1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
|
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
*/
/**
* \file KMSAgentChallenge.h
*/
#ifndef KMSAagentChallenge_H
#define KMSAagentChallenge_H
/**
* computes the response to the KMA's challenge using
* HMAC-SHA1( RootCACertificate || AuthenticationChallenge,
* AuthenticationSecret ). The AuthenticationSecret is
* used as the key in the HMAC-SHA1 computation.
*
* @param i_pAuthenticationSecret
* @param i_iAuthenticationSecretLength
* @param i_pRootCACertificate
* @param i_iRootCACertificateLength
* @param i_pAuthenticationChallenge
* @param i_iAuthenticationChallengeLength
* @param o_pAuthenticationChallengeResponse
* @param i_iAuthenticationChallengeResponseLength
*
* @return boolean success indicator
*/
bool ComputeChallengeResponse(
const unsigned char* i_pAuthenticationSecret,
int i_iAuthenticationSecretLength,
const unsigned char* i_pRootCACertificate,
int i_iRootCACertificateLength,
const unsigned char* i_pAuthenticationChallenge,
int i_iAuthenticationChallengeLength,
unsigned char* o_pAuthenticationChallengeResponse,
int i_iAuthenticationChallengeResponseLength );
/**
* computes the SHA1 hash of the specified passphrase.
* The number of SHA1 iterations
* is recorded in <code>o_iAuthenticationHashIterationCount</code> and the result
* stored in o_sHexAuthenticationSecret as a UTF8 hex string.
* HexAuthenticationSecret is SHA1( SHA1( ... ( SHA1( HashedPassphrase ) ) )
* The number of iterations is time bounded at 1/10 of a second, and also
* bounded by fixed minimum and maximum values (to prevent too weak of a
* computation and to prevent a DoS, respectively).
* This value is used as the shared secret in challenge-response
* authentication exchanges.
* @param i_sPassphrase the passphrase to be hashed
* @param o_sHexHashedPassphrase the hashed passphrase
* returned in UTF8 hexadecimal, this
* buffer should be at least
* 2*HASH_LENGTH+1 bytes
* @param o_iAuthenticationHashIterationCount
* @param o_sHexAuthenticationSecret
*
* @return boolean success indicator
*/
bool ComputeEntityHashedPassphraseAndAuthenticationSecret(
const char* const i_sPassphrase,
char* const o_sHexHashedPassphrase,
int* const o_piAuthenticationHashIterationCount,
char* const o_sHexAuthenticationSecret );
/**
* computes the SHA1 hash of the specified passphrase. The SHA1 is
* performed a "fixed" number of times as specified by
* <code>i_iAuthenticationHashIterationCount</code>.
*
* @param i_sPassphrase the passprhase to be SHA1 hashed
* @param o_sHexHashedPassphrase the SHA1 hash
* of i_sPassphrase stored as a UTF8 hex string
* @param i_iAuthenticationHashIterationCount the number
* of times to SHA1 hash the passphrase
* @param o_sHexAuthenticationSecret the passphrase hashed
* the fixed number of times and stored as a UTF8
* hex string
*
* @return boolean success indicator
*/
bool ComputeFixedEntityHashedPassphraseAndAuthenticationSecret(
const char* i_sPassphrase,
char* const o_sHexHashedPassphrase,
int i_iAuthenticationHashIterationCount,
char* const o_sHexAuthenticationSecret );
#endif /* KMSAagentChallenge_H */
|
