e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll/*
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * CDDL HEADER START
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll *
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * The contents of this file are subject to the terms of the
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * Common Development and Distribution License (the "License").
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * You may not use this file except in compliance with the License.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll *
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * or http://www.opensolaris.org/os/licensing.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * See the License for the specific language governing permissions
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * and limitations under the License.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll *
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * When distributing Covered Code, include this CDDL HEADER in each
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * If applicable, add the following below this CDDL HEADER, with the
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * fields enclosed by brackets "[]" replaced with your own identifying
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * information: Portions Copyright [yyyy] [name of copyright owner]
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll *
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * CDDL HEADER END
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll/*
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * Use is subject to license terms.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll#include <stdio.h>
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll#include <string.h>
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll#include <ctype.h>
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll#include <malloc.h>
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll#include <libgen.h>
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll#include <errno.h>
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll#include <cryptoutil.h>
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll#include <security/cryptoki.h>
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll#include "common.h"
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll#include <kmfapi.h>
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll#define SET_VALUE(f, s) \
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmfrv = f; \
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kmfrv != KMF_OK) { \
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll cryptoerror(LOG_STDERR, \
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll gettext("Failed to set %s: 0x%02x\n"), \
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll s, kmfrv); \
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll goto cleanup; \
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys IngersollKMF_RETURN
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersollgenkeypair_pkcs11(KMF_HANDLE_T kmfhandle,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *token, char *keylabel, KMF_KEY_ALG keyAlg,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll int keylen, KMF_CREDENTIAL *tokencred, KMF_OID *curveoid,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_HANDLE *outPriKey, KMF_KEY_HANDLE *outPubKey)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll{
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_RETURN kmfrv = KMF_OK;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_HANDLE pubk, prik;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_ATTRIBUTE attrlist[16];
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll int numattr = 0;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_ALG keytype;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll uint32_t keylength;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll keylength = keylen; /* bits */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll keytype = keyAlg;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll /* Select a PKCS11 token */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmfrv = select_token(kmfhandle, token, FALSE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kmfrv != KMF_OK)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (kmfrv);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYSTORE_TYPE_ATTR, &kstype,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (kstype));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYALG_ATTR, &keytype,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (keytype));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYLENGTH_ATTR, &keylength,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (keylength));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (keylabel != NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYLABEL_ATTR, keylabel,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll strlen(keylabel));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (tokencred != NULL && tokencred->cred != NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_CREDENTIAL_ATTR, tokencred,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (KMF_CREDENTIAL));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_PRIVKEY_HANDLE_ATTR, &prik,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (KMF_KEY_HANDLE));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_PUBKEY_HANDLE_ATTR, &pubk,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (KMF_KEY_HANDLE));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (keytype == KMF_ECDSA && curveoid != NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_ECC_CURVE_OID_ATTR, curveoid,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (KMF_OID));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kmfrv != KMF_OK) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (kmfrv);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersollcleanup:
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kmfrv == KMF_OK) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (outPriKey != NULL)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll *outPriKey = prik;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (outPubKey != NULL)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll *outPubKey = pubk;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (kmfrv);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll}
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys IngersollKMF_RETURN
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersollgenkeypair_file(KMF_HANDLE_T kmfhandle,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_ALG keyAlg, int keylen, KMF_ENCODE_FORMAT fmt,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *outkey,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_HANDLE *outPriKey, KMF_KEY_HANDLE *outPubKey)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll{
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_RETURN kmfrv;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_HANDLE pubk, prik;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *fullkeypath = NULL;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_ATTRIBUTE attrlist[10];
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll int numattr = 0;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_ALG keytype;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll uint32_t keylength;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_ENCODE_FORMAT format;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (EMPTYSTRING(outkey)) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll cryptoerror(LOG_STDERR,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll gettext("No output file was specified for "
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "the key\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll fullkeypath = strdup(outkey);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (verify_file(fullkeypath)) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll cryptoerror(LOG_STDERR,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll gettext("Cannot write the indicated output "
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "key file (%s).\n"), fullkeypath);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll free(fullkeypath);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll keylength = keylen; /* bits */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll keytype = keyAlg;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll format = fmt;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYSTORE_TYPE_ATTR, &kstype,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (kstype));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYALG_ATTR, &keytype,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (keytype));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYLENGTH_ATTR, &keylength,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (keylength));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (fullkeypath != NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_FILENAME_ATTR, fullkeypath,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll strlen(fullkeypath));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_ENCODE_FORMAT_ATTR, &format,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (format));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_PRIVKEY_HANDLE_ATTR, &prik,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (KMF_KEY_HANDLE));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_PUBKEY_HANDLE_ATTR, &pubk,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (KMF_KEY_HANDLE));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kmfrv != KMF_OK) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll goto cleanup;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersollcleanup:
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (fullkeypath != NULL)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll free(fullkeypath);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kmfrv == KMF_OK) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (outPriKey != NULL)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll *outPriKey = prik;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (outPubKey != NULL)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll *outPubKey = pubk;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (kmfrv);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll}
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys IngersollKMF_RETURN
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersollgenkeypair_nss(KMF_HANDLE_T kmfhandle,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *token,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *nickname, char *dir, char *prefix,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_ALG keyAlg,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll int keylen, KMF_CREDENTIAL *tokencred,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_OID *curveoid,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_HANDLE *outPriKey, KMF_KEY_HANDLE *outPubKey)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll{
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_RETURN kmfrv;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_HANDLE pubk, prik;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_ATTRIBUTE attrlist[16];
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll int numattr = 0;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_ALG keytype;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll uint32_t keylength;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (token == NULL)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll token = DEFAULT_NSS_TOKEN;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmfrv = configure_nss(kmfhandle, dir, prefix);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kmfrv != KMF_OK)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (kmfrv);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll keylength = keylen; /* bits */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll keytype = keyAlg;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYSTORE_TYPE_ATTR, &kstype,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (kstype));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYALG_ATTR, &keytype,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (keytype));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYLENGTH_ATTR, &keylength,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (keylength));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (nickname != NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYLABEL_ATTR, nickname,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll strlen(nickname));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (tokencred != NULL && tokencred->cred != NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_CREDENTIAL_ATTR, tokencred,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (KMF_CREDENTIAL));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (token != NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_TOKEN_LABEL_ATTR, token,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll strlen(token));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_PRIVKEY_HANDLE_ATTR, &prik,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (KMF_KEY_HANDLE));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_PUBKEY_HANDLE_ATTR, &pubk,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (KMF_KEY_HANDLE));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (keytype == KMF_ECDSA && curveoid != NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_ECC_CURVE_OID_ATTR, curveoid,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll sizeof (KMF_OID));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll numattr++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kmfrv != KMF_OK) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (kmfrv);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersollcleanup:
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kmfrv == KMF_OK) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (outPriKey != NULL)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll *outPriKey = prik;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (outPubKey != NULL)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll *outPubKey = pubk;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (kmfrv);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll}
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersollint
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersollpk_genkeypair(int argc, char *argv[])
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll{
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll int rv;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll int opt;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll extern int optind_av;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll extern char *optarg_av;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEYSTORE_TYPE kstype = 0;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *tokenname = NULL;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *dir = NULL;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *prefix = NULL;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *keytype = PK_DEFAULT_KEYTYPE;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll int keylen = PK_DEFAULT_KEYLENGTH;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *label = NULL;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *outkey = NULL;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *format = NULL;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_HANDLE_T kmfhandle = NULL;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_ENCODE_FORMAT fmt = KMF_FORMAT_ASN1;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_KEY_ALG keyAlg = KMF_RSA;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_ALGORITHM_INDEX sigAlg;
6b35cb3cf158584a9408d44b9b6796564e8e1882Richard PALO KMF_CREDENTIAL tokencred = { NULL, 0 };
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_OID *curveoid = NULL; /* ECC */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll int y_flag = 0;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll while ((opt = getopt_av(argc, argv,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "k:(keystore)s:(subject)n:(nickname)"
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "T:(token)d:(dir)p:(prefix)t:(keytype)y:(keylen)"
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "l:(label)K:(outkey)F:(format)C:(curve)"
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "E(listcurves)")) != EOF) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (opt != 'i' && opt != 'E' && EMPTYSTRING(optarg_av))
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll switch (opt) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll case 'k':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kstype = KS2Int(optarg_av);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kstype == 0)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll break;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll case 'l':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll case 'n':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (label)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll label = optarg_av;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll break;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll case 'T':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (tokenname)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll tokenname = optarg_av;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll break;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll case 'd':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (dir)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll dir = optarg_av;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll break;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll case 'p':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (prefix)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll prefix = optarg_av;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll break;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll case 't':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll keytype = optarg_av;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll break;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll case 'y':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (sscanf(optarg_av, "%d",
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll &keylen) != 1) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll cryptoerror(LOG_STDERR,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll gettext("key length must be"
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "a numeric value (%s)\n"),
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll optarg_av);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll y_flag++;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll break;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll case 'K':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (outkey)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll outkey = optarg_av;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll break;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll case 'F':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (format)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll format = optarg_av;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll break;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll case 'C':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll curveoid = ecc_name_to_oid(optarg_av);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (curveoid == NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll cryptoerror(LOG_STDERR,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll gettext(
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "Unrecognized ECC curve.\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll break;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll case 'E':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll show_ecc_curves();
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (0);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll default:
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll /* No additional args allowed. */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll argc -= optind_av;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll argv += optind_av;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (argc) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll cryptoerror(LOG_STDERR, gettext("Error initializing KMF\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll /* Assume keystore = PKCS#11 if not specified. */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kstype == 0)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kstype = KMF_KEYSTORE_PK11TOKEN;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll DIR_OPTION_CHECK(kstype, dir);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (format && (fmt = Str2Format(format)) == KMF_FORMAT_UNDEF) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll cryptoerror(LOG_STDERR,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll gettext("Error parsing format string (%s).\n"),
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll format);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (Str2KeyType(keytype, NULL, &keyAlg, &sigAlg) != 0) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll cryptoerror(LOG_STDERR, gettext("Unrecognized keytype (%s).\n"),
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll keytype);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (curveoid != NULL && keyAlg != KMF_ECDSA) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll cryptoerror(LOG_STDERR, gettext("EC curves are only "
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "valid for EC keytypes.\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (keyAlg == KMF_ECDSA && curveoid == NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll cryptoerror(LOG_STDERR, gettext("A curve must be "
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "specifed when using EC keys.\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (keyAlg == KMF_ECDSA && kstype == KMF_KEYSTORE_OPENSSL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll (void) fprintf(stderr, gettext("ECC certificates are"
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "only supported with the pkcs11 and nss keystores\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll rv = PK_ERR_USAGE;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll goto end;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll /* Adjust default keylength for NSS and DSA */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (keyAlg == KMF_DSA && kstype == KMF_KEYSTORE_NSS) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll /* NSS only allows for 512-1024 bit DSA keys */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (!y_flag)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll /* If nothing was given, default to 1024 */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll keylen = 1024;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll else if (keylen > 1024 || keylen < 512) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll (void) fprintf(stderr, gettext("NSS keystore only "
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "supports DSA keylengths of 512 - 1024 bits\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll rv = PK_ERR_USAGE;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll goto end;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (label == NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll (void) fprintf(stderr,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll gettext("No key label specified\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll rv = PK_ERR_USAGE;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll goto end;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (tokenname == NULL || !strlen(tokenname)) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kstype == KMF_KEYSTORE_NSS) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll tokenname = "internal";
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll } else {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll tokenname = PK_DEFAULT_PK11TOKEN;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll (void) get_token_password(kstype, tokenname, &tokencred);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (kstype == KMF_KEYSTORE_NSS) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (dir == NULL)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll dir = PK_DEFAULT_DIRECTORY;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll rv = genkeypair_nss(kmfhandle,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll tokenname, label, dir, prefix, keyAlg, keylen,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll &tokencred, curveoid, NULL, NULL);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll } else if (kstype == KMF_KEYSTORE_PK11TOKEN) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll rv = genkeypair_pkcs11(kmfhandle,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll tokenname, label, keyAlg, keylen,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll &tokencred, curveoid, NULL, NULL);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll } else if (kstype == KMF_KEYSTORE_OPENSSL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll rv = genkeypair_file(kmfhandle, keyAlg, keylen,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll fmt, outkey, NULL, NULL);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (rv != KMF_OK)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll display_error(kmfhandle, rv,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll gettext("Error creating and keypair"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersollend:
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (tokencred.cred != NULL)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll free(tokencred.cred);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll (void) kmf_finalize(kmfhandle);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (rv);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll}