Skip to content

Commit f3b0d54

Browse files
bryan-huntbryan-hunt
committed
Enable options to populate CKA_ID by subjectKeyIdentifier or by device location (slot/handle)
1 parent 8321f81 commit f3b0d54

File tree

4 files changed

+92
-3
lines changed

4 files changed

+92
-3
lines changed

‎lib/cmake/pkcs11.cmake‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ set(PKCS11_PIN_PBKDF2_ITERATIONS 2 CACHE STRING "Define how many iterations PBK
1515
set(PKCS11_SEARCH_CACHE_SIZE 250 CACHE STRING "Static Search Attribute Cache in bytes")
1616
set(PKCS11_TOKEN_INIT_SUPPORT OFF CACHE BOOL "Support for configuring a blank or new device")
1717
set(PKCS11_MONOTONIC_ENABLE OFF CACHE BOOL "Include the monotonic hardware feature as an object")
18+
set(PKCS11_AUTO_ID_ENABLE ON CACHE BOOL "Generate CKA_ID values based on standards")
1819

1920
file(GLOB PKCS11_SRC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "pkcs11/*.c")
2021
file(GLOB PKCS11_INC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "pkcs11/*.h")

‎lib/pkcs11/pkcs11_cert.c‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -372,6 +372,35 @@ CK_RV pkcs11_cert_get_trusted_flag(CK_VOID_PTR pObject, CK_ATTRIBUTE_PTR pAttrib
372372
return CKR_ARGUMENTS_BAD;
373373
}
374374

375+
static CK_RV pkcs11_cert_get_id(CK_VOID_PTR pObject, CK_ATTRIBUTE_PTR pAttribute)
376+
{
377+
#if PKCS11_AUTO_ID_ENABLE
378+
return pkcs11_cert_get_subject_key_id(pObject, pAttribute);
379+
#elif ATCA_CA_SUPPORT
380+
pkcs11_object_ptr obj_ptr = (pkcs11_object_ptr)pObject;
381+
CK_RV rv = CKR_ARGUMENTS_BAD;
382+
383+
if (obj_ptr)
384+
{
385+
pkcs11_cert_check_trust_data(obj_ptr);
386+
387+
if (obj_ptr->data)
388+
{
389+
atcacert_def_t * cert_cfg = (atcacert_def_t*)obj_ptr->data;
390+
uint16_t key_id = ATCA_UINT16_HOST_TO_BE(cert_cfg->public_key_dev_loc.slot);
391+
rv = pkcs11_attrib_fill(pAttribute, &key_id, sizeof(uint16_t));
392+
}
393+
else
394+
{
395+
return pkcs11_attrib_empty(NULL, pAttribute);
396+
}
397+
}
398+
return rv;
399+
#else
400+
return pkcs11_attrib_empty(pObject, pAttribute);
401+
#endif
402+
}
403+
375404
/**
376405
* CKO_CERTIFICATE (Type: CKC_X_509) - X509 Public Key Certificate Model
377406
*/
@@ -411,7 +440,7 @@ const pkcs11_attrib_model pkcs11_cert_x509public_attributes[] = {
411440
/** DER-encoded Certificate subject name */
412441
{ CKA_SUBJECT, pkcs11_cert_get_subject },
413442
/** Key identifier for public/private key pair (default empty) */
414-
{ CKA_ID, pkcs11_attrib_empty },
443+
{ CKA_ID, pkcs11_cert_get_id },
415444
/** DER-encoded Certificate issuer name (default empty)*/
416445
{ CKA_ISSUER, pkcs11_attrib_empty },
417446
/** DER-encoding of the certificate serial number (default empty) */

‎lib/pkcs11/pkcs11_config.h.in‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,10 @@
115115
#cmakedefine01 PKCS11_MONOTONIC_ENABLE
116116
#endif
117117

118+
/** Automatically generate CKA_ID values based on standards */
119+
#ifndef PKCS11_AUTO_ID_ENABLE
120+
#cmakedefine01 PKCS11_AUTO_ID_ENABLE
121+
#endif
118122

119123
#include "pkcs11/cryptoki.h"
120124
#include <stddef.h>

‎lib/pkcs11/pkcs11_key.c‎

Lines changed: 57 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -373,6 +373,61 @@ static CK_RV pkcs11_key_auth_required(CK_VOID_PTR pObject, CK_ATTRIBUTE_PTR pAtt
373373
return rv;
374374
}
375375

376+
static CK_RV pkcs11_key_get_id(CK_VOID_PTR pObject, CK_ATTRIBUTE_PTR pAttribute)
377+
{
378+
pkcs11_object_ptr obj_ptr = (pkcs11_object_ptr)pObject;
379+
CK_RV rv = CKR_ARGUMENTS_BAD;
380+
381+
if (obj_ptr)
382+
{
383+
#if PKCS11_AUTO_ID_ENABLE
384+
if (pAttribute->pValue)
385+
{
386+
CK_BBOOL is_private;
387+
388+
if (CKR_OK == (rv = pkcs11_object_is_private(obj_ptr, &is_private)))
389+
{
390+
ATCA_STATUS status;
391+
uint8_t buffer[1 + ATCA_ECCP256_PUBKEY_SIZE] = {0x04};
392+
393+
if (is_private)
394+
{
395+
status = atcab_get_pubkey(obj_ptr->slot, &buffer[1]);
396+
PKCS11_DEBUG("atcab_get_pubkey: %x\r\n", status);
397+
}
398+
else
399+
{
400+
status = atcab_read_pubkey(obj_ptr->slot, &buffer[1]);
401+
PKCS11_DEBUG("atcab_read_pubkey: %x\r\n", status);
402+
}
403+
404+
if (ATCA_SUCCESS == status)
405+
{
406+
status = atcac_sw_sha1(buffer, sizeof(buffer), buffer);
407+
}
408+
409+
if (ATCA_SUCCESS == status)
410+
{
411+
rv = pkcs11_attrib_fill(pAttribute, buffer, ATCA_SHA1_DIGEST_SIZE);
412+
}
413+
else
414+
{
415+
rv = pkcs11_util_convert_rv(status);
416+
}
417+
}
418+
}
419+
else
420+
{
421+
rv = pkcs11_attrib_fill(pAttribute, NULL, ATCA_SHA1_DIGEST_SIZE);
422+
}
423+
#else
424+
uint16_t key_id = ATCA_UINT16_HOST_TO_BE(obj_ptr->slot);
425+
rv = pkcs11_attrib_fill(pAttribute, &key_id, sizeof(uint16_t));
426+
#endif
427+
}
428+
return rv;
429+
}
430+
376431
/**
377432
* CKO_PUBLIC_KEY - Public Key Object Model
378433
*/
@@ -394,7 +449,7 @@ const pkcs11_attrib_model pkcs11_key_public_attributes[] = {
394449
/** Type of key */
395450
{ CKA_KEY_TYPE, pkcs11_object_get_type },
396451
/** Key identifier for key (default empty) */
397-
{ CKA_ID, pkcs11_attrib_empty },
452+
{ CKA_ID, pkcs11_key_get_id },
398453
/** Start date for the key (default empty) */
399454
{ CKA_START_DATE, pkcs11_attrib_empty },
400455
/** End date for the key (default empty) */
@@ -484,7 +539,7 @@ const pkcs11_attrib_model pkcs11_key_private_attributes[] = {
484539
/** Type of key */
485540
{ CKA_KEY_TYPE, pkcs11_object_get_type },
486541
/** Key identifier for key (default empty) */
487-
{ CKA_ID, pkcs11_attrib_empty },
542+
{ CKA_ID, pkcs11_key_get_id },
488543
/** Start date for the key (default empty) */
489544
{ CKA_START_DATE, pkcs11_attrib_empty },
490545
/** End date for the key (default empty) */

0 commit comments

Comments
 (0)