From 6fd188cefb95cd1b1cf094cc7be248ba42e50ca1 Mon Sep 17 00:00:00 2001 From: Juergen Christ Date: Fri, 10 Sep 2021 13:57:54 +0200 Subject: [PATCH] DOC: Add example policy and strength configurations These files will also be installed automatically via autotools into the correct doc folder (typically /usr/share/doc/opencryptoki). Signed-off-by: Juergen Christ --- Makefile.am | 1 + doc/doc.mk | 7 +++ doc/strength-example.conf | 35 ++++++++++++ tools/policyexamplegen.c | 114 ++++++++++++++++++++++++++++++++++++++ tools/tools.mk | 7 ++- 5 files changed, 162 insertions(+), 2 deletions(-) create mode 100644 doc/doc.mk create mode 100644 doc/strength-example.conf create mode 100644 tools/policyexamplegen.c diff --git a/Makefile.am b/Makefile.am index e447be28..d1dd6ec3 100644 --- a/Makefile.am +++ b/Makefile.am @@ -30,6 +30,7 @@ include man/man.mk include usr/usr.mk include tools/tools.mk +include doc/doc.mk install-data-hook: if ENABLE_LIBRARY diff --git a/doc/doc.mk b/doc/doc.mk new file mode 100644 index 00000000..3d21d5cf --- /dev/null +++ b/doc/doc.mk @@ -0,0 +1,7 @@ +doc_DATA = doc/strength-example.conf +nodist_doc_DATA = doc/policy-example.conf + +doc/policy-example.conf: tools/policyexamplegen + $(AM_V_GEN) $(MKDIR_P) doc && tools/policyexamplegen > doc/policy-example.conf + +EXTRA_DIST += $(doc_DATA) diff --git a/doc/strength-example.conf b/doc/strength-example.conf new file mode 100644 index 00000000..23a18a6d --- /dev/null +++ b/doc/strength-example.conf @@ -0,0 +1,35 @@ +# OpenCryptoki strength example corresponding to NIST recommendations +# See https://www.keylength.com/en/4/ +# Move/copy to /etc/opencryptoki/strength.cfg to use it with opencryptoki. +# Then chown it to root:pkcs11 and chmod it to 0640. + +version strength-0 + +strength 112 { + MOD_EXP = 2048 + ECC = 224 + SYMMETRIC = 112 + digest = 224 + signature = 112 +} +strength 128 { + MOD_EXP = 3072 + ECC = 256 + SYMMETRIC = 128 + digest = 256 + signature = 128 +} +strength 192 { + MOD_EXP = 7680 + ECC = 384 + SYMMETRIC = 192 + digest = 384 + signature = 192 +} +strength 256 { + MOD_EXP = 15360 + ECC = 512 + SYMMETRIC = 256 + digest = 512 + signature = 256 +} diff --git a/tools/policyexamplegen.c b/tools/policyexamplegen.c new file mode 100644 index 00000000..ee71c104 --- /dev/null +++ b/tools/policyexamplegen.c @@ -0,0 +1,114 @@ +/* + * COPYRIGHT (c) International Business Machines Corp. 2021 + * + * This program is provided under the terms of the Common Public License, + * version 1.0 (CPL-1.0). Any use, reproduction or distribution for this + * software constitutes recipient's acceptance of CPL-1.0 terms which can be + * found in the file LICENSE file or at + * https://opensource.org/licenses/cpl1.0.php + */ + +#include + +#include + +#include + +int main(void) +{ + size_t i; + char *line = ""; + + puts("# OpenCryptoki policy example"); + puts("# Move/copy to /etc/opencryptoki/policy.cfg to use it with opencryptoki."); + puts("# Then chown it to root:pkcs11 and chmod it to 0640."); + puts("# Also create a /etc/opencryptoki/strength.cfg since this is a prerequisite"); + puts("# for policies. You could just copy the strength-example.cfg from this"); + puts("# folder, chown it to root:pkcs11 and chmod it to 0640."); + puts(""); + puts("version policy-0"); + puts(""); + puts("# Do not require any specific strength."); + puts("# You probably do not want this!"); + puts("strength = 0"); + puts(""); + puts("# Allow all mechanisms by name."); + puts("# A simpler option to configure this is to just remove the allowedmechs list."); + puts("allowedmechs ("); + for (i = 0; i < MECHTABLE_NUM_ELEMS; ++i) { + fputs(line, stdout); + printf(" %s", mechtable_rows[i].string); + line = ",\n"; + } + putchar('\n'); + puts(" # No comma after last element!"); + puts(")"); + puts(""); + puts("# Allow all elliptic curves."); + puts("# A simpler method to configure this is to just remove the allowedcurves list."); + puts("allowedcurves ("); + puts(" BRAINPOOL_P160R1,"); + puts(" BRAINPOOL_P160T1,"); + puts(" BRAINPOOL_P192R1,"); + puts(" BRAINPOOL_P192T1,"); + puts(" BRAINPOOL_P224R1,"); + puts(" BRAINPOOL_P224T1,"); + puts(" BRAINPOOL_P256R1,"); + puts(" BRAINPOOL_P256T1,"); + puts(" BRAINPOOL_P320R1,"); + puts(" BRAINPOOL_P320T1,"); + puts(" BRAINPOOL_P384R1,"); + puts(" BRAINPOOL_P384T1,"); + puts(" BRAINPOOL_P512R1,"); + puts(" BRAINPOOL_P512T1,"); + puts(" PRIME192V1,"); + puts(" SECP224R1,"); + puts(" PRIME256V1,"); + puts(" SECP384R1,"); + puts(" SECP521R1,"); + puts(" SECP256K1,"); + puts(" CURVE25519,"); + puts(" CURVE448,"); + puts(" ED25519,"); + puts(" ED448"); + puts(" # No comma after last element!"); + puts(")"); + puts(""); + puts("# Allow all MGFs."); + puts("# A simpler method to configure this is to just remove the allowedmgfs list."); + puts("allowedmgfs ("); + puts(" CKG_MGF1_SHA1,"); + puts(" CKG_MGF1_SHA224,"); + puts(" CKG_MGF1_SHA256,"); + puts(" CKG_MGF1_SHA384,"); + puts(" CKG_MGF1_SHA512,"); + puts(" CKG_IBM_MGF1_SHA3_224,"); + puts(" CKG_IBM_MGF1_SHA3_256,"); + puts(" CKG_IBM_MGF1_SHA3_384,"); + puts(" CKG_IBM_MGF1_SHA3_512"); + puts(" # No comma after last element!"); + puts(")"); + puts(""); + puts("# Allow all KDFs."); + puts("# A simpler method to configure this is to just remove the allowedkdfs list."); + puts("allowedkdfs ("); + puts(" CKD_NULL,"); + puts(" CKD_SHA1_KDF,"); + puts(" CKD_SHA1_KDF_ASN1,"); + puts(" CKD_SHA1_KDF_CONCATENATE,"); + puts(" CKD_SHA224_KDF,"); + puts(" CKD_SHA256_KDF,"); + puts(" CKD_SHA384_KDF,"); + puts(" CKD_SHA512_KDF"); + puts(" # No comma after last element!"); + puts(")"); + puts(""); + puts("# Allow all PRFs."); + puts("# A simpler method to configure this is to just remove the allowedprfs list."); + puts("allowedprfs ("); + puts(" CKP_PKCS5_PBKD2_HMAC_SHA256,"); + puts(" CKP_PKCS5_PBKD2_HMAC_SHA512"); + puts(" # No comma after last element!"); + puts(")"); + return 0; +} diff --git a/tools/tools.mk b/tools/tools.mk index 72a8bf79..a0a7ca2c 100644 --- a/tools/tools.mk +++ b/tools/tools.mk @@ -1,4 +1,7 @@ -noinst_PROGRAMS += tools/tableidxgen +noinst_PROGRAMS += tools/tableidxgen tools/policyexamplegen -tools_tableidxgen_SOURCES = tools/tableidxgen.c usr/lib/common/mechtable.inc +tools_tableidxgen_SOURCES = tools/tableidxgen.c usr/lib/api/mechtable.inc tools_tableidxgen_CFLAGS = -I${srcdir}/usr/include -I${srcdir}/usr/lib/api + +tools_policyexamplegen_SOURCES = tools/policyexamplegen.c usr/lib/api/mechtable.c +tools_policyexamplegen_CFLAGS = -I${srcdir}/usr/include -I${srcdir}/usr/lib/api -I${top_builddir}/usr/lib/api