Add support for loading EdDSA keys from PKCS#11 and using them

Signed-off-by: Jakub Jelen <jjelen@redhat.com>

diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index 2ef0e3e02524d030b57d969725d26da4c0d68c15..8b65212a50cd439ff526ced58f7db05675464a04 100644 (file)
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -1897,6 +1897,35 @@ int pkcs11_read_pubkey(struct ck_function_list *module,
                }
 
                break;
+#ifdef HAVE_CKM_EDDSA
+       case CKK_EC_EDWARDS:
+               a[0].type = CKA_EC_PARAMS;
+               a[0].value = tmp1;
+               a[0].value_len = tmp1_size;
+
+               a[1].type = CKA_EC_POINT;
+               a[1].value = tmp2;
+               a[1].value_len = tmp2_size;
+
+               if ((rv = pkcs11_get_attribute_value(module, pks, ctx, a, 2)) ==
+                   CKR_OK) {
+
+                       pobj->pubkey[0].data = a[0].value;
+                       pobj->pubkey[0].size = a[0].value_len;
+
+                       pobj->pubkey[1].data = a[1].value;
+                       pobj->pubkey[1].size = a[1].value_len;
+
+                       pobj->pubkey_size = 2;
+               } else {
+                       gnutls_assert();
+
+                       ret = pkcs11_rv_to_err(rv);
+                       goto cleanup;
+               }
+
+               break;
+#endif
        default:
                _gnutls_debug_log("requested reading public key of unsupported type %u\n", (unsigned)key_type);
                ret = gnutls_assert_val(GNUTLS_E_UNIMPLEMENTED_FEATURE);

diff --git a/lib/pubkey.c b/lib/pubkey.c
index eb7fdbaa82bf8004536e231018491dbfd1441c35..0e0d0ada478bda31de9bbfb9e5de87a0c08d41b5 100644 (file)
--- a/lib/pubkey.c
+++ b/lib/pubkey.c
@@ -362,6 +362,33 @@ gnutls_pubkey_get_preferred_hash_algorithm(gnutls_pubkey_t key,
 
 #ifdef ENABLE_PKCS11
 
+
+static int
+gnutls_pubkey_import_ecc_eddsa(gnutls_pubkey_t key,
+                              const gnutls_datum_t * parameters,
+                              const gnutls_datum_t * ecpoint)
+{
+       int ret;
+       gnutls_datum_t raw_point = {NULL, 0};
+
+       /* TODO handle parameters containing curve name to figure
+        * out if it is Ed25519, Ed448 or even something else */
+
+       ret = _gnutls_x509_decode_string(ASN1_ETYPE_OCTET_STRING,
+                                        ecpoint->data, ecpoint->size,
+                                        &raw_point, 0);
+       if (ret < 0) {
+               gnutls_assert();
+               gnutls_free(raw_point.data);
+               return ret;
+       }
+       ret = gnutls_pubkey_import_ecc_raw(key, GNUTLS_ECC_CURVE_ED25519,
+                                          &raw_point, NULL);
+
+       gnutls_free(raw_point.data);
+       return ret;
+}
+
 /**
  * gnutls_pubkey_import_pkcs11:
  * @key: The public key
@@ -438,6 +465,10 @@ gnutls_pubkey_import_pkcs11(gnutls_pubkey_t key,
                ret = gnutls_pubkey_import_ecc_x962(key, &obj->pubkey[0],
                                                    &obj->pubkey[1]);
                break;
+       case GNUTLS_PK_EDDSA_ED25519:
+               ret = gnutls_pubkey_import_ecc_eddsa(key, &obj->pubkey[0],
+                                                    &obj->pubkey[1]);
+               break;
        default:
                gnutls_assert();
                return GNUTLS_E_UNIMPLEMENTED_FEATURE;