1# 加密导入密钥(C/C++) 2 3 4以加密导入ECDH密钥对为例，涉及业务侧加密密钥的[密钥生成](huks-key-generation-overview.md)、[协商](huks-key-agreement-overview.md)等操作不在本示例中体现。 5 6 7具体的场景介绍及支持的算法规格，请参考[密钥导入的支持的算法](huks-key-import-overview.md#支持的算法)。 8 9## 在CMake脚本中链接相关动态库 10```txt 11 target_link_libraries(entry PUBLIC libhuks_ndk.z.so) 12``` 13 14## 开发步骤 15 161. 设备A（导入设备）将待导入密钥转换成[HUKS密钥材料格式](huks-concepts.md#密钥材料格式)To_Import_Key（仅针对非对称密钥，若待导入密钥是对称密钥则可省略此步骤）。 17 182. 设备B（被导入设备）生成一个加密导入用途的、用于协商的非对称密钥对Wrapping_Key（公钥Wrapping_Pk，私钥Wrapping_Sk），其密钥用途设置为unwrap，导出Wrapping_Key的公钥材料Wrapping_Pk并保存。 19 203. 设备A使用和设备B同样的算法，生成一个加密导入用途的、用于协商的非对称密钥对Caller_Key（公钥Caller_Pk，私钥Caller_Sk），导出Caller_Key的公钥材料Caller_Pk并保存。 21 224. 设备A生成一个对称密钥Caller_Kek，该密钥后续将用于加密To_Import_Key。 23 245. 设备A基于Caller_Key的私钥Caller_Sk和设备B Wrapping_Key的公钥Wrapping_Pk，协商出Shared_Key。 25 266. 设备A使用Caller_Kek加密To_Import_Key，生成To_Import_Key_Enc。 27 287. 设备A使用Shared_Key加密Caller_Kek，生成Caller_Kek_Enc。 29 308. 设备A封装Caller_Pk、Caller_Kek_Enc、To_Import_Key_Enc等加密导入的密钥材料并发送给设备B，加密导入密钥材料格式见[加密导入密钥材料格式](huks-key-import-overview.md#加密导入密钥材料格式)。 31 329. 设备B导入封装的加密密钥材料。 33 3410. 设备A、B删除用于加密导入的密钥。 35 36```c++ 37#include "napi/native_api.h" 38#include "huks/native_huks_api.h" 39#include "huks/native_huks_param.h" 40#include <algorithm> 41OH_Huks_Result InitParamSet(struct OH_Huks_ParamSet **paramSet, const struct OH_Huks_Param *params, 42 uint32_t paramCount) { 43 OH_Huks_Result ret = OH_Huks_InitParamSet(paramSet); 44 if (ret.errorCode != OH_HUKS_SUCCESS) { 45 return ret; 46 } 47 ret = OH_Huks_AddParams(*paramSet, params, paramCount); 48 if (ret.errorCode != OH_HUKS_SUCCESS) { 49 OH_Huks_FreeParamSet(paramSet); 50 return ret; 51 } 52 ret = OH_Huks_BuildParamSet(paramSet); 53 if (ret.errorCode != OH_HUKS_SUCCESS) { 54 OH_Huks_FreeParamSet(paramSet); 55 return ret; 56 } 57 return ret; 58} 59struct HksImportWrappedKeyTestParams { 60 // server key, for real 61 struct OH_Huks_Blob *wrappingKeyAlias; 62 struct OH_Huks_ParamSet *genWrappingKeyParamSet; 63 uint32_t publicKeySize; 64 struct OH_Huks_Blob *callerKeyAlias; 65 struct OH_Huks_ParamSet *genCallerKeyParamSet; 66 struct OH_Huks_Blob *callerKekAlias; 67 struct OH_Huks_Blob *callerKek; 68 struct OH_Huks_ParamSet *importCallerKekParamSet; 69 struct OH_Huks_Blob *callerAgreeKeyAlias; 70 struct OH_Huks_ParamSet *agreeParamSet; 71 struct OH_Huks_ParamSet *importWrappedKeyParamSet; 72 struct OH_Huks_Blob *importedKeyAlias; 73 struct OH_Huks_Blob *importedPlainKey; 74 uint32_t keyMaterialLen; 75}; 76static const uint32_t IV_SIZE = 16; 77static uint8_t IV[IV_SIZE] = "bababababababab"; // 此处仅为测试数据，实际使用时该值每次应该不同 78static const uint32_t WRAPPED_KEY_IV_SIZE = 16; 79static uint8_t WRAPPED_KEY_IV[IV_SIZE] = "bababababababab"; // 此处仅为测试数据，实际使用时该值每次应该不同 80static const uint32_t AAD_SIZE = 16; 81static uint8_t AAD[AAD_SIZE] = "abababababababa"; // 此处仅为测试数据，实际使用时该值每次应该不同 82static const uint32_t NONCE_SIZE = 12; 83static uint8_t NONCE[NONCE_SIZE] = "hahahahahah"; // 此处仅为测试数据，实际使用时该值每次应该不同 84static const uint32_t AEAD_TAG_SIZE = 16; 85static const uint32_t X25519_256_SIZE = 256; 86static struct OH_Huks_Blob g_wrappingKeyAliasAes256 = {.size = (uint32_t)strlen("test_wrappingKey_x25519_aes256"), 87 .data = (uint8_t *)"test_wrappingKey_x25519_aes256"}; 88static struct OH_Huks_Blob g_callerKeyAliasAes256 = {.size = (uint32_t)strlen("test_caller_key_x25519_aes256"), 89 .data = (uint8_t *)"test_caller_key_x25519_aes256"}; 90static struct OH_Huks_Blob g_callerKekAliasAes256 = {.size = (uint32_t)strlen("test_caller_kek_x25519_aes256"), 91 .data = (uint8_t *)"test_caller_kek_x25519_aes256"}; 92static struct OH_Huks_Blob g_callerAes256Kek = {.size = (uint32_t)strlen("This is kek to encrypt plain key"), 93 .data = (uint8_t *)"This is kek to encrypt plain key"}; 94static struct OH_Huks_Blob g_callerAgreeKeyAliasAes256 = {.size = 95 (uint32_t)strlen("test_caller_agree_key_x25519_aes256"), 96 .data = (uint8_t *)"test_caller_agree_key_x25519_aes256"}; 97static struct OH_Huks_Blob g_importedKeyAliasAes256 = {.size = (uint32_t)strlen("test_import_key_x25519_aes256"), 98 .data = (uint8_t *)"test_import_key_x25519_aes256"}; 99static struct OH_Huks_Blob g_importedAes256PlainKey = {.size = (uint32_t)strlen("This is plain key to be imported"), 100 .data = (uint8_t *)"This is plain key to be imported"}; 101static struct OH_Huks_Param g_importWrappedAes256Params[] = { 102 {.tag = OH_HUKS_TAG_ALGORITHM, .uint32Param = OH_HUKS_ALG_AES}, 103 {.tag = OH_HUKS_TAG_PURPOSE, .uint32Param = OH_HUKS_KEY_PURPOSE_ENCRYPT | OH_HUKS_KEY_PURPOSE_DECRYPT}, 104 {.tag = OH_HUKS_TAG_KEY_SIZE, .uint32Param = OH_HUKS_AES_KEY_SIZE_256}, 105 {.tag = OH_HUKS_TAG_PADDING, .uint32Param = OH_HUKS_PADDING_NONE}, 106 {.tag = OH_HUKS_TAG_BLOCK_MODE, .uint32Param = OH_HUKS_MODE_GCM}, 107 {.tag = OH_HUKS_TAG_DIGEST, .uint32Param = OH_HUKS_DIGEST_NONE}, 108 {.tag = OH_HUKS_TAG_UNWRAP_ALGORITHM_SUITE, .uint32Param = OH_HUKS_UNWRAP_SUITE_X25519_AES_256_GCM_NOPADDING}, 109 {.tag = OH_HUKS_TAG_ASSOCIATED_DATA, 110 .blob = {.size = AAD_SIZE, .data = (uint8_t *)AAD}}, // 此处仅为测试数据，实际使用时该值应与调用者信息相关 111 {.tag = OH_HUKS_TAG_NONCE, 112 .blob = {.size = NONCE_SIZE, .data = (uint8_t *)NONCE}}}; // 此处仅为测试数据，实际使用时该值每次应该不同 113static const uint32_t g_x25519PubKeySize = 32; 114static struct OH_Huks_Param g_genWrappingKeyParams[] = { 115 {.tag = OH_HUKS_TAG_ALGORITHM, .uint32Param = OH_HUKS_ALG_X25519}, 116 {.tag = OH_HUKS_TAG_PURPOSE, .uint32Param = OH_HUKS_KEY_PURPOSE_UNWRAP}, 117 {.tag = OH_HUKS_TAG_KEY_SIZE, .uint32Param = OH_HUKS_CURVE25519_KEY_SIZE_256}}; 118static struct OH_Huks_Param g_genCallerX25519Params[] = { 119 {.tag = OH_HUKS_TAG_ALGORITHM, .uint32Param = OH_HUKS_ALG_X25519}, 120 {.tag = OH_HUKS_TAG_PURPOSE, .uint32Param = OH_HUKS_KEY_PURPOSE_AGREE}, 121 {.tag = OH_HUKS_TAG_KEY_SIZE, .uint32Param = OH_HUKS_CURVE25519_KEY_SIZE_256}}; 122static struct OH_Huks_Param g_importParamsCallerKek[] = { 123 {.tag = OH_HUKS_TAG_ALGORITHM, .uint32Param = OH_HUKS_ALG_AES}, 124 {.tag = OH_HUKS_TAG_PURPOSE, .uint32Param = OH_HUKS_KEY_PURPOSE_ENCRYPT}, 125 {.tag = OH_HUKS_TAG_KEY_SIZE, .uint32Param = OH_HUKS_AES_KEY_SIZE_256}, 126 {.tag = OH_HUKS_TAG_PADDING, .uint32Param = OH_HUKS_PADDING_NONE}, 127 {.tag = OH_HUKS_TAG_BLOCK_MODE, .uint32Param = OH_HUKS_MODE_GCM}, 128 {.tag = OH_HUKS_TAG_DIGEST, .uint32Param = OH_HUKS_DIGEST_NONE}, 129 {.tag = OH_HUKS_TAG_IV, 130 .blob = {.size = WRAPPED_KEY_IV_SIZE, 131 .data = (uint8_t *)WRAPPED_KEY_IV}}}; // 此处仅为测试数据，实际使用时该值每次应该不同 132static struct OH_Huks_Param g_callerAgreeParams[] = { 133 {.tag = OH_HUKS_TAG_ALGORITHM, .uint32Param = OH_HUKS_ALG_X25519}, 134 {.tag = OH_HUKS_TAG_PURPOSE, .uint32Param = OH_HUKS_KEY_PURPOSE_AGREE}, 135 {.tag = OH_HUKS_TAG_KEY_SIZE, .uint32Param = OH_HUKS_CURVE25519_KEY_SIZE_256}}; 136static struct OH_Huks_Param g_aesKekEncryptParams[] = { 137 {.tag = OH_HUKS_TAG_ALGORITHM, .uint32Param = OH_HUKS_ALG_AES}, 138 {.tag = OH_HUKS_TAG_PURPOSE, .uint32Param = OH_HUKS_KEY_PURPOSE_ENCRYPT}, 139 {.tag = OH_HUKS_TAG_KEY_SIZE, .uint32Param = OH_HUKS_AES_KEY_SIZE_256}, 140 {.tag = OH_HUKS_TAG_PADDING, .uint32Param = OH_HUKS_PADDING_NONE}, 141 {.tag = OH_HUKS_TAG_BLOCK_MODE, .uint32Param = OH_HUKS_MODE_GCM}, 142 {.tag = OH_HUKS_TAG_DIGEST, .uint32Param = OH_HUKS_DIGEST_NONE}, 143 {.tag = OH_HUKS_TAG_ASSOCIATED_DATA, 144 .blob = {.size = AAD_SIZE, .data = (uint8_t *)AAD}}, // 此处仅为测试数据，实际使用时该值应与调用者信息相关 145 {.tag = OH_HUKS_TAG_NONCE, 146 .blob = {.size = NONCE_SIZE, .data = (uint8_t *)NONCE}}}; // 此处仅为测试数据，实际使用时该值每次应该不同 147static struct OH_Huks_Param g_importAgreeKeyParams[] = { 148 {.tag = OH_HUKS_TAG_ALGORITHM, .uint32Param = OH_HUKS_ALG_AES}, 149 {.tag = OH_HUKS_TAG_PURPOSE, .uint32Param = OH_HUKS_KEY_PURPOSE_ENCRYPT}, 150 {.tag = OH_HUKS_TAG_KEY_SIZE, .uint32Param = OH_HUKS_AES_KEY_SIZE_256}, 151 {.tag = OH_HUKS_TAG_PADDING, .uint32Param = OH_HUKS_PADDING_NONE}, 152 {.tag = OH_HUKS_TAG_BLOCK_MODE, .uint32Param = OH_HUKS_MODE_GCM}, 153 {.tag = OH_HUKS_TAG_DIGEST, .uint32Param = OH_HUKS_DIGEST_NONE}, 154 {.tag = OH_HUKS_TAG_IV, 155 .blob = {.size = IV_SIZE, .data = (uint8_t *)IV}}}; // 此处仅为测试数据，实际使用时该值每次应该不同 156OH_Huks_Result HuksAgreeKey(const struct OH_Huks_ParamSet *paramSet, const struct OH_Huks_Blob *keyAlias, 157 const struct OH_Huks_Blob *peerPublicKey, struct OH_Huks_Blob *agreedKey) { 158 uint8_t temp[10] = {0}; 159 struct OH_Huks_Blob inData = {sizeof(temp), temp}; 160 uint8_t handleU[sizeof(uint64_t)] = {0}; 161 struct OH_Huks_Blob handle = {sizeof(uint64_t), handleU}; 162 OH_Huks_Result ret = OH_Huks_InitSession(keyAlias, paramSet, &handle, nullptr); 163 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 164 return ret; 165 } 166 uint8_t outDataU[1024] = {0}; 167 struct OH_Huks_Blob outDataUpdate = {1024, outDataU}; 168 ret = OH_Huks_UpdateSession(&handle, paramSet, peerPublicKey, &outDataUpdate); 169 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 170 return ret; 171 } 172 ret = OH_Huks_FinishSession(&handle, paramSet, &inData, agreedKey); 173 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 174 return ret; 175 } 176 return ret; 177} 178OH_Huks_Result MallocAndCheckBlobData(struct OH_Huks_Blob *blob, const uint32_t blobSize) { 179 struct OH_Huks_Result ret; 180 ret.errorCode = OH_HUKS_SUCCESS; 181 blob->data = (uint8_t *)malloc(blobSize); 182 if (blob->data == NULL) { 183 ret.errorCode = OH_HUKS_ERR_CODE_INTERNAL_ERROR; 184 } 185 return ret; 186} 187static const uint32_t TIMES = 4; 188static const uint32_t MAX_UPDATE_SIZE = 64; 189static const uint32_t MAX_OUTDATA_SIZE = MAX_UPDATE_SIZE * TIMES; 190#define HUKS_FREE_BLOB(blob) \ 191 do { \ 192 if ((blob).data != nullptr) { \ 193 free((blob).data); \ 194 (blob).data = nullptr; \ 195 } \ 196 (blob).size = 0; \ 197 } while (0) 198#define OH_HUKS_KEY_BYTES(keySize) (((keySize) + 7) / 8) 199static OH_Huks_Result HksEncryptLoopUpdate(const struct OH_Huks_Blob *handle, const struct OH_Huks_ParamSet *paramSet, 200 const struct OH_Huks_Blob *inData, struct OH_Huks_Blob *outData) { 201 struct OH_Huks_Result ret; 202 ret.errorCode = OH_HUKS_SUCCESS; 203 struct OH_Huks_Blob inDataSeg = *inData; 204 uint8_t *lastPtr = inData->data + inData->size - 1; 205 struct OH_Huks_Blob outDataSeg = {MAX_OUTDATA_SIZE, NULL}; 206 uint8_t *cur = outData->data; 207 outData->size = 0; 208 inDataSeg.size = MAX_UPDATE_SIZE; 209 bool isFinished = false; 210 while (inDataSeg.data <= lastPtr) { 211 if (inDataSeg.data + MAX_UPDATE_SIZE <= lastPtr) { 212 outDataSeg.size = MAX_OUTDATA_SIZE; 213 } else { 214 isFinished = true; 215 inDataSeg.size = lastPtr - inDataSeg.data + 1; 216 break; 217 } 218 if (MallocAndCheckBlobData(&outDataSeg, outDataSeg.size).errorCode != (int32_t)OH_HUKS_SUCCESS) { 219 ret.errorCode = OH_HUKS_ERR_CODE_INTERNAL_ERROR; 220 return ret; 221 } 222 ret = OH_Huks_UpdateSession(handle, paramSet, &inDataSeg, &outDataSeg); 223 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 224 free(outDataSeg.data); 225 return ret; 226 } 227 std::copy(outDataSeg.data, outDataSeg.data + outDataSeg.size, cur); 228 cur += outDataSeg.size; 229 outData->size += outDataSeg.size; 230 free(outDataSeg.data); 231 if ((isFinished == false) && (inDataSeg.data + MAX_UPDATE_SIZE > lastPtr)) { 232 ret.errorCode = OH_HUKS_ERR_CODE_INTERNAL_ERROR; 233 return ret; 234 } 235 inDataSeg.data += MAX_UPDATE_SIZE; 236 } 237 struct OH_Huks_Blob outDataFinish = {inDataSeg.size * TIMES, NULL}; 238 if (MallocAndCheckBlobData(&outDataFinish, outDataFinish.size).errorCode != (int32_t)OH_HUKS_SUCCESS) { 239 ret.errorCode = OH_HUKS_ERR_CODE_INTERNAL_ERROR; 240 return ret; 241 } 242 ret = OH_Huks_FinishSession(handle, paramSet, &inDataSeg, &outDataFinish); 243 if (ret.errorCode != OH_HUKS_SUCCESS) { 244 free(outDataFinish.data); 245 return ret; 246 } 247 std::copy(outDataFinish.data, outDataFinish.data + outDataFinish.size, cur); 248 outData->size += outDataFinish.size; 249 free(outDataFinish.data); 250 return ret; 251} 252OH_Huks_Result HuksEncrypt(const struct OH_Huks_Blob *key, const struct OH_Huks_ParamSet *paramSet, 253 const struct OH_Huks_Blob *plainText, struct OH_Huks_Blob *cipherText) { 254 uint8_t handle[sizeof(uint64_t)] = {0}; 255 struct OH_Huks_Blob handleBlob = {sizeof(uint64_t), handle}; 256 OH_Huks_Result ret = OH_Huks_InitSession(key, paramSet, &handleBlob, nullptr); 257 if (ret.errorCode != OH_HUKS_SUCCESS) { 258 return ret; 259 } 260 ret = HksEncryptLoopUpdate(&handleBlob, paramSet, plainText, cipherText); 261 return ret; 262} 263static OH_Huks_Result BuildWrappedKeyData(struct OH_Huks_Blob **blobArray, uint32_t size, 264 struct OH_Huks_Blob *outData) { 265 uint32_t totalLength = size * sizeof(uint32_t); 266 struct OH_Huks_Result ret; 267 ret.errorCode = OH_HUKS_SUCCESS; 268 /* 计算大小 */ 269 for (uint32_t i = 0; i < size; ++i) { 270 totalLength += blobArray[i]->size; 271 } 272 struct OH_Huks_Blob outBlob = {0, nullptr}; 273 outBlob.size = totalLength; 274 ret = MallocAndCheckBlobData(&outBlob, outBlob.size); 275 if (ret.errorCode != OH_HUKS_SUCCESS) { 276 return ret; 277 } 278 uint32_t offset = 0; 279 /* 拷贝数据 */ 280 for (uint32_t i = 0; i < size; ++i) { 281 if (totalLength - offset >= sizeof(blobArray[i]->size)) { 282 std::copy(reinterpret_cast<uint8_t *>(&blobArray[i]->size), 283 reinterpret_cast<uint8_t *>(&blobArray[i]->size) + sizeof(blobArray[i]->size), 284 outBlob.data + offset); 285 } else { 286 ret.errorCode = OH_HUKS_ERR_CODE_INTERNAL_ERROR; 287 return ret; 288 } 289 offset += sizeof(blobArray[i]->size); 290 if (totalLength - offset >= blobArray[i]->size) { 291 std::copy(blobArray[i]->data, blobArray[i]->data + blobArray[i]->size, outBlob.data + offset); 292 } else { 293 ret.errorCode = OH_HUKS_ERR_CODE_INTERNAL_ERROR; 294 return ret; 295 } 296 offset += blobArray[i]->size; 297 } 298 outData->size = outBlob.size; 299 outData->data = outBlob.data; 300 return ret; 301} 302static OH_Huks_Result CheckParamsValid(const struct HksImportWrappedKeyTestParams *params) { 303 struct OH_Huks_Result ret; 304 ret.errorCode = OH_HUKS_SUCCESS; 305 if (params == nullptr) { 306 ret.errorCode = OH_HUKS_ERR_CODE_ILLEGAL_ARGUMENT; 307 return ret; 308 } 309 if (params->wrappingKeyAlias == nullptr || params->genWrappingKeyParamSet == nullptr || 310 params->callerKeyAlias == nullptr || params->genCallerKeyParamSet == nullptr || 311 params->callerKekAlias == nullptr || params->callerKek == nullptr || 312 params->importCallerKekParamSet == nullptr || params->callerAgreeKeyAlias == nullptr || 313 params->agreeParamSet == nullptr || params->importWrappedKeyParamSet == nullptr || 314 params->importedKeyAlias == nullptr || params->importedPlainKey == nullptr) { 315 ret.errorCode = OH_HUKS_ERR_CODE_ILLEGAL_ARGUMENT; 316 return ret; 317 } 318 return ret; 319} 320static OH_Huks_Result GenerateAndExportHuksPublicKey(const struct HksImportWrappedKeyTestParams *params, 321 struct OH_Huks_Blob *huksPublicKey) { 322 OH_Huks_Result ret = OH_Huks_GenerateKeyItem(params->wrappingKeyAlias, params->genWrappingKeyParamSet, nullptr); 323 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 324 return ret; 325 } 326 huksPublicKey->size = params->publicKeySize; 327 ret = MallocAndCheckBlobData(huksPublicKey, huksPublicKey->size); 328 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 329 return ret; 330 } 331 ret = OH_Huks_ExportPublicKeyItem(params->wrappingKeyAlias, nullptr, huksPublicKey); 332 return ret; 333} 334static OH_Huks_Result GenerateAndExportCallerPublicKey(const struct HksImportWrappedKeyTestParams *params, 335 struct OH_Huks_Blob *callerSelfPublicKey) { 336 OH_Huks_Result ret = OH_Huks_GenerateKeyItem(params->callerKeyAlias, params->genCallerKeyParamSet, nullptr); 337 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 338 return ret; 339 } 340 callerSelfPublicKey->size = params->publicKeySize; 341 ret = MallocAndCheckBlobData(callerSelfPublicKey, callerSelfPublicKey->size); 342 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 343 return ret; 344 } 345 ret = OH_Huks_ExportPublicKeyItem(params->callerKeyAlias, params->genWrappingKeyParamSet, callerSelfPublicKey); 346 return ret; 347} 348static OH_Huks_Result ImportKekAndAgreeSharedSecret(const struct HksImportWrappedKeyTestParams *params, 349 const struct OH_Huks_Blob *huksPublicKey, 350 struct OH_Huks_Blob *outSharedKey) { 351 OH_Huks_Result ret = 352 OH_Huks_ImportKeyItem(params->callerKekAlias, params->importCallerKekParamSet, params->callerKek); 353 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 354 return ret; 355 } 356 ret = MallocAndCheckBlobData(outSharedKey, outSharedKey->size); 357 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 358 return ret; 359 } 360 ret = HuksAgreeKey(params->agreeParamSet, params->callerKeyAlias, huksPublicKey, outSharedKey); 361 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 362 return ret; 363 } 364 struct OH_Huks_ParamSet *importAgreeKeyParams = nullptr; 365 ret = InitParamSet(&importAgreeKeyParams, g_importAgreeKeyParams, 366 sizeof(g_importAgreeKeyParams) / sizeof(OH_Huks_Param)); 367 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 368 return ret; 369 } 370 ret = OH_Huks_ImportKeyItem(params->callerAgreeKeyAlias, importAgreeKeyParams, outSharedKey); 371 OH_Huks_FreeParamSet(&importAgreeKeyParams); 372 return ret; 373} 374static OH_Huks_Result EncryptImportedPlainKeyAndKek(const struct HksImportWrappedKeyTestParams *params, 375 struct OH_Huks_Blob *plainCipherText, 376 struct OH_Huks_Blob *kekCipherText) { 377 struct OH_Huks_ParamSet *encryptParamSet = nullptr; 378 OH_Huks_Result ret = 379 InitParamSet(&encryptParamSet, g_aesKekEncryptParams, sizeof(g_aesKekEncryptParams) / sizeof(OH_Huks_Param)); 380 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 381 return ret; 382 } 383 ret = HuksEncrypt(params->callerKekAlias, encryptParamSet, params->importedPlainKey, plainCipherText); 384 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 385 return ret; 386 } 387 ret = HuksEncrypt(params->callerAgreeKeyAlias, encryptParamSet, params->callerKek, kekCipherText); 388 OH_Huks_FreeParamSet(&encryptParamSet); 389 return ret; 390} 391static OH_Huks_Result ImportWrappedKey(const struct HksImportWrappedKeyTestParams *params, 392 struct OH_Huks_Blob *plainCipher, struct OH_Huks_Blob *kekCipherText, 393 struct OH_Huks_Blob *peerPublicKey, struct OH_Huks_Blob *wrappedKeyData) { 394 struct OH_Huks_Blob commonAad = {.size = AAD_SIZE, .data = reinterpret_cast<uint8_t *>(AAD)}; 395 struct OH_Huks_Blob commonNonce = {.size = NONCE_SIZE, .data = reinterpret_cast<uint8_t *>(NONCE)}; 396 struct OH_Huks_Blob keyMaterialLen = {.size = sizeof(uint32_t), .data = (uint8_t *)¶ms->keyMaterialLen}; 397 /* 从密文中拷贝AEAD的tag并缩小其大小 */ 398 const uint32_t tagSize = AEAD_TAG_SIZE; 399 uint8_t kekTagBuf[tagSize] = {0}; 400 struct OH_Huks_Blob kekTag = {.size = tagSize, .data = kekTagBuf}; 401 std::copy(plainCipher->data + (plainCipher->size - tagSize), 402 plainCipher->data + (plainCipher->size - tagSize) + tagSize, kekTag.data); 403 plainCipher->size -= tagSize; 404 /* 从密钥加密密钥的密文中拷贝AEAD的tag并缩小其大小 */ 405 uint8_t agreeKeyTagBuf[tagSize] = {0}; 406 struct OH_Huks_Blob agreeKeyTag = {.size = tagSize, .data = agreeKeyTagBuf}; 407 std::copy(kekCipherText->data + (kekCipherText->size - tagSize), 408 kekCipherText->data + (kekCipherText->size - tagSize) + tagSize, agreeKeyTagBuf); 409 kekCipherText->size -= tagSize; 410 struct OH_Huks_Blob *blobArray[] = {peerPublicKey, &commonAad, &commonNonce, &agreeKeyTag, kekCipherText, 411 &commonAad, &commonNonce, &kekTag, &keyMaterialLen, plainCipher}; 412 OH_Huks_Result ret = BuildWrappedKeyData(blobArray, OH_HUKS_IMPORT_WRAPPED_KEY_TOTAL_BLOBS, wrappedKeyData); 413 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 414 return ret; 415 } 416 struct OH_Huks_Param *purpose = nullptr; 417 ret = OH_Huks_GetParam(params->importWrappedKeyParamSet, OH_HUKS_TAG_PURPOSE, &purpose); 418 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 419 return ret; 420 } 421 ret = OH_Huks_ImportWrappedKeyItem(params->importedKeyAlias, params->wrappingKeyAlias, 422 params->importWrappedKeyParamSet, wrappedKeyData); 423 return ret; 424} 425OH_Huks_Result HksImportWrappedKeyTestCommonCase(const struct HksImportWrappedKeyTestParams *params) { 426 OH_Huks_Result ret = CheckParamsValid(params); 427 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 428 return ret; 429 } 430 struct OH_Huks_Blob huksPublicKey = {0, nullptr}; 431 struct OH_Huks_Blob callerSelfPublicKey = {0, nullptr}; 432 struct OH_Huks_Blob outSharedKey = {.size = OH_HUKS_KEY_BYTES(OH_HUKS_AES_KEY_SIZE_256), .data = nullptr}; 433 struct OH_Huks_Blob wrappedKeyData = {0, nullptr}; 434 uint8_t plainKeyCipherBuffer[OH_HUKS_MAX_KEY_SIZE] = {0}; 435 struct OH_Huks_Blob plainCipherText = {OH_HUKS_MAX_KEY_SIZE, plainKeyCipherBuffer}; 436 uint8_t kekCipherTextBuffer[OH_HUKS_MAX_KEY_SIZE] = {0}; 437 struct OH_Huks_Blob kekCipherText = {OH_HUKS_MAX_KEY_SIZE, kekCipherTextBuffer}; 438 /* 模拟加密导入密钥场景，设备A为远端设备（导入设备），设备B为本端设备（被导入设备） */ 439 do { 440 /** 441 * 1.设备A将待导入密钥转换成HUKS密钥材料格式To_Import_Key（仅针对非对称密钥，若待导入密钥是对称密钥则可省略此步骤）， 442 * 本示例使用g_importedAes256PlainKey（对称密钥）作为模拟 443 */ 444 /* 2.设备B生成一个加密导入用途的、用于协商的非对称密钥对Wrapping_Key（公钥Wrapping_Pk，私钥Wrapping_Sk），其密钥用途设置为unwrap，导出Wrapping_Key公钥Wrapping_Pk存放在变量huksPublicKey中 445 */ 446 ret = GenerateAndExportHuksPublicKey(params, &huksPublicKey); 447 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 448 break; 449 } 450 /* 3.设备A使用和设备B同样的算法，生成一个加密导入用途的、用于协商的非对称密钥对Caller_Key（公钥Caller_Pk，私钥Caller_Sk），导出Caller_Key公钥Caller_Pk存放在变量callerSelfPublicKey中 451 */ 452 ret = GenerateAndExportCallerPublicKey(params, &callerSelfPublicKey); 453 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 454 break; 455 } 456 /** 457 * 4. 设备A生成一个对称密钥Caller_Kek，该密钥后续将用于加密To_Import_Key 458 * 5. 设备A基于Caller_Key的私钥Caller_Sk和设备B Wrapping_Key的公钥Wrapping_Pk，协商出Shared_Key 459 */ 460 ret = ImportKekAndAgreeSharedSecret(params, &huksPublicKey, &outSharedKey); 461 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 462 break; 463 } 464 /** 465 * 6. 设备A使用Caller_Kek加密To_Import_Key，生成To_Import_Key_Enc 466 * 7. 设备A使用Shared_Key加密Caller_Kek，生成Caller_Kek_Enc 467 */ 468 ret = EncryptImportedPlainKeyAndKek(params, &plainCipherText, &kekCipherText); 469 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 470 break; 471 } 472 /* 8. 设备A封装Caller_Pk、To_Import_Key_Enc、Caller_Kek_Enc等加密导入的材料并发送给设备B。 473 * 本示例作为变量存放在callerSelfPublicKey，plainCipherText，kekCipherText 474 * 9. 设备B导入封装的加密密钥材料 475 */ 476 ret = ImportWrappedKey(params, &plainCipherText, &kekCipherText, &callerSelfPublicKey, &wrappedKeyData); 477 } while (0); 478 /* 10. 设备A、B删除用于加密导入的密钥 */ 479 HUKS_FREE_BLOB(huksPublicKey); 480 HUKS_FREE_BLOB(callerSelfPublicKey); 481 HUKS_FREE_BLOB(outSharedKey); 482 HUKS_FREE_BLOB(wrappedKeyData); 483 return ret; 484} 485void HksClearKeysForWrappedKeyTest(const struct HksImportWrappedKeyTestParams *params) { 486 OH_Huks_Result ret = CheckParamsValid(params); 487 if (ret.errorCode != (int32_t)OH_HUKS_SUCCESS) { 488 return; 489 } 490 (void)OH_Huks_DeleteKeyItem(params->wrappingKeyAlias, nullptr); 491 (void)OH_Huks_DeleteKeyItem(params->callerKeyAlias, nullptr); 492 (void)OH_Huks_DeleteKeyItem(params->callerKekAlias, nullptr); 493 (void)OH_Huks_DeleteKeyItem(params->callerAgreeKeyAlias, nullptr); 494 (void)OH_Huks_DeleteKeyItem(params->importedKeyAlias, nullptr); 495} 496static OH_Huks_Result InitCommonTestParamsAndDoImport(struct HksImportWrappedKeyTestParams *importWrappedKeyTestParams, 497 const struct OH_Huks_Param *importedKeyParamSetArray, 498 uint32_t arraySize) { 499 struct OH_Huks_ParamSet *genX25519KeyParamSet = nullptr; 500 struct OH_Huks_ParamSet *genCallerKeyParamSet = nullptr; 501 struct OH_Huks_ParamSet *callerImportParamsKek = nullptr; 502 struct OH_Huks_ParamSet *agreeParamSet = nullptr; 503 struct OH_Huks_ParamSet *importPlainKeyParams = nullptr; 504 OH_Huks_Result ret; 505 do { 506 ret = InitParamSet(&genX25519KeyParamSet, g_genWrappingKeyParams, 507 sizeof(g_genWrappingKeyParams) / sizeof(OH_Huks_Param)); 508 if (ret.errorCode != OH_HUKS_SUCCESS) { 509 break; 510 } 511 importWrappedKeyTestParams->genWrappingKeyParamSet = genX25519KeyParamSet; 512 importWrappedKeyTestParams->publicKeySize = g_x25519PubKeySize; 513 ret = InitParamSet(&genCallerKeyParamSet, g_genCallerX25519Params, 514 sizeof(g_genCallerX25519Params) / sizeof(OH_Huks_Param)); 515 if (ret.errorCode != OH_HUKS_SUCCESS) { 516 break; 517 } 518 importWrappedKeyTestParams->genCallerKeyParamSet = genCallerKeyParamSet; 519 ret = InitParamSet(&callerImportParamsKek, g_importParamsCallerKek, 520 sizeof(g_importParamsCallerKek) / sizeof(OH_Huks_Param)); 521 if (ret.errorCode != OH_HUKS_SUCCESS) { 522 break; 523 } 524 importWrappedKeyTestParams->importCallerKekParamSet = callerImportParamsKek; 525 ret = InitParamSet(&agreeParamSet, g_callerAgreeParams, sizeof(g_callerAgreeParams) / sizeof(OH_Huks_Param)); 526 if (ret.errorCode != OH_HUKS_SUCCESS) { 527 break; 528 } 529 importWrappedKeyTestParams->agreeParamSet = agreeParamSet; 530 ret = InitParamSet(&importPlainKeyParams, importedKeyParamSetArray, arraySize); 531 if (ret.errorCode != OH_HUKS_SUCCESS) { 532 break; 533 } 534 importWrappedKeyTestParams->importWrappedKeyParamSet = importPlainKeyParams; 535 ret = HksImportWrappedKeyTestCommonCase(importWrappedKeyTestParams); 536 } while (0); 537 OH_Huks_FreeParamSet(&genX25519KeyParamSet); 538 OH_Huks_FreeParamSet(&genCallerKeyParamSet); 539 OH_Huks_FreeParamSet(&callerImportParamsKek); 540 OH_Huks_FreeParamSet(&agreeParamSet); 541 OH_Huks_FreeParamSet(&importPlainKeyParams); 542 return ret; 543} 544static napi_value ImportWrappedKey(napi_env env, napi_callback_info info) { 545 struct HksImportWrappedKeyTestParams importWrappedKeyTestParams001 = {0}; 546 importWrappedKeyTestParams001.wrappingKeyAlias = &g_wrappingKeyAliasAes256; 547 importWrappedKeyTestParams001.keyMaterialLen = g_importedAes256PlainKey.size; 548 importWrappedKeyTestParams001.callerKeyAlias = &g_callerKeyAliasAes256; 549 importWrappedKeyTestParams001.callerKekAlias = &g_callerKekAliasAes256; 550 importWrappedKeyTestParams001.callerKek = &g_callerAes256Kek; 551 importWrappedKeyTestParams001.callerAgreeKeyAlias = &g_callerAgreeKeyAliasAes256; 552 importWrappedKeyTestParams001.importedKeyAlias = &g_importedKeyAliasAes256; 553 importWrappedKeyTestParams001.importedPlainKey = &g_importedAes256PlainKey; 554 OH_Huks_Result ohResult = 555 InitCommonTestParamsAndDoImport(&importWrappedKeyTestParams001, g_importWrappedAes256Params, 556 sizeof(g_importWrappedAes256Params) / sizeof(struct OH_Huks_Param)); 557 HksClearKeysForWrappedKeyTest(&importWrappedKeyTestParams001); 558 napi_value ret; 559 napi_create_int32(env, ohResult.errorCode, &ret); 560 return ret; 561} 562``` 563 564 565## 调测验证 566 567调用[OH_Huks_IsKeyItemExist](../../reference/apis-universal-keystore-kit/_huks_key_api.md#oh_huks_iskeyitemexist)验证密钥是否存在，如密钥存在即表示密钥导入成功。 568 569```c++ 570#include "huks/native_huks_api.h" 571#include "huks/native_huks_param.h" 572#include <string.h> 573static napi_value IsKeyExist(napi_env env, napi_callback_info info) 574{ 575 /* 1.指定密钥别名 */ 576 struct OH_Huks_Blob keyAlias = { 577 (uint32_t)strlen("test_key"), 578 (uint8_t *)"test_key" 579 }; 580 581 /* 2.调用OH_Huks_IsKeyItemExist判断密钥是否存在 */ 582 struct OH_Huks_Result ohResult = OH_Huks_IsKeyItemExist(&keyAlias, NULL); 583 if (ohResult.errorCode != OH_HUKS_SUCCESS) { 584 // 失败 585 } else { 586 // 成功 587 } 588} 589``` 590