1 |
vletoux |
1 |
/* OpenPGP Smart Card Mini Driver |
2 |
|
|
Copyright (C) 2009 Vincent Le Toux |
3 |
|
|
|
4 |
|
|
This library is Free software; you can redistribute it and/or |
5 |
|
|
modify it under the terms of the GNU Lesser General Public |
6 |
|
|
License version 2.1 as published by the Free Software Foundation. |
7 |
|
|
|
8 |
|
|
This library is distributed in the hope that it will be useful, |
9 |
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of |
10 |
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
11 |
|
|
Lesser General Public License for more details. |
12 |
|
|
|
13 |
|
|
You should have received a copy of the GNU Lesser General Public |
14 |
|
|
License along with this library; if not, write to the Free Software |
15 |
|
|
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
16 |
|
|
*/ |
17 |
|
|
|
18 |
|
|
#include <windows.h> |
19 |
|
|
#include <cardmod.h> |
20 |
|
|
#include "Tracing.h" |
21 |
|
|
#include "Context.h" |
22 |
|
|
#include "CryptoOperations.h" |
23 |
|
|
|
24 |
|
|
// 4.7 Cryptographic operations |
25 |
|
|
|
26 |
|
|
/** This function performs an RSA decryption operation on the passed buffer |
27 |
|
|
by using the private key that a container index refers to. Note that for |
28 |
|
|
ECC-only smart cards, this entry point is not defined and is set to NULL |
29 |
|
|
in the returned CARD_DATA structure from CardAcquireContext. This operation |
30 |
|
|
is restricted to a single buffer of a size equal to the key modulus.*/ |
31 |
|
|
|
32 |
|
|
DWORD WINAPI CardRSADecrypt( |
33 |
|
|
__in PCARD_DATA pCardData, |
34 |
|
|
__inout PCARD_RSA_DECRYPT_INFO pInfo |
35 |
|
|
) |
36 |
|
|
{ |
37 |
|
|
DWORD dwReturn = 0; |
38 |
|
|
|
39 |
|
|
Trace(WINEVENT_LEVEL_VERBOSE, L"Enter"); |
40 |
|
|
__try |
41 |
|
|
{ |
42 |
|
|
if ( pCardData == NULL ) |
43 |
|
|
{ |
44 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"pCardData == NULL"); |
45 |
|
|
dwReturn = SCARD_E_INVALID_PARAMETER; |
46 |
|
|
__leave; |
47 |
|
|
} |
48 |
|
|
|
49 |
|
|
if ( pInfo == NULL ) |
50 |
|
|
{ |
51 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"pInfo == NULL"); |
52 |
|
|
dwReturn = SCARD_E_INVALID_PARAMETER; |
53 |
|
|
__leave; |
54 |
|
|
} |
55 |
|
|
if ( pInfo->pbData == NULL ) |
56 |
|
|
{ |
57 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"pInfo->pbData == NULL"); |
58 |
|
|
dwReturn = SCARD_E_INVALID_PARAMETER; |
59 |
|
|
__leave; |
60 |
|
|
} |
61 |
vletoux |
8 |
if (pInfo->dwVersion != CARD_RSA_KEY_DECRYPT_INFO_VERSION_ONE |
62 |
|
|
&& pInfo->dwVersion != CARD_RSA_KEY_DECRYPT_INFO_VERSION_TWO) |
63 |
vletoux |
1 |
{ |
64 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"ERROR_REVISION_MISMATCH"); |
65 |
|
|
dwReturn = ERROR_REVISION_MISMATCH; |
66 |
|
|
__leave; |
67 |
|
|
} |
68 |
|
|
if (pInfo->dwKeySpec != AT_KEYEXCHANGE) |
69 |
|
|
{ |
70 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"AT_KEYEXCHANGE %d", pInfo->dwKeySpec); |
71 |
vletoux |
8 |
dwReturn = SCARD_E_INVALID_PARAMETER ; |
72 |
vletoux |
1 |
__leave; |
73 |
|
|
} |
74 |
|
|
if (pInfo->bContainerIndex != Confidentiality) |
75 |
|
|
{ |
76 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"Confidentiality %d", pInfo->bContainerIndex); |
77 |
|
|
dwReturn = SCARD_E_NO_KEY_CONTAINER ; |
78 |
|
|
__leave; |
79 |
|
|
} |
80 |
|
|
dwReturn = CheckContext(pCardData); |
81 |
|
|
if ( dwReturn) |
82 |
|
|
{ |
83 |
|
|
__leave; |
84 |
|
|
} |
85 |
vletoux |
8 |
dwReturn = OCardDecrypt(pCardData, pInfo); |
86 |
|
|
if (dwReturn == SCARD_W_WRONG_CHV) |
87 |
|
|
{ |
88 |
|
|
dwReturn = SCARD_W_SECURITY_VIOLATION; |
89 |
|
|
} |
90 |
vletoux |
1 |
} |
91 |
|
|
__finally |
92 |
|
|
{ |
93 |
|
|
} |
94 |
|
|
Trace(WINEVENT_LEVEL_VERBOSE, L"dwReturn = 0x%08X",dwReturn); |
95 |
|
|
return dwReturn; |
96 |
|
|
} |
97 |
|
|
|
98 |
|
|
|
99 |
|
|
/** The CardSignData function signs a block of unpadded data. This entry either performs |
100 |
|
|
padding on the card or pads the data by using the PFN_CSP_PAD_DATA callback. All card |
101 |
|
|
minidrivers must support this entry point.*/ |
102 |
|
|
|
103 |
|
|
DWORD WINAPI CardSignData( |
104 |
|
|
__in PCARD_DATA pCardData, |
105 |
|
|
__in PCARD_SIGNING_INFO pInfo |
106 |
|
|
) |
107 |
|
|
{ |
108 |
|
|
DWORD dwReturn = 0; |
109 |
|
|
|
110 |
|
|
Trace(WINEVENT_LEVEL_VERBOSE, L"Enter"); |
111 |
|
|
__try |
112 |
|
|
{ |
113 |
|
|
if ( pCardData == NULL ) |
114 |
|
|
{ |
115 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"pCardData == NULL"); |
116 |
|
|
dwReturn = SCARD_E_INVALID_PARAMETER; |
117 |
|
|
__leave; |
118 |
|
|
} |
119 |
|
|
|
120 |
|
|
if ( pInfo == NULL ) |
121 |
|
|
{ |
122 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"pInfo == NULL"); |
123 |
|
|
dwReturn = SCARD_E_INVALID_PARAMETER; |
124 |
|
|
__leave; |
125 |
|
|
} |
126 |
vletoux |
8 |
if ( ( pInfo->dwVersion != CARD_SIGNING_INFO_BASIC_VERSION ) && |
127 |
|
|
( pInfo->dwVersion != CARD_SIGNING_INFO_CURRENT_VERSION ) ) |
128 |
|
|
{ |
129 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"dwVersion == %d", pInfo->dwVersion); |
130 |
|
|
dwReturn = ERROR_REVISION_MISMATCH; |
131 |
|
|
__leave; |
132 |
|
|
} |
133 |
vletoux |
1 |
if ( pInfo->pbData == NULL ) |
134 |
|
|
{ |
135 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"pInfo->pbData == NULL"); |
136 |
|
|
dwReturn = SCARD_E_INVALID_PARAMETER; |
137 |
|
|
__leave; |
138 |
|
|
} |
139 |
vletoux |
8 |
if (pInfo->dwKeySpec == AT_KEYEXCHANGE) |
140 |
|
|
{ |
141 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"AT_KEYEXCHANGE %d", pInfo->dwKeySpec); |
142 |
|
|
dwReturn = SCARD_E_NO_KEY_CONTAINER ; |
143 |
|
|
__leave; |
144 |
|
|
} |
145 |
|
|
if (pInfo->dwKeySpec != AT_SIGNATURE) |
146 |
|
|
{ |
147 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"AT_SIGNATURE %d", pInfo->dwKeySpec); |
148 |
|
|
dwReturn = SCARD_E_INVALID_PARAMETER ; |
149 |
|
|
__leave; |
150 |
|
|
} |
151 |
vletoux |
1 |
dwReturn = CheckContext(pCardData); |
152 |
|
|
if ( dwReturn) |
153 |
|
|
{ |
154 |
|
|
__leave; |
155 |
|
|
} |
156 |
vletoux |
5 |
switch(pInfo->bContainerIndex) |
157 |
|
|
{ |
158 |
|
|
case Authentication: |
159 |
vletoux |
8 |
dwReturn = OCardAuthenticate(pCardData, pInfo); |
160 |
vletoux |
5 |
break; |
161 |
|
|
case Signature: |
162 |
vletoux |
8 |
dwReturn = OCardSign(pCardData, pInfo); |
163 |
vletoux |
5 |
break; |
164 |
|
|
default: |
165 |
|
|
dwReturn = SCARD_E_NO_KEY_CONTAINER; |
166 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"SCARD_E_NO_KEY_CONTAINER %d", pInfo->bContainerIndex); |
167 |
|
|
__leave; |
168 |
|
|
} |
169 |
vletoux |
8 |
if (dwReturn == SCARD_W_WRONG_CHV) |
170 |
|
|
{ |
171 |
|
|
dwReturn = SCARD_W_SECURITY_VIOLATION; |
172 |
|
|
} |
173 |
vletoux |
1 |
} |
174 |
|
|
__finally |
175 |
|
|
{ |
176 |
|
|
} |
177 |
|
|
Trace(WINEVENT_LEVEL_VERBOSE, L"dwReturn = 0x%08X",dwReturn); |
178 |
|
|
return dwReturn; |
179 |
|
|
} |
180 |
|
|
|
181 |
|
|
/** This function returns the public key sizes that are supported by the card in use.*/ |
182 |
|
|
DWORD WINAPI CardQueryKeySizes( |
183 |
|
|
__in PCARD_DATA pCardData, |
184 |
|
|
__in DWORD dwKeySpec, |
185 |
|
|
__in DWORD dwFlags, |
186 |
|
|
__inout PCARD_KEY_SIZES pKeySizes |
187 |
|
|
) |
188 |
|
|
{ |
189 |
|
|
DWORD dwReturn = 0, dwVersion; |
190 |
|
|
Trace(WINEVENT_LEVEL_VERBOSE, L"Enter"); |
191 |
|
|
__try |
192 |
|
|
{ |
193 |
|
|
if ( pCardData == NULL ) |
194 |
|
|
{ |
195 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"pCardData == NULL"); |
196 |
|
|
dwReturn = SCARD_E_INVALID_PARAMETER; |
197 |
|
|
__leave; |
198 |
|
|
} |
199 |
|
|
|
200 |
|
|
if ( dwFlags != 0 ) |
201 |
|
|
{ |
202 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"dwFlags != 0 : %d", dwFlags); |
203 |
|
|
dwReturn = SCARD_E_INVALID_PARAMETER; |
204 |
|
|
__leave; |
205 |
|
|
} |
206 |
|
|
if ( pKeySizes == NULL ) |
207 |
|
|
{ |
208 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"pKeySizes == NULL"); |
209 |
|
|
dwReturn = SCARD_E_INVALID_PARAMETER; |
210 |
|
|
__leave; |
211 |
|
|
} |
212 |
|
|
dwVersion = (pKeySizes->dwVersion == 0) ? 1 : pKeySizes->dwVersion; |
213 |
|
|
if ( dwVersion != CARD_KEY_SIZES_CURRENT_VERSION ) |
214 |
|
|
{ |
215 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"dwVersion == %d", pKeySizes->dwVersion); |
216 |
|
|
dwReturn = ERROR_REVISION_MISMATCH; |
217 |
|
|
__leave; |
218 |
|
|
} |
219 |
vletoux |
8 |
dwReturn = CheckContext(pCardData); |
220 |
|
|
if ( dwReturn) |
221 |
|
|
{ |
222 |
|
|
__leave; |
223 |
|
|
} |
224 |
vletoux |
1 |
switch(dwKeySpec) |
225 |
|
|
{ |
226 |
|
|
case AT_ECDHE_P256 : |
227 |
|
|
case AT_ECDHE_P384 : |
228 |
|
|
case AT_ECDHE_P521 : |
229 |
|
|
case AT_ECDSA_P256 : |
230 |
|
|
case AT_ECDSA_P384 : |
231 |
|
|
case AT_ECDSA_P521 : |
232 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"dwKeySpec == %d", dwKeySpec); |
233 |
|
|
dwReturn = SCARD_E_UNSUPPORTED_FEATURE; |
234 |
|
|
__leave; |
235 |
|
|
break; |
236 |
|
|
case AT_KEYEXCHANGE: |
237 |
|
|
case AT_SIGNATURE : |
238 |
|
|
break; |
239 |
|
|
default: |
240 |
|
|
Trace(WINEVENT_LEVEL_ERROR, L"dwKeySpec == %d", dwKeySpec); |
241 |
|
|
dwReturn = SCARD_E_INVALID_PARAMETER; |
242 |
|
|
__leave; |
243 |
|
|
break; |
244 |
|
|
} |
245 |
|
|
|
246 |
|
|
pKeySizes->dwMinimumBitlen = 1024; |
247 |
|
|
pKeySizes->dwDefaultBitlen = 2048; |
248 |
|
|
pKeySizes->dwMaximumBitlen = 2048; |
249 |
|
|
pKeySizes->dwIncrementalBitlen = 0; |
250 |
|
|
} |
251 |
|
|
__finally |
252 |
|
|
{ |
253 |
|
|
} |
254 |
|
|
Trace(WINEVENT_LEVEL_VERBOSE, L"dwReturn = 0x%08X",dwReturn); |
255 |
|
|
return dwReturn; |
256 |
|
|
} |
257 |
|
|
|
258 |
|
|
|
259 |
|
|
/** The CardConstructDHAgreement function performs a secret agreement calculation |
260 |
|
|
for Diffie Hellman (DH) key exchange by using a private key that is present on the |
261 |
|
|
card. For RSA-only card minidrivers, this entry point is not defined and is set to |
262 |
|
|
NULL in the CARD_DATA structure that is returned from CardAcquireContext. |
263 |
|
|
The CARD_DH_AGREEMENT structure changes to allow for return of a handle to |
264 |
|
|
the agreed secret. This raises a point about how to index the DH agreement |
265 |
|
|
on the card in an opaque manner. Maintaining a map file is unnecessary because |
266 |
|
|
Ncrypt makes no provision for persistent DH agreements and there is no way to |
267 |
|
|
retrieve one after a provider is closed. DH agreements are addressable on card |
268 |
|
|
through an opaque BYTE that the card minidriver maintains. This BYTE should be |
269 |
|
|
associated with a handle to a card-side agreement.*/ |
270 |
|
|
|
271 |
|
|
DWORD WINAPI CardConstructDHAgreement( |
272 |
|
|
__in PCARD_DATA pCardData, |
273 |
|
|
__inout PCARD_DH_AGREEMENT_INFO pSecretInfo |
274 |
|
|
) |
275 |
|
|
{ |
276 |
|
|
Trace(WINEVENT_LEVEL_VERBOSE, L"Enter"); |
277 |
|
|
return SCARD_E_UNSUPPORTED_FEATURE; |
278 |
|
|
} |
279 |
|
|
|
280 |
|
|
/** The key derivation structure represents the majority of the required changes |
281 |
|
|
for FIPS 140-2 compliance for smart cards. It holds the requested key derivation |
282 |
|
|
function (KDF) and the associated input. The KDFs are defined in the CNG Reference |
283 |
|
|
documentation on MSDN. For RSA-only card minidrivers, this entry point is not defined |
284 |
|
|
and is set to NULL in the CARD_DATA structure that is returned from CardAcquireContext.*/ |
285 |
|
|
|
286 |
|
|
DWORD WINAPI CardDeriveKey( |
287 |
|
|
__in PCARD_DATA pCardData, |
288 |
|
|
__inout PCARD_DERIVE_KEY pAgreementInfo |
289 |
|
|
) |
290 |
|
|
{ |
291 |
|
|
Trace(WINEVENT_LEVEL_VERBOSE, L"Enter"); |
292 |
|
|
return SCARD_E_UNSUPPORTED_FEATURE; |
293 |
|
|
} |
294 |
|
|
|
295 |
|
|
/** The CardDestroyDHAgreement function removes an agreed secret from the card. |
296 |
|
|
For RSA-only card minidrivers, this entry point is not defined and is set to |
297 |
|
|
NULL in the CARD_DATA structure that was returned from CardAcquireContext.*/ |
298 |
|
|
|
299 |
|
|
DWORD WINAPI CardDestroyDHAgreement( |
300 |
|
|
__in PCARD_DATA pCardData, |
301 |
|
|
__in BYTE bSecretAgreementIndex, |
302 |
|
|
__in DWORD dwFlags |
303 |
|
|
) |
304 |
|
|
{ |
305 |
|
|
Trace(WINEVENT_LEVEL_VERBOSE, L"Enter"); |
306 |
|
|
return SCARD_E_UNSUPPORTED_FEATURE; |
307 |
|
|
} |