Skip to content

Commit 4f4e596

Browse files
committed
wolfKeyMgr v0.2
* Fixes for threading. * Added libwolfkeymgr for general use API's. * Added ETSI client API's * Added full HTTP server/client support. * Abstraction of all modules to library for generic socket, TLS, HTTP and ETSI functions. * Added non-blocking support for client. * Added version header * Improvement to performance.
1 parent 4ca1fe8 commit 4f4e596

33 files changed

+1985
-2344
lines changed

.gitignore

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,18 +25,19 @@ stamp-h1
2525
*.log
2626
*.trs
2727
aminclude.am
28+
*.lo
29+
*.la
30+
*.libs
2831

2932
# misc
3033
tags
31-
cert.pid
34+
wolfkeymgr.pid
3235
response.pem
3336
dump.der
3437
diff
3538

3639
# applications
37-
examples/cert_client/cert_client
40+
src/wolfkeymgr
3841
examples/etsi_client/etsi_client
3942
libtool
4043
src/options.h
41-
settings.json
42-
src/wolfkeymgr

Makefile.am

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,13 @@ check_SCRIPTS =
2323
DISTCLEANFILES+= aminclude.am
2424

2525
ACLOCAL_AMFLAGS = -I m4
26-
EXTRA_DIST += README test-key.pem test-cert.pem
26+
EXTRA_DIST += README.md
27+
EXTRA_DIST += LICENSE
2728

2829
include src/include.am
29-
include examples/cert_client/include.am
3030
include examples/etsi_client/include.am
3131
include scripts/include.am
32+
include certs/include.am
3233

3334
check_SCRIPTS+= $(dist_noinst_SCRIPTS)
3435

README.md

Lines changed: 64 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -1,107 +1,43 @@
11
# wolf Key Manager
22

3-
This is an secure service for Key and Certificate management.
3+
This is a secure service for Key management using ETSI specification.
4+
5+
For a demo package showing use with Apache httpd and the wolfSSL sniffer please email [email protected].
6+
7+
## Design
48

59
Based on:
610
* ETSI TS 103 523-3 V1.3.1 (2019-08)
711
* IETF RFC 5958
812

913
## Features
1014

11-
* Protection of key material / sensitive data:
12-
* Provisioning keys using an asymmetric key package request
13-
* Provisioning a trusted certificate using a CSR.
14-
15-
## Design
16-
15+
* Generation of keys using an asymmetric key package request
1716
* Low level socket handling using libevent, which is a portable framework for handling sockets.
18-
* An HTTPS server supports GET requests using HTTP/1.1.
19-
* A TLS server supports custom commands for CSR signing and Generic hash signatures using a trusted CA.
17+
* HTTPS server supports GET/PUT requests using HTTP/1.1.
2018
* The CA key can be local PKCS #8 (simple password/encrypted), PKCS #11 HSM or TPM 2.0.
21-
* Generated key and certificate material is encrypted with AES XTS and indexed.
22-
* Uses stdint.h types.
2319
* TLS v1.3 is used for securing connections to server
2420

2521
## Layout of files
2622

2723
* keymanager.c: The main entry point
2824
* sock_mgr.c: The libevent socket manager
29-
* svc_[]: Services exposed (ETSI or CERT)
30-
* mod_[]: Modules for support (HTTPS)
25+
* svc_[]: Services exposed (ETSI)
26+
* mod_[]: Modules for support (HTTP, TLS, Socket, ETSI)
3127
* wkm_[]: Generic wolfKeyManager functions
3228

3329
## ETSI Design
3430

3531
Server Side
36-
1) KeyGen (Gen Key)
32+
1) KeyGen (Gen Key). Currently ECC SECP25R1 only.
3733
2) Formatting the KeyGen (asymmetric key package)
3834
3) Sending Wire format (HTTPS)
35+
4) Key expiration and notification of new key to peers
3936

4037
Client side
41-
1) Unbundling format
42-
2) Unbundling key gen
43-
44-
## ETSI (Enterprise Transport Security)
45-
46-
### ETSI GET Request Case 1
47-
48-
`GET /.well-known/enterprise-transport-security/keys?fingerprints=[fingerprints]`, where:
49-
50-
a) `fingerprints` shall be present and its value, `[fingerprints]`, shall be either empty or shall be a comma-separated list of the hexadecimal string representation where each entry in the list is the static Diffie-Hellman public key fingerprint, as defined in clause 4.3.3, for which the corresponding public/private key pairs are being requested.
51-
52-
b) The key manager shall return a key package that contains the corresponding public/private key pair for each fingerprint for which it has a record. In the unlikely case that the key manager has more than one public/private key pair corresponding to a given fingerprint, it shall return all of them in the key package. If `[fingerprints]` is empty, the actions of the implementation are out of scope of the present document.
53-
54-
c) The key manager shall return an appropriate HTTP error code if there is not at least one matching public/private key pair [12].
55-
56-
Example:
57-
58-
```
59-
GET /.well-known/enterprise-transport-security/keys?fingerprints=00010203040506070809,09080706050403020100
60-
Accept: application/pkcs8, application/cms
61-
```
62-
63-
### ETSI GET Request Case 2
64-
65-
`GET /.well-known/enterprise-transport-security/keys?groups=[groups]&certs=[sigalgs]&context=contextstr`, where:
66-
67-
a) `groups` shall be non-empty and its value, `[groups]`, shall be a comma-separated list where each entry in the list is a NamedGroup value defined in clause 4.2.7 in IETF RFC 8446 [2], represented in hexadecimal notation, for which an associated static Diffie-Hellman key pair is being requested.
68-
69-
b) `certs` may be included. If certs is included, its value, `[sigalgs]`, shall be a comma-separated list where each entry is a colon-separated pair of SignatureScheme values defined in clause B.3.1.3 in IETF RFC 8446 [2], in hexadecimal notation. The first value in the pair shall indicate the requested algorithm for the certificate issuer to use to sign the certificate. The second value in the pair shall indicate the requested algorithm to be used to generate the certificate subject's signing key pair. If certs is included, then for each entry in the list, the key consumer shall request one additional server certificate using that scheme, which is bound to all returned key pairs. If certs is not included, then no certificates are being requested, and so none shall be provided by the key manager.
70-
71-
c) `context` may be included. If `context` is included, its value, contextstr, is a free string that the key manager shall use to determine what key pair and certificate contents to return. The structure of contextstr is not specified in the present document.
72-
73-
d) The key manager shall return a key package containing a static Diffie-Hellman key pair for each group listed in `[groups]` that the key manager supports. For each static Diffie-Hellman key pair in the key package, the key manager shall also return a corresponding server certificate for each given signature algorithm pair listed in `[sigalgs]` that it supports.
74-
75-
e) If no group in `[groups]` is supported by the key manager, the key manager shall return an appropriate HTTP error code as defined in clause 6 of IETF RFC 7231 [12]. If the key manager is unable to use contextstr, the key manager may return an appropriate HTTP error code, as defined in clause 6 of IETF RFC 7231 [12], or it may handle the error itself in a way outside the scope of the present document.
76-
77-
Example:
78-
79-
```
80-
GET /.well-known/enterprise-transport-security/keys?groups=0x0018,0x001d&certs=0x0401:0x0809,0x0503:0x0503
81-
Accept: application/pkcs8
82-
```
83-
84-
### ETSI Push (HTTPS PUT)
85-
86-
The key consumer shall support receiving a key package via an HTTP PUT request to a request-target, given here in origin-form, of `/enterprise-transport-security/keys`.
87-
88-
89-
## Asymmetric Key Packages (RFC 5958)
90-
91-
When an Enterprise Transport Security static Diffie-Hellman public/private key pair are sent from the key manager to a key consumer, they shall be packaged using the Asymmetric Key Package defined in IETF RFC 5958 [3]. Each Asymmetric Key Package shall contain one or more OneAsymmetricKey elements. Such an element will be one of either:
92-
93-
a) a static Diffie-Hellman key pair, hereafter referred to as Type A elements; or
94-
b) a private signing key and a certificate, hereafter referred to as Type B elements.
95-
96-
First the case is defined where elements are static Diffie-Hellman key pairs, and so the Asymmetric Key Package shall contain fields and attributes pertaining to these key pairs, defined below. Though certificates are not sent in the same OneAsymmetricKey element as a static key pair, each Asymmetric Key Package may contain one or more Type B elements (server certificates and corresponding private signing keys). Where such Type B elements are sent, all certificates in the Asymmetric Key Package shall be bound to all of the static Diffie-Hellman key pairs in the Asymmetric Key Package. The use of multiple certificates is intended for the situation where it is necessary to provide certificates with different signature algorithms.
97-
With reference to clause 2 of IETF RFC 5958 [3], the Type A OneAsymmetricKey element used to store each key pair
98-
in the Asymmetric Key Package shall have the following fields set as follows:
99-
100-
1) Version shall be set to version 2 (integer value of 1).
101-
2) privateKeyAlgorithm shall be set to the key pair algorithm identifier (see below).
102-
3) privateKey shall be set to the Diffie-Hellman private key encoded as an octet string.
103-
4) publicKey shall be set to the Diffie-Hellman public key encoded as a bit string.
104-
5) Attributes shall include a validity period for the key pair using the attribute defined in clause 15 of IETF RFC 7906 [4].
38+
1) Generating ETSI HTTP request
39+
2) Parsing HTTP response
40+
3) Unbundling asymmetric key
10541

10642

10743
## Installation
@@ -148,14 +84,56 @@ $ sudo make install
14884

14985
Note: A custom install location can be specified using: `./configure --prefix=/opt/local`
15086

151-
## Running
87+
## Running ETSI Example
15288

15389
```
15490
$ ./src/wolfkeymgr
155-
$ ./examples/cert_client/cert_client
91+
$ ./examples/etsi_client/etsi_client
15692
```
15793

158-
## Server Certificate Visibility
94+
95+
## ETSI (Enterprise Transport Security)
96+
97+
### ETSI Request Case (HTTPS GET)
98+
99+
`GET /.well-known/enterprise-transport-security/keys?fingerprints=[fingerprints]`, where:
100+
101+
a) `fingerprints` shall be present and its value, `[fingerprints]`, shall be either empty or shall be a comma-separated list of the hexadecimal string representation where each entry in the list is the static Diffie-Hellman public key fingerprint, as defined in clause 4.3.3, for which the corresponding public/private key pairs are being requested.
102+
103+
b) The key manager shall return a key package that contains the corresponding public/private key pair for each fingerprint for which it has a record. In the unlikely case that the key manager has more than one public/private key pair corresponding to a given fingerprint, it shall return all of them in the key package. If `[fingerprints]` is empty, the actions of the implementation are out of scope of the present document.
104+
105+
c) The key manager shall return an appropriate HTTP error code if there is not at least one matching public/private key pair [12].
106+
107+
Example:
108+
109+
```
110+
GET /.well-known/enterprise-transport-security/keys?fingerprints=00010203040506070809,09080706050403020100
111+
Accept: application/pkcs8, application/cms
112+
```
113+
114+
### ETSI Push (HTTPS PUT)
115+
116+
The key consumer shall support receiving a key package via an HTTP PUT request to a request-target, given here in origin-form, of `/enterprise-transport-security/keys`.
117+
118+
119+
### Asymmetric Key Packages (RFC 5958)
120+
121+
When an Enterprise Transport Security static Diffie-Hellman public/private key pair are sent from the key manager to a key consumer, they shall be packaged using the Asymmetric Key Package defined in IETF RFC 5958 [3]. Each Asymmetric Key Package shall contain one or more OneAsymmetricKey elements. Such an element will be one of either:
122+
123+
a) a static Diffie-Hellman key pair, hereafter referred to as Type A elements; or
124+
b) a private signing key and a certificate, hereafter referred to as Type B elements.
125+
126+
First the case is defined where elements are static Diffie-Hellman key pairs, and so the Asymmetric Key Package shall contain fields and attributes pertaining to these key pairs, defined below. Though certificates are not sent in the same OneAsymmetricKey element as a static key pair, each Asymmetric Key Package may contain one or more Type B elements (server certificates and corresponding private signing keys). Where such Type B elements are sent, all certificates in the Asymmetric Key Package shall be bound to all of the static Diffie-Hellman key pairs in the Asymmetric Key Package. The use of multiple certificates is intended for the situation where it is necessary to provide certificates with different signature algorithms.
127+
With reference to clause 2 of IETF RFC 5958 [3], the Type A OneAsymmetricKey element used to store each key pair
128+
in the Asymmetric Key Package shall have the following fields set as follows:
129+
130+
1) Version shall be set to version 2 (integer value of 1).
131+
2) privateKeyAlgorithm shall be set to the key pair algorithm identifier (see below).
132+
3) privateKey shall be set to the Diffie-Hellman private key encoded as an octet string.
133+
4) publicKey shall be set to the Diffie-Hellman public key encoded as a bit string.
134+
5) Attributes shall include a validity period for the key pair using the attribute defined in clause 15 of IETF RFC 7906 [4].
135+
136+
### Server Certificate Visibility
159137

160138
The ETSI specification part 3 section 4.3.3 requires the TLS server to present a "visibility" information field indicating "Enterrpise Transport Security" is being used.
161139

@@ -169,6 +147,11 @@ where the SHA-256 digest of the static Diffie-Hellman public key as transmitted
169147

170148
See Recommendation ITU-T X.509 (10/2016) | ISO/IEC 9594-8: "Information technology - Open Systems Interconnection - The Directory: Public-key and attribute certificate frameworks".
171149

150+
## Outstanding Features
151+
152+
1) Add TLS mutual authentication to ETSI example.
153+
2) Add example for HTTP server "VisibilityInformation" extension.
154+
172155
## Support
173156

174157
For questions or to request an evaluation package please email [email protected]

certs/include.am

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# vim:ft=automake
2+
# included from Top Level Makefile.am
3+
# All paths should be given relative to the root
4+
5+
6+
EXTRA_DIST += certs/test-cert.pem
7+
EXTRA_DIST += certs/test-cert.sh
8+
EXTRA_DIST += certs/test-key.pem

configure.ac

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
AC_PREREQ(2.59)
77

8-
AC_INIT([wolfKeyManager],[0.1],[http://www.wolfssl.com])
8+
AC_INIT([wolfKeyManager],[0.2],[http://www.wolfssl.com])
99
AC_CONFIG_AUX_DIR(config)
1010
AC_CONFIG_HEADERS([src/config.h])
1111
AC_CONFIG_MACRO_DIR(m4)
@@ -71,7 +71,7 @@ LT_PREREQ([2.2])
7171
LT_INIT([disable-static win32-dll])
7272

7373
# Shared library versioning
74-
WOLFKM_LIBRARY_VERSION=1:0:0
74+
WOLFKM_LIBRARY_VERSION=2:0:0
7575
# | | |
7676
# +------+ | +---+
7777
# | | |
@@ -122,18 +122,6 @@ esac
122122
LIB_SOCKET_NSL
123123

124124

125-
# Certificate Service
126-
AC_ARG_ENABLE([certsvc],
127-
[AS_HELP_STRING([--enable-certsvc],[Enable the Certificate service (default: disabled)])],
128-
[ ENABLED_CERT_SERVICE=$enableval ],
129-
[ ENABLED_CERT_SERVICE=no ]
130-
)
131-
132-
if test "x$ENABLED_CERT_SERVICE" = "xyes"
133-
then
134-
CFLAGS="$CFLAGS -DWOLFKM_CERT_SERVICE"
135-
fi
136-
137125
# ETSI Service
138126
AC_ARG_ENABLE([etsisvc],
139127
[AS_HELP_STRING([--enable-etsisvc],[Enable the ETSI key service (default: enabled)])],
@@ -151,11 +139,11 @@ fi
151139
# The following AM_CONDITIONAL statements set flags for use in the Makefiles.
152140
# Some of these affect build targets and objects, some trigger different
153141
# test scripts for make check.
154-
AM_CONDITIONAL([BUILD_CERT_SERVICE],[test "x$ENABLED_CERT_SERVICE" = "xyes"])
142+
AM_CONDITIONAL([BUILD_ETSI_SERVICE],[test "x$ENABLED_ETSI_SERVICE" = "xyes"])
155143

156144

157145
# FINAL
158-
AC_CONFIG_FILES([Makefile src/options.h])
146+
AC_CONFIG_FILES([Makefile src/options.h src/version.h])
159147

160148
AX_AM_JOBSERVER([yes])
161149

@@ -250,5 +238,4 @@ echo " * CPP Flags: $CPPFLAGS"
250238
echo " * LIB Flags: $LIB"
251239
echo " * Debug enabled: $ax_enable_debug"
252240

253-
echo " * Certificate Service $ENABLED_CERT_SERVICE"
254241
echo " * ETSI Service $ENABLED_ETSI_SERVICE"

0 commit comments

Comments
 (0)