Virgil IoT KIT
|
Security Module implementations signatures. More...
#include <stdint.h>
#include <stddef.h>
#include <virgil/iot/status_code/status_code.h>
#include <virgil/iot/secmodule/devices/secmodule-soft.h>
Go to the source code of this file.
Data Structures | |
struct | vs_secmodule_sw_sha256_ctx |
SHA-256 context. More... | |
struct | vs_secmodule_impl_t |
Security Module implementation. More... | |
Typedefs | |
typedef vs_status_e(* | vs_secmodule_slot_save_t) (vs_iot_secmodule_slot_e slot, const uint8_t *data, uint16_t data_sz) |
Save information to the slot. More... | |
typedef vs_status_e(* | vs_secmodule_slot_load_t) (vs_iot_secmodule_slot_e slot, uint8_t *data, uint16_t buf_sz, uint16_t *out_sz) |
Load information to the slot. More... | |
typedef vs_status_e(* | vs_secmodule_slot_delete_t) (vs_iot_secmodule_slot_e slot) |
Delete information from the slot. More... | |
typedef vs_status_e(* | vs_secmodule_hash_create_t) (vs_secmodule_hash_type_e hash_type, const uint8_t *data, uint16_t data_sz, uint8_t *hash, uint16_t hash_buf_sz, uint16_t *hash_sz) |
Hash generation. More... | |
typedef vs_status_e(* | vs_secmodule_keypair_create_t) (vs_iot_secmodule_slot_e slot, vs_secmodule_keypair_type_e keypair_type) |
Key pair generate. More... | |
typedef vs_status_e(* | vs_secmodule_keypair_get_pubkey_t) (vs_iot_secmodule_slot_e slot, uint8_t *buf, uint16_t buf_sz, uint16_t *key_sz, vs_secmodule_keypair_type_e *keypair_type) |
Public key retrieval. More... | |
typedef vs_status_e(* | vs_secmodule_ecdsa_sign_t) (vs_iot_secmodule_slot_e key_slot, vs_secmodule_hash_type_e hash_type, const uint8_t *hash, uint8_t *signature, uint16_t signature_buf_sz, uint16_t *signature_sz) |
Signature calculation based on ECDSA. More... | |
typedef vs_status_e(* | vs_secmodule_ecdsa_verify_t) (vs_secmodule_keypair_type_e keypair_type, const uint8_t *public_key, uint16_t public_key_sz, vs_secmodule_hash_type_e hash_type, const uint8_t *hash, const uint8_t *signature, uint16_t signature_sz) |
Signature verification based on ECDSA. More... | |
typedef vs_status_e(* | vs_secmodule_hmac_t) (vs_secmodule_hash_type_e hash_type, const uint8_t *key, uint16_t key_sz, const uint8_t *input, uint16_t input_sz, uint8_t *output, uint16_t output_buf_sz, uint16_t *output_sz) |
HMAC calculation. More... | |
typedef vs_status_e(* | vs_secmodule_kdf_t) (vs_secmodule_kdf_type_e kdf_type, vs_secmodule_hash_type_e hash_type, const uint8_t *input, uint16_t input_sz, uint8_t *output, uint16_t output_sz) |
KDF calculation. More... | |
typedef vs_status_e(* | vs_secmodule_hkdf_t) (vs_secmodule_hash_type_e hash_type, const uint8_t *input, uint16_t input_sz, const uint8_t *salt, uint16_t salt_sz, const uint8_t *info, uint16_t info_sz, uint8_t *output, uint16_t output_sz) |
HKDF calculation. More... | |
typedef vs_status_e(* | vs_secmodule_random_t) (uint8_t *output, uint16_t output_sz) |
Random data generation. More... | |
typedef vs_status_e(* | vs_secmodule_aes_encrypt_t) (vs_iot_aes_type_e aes_type, const uint8_t *key, uint16_t key_bitlen, const uint8_t *iv, uint16_t iv_len, const uint8_t *add, uint16_t add_len, uint16_t buf_len, const uint8_t *input, uint8_t *output, uint8_t *tag, uint16_t tag_len) |
Data encryption by AES algorithm. More... | |
typedef vs_status_e(* | vs_secmodule_aes_decrypt_t) (vs_iot_aes_type_e aes_type, const uint8_t *key, uint16_t key_bitlen, const uint8_t *iv, uint16_t iv_len, const uint8_t *add, uint16_t add_len, uint16_t buf_len, const uint8_t *input, uint8_t *output, uint8_t *tag, uint16_t tag_len) |
Data decryption by AES algorithm. More... | |
typedef vs_status_e(* | vs_secmodule_aes_auth_decrypt_t) (vs_iot_aes_type_e aes_type, const uint8_t *key, uint16_t key_bitlen, const uint8_t *iv, uint16_t iv_len, const uint8_t *add, uint16_t add_len, uint16_t buf_len, const uint8_t *input, uint8_t *output, const uint8_t *tag, uint16_t tag_len) |
Data decryption by AES algorithm with authentication check. More... | |
typedef vs_status_e(* | vs_secmodule_ecdh_t) (vs_iot_secmodule_slot_e slot, vs_secmodule_keypair_type_e keypair_type, const uint8_t *public_key, uint16_t public_key_sz, uint8_t *shared_secret, uint16_t buf_sz, uint16_t *shared_secret_sz) |
ECDH algorithm. More... | |
typedef void(* | vs_secmodule_sw_sha256_init_t) (vs_secmodule_sw_sha256_ctx *ctx) |
SHA-256 context initialization. More... | |
typedef vs_status_e(* | vs_secmodule_sw_sha256_update_t) (vs_secmodule_sw_sha256_ctx *ctx, const uint8_t *message, uint32_t len) |
SHA-256 context update. More... | |
typedef vs_status_e(* | vs_secmodule_sw_sha256_final_t) (vs_secmodule_sw_sha256_ctx *ctx, uint8_t *digest) |
SHA-256 context finalization. More... | |
typedef void(* | vs_secmodule_deinit_t) (void) |
Security Module destruction. More... | |
Enumerations | |
enum | vs_secmodule_keypair_type_e { VS_KEYPAIR_INVALID = -1, VS_KEYPAIR_EC_SECP_MIN = 1, VS_KEYPAIR_EC_SECP192R1 = VS_KEYPAIR_EC_SECP_MIN, VS_KEYPAIR_EC_SECP224R1, VS_KEYPAIR_EC_SECP256R1, VS_KEYPAIR_EC_SECP384R1, VS_KEYPAIR_EC_SECP521R1, VS_KEYPAIR_EC_SECP192K1, VS_KEYPAIR_EC_SECP224K1, VS_KEYPAIR_EC_SECP256K1, VS_KEYPAIR_EC_SECP_MAX = VS_KEYPAIR_EC_SECP256K1, VS_KEYPAIR_EC_CURVE25519, VS_KEYPAIR_EC_ED25519, VS_KEYPAIR_MAX } |
Keypair types. More... | |
enum | vs_secmodule_hash_type_e { VS_HASH_SHA_INVALID = -1, VS_HASH_SHA_256 = 0, VS_HASH_SHA_384, VS_HASH_SHA_512 } |
Hash types. More... | |
enum | vs_secmodule_kdf_type_e { VS_KDF_INVALID = -1, VS_KDF_2 = 0 } |
KDF type. More... | |
enum | vs_iot_aes_type_e { VS_AES_GCM, VS_AES_CBC } |
AES mode. More... | |
Functions | |
vs_status_e | vs_secmodule_ecies_decrypt (const vs_secmodule_impl_t *secmodule_impl, const uint8_t *recipient_id, size_t recipient_id_sz, const uint8_t *cryptogram, size_t cryptogram_sz, uint8_t *decrypted_data, size_t buf_sz, size_t *decrypted_data_sz) |
ECIES decryption for AES-256 based on SHA-384. More... | |
vs_status_e | vs_secmodule_ecies_encrypt (const vs_secmodule_impl_t *secmodule_impl, const uint8_t *recipient_id, size_t recipient_id_sz, const uint8_t *data, size_t data_sz, uint8_t *cryptogram, size_t buf_sz, size_t *cryptogram_sz) |
ECIES encryption for AES-256 based on SHA-384. More... | |
Security Module implementations signatures.
This header contains vs_secmodule_impl_t structure that is used for crypto operations.
Software Security Module needs to have Slots Storage Implementation initialized. See Storage HAL Usage for details.
typedef vs_status_e(* vs_secmodule_aes_auth_decrypt_t) (vs_iot_aes_type_e aes_type, const uint8_t *key, uint16_t key_bitlen, const uint8_t *iv, uint16_t iv_len, const uint8_t *add, uint16_t add_len, uint16_t buf_len, const uint8_t *input, uint8_t *output, const uint8_t *tag, uint16_t tag_len) |
Data decryption by AES algorithm with authentication check.
[in] | aes_type | Hash type. Cannot be VS_HASH_SHA_INVALID. |
[in] | key | Key. Cannot be NULL. |
[in] | key_bitlen | Key size in bits. Cannot be zero. |
[in] | iv | IV. Cannot be NULL. |
[in] | iv_len | IV size. Cannot be zero. |
[in] | add | Additional data. Cannot be NULL. |
[in] | add_len | Additional data size. Cannot be NULL. |
[in] | buf_len | Buffer size. Cannot be zero. |
[in] | input | Input buffer. Cannot be zero. |
[out] | output | Output buffer. Cannot be NULL. |
[in] | tag | Tag buffer. Cannot be NULL. |
[in] | tag_len | Tag size. Cannot be zero. |
typedef vs_status_e(* vs_secmodule_aes_decrypt_t) (vs_iot_aes_type_e aes_type, const uint8_t *key, uint16_t key_bitlen, const uint8_t *iv, uint16_t iv_len, const uint8_t *add, uint16_t add_len, uint16_t buf_len, const uint8_t *input, uint8_t *output, uint8_t *tag, uint16_t tag_len) |
Data decryption by AES algorithm.
[in] | aes_type | Hash type. Cannot be VS_HASH_SHA_INVALID. |
[in] | key | Key. Cannot be NULL. |
[in] | key_bitlen | Key size in bits. Cannot be zero. |
[in] | iv | IV. Cannot be NULL. |
[in] | iv_len | IV size. Cannot be zero. |
[in] | add | Additional data. Cannot be NULL. |
[in] | add_len | Additional data size. Cannot be NULL. |
[in] | buf_len | Buffer size. Cannot be zero. |
[in] | input | Input buffer. Cannot be zero. |
[out] | output | Output buffer. Cannot be NULL. |
[out] | tag | Tag buffer. Cannot be NULL. |
[in] | tag_len | Tag size. Cannot be zero. |
typedef vs_status_e(* vs_secmodule_aes_encrypt_t) (vs_iot_aes_type_e aes_type, const uint8_t *key, uint16_t key_bitlen, const uint8_t *iv, uint16_t iv_len, const uint8_t *add, uint16_t add_len, uint16_t buf_len, const uint8_t *input, uint8_t *output, uint8_t *tag, uint16_t tag_len) |
Data encryption by AES algorithm.
[in] | aes_type | Hash type. Cannot be VS_HASH_SHA_INVALID. |
[in] | key | Key. Cannot be NULL. |
[in] | key_bitlen | Key size in bits. Cannot be zero. |
[in] | iv | IV. Cannot be NULL. |
[in] | iv_len | IV size. Cannot be zero. |
[in] | add | Additional data. Cannot be NULL. |
[in] | add_len | Additional data size. Cannot be NULL. |
[in] | buf_len | Buffer size. Cannot be zero. |
[in] | input | Input buffer. Cannot be zero. |
[out] | output | Output buffer. Cannot be NULL. |
[out] | tag | Tag buffer. Cannot be NULL. |
[in] | tag_len | Tag size. Cannot be zero. |
typedef void(* vs_secmodule_deinit_t) (void) |
Security Module destruction.
typedef vs_status_e(* vs_secmodule_ecdh_t) (vs_iot_secmodule_slot_e slot, vs_secmodule_keypair_type_e keypair_type, const uint8_t *public_key, uint16_t public_key_sz, uint8_t *shared_secret, uint16_t buf_sz, uint16_t *shared_secret_sz) |
ECDH algorithm.
[in] | key_slot | Slot number. |
[in] | keypair_type | Key pair type. Cannot be VS_KEYPAIR_INVALID or VS_KEYPAIR_MAX. |
[in] | public_key | Public key buffer. Cannot be NULL. |
[in] | public_key_sz | Public key size. Cannot be zero. |
[in,out] | shared_secret | Shared secret buffer. Cannot be NULL. |
[in] | buf_sz | Shared secret buffer size. Cannot be zero. |
[out] | shared_secret_sz | Output buffer to store shared secret buffer size. Cannot be NULL. |
typedef vs_status_e(* vs_secmodule_ecdsa_sign_t) (vs_iot_secmodule_slot_e key_slot, vs_secmodule_hash_type_e hash_type, const uint8_t *hash, uint8_t *signature, uint16_t signature_buf_sz, uint16_t *signature_sz) |
Signature calculation based on ECDSA.
[in] | key_slot | Slot number. |
[in] | hash_type | Hash type. Cannot be VS_HASH_SHA_INVALID. |
[in] | hash | Hash source for signature calculation. Cannot be NULL. |
[out] | signature | Output buffer to store signature. Cannot be NULL. |
[in] | signature_buf_sz | Output buffer size. Cannot be NULL. |
[out] | signature_sz | Output buffer to store signature size. Cannot be NULL. |
typedef vs_status_e(* vs_secmodule_ecdsa_verify_t) (vs_secmodule_keypair_type_e keypair_type, const uint8_t *public_key, uint16_t public_key_sz, vs_secmodule_hash_type_e hash_type, const uint8_t *hash, const uint8_t *signature, uint16_t signature_sz) |
Signature verification based on ECDSA.
[in] | keypair_type | Key pair type. Cannot be VS_KEYPAIR_INVALID or VS_KEYPAIR_MAX. |
[in] | public_key | Public key buffer. Cannot be NULL. |
[in] | public_key_sz | Public key size. Cannot be zero. |
[in] | hash_type | Hash type. Cannot be VS_HASH_SHA_INVALID. |
[in] | hash | Hash source for signature calculation. Cannot be NULL. |
[in] | signature | Output buffer to store signature. Cannot be NULL. |
[in] | signature_sz | Output buffer to store signature size. Cannot be NULL. |
typedef vs_status_e(* vs_secmodule_hash_create_t) (vs_secmodule_hash_type_e hash_type, const uint8_t *data, uint16_t data_sz, uint8_t *hash, uint16_t hash_buf_sz, uint16_t *hash_sz) |
Hash generation.
[in] | hash_type | Hash type. Cannot by VS_HASH_SHA_INVALID. |
[in] | data | Data source for hash calculation. Cannot be NULL. |
[in] | data_sz | Data size. Cannot be zero. |
[out] | hash | Output buffer to store hash. Cannot be NULL. |
[in] | hash_buf_sz | Output buffer size. Cannot be NULL. |
[out] | hash_sz | Output buffer to store hash size. Cannot be NULL. |
typedef vs_status_e(* vs_secmodule_hkdf_t) (vs_secmodule_hash_type_e hash_type, const uint8_t *input, uint16_t input_sz, const uint8_t *salt, uint16_t salt_sz, const uint8_t *info, uint16_t info_sz, uint8_t *output, uint16_t output_sz) |
HKDF calculation.
[in] | hash_type | Hash type. Cannot be VS_HASH_SHA_INVALID. |
[in] | input | Input data. Cannot be NULL. |
[in] | input_sz | Input data size. Cannot be zero. |
[in] | salt | Salt data. Cannot be NULL. |
[in] | salt_sz | Salt data size. Cannot be zero. |
[in] | info | Information data. Cannot be NULL. |
[in] | info_sz | Information data size. Cannot be zero. |
[out] | output | Output key buffer. Cannot be NULL. |
[in] | output_sz | Output key size. Cannot be zero. |
typedef vs_status_e(* vs_secmodule_hmac_t) (vs_secmodule_hash_type_e hash_type, const uint8_t *key, uint16_t key_sz, const uint8_t *input, uint16_t input_sz, uint8_t *output, uint16_t output_buf_sz, uint16_t *output_sz) |
HMAC calculation.
[in] | hash_type | Hash type. Cannot be VS_HASH_SHA_INVALID. |
[in] | key | Key buffer. Cannot be NULL. |
[in] | key_sz | Key size. Cannot be zero. |
[in] | input | Input data. Cannot be NULL. |
[in] | input_sz | Input data size. Cannot be zero. |
[out] | output | Output buffer. Cannot be NULL. |
[in] | output_buf_sz | Output buffer size. Cannot be NULL. |
[out] | output_sz | Output buffer to store output data size. Cannot be NULL. |
typedef vs_status_e(* vs_secmodule_kdf_t) (vs_secmodule_kdf_type_e kdf_type, vs_secmodule_hash_type_e hash_type, const uint8_t *input, uint16_t input_sz, uint8_t *output, uint16_t output_sz) |
KDF calculation.
[in] | kdf_type | KDF algorithm. Cannot be VS_KDF_INVALID. |
[in] | hash_type | Hash type. Cannot be VS_HASH_SHA_INVALID. |
[in] | input | Input data. Cannot be NULL. |
[in] | input_sz | Input data size. Cannot be zero. |
[out] | output | Output key buffer. Cannot be NULL. |
[in] | output_sz | Output key size. Cannot be zero. |
typedef vs_status_e(* vs_secmodule_keypair_create_t) (vs_iot_secmodule_slot_e slot, vs_secmodule_keypair_type_e keypair_type) |
Key pair generate.
[in] | slot | Slot ID to save key pair. |
[in] | keypair_type | Key pair type. Cannot be VS_KEYPAIR_INVALID or VS_KEYPAIR_MAX. |
typedef vs_status_e(* vs_secmodule_keypair_get_pubkey_t) (vs_iot_secmodule_slot_e slot, uint8_t *buf, uint16_t buf_sz, uint16_t *key_sz, vs_secmodule_keypair_type_e *keypair_type) |
Public key retrieval.
[in] | slot | Slot number. |
[out] | buf | Output buffer to store public key. Cannot be NULL. |
[in] | buf_sz | Output buffer size. Cannot be NULL. |
[out] | key_sz | Output buffer to store public key size. Cannot be NULL. |
[out] | keypair_type | Output buffer to store key pair type. Cannot be NULL. |
typedef vs_status_e(* vs_secmodule_random_t) (uint8_t *output, uint16_t output_sz) |
Random data generation.
[out] | output | Output buffer. Cannot be NULL. |
[in] | output_sz | Output buffer size. Cannot be zero. |
typedef vs_status_e(* vs_secmodule_slot_delete_t) (vs_iot_secmodule_slot_e slot) |
Delete information from the slot.
[in] | slot | Slot ID. |
typedef vs_status_e(* vs_secmodule_slot_load_t) (vs_iot_secmodule_slot_e slot, uint8_t *data, uint16_t buf_sz, uint16_t *out_sz) |
Load information to the slot.
[in] | slot | Slot ID. |
[out] | data | Data buffer for loaded information. Cannot be NULL. |
[in] | buf_sz | Buffer size. Cannot be zero. |
[out] | out_sz | Loaded data size buffer. Cannot be NULL. |
typedef vs_status_e(* vs_secmodule_slot_save_t) (vs_iot_secmodule_slot_e slot, const uint8_t *data, uint16_t data_sz) |
Save information to the slot.
[in] | slot | Slot ID. |
[in] | data | Data to be saved. Cannot be NULL. |
[in] | data_sz | Data size. Cannot be zero. |
typedef vs_status_e(* vs_secmodule_sw_sha256_final_t) (vs_secmodule_sw_sha256_ctx *ctx, uint8_t *digest) |
SHA-256 context finalization.
[in,out] | ctx | Context. |
[out] | digest | Produced digest. Cannot be NULL. |
typedef void(* vs_secmodule_sw_sha256_init_t) (vs_secmodule_sw_sha256_ctx *ctx) |
SHA-256 context initialization.
[out] | ctx | Context. Cannot be NULL. |
typedef vs_status_e(* vs_secmodule_sw_sha256_update_t) (vs_secmodule_sw_sha256_ctx *ctx, const uint8_t *message, uint32_t len) |
SHA-256 context update.
[in,out] | ctx | Context. |
[in] | message | Message update SHA-256 context. Cannot be NULL. |
[in] | len | Message size. Cannot be zero. |
enum vs_iot_aes_type_e |
Keypair types.
vs_status_e vs_secmodule_ecies_decrypt | ( | const vs_secmodule_impl_t * | secmodule_impl, |
const uint8_t * | recipient_id, | ||
size_t | recipient_id_sz, | ||
const uint8_t * | cryptogram, | ||
size_t | cryptogram_sz, | ||
uint8_t * | decrypted_data, | ||
size_t | buf_sz, | ||
size_t * | decrypted_data_sz | ||
) |
ECIES decryption for AES-256 based on SHA-384.
[in] | secmodule_impl | Secmodule implementation. Cannot be NULL. |
[in] | recipient_id | Recipient ID. Cannot be NULL. |
[in] | recipient_id_sz | Recipient ID size. Cannot be NULL. |
[in] | cryptogram | Cryptogram buffer. Cannot be NULL. |
[in] | cryptogram_sz | Cryptogram buffer size. Cannot be NULL. |
[out] | decrypted_data | Decrypted data output buffer. Cannot be NULL. |
[in] | buf_sz | Decrypted data buffer size. Cannot be zero. |
[out] | decrypted_data_sz | Decrypted data size. Cannot be NULL. |
vs_status_e vs_secmodule_ecies_encrypt | ( | const vs_secmodule_impl_t * | secmodule_impl, |
const uint8_t * | recipient_id, | ||
size_t | recipient_id_sz, | ||
const uint8_t * | data, | ||
size_t | data_sz, | ||
uint8_t * | cryptogram, | ||
size_t | buf_sz, | ||
size_t * | cryptogram_sz | ||
) |
ECIES encryption for AES-256 based on SHA-384.
[in] | secmodule_impl | Secmodule implementation. Cannot be NULL. |
[in] | recipient_id | Recipient ID. Cannot be NULL. |
[in] | recipient_id_sz | Recipient ID size. Cannot be NULL. |
[in] | cryptogram | Cryptogram buffer. Cannot be NULL. |
[in] | cryptogram_sz | Cryptogram buffer size. Cannot be NULL. |
[out] | decrypted_data | Decrypted data output buffer. Cannot be NULL. |
[in] | buf_sz | Decrypted data buffer size. Cannot be zero. |
[out] | decrypted_data_sz | Decrypted data size. Cannot be NULL. |