cmd-crypto/pktool/genkeypair.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include <stdio.h>
#include <string.h>
#include <ctype.h>
#include <malloc.h>
#include <libgen.h>
#include <errno.h>
#include <cryptoutil.h>
#include <security/cryptoki.h>
#include "common.h"

#include <kmfapi.h>

#define SET_VALUE(f, s) \
    kmfrv = f; \
    if (kmfrv != KMF_OK) { \
        cryptoerror(LOG_STDERR, \
            gettext("Failed to set %s: 0x%02x\n"), \
            s, kmfrv); \
        goto cleanup; \
    }

KMF_RETURN
genkeypair_pkcs11(KMF_HANDLE_T kmfhandle,
    char *token, char *keylabel, KMF_KEY_ALG keyAlg,
    int keylen, KMF_CREDENTIAL *tokencred, KMF_OID *curveoid,
    KMF_KEY_HANDLE *outPriKey, KMF_KEY_HANDLE *outPubKey)
{
    KMF_RETURN kmfrv = KMF_OK;
    KMF_KEY_HANDLE pubk, prik;
    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN;
    KMF_ATTRIBUTE attrlist[16];
    int numattr = 0;
    KMF_KEY_ALG keytype;
    uint32_t keylength;

    keylength = keylen; /* bits */
    keytype = keyAlg;

    /* Select a PKCS11 token */
    kmfrv = select_token(kmfhandle, token, FALSE);
    if (kmfrv != KMF_OK)
        return (kmfrv);

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEYSTORE_TYPE_ATTR, &kstype,
        sizeof (kstype));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEYALG_ATTR, &keytype,
        sizeof (keytype));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEYLENGTH_ATTR, &keylength,
        sizeof (keylength));
    numattr++;

    if (keylabel != NULL) {
        kmf_set_attr_at_index(attrlist, numattr,
            KMF_KEYLABEL_ATTR, keylabel,
            strlen(keylabel));
        numattr++;
    }

    if (tokencred != NULL && tokencred->cred != NULL) {
        kmf_set_attr_at_index(attrlist, numattr,
            KMF_CREDENTIAL_ATTR, tokencred,
            sizeof (KMF_CREDENTIAL));
        numattr++;
    }

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_PRIVKEY_HANDLE_ATTR, &prik,
        sizeof (KMF_KEY_HANDLE));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_PUBKEY_HANDLE_ATTR, &pubk,
        sizeof (KMF_KEY_HANDLE));
    numattr++;

    if (keytype == KMF_ECDSA && curveoid != NULL) {
        kmf_set_attr_at_index(attrlist, numattr,
            KMF_ECC_CURVE_OID_ATTR, curveoid,
            sizeof (KMF_OID));
        numattr++;
    }

    kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist);
    if (kmfrv != KMF_OK) {
        return (kmfrv);
    }

cleanup:
    if (kmfrv == KMF_OK) {
        if (outPriKey != NULL)
            *outPriKey = prik;
        if (outPubKey != NULL)
            *outPubKey = pubk;
    }

    return (kmfrv);
}

KMF_RETURN
genkeypair_file(KMF_HANDLE_T kmfhandle,
    KMF_KEY_ALG keyAlg, int keylen, KMF_ENCODE_FORMAT fmt,
    char *outkey,
    KMF_KEY_HANDLE *outPriKey, KMF_KEY_HANDLE *outPubKey)
{
    KMF_RETURN kmfrv;
    KMF_KEY_HANDLE pubk, prik;
    char *fullkeypath = NULL;
    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL;
    KMF_ATTRIBUTE attrlist[10];
    int numattr = 0;
    KMF_KEY_ALG keytype;
    uint32_t keylength;
    KMF_ENCODE_FORMAT format;

    if (EMPTYSTRING(outkey)) {
        cryptoerror(LOG_STDERR,
            gettext("No output file was specified for "
            "the key\n"));
        return (PK_ERR_USAGE);
    }

    fullkeypath = strdup(outkey);
    if (verify_file(fullkeypath)) {
        cryptoerror(LOG_STDERR,
            gettext("Cannot write the indicated output "
            "key file (%s).\n"), fullkeypath);
        free(fullkeypath);
        return (PK_ERR_USAGE);
    }

    keylength = keylen; /* bits */
    keytype = keyAlg;
    format = fmt;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEYSTORE_TYPE_ATTR, &kstype,
        sizeof (kstype));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEYALG_ATTR, &keytype,
        sizeof (keytype));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEYLENGTH_ATTR, &keylength,
        sizeof (keylength));
    numattr++;

    if (fullkeypath != NULL) {
        kmf_set_attr_at_index(attrlist, numattr,
            KMF_KEY_FILENAME_ATTR, fullkeypath,
            strlen(fullkeypath));
        numattr++;
    }

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_ENCODE_FORMAT_ATTR, &format,
        sizeof (format));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_PRIVKEY_HANDLE_ATTR, &prik,
        sizeof (KMF_KEY_HANDLE));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_PUBKEY_HANDLE_ATTR, &pubk,
        sizeof (KMF_KEY_HANDLE));
    numattr++;

    kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist);
    if (kmfrv != KMF_OK) {
        goto cleanup;
    }

cleanup:
    if (fullkeypath != NULL)
        free(fullkeypath);

    if (kmfrv == KMF_OK) {
        if (outPriKey != NULL)
            *outPriKey = prik;
        if (outPubKey != NULL)
            *outPubKey = pubk;
    }

    return (kmfrv);
}

KMF_RETURN
genkeypair_nss(KMF_HANDLE_T kmfhandle,
    char *token,
    char *nickname, char *dir, char *prefix,
    KMF_KEY_ALG keyAlg,
    int keylen, KMF_CREDENTIAL *tokencred,
    KMF_OID *curveoid,
    KMF_KEY_HANDLE *outPriKey, KMF_KEY_HANDLE *outPubKey)
{
    KMF_RETURN kmfrv;
    KMF_KEY_HANDLE pubk, prik;
    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS;
    KMF_ATTRIBUTE attrlist[16];
    int numattr = 0;
    KMF_KEY_ALG keytype;
    uint32_t keylength;

    if (token == NULL)
        token = DEFAULT_NSS_TOKEN;

    kmfrv = configure_nss(kmfhandle, dir, prefix);
    if (kmfrv != KMF_OK)
        return (kmfrv);

    keylength = keylen; /* bits */
    keytype = keyAlg;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEYSTORE_TYPE_ATTR, &kstype,
        sizeof (kstype));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEYALG_ATTR, &keytype,
        sizeof (keytype));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEYLENGTH_ATTR, &keylength,
        sizeof (keylength));
    numattr++;

    if (nickname != NULL) {
        kmf_set_attr_at_index(attrlist, numattr,
            KMF_KEYLABEL_ATTR, nickname,
            strlen(nickname));
        numattr++;
    }

    if (tokencred != NULL && tokencred->cred != NULL) {
        kmf_set_attr_at_index(attrlist, numattr,
            KMF_CREDENTIAL_ATTR, tokencred,
            sizeof (KMF_CREDENTIAL));
        numattr++;
    }

    if (token != NULL) {
        kmf_set_attr_at_index(attrlist, numattr,
            KMF_TOKEN_LABEL_ATTR, token,
            strlen(token));
        numattr++;
    }

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_PRIVKEY_HANDLE_ATTR, &prik,
        sizeof (KMF_KEY_HANDLE));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_PUBKEY_HANDLE_ATTR, &pubk,
        sizeof (KMF_KEY_HANDLE));
    numattr++;

    if (keytype == KMF_ECDSA && curveoid != NULL) {
        kmf_set_attr_at_index(attrlist, numattr,
            KMF_ECC_CURVE_OID_ATTR, curveoid,
            sizeof (KMF_OID));
        numattr++;
    }

    kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist);
    if (kmfrv != KMF_OK) {
        return (kmfrv);
    }
cleanup:
    if (kmfrv == KMF_OK) {
        if (outPriKey != NULL)
            *outPriKey = prik;
        if (outPubKey != NULL)
            *outPubKey = pubk;
    }
    return (kmfrv);
}

int
pk_genkeypair(int argc, char *argv[])
{
    int rv;
    int opt;
    extern int  optind_av;
    extern char *optarg_av;
    KMF_KEYSTORE_TYPE kstype = 0;
    char *tokenname = NULL;
    char *dir = NULL;
    char *prefix = NULL;
    char *keytype = PK_DEFAULT_KEYTYPE;
    int keylen = PK_DEFAULT_KEYLENGTH;
    char *label = NULL;
    char *outkey = NULL;
    char *format = NULL;
    KMF_HANDLE_T kmfhandle = NULL;
    KMF_ENCODE_FORMAT fmt = KMF_FORMAT_ASN1;
    KMF_KEY_ALG keyAlg = KMF_RSA;
    KMF_ALGORITHM_INDEX sigAlg;
    KMF_CREDENTIAL tokencred = { NULL, 0 };
    KMF_OID *curveoid = NULL; /* ECC */
    int y_flag = 0;

    while ((opt = getopt_av(argc, argv,
        "k:(keystore)s:(subject)n:(nickname)"
        "T:(token)d:(dir)p:(prefix)t:(keytype)y:(keylen)"
        "l:(label)K:(outkey)F:(format)C:(curve)"
        "E(listcurves)")) != EOF) {

        if (opt != 'i' && opt != 'E' && EMPTYSTRING(optarg_av))
            return (PK_ERR_USAGE);

        switch (opt) {
            case 'k':
                kstype = KS2Int(optarg_av);
                if (kstype == 0)
                    return (PK_ERR_USAGE);
                break;
            case 'l':
            case 'n':
                if (label)
                    return (PK_ERR_USAGE);
                label = optarg_av;
                break;
            case 'T':
                if (tokenname)
                    return (PK_ERR_USAGE);
                tokenname = optarg_av;
                break;
            case 'd':
                if (dir)
                    return (PK_ERR_USAGE);
                dir = optarg_av;
                break;
            case 'p':
                if (prefix)
                    return (PK_ERR_USAGE);
                prefix = optarg_av;
                break;
            case 't':
                keytype = optarg_av;
                break;
            case 'y':
                if (sscanf(optarg_av, "%d",
                    &keylen) != 1) {
                    cryptoerror(LOG_STDERR,
                        gettext("key length must be"
                        "a numeric value (%s)\n"),
                        optarg_av);
                    return (PK_ERR_USAGE);
                }
                y_flag++;
                break;
            case 'K':
                if (outkey)
                    return (PK_ERR_USAGE);
                outkey = optarg_av;
                break;
            case 'F':
                if (format)
                    return (PK_ERR_USAGE);
                format = optarg_av;
                break;
            case 'C':
                curveoid = ecc_name_to_oid(optarg_av);
                if (curveoid == NULL) {
                    cryptoerror(LOG_STDERR,
                        gettext(
                        "Unrecognized ECC curve.\n"));
                    return (PK_ERR_USAGE);
                }
                break;
            case 'E':
                show_ecc_curves();
                return (0);
            default:
                return (PK_ERR_USAGE);
        }
    }

    /* No additional args allowed. */
    argc -= optind_av;
    argv += optind_av;
    if (argc) {
        return (PK_ERR_USAGE);
    }

    if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) {
        cryptoerror(LOG_STDERR, gettext("Error initializing KMF\n"));
        return (PK_ERR_USAGE);
    }

    /* Assume keystore = PKCS#11 if not specified. */
    if (kstype == 0)
        kstype = KMF_KEYSTORE_PK11TOKEN;

    DIR_OPTION_CHECK(kstype, dir);

    if (format && (fmt = Str2Format(format)) == KMF_FORMAT_UNDEF) {
        cryptoerror(LOG_STDERR,
            gettext("Error parsing format string (%s).\n"),
            format);
        return (PK_ERR_USAGE);
    }

    if (Str2KeyType(keytype, NULL, &keyAlg, &sigAlg) != 0) {
        cryptoerror(LOG_STDERR, gettext("Unrecognized keytype (%s).\n"),
            keytype);
        return (PK_ERR_USAGE);
    }
    if (curveoid != NULL && keyAlg != KMF_ECDSA) {
        cryptoerror(LOG_STDERR, gettext("EC curves are only "
            "valid for EC keytypes.\n"));
        return (PK_ERR_USAGE);
    }
    if (keyAlg == KMF_ECDSA && curveoid == NULL) {
        cryptoerror(LOG_STDERR, gettext("A curve must be "
            "specifed when using EC keys.\n"));
        return (PK_ERR_USAGE);
    }
    if (keyAlg == KMF_ECDSA && kstype == KMF_KEYSTORE_OPENSSL) {
        (void) fprintf(stderr, gettext("ECC certificates are"
            "only supported with the pkcs11 and nss keystores\n"));
        rv = PK_ERR_USAGE;
        goto end;
    }
    /* Adjust default keylength for NSS and DSA */
    if (keyAlg == KMF_DSA && kstype == KMF_KEYSTORE_NSS) {
        /* NSS only allows for 512-1024 bit DSA keys */
        if (!y_flag)
            /* If nothing was given, default to 1024 */
            keylen = 1024;
        else if (keylen > 1024 || keylen < 512) {
            (void) fprintf(stderr, gettext("NSS keystore only "
                "supports DSA keylengths of 512 - 1024 bits\n"));
            rv = PK_ERR_USAGE;
            goto end;
        }
    }

    if (kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN) {
        if (label == NULL) {
            (void) fprintf(stderr,
                gettext("No key label specified\n"));
            rv = PK_ERR_USAGE;
            goto end;
        }
        if (tokenname == NULL || !strlen(tokenname)) {
            if (kstype == KMF_KEYSTORE_NSS) {
                tokenname = "internal";
            } else  {
                tokenname = PK_DEFAULT_PK11TOKEN;
            }
        }

        (void) get_token_password(kstype, tokenname, &tokencred);
    }

    if (kstype == KMF_KEYSTORE_NSS) {
        if (dir == NULL)
            dir = PK_DEFAULT_DIRECTORY;

        rv = genkeypair_nss(kmfhandle,
            tokenname, label, dir, prefix, keyAlg, keylen,
            &tokencred, curveoid, NULL, NULL);

    } else if (kstype == KMF_KEYSTORE_PK11TOKEN) {
        rv = genkeypair_pkcs11(kmfhandle,
            tokenname, label, keyAlg, keylen,
            &tokencred, curveoid, NULL, NULL);

    } else if (kstype == KMF_KEYSTORE_OPENSSL) {
        rv = genkeypair_file(kmfhandle, keyAlg, keylen,
            fmt, outkey, NULL, NULL);
    }

    if (rv != KMF_OK)
        display_error(kmfhandle, rv,
            gettext("Error creating and keypair"));
end:
    if (tokencred.cred != NULL)
        free(tokencred.cred);

    (void) kmf_finalize(kmfhandle);
    return (rv);
}