crypt/opencryptoki
1
0
Fork 0
mirror of https://github.com/opencryptoki/opencryptoki.git synced 2026-10-24 05:39:17 +03:00
Code Releases Activity

DOC: Add example policy and strength configurations

Browse Source 
These files will also be installed automatically via autotools into the
correct doc folder (typically /usr/share/doc/opencryptoki).

Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
This commit is contained in:
Juergen Christ
2021-09-10 13:57:54 +02:00
committed by Patrick Steuer
parent c96f608763
commit 6fd188cefb
5 changed files with 162 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Makefile.am
View File

@@ -30,6 +30,7 @@ include man/man.mk
include usr/usr.mk
include tools/tools.mk
include doc/doc.mk
install-data-hook:
if ENABLE_LIBRARY

7
doc/doc.mk Normal file
View File

@@ -0,0 +1,7 @@
doc_DATA = doc/strength-example.conf
nodist_doc_DATA = doc/policy-example.conf
doc/policy-example.conf: tools/policyexamplegen
$(AM_V_GEN) $(MKDIR_P) doc && tools/policyexamplegen > doc/policy-example.conf
EXTRA_DIST += $(doc_DATA)

35
doc/strength-example.conf Normal file
View File

@@ -0,0 +1,35 @@
# OpenCryptoki strength example corresponding to NIST recommendations
# See https://www.keylength.com/en/4/
# Move/copy to /etc/opencryptoki/strength.cfg to use it with opencryptoki.
# Then chown it to root:pkcs11 and chmod it to 0640.
version strength-0
strength 112 {
MOD_EXP = 2048
ECC = 224
SYMMETRIC = 112
digest = 224
signature = 112
}
strength 128 {
MOD_EXP = 3072
ECC = 256
SYMMETRIC = 128
digest = 256
signature = 128
}
strength 192 {
MOD_EXP = 7680
ECC = 384
SYMMETRIC = 192
digest = 384
signature = 192
}
strength 256 {
MOD_EXP = 15360
ECC = 512
SYMMETRIC = 256
digest = 512
signature = 256
}

114
tools/policyexamplegen.c Normal file
View File

@@ -0,0 +1,114 @@
/*
* COPYRIGHT (c) International Business Machines Corp. 2021
*
* This program is provided under the terms of the Common Public License,
* version 1.0 (CPL-1.0). Any use, reproduction or distribution for this
* software constitutes recipient's acceptance of CPL-1.0 terms which can be
* found in the file LICENSE file or at
* https://opensource.org/licenses/cpl1.0.php
*/
#include <stdio.h>
#include <pkcs11types.h>
#include <mechtable.h>
int main(void)
{
size_t i;
char *line = "";
puts("# OpenCryptoki policy example");
puts("# Move/copy to /etc/opencryptoki/policy.cfg to use it with opencryptoki.");
puts("# Then chown it to root:pkcs11 and chmod it to 0640.");
puts("# Also create a /etc/opencryptoki/strength.cfg since this is a prerequisite");
puts("# for policies. You could just copy the strength-example.cfg from this");
puts("# folder, chown it to root:pkcs11 and chmod it to 0640.");
puts("");
puts("version policy-0");
puts("");
puts("# Do not require any specific strength.");
puts("# You probably do not want this!");
puts("strength = 0");
puts("");
puts("# Allow all mechanisms by name.");
puts("# A simpler option to configure this is to just remove the allowedmechs list.");
puts("allowedmechs (");
for (i = 0; i < MECHTABLE_NUM_ELEMS; ++i) {
fputs(line, stdout);
printf(" %s", mechtable_rows[i].string);
line = ",\n";
}
putchar('\n');
puts(" # No comma after last element!");
puts(")");
puts("");
puts("# Allow all elliptic curves.");
puts("# A simpler method to configure this is to just remove the allowedcurves list.");
puts("allowedcurves (");
puts(" BRAINPOOL_P160R1,");
puts(" BRAINPOOL_P160T1,");
puts(" BRAINPOOL_P192R1,");
puts(" BRAINPOOL_P192T1,");
puts(" BRAINPOOL_P224R1,");
puts(" BRAINPOOL_P224T1,");
puts(" BRAINPOOL_P256R1,");
puts(" BRAINPOOL_P256T1,");
puts(" BRAINPOOL_P320R1,");
puts(" BRAINPOOL_P320T1,");
puts(" BRAINPOOL_P384R1,");
puts(" BRAINPOOL_P384T1,");
puts(" BRAINPOOL_P512R1,");
puts(" BRAINPOOL_P512T1,");
puts(" PRIME192V1,");
puts(" SECP224R1,");
puts(" PRIME256V1,");
puts(" SECP384R1,");
puts(" SECP521R1,");
puts(" SECP256K1,");
puts(" CURVE25519,");
puts(" CURVE448,");
puts(" ED25519,");
puts(" ED448");
puts(" # No comma after last element!");
puts(")");
puts("");
puts("# Allow all MGFs.");
puts("# A simpler method to configure this is to just remove the allowedmgfs list.");
puts("allowedmgfs (");
puts(" CKG_MGF1_SHA1,");
puts(" CKG_MGF1_SHA224,");
puts(" CKG_MGF1_SHA256,");
puts(" CKG_MGF1_SHA384,");
puts(" CKG_MGF1_SHA512,");
puts(" CKG_IBM_MGF1_SHA3_224,");
puts(" CKG_IBM_MGF1_SHA3_256,");
puts(" CKG_IBM_MGF1_SHA3_384,");
puts(" CKG_IBM_MGF1_SHA3_512");
puts(" # No comma after last element!");
puts(")");
puts("");
puts("# Allow all KDFs.");
puts("# A simpler method to configure this is to just remove the allowedkdfs list.");
puts("allowedkdfs (");
puts(" CKD_NULL,");
puts(" CKD_SHA1_KDF,");
puts(" CKD_SHA1_KDF_ASN1,");
puts(" CKD_SHA1_KDF_CONCATENATE,");
puts(" CKD_SHA224_KDF,");
puts(" CKD_SHA256_KDF,");
puts(" CKD_SHA384_KDF,");
puts(" CKD_SHA512_KDF");
puts(" # No comma after last element!");
puts(")");
puts("");
puts("# Allow all PRFs.");
puts("# A simpler method to configure this is to just remove the allowedprfs list.");
puts("allowedprfs (");
puts(" CKP_PKCS5_PBKD2_HMAC_SHA256,");
puts(" CKP_PKCS5_PBKD2_HMAC_SHA512");
puts(" # No comma after last element!");
puts(")");
return 0;
}

7
tools/tools.mk
View File

@@ -1,4 +1,7 @@
noinst_PROGRAMS += tools/tableidxgen
noinst_PROGRAMS += tools/tableidxgen tools/policyexamplegen
tools_tableidxgen_SOURCES = tools/tableidxgen.c usr/lib/common/mechtable.inc
tools_tableidxgen_SOURCES = tools/tableidxgen.c usr/lib/api/mechtable.inc
tools_tableidxgen_CFLAGS = -I${srcdir}/usr/include -I${srcdir}/usr/lib/api
tools_policyexamplegen_SOURCES = tools/policyexamplegen.c usr/lib/api/mechtable.c
tools_policyexamplegen_CFLAGS = -I${srcdir}/usr/include -I${srcdir}/usr/lib/api -I${top_builddir}/usr/lib/api