pkcs7.h

Go to the documentation of this file.

/*
 * pkcs7.h
 *
 * PKCS#7 Parser and utilities routines
 *
 * Copyright 2019-2024 DigiCert, Inc. All Rights Reserved.
 * Proprietary and Confidential Material.
 *
 */
#ifndef __PKCS7_HEADER__
#define __PKCS7_HEADER__

#ifdef __cplusplus
extern "C" {
#endif

/*------------------------------------------------------------------*/

/* PKCS7_signData flags */
#define PKCS7_EXTERNAL_SIGNATURES 0x01

/* type definitions */

struct ASN1_ITEM;

struct DER_ITEM;

struct AsymmetricKey;

enum encryptedContentType;


typedef struct Attribute
{
    const ubyte* typeOID;
    ubyte4 type; /* id|tag */
    ubyte* value;
    ubyte4 valueLen;
} Attribute;

typedef struct signerInfo {
    struct ASN1_ITEM* pIssuer; /* signer certificate's issuer */
    struct ASN1_ITEM* pSerialNumber; /* signer certificate's issuer specific serial number */
    CStream cs; /* common stream for both issuer and serial number */
    AsymmetricKey* pKey; /* private key */
    const ubyte* digestAlgoOID; /* must point to one of the constants in oiddefs.h */
    const ubyte* unused;
    Attribute* pAuthAttrs;
    ubyte4 authAttrsLen;
    Attribute* pUnauthAttrs;
    ubyte4 unauthAttrsLen;
} signerInfo;

typedef struct signerInfo *signerInfoPtr;

/* this callback is used to retrieve the private key that
   corresponds to an issuer and serial number; key will
   be released by PKCS7 stack */
typedef MSTATUS (*PKCS7_GetPrivateKey)(const void* arg,
                                       CStream cs,
                                       struct ASN1_ITEM* pSerialNumber,
                                       struct ASN1_ITEM* pIssuerName,
                                       struct AsymmetricKey* pKey);

/* this callback is used to verify that this certificate is recognized
   as valid */
typedef MSTATUS (*PKCS7_ValidateRootCertificate)(const void* arg,
                                                 CStream cs,
                                                 struct ASN1_ITEM* pCertificate,
                                                 sbyte4 chainLength);

/* this callback is used to get a certificate given the issuer name and
   serial number; the ppCertificate will be released by the PKCS7 stack */
typedef MSTATUS (*PKCS7_GetCertificate)(const void* arg,
                                        CStream cs,
                                        struct ASN1_ITEM* pSerialNumber,
                                        struct ASN1_ITEM* pIssuerName,
                                        ubyte** ppCertificate,
                                        ubyte4* certificateLen);
/* used by PKCS#12 */
typedef struct PKCS7_Callbacks
{
    PKCS7_GetPrivateKey             getPrivKeyFun;
    PKCS7_ValidateRootCertificate   valCertFun;
    PKCS7_GetCertificate            getCertFun;
} PKCS7_Callbacks;

/*------------------------------------------------------------------*/
/* exported routines */
#ifdef __ENABLE_MOCANA_PKCS7__

/* this routine takes a pointer to the root item of a parsed PKCS7
    message (by ASN1_Parse) and returns the pointer to the first
    certificate in the message. If the PKCS7 contains several
    certificates, they are the siblings of the first one */

MOC_EXTERN MSTATUS
PKCS7_GetCertificates(struct ASN1_ITEM* pRootItem, CStream s,
                      struct ASN1_ITEM** ppFirstCertificate);

MOC_EXTERN MSTATUS
PKCS7_VerifySignedData(MOC_ASYM(hwAccelDescr hwAccelCtx)
                         struct ASN1_ITEM* pSignedData, CStream s,
                        /* getCertFun can be NULL, if certificates
                         * are included in signedData
                         */
                         const void* callbackArg,
                         PKCS7_GetCertificate getCertFun,
                         PKCS7_ValidateRootCertificate valCertFun,
                         const ubyte* payLoad, /* for detached signatures */
                         ubyte4 payLoadLen,
                         sbyte4* numKnownSigners);

MOC_EXTERN MSTATUS
PKCS7_DecryptEnvelopedDataAux( MOC_HW(hwAccelDescr hwAccelCtx)
                              struct ASN1_ITEM* pEnvelopedData, CStream s,
                              const void* callbackArg,
                              PKCS7_GetPrivateKey getPrivateKeyFun,
                              enum encryptedContentType* pType,
                              struct ASN1_ITEM** ppEncryptedContent,
                              BulkCtx* ppBulkCtx,
                              const BulkEncryptionAlgo** ppBulkAlgo,
                              ubyte iv[/*16=MAX_IV_SIZE*/]);

MOC_EXTERN MSTATUS
PKCS7_DecryptEnvelopedData( MOC_HW(hwAccelDescr hwAccelCtx)
                           struct ASN1_ITEM* pEnvelopedData, CStream s,
                           const void* callbackArg,
                           PKCS7_GetPrivateKey getPrivateKeyFun,
                           ubyte** decryptedInfo, sbyte4* decryptedInfoLen);

MOC_EXTERN MSTATUS
PKCS7_EnvelopData( MOC_HW(hwAccelDescr hwAccelCtx)
                  struct DER_ITEM* pStart, /* can be null */
                  struct DER_ITEM* pParent, /* can be null */
                  struct ASN1_ITEM* pCACertificatesParseRoots[/*numCACerts*/],
                  CStream pStreams[/*numCACerts*/],
                  sbyte4 numCACerts,
                  const ubyte* encryptAlgoOID,
                  RNGFun rngFun, void* rngFunArg,
                  const ubyte* pPayLoad, ubyte4 payLoadLen,
                  ubyte** ppEnveloped, ubyte4* pEnvelopedLen);

MOC_EXTERN MSTATUS
PKCS7_EnvelopDataWoaep( MOC_HW(hwAccelDescr hwAccelCtx)
                  struct DER_ITEM* pStart, /* can be null */
                  struct DER_ITEM* pParent, /* can be null */
                  struct ASN1_ITEM* pCACertificatesParseRoots[/*numCACerts*/],
                  CStream pStreams[/*numCACerts*/],
                  sbyte4 numCACerts,
                  const ubyte* encryptAlgoOID,
                  RNGFun rngFun, void* rngFunArg,
                  ubyte isOaep, ubyte4 oaepHashAlgo, sbyte *pOaepLabel,
                  const ubyte* pPayLoad, ubyte4 payLoadLen,
                  ubyte** ppEnveloped, ubyte4* pEnvelopedLen);

MOC_EXTERN MSTATUS
PKCS7_SignData(MOC_ASYM(hwAccelDescr hwAccelCtx)
               ubyte4 flags,
               struct DER_ITEM* pStart, /* can be null */
               struct DER_ITEM* pParent,
               struct ASN1_ITEM* pCACertificatesParseRoots[/*numCACerts*/], /* can be null */
               CStream pCAStreams[/*numCACerts*/], sbyte4 numCACerts,
               struct ASN1_ITEM* pCrlsParseRoots[/*numCrls*/], /* can be null */
               CStream pCrlStreams[/*numCrls*/], sbyte4 numCrls,
               signerInfoPtr *pSignerInfos, /* if NULL, will create degenerate SignedData */
               ubyte4 numSigners, /* number of signers */
               const ubyte* payLoadType, /* if NULL, will create degenerate SignedData */
               const ubyte* pPayLoad, ubyte4 payLoadLen,
               RNGFun rngFun,             /* this can be NULL for degenerate SignedData */
               void* rngFunArg,           /* this can be NULL for degenerate SignedData */
               ubyte** ppSigned, ubyte4* pSignedLen);

MOC_EXTERN MSTATUS
PKCS7_DigestData( MOC_HASH(hwAccelDescr hwAccelCtx)
                 struct DER_ITEM* pStart, /* can be null */
                 struct DER_ITEM* pParent,
                 const ubyte* payLoadType, /* OID can be null then will used pkcs7_data_OID */
                 ubyte hashType,
                 const ubyte* pPayLoad, ubyte4 payLoadLen,
                 ubyte** ppDigested, ubyte4* pDigestedLen);


MOC_EXTERN MSTATUS
PKCS7_GetSignerDigestAlgo( struct ASN1_ITEM* pSignerInfo, CStream cs, ubyte* hashAlgoId);

MOC_EXTERN MSTATUS
PKCS7_GetSignerSignatureAlgo( struct ASN1_ITEM* pSignerInfo, CStream cs, ubyte* pubKeyAlgoId);

MOC_EXTERN MSTATUS
PKCS7_GetSignerSignedAttributes( struct ASN1_ITEM* pSignerInfo,
                        struct ASN1_ITEM* *ppFirstSignedAttribute);

MOC_EXTERN MSTATUS
PKCS7_GetSignerUnsignedAttributes( struct ASN1_ITEM* pSignerInfo,
                        struct ASN1_ITEM* *ppFirstUnsignedAttribute);

/*------------------------------------------------------------------*/

typedef enum {
    success = 0,
    failed = 2,
    pending = 3,
    noSupport = 4,
    confirmRequired = 5,
    popRequired = 6,
    partial = 7
} CMCStatus;

typedef struct cmcSignerInfo {
    signerInfo *pSignerInfo;
    struct ASN1_ITEM* pSubjectKeyIdentifier;

} cmcSignerInfo;

typedef struct CertsData
{
    ubyte *pCertData;
    ubyte4 certDataLen;
} CERTS_DATA;

typedef struct taggedContent
{
    ubyte *pData;
    ubyte4 dataLen;
} taggedContent;

typedef struct taggedAttribute
{
    ubyte4 bodyPartId;
    ubyte *pAttributeTypeOid;
    taggedContent *pTaggedAttributeValues;
    ubyte4 numAttributeValues;
} taggedAttribute;

typedef struct taggedContentInfo
{
    ubyte4 bodyPartId;
    /* ContentInfo */
    taggedContent *pTaggedContentInfo;
} taggedContentInfo;

typedef struct otherMsg
{
    ubyte4 bodyPartId;
    ubyte *pOtherMsgTypeOid;
    /*otherMsgValue*/
    taggedContent *pOtherMsgValue;
} otherMsg;

typedef struct cmcSignerInfo *cmcSignerInfoPtr;

MOC_EXTERN MSTATUS
CMC_createPKIDataEx(taggedAttribute pTaggedAttributes[], ubyte4 numTaggedAttrs, ubyte *pDerCertificateRequest, ubyte4 derCertificateReqLen, taggedContentInfo pTaggedContentInfos[], ubyte4 numTaggedContents, otherMsg pOtherMsgs[], ubyte4 numOtherMsgs, ubyte **ppBuffer, ubyte4 *pBufferLen);

MOC_EXTERN MSTATUS
CMC_processCmsSequence(ASN1_ITEM *pPKIInputData, CStream stream, ubyte4 *pBodyPartsList, ubyte4 numBodyParts, byteBoolean isResponseData, ASN1_ITEMPTR **ppEnvelopDataItems, ubyte4 *pNumEnvelopDataItems);

MOC_EXTERN MSTATUS
CMC_processControlSequence(ASN1_ITEM *pPKIInputData, CStream stream, ubyte *pBatchOID, ubyte4 **ppBodyPartIds, ubyte4 *pNumBodyPartIds);

MOC_EXTERN MSTATUS
CMC_processOtherMsgSequence(ASN1_ITEM *pPKIInputData, CStream stream, ubyte **ppOutData, ubyte4 *pOutDataLen, byteBoolean isResponseData);

MOC_EXTERN MSTATUS
CMC_verifyAttestationReqType(ASN1_ITEM *pPKIInputData, CStream stream, byteBoolean *pAttestFlow, ubyte **ppOid);

MOC_EXTERN MSTATUS
CMC_createPKIData(ASN1_ITEMPTR pControlItem, CStream *controlStream, ASN1_ITEMPTR pReqItem, CStream *reqStream, ubyte **ppBuffer, ubyte4 *pBufferLen);

MOC_EXTERN MSTATUS
CMC_getPKIResponse(ASN1_ITEM* pRootItem, CStream stream, ASN1_ITEM **ppPkiResponse);

MOC_EXTERN MSTATUS
CMC_getPKIData(ASN1_ITEM* pRootItem, CStream stream, ASN1_ITEM **ppPkiRequest);
#if defined(__ENABLE_MOCANA_AIDE_SERVER__)
MOC_EXTERN MSTATUS
CMC_addCMCStatusInfoV2(CMCStatus status, sbyte4 referanceIds[], sbyte4 numRefIds, ubyte **ppBuffer, ubyte4 *pBufferLen);
MOC_EXTERN MSTATUS
CMC_addTaggedAttribute(sbyte4 bodyPartID, ubyte *attrTypeOid, ubyte *attrValueData, ubyte4 attrValueLen, ubyte **ppBuffer, ubyte4 *pBufferLen);
MOC_EXTERN MSTATUS
CMC_createSimplePKIMessage(CERTS_DATA *pCertsData, sbyte4 certDataLen, ubyte **ppPkiMessage, ubyte4 *pPkiMessageLen);
MOC_EXTERN MSTATUS
CMC_createFullPKIMessage(ubyte* pSignerCertBytes, ubyte4 signerCertByteLen, AsymmetricKey *pSignerKey, CERTS_DATA *pCertsData, sbyte4 certDataLen, intBoolean isAttest, ubyte *pEkCertData, ubyte4 ekCertDataLen, ubyte *pOtherMsgData, ubyte4 otherMsgDataLen, ubyte **ppPkiMessage, ubyte4 *pPkiMessageLen);

MOC_EXTERN MSTATUS
CMC_createCMSEnvelopForKekri(ubyte *encryptAlgoOID, BulkEncryptionAlgo* pBulkEncryptionAlgo, sbyte4 keyLength,
    ubyte *decryptKeyIdentifierData, ubyte4 decryptKeyIdentifierDataLen,
    ubyte *pPreSharedKey, ubyte4 preSharedKeyLen,
    ubyte *pSecret, ubyte4 secretLen,
    ubyte *pPayload, ubyte4 payloadLen,
    ubyte** ppOutData, ubyte4 *pOutDataLen);

MOC_EXTERN MSTATUS
CMC_createCMSEnvelopForKtri(ubyte *encryptAlgoOID,
    ubyte *pPreSharedCert, ubyte4 preSharedCertLen,
    ubyte *pPayload, ubyte4 payloadLen,
    ubyte** ppRetKeyData, ubyte4 *pRetKeyDataLen);

#endif

MOC_EXTERN MSTATUS
CMC_SignData(MOC_ASYM(hwAccelDescr hwAccelCtx)
               ubyte4 flags,
               struct DER_ITEM* pStart, /* can be null */
               struct DER_ITEM* pParent,
               struct ASN1_ITEM* pCACertificatesParseRoots[/*numCACerts*/], /* can be null */
               CStream pCAStreams[/*numCACerts*/], sbyte4 numCACerts,
               struct ASN1_ITEM* pCrlsParseRoots[/*numCrls*/], /* can be null */
               CStream pCrlStreams[/*numCrls*/], sbyte4 numCrls,
               cmcSignerInfoPtr *pCmcSignerInfos, /* if NULL, will create degenerate SignedData */
               ubyte4 numSigners, /* number of signers */
               const ubyte* payLoadType, /* if NULL, will create degenerate SignedData */
               const ubyte* pPayLoad, ubyte4 payLoadLen,
               RNGFun rngFun,             /* this can be NULL for degenerate SignedData */
               void* rngFunArg,           /* this can be NULL for degenerate SignedData */
               ubyte** ppSigned, ubyte4* pSignedLen);

#endif  /*#ifdef __ENABLE_MOCANA_PKCS7__*/

#ifdef __cplusplus
}
#endif

#endif  /*#ifndef __PKCS7_HEADER__ */