES-192 OFB PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_OFB "AES-128-OFB:2.16.840.1.101.3.4.1.3" -#define P11PROV_DESCS_AES_128_OFB "AES-128 OFB PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_CFB "AES-256-CFB:2.16.840.1.101.3.4.1.44" -#define P11PROV_DESCS_AES_256_CFB \ - "AES-256 CFB128 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_CFB "AES-192-CFB:2.16.840.1.101.3.4.1.24" -#define P11PROV_DESCS_AES_192_CFB \ - "AES-192 CFB128 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_CFB "AES-128-CFB:2.16.840.1.101.3.4.1.4" -#define P11PROV_DESCS_AES_128_CFB \ - "AES-128 CFB128 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_CFB1 "AES-256-CFB1" -#define P11PROV_DESCS_AES_256_CFB1 "AES-256 CFB1 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_CFB1 "AES-192-CFB1" -#define P11PROV_DESCS_AES_192_CFB1 "AES-192 CFB1 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_CFB1 "AES-128-CFB1" -#define P11PROV_DESCS_AES_128_CFB1 "AES-128 CFB1 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_CFB8 "AES-256-CFB8" -#define P11PROV_DESCS_AES_256_CFB8 "AES-256 CFB8 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_CFB8 "AES-192-CFB8" -#define P11PROV_DESCS_AES_192_CFB8 "AES-192 CFB8 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_CFB8 "AES-128-CFB8" -#define P11PROV_DESCS_AES_128_CFB8 "AES-128 CFB8 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_CTR "AES-256-CTR" -#define P11PROV_DESCS_AES_256_CTR "AES-256 CTR PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_CTR "AES-192-CTR" -#define P11PROV_DESCS_AES_192_CTR "AES-192 CTR PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_CTR "AES-128-CTR" -#define P11PROV_DESCS_AES_128_CTR "AES-128 CTR PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_CTS "AES-256-CBC-CTS" -#define P11PROV_DESCS_AES_256_CTS "AES-256 CTS PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_CTS "AES-192-CBC-CTS" -#define P11PROV_DESCS_AES_192_CTS "AES-192 CTS PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_CTS "AES-128-CBC-CTS" -#define P11PROV_DESCS_AES_128_CTS "AES-128 CTS PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_GCM "AES-256-GCM" -#define P11PROV_DESCS_AES_256_GCM "AES-256 GCM PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_GCM "AES-192-GCM" -#define P11PROV_DESCS_AES_192_GCM "AES-192 GCM PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_GCM "AES-128-GCM" -#define P11PROV_DESCS_AES_128_GCM "AES-128 GCM PKCS11 Provider Implementation" -#define P11PROV_NAMES_CHACHA20_POLY1305 "ChaCha20-Poly1305" -#define P11PROV_DESCS_CHACHA20_POLY1305 \ - "CHACHA20-POLY1305 PKCS11 Provider Implementation" #define P11PROV_NAME_GENERIC_SECRET "GENERIC-SECRET" -#define P11PROV_NAMES_GENERIC_SECRET P11PROV_NAME_GENERIC_SECRET -#define P11PROV_DESCS_GENERIC_SECRET "PKCS11 Generic Secret Implementation" - #endif typedef struct p11prov_ctx P11PROV_CTX; @@ -313,7 +67,18 @@ typedef struct p11prov_obj_pool P11PROV_OBJ_POOL; #endif /* Provider ctx */ +enum p11prov_ctx_status { + P11PROV_UNINITIALIZED = 0, + P11PROV_OPS_NEEDS_INIT, + P11PROV_INITIALIZED, + P11PROV_NEEDS_REINIT, + P11PROV_NO_DEINIT, + P11PROV_IN_ERROR, +}; + P11PROV_INTERFACE *p11prov_ctx_get_interface(P11PROV_CTX *ctx); +P11PROV_MODULE *p11prov_ctx_get_module(P11PROV_CTX *ctx); +void p11prov_ctx_set_status(P11PROV_CTX *ctx, enum p11prov_ctx_status status); CK_UTF8CHAR_PTR p11prov_ctx_pin(P11PROV_CTX *ctx); OSSL_LIB_CTX *p11prov_ctx_get_libctx(P11PROV_CTX *ctx); CK_RV p11prov_ctx_status(P11PROV_CTX *ctx); @@ -353,6 +118,8 @@ bool p11prov_ctx_is_call_blocked(P11PROV_CTX *ctx, uint64_t mask); bool p11prov_ctx_no_session_callbacks(P11PROV_CTX *ctx); CK_INFO p11prov_ctx_get_ck_info(P11PROV_CTX *ctx); +CK_RV p11prov_ctx_add_algs(P11PROV_CTX *ctx, int operation_id, + OSSL_ALGORITHM *algs); #include "debug.h" @@ -378,25 +145,13 @@ int p11prov_pop_error_to_mark(P11PROV_CTX *ctx); #include "interface.h" #include "obj/object.h" -#include "kmgmt/keymgmt.h" -#include "store.h" -#include "sig/signature.h" -#include "asymmetric_cipher.h" -#include "exchange.h" -#include "kdf.h" -#include "encoder.h" -#include "digests.h" #include "util.h" #include "session.h" #include "slot.h" -#include "random.h" #include "pk11_uri.h" -#include "kem.h" -#if SKEY_SUPPORT == 1 -#include "cipher.h" -#include "kmgmt/skey.h" -#endif +#include "registration.h" +#include "digests.h" /* TLS */ int tls_group_capabilities(OSSL_CALLBACK *cb, void *arg); diff --git a/src/random.c b/src/random.c index e2fc6e07..72edd8b8 100644 --- a/src/random.c +++ b/src/random.c @@ -2,6 +2,9 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "random.h" + +#define DISPATCH_RAND_FN(name) DECL_DISPATCH_FUNC(rand, p11prov_rand, name) DISPATCH_RAND_FN(newctx); /* required */ DISPATCH_RAND_FN(freectx); /* required */ @@ -177,6 +180,9 @@ static void p11prov_rand_unlock(void *pctx) /* nothing to do */ } +#define DISPATCH_RAND_ELEM(prefix, NAME, name) \ + { OSSL_FUNC_RAND_##NAME, (void (*)(void))p11prov_##prefix##_##name } + const OSSL_DISPATCH p11prov_rand_functions[] = { DISPATCH_RAND_ELEM(rand, NEWCTX, newctx), DISPATCH_RAND_ELEM(rand, FREECTX, freectx), @@ -191,7 +197,7 @@ const OSSL_DISPATCH p11prov_rand_functions[] = { { 0, NULL }, }; -CK_RV p11prov_check_random(P11PROV_CTX *ctx) +static CK_RV p11prov_check_random(P11PROV_CTX *ctx) { struct p11prov_rand_ctx rctx = { .provctx = ctx, @@ -207,3 +213,30 @@ CK_RV p11prov_check_random(P11PROV_CTX *ctx) return CKR_OK; } + +OSSL_ALGORITHM rand_algorithms[] = { + DEFAULT_ALGORITHM(RAND, p11prov_rand_functions), +}; + +CK_RV p11prov_register_random(P11PROV_CTX *ctx, bool fips_property) +{ + OSSL_ALGORITHM *algs; + CK_RV ret; + + ret = p11prov_check_random(ctx); + if (ret == CKR_FUNCTION_NOT_SUPPORTED) { + /* not supported */ + return p11prov_ctx_add_algs(ctx, OSSL_OP_RAND, NULL); + } + + algs = OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * 2); + if (algs == NULL) { + (void)p11prov_ctx_add_algs(ctx, OSSL_OP_RAND, NULL); + return CKR_HOST_MEMORY; + } + + p11prov_assign_alg(&algs[0], rand_algorithms, 0, + fips_property ? P11PROV_FIPS_PROPERTIES : NULL); + + return p11prov_ctx_add_algs(ctx, OSSL_OP_RAND, algs); +} diff --git a/src/random.h b/src/random.h index 950a19e7..87b92a96 100644 --- a/src/random.h +++ b/src/random.h @@ -4,13 +4,6 @@ #ifndef _PKCS11_RANDOM_H #define _PKCS11_RANDOM_H -#define DISPATCH_RAND_FN(name) DECL_DISPATCH_FUNC(rand, p11prov_rand, name) -#define DISPATCH_RAND_ELEM(prefix, NAME, name) \ - { \ - OSSL_FUNC_RAND_##NAME, (void (*)(void))p11prov_##prefix##_##name \ - } -extern const OSSL_DISPATCH p11prov_rand_functions[]; - -CK_RV p11prov_check_random(P11PROV_CTX *ctx); +CK_RV p11prov_register_random(P11PROV_CTX *ctx, bool fips_property); #endif /* _PKCS11_RANDOM_H */ diff --git a/src/registration.c b/src/registration.c new file mode 100644 index 00000000..5b99b4a2 --- /dev/null +++ b/src/registration.c @@ -0,0 +1,665 @@ +/* Copyright (C) 2026 Simo Sorce + SPDX-License-Identifier: Apache-2.0 */ + +#include "provider.h" + +CK_MECHANISM_TYPE p11prov_tbid_to_mech(enum p11prov_mech_tbid tbid) +{ + switch (tbid) { + case TBID_RSA_PKCS_KEY_PAIR_GEN: + return CKM_RSA_PKCS_KEY_PAIR_GEN; + case TBID_RSA_PKCS: + return CKM_RSA_PKCS; + case TBID_SHA1_RSA_PKCS: + return CKM_SHA1_RSA_PKCS; + case TBID_SHA224_RSA_PKCS: + return CKM_SHA224_RSA_PKCS; + case TBID_SHA256_RSA_PKCS: + return CKM_SHA256_RSA_PKCS; + case TBID_SHA384_RSA_PKCS: + return CKM_SHA384_RSA_PKCS; + case TBID_SHA512_RSA_PKCS: + return CKM_SHA512_RSA_PKCS; + case TBID_SHA3_224_RSA_PKCS: + return CKM_SHA3_224_RSA_PKCS; + case TBID_SHA3_256_RSA_PKCS: + return CKM_SHA3_256_RSA_PKCS; + case TBID_SHA3_384_RSA_PKCS: + return CKM_SHA3_384_RSA_PKCS; + case TBID_SHA3_512_RSA_PKCS: + return CKM_SHA3_512_RSA_PKCS; + case TBID_RSA_PKCS_PSS: + return CKM_RSA_PKCS_PSS; + case TBID_SHA1_RSA_PKCS_PSS: + return CKM_SHA1_RSA_PKCS_PSS; + case TBID_SHA256_RSA_PKCS_PSS: + return CKM_SHA256_RSA_PKCS_PSS; + case TBID_SHA384_RSA_PKCS_PSS: + return CKM_SHA384_RSA_PKCS_PSS; + case TBID_SHA512_RSA_PKCS_PSS: + return CKM_SHA512_RSA_PKCS_PSS; + case TBID_SHA224_RSA_PKCS_PSS: + return CKM_SHA224_RSA_PKCS_PSS; + case TBID_SHA3_256_RSA_PKCS_PSS: + return CKM_SHA3_256_RSA_PKCS_PSS; + case TBID_SHA3_384_RSA_PKCS_PSS: + return CKM_SHA3_384_RSA_PKCS_PSS; + case TBID_SHA3_512_RSA_PKCS_PSS: + return CKM_SHA3_512_RSA_PKCS_PSS; + case TBID_SHA3_224_RSA_PKCS_PSS: + return CKM_SHA3_224_RSA_PKCS_PSS; + case TBID_RSA_PKCS_OAEP: + return CKM_RSA_PKCS_OAEP; + case TBID_RSA_X_509: + return CKM_RSA_X_509; + case TBID_RSA_X9_31: + return CKM_RSA_X9_31; + case TBID_RSA_X9_31_KEY_PAIR_GEN: + return CKM_RSA_X9_31_KEY_PAIR_GEN; + case TBID_EC_KEY_PAIR_GEN: + return CKM_EC_KEY_PAIR_GEN; + case TBID_ECDSA: + return CKM_ECDSA; + case TBID_ECDSA_SHA1: + return CKM_ECDSA_SHA1; + case TBID_ECDSA_SHA224: + return CKM_ECDSA_SHA224; + case TBID_ECDSA_SHA256: + return CKM_ECDSA_SHA256; + case TBID_ECDSA_SHA384: + return CKM_ECDSA_SHA384; + case TBID_ECDSA_SHA512: + return CKM_ECDSA_SHA512; + case TBID_ECDSA_SHA3_224: + return CKM_ECDSA_SHA3_224; + case TBID_ECDSA_SHA3_256: + return CKM_ECDSA_SHA3_256; + case TBID_ECDSA_SHA3_384: + return CKM_ECDSA_SHA3_384; + case TBID_ECDSA_SHA3_512: + return CKM_ECDSA_SHA3_512; + case TBID_ECDH1_DERIVE: + return CKM_ECDH1_DERIVE; + case TBID_ECDH1_COFACTOR_DERIVE: + return CKM_ECDH1_COFACTOR_DERIVE; + case TBID_EC_EDWARDS_KEY_PAIR_GEN: + return CKM_EC_EDWARDS_KEY_PAIR_GEN; + case TBID_EC_MONTGOMERY_KEY_PAIR_GEN: + return CKM_EC_MONTGOMERY_KEY_PAIR_GEN; + case TBID_EDDSA: + return CKM_EDDSA; + case TBID_HKDF_DERIVE: + return CKM_HKDF_DERIVE; + case TBID_SHA_1: + return CKM_SHA_1; + case TBID_SHA_1_HMAC: + return CKM_SHA_1_HMAC; + case TBID_SHA_1_HMAC_GENERAL: + return CKM_SHA_1_HMAC_GENERAL; + case TBID_SHA1_KEY_DERIVATION: + return CKM_SHA1_KEY_DERIVATION; + case TBID_SHA_1_KEY_GEN: + return CKM_SHA_1_KEY_GEN; + case TBID_SHA224: + return CKM_SHA224; + case TBID_SHA224_HMAC: + return CKM_SHA224_HMAC; + case TBID_SHA224_HMAC_GENERAL: + return CKM_SHA224_HMAC_GENERAL; + case TBID_SHA224_KEY_DERIVATION: + return CKM_SHA224_KEY_DERIVATION; + case TBID_SHA224_KEY_GEN: + return CKM_SHA224_KEY_GEN; + case TBID_SHA256: + return CKM_SHA256; + case TBID_SHA256_HMAC: + return CKM_SHA256_HMAC; + case TBID_SHA256_HMAC_GENERAL: + return CKM_SHA256_HMAC_GENERAL; + case TBID_SHA256_KEY_DERIVATION: + return CKM_SHA256_KEY_DERIVATION; + case TBID_SHA256_KEY_GEN: + return CKM_SHA256_KEY_GEN; + case TBID_SHA384: + return CKM_SHA384; + case TBID_SHA384_HMAC: + return CKM_SHA384_HMAC; + case TBID_SHA384_HMAC_GENERAL: + return CKM_SHA384_HMAC_GENERAL; + case TBID_SHA384_KEY_DERIVATION: + return CKM_SHA384_KEY_DERIVATION; + case TBID_SHA384_KEY_GEN: + return CKM_SHA384_KEY_GEN; + case TBID_SHA512: + return CKM_SHA512; + case TBID_SHA512_HMAC: + return CKM_SHA512_HMAC; + case TBID_SHA512_HMAC_GENERAL: + return CKM_SHA512_HMAC_GENERAL; + case TBID_SHA512_KEY_DERIVATION: + return CKM_SHA512_KEY_DERIVATION; + case TBID_SHA512_KEY_GEN: + return CKM_SHA512_KEY_GEN; + case TBID_SHA512_224: + return CKM_SHA512_224; + case TBID_SHA512_224_HMAC: + return CKM_SHA512_224_HMAC; + case TBID_SHA512_224_HMAC_GENERAL: + return CKM_SHA512_224_HMAC_GENERAL; + case TBID_SHA512_224_KEY_DERIVATION: + return CKM_SHA512_224_KEY_DERIVATION; + case TBID_SHA512_224_KEY_GEN: + return CKM_SHA512_224_KEY_GEN; + case TBID_SHA512_256: + return CKM_SHA512_256; + case TBID_SHA512_256_HMAC: + return CKM_SHA512_256_HMAC; + case TBID_SHA512_256_HMAC_GENERAL: + return CKM_SHA512_256_HMAC_GENERAL; + case TBID_SHA512_256_KEY_DERIVATION: + return CKM_SHA512_256_KEY_DERIVATION; + case TBID_SHA512_256_KEY_GEN: + return CKM_SHA512_256_KEY_GEN; + case TBID_SHA512_T: + return CKM_SHA512_T; + case TBID_SHA512_T_HMAC: + return CKM_SHA512_T_HMAC; + case TBID_SHA512_T_HMAC_GENERAL: + return CKM_SHA512_T_HMAC_GENERAL; + case TBID_SHA512_T_KEY_DERIVATION: + return CKM_SHA512_T_KEY_DERIVATION; + case TBID_SHA512_T_KEY_GEN: + return CKM_SHA512_T_KEY_GEN; + case TBID_SHA3_224: + return CKM_SHA3_224; + case TBID_SHA3_224_HMAC: + return CKM_SHA3_224_HMAC; + case TBID_SHA3_224_HMAC_GENERAL: + return CKM_SHA3_224_HMAC_GENERAL; + case TBID_SHA3_224_KEY_DERIVATION: + return CKM_SHA3_224_KEY_DERIVATION; + case TBID_SHA3_224_KEY_GEN: + return CKM_SHA3_224_KEY_GEN; + case TBID_SHA3_256: + return CKM_SHA3_256; + case TBID_SHA3_256_HMAC: + return CKM_SHA3_256_HMAC; + case TBID_SHA3_256_HMAC_GENERAL: + return CKM_SHA3_256_HMAC_GENERAL; + case TBID_SHA3_256_KEY_DERIVATION: + return CKM_SHA3_256_KEY_DERIVATION; + case TBID_SHA3_256_KEY_GEN: + return CKM_SHA3_256_KEY_GEN; + case TBID_SHA3_384: + return CKM_SHA3_384; + case TBID_SHA3_384_HMAC: + return CKM_SHA3_384_HMAC; + case TBID_SHA3_384_HMAC_GENERAL: + return CKM_SHA3_384_HMAC_GENERAL; + case TBID_SHA3_384_KEY_DERIVATION: + return CKM_SHA3_384_KEY_DERIVATION; + case TBID_SHA3_384_KEY_GEN: + return CKM_SHA3_384_KEY_GEN; + case TBID_SHA3_512: + return CKM_SHA3_512; + case TBID_SHA3_512_HMAC: + return CKM_SHA3_512_HMAC; + case TBID_SHA3_512_HMAC_GENERAL: + return CKM_SHA3_512_HMAC_GENERAL; + case TBID_SHA3_512_KEY_DERIVATION: + return CKM_SHA3_512_KEY_DERIVATION; + case TBID_SHA3_512_KEY_GEN: + return CKM_SHA3_512_KEY_GEN; + case TBID_ML_DSA_KEY_PAIR_GEN: + return CKM_ML_DSA_KEY_PAIR_GEN; + case TBID_ML_DSA: + return CKM_ML_DSA; + case TBID_HASH_ML_DSA: + return CKM_HASH_ML_DSA; + case TBID_HASH_ML_DSA_SHA224: + return CKM_HASH_ML_DSA_SHA224; + case TBID_HASH_ML_DSA_SHA256: + return CKM_HASH_ML_DSA_SHA256; + case TBID_HASH_ML_DSA_SHA384: + return CKM_HASH_ML_DSA_SHA384; + case TBID_HASH_ML_DSA_SHA512: + return CKM_HASH_ML_DSA_SHA512; + case TBID_HASH_ML_DSA_SHA3_224: + return CKM_HASH_ML_DSA_SHA3_224; + case TBID_HASH_ML_DSA_SHA3_256: + return CKM_HASH_ML_DSA_SHA3_256; + case TBID_HASH_ML_DSA_SHA3_384: + return CKM_HASH_ML_DSA_SHA3_384; + case TBID_HASH_ML_DSA_SHA3_512: + return CKM_HASH_ML_DSA_SHA3_512; + case TBID_HASH_ML_DSA_SHAKE128: + return CKM_HASH_ML_DSA_SHAKE128; + case TBID_HASH_ML_DSA_SHAKE256: + return CKM_HASH_ML_DSA_SHAKE256; + case TBID_ML_KEM_KEY_PAIR_GEN: + return CKM_ML_KEM_KEY_PAIR_GEN; + case TBID_ML_KEM: + return CKM_ML_KEM; + case TBID_SLH_DSA_KEY_PAIR_GEN: + return CKM_SLH_DSA_KEY_PAIR_GEN; + case TBID_SLH_DSA: + return CKM_SLH_DSA; + case TBID_HASH_SLH_DSA: + return CKM_HASH_SLH_DSA; + case TBID_HASH_SLH_DSA_SHA224: + return CKM_HASH_SLH_DSA_SHA224; + case TBID_HASH_SLH_DSA_SHA256: + return CKM_HASH_SLH_DSA_SHA256; + case TBID_HASH_SLH_DSA_SHA384: + return CKM_HASH_SLH_DSA_SHA384; + case TBID_HASH_SLH_DSA_SHA512: + return CKM_HASH_SLH_DSA_SHA512; + case TBID_HASH_SLH_DSA_SHA3_224: + return CKM_HASH_SLH_DSA_SHA3_224; + case TBID_HASH_SLH_DSA_SHA3_256: + return CKM_HASH_SLH_DSA_SHA3_256; + case TBID_HASH_SLH_DSA_SHA3_384: + return CKM_HASH_SLH_DSA_SHA3_384; + case TBID_HASH_SLH_DSA_SHA3_512: + return CKM_HASH_SLH_DSA_SHA3_512; + case TBID_HASH_SLH_DSA_SHAKE128: + return CKM_HASH_SLH_DSA_SHAKE128; + case TBID_HASH_SLH_DSA_SHAKE256: + return CKM_HASH_SLH_DSA_SHAKE256; + case TBID_AES_KEY_GEN: + return CKM_AES_KEY_GEN; + case TBID_AES_ECB: + return CKM_AES_ECB; + case TBID_AES_CBC: + return CKM_AES_CBC; + case TBID_AES_CBC_PAD: + return CKM_AES_CBC_PAD; + case TBID_AES_OFB: + return CKM_AES_OFB; + case TBID_AES_CFB128: + return CKM_AES_CFB128; + case TBID_AES_CFB1: + return CKM_AES_CFB1; + case TBID_AES_CFB8: + return CKM_AES_CFB8; + case TBID_AES_CTR: + return CKM_AES_CTR; + case TBID_AES_CTS: + return CKM_AES_CTS; + case TBID_AES_GCM: + return CKM_AES_GCM; + case TBID_AES_MAC: + return CKM_AES_MAC; + case TBID_AES_MAC_GENERAL: + return CKM_AES_MAC_GENERAL; + case TBID_AES_CCM: + return CKM_AES_CCM; + case TBID_AES_CMAC: + return CKM_AES_CMAC; + case TBID_AES_CMAC_GENERAL: + return CKM_AES_CMAC_GENERAL; + case TBID_AES_XCBC_MAC: + return CKM_AES_XCBC_MAC; + case TBID_AES_XCBC_MAC_96: + return CKM_AES_XCBC_MAC_96; + case TBID_AES_GMAC: + return CKM_AES_GMAC; + case TBID_CHACHA20_POLY1305: + return CKM_CHACHA20_POLY1305; + case TBID_GENERIC_SECRET_KEY_GEN: + return CKM_GENERIC_SECRET_KEY_GEN; + default: + return CK_UNAVAILABLE_INFORMATION; + } +} + +int p11prov_mech_to_tbid(CK_MECHANISM_TYPE mech) +{ + switch (mech) { + case CKM_RSA_PKCS_KEY_PAIR_GEN: + return TBID_RSA_PKCS_KEY_PAIR_GEN; + case CKM_RSA_PKCS: + return TBID_RSA_PKCS; + case CKM_SHA1_RSA_PKCS: + return TBID_SHA1_RSA_PKCS; + case CKM_SHA224_RSA_PKCS: + return TBID_SHA224_RSA_PKCS; + case CKM_SHA256_RSA_PKCS: + return TBID_SHA256_RSA_PKCS; + case CKM_SHA384_RSA_PKCS: + return TBID_SHA384_RSA_PKCS; + case CKM_SHA512_RSA_PKCS: + return TBID_SHA512_RSA_PKCS; + case CKM_SHA3_224_RSA_PKCS: + return TBID_SHA3_224_RSA_PKCS; + case CKM_SHA3_256_RSA_PKCS: + return TBID_SHA3_256_RSA_PKCS; + case CKM_SHA3_384_RSA_PKCS: + return TBID_SHA3_384_RSA_PKCS; + case CKM_SHA3_512_RSA_PKCS: + return TBID_SHA3_512_RSA_PKCS; + case CKM_RSA_PKCS_PSS: + return TBID_RSA_PKCS_PSS; + case CKM_SHA1_RSA_PKCS_PSS: + return TBID_SHA1_RSA_PKCS_PSS; + case CKM_SHA256_RSA_PKCS_PSS: + return TBID_SHA256_RSA_PKCS_PSS; + case CKM_SHA384_RSA_PKCS_PSS: + return TBID_SHA384_RSA_PKCS_PSS; + case CKM_SHA512_RSA_PKCS_PSS: + return TBID_SHA512_RSA_PKCS_PSS; + case CKM_SHA224_RSA_PKCS_PSS: + return TBID_SHA224_RSA_PKCS_PSS; + case CKM_SHA3_256_RSA_PKCS_PSS: + return TBID_SHA3_256_RSA_PKCS_PSS; + case CKM_SHA3_384_RSA_PKCS_PSS: + return TBID_SHA3_384_RSA_PKCS_PSS; + case CKM_SHA3_512_RSA_PKCS_PSS: + return TBID_SHA3_512_RSA_PKCS_PSS; + case CKM_SHA3_224_RSA_PKCS_PSS: + return TBID_SHA3_224_RSA_PKCS_PSS; + case CKM_RSA_PKCS_OAEP: + return TBID_RSA_PKCS_OAEP; + case CKM_RSA_X_509: + return TBID_RSA_X_509; + case CKM_RSA_X9_31: + return TBID_RSA_X9_31; + case CKM_RSA_X9_31_KEY_PAIR_GEN: + return TBID_RSA_X9_31_KEY_PAIR_GEN; + case CKM_EC_KEY_PAIR_GEN: + return TBID_EC_KEY_PAIR_GEN; + case CKM_ECDSA: + return TBID_ECDSA; + case CKM_ECDSA_SHA1: + return TBID_ECDSA_SHA1; + case CKM_ECDSA_SHA224: + return TBID_ECDSA_SHA224; + case CKM_ECDSA_SHA256: + return TBID_ECDSA_SHA256; + case CKM_ECDSA_SHA384: + return TBID_ECDSA_SHA384; + case CKM_ECDSA_SHA512: + return TBID_ECDSA_SHA512; + case CKM_ECDSA_SHA3_224: + return TBID_ECDSA_SHA3_224; + case CKM_ECDSA_SHA3_256: + return TBID_ECDSA_SHA3_256; + case CKM_ECDSA_SHA3_384: + return TBID_ECDSA_SHA3_384; + case CKM_ECDSA_SHA3_512: + return TBID_ECDSA_SHA3_512; + case CKM_ECDH1_DERIVE: + return TBID_ECDH1_DERIVE; + case CKM_ECDH1_COFACTOR_DERIVE: + return TBID_ECDH1_COFACTOR_DERIVE; + case CKM_EC_EDWARDS_KEY_PAIR_GEN: + return TBID_EC_EDWARDS_KEY_PAIR_GEN; + case CKM_EC_MONTGOMERY_KEY_PAIR_GEN: + return TBID_EC_MONTGOMERY_KEY_PAIR_GEN; + case CKM_EDDSA: + return TBID_EDDSA; + case CKM_HKDF_DERIVE: + return TBID_HKDF_DERIVE; + case CKM_SHA_1: + return TBID_SHA_1; + case CKM_SHA_1_HMAC: + return TBID_SHA_1_HMAC; + case CKM_SHA_1_HMAC_GENERAL: + return TBID_SHA_1_HMAC_GENERAL; + case CKM_SHA1_KEY_DERIVATION: + return TBID_SHA1_KEY_DERIVATION; + case CKM_SHA_1_KEY_GEN: + return TBID_SHA_1_KEY_GEN; + case CKM_SHA224: + return TBID_SHA224; + case CKM_SHA224_HMAC: + return TBID_SHA224_HMAC; + case CKM_SHA224_HMAC_GENERAL: + return TBID_SHA224_HMAC_GENERAL; + case CKM_SHA224_KEY_DERIVATION: + return TBID_SHA224_KEY_DERIVATION; + case CKM_SHA224_KEY_GEN: + return TBID_SHA224_KEY_GEN; + case CKM_SHA256: + return TBID_SHA256; + case CKM_SHA256_HMAC: + return TBID_SHA256_HMAC; + case CKM_SHA256_HMAC_GENERAL: + return TBID_SHA256_HMAC_GENERAL; + case CKM_SHA256_KEY_DERIVATION: + return TBID_SHA256_KEY_DERIVATION; + case CKM_SHA256_KEY_GEN: + return TBID_SHA256_KEY_GEN; + case CKM_SHA384: + return TBID_SHA384; + case CKM_SHA384_HMAC: + return TBID_SHA384_HMAC; + case CKM_SHA384_HMAC_GENERAL: + return TBID_SHA384_HMAC_GENERAL; + case CKM_SHA384_KEY_DERIVATION: + return TBID_SHA384_KEY_DERIVATION; + case CKM_SHA384_KEY_GEN: + return TBID_SHA384_KEY_GEN; + case CKM_SHA512: + return TBID_SHA512; + case CKM_SHA512_HMAC: + return TBID_SHA512_HMAC; + case CKM_SHA512_HMAC_GENERAL: + return TBID_SHA512_HMAC_GENERAL; + case CKM_SHA512_KEY_DERIVATION: + return TBID_SHA512_KEY_DERIVATION; + case CKM_SHA512_KEY_GEN: + return TBID_SHA512_KEY_GEN; + case CKM_SHA512_224: + return TBID_SHA512_224; + case CKM_SHA512_224_HMAC: + return TBID_SHA512_224_HMAC; + case CKM_SHA512_224_HMAC_GENERAL: + return TBID_SHA512_224_HMAC_GENERAL; + case CKM_SHA512_224_KEY_DERIVATION: + return TBID_SHA512_224_KEY_DERIVATION; + case CKM_SHA512_224_KEY_GEN: + return TBID_SHA512_224_KEY_GEN; + case CKM_SHA512_256: + return TBID_SHA512_256; + case CKM_SHA512_256_HMAC: + return TBID_SHA512_256_HMAC; + case CKM_SHA512_256_HMAC_GENERAL: + return TBID_SHA512_256_HMAC_GENERAL; + case CKM_SHA512_256_KEY_DERIVATION: + return TBID_SHA512_256_KEY_DERIVATION; + case CKM_SHA512_256_KEY_GEN: + return TBID_SHA512_256_KEY_GEN; + case CKM_SHA512_T: + return TBID_SHA512_T; + case CKM_SHA512_T_HMAC: + return TBID_SHA512_T_HMAC; + case CKM_SHA512_T_HMAC_GENERAL: + return TBID_SHA512_T_HMAC_GENERAL; + case CKM_SHA512_T_KEY_DERIVATION: + return TBID_SHA512_T_KEY_DERIVATION; + case CKM_SHA512_T_KEY_GEN: + return TBID_SHA512_T_KEY_GEN; + case CKM_SHA3_224: + return TBID_SHA3_224; + case CKM_SHA3_224_HMAC: + return TBID_SHA3_224_HMAC; + case CKM_SHA3_224_HMAC_GENERAL: + return TBID_SHA3_224_HMAC_GENERAL; + case CKM_SHA3_224_KEY_DERIVATION: + return TBID_SHA3_224_KEY_DERIVATION; + case CKM_SHA3_224_KEY_GEN: + return TBID_SHA3_224_KEY_GEN; + case CKM_SHA3_256: + return TBID_SHA3_256; + case CKM_SHA3_256_HMAC: + return TBID_SHA3_256_HMAC; + case CKM_SHA3_256_HMAC_GENERAL: + return TBID_SHA3_256_HMAC_GENERAL; + case CKM_SHA3_256_KEY_DERIVATION: + return TBID_SHA3_256_KEY_DERIVATION; + case CKM_SHA3_256_KEY_GEN: + return TBID_SHA3_256_KEY_GEN; + case CKM_SHA3_384: + return TBID_SHA3_384; + case CKM_SHA3_384_HMAC: + return TBID_SHA3_384_HMAC; + case CKM_SHA3_384_HMAC_GENERAL: + return TBID_SHA3_384_HMAC_GENERAL; + case CKM_SHA3_384_KEY_DERIVATION: + return TBID_SHA3_384_KEY_DERIVATION; + case CKM_SHA3_384_KEY_GEN: + return TBID_SHA3_384_KEY_GEN; + case CKM_SHA3_512: + return TBID_SHA3_512; + case CKM_SHA3_512_HMAC: + return TBID_SHA3_512_HMAC; + case CKM_SHA3_512_HMAC_GENERAL: + return TBID_SHA3_512_HMAC_GENERAL; + case CKM_SHA3_512_KEY_DERIVATION: + return TBID_SHA3_512_KEY_DERIVATION; + case CKM_SHA3_512_KEY_GEN: + return TBID_SHA3_512_KEY_GEN; + case CKM_ML_DSA_KEY_PAIR_GEN: + return TBID_ML_DSA_KEY_PAIR_GEN; + case CKM_ML_DSA: + return TBID_ML_DSA; + case CKM_HASH_ML_DSA: + return TBID_HASH_ML_DSA; + case CKM_HASH_ML_DSA_SHA224: + return TBID_HASH_ML_DSA_SHA224; + case CKM_HASH_ML_DSA_SHA256: + return TBID_HASH_ML_DSA_SHA256; + case CKM_HASH_ML_DSA_SHA384: + return TBID_HASH_ML_DSA_SHA384; + case CKM_HASH_ML_DSA_SHA512: + return TBID_HASH_ML_DSA_SHA512; + case CKM_HASH_ML_DSA_SHA3_224: + return TBID_HASH_ML_DSA_SHA3_224; + case CKM_HASH_ML_DSA_SHA3_256: + return TBID_HASH_ML_DSA_SHA3_256; + case CKM_HASH_ML_DSA_SHA3_384: + return TBID_HASH_ML_DSA_SHA3_384; + case CKM_HASH_ML_DSA_SHA3_512: + return TBID_HASH_ML_DSA_SHA3_512; + case CKM_HASH_ML_DSA_SHAKE128: + return TBID_HASH_ML_DSA_SHAKE128; + case CKM_HASH_ML_DSA_SHAKE256: + return TBID_HASH_ML_DSA_SHAKE256; + case CKM_ML_KEM_KEY_PAIR_GEN: + return TBID_ML_KEM_KEY_PAIR_GEN; + case CKM_ML_KEM: + return TBID_ML_KEM; + case CKM_SLH_DSA_KEY_PAIR_GEN: + return TBID_SLH_DSA_KEY_PAIR_GEN; + case CKM_SLH_DSA: + return TBID_SLH_DSA; + case CKM_HASH_SLH_DSA: + return TBID_HASH_SLH_DSA; + case CKM_HASH_SLH_DSA_SHA224: + return TBID_HASH_SLH_DSA_SHA224; + case CKM_HASH_SLH_DSA_SHA256: + return TBID_HASH_SLH_DSA_SHA256; + case CKM_HASH_SLH_DSA_SHA384: + return TBID_HASH_SLH_DSA_SHA384; + case CKM_HASH_SLH_DSA_SHA512: + return TBID_HASH_SLH_DSA_SHA512; + case CKM_HASH_SLH_DSA_SHA3_224: + return TBID_HASH_SLH_DSA_SHA3_224; + case CKM_HASH_SLH_DSA_SHA3_256: + return TBID_HASH_SLH_DSA_SHA3_256; + case CKM_HASH_SLH_DSA_SHA3_384: + return TBID_HASH_SLH_DSA_SHA3_384; + case CKM_HASH_SLH_DSA_SHA3_512: + return TBID_HASH_SLH_DSA_SHA3_512; + case CKM_HASH_SLH_DSA_SHAKE128: + return TBID_HASH_SLH_DSA_SHAKE128; + case CKM_HASH_SLH_DSA_SHAKE256: + return TBID_HASH_SLH_DSA_SHAKE256; + case CKM_AES_KEY_GEN: + return TBID_AES_KEY_GEN; + case CKM_AES_ECB: + return TBID_AES_ECB; + case CKM_AES_CBC: + return TBID_AES_CBC; + case CKM_AES_CBC_PAD: + return TBID_AES_CBC_PAD; + case CKM_AES_OFB: + return TBID_AES_OFB; + case CKM_AES_CFB128: + return TBID_AES_CFB128; + case CKM_AES_CFB1: + return TBID_AES_CFB1; + case CKM_AES_CFB8: + return TBID_AES_CFB8; + case CKM_AES_CTR: + return TBID_AES_CTR; + case CKM_AES_CTS: + return TBID_AES_CTS; + case CKM_AES_GCM: + return TBID_AES_GCM; + case CKM_AES_MAC: + return TBID_AES_MAC; + case CKM_AES_MAC_GENERAL: + return TBID_AES_MAC_GENERAL; + case CKM_AES_CCM: + return TBID_AES_CCM; + case CKM_AES_CMAC: + return TBID_AES_CMAC; + case CKM_AES_CMAC_GENERAL: + return TBID_AES_CMAC_GENERAL; + case CKM_AES_XCBC_MAC: + return TBID_AES_XCBC_MAC; + case CKM_AES_XCBC_MAC_96: + return TBID_AES_XCBC_MAC_96; + case CKM_AES_GMAC: + return TBID_AES_GMAC; + case CKM_CHACHA20_POLY1305: + return TBID_CHACHA20_POLY1305; + case CKM_GENERIC_SECRET_KEY_GEN: + return TBID_GENERIC_SECRET_KEY_GEN; + default: + return -1; + } +} + +CK_RV p11prov_get_mech_state_table(P11PROV_CTX *ctx, bool available[TBID_SIZE]) +{ + P11PROV_SLOTS_CTX *slots; + P11PROV_SLOT *slot; + int slot_idx = 0; + CK_RV ret; + + ret = p11prov_take_slots(ctx, &slots); + if (ret != CKR_OK) { + return ret; + } + + for (slot = p11prov_fetch_slot(slots, &slot_idx); slot != NULL; + slot = p11prov_fetch_slot(slots, &slot_idx)) { + + CK_MECHANISM_TYPE *mechs; + int nmechs; + nmechs = p11prov_slot_get_mechanisms(slot, &mechs); + + for (int i = 0; i < nmechs; i++) { + int tbid = p11prov_mech_to_tbid(mechs[i]); + if (tbid == -1) { + continue; + } + available[tbid] = true; + } + } + p11prov_return_slots(slots); + + return CKR_OK; +} + +void p11prov_assign_alg(OSSL_ALGORITHM *dest, const OSSL_ALGORITHM *algs, + int idx, const char *fips_property) +{ + *dest = algs[idx]; + if (fips_property) { + dest->property_definition = fips_property; + } +} diff --git a/src/registration.h b/src/registration.h new file mode 100644 index 00000000..1a7e5475 --- /dev/null +++ b/src/registration.h @@ -0,0 +1,459 @@ +/* Copyright (C) 2026 Simo Sorce + SPDX-License-Identifier: Apache-2.0 */ + +#ifndef _REGISTRATION_H_ +#define _REGISTRATION_H_ + +/* list of supported mechanism that are used to declare + * supported functionality to openssl based on token + * support. */ + +enum p11prov_mech_tbid { + /* RSA */ + TBID_RSA_PKCS_KEY_PAIR_GEN = 0, + TBID_RSA_PKCS, + TBID_SHA1_RSA_PKCS, + TBID_SHA224_RSA_PKCS, + TBID_SHA256_RSA_PKCS, + TBID_SHA384_RSA_PKCS, + TBID_SHA512_RSA_PKCS, + TBID_SHA3_224_RSA_PKCS, + TBID_SHA3_256_RSA_PKCS, + TBID_SHA3_384_RSA_PKCS, + TBID_SHA3_512_RSA_PKCS, + TBID_RSA_PKCS_PSS, + TBID_SHA1_RSA_PKCS_PSS, + TBID_SHA256_RSA_PKCS_PSS, + TBID_SHA384_RSA_PKCS_PSS, + TBID_SHA512_RSA_PKCS_PSS, + TBID_SHA224_RSA_PKCS_PSS, + TBID_SHA3_256_RSA_PKCS_PSS, + TBID_SHA3_384_RSA_PKCS_PSS, + TBID_SHA3_512_RSA_PKCS_PSS, + TBID_SHA3_224_RSA_PKCS_PSS, + TBID_RSA_PKCS_OAEP, + TBID_RSA_X_509, + TBID_RSA_X9_31_KEY_PAIR_GEN, + TBID_RSA_X9_31, + + /* EC */ + TBID_EC_KEY_PAIR_GEN, + TBID_ECDSA, + TBID_ECDSA_SHA1, + TBID_ECDSA_SHA224, + TBID_ECDSA_SHA256, + TBID_ECDSA_SHA384, + TBID_ECDSA_SHA512, + TBID_ECDSA_SHA3_224, + TBID_ECDSA_SHA3_256, + TBID_ECDSA_SHA3_384, + TBID_ECDSA_SHA3_512, + TBID_ECDH1_DERIVE, + TBID_ECDH1_COFACTOR_DERIVE, + TBID_EC_EDWARDS_KEY_PAIR_GEN, + TBID_EC_MONTGOMERY_KEY_PAIR_GEN, + TBID_EDDSA, + + /* HKDF */ + TBID_HKDF_DERIVE, + + /* SHA Hashes */ + TBID_SHA_1, + TBID_SHA_1_HMAC, + TBID_SHA_1_HMAC_GENERAL, + TBID_SHA1_KEY_DERIVATION, + TBID_SHA_1_KEY_GEN, + TBID_SHA224, + TBID_SHA224_HMAC, + TBID_SHA224_HMAC_GENERAL, + TBID_SHA224_KEY_DERIVATION, + TBID_SHA224_KEY_GEN, + TBID_SHA256, + TBID_SHA256_HMAC, + TBID_SHA256_HMAC_GENERAL, + TBID_SHA256_KEY_DERIVATION, + TBID_SHA256_KEY_GEN, + TBID_SHA384, + TBID_SHA384_HMAC, + TBID_SHA384_HMAC_GENERAL, + TBID_SHA384_KEY_DERIVATION, + TBID_SHA384_KEY_GEN, + TBID_SHA512, + TBID_SHA512_HMAC, + TBID_SHA512_HMAC_GENERAL, + TBID_SHA512_KEY_DERIVATION, + TBID_SHA512_KEY_GEN, + TBID_SHA512_224, + TBID_SHA512_224_HMAC, + TBID_SHA512_224_HMAC_GENERAL, + TBID_SHA512_224_KEY_DERIVATION, + TBID_SHA512_224_KEY_GEN, + TBID_SHA512_256, + TBID_SHA512_256_HMAC, + TBID_SHA512_256_HMAC_GENERAL, + TBID_SHA512_256_KEY_DERIVATION, + TBID_SHA512_256_KEY_GEN, + TBID_SHA512_T, + TBID_SHA512_T_HMAC, + TBID_SHA512_T_HMAC_GENERAL, + TBID_SHA512_T_KEY_DERIVATION, + TBID_SHA512_T_KEY_GEN, + TBID_SHA3_224, + TBID_SHA3_224_HMAC, + TBID_SHA3_224_HMAC_GENERAL, + TBID_SHA3_224_KEY_DERIVATION, + TBID_SHA3_224_KEY_GEN, + TBID_SHA3_256, + TBID_SHA3_256_HMAC, + TBID_SHA3_256_HMAC_GENERAL, + TBID_SHA3_256_KEY_DERIVATION, + TBID_SHA3_256_KEY_GEN, + TBID_SHA3_384, + TBID_SHA3_384_HMAC, + TBID_SHA3_384_HMAC_GENERAL, + TBID_SHA3_384_KEY_DERIVATION, + TBID_SHA3_384_KEY_GEN, + TBID_SHA3_512, + TBID_SHA3_512_HMAC, + TBID_SHA3_512_HMAC_GENERAL, + TBID_SHA3_512_KEY_DERIVATION, + TBID_SHA3_512_KEY_GEN, + + /* ML-DSA */ + TBID_ML_DSA_KEY_PAIR_GEN, + TBID_ML_DSA, + TBID_HASH_ML_DSA, + TBID_HASH_ML_DSA_SHA224, + TBID_HASH_ML_DSA_SHA256, + TBID_HASH_ML_DSA_SHA384, + TBID_HASH_ML_DSA_SHA512, + TBID_HASH_ML_DSA_SHA3_224, + TBID_HASH_ML_DSA_SHA3_256, + TBID_HASH_ML_DSA_SHA3_384, + TBID_HASH_ML_DSA_SHA3_512, + TBID_HASH_ML_DSA_SHAKE128, + TBID_HASH_ML_DSA_SHAKE256, + + /* ML-KEM */ + TBID_ML_KEM_KEY_PAIR_GEN, + TBID_ML_KEM, + + /* SLH-DSA */ + TBID_SLH_DSA_KEY_PAIR_GEN, + TBID_SLH_DSA, + TBID_HASH_SLH_DSA, + TBID_HASH_SLH_DSA_SHA224, + TBID_HASH_SLH_DSA_SHA256, + TBID_HASH_SLH_DSA_SHA384, + TBID_HASH_SLH_DSA_SHA512, + TBID_HASH_SLH_DSA_SHA3_224, + TBID_HASH_SLH_DSA_SHA3_256, + TBID_HASH_SLH_DSA_SHA3_384, + TBID_HASH_SLH_DSA_SHA3_512, + TBID_HASH_SLH_DSA_SHAKE128, + TBID_HASH_SLH_DSA_SHAKE256, + + /* AES */ + TBID_AES_KEY_GEN, + TBID_AES_ECB, + TBID_AES_CBC, + TBID_AES_CBC_PAD, + TBID_AES_OFB, + TBID_AES_CFB128, + TBID_AES_CFB1, + TBID_AES_CFB8, + TBID_AES_CTR, + TBID_AES_CTS, + TBID_AES_GCM, + TBID_AES_MAC, + TBID_AES_MAC_GENERAL, + TBID_AES_CCM, + TBID_AES_CMAC, + TBID_AES_CMAC_GENERAL, + TBID_AES_XCBC_MAC, + TBID_AES_XCBC_MAC_96, + TBID_AES_GMAC, + + /* other */ + TBID_CHACHA20_POLY1305, + TBID_GENERIC_SECRET_KEY_GEN, + + /* Must be last */ + TBID_SIZE, +}; + +CK_MECHANISM_TYPE p11prov_tbid_to_mech(enum p11prov_mech_tbid tbid); +int p11prov_mech_to_tbid(CK_MECHANISM_TYPE mech); +CK_RV p11prov_get_mech_state_table(P11PROV_CTX *ctx, bool available[TBID_SIZE]); + +#define P11PROV_DEFAULT_PROPERTIES "provider=pkcs11" +#define P11PROV_FIPS_PROPERTIES "provider=pkcs11,fips=yes" +#define P11PROV_DEFAULT_PROVIDER "provider=default" + +#define P11PROV_NAME_HKDF "HKDF" +#define P11PROV_NAME_RSA "RSA" +#define P11PROV_NAME_RSAPSS "RSA-PSS" +#define P11PROV_NAME_EC "EC" +#define P11PROV_NAME_ECDSA "ECDSA" +#define P11PROV_NAME_ECDH "ECDH" +#define P11PROV_NAME_ED25519 "ED25519" +#define P11PROV_NAME_ED448 "ED448" +#define P11PROV_NAME_X25519 "X25519" +#define P11PROV_NAME_X448 "X448" +#define P11PROV_NAME_CERTIFICATE "CERTIFICATE" + +#define P11PROV_NAMES_RSA "RSA:rsaEncryption:1.2.840.113549.1.1.1" +#define P11PROV_DESCS_RSA "PKCS11 RSA Implementation" +#define P11PROV_NAMES_RSAPSS "RSA-PSS:RSASSA-PSS:1.2.840.113549.1.1.10" +#define P11PROV_DESCS_RSAPSS "PKCS11 RSA PSS Implementation" +#define P11PROV_NAMES_RSA_SHA1 \ + "RSA-SHA1:RSA-SHA-1:sha1WithRSAEncryption:1.2.840.113549.1.1.5" +#define P11PROV_DESCS_RSA_SHA1 "PKCS11 RSA-SHA1 Implementation" +#define P11PROV_NAMES_RSA_SHA256 \ + "RSA-SHA2-256:RSA-SHA256:sha256WithRSAEncryption:1.2.840.113549.1.1.11" +#define P11PROV_DESCS_RSA_SHA256 "PKCS11 RSA-SHA256 Implementation" +#define P11PROV_NAMES_RSA_SHA384 \ + "RSA-SHA2-384:RSA-SHA384:sha384WithRSAEncryption:1.2.840.113549.1.1.12" +#define P11PROV_DESCS_RSA_SHA384 "PKCS11 RSA-SHA384 Implementation" +#define P11PROV_NAMES_RSA_SHA512 \ + "RSA-SHA2-512:RSA-SHA512:sha512WithRSAEncryption:1.2.840.113549.1.1.13" +#define P11PROV_DESCS_RSA_SHA512 "PKCS11 RSA-SHA512 Implementation" +#define P11PROV_NAMES_RSA_SHA224 \ + "RSA-SHA2-224:RSA-SHA224:sha224WithRSAEncryption:1.2.840.113549.1.1.14" +#define P11PROV_DESCS_RSA_SHA224 "PKCS11 RSA-SHA224 Implementation" +#define P11PROV_NAMES_RSA_SHA3_224 \ + "RSA-SHA3-224:id-rsassa-pkcs1-v1_5-with-sha3-224:2.16.840.1.101.3.4.3.13" +#define P11PROV_DESCS_RSA_SHA3_224 "PKCS11 RSA-SHA3_224 Implementation" +#define P11PROV_NAMES_RSA_SHA3_256 \ + "RSA-SHA3-256:id-rsassa-pkcs1-v1_5-with-sha3-256:2.16.840.1.101.3.4.3.14" +#define P11PROV_DESCS_RSA_SHA3_256 "PKCS11 RSA-SHA3_256 Implementation" +#define P11PROV_NAMES_RSA_SHA3_384 \ + "RSA-SHA3-384:id-rsassa-pkcs1-v1_5-with-sha3-384:2.16.840.1.101.3.4.3.15" +#define P11PROV_DESCS_RSA_SHA3_384 "PKCS11 RSA-SHA3_384 Implementation" +#define P11PROV_NAMES_RSA_SHA3_512 \ + "RSA-SHA3-512:id-rsassa-pkcs1-v1_5-with-sha3-512:2.16.840.1.101.3.4.3.16" +#define P11PROV_DESCS_RSA_SHA3_512 "PKCS11 RSA-SHA3_512 Implementation" +#define P11PROV_NAMES_EC "EC:id-ecPublicKey:1.2.840.10045.2.1" +#define P11PROV_DESCS_EC "PKCS11 EC Implementation" +#define P11PROV_NAMES_ECDSA P11PROV_NAME_ECDSA +#define P11PROV_DESCS_ECDSA "PKCS11 ECDSA Implementation" +#define P11PROV_NAMES_ECDSA_SHA1 \ + "ECDSA-SHA1:ECDSA-SHA-1:ecdsa-with-SHA1:1.2.840.10045.4.1" +#define P11PROV_DESCS_ECDSA_SHA1 "PKCS11 ECDSA-SHA1 Implementation" +#define P11PROV_NAMES_ECDSA_SHA224 \ + "ECDSA-SHA2-224:ECDSA-SHA224:ecdsa-with-SHA224:1.2.840.10045.4.3.1" +#define P11PROV_DESCS_ECDSA_SHA224 "PKCS11 ECDSA-SHA224 Implementation" +#define P11PROV_NAMES_ECDSA_SHA256 \ + "ECDSA-SHA2-256:ECDSA-SHA256:ecdsa-with-SHA256:1.2.840.10045.4.3.2" +#define P11PROV_DESCS_ECDSA_SHA256 "PKCS11 ECDSA-SHA256 Implementation" +#define P11PROV_NAMES_ECDSA_SHA384 \ + "ECDSA-SHA2-384:ECDSA-SHA384:ecdsa-with-SHA384:1.2.840.10045.4.3.3" +#define P11PROV_DESCS_ECDSA_SHA384 "PKCS11 ECDSA-SHA384 Implementation" +#define P11PROV_NAMES_ECDSA_SHA512 \ + "ECDSA-SHA2-512:ECDSA-SHA512:ecdsa-with-SHA512:1.2.840.10045.4.3.4" +#define P11PROV_DESCS_ECDSA_SHA512 "PKCS11 ECDSA-SHA512 Implementation" +#define P11PROV_NAMES_ECDSA_SHA3_224 \ + "ECDSA-SHA3-224:ecdsa_with_SHA3-224:id-ecdsa-with-sha3-224:2.16.840.1." \ + "101.3.4.3.9" +#define P11PROV_DESCS_ECDSA_SHA3_224 "PKCS11 ECDSA-SHA3_224 Implementation" +#define P11PROV_NAMES_ECDSA_SHA3_256 \ + "ECDSA-SHA3-256:ecdsa_with_SHA3-256:id-ecdsa-with-sha3-256:2.16.840.1." \ + "101.3.4.3.10" +#define P11PROV_DESCS_ECDSA_SHA3_256 "PKCS11 ECDSA-SHA3_256 Implementation" +#define P11PROV_NAMES_ECDSA_SHA3_384 \ + "ECDSA-SHA3-384:ecdsa_with_SHA3-384:id-ecdsa-with-sha3-384:2.16.840.1." \ + "101.3.4.3.11" +#define P11PROV_DESCS_ECDSA_SHA3_384 "PKCS11 ECDSA-SHA3_384 Implementation" +#define P11PROV_NAMES_ECDSA_SHA3_512 \ + "ECDSA-SHA3-512:ecdsa_with_SHA3-512:id-ecdsa-with-sha3-512:2.16.840.1." \ + "101.3.4.3.12" +#define P11PROV_DESCS_ECDSA_SHA3_512 "PKCS11 ECDSA-SHA3_512 Implementation" +#define P11PROV_NAMES_ECDH P11PROV_NAME_ECDH +#define P11PROV_DESCS_ECDH "PKCS11 ECDH Implementation" +#define P11PROV_NAMES_HKDF "HKDF" +#define P11PROV_DESCS_HKDF "PKCS11 HKDF Implementation" +#define P11PROV_NAMES_ED25519 "ED25519:1.3.101.112" +#define P11PROV_DESCS_ED25519 "PKCS11 ED25519 Implementation" +#define P11PROV_NAMES_ED25519PH "ED25519ph" +#define P11PROV_DESCS_ED25519PH "PKCS11 ED25519ph implementation" +#define P11PROV_NAMES_ED25519CTX "ED25519ctx" +#define P11PROV_DESCS_ED25519CTX "PKCS11 ED25519ctx implementation" +#define P11PROV_NAMES_ED448 "ED448:1.3.101.113" +#define P11PROV_DESCS_ED448 "PKCS11 ED448 Implementation" +#define P11PROV_NAMES_ED448PH "ED448ph" +#define P11PROV_DESCS_ED448PH "PKCS11 ED448ph implementation" +#define P11PROV_NAMES_X25519 "X25519:1.3.101.110" +#define P11PROV_DESCS_X25519 "PKCS11 X25519 Implementation" +#define P11PROV_NAMES_X448 "X448:1.3.101.111" +#define P11PROV_DESCS_X448 "PKCS11 X448 Implementation" +#define P11PROV_NAMES_MLDSA_44 \ + "ML-DSA-44:MLDSA44:2.16.840.1.101.3.4.3.17:id-ml-dsa-44" +#define P11PROV_DESCS_MLDSA_44 "PKCS11 ML-DSA-44 implementation" +#define P11PROV_NAMES_MLDSA_65 \ + "ML-DSA-65:MLDSA65:2.16.840.1.101.3.4.3.18:id-ml-dsa-65" +#define P11PROV_DESCS_MLDSA_65 "PKCS11 ML-DSA-65 implementation" +#define P11PROV_NAMES_MLDSA_87 \ + "ML-DSA-87:MLDSA87:2.16.840.1.101.3.4.3.19:id-ml-dsa-87" +#define P11PROV_DESCS_MLDSA_87 "PKCS11 ML-DSA-87 implementation" +#define P11PROV_NAMES_ML_KEM_512 \ + "ML-KEM-512:MLKEM512:id-alg-ml-kem-512:2.16.840.1.101.3.4.4.1" +#define P11PROV_DESCS_ML_KEM_512 "PKCS11 ML-KEM-512 implementation" +#define P11PROV_NAMES_ML_KEM_768 \ + "ML-KEM-768:MLKEM768:id-alg-ml-kem-768:2.16.840.1.101.3.4.4.2" +#define P11PROV_DESCS_ML_KEM_768 "PKCS11 ML-KEM-768 implementation" +#define P11PROV_NAMES_ML_KEM_1024 \ + "ML-KEM-1024:MLKEM1024:id-alg-ml-kem-1024:2.16.840.1.101.3.4.4.3" +#define P11PROV_DESCS_ML_KEM_1024 "PKCS11 ML-KEM-1024 implementation" +#define P11PROV_NAMES_SLHDSA_SHA2_128S \ + "SLH-DSA-SHA2-128s:2.16.840.1.101.3.4.3.20" +#define P11PROV_DESCS_SLHDSA_SHA2_128S "PKCS11 SLH-DSA-SHA2-128s implementation" +#define P11PROV_NAMES_SLHDSA_SHA2_128F \ + "SLH-DSA-SHA2-128f:2.16.840.1.101.3.4.3.21" +#define P11PROV_DESCS_SLHDSA_SHA2_128F "PKCS11 SLH-DSA-SHA2-128f implementation" +#define P11PROV_NAMES_SLHDSA_SHA2_192S \ + "SLH-DSA-SHA2-192s:2.16.840.1.101.3.4.3.22" +#define P11PROV_DESCS_SLHDSA_SHA2_192S "PKCS11 SLH-DSA-SHA2-192s implementation" +#define P11PROV_NAMES_SLHDSA_SHA2_192F \ + "SLH-DSA-SHA2-192f:2.16.840.1.101.3.4.3.23" +#define P11PROV_DESCS_SLHDSA_SHA2_192F "PKCS11 SLH-DSA-SHA2-192f implementation" +#define P11PROV_NAMES_SLHDSA_SHA2_256S \ + "SLH-DSA-SHA2-256s:2.16.840.1.101.3.4.3.24" +#define P11PROV_DESCS_SLHDSA_SHA2_256S "PKCS11 SLH-DSA-SHA2-256s implementation" +#define P11PROV_NAMES_SLHDSA_SHA2_256F \ + "SLH-DSA-SHA2-256f:2.16.840.1.101.3.4.3.25" +#define P11PROV_DESCS_SLHDSA_SHA2_256F "PKCS11 SLH-DSA-SHA2-256f implementation" +#define P11PROV_NAMES_SLHDSA_SHAKE_128S \ + "SLH-DSA-SHAKE-128s:2.16.840.1.101.3.4.3.26" +#define P11PROV_DESCS_SLHDSA_SHAKE_128S \ + "PKCS11 SLH-DSA-SHAKE-128s implementation" +#define P11PROV_NAMES_SLHDSA_SHAKE_128F \ + "SLH-DSA-SHAKE-128f:2.16.840.1.101.3.4.3.27" +#define P11PROV_DESCS_SLHDSA_SHAKE_128F \ + "PKCS11 SLH-DSA-SHAKE-128f implementation" +#define P11PROV_NAMES_SLHDSA_SHAKE_192S \ + "SLH-DSA-SHAKE-192s:2.16.840.1.101.3.4.3.28" +#define P11PROV_DESCS_SLHDSA_SHAKE_192S \ + "PKCS11 SLH-DSA-SHAKE-192s implementation" +#define P11PROV_NAMES_SLHDSA_SHAKE_192F \ + "SLH-DSA-SHAKE-192f:2.16.840.1.101.3.4.3.29" +#define P11PROV_DESCS_SLHDSA_SHAKE_192F \ + "PKCS11 SLH-DSA-SHAKE-192f implementation" +#define P11PROV_NAMES_SLHDSA_SHAKE_256S \ + "SLH-DSA-SHAKE-256s:2.16.840.1.101.3.4.3.30" +#define P11PROV_DESCS_SLHDSA_SHAKE_256S \ + "PKCS11 SLH-DSA-SHAKE-256s implementation" +#define P11PROV_NAMES_SLHDSA_SHAKE_256F \ + "SLH-DSA-SHAKE-256f:2.16.840.1.101.3.4.3.31" +#define P11PROV_DESCS_SLHDSA_SHAKE_256F \ + "PKCS11 SLH-DSA-SHAKE-256f implementation" +#define P11PROV_NAMES_RAND "PKCS11-RAND" +#define P11PROV_DESCS_RAND "PKCS11 Random Generator" +#define P11PROV_NAMES_TLS13_KDF "TLS13-KDF" +#define P11PROV_DESCS_TLS13_KDF "PKCS11 TLS 1.3 HKDF Implementation" +#define P11PROV_NAMES_URI "pkcs11" +#define P11PROV_DESCS_URI "PKCS11 URI Store" +#define P11PROV_NAMES_AES "AES:2.16.840.1.101.3.4.1" +#define P11PROV_DESCS_AES "PKCS11 AES Implementation" +#define P11PROV_NAMES_AES_128_ECB "AES-128-ECB:2.16.840.1.101.3.4.1.1" +#define P11PROV_DESCS_AES_128_ECB "AES-128 ECB PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_ECB "AES-192-ECB:2.16.840.1.101.3.4.1.21" +#define P11PROV_DESCS_AES_192_ECB "AES-192 ECB PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_ECB "AES-256-ECB:2.16.840.1.101.3.4.1.41" +#define P11PROV_DESCS_AES_256_ECB "AES-256 ECB PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_CBC \ + "AES-128-CBC:AES128:aes128:2.16.840.1.101.3.4.1.2" +#define P11PROV_DESCS_AES_128_CBC "AES-128 CBC PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_CBC \ + "AES-192-CBC:AES192:aes192:2.16.840.1.101.3.4.1.22" +#define P11PROV_DESCS_AES_192_CBC "AES-192 CBC PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_CBC \ + "AES-256-CBC:AES256:aes256:2.16.840.1.101.3.4.1.42" +#define P11PROV_DESCS_AES_256_CBC "AES-256 CBC PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_OFB "AES-128-OFB:2.16.840.1.101.3.4.1.3" +#define P11PROV_DESCS_AES_128_OFB "AES-128 OFB PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_OFB "AES-192-OFB:2.16.840.1.101.3.4.1.23" +#define P11PROV_DESCS_AES_192_OFB "AES-192 OFB PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_OFB "AES-256-OFB:2.16.840.1.101.3.4.1.43" +#define P11PROV_DESCS_AES_256_OFB "AES-256 OFB PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_CFB "AES-128-CFB:2.16.840.1.101.3.4.1.4" +#define P11PROV_DESCS_AES_128_CFB \ + "AES-128 CFB128 PKCS11 provider Implementation" +#define P11PROV_NAMES_AES_192_CFB "AES-192-CFB:2.16.840.1.101.3.4.1.24" +#define P11PROV_DESCS_AES_192_CFB \ + "AES-192 CFB128 PKCS11 provider Implementation" +#define P11PROV_NAMES_AES_256_CFB "AES-256-CFB:2.16.840.1.101.3.4.1.44" +#define P11PROV_DESCS_AES_256_CFB \ + "AES-256 CFB128 PKCS11 provider Implementation" +#define P11PROV_NAMES_AES_128_CFB1 "AES-128-CFB1" +#define P11PROV_DESCS_AES_128_CFB1 "AES-128 CFB1 PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_CFB1 "AES-192-CFB1" +#define P11PROV_DESCS_AES_192_CFB1 "AES-192 CFB1 PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_CFB1 "AES-256-CFB1" +#define P11PROV_DESCS_AES_256_CFB1 "AES-256 CFB1 PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_CFB8 "AES-128-CFB8" +#define P11PROV_DESCS_AES_128_CFB8 "AES-128 CFB8 PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_CFB8 "AES-192-CFB8" +#define P11PROV_DESCS_AES_192_CFB8 "AES-192 CFB8 PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_CFB8 "AES-256-CFB8" +#define P11PROV_DESCS_AES_256_CFB8 "AES-256 CFB8 PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_CTR "AES-128-CTR" +#define P11PROV_DESCS_AES_128_CTR "AES-128 CTR PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_CTR "AES-192-CTR" +#define P11PROV_DESCS_AES_192_CTR "AES-192 CTR PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_CTR "AES-256-CTR" +#define P11PROV_DESCS_AES_256_CTR "AES-256 CTR PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_CTS "AES-128-CBC-CTS" +#define P11PROV_DESCS_AES_128_CTS "AES-128 CTS PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_CTS "AES-192-CBC-CTS" +#define P11PROV_DESCS_AES_192_CTS "AES-192 CTS PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_CTS "AES-256-CBC-CTS" +#define P11PROV_DESCS_AES_256_CTS "AES-256 CTS PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_GCM "AES-128-GCM" +#define P11PROV_DESCS_AES_128_GCM "AES-128 GCM PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_GCM "AES-192-GCM" +#define P11PROV_DESCS_AES_192_GCM "AES-192 GCM PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_GCM "AES-256-GCM" +#define P11PROV_DESCS_AES_256_GCM "AES-256 GCM PKCS11 Provider Implementation" +#define P11PROV_NAMES_CHACHA20_256_POLY1305 "ChaCha20-Poly1305" +#define P11PROV_DESCS_CHACHA20_256_POLY1305 \ + "CHACHA20-POLY1305 PKCS11 Provider Implementation" +#define P11PROV_NAMES_GENERIC_SECRET "GENERIC-SECRET" +#define P11PROV_DESCS_GENERIC_SECRET "PKCS11 Generic Secret Implementation" + +#define P11PROV_NAMES_SHA1 "SHA1:SHA-1:SSL3-SHA1:1.3.14.3.2.26" +#define P11PROV_DESCS_SHA1 "PKCS11 SHA1 Implementation" +#define P11PROV_NAMES_SHA224 "SHA2-224:SHA-224:SHA224:2.16.840.1.101.3.4.2.4" +#define P11PROV_DESCS_SHA224 "PKCS11 SHA2-224 Implementation" +#define P11PROV_NAMES_SHA256 "SHA2-256:SHA-256:SHA256:2.16.840.1.101.3.4.2.1" +#define P11PROV_DESCS_SHA256 "PKCS11 SHA2-256 Implementation" +#define P11PROV_NAMES_SHA384 "SHA2-384:SHA-384:SHA384:2.16.840.1.101.3.4.2.2" +#define P11PROV_DESCS_SHA384 "PKCS11 SHA2-384 Implementation" +#define P11PROV_NAMES_SHA512 "SHA2-512:SHA-512:SHA512:2.16.840.1.101.3.4.2.3" +#define P11PROV_DESCS_SHA512 "PKCS11 SHA2-512 Implementation" +#define P11PROV_NAMES_SHA512_224 \ + "SHA2-512/224:SHA-512/224:SHA512-224:2.16.840.1.101.3.4.2.5" +#define P11PROV_DESCS_SHA512_224 "PKCS11 SHA2-512/224 Implementation" +#define P11PROV_NAMES_SHA512_256 \ + "SHA2-512/256:SHA-512/256:SHA512-256:2.16.840.1.101.3.4.2.6" +#define P11PROV_DESCS_SHA512_256 "PKCS11 SHA2-512/224 Implementation" +#define P11PROV_NAMES_SHA3_224 "SHA3-224:2.16.840.1.101.3.4.2.7" +#define P11PROV_DESCS_SHA3_224 "PKCS11 SHA3-224 Implementation" +#define P11PROV_NAMES_SHA3_256 "SHA3-256:2.16.840.1.101.3.4.2.8" +#define P11PROV_DESCS_SHA3_256 "PKCS11 SHA3-256 Implementation" +#define P11PROV_NAMES_SHA3_384 "SHA3-384:2.16.840.1.101.3.4.2.9" +#define P11PROV_DESCS_SHA3_384 "PKCS11 SHA3-384 Implementation" +#define P11PROV_NAMES_SHA3_512 "SHA3-512:2.16.840.1.101.3.4.2.10" +#define P11PROV_DESCS_SHA3_512 "PKCS11 SHA3-512 Implementation" + +#define DEFAULT_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + P11PROV_DEFAULT_PROPERTIES, \ + func, \ + P11PROV_DESCS_##name, \ + } + +void p11prov_assign_alg(OSSL_ALGORITHM *dest, const OSSL_ALGORITHM *algs, + int idx, const char *fips_property); + +#endif /* _REGISTRATION_H_ */ diff --git a/src/sig/ecdsa.c b/src/sig/ecdsa.c index fa248a25..c238a281 100644 --- a/src/sig/ecdsa.c +++ b/src/sig/ecdsa.c @@ -8,6 +8,9 @@ #include "openssl/ec.h" #include "openssl/err.h" +#define DISPATCH_ECDSA_FN(name) \ + DECL_DISPATCH_FUNC(signature, p11prov_ecdsa, name) + DISPATCH_ECDSA_FN(newctx); DISPATCH_ECDSA_FN(sign_init); DISPATCH_ECDSA_FN(sign); @@ -662,7 +665,7 @@ static const OSSL_PARAM *p11prov_ecdsa_settable_ctx_params(void *ctx, return params; } -const OSSL_DISPATCH p11prov_ecdsa_signature_functions[] = { +const OSSL_DISPATCH p11prov_ecdsa_functions[] = { DISPATCH_SIG_ELEM(ecdsa, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -695,7 +698,7 @@ const OSSL_DISPATCH p11prov_ecdsa_signature_functions[] = { { \ return p11prov_ecdsa_digest_verify_init(ctx, digest, provkey, params); \ } \ - const OSSL_DISPATCH p11prov_ecdsa_##alg##_signature_functions[] = { \ + const OSSL_DISPATCH p11prov_ecdsa_##alg##_functions[] = { \ DISPATCH_SIG_ELEM(ecdsa, NEWCTX, newctx), \ DISPATCH_SIG_ELEM(sig, FREECTX, freectx), \ DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), \ diff --git a/src/sig/eddsa.c b/src/sig/eddsa.c index 70d82d30..d7030752 100644 --- a/src/sig/eddsa.c +++ b/src/sig/eddsa.c @@ -8,6 +8,9 @@ #include "openssl/ec.h" #include "openssl/err.h" +#define DISPATCH_EDDSA_FN(name) \ + DECL_DISPATCH_FUNC(signature, p11prov_eddsa, name) + DISPATCH_EDDSA_FN(newctx); DISPATCH_EDDSA_FN(digest_sign_init); DISPATCH_EDDSA_FN(sign); @@ -492,7 +495,7 @@ static const char **p11prov_ed448_query_key_types(void) } #endif /* OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT */ -const OSSL_DISPATCH p11prov_ed25519_signature_functions[] = { +const OSSL_DISPATCH p11prov_ed25519_functions[] = { DISPATCH_SIG_ELEM(eddsa, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -514,7 +517,7 @@ const OSSL_DISPATCH p11prov_ed25519_signature_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_ed448_signature_functions[] = { +const OSSL_DISPATCH p11prov_ed448_functions[] = { DISPATCH_SIG_ELEM(eddsa, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -537,7 +540,7 @@ const OSSL_DISPATCH p11prov_ed448_signature_functions[] = { }; #if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) -const OSSL_DISPATCH p11prov_ed25519ph_signature_functions[] = { +const OSSL_DISPATCH p11prov_ed25519ph_functions[] = { DISPATCH_SIG_ELEM(eddsa, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -549,7 +552,7 @@ const OSSL_DISPATCH p11prov_ed25519ph_signature_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_ed25519ctx_signature_functions[] = { +const OSSL_DISPATCH p11prov_ed25519ctx_functions[] = { DISPATCH_SIG_ELEM(eddsa, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -561,7 +564,7 @@ const OSSL_DISPATCH p11prov_ed25519ctx_signature_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_ed448ph_signature_functions[] = { +const OSSL_DISPATCH p11prov_ed448ph_functions[] = { DISPATCH_SIG_ELEM(eddsa, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), diff --git a/src/sig/internal.h b/src/sig/internal.h index 6e7d93c7..ed6a1a5d 100644 --- a/src/sig/internal.h +++ b/src/sig/internal.h @@ -4,6 +4,11 @@ #ifndef _SIG_INTERNAL_H #define _SIG_INTERNAL_H +#include "sig/signature.h" + +struct p11prov_sig_ctx; +typedef struct p11prov_sig_ctx P11PROV_SIG_CTX; + enum instance { ED_Unset = 0, ED_25519, @@ -110,4 +115,54 @@ int p11prov_sig_digest_final(P11PROV_SIG_CTX *sigctx, unsigned char *sig, #define DER_NIST_SIGALGS DER_NIST_ALGS, 0x03 #define DER_NIST_SIGALGS_LEN (DER_NIST_ALGS_LEN + 1) +#define DISPATCH_SIG_ELEM(prefix, NAME, name) \ + { OSSL_FUNC_SIGNATURE_##NAME, (void (*)(void))p11prov_##prefix##_##name } + +extern const OSSL_DISPATCH p11prov_rsa_functions[]; +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) +extern const OSSL_DISPATCH p11prov_rsa_sha1_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha224_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha256_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha384_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha512_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha3_224_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha3_256_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha3_384_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha3_512_functions[]; +#endif +extern const OSSL_DISPATCH p11prov_ecdsa_functions[]; +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) +extern const OSSL_DISPATCH p11prov_ecdsa_sha1_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha224_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha256_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha384_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha512_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha3_224_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha3_256_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha3_384_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha3_512_functions[]; +#endif +extern const OSSL_DISPATCH p11prov_ed25519_functions[]; +extern const OSSL_DISPATCH p11prov_ed448_functions[]; +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) +extern const OSSL_DISPATCH p11prov_ed25519ph_functions[]; +extern const OSSL_DISPATCH p11prov_ed25519ctx_functions[]; +extern const OSSL_DISPATCH p11prov_ed448ph_functions[]; +#endif +extern const OSSL_DISPATCH p11prov_mldsa_44_functions[]; +extern const OSSL_DISPATCH p11prov_mldsa_65_functions[]; +extern const OSSL_DISPATCH p11prov_mldsa_87_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128s_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_128s_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128f_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_128f_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192s_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_192s_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192f_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_192f_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256s_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_256s_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256f_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_256f_functions[]; + #endif /* _SIG_INTERNAL_H */ diff --git a/src/sig/mldsa.c b/src/sig/mldsa.c index 1b427af2..63f130a1 100644 --- a/src/sig/mldsa.c +++ b/src/sig/mldsa.c @@ -7,6 +7,9 @@ #include "openssl/evp.h" #include "openssl/err.h" +#define DISPATCH_MLDSA_FN(name) \ + DECL_DISPATCH_FUNC(signature, p11prov_mldsa, name) + DISPATCH_MLDSA_FN(sign_init); DISPATCH_MLDSA_FN(sign); DISPATCH_MLDSA_FN(verify_init); @@ -555,7 +558,7 @@ static const OSSL_PARAM *p11prov_mldsa_settable_ctx_params(void *ctx, return params; } -const OSSL_DISPATCH p11prov_mldsa_44_signature_functions[] = { +const OSSL_DISPATCH p11prov_mldsa_44_functions[] = { DISPATCH_SIG_ELEM(mldsa_44, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -586,7 +589,7 @@ const OSSL_DISPATCH p11prov_mldsa_44_signature_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_mldsa_65_signature_functions[] = { +const OSSL_DISPATCH p11prov_mldsa_65_functions[] = { DISPATCH_SIG_ELEM(mldsa_65, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -617,7 +620,7 @@ const OSSL_DISPATCH p11prov_mldsa_65_signature_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_mldsa_87_signature_functions[] = { +const OSSL_DISPATCH p11prov_mldsa_87_functions[] = { DISPATCH_SIG_ELEM(mldsa_87, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), diff --git a/src/sig/rsasig.c b/src/sig/rsasig.c index 1fd0c1d2..46241cc2 100644 --- a/src/sig/rsasig.c +++ b/src/sig/rsasig.c @@ -385,6 +385,9 @@ static int p11prov_rsasig_set_pss_saltlen_max(void *ctx, bool max_to_digest) return RET_OSSL_OK; } +#define DISPATCH_RSASIG_FN(name) \ + DECL_DISPATCH_FUNC(signature, p11prov_rsasig, name) + DISPATCH_RSASIG_FN(newctx); DISPATCH_RSASIG_FN(sign_init); DISPATCH_RSASIG_FN(sign); @@ -1258,7 +1261,7 @@ static const OSSL_PARAM *p11prov_rsasig_settable_ctx_params(void *ctx, return params; } -const OSSL_DISPATCH p11prov_rsa_signature_functions[] = { +const OSSL_DISPATCH p11prov_rsa_functions[] = { DISPATCH_SIG_ELEM(rsasig, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -1292,7 +1295,7 @@ const OSSL_DISPATCH p11prov_rsa_signature_functions[] = { return p11prov_rsasig_digest_verify_init(ctx, digest, provkey, \ params); \ } \ - const OSSL_DISPATCH p11prov_rsa_##alg##_signature_functions[] = { \ + const OSSL_DISPATCH p11prov_rsa_##alg##_functions[] = { \ DISPATCH_SIG_ELEM(rsasig, NEWCTX, newctx), \ DISPATCH_SIG_ELEM(sig, FREECTX, freectx), \ DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), \ diff --git a/src/sig/signature.c b/src/sig/signature.c index 84e3c512..4a2013b5 100644 --- a/src/sig/signature.c +++ b/src/sig/signature.c @@ -670,3 +670,315 @@ int p11prov_sig_digest_final(P11PROV_SIG_CTX *sigctx, unsigned char *sig, sigctx->session = NULL; return result; } + +enum p11prov_signature_algorithms { + P11PROV_SIG_RSA = 0, +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + P11PROV_SIG_RSA_SHA1, + P11PROV_SIG_RSA_SHA224, + P11PROV_SIG_RSA_SHA256, + P11PROV_SIG_RSA_SHA384, + P11PROV_SIG_RSA_SHA512, + P11PROV_SIG_RSA_SHA3_224, + P11PROV_SIG_RSA_SHA3_256, + P11PROV_SIG_RSA_SHA3_384, + P11PROV_SIG_RSA_SHA3_512, +#endif + P11PROV_SIG_ECDSA, +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + P11PROV_SIG_ECDSA_SHA1, + P11PROV_SIG_ECDSA_SHA224, + P11PROV_SIG_ECDSA_SHA256, + P11PROV_SIG_ECDSA_SHA384, + P11PROV_SIG_ECDSA_SHA512, + P11PROV_SIG_ECDSA_SHA3_224, + P11PROV_SIG_ECDSA_SHA3_256, + P11PROV_SIG_ECDSA_SHA3_384, + P11PROV_SIG_ECDSA_SHA3_512, +#endif + P11PROV_SIG_ED25519, + P11PROV_SIG_ED448, +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + P11PROV_SIG_ED25519PH, + P11PROV_SIG_ED25519CTX, + P11PROV_SIG_ED448PH, +#endif + P11PROV_SIG_MLDSA_44, + P11PROV_SIG_MLDSA_65, + P11PROV_SIG_MLDSA_87, + P11PROV_SIG_SLHDSA_SHA2_128S, + P11PROV_SIG_SLHDSA_SHAKE_128S, + P11PROV_SIG_SLHDSA_SHA2_128F, + P11PROV_SIG_SLHDSA_SHAKE_128F, + P11PROV_SIG_SLHDSA_SHA2_192S, + P11PROV_SIG_SLHDSA_SHAKE_192S, + P11PROV_SIG_SLHDSA_SHA2_192F, + P11PROV_SIG_SLHDSA_SHAKE_192F, + P11PROV_SIG_SLHDSA_SHA2_256S, + P11PROV_SIG_SLHDSA_SHAKE_256S, + P11PROV_SIG_SLHDSA_SHA2_256F, + P11PROV_SIG_SLHDSA_SHAKE_256F, + P11PROV_SIG_NUM_ALGS +}; + +const OSSL_ALGORITHM signature_algorithms[P11PROV_SIG_NUM_ALGS] = { + [P11PROV_SIG_RSA] = DEFAULT_ALGORITHM(RSA, p11prov_rsa_functions), +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + [P11PROV_SIG_RSA_SHA1] = + DEFAULT_ALGORITHM(RSA_SHA1, p11prov_rsa_sha1_functions), + [P11PROV_SIG_RSA_SHA224] = + DEFAULT_ALGORITHM(RSA_SHA224, p11prov_rsa_sha224_functions), + [P11PROV_SIG_RSA_SHA256] = + DEFAULT_ALGORITHM(RSA_SHA256, p11prov_rsa_sha256_functions), + [P11PROV_SIG_RSA_SHA384] = + DEFAULT_ALGORITHM(RSA_SHA384, p11prov_rsa_sha384_functions), + [P11PROV_SIG_RSA_SHA512] = + DEFAULT_ALGORITHM(RSA_SHA512, p11prov_rsa_sha512_functions), + [P11PROV_SIG_RSA_SHA3_224] = + DEFAULT_ALGORITHM(RSA_SHA3_224, p11prov_rsa_sha3_224_functions), + [P11PROV_SIG_RSA_SHA3_256] = + DEFAULT_ALGORITHM(RSA_SHA3_256, p11prov_rsa_sha3_256_functions), + [P11PROV_SIG_RSA_SHA3_384] = + DEFAULT_ALGORITHM(RSA_SHA3_384, p11prov_rsa_sha3_384_functions), + [P11PROV_SIG_RSA_SHA3_512] = + DEFAULT_ALGORITHM(RSA_SHA3_512, p11prov_rsa_sha3_512_functions), +#endif + [P11PROV_SIG_ECDSA] = DEFAULT_ALGORITHM(ECDSA, p11prov_ecdsa_functions), +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + [P11PROV_SIG_ECDSA_SHA1] = + DEFAULT_ALGORITHM(ECDSA_SHA1, p11prov_ecdsa_sha1_functions), + [P11PROV_SIG_ECDSA_SHA224] = + DEFAULT_ALGORITHM(ECDSA_SHA224, p11prov_ecdsa_sha224_functions), + [P11PROV_SIG_ECDSA_SHA256] = + DEFAULT_ALGORITHM(ECDSA_SHA256, p11prov_ecdsa_sha256_functions), + [P11PROV_SIG_ECDSA_SHA384] = + DEFAULT_ALGORITHM(ECDSA_SHA384, p11prov_ecdsa_sha384_functions), + [P11PROV_SIG_ECDSA_SHA512] = + DEFAULT_ALGORITHM(ECDSA_SHA512, p11prov_ecdsa_sha512_functions), + [P11PROV_SIG_ECDSA_SHA3_224] = + DEFAULT_ALGORITHM(ECDSA_SHA3_224, p11prov_ecdsa_sha3_224_functions), + [P11PROV_SIG_ECDSA_SHA3_256] = + DEFAULT_ALGORITHM(ECDSA_SHA3_256, p11prov_ecdsa_sha3_256_functions), + [P11PROV_SIG_ECDSA_SHA3_384] = + DEFAULT_ALGORITHM(ECDSA_SHA3_384, p11prov_ecdsa_sha3_384_functions), + [P11PROV_SIG_ECDSA_SHA3_512] = + DEFAULT_ALGORITHM(ECDSA_SHA3_512, p11prov_ecdsa_sha3_512_functions), +#endif + [P11PROV_SIG_ED25519] = + DEFAULT_ALGORITHM(ED25519, p11prov_ed25519_functions), + [P11PROV_SIG_ED448] = DEFAULT_ALGORITHM(ED448, p11prov_ed448_functions), +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + [P11PROV_SIG_ED25519PH] = + DEFAULT_ALGORITHM(ED25519PH, p11prov_ed25519ph_functions), + [P11PROV_SIG_ED25519CTX] = + DEFAULT_ALGORITHM(ED25519CTX, p11prov_ed25519ctx_functions), + [P11PROV_SIG_ED448PH] = + DEFAULT_ALGORITHM(ED448PH, p11prov_ed448ph_functions), +#endif + [P11PROV_SIG_MLDSA_44] = + DEFAULT_ALGORITHM(MLDSA_44, p11prov_mldsa_44_functions), + [P11PROV_SIG_MLDSA_65] = + DEFAULT_ALGORITHM(MLDSA_65, p11prov_mldsa_65_functions), + [P11PROV_SIG_MLDSA_87] = + DEFAULT_ALGORITHM(MLDSA_87, p11prov_mldsa_87_functions), + [P11PROV_SIG_SLHDSA_SHA2_128S] = + DEFAULT_ALGORITHM(SLHDSA_SHA2_128S, p11prov_slhdsa_sha2_128s_functions), + [P11PROV_SIG_SLHDSA_SHAKE_128S] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_128S, p11prov_slhdsa_shake_128s_functions), + [P11PROV_SIG_SLHDSA_SHA2_128F] = + DEFAULT_ALGORITHM(SLHDSA_SHA2_128F, p11prov_slhdsa_sha2_128f_functions), + [P11PROV_SIG_SLHDSA_SHAKE_128F] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_128F, p11prov_slhdsa_shake_128f_functions), + [P11PROV_SIG_SLHDSA_SHA2_192S] = + DEFAULT_ALGORITHM(SLHDSA_SHA2_192S, p11prov_slhdsa_sha2_192s_functions), + [P11PROV_SIG_SLHDSA_SHAKE_192S] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_192S, p11prov_slhdsa_shake_192s_functions), + [P11PROV_SIG_SLHDSA_SHA2_192F] = + DEFAULT_ALGORITHM(SLHDSA_SHA2_192F, p11prov_slhdsa_sha2_192f_functions), + [P11PROV_SIG_SLHDSA_SHAKE_192F] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_192F, p11prov_slhdsa_shake_192f_functions), + [P11PROV_SIG_SLHDSA_SHA2_256S] = + DEFAULT_ALGORITHM(SLHDSA_SHA2_256S, p11prov_slhdsa_sha2_256s_functions), + [P11PROV_SIG_SLHDSA_SHAKE_256S] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_256S, p11prov_slhdsa_shake_256s_functions), + [P11PROV_SIG_SLHDSA_SHA2_256F] = + DEFAULT_ALGORITHM(SLHDSA_SHA2_256F, p11prov_slhdsa_sha2_256f_functions), + [P11PROV_SIG_SLHDSA_SHAKE_256F] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_256F, p11prov_slhdsa_shake_256f_functions), +}; + +CK_RV p11prov_register_signatures(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_SIG_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + if (mechs[TBID_RSA_PKCS] || mechs[TBID_RSA_PKCS_PSS] + || mechs[TBID_SHA1_RSA_PKCS] || mechs[TBID_SHA224_RSA_PKCS] + || mechs[TBID_SHA256_RSA_PKCS] || mechs[TBID_SHA384_RSA_PKCS] + || mechs[TBID_SHA512_RSA_PKCS] || mechs[TBID_SHA3_224_RSA_PKCS] + || mechs[TBID_SHA3_256_RSA_PKCS] || mechs[TBID_SHA3_384_RSA_PKCS] + || mechs[TBID_SHA3_512_RSA_PKCS] || mechs[TBID_SHA1_RSA_PKCS_PSS] + || mechs[TBID_SHA224_RSA_PKCS_PSS] || mechs[TBID_SHA256_RSA_PKCS_PSS] + || mechs[TBID_SHA384_RSA_PKCS_PSS] || mechs[TBID_SHA512_RSA_PKCS_PSS] + || mechs[TBID_SHA3_224_RSA_PKCS_PSS] + || mechs[TBID_SHA3_256_RSA_PKCS_PSS] + || mechs[TBID_SHA3_384_RSA_PKCS_PSS] + || mechs[TBID_SHA3_512_RSA_PKCS_PSS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, P11PROV_SIG_RSA, + property); + } +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + if (mechs[TBID_SHA1_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA1, property); + } + if (mechs[TBID_SHA224_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA224, property); + } + if (mechs[TBID_SHA256_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA256, property); + } + if (mechs[TBID_SHA384_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA384, property); + } + if (mechs[TBID_SHA512_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA512, property); + } + if (mechs[TBID_SHA3_224_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA3_224, property); + } + if (mechs[TBID_SHA3_256_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA3_256, property); + } + if (mechs[TBID_SHA3_384_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA3_384, property); + } + if (mechs[TBID_SHA3_512_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA3_512, property); + } +#endif + + if (mechs[TBID_ECDSA] || mechs[TBID_ECDSA_SHA1] || mechs[TBID_ECDSA_SHA224] + || mechs[TBID_ECDSA_SHA256] || mechs[TBID_ECDSA_SHA384] + || mechs[TBID_ECDSA_SHA512] || mechs[TBID_ECDSA_SHA3_224] + || mechs[TBID_ECDSA_SHA3_256] || mechs[TBID_ECDSA_SHA3_384] + || mechs[TBID_ECDSA_SHA3_512]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, P11PROV_SIG_ECDSA, + property); + } +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + if (mechs[TBID_ECDSA_SHA1]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA1, property); + } + if (mechs[TBID_ECDSA_SHA224]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA224, property); + } + if (mechs[TBID_ECDSA_SHA256]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA256, property); + } + if (mechs[TBID_ECDSA_SHA384]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA384, property); + } + if (mechs[TBID_ECDSA_SHA512]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA512, property); + } + if (mechs[TBID_ECDSA_SHA3_224]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA3_224, property); + } + if (mechs[TBID_ECDSA_SHA3_256]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA3_256, property); + } + if (mechs[TBID_ECDSA_SHA3_384]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA3_384, property); + } + if (mechs[TBID_ECDSA_SHA3_512]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA3_512, property); + } +#endif + + if (mechs[TBID_EDDSA] || mechs[TBID_EC_EDWARDS_KEY_PAIR_GEN]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ED25519, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, P11PROV_SIG_ED448, + property); +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ED25519PH, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ED25519CTX, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ED448PH, property); +#endif + } + + if (mechs[TBID_ML_DSA] || mechs[TBID_ML_DSA_KEY_PAIR_GEN]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_MLDSA_44, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_MLDSA_65, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_MLDSA_87, property); + } + + if (mechs[TBID_SLH_DSA] || mechs[TBID_SLH_DSA_KEY_PAIR_GEN]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHA2_128S, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHAKE_128S, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHA2_128F, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHAKE_128F, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHA2_192S, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHAKE_192S, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHA2_192F, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHAKE_192F, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHA2_256S, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHAKE_256S, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHA2_256F, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHAKE_256F, property); + } + + if (i == 0) { + OPENSSL_free(algs); + algs = NULL; + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_SIGNATURE, algs); +} diff --git a/src/sig/signature.h b/src/sig/signature.h index 298c6fb4..1bb7b0e4 100644 --- a/src/sig/signature.h +++ b/src/sig/signature.h @@ -4,82 +4,9 @@ #ifndef _SIGNATURE_H #define _SIGNATURE_H -struct p11prov_sig_ctx; -typedef struct p11prov_sig_ctx P11PROV_SIG_CTX; - -/* common sig functions */ -#define DISPATCH_SIG_FN(name) DECL_DISPATCH_FUNC(signature, p11prov_sig, name) -#define DISPATCH_SIG_ELEM(prefix, NAME, name) \ - { \ - OSSL_FUNC_SIGNATURE_##NAME, (void (*)(void))p11prov_##prefix##_##name \ - } - -/* rsa sig functions */ -#define DISPATCH_RSASIG_FN(name) \ - DECL_DISPATCH_FUNC(signature, p11prov_rsasig, name) -extern const OSSL_DISPATCH p11prov_rsa_signature_functions[]; -#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) -extern const OSSL_DISPATCH p11prov_rsa_sha1_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha224_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha256_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha384_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha512_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha3_224_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha3_256_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha3_384_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha3_512_signature_functions[]; -#endif - -/* ecdsa sig functions */ -#define DISPATCH_ECDSA_FN(name) \ - DECL_DISPATCH_FUNC(signature, p11prov_ecdsa, name) -extern const OSSL_DISPATCH p11prov_ecdsa_signature_functions[]; -#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) -extern const OSSL_DISPATCH p11prov_ecdsa_sha1_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha224_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha256_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha384_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha512_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha3_224_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha3_256_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha3_384_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha3_512_signature_functions[]; -#endif - -/* eddsa sig functions */ -#define DISPATCH_EDDSA_FN(name) \ - DECL_DISPATCH_FUNC(signature, p11prov_eddsa, name) -extern const OSSL_DISPATCH p11prov_ed25519_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ed448_signature_functions[]; -#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) -extern const OSSL_DISPATCH p11prov_ed25519ph_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ed25519ctx_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ed448ph_signature_functions[]; -#endif - CK_MECHANISM_TYPE p11prov_digest_to_rsapss_mech(CK_MECHANISM_TYPE digest); -/* mldsa sig functions */ -#define DISPATCH_MLDSA_FN(name) \ - DECL_DISPATCH_FUNC(signature, p11prov_mldsa, name) -extern const OSSL_DISPATCH p11prov_mldsa_44_signature_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_65_signature_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_87_signature_functions[]; - -/* slhdsa sig functions */ -#define DISPATCH_SLHDSA_FN(name) \ - DECL_DISPATCH_FUNC(signature, p11prov_slhdsa, name) -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128s_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_128s_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128f_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_128f_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192s_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_192s_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192f_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_192f_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256s_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_256s_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256f_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_256f_signature_functions[]; +CK_RV p11prov_register_signatures(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); #endif /* _SIGNATURE_H */ diff --git a/src/sig/slhdsa.c b/src/sig/slhdsa.c index 464ee410..e5552d51 100644 --- a/src/sig/slhdsa.c +++ b/src/sig/slhdsa.c @@ -7,6 +7,9 @@ #include "openssl/evp.h" #include "openssl/err.h" +#define DISPATCH_SLHDSA_FN(name) \ + DECL_DISPATCH_FUNC(signature, p11prov_slhdsa, name) + DISPATCH_SLHDSA_FN(sign_init); DISPATCH_SLHDSA_FN(sign); DISPATCH_SLHDSA_FN(verify_init); @@ -667,7 +670,7 @@ static const OSSL_PARAM *p11prov_slhdsa_settable_ctx_params(void *ctx, #endif #define SLHDSA_SIGNATURE_FUNCTIONS(variant) \ - const OSSL_DISPATCH p11prov_slhdsa_##variant##_signature_functions[] = { \ + const OSSL_DISPATCH p11prov_slhdsa_##variant##_functions[] = { \ DISPATCH_SIG_ELEM(slhdsa_##variant, NEWCTX, newctx), \ DISPATCH_SIG_ELEM(sig, FREECTX, freectx), \ DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), \ diff --git a/src/store.c b/src/store.c index c56ac3d8..ad83c36a 100644 --- a/src/store.c +++ b/src/store.c @@ -2,6 +2,7 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include #include #include "store.h" @@ -258,6 +259,8 @@ static void store_fetch(struct p11prov_store_ctx *ctx, p11prov_uri_free(search_uri); } +#define DISPATCH_STORE_FN(name) DECL_DISPATCH_FUNC(store, p11prov_store, name) + DISPATCH_STORE_FN(open); DISPATCH_STORE_FN(attach); DISPATCH_STORE_FN(load); @@ -819,6 +822,9 @@ int p11prov_store_direct_fetch(void *provctx, const char *uri, return ret; } +#define DISPATCH_STORE_ELEM(NAME, name) \ + { OSSL_FUNC_STORE_##NAME, (void (*)(void))p11prov_store_##name } + const OSSL_DISPATCH p11prov_store_functions[] = { DISPATCH_STORE_ELEM(OPEN, open), DISPATCH_STORE_ELEM(ATTACH, attach), @@ -830,3 +836,20 @@ const OSSL_DISPATCH p11prov_store_functions[] = { DISPATCH_STORE_ELEM(EXPORT_OBJECT, export_object), { 0, NULL }, }; + +OSSL_ALGORITHM store_algorithms[] = { + DEFAULT_ALGORITHM(URI, p11prov_store_functions), +}; + +CK_RV p11prov_register_store(P11PROV_CTX *ctx, bool fips_property) +{ + OSSL_ALGORITHM *algs = OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * 2); + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + p11prov_assign_alg(&algs[0], store_algorithms, 0, + fips_property ? P11PROV_FIPS_PROPERTIES : NULL); + + return p11prov_ctx_add_algs(ctx, OSSL_OP_STORE, algs); +} diff --git a/src/store.h b/src/store.h index 4cce30cf..1dbc12f1 100644 --- a/src/store.h +++ b/src/store.h @@ -4,17 +4,10 @@ #ifndef _STORE_H #define _STORE_H -#include - -#define DISPATCH_STORE_FN(name) DECL_DISPATCH_FUNC(store, p11prov_store, name) -#define DISPATCH_STORE_ELEM(NAME, name) \ - { \ - OSSL_FUNC_STORE_##NAME, (void (*)(void))p11prov_store_##name \ - } -extern const OSSL_DISPATCH p11prov_store_functions[]; - int p11prov_store_direct_fetch(void *provctx, const char *uri, OSSL_CALLBACK *object_cb, void *object_cbarg, OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg); +CK_RV p11prov_register_store(P11PROV_CTX *ctx, bool fips_property); + #endif /* _STORE_H */ diff --git a/tests/tpem_encoder b/tests/tpem_encoder index 9491ed62..272fa6fc 100755 --- a/tests/tpem_encoder +++ b/tests/tpem_encoder @@ -7,6 +7,9 @@ source "${TESTSSRCDIR}/helpers.sh" # Forward declaration to avoid shellcheck's SC2153 did you mean ... : "${PRIURI:?}" "${ECPRIURI:?}" "${EDPRIURI:=}" : "${PUBURI:?}" "${ECPUBURI:?}" "${EDPUBURI:=}" +: "${MLDSAPRIURI:=}" "${MLDSAPUBURI:=}" +: "${MLKEMPRIURI:=}" "${MLKEMPUBURI:=}" +: "${SLHDSAPRIURI:=}" "${SLHDSAPUBURI:=}" # We need to configure early loading otherwise no digests are loaded, # and all checks are skipped @@ -142,6 +145,73 @@ else title PARA "Skipping Test PEM Encoding ED support" fi; +# Only run ML-DSA test if setup created ML-DSA key +if [[ -n "${MLDSAPRIURI}" ]]; then + title PARA "Test PEM Encoding ML-DSA support" + + make-uri-pem "${MLDSAPRIURI}" "${TMPPDIR}/mldsapriuri-pkey.pem" + sign-verify "${TMPPDIR}/mldsapriuri-pkey.pem" "${MLDSAPUBURI}" "${TMPPDIR}/64krandom.bin" "no-digest" + + export ALGORITHM=ML-DSA-44 + ossl ' + genpkey -propquery "provider=pkcs11" + -algorithm "${ALGORITHM}" + -pkeyopt "pkcs11_uri:pkcs11:object=Test-PEM-Encode-ML-DSA-${LABEL_SUFFIX_URI}" + -out "${TMPPDIR}/mldsa-pkey-uri.pem"' + + grep -e "-----BEGIN PKCS#11 PROVIDER URI-----" "${TMPPDIR}/mldsa-pkey-uri.pem" + + sign-verify "${TMPPDIR}/mldsa-pkey-uri.pem" \ + "pkcs11:object=Test-PEM-Encode-ML-DSA-${LABEL_SUFFIX_URI}" \ + "${TMPPDIR}/64krandom.bin" "no-digest" +else + title PARA "Skipping Test PEM Encoding ML-DSA support" +fi; + +# Only run ML-KEM test if setup created ML-KEM key +if [[ -n "${MLKEMPRIURI}" ]]; then + title PARA "Test PEM Encoding ML-KEM support" + + make-uri-pem "${MLKEMPRIURI}" "${TMPPDIR}/mlkempriuri-pkey.pem" + ossl 'pkey -in "${TMPPDIR}/mlkempriuri-pkey.pem" -noout' + + export ALGORITHM=ML-KEM-512 + ossl ' + genpkey -propquery "provider=pkcs11" + -algorithm "${ALGORITHM}" + -pkeyopt "pkcs11_uri:pkcs11:object=Test-PEM-Encode-ML-KEM-${LABEL_SUFFIX_URI}" + -out "${TMPPDIR}/mlkem-pkey-uri.pem"' + + grep -e "-----BEGIN PKCS#11 PROVIDER URI-----" "${TMPPDIR}/mlkem-pkey-uri.pem" + + ossl 'pkey -in "${TMPPDIR}/mlkem-pkey-uri.pem" -noout' +else + title PARA "Skipping Test PEM Encoding ML-KEM support" +fi; + +# Only run SLH-DSA test if setup created SLH-DSA key +if [[ -n "${SLHDSAPRIURI}" ]]; then + title PARA "Test PEM Encoding SLH-DSA support" + + make-uri-pem "${SLHDSAPRIURI}" "${TMPPDIR}/slhdsapriuri-pkey.pem" + sign-verify "${TMPPDIR}/slhdsapriuri-pkey.pem" "${SLHDSAPUBURI}" "${TMPPDIR}/64krandom.bin" "no-digest" + + export ALGORITHM=SLH-DSA-SHAKE-128s + ossl ' + genpkey -propquery "provider=pkcs11" + -algorithm "${ALGORITHM}" + -pkeyopt "pkcs11_uri:pkcs11:object=Test-PEM-Encode-SLH-DSA-${LABEL_SUFFIX_URI}" + -out "${TMPPDIR}/slhdsa-pkey-uri.pem"' + + grep -e "-----BEGIN PKCS#11 PROVIDER URI-----" "${TMPPDIR}/slhdsa-pkey-uri.pem" + + sign-verify "${TMPPDIR}/slhdsa-pkey-uri.pem" \ + "pkcs11:object=Test-PEM-Encode-SLH-DSA-${LABEL_SUFFIX_URI}" \ + "${TMPPDIR}/64krandom.bin" "no-digest" +else + title PARA "Skipping Test PEM Encoding SLH-DSA support" +fi; + title PARA "Test visible string has to match" make-uri-pem "${PRIURI}" "${TMPPDIR}/priuri-wrong-version-key.pem" "PKCS#11 Provider URI v2.0" FAIL=0