• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /**
2  * \file pkcs12.h
3  *
4  * \brief PKCS#12 Personal Information Exchange Syntax
5  */
6 /*
7  *  Copyright The Mbed TLS Contributors
8  *  SPDX-License-Identifier: Apache-2.0
9  *
10  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
11  *  not use this file except in compliance with the License.
12  *  You may obtain a copy of the License at
13  *
14  *  http://www.apache.org/licenses/LICENSE-2.0
15  *
16  *  Unless required by applicable law or agreed to in writing, software
17  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
18  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19  *  See the License for the specific language governing permissions and
20  *  limitations under the License.
21  */
22 #ifndef MBEDTLS_PKCS12_H
23 #define MBEDTLS_PKCS12_H
24 
25 #include "mbedtls/build_info.h"
26 
27 #include "mbedtls/md.h"
28 #include "mbedtls/cipher.h"
29 #include "mbedtls/asn1.h"
30 
31 #include <stddef.h>
32 
33 /** Bad input parameters to function. */
34 #define MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA                 -0x1F80
35 /** Feature not available, e.g. unsupported encryption scheme. */
36 #define MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE            -0x1F00
37 /** PBE ASN.1 data not as expected. */
38 #define MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT             -0x1E80
39 /** Given private key password does not allow for correct decryption. */
40 #define MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH              -0x1E00
41 
42 #define MBEDTLS_PKCS12_DERIVE_KEY       1   /**< encryption/decryption key */
43 #define MBEDTLS_PKCS12_DERIVE_IV        2   /**< initialization vector     */
44 #define MBEDTLS_PKCS12_DERIVE_MAC_KEY   3   /**< integrity / MAC key       */
45 
46 #define MBEDTLS_PKCS12_PBE_DECRYPT      0
47 #define MBEDTLS_PKCS12_PBE_ENCRYPT      1
48 
49 #ifdef __cplusplus
50 extern "C" {
51 #endif
52 
53 #if defined(MBEDTLS_ASN1_PARSE_C)
54 
55 /**
56  * \brief            PKCS12 Password Based function (encryption / decryption)
57  *                   for cipher-based and mbedtls_md-based PBE's
58  *
59  * \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure
60  * \param mode       either #MBEDTLS_PKCS12_PBE_ENCRYPT or
61  *                   #MBEDTLS_PKCS12_PBE_DECRYPT
62  * \param cipher_type the cipher used
63  * \param md_type    the mbedtls_md used
64  * \param pwd        Latin1-encoded password used. This may only be \c NULL when
65  *                   \p pwdlen is 0. No null terminator should be used.
66  * \param pwdlen     length of the password (may be 0)
67  * \param input      the input data
68  * \param len        data length
69  * \param output     the output buffer
70  *
71  * \return           0 if successful, or a MBEDTLS_ERR_XXX code
72  */
73 int mbedtls_pkcs12_pbe(mbedtls_asn1_buf *pbe_params, int mode,
74                        mbedtls_cipher_type_t cipher_type, mbedtls_md_type_t md_type,
75                        const unsigned char *pwd,  size_t pwdlen,
76                        const unsigned char *input, size_t len,
77                        unsigned char *output);
78 
79 #endif /* MBEDTLS_ASN1_PARSE_C */
80 
81 /**
82  * \brief            The PKCS#12 derivation function uses a password and a salt
83  *                   to produce pseudo-random bits for a particular "purpose".
84  *
85  *                   Depending on the given id, this function can produce an
86  *                   encryption/decryption key, an initialization vector or an
87  *                   integrity key.
88  *
89  * \param data       buffer to store the derived data in
90  * \param datalen    length of buffer to fill
91  * \param pwd        The password to use. For compliance with PKCS#12 §B.1, this
92  *                   should be a BMPString, i.e. a Unicode string where each
93  *                   character is encoded as 2 bytes in big-endian order, with
94  *                   no byte order mark and with a null terminator (i.e. the
95  *                   last two bytes should be 0x00 0x00).
96  * \param pwdlen     length of the password (may be 0).
97  * \param salt       Salt buffer to use. This may only be \c NULL when
98  *                   \p saltlen is 0.
99  * \param saltlen    length of the salt (may be zero)
100  * \param mbedtls_md mbedtls_md type to use during the derivation
101  * \param id         id that describes the purpose (can be
102  *                   #MBEDTLS_PKCS12_DERIVE_KEY, #MBEDTLS_PKCS12_DERIVE_IV or
103  *                   #MBEDTLS_PKCS12_DERIVE_MAC_KEY)
104  * \param iterations number of iterations
105  *
106  * \return          0 if successful, or a MD, BIGNUM type error.
107  */
108 int mbedtls_pkcs12_derivation(unsigned char *data, size_t datalen,
109                               const unsigned char *pwd, size_t pwdlen,
110                               const unsigned char *salt, size_t saltlen,
111                               mbedtls_md_type_t mbedtls_md, int id, int iterations);
112 
113 #ifdef __cplusplus
114 }
115 #endif
116 
117 #endif /* pkcs12.h */
118