1 2 /* 3 * COPYRIGHT (C) 2006 4 * THE REGENTS OF THE UNIVERSITY OF MICHIGAN 5 * ALL RIGHTS RESERVED 6 * 7 * Permission is granted to use, copy, create derivative works 8 * and redistribute this software and such derivative works 9 * for any purpose, so long as the name of The University of 10 * Michigan is not used in any advertising or publicity 11 * pertaining to the use of distribution of this software 12 * without specific, written prior authorization. If the 13 * above copyright notice or any other identification of the 14 * University of Michigan is included in any copy of any 15 * portion of this software, then the disclaimer below must 16 * also be included. 17 * 18 * THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION 19 * FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY 20 * PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF 21 * MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING 22 * WITHOUT LIMITATION THE IMPLIED WARRANTIES OF 23 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE 24 * REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE 25 * FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR 26 * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING 27 * OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN 28 * IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGES. 30 */ 31 32 #ifndef _KRB5_INT_PKINIT_H 33 #define _KRB5_INT_PKINIT_H 34 35 /* 36 * pkinit structures 37 */ 38 39 /* PKAuthenticator */ 40 typedef struct _krb5_pk_authenticator { 41 krb5_int32 cusec; /* (0..999999) */ 42 krb5_timestamp ctime; 43 krb5_int32 nonce; /* (0..4294967295) */ 44 krb5_checksum paChecksum; 45 } krb5_pk_authenticator; 46 47 /* PKAuthenticator draft9 */ 48 typedef struct _krb5_pk_authenticator_draft9 { 49 krb5_principal kdcName; 50 krb5_octet_data kdcRealm; 51 krb5_int32 cusec; /* (0..999999) */ 52 krb5_timestamp ctime; 53 krb5_int32 nonce; /* (0..4294967295) */ 54 } krb5_pk_authenticator_draft9; 55 56 /* AlgorithmIdentifier */ 57 typedef struct _krb5_algorithm_identifier { 58 krb5_octet_data algorithm; /* OID */ 59 krb5_octet_data parameters; /* Optional */ 60 } krb5_algorithm_identifier; 61 62 /* SubjectPublicKeyInfo */ 63 typedef struct _krb5_subject_pk_info { 64 krb5_algorithm_identifier algorithm; 65 krb5_octet_data subjectPublicKey; /* BIT STRING */ 66 } krb5_subject_pk_info; 67 68 /* AuthPack */ 69 typedef struct _krb5_auth_pack { 70 krb5_pk_authenticator pkAuthenticator; 71 krb5_subject_pk_info *clientPublicValue; /* Optional */ 72 krb5_algorithm_identifier **supportedCMSTypes; /* Optional */ 73 krb5_octet_data clientDHNonce; /* Optional */ 74 } krb5_auth_pack; 75 76 /* AuthPack draft9 */ 77 typedef struct _krb5_auth_pack_draft9 { 78 krb5_pk_authenticator_draft9 pkAuthenticator; 79 krb5_subject_pk_info *clientPublicValue; /* Optional */ 80 } krb5_auth_pack_draft9; 81 82 /* ExternalPrincipalIdentifier */ 83 typedef struct _krb5_external_principal_identifier { 84 krb5_octet_data subjectName; /* Optional */ 85 krb5_octet_data issuerAndSerialNumber; /* Optional */ 86 krb5_octet_data subjectKeyIdentifier; /* Optional */ 87 } krb5_external_principal_identifier; 88 89 /* TrustedCas */ 90 typedef struct _krb5_trusted_ca { 91 enum { 92 choice_trusted_cas_UNKNOWN = -1, 93 choice_trusted_cas_principalName = 0, 94 choice_trusted_cas_caName = 1, 95 choice_trusted_cas_issuerAndSerial = 2 96 } choice; 97 union { 98 krb5_principal principalName; 99 krb5_octet_data caName; /* fully-qualified X.500 "Name" as defined by X.509 (der-encoded) */ 100 krb5_octet_data issuerAndSerial; /* Optional -- IssuerAndSerialNumber (der-encoded) */ 101 } u; 102 } krb5_trusted_ca; 103 104 /* typed data */ 105 typedef struct _krb5_typed_data { 106 krb5_magic magic; 107 krb5_int32 type; 108 unsigned int length; 109 krb5_octet *data; 110 } krb5_typed_data; 111 112 /* PA-PK-AS-REQ (Draft 9 -- PA TYPE 14) */ 113 typedef struct _krb5_pa_pk_as_req_draft9 { 114 krb5_octet_data signedAuthPack; 115 krb5_trusted_ca **trustedCertifiers; /* Optional array */ 116 krb5_octet_data kdcCert; /* Optional */ 117 krb5_octet_data encryptionCert; 118 } krb5_pa_pk_as_req_draft9; 119 120 /* PA-PK-AS-REQ (rfc4556 -- PA TYPE 16) */ 121 typedef struct _krb5_pa_pk_as_req { 122 krb5_octet_data signedAuthPack; 123 krb5_external_principal_identifier **trustedCertifiers; /* Optional array */ 124 krb5_octet_data kdcPkId; /* Optional */ 125 } krb5_pa_pk_as_req; 126 127 /* DHRepInfo */ 128 typedef struct _krb5_dh_rep_info { 129 krb5_octet_data dhSignedData; 130 krb5_octet_data serverDHNonce; /* Optional */ 131 } krb5_dh_rep_info; 132 133 /* KDCDHKeyInfo */ 134 typedef struct _krb5_kdc_dh_key_info { 135 krb5_octet_data subjectPublicKey; /* BIT STRING */ 136 krb5_int32 nonce; /* (0..4294967295) */ 137 krb5_timestamp dhKeyExpiration; /* Optional */ 138 } krb5_kdc_dh_key_info; 139 140 /* KDCDHKeyInfo draft9*/ 141 typedef struct _krb5_kdc_dh_key_info_draft9 { 142 krb5_octet_data subjectPublicKey; /* BIT STRING */ 143 krb5_int32 nonce; /* (0..4294967295) */ 144 } krb5_kdc_dh_key_info_draft9; 145 146 /* ReplyKeyPack */ 147 typedef struct _krb5_reply_key_pack { 148 krb5_keyblock replyKey; 149 krb5_checksum asChecksum; 150 } krb5_reply_key_pack; 151 152 /* ReplyKeyPack */ 153 typedef struct _krb5_reply_key_pack_draft9 { 154 krb5_keyblock replyKey; 155 krb5_int32 nonce; 156 } krb5_reply_key_pack_draft9; 157 158 /* PA-PK-AS-REP (Draft 9 -- PA TYPE 15) */ 159 typedef struct _krb5_pa_pk_as_rep_draft9 { 160 enum { 161 choice_pa_pk_as_rep_draft9_UNKNOWN = -1, 162 choice_pa_pk_as_rep_draft9_dhSignedData = 0, 163 choice_pa_pk_as_rep_draft9_encKeyPack = 1 164 } choice; 165 union { 166 krb5_octet_data dhSignedData; 167 krb5_octet_data encKeyPack; 168 } u; 169 } krb5_pa_pk_as_rep_draft9; 170 171 /* PA-PK-AS-REP (rfc4556 -- PA TYPE 17) */ 172 typedef struct _krb5_pa_pk_as_rep { 173 enum { 174 choice_pa_pk_as_rep_UNKNOWN = -1, 175 choice_pa_pk_as_rep_dhInfo = 0, 176 choice_pa_pk_as_rep_encKeyPack = 1 177 } choice; 178 union { 179 krb5_dh_rep_info dh_Info; 180 krb5_octet_data encKeyPack; 181 } u; 182 } krb5_pa_pk_as_rep; 183 184 /* 185 * Begin "asn1.h" 186 */ 187 188 /************************************************************************* 189 * Prototypes for pkinit asn.1 encode routines 190 *************************************************************************/ 191 192 krb5_error_code encode_krb5_pa_pk_as_req 193 (const krb5_pa_pk_as_req *rep, krb5_data **code); 194 195 krb5_error_code encode_krb5_pa_pk_as_req_draft9 196 (const krb5_pa_pk_as_req_draft9 *rep, krb5_data **code); 197 198 krb5_error_code encode_krb5_pa_pk_as_rep 199 (const krb5_pa_pk_as_rep *rep, krb5_data **code); 200 201 krb5_error_code encode_krb5_pa_pk_as_rep_draft9 202 (const krb5_pa_pk_as_rep_draft9 *rep, krb5_data **code); 203 204 krb5_error_code encode_krb5_auth_pack 205 (const krb5_auth_pack *rep, krb5_data **code); 206 207 krb5_error_code encode_krb5_auth_pack_draft9 208 (const krb5_auth_pack_draft9 *rep, krb5_data **code); 209 210 krb5_error_code encode_krb5_kdc_dh_key_info 211 (const krb5_kdc_dh_key_info *rep, krb5_data **code); 212 213 krb5_error_code encode_krb5_reply_key_pack 214 (const krb5_reply_key_pack *, krb5_data **code); 215 216 krb5_error_code encode_krb5_reply_key_pack_draft9 217 (const krb5_reply_key_pack_draft9 *, krb5_data **code); 218 219 krb5_error_code encode_krb5_typed_data 220 (const krb5_typed_data **, krb5_data **code); 221 222 krb5_error_code encode_krb5_td_trusted_certifiers 223 (const krb5_external_principal_identifier **, krb5_data **code); 224 225 krb5_error_code encode_krb5_td_dh_parameters 226 (const krb5_algorithm_identifier **, krb5_data **code); 227 228 /************************************************************************* 229 * Prototypes for pkinit asn.1 decode routines 230 *************************************************************************/ 231 232 krb5_error_code decode_krb5_pa_pk_as_req 233 (const krb5_data *, krb5_pa_pk_as_req **); 234 235 krb5_error_code decode_krb5_pa_pk_as_req_draft9 236 (const krb5_data *, krb5_pa_pk_as_req_draft9 **); 237 238 krb5_error_code decode_krb5_pa_pk_as_rep 239 (const krb5_data *, krb5_pa_pk_as_rep **); 240 241 krb5_error_code decode_krb5_pa_pk_as_rep_draft9 242 (const krb5_data *, krb5_pa_pk_as_rep_draft9 **); 243 244 krb5_error_code decode_krb5_auth_pack 245 (const krb5_data *, krb5_auth_pack **); 246 247 krb5_error_code decode_krb5_auth_pack_draft9 248 (const krb5_data *, krb5_auth_pack_draft9 **); 249 250 krb5_error_code decode_krb5_kdc_dh_key_info 251 (const krb5_data *, krb5_kdc_dh_key_info **); 252 253 krb5_error_code decode_krb5_principal_name 254 (const krb5_data *, krb5_principal_data **); 255 256 krb5_error_code decode_krb5_reply_key_pack 257 (const krb5_data *, krb5_reply_key_pack **); 258 259 krb5_error_code decode_krb5_reply_key_pack_draft9 260 (const krb5_data *, krb5_reply_key_pack_draft9 **); 261 262 krb5_error_code decode_krb5_typed_data 263 (const krb5_data *, krb5_typed_data ***); 264 265 krb5_error_code decode_krb5_td_trusted_certifiers 266 (const krb5_data *, krb5_external_principal_identifier ***); 267 268 krb5_error_code decode_krb5_td_dh_parameters 269 (const krb5_data *, krb5_algorithm_identifier ***); 270 271 #endif /* _KRB5_INT_PKINIT_H */ 272