ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <config.h>

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#if defined(PKCS11CRYPTO) && defined(HAVE_PKCS11_ECDSA)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <isc/entropy.h>

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <isc/mem.h>

699f790c49d03a9ef3c3234a72d272bb469203e8Evan Hunt#include <isc/safe.h>

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <isc/sha2.h>

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <isc/string.h>

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <isc/util.h>

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dns/keyvalues.h>

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dst/result.h>

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include "dst_internal.h"

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include "dst_parse.h"

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include "dst_pkcs11.h"

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt#include <pk11/pk11.h>

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt#include <pk11/internal.h>

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#define WANT_ECC_CURVES

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt#include <pk11/constants.h>

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <pkcs11/pkcs11.h>

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#define TAG_OCTECT_STRING 0x04

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#define UNCOMPRESSED 0x04

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#define DST_RET(a) {ret = a; goto err;}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic CK_BBOOL truevalue = TRUE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic CK_BBOOL falsevalue = FALSE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t pkcs11ecdsa_todns(const dst_key_t *key,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_t *data);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void pkcs11ecdsa_destroy(dst_key_t *key);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t pkcs11ecdsa_fetch(dst_key_t *key, const char *engine,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt const char *label, dst_key_t *pub);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_createctx(dst_key_t *key, dst_context_t *dctx) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_RV rv;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_MECHANISM mech = {0, NULL, 0 };

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_SLOT_ID slotid;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_context_t *pk11_ctx;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec = key->keydata.pkey;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t ret;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(dctx->key->key_alg == DST_ALG_ECDSA256 ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dctx->key->key_alg == DST_ALG_ECDSA384);

f5c17a057fc5974bb51d7bc8c5827a7fd6dc9aeeEvan Hunt REQUIRE(ec != NULL);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (dctx->key->key_alg == DST_ALG_ECDSA256)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt mech.mechanism = CKM_SHA256;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt else

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt mech.mechanism = CKM_SHA384;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_ctx = (pk11_context_t *) isc_mem_get(dctx->mctx,

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (pk11_ctx == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(pk11_ctx, 0, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec->ontoken && (dctx->use == DO_SIGN))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt slotid = ec->slot;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt else

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt slotid = pk11_get_best_token(OP_EC);

f5c17a057fc5974bb51d7bc8c5827a7fd6dc9aeeEvan Hunt ret = pk11_get_session(pk11_ctx, OP_EC, ISC_TRUE, ISC_FALSE,

f5c17a057fc5974bb51d7bc8c5827a7fd6dc9aeeEvan Hunt ec->reqlogon, NULL, slotid);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ret != ISC_R_SUCCESS)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto err;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_DigestInit, (pk11_ctx->session, &mech), ISC_R_FAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dctx->ctxdata.pk11_ctx = pk11_ctx;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_SUCCESS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt err:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_return_session(pk11_ctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(pk11_ctx, 0, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ret);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_destroyctx(dst_context_t *dctx) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_BYTE garbage[ISC_SHA384_DIGESTLENGTH];

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ULONG len = ISC_SHA384_DIGESTLENGTH;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(dctx->key->key_alg == DST_ALG_ECDSA256 ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dctx->key->key_alg == DST_ALG_ECDSA384);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (pk11_ctx != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (void) pkcs_C_DigestFinal(pk11_ctx->session, garbage, &len);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(garbage, 0, sizeof(garbage));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_return_session(pk11_ctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(pk11_ctx, 0, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dctx->ctxdata.pk11_ctx = NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_adddata(dst_context_t *dctx, const isc_region_t *data) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_RV rv;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t ret = ISC_R_SUCCESS;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(dctx->key->key_alg == DST_ALG_ECDSA256 ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dctx->key->key_alg == DST_ALG_ECDSA384);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_CALL(pkcs_C_DigestUpdate,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (CK_BYTE_PTR) data->base,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (CK_ULONG) data->length),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ISC_R_FAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ret);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_RV rv;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_MECHANISM mech = { CKM_ECDSA, NULL, 0 };

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_OBJECT_CLASS keyClass = CKO_PRIVATE_KEY;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_KEY_TYPE keyType = CKK_EC;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE keyTemplate[] =

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_CLASS, &keyClass, (CK_ULONG) sizeof(keyClass) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_SIGN, &truevalue, (CK_ULONG) sizeof(truevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_EC_PARAMS, NULL, 0 },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_VALUE, NULL, 0 }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt };

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *attr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_BYTE digest[ISC_SHA384_DIGESTLENGTH];

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ULONG dgstlen;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ULONG siglen;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_key_t *key = dctx->key;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec = key->keydata.pkey;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_region_t r;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t ret = ISC_R_SUCCESS;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned int i;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->key_alg == DST_ALG_ECDSA384);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(ec != NULL);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->key_alg == DST_ALG_ECDSA256) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dgstlen = ISC_SHA256_DIGESTLENGTH;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt siglen = DNS_SIG_ECDSA256SIZE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt siglen = DNS_SIG_ECDSA384SIZE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dgstlen = ISC_SHA384_DIGESTLENGTH;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_DigestFinal,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, digest, &dgstlen),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ISC_R_FAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_availableregion(sig, &r);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (r.length < siglen)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOSPACE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec->ontoken && (ec->object != CK_INVALID_HANDLE)) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_ctx->ontoken = ec->ontoken;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_ctx->object = ec->object;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto token_key;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt for (attr = pk11_attribute_first(ec);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr != NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = pk11_attribute_next(ec, attr))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt switch (attr->type) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case CKA_EC_PARAMS:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(keyTemplate[5].type == attr->type);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[5].pValue = isc_mem_get(dctx->mctx,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (keyTemplate[5].pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(keyTemplate[5].pValue, attr->pValue,

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[5].ulValueLen = attr->ulValueLen;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt break;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case CKA_VALUE:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(keyTemplate[6].type == attr->type);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[6].pValue = isc_mem_get(dctx->mctx,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (keyTemplate[6].pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(keyTemplate[6].pValue, attr->pValue,

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[6].ulValueLen = attr->ulValueLen;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt break;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_ctx->object = CK_INVALID_HANDLE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_ctx->ontoken = ISC_FALSE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_CreateObject,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate, (CK_ULONG) 7,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &hKey),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ISC_R_FAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt token_key:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_SignInit,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, &mech,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_ctx->ontoken ? pk11_ctx->object : hKey),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ISC_R_FAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_Sign,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt digest, dgstlen,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (CK_BYTE_PTR) r.base, &siglen),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_SIGNFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_add(sig, (unsigned int) siglen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt err:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (hKey != CK_INVALID_HANDLE)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (void) pkcs_C_DestroyObject(pk11_ctx->session, hKey);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt for (i = 5; i <= 6; i++)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (keyTemplate[i].pValue != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(keyTemplate[i].pValue, 0,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[i].ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(dctx->mctx,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[i].pValue,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[i].ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_return_session(pk11_ctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(pk11_ctx, 0, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dctx->ctxdata.pk11_ctx = NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ret);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_RV rv;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_MECHANISM mech = { CKM_ECDSA, NULL, 0 };

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_OBJECT_CLASS keyClass = CKO_PUBLIC_KEY;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_KEY_TYPE keyType = CKK_EC;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE keyTemplate[] =

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_CLASS, &keyClass, (CK_ULONG) sizeof(keyClass) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_VERIFY, &truevalue, (CK_ULONG) sizeof(truevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_EC_PARAMS, NULL, 0 },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_EC_POINT, NULL, 0 }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt };

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *attr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_BYTE digest[ISC_SHA384_DIGESTLENGTH];

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ULONG dgstlen;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_key_t *key = dctx->key;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec = key->keydata.pkey;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t ret = ISC_R_SUCCESS;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned int i;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->key_alg == DST_ALG_ECDSA384);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(ec != NULL);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->key_alg == DST_ALG_ECDSA256)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dgstlen = ISC_SHA256_DIGESTLENGTH;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt else

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dgstlen = ISC_SHA384_DIGESTLENGTH;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_DigestFinal,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, digest, &dgstlen),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ISC_R_FAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt for (attr = pk11_attribute_first(ec);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr != NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = pk11_attribute_next(ec, attr))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt switch (attr->type) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case CKA_EC_PARAMS:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(keyTemplate[5].type == attr->type);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[5].pValue = isc_mem_get(dctx->mctx,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (keyTemplate[5].pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(keyTemplate[5].pValue, attr->pValue,

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[5].ulValueLen = attr->ulValueLen;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt break;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case CKA_EC_POINT:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(keyTemplate[6].type == attr->type);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[6].pValue = isc_mem_get(dctx->mctx,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (keyTemplate[6].pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(keyTemplate[6].pValue, attr->pValue,

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[6].ulValueLen = attr->ulValueLen;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt break;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_ctx->object = CK_INVALID_HANDLE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_ctx->ontoken = ISC_FALSE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_CreateObject,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate, (CK_ULONG) 7,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &hKey),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ISC_R_FAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_VerifyInit,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, &mech, hKey),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ISC_R_FAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_Verify,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt digest, dgstlen,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (CK_BYTE_PTR) sig->base, (CK_ULONG) sig->length),

f5c17a057fc5974bb51d7bc8c5827a7fd6dc9aeeEvan Hunt DST_R_VERIFYFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt err:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (hKey != CK_INVALID_HANDLE)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (void) pkcs_C_DestroyObject(pk11_ctx->session, hKey);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt for (i = 5; i <= 6; i++)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (keyTemplate[i].pValue != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(keyTemplate[i].pValue, 0,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[i].ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(dctx->mctx,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[i].pValue,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyTemplate[i].ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_return_session(pk11_ctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(pk11_ctx, 0, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dctx->ctxdata.pk11_ctx = NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ret);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_boolean_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec1, *ec2;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *attr1, *attr2;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec1 = key1->keydata.pkey;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec2 = key2->keydata.pkey;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if ((ec1 == NULL) && (ec2 == NULL))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_TRUE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt else if ((ec1 == NULL) || (ec2 == NULL))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_FALSE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr1 = pk11_attribute_bytype(ec1, CKA_EC_PARAMS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr2 = pk11_attribute_bytype(ec2, CKA_EC_PARAMS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if ((attr1 == NULL) && (attr2 == NULL))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_TRUE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt else if ((attr1 == NULL) || (attr2 == NULL) ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (attr1->ulValueLen != attr2->ulValueLen) ||

420a43c8d8028992a4e9c170022f97bfac689025Evan Hunt !isc_safe_memequal(attr1->pValue, attr2->pValue,

420a43c8d8028992a4e9c170022f97bfac689025Evan Hunt attr1->ulValueLen))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_FALSE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr1 = pk11_attribute_bytype(ec1, CKA_EC_POINT);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr2 = pk11_attribute_bytype(ec2, CKA_EC_POINT);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if ((attr1 == NULL) && (attr2 == NULL))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_TRUE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt else if ((attr1 == NULL) || (attr2 == NULL) ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (attr1->ulValueLen != attr2->ulValueLen) ||

420a43c8d8028992a4e9c170022f97bfac689025Evan Hunt !isc_safe_memequal(attr1->pValue, attr2->pValue,

420a43c8d8028992a4e9c170022f97bfac689025Evan Hunt attr1->ulValueLen))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_FALSE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr1 = pk11_attribute_bytype(ec1, CKA_VALUE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr2 = pk11_attribute_bytype(ec2, CKA_VALUE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (((attr1 != NULL) || (attr2 != NULL)) &&

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ((attr1 == NULL) || (attr2 == NULL) ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (attr1->ulValueLen != attr2->ulValueLen) ||

420a43c8d8028992a4e9c170022f97bfac689025Evan Hunt !isc_safe_memequal(attr1->pValue, attr2->pValue,

420a43c8d8028992a4e9c170022f97bfac689025Evan Hunt attr1->ulValueLen)))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_FALSE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (!ec1->ontoken && !ec2->ontoken)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_TRUE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt else if (ec1->ontoken || ec2->ontoken ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (ec1->object != ec2->object))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_FALSE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_TRUE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#define SETCURVE() \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->key_alg == DST_ALG_ECDSA256) { \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue = isc_mem_get(key->mctx, \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt sizeof(pk11_ecc_prime256v1)); \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue == NULL) \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY); \

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(attr->pValue, \

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt pk11_ecc_prime256v1, sizeof(pk11_ecc_prime256v1)); \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen = sizeof(pk11_ecc_prime256v1); \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else { \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue = isc_mem_get(key->mctx, \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt sizeof(pk11_ecc_secp384r1)); \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue == NULL) \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY); \

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(attr->pValue, \

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt pk11_ecc_secp384r1, sizeof(pk11_ecc_secp384r1)); \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen = sizeof(pk11_ecc_secp384r1); \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#define FREECURVE() \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue != NULL) { \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(attr->pValue, 0, attr->ulValueLen); \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(key->mctx, attr->pValue, attr->ulValueLen); \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue = NULL; \

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_RV rv;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_MECHANISM mech = { CKM_EC_KEY_PAIR_GEN, NULL, 0 };

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_OBJECT_HANDLE pub = CK_INVALID_HANDLE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_OBJECT_CLASS pubClass = CKO_PUBLIC_KEY;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_KEY_TYPE keyType = CKK_EC;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE pubTemplate[] =

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_CLASS, &pubClass, (CK_ULONG) sizeof(pubClass) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_VERIFY, &truevalue, (CK_ULONG) sizeof(truevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_EC_PARAMS, NULL, 0 }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt };

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_OBJECT_HANDLE priv = CK_INVALID_HANDLE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_OBJECT_HANDLE privClass = CKO_PRIVATE_KEY;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE privTemplate[] =

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_CLASS, &privClass, (CK_ULONG) sizeof(privClass) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_SENSITIVE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_EXTRACTABLE, &truevalue, (CK_ULONG) sizeof(truevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_SIGN, &truevalue, (CK_ULONG) sizeof(truevalue) }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt };

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *attr;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_context_t *pk11_ctx;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t ret;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->key_alg == DST_ALG_ECDSA384);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNUSED(unused);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNUSED(callback);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_ctx = (pk11_context_t *) isc_mem_get(key->mctx,

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (pk11_ctx == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_NOMEMORY);

acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt ret = pk11_get_session(pk11_ctx, OP_EC, ISC_TRUE, ISC_FALSE,

acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt ISC_FALSE, NULL, pk11_get_best_token(OP_EC));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ret != ISC_R_SUCCESS)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto err;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt ec = (pk11_object_t *) isc_mem_get(key->mctx, sizeof(*ec));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(ec, 0, sizeof(*ec));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->keydata.pkey = ec;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->repr = (CK_ATTRIBUTE *) isc_mem_get(key->mctx, sizeof(*attr) * 3);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec->repr == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(ec->repr, 0, sizeof(*attr) * 3);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->attrcnt = 3;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = ec->repr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr[0].type = CKA_EC_PARAMS;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr[1].type = CKA_EC_POINT;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr[2].type = CKA_VALUE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = &pubTemplate[5];

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt SETCURVE();

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_GenerateKeyPair,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, &mech,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pubTemplate, (CK_ULONG) 6,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt privTemplate, (CK_ULONG) 7,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &pub, &priv),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = &pubTemplate[5];

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt FREECURVE();

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = ec->repr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt SETCURVE();

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr++;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_GetAttributeValue,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, pub, attr, 1),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue = isc_mem_get(key->mctx, attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(attr->pValue, 0, attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_GetAttributeValue,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, pub, attr, 1),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr++;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_GetAttributeValue,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, priv, attr, 1),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue = isc_mem_get(key->mctx, attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(attr->pValue, 0, attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_GetAttributeValue,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, priv, attr, 1),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (void) pkcs_C_DestroyObject(pk11_ctx->session, priv);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (void) pkcs_C_DestroyObject(pk11_ctx->session, pub);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_return_session(pk11_ctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(pk11_ctx, 0, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews if (key->key_alg == DST_ALG_ECDSA256)

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews key->key_size = DNS_KEY_ECDSA256SIZE * 4;

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews else

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews key->key_size = DNS_KEY_ECDSA384SIZE * 4;

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_SUCCESS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt err:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pkcs11ecdsa_destroy(key);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (priv != CK_INVALID_HANDLE)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (void) pkcs_C_DestroyObject(pk11_ctx->session, priv);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (pub != CK_INVALID_HANDLE)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (void) pkcs_C_DestroyObject(pk11_ctx->session, pub);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_return_session(pk11_ctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(pk11_ctx, 0, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ret);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_boolean_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_isprivate(const dst_key_t *key) {

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec = key->keydata.pkey;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *attr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_FALSE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = pk11_attribute_bytype(ec, CKA_VALUE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_TF((attr != NULL) || ec->ontoken));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_destroy(dst_key_t *key) {

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec = key->keydata.pkey;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *attr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST((ec->object == CK_INVALID_HANDLE) || ec->ontoken);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt for (attr = pk11_attribute_first(ec);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr != NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = pk11_attribute_next(ec, attr))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt switch (attr->type) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case CKA_LABEL:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case CKA_ID:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case CKA_EC_PARAMS:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case CKA_EC_POINT:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case CKA_VALUE:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt FREECURVE();

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt break;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec->repr != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(ec->repr, 0, ec->attrcnt * sizeof(*attr));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(key->mctx,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->repr,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->attrcnt * sizeof(*attr));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(ec, 0, sizeof(*ec));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(key->mctx, ec, sizeof(*ec));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->keydata.pkey = NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_region_t r;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned int len;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *attr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(key->keydata.pkey != NULL);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->key_alg == DST_ALG_ECDSA256)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt len = DNS_KEY_ECDSA256SIZE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt else

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt len = DNS_KEY_ECDSA384SIZE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec = key->keydata.pkey;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = pk11_attribute_bytype(ec, CKA_EC_POINT);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if ((attr == NULL) ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (attr->ulValueLen != len + 3) ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (((CK_BYTE_PTR) attr->pValue)[0] != TAG_OCTECT_STRING) ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (((CK_BYTE_PTR) attr->pValue)[1] != len + 1) ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (((CK_BYTE_PTR) attr->pValue)[2] != UNCOMPRESSED))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_FAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_availableregion(data, &r);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (r.length < len)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_NOSPACE);

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(r.base, (CK_BYTE_PTR) attr->pValue + 3, len);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_add(data, len);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_SUCCESS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_region_t r;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned int len;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *attr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->key_alg == DST_ALG_ECDSA384);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->key_alg == DST_ALG_ECDSA256)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt len = DNS_KEY_ECDSA256SIZE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt else

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt len = DNS_KEY_ECDSA384SIZE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_remainingregion(data, &r);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (r.length == 0)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_SUCCESS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (r.length != len)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (DST_R_INVALIDPUBLICKEY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt ec = (pk11_object_t *) isc_mem_get(key->mctx, sizeof(*ec));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(ec, 0, sizeof(*ec));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->repr = (CK_ATTRIBUTE *) isc_mem_get(key->mctx, sizeof(*attr) * 2);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec->repr == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto nomemory;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->attrcnt = 2;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = ec->repr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->type = CKA_EC_PARAMS;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->key_alg == DST_ALG_ECDSA256) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue =

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_get(key->mctx, sizeof(pk11_ecc_prime256v1));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto nomemory;

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(attr->pValue,

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt pk11_ecc_prime256v1, sizeof(pk11_ecc_prime256v1));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen = sizeof(pk11_ecc_prime256v1);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue =

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_get(key->mctx, sizeof(pk11_ecc_secp384r1));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto nomemory;

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(attr->pValue,

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt pk11_ecc_secp384r1, sizeof(pk11_ecc_secp384r1));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen = sizeof(pk11_ecc_secp384r1);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr++;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->type = CKA_EC_POINT;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue = isc_mem_get(key->mctx, len + 3);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto nomemory;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ((CK_BYTE_PTR) attr->pValue)[0] = TAG_OCTECT_STRING;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ((CK_BYTE_PTR) attr->pValue)[1] = len + 1;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ((CK_BYTE_PTR) attr->pValue)[2] = UNCOMPRESSED;

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove((CK_BYTE_PTR) attr->pValue + 3, r.base, len);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen = len + 3;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_forward(data, len);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->keydata.pkey = ec;

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews key->key_size = len * 4;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_SUCCESS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt nomemory:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt for (attr = pk11_attribute_first(ec);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr != NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = pk11_attribute_next(ec, attr))

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt switch (attr->type) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case CKA_EC_PARAMS:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case CKA_EC_POINT:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt FREECURVE();

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt break;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec->repr != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(ec->repr, 0, ec->attrcnt * sizeof(*attr));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(key->mctx,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->repr,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->attrcnt * sizeof(*attr));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(ec, 0, sizeof(*ec));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(key->mctx, ec, sizeof(*ec));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_tofile(const dst_key_t *key, const char *directory) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t ret;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_private_t priv;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned char *buf = NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned int i = 0;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *attr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->keydata.pkey == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (DST_R_NULLKEY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

6972eaffdbb7bb83c1b8565adfc6778430f80c8cFrancis Dupont if (key->external) {

6972eaffdbb7bb83c1b8565adfc6778430f80c8cFrancis Dupont priv.nelements = 0;

12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt return (dst__privstruct_writefile(key, &priv, directory));

6972eaffdbb7bb83c1b8565adfc6778430f80c8cFrancis Dupont }

6972eaffdbb7bb83c1b8565adfc6778430f80c8cFrancis Dupont

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec = key->keydata.pkey;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = pk11_attribute_bytype(ec, CKA_VALUE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt buf = isc_mem_get(key->mctx, attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (buf == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt priv.elements[i].tag = TAG_ECDSA_PRIVATEKEY;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt priv.elements[i].length = (unsigned short) attr->ulValueLen;

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(buf, attr->pValue, attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt priv.elements[i].data = buf;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt i++;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->engine != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt priv.elements[i].tag = TAG_ECDSA_ENGINE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt priv.elements[i].length = strlen(key->engine) + 1;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt priv.elements[i].data = (unsigned char *)key->engine;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt i++;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->label != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt priv.elements[i].tag = TAG_ECDSA_LABEL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt priv.elements[i].length = strlen(key->label) + 1;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt priv.elements[i].data = (unsigned char *)key->label;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt i++;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt priv.nelements = i;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ret = dst__privstruct_writefile(key, &priv, directory);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (buf != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(buf, 0, attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(key->mctx, buf, attr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ret);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_fetch(dst_key_t *key, const char *engine, const char *label,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_key_t *pub)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt{

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_RV rv;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_OBJECT_CLASS keyClass = CKO_PRIVATE_KEY;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_KEY_TYPE keyType = CKK_EC;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE searchTemplate[] =

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_CLASS, &keyClass, (CK_ULONG) sizeof(keyClass) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_TOKEN, &truevalue, (CK_ULONG) sizeof(truevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_LABEL, NULL, 0 }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt };

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ULONG cnt;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *attr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *pubattr;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *pubec;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_context_t *pk11_ctx = NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t ret;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (label == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (DST_R_NOENGINE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec = key->keydata.pkey;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pubec = pub->keydata.pkey;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->object = CK_INVALID_HANDLE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->ontoken = ISC_TRUE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->reqlogon = ISC_TRUE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->repr = (CK_ATTRIBUTE *) isc_mem_get(key->mctx, sizeof(*attr) * 2);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec->repr == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(ec->repr, 0, sizeof(*attr) * 2);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->attrcnt = 2;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = ec->repr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->type = CKA_EC_PARAMS;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pubattr = pk11_attribute_bytype(pubec, CKA_EC_PARAMS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue = isc_mem_get(key->mctx, pubattr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(attr->pValue, pubattr->pValue, pubattr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen = pubattr->ulValueLen;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr++;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->type = CKA_EC_POINT;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pubattr = pk11_attribute_bytype(pubec, CKA_EC_POINT);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue = isc_mem_get(key->mctx, pubattr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(attr->pValue, pubattr->pValue, pubattr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen = pubattr->ulValueLen;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ret = pk11_parse_uri(ec, label, key->mctx, OP_EC);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ret != ISC_R_SUCCESS)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto err;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_ctx = (pk11_context_t *) isc_mem_get(key->mctx,

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (pk11_ctx == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt ret = pk11_get_session(pk11_ctx, OP_EC, ISC_TRUE, ISC_FALSE,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->reqlogon, NULL, ec->slot);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ret != ISC_R_SUCCESS)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto err;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = pk11_attribute_bytype(ec, CKA_LABEL);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr == NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = pk11_attribute_bytype(ec, CKA_ID);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(attr != NULL);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt searchTemplate[3].type = CKA_ID;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt searchTemplate[3].pValue = attr->pValue;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt searchTemplate[3].ulValueLen = attr->ulValueLen;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_FindObjectsInit,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, searchTemplate, (CK_ULONG) 4),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_FindObjects,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, &ec->object, (CK_ULONG) 1, &cnt),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (void) pkcs_C_FindObjectsFinal(pk11_ctx->session);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (cnt == 0)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOTFOUND);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (cnt > 1)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_EXISTS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (engine != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->engine = isc_mem_strdup(key->mctx, engine);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->engine == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->label = isc_mem_strdup(key->mctx, label);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->label == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_return_session(pk11_ctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(pk11_ctx, 0, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_SUCCESS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt err:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (pk11_ctx != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_return_session(pk11_ctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(pk11_ctx, 0, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ret);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_private_t priv;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t ret;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec = NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *attr, *pattr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_t *mctx = key->mctx;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned int i;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt const char *engine = NULL, *label = NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->key_alg == DST_ALG_ECDSA384);

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt if ((pub == NULL) || (pub->keydata.pkey == NULL))

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt DST_RET(DST_R_INVALIDPRIVATEKEY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /* read private key file */

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ret = dst__privstruct_parse(key, DST_ALG_ECDSA256, lexer, mctx, &priv);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ret != ISC_R_SUCCESS)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ret);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt if (key->external) {

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt if (priv.nelements != 0)

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt DST_RET(DST_R_INVALIDPRIVATEKEY);

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt key->keydata.pkey = pub->keydata.pkey;

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt pub->keydata.pkey = NULL;

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt key->key_size = pub->key_size;

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt dst__privstruct_free(&priv, mctx);

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt memset(&priv, 0, sizeof(priv));

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt return (ISC_R_SUCCESS);

3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt }

6972eaffdbb7bb83c1b8565adfc6778430f80c8cFrancis Dupont

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt for (i = 0; i < priv.nelements; i++) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt switch (priv.elements[i].tag) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case TAG_ECDSA_ENGINE:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt engine = (char *)priv.elements[i].data;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt break;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt case TAG_ECDSA_LABEL:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt label = (char *)priv.elements[i].data;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt break;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt default:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt break;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt ec = (pk11_object_t *) isc_mem_get(key->mctx, sizeof(*ec));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(ec, 0, sizeof(*ec));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->keydata.pkey = ec;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /* Is this key is stored in a HSM? See if we can fetch it. */

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if ((label != NULL) || (engine != NULL)) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ret = pkcs11ecdsa_fetch(key, engine, label, pub);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ret != ISC_R_SUCCESS)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto err;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst__privstruct_free(&priv, mctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(&priv, 0, sizeof(priv));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ret);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->repr = (CK_ATTRIBUTE *) isc_mem_get(key->mctx, sizeof(*attr) * 3);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec->repr == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(ec->repr, 0, sizeof(*attr) * 3);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->attrcnt = 3;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = ec->repr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->type = CKA_EC_PARAMS;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pattr = pk11_attribute_bytype(pub->keydata.pkey, CKA_EC_PARAMS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(pattr != NULL);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue = isc_mem_get(key->mctx, pattr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(attr->pValue, pattr->pValue, pattr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen = pattr->ulValueLen;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr++;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->type = CKA_EC_POINT;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pattr = pk11_attribute_bytype(pub->keydata.pkey, CKA_EC_POINT);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(pattr != NULL);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue = isc_mem_get(key->mctx, pattr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(attr->pValue, pattr->pValue, pattr->ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen = pattr->ulValueLen;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr++;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->type = CKA_VALUE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->pValue = isc_mem_get(key->mctx, priv.elements[0].length);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr->pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt memmove(attr->pValue, priv.elements[0].data, priv.elements[0].length);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr->ulValueLen = priv.elements[0].length;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst__privstruct_free(&priv, mctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(&priv, 0, sizeof(priv));

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews if (key->key_alg == DST_ALG_ECDSA256)

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews key->key_size = DNS_KEY_ECDSA256SIZE * 4;

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews else

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews key->key_size = DNS_KEY_ECDSA384SIZE * 4;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_SUCCESS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt err:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pkcs11ecdsa_destroy(key);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst__privstruct_free(&priv, mctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(&priv, 0, sizeof(priv));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ret);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic isc_result_t

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntpkcs11ecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt const char *pin)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt{

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_RV rv;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_OBJECT_CLASS keyClass = CKO_PUBLIC_KEY;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_KEY_TYPE keyType = CKK_EC;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE searchTemplate[] =

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_CLASS, &keyClass, (CK_ULONG) sizeof(keyClass) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_TOKEN, &truevalue, (CK_ULONG) sizeof(truevalue) },

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt { CKA_LABEL, NULL, 0 }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt };

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ULONG cnt;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt CK_ATTRIBUTE *attr;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_object_t *ec;

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_context_t *pk11_ctx = NULL;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t ret;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned int i;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNUSED(pin);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt ec = (pk11_object_t *) isc_mem_get(key->mctx, sizeof(*ec));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(ec, 0, sizeof(*ec));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->object = CK_INVALID_HANDLE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->ontoken = ISC_TRUE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->reqlogon = ISC_TRUE;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->keydata.pkey = ec;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->repr = (CK_ATTRIBUTE *) isc_mem_get(key->mctx, sizeof(*attr) * 2);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ec->repr == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(ec->repr, 0, sizeof(*attr) * 2);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->attrcnt = 2;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = ec->repr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr[0].type = CKA_EC_PARAMS;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr[1].type = CKA_EC_POINT;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ret = pk11_parse_uri(ec, label, key->mctx, OP_EC);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ret != ISC_R_SUCCESS)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto err;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt pk11_ctx = (pk11_context_t *) isc_mem_get(key->mctx,

dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (pk11_ctx == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt ret = pk11_get_session(pk11_ctx, OP_EC, ISC_TRUE, ISC_FALSE,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt ec->reqlogon, NULL, ec->slot);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (ret != ISC_R_SUCCESS)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto err;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = pk11_attribute_bytype(ec, CKA_LABEL);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr == NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = pk11_attribute_bytype(ec, CKA_ID);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(attr != NULL);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt searchTemplate[3].type = CKA_ID;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt searchTemplate[3].pValue = attr->pValue;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt searchTemplate[3].ulValueLen = attr->ulValueLen;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_FindObjectsInit,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, searchTemplate, (CK_ULONG) 4),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_FindObjects,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, &hKey, (CK_ULONG) 1, &cnt),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (void) pkcs_C_FindObjectsFinal(pk11_ctx->session);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (cnt == 0)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOTFOUND);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (cnt > 1)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_EXISTS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr = ec->repr;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_GetAttributeValue,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, hKey, attr, 2),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt for (i = 0; i <= 1; i++) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt attr[i].pValue = isc_mem_get(key->mctx, attr[i].ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (attr[i].pValue == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(attr[i].pValue, 0, attr[i].ulValueLen);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_GetAttributeValue,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, hKey, attr, 2),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt keyClass = CKO_PRIVATE_KEY;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_FindObjectsInit,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, searchTemplate, (CK_ULONG) 4),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt PK11_RET(pkcs_C_FindObjects,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (pk11_ctx->session, &ec->object, (CK_ULONG) 1, &cnt),

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_R_CRYPTOFAILURE);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (void) pkcs_C_FindObjectsFinal(pk11_ctx->session);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (cnt == 0)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOTFOUND);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (cnt > 1)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_EXISTS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (engine != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->engine = isc_mem_strdup(key->mctx, engine);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->engine == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key->label = isc_mem_strdup(key->mctx, label);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (key->label == NULL)

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DST_RET(ISC_R_NOMEMORY);

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews if (key->key_alg == DST_ALG_ECDSA256)

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews key->key_size = DNS_KEY_ECDSA256SIZE * 4;

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews else

80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews key->key_size = DNS_KEY_ECDSA384SIZE * 4;

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_return_session(pk11_ctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(pk11_ctx, 0, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_SUCCESS);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt err:

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pkcs11ecdsa_destroy(key);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (pk11_ctx != NULL) {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pk11_return_session(pk11_ctx);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt memset(pk11_ctx, 0, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ret);

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic dst_func_t pkcs11ecdsa_functions = {

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pkcs11ecdsa_createctx,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt NULL, /*%< createctx2 */

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pkcs11ecdsa_destroyctx,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pkcs11ecdsa_adddata,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pkcs11ecdsa_sign,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pkcs11ecdsa_verify,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt NULL, /*%< verify2 */

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt NULL, /*%< computesecret */

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt pkcs11ecdsa_compare,

ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt NULL, /*%< paramcompare */