Data Structures
struct	telux::sec::ECCPoint

struct	telux::sec::DataDigest

struct	telux::sec::Signature

struct	telux::sec::Scalar

struct	telux::sec::OperationResult

class	telux::sec::ICryptoAcceleratorListener

class	telux::sec::ICryptoAcceleratorManager

class	telux::sec::ResultParser

class	telux::sec::ICryptoParam

class	telux::sec::ICryptoManager
	ICryptoManager provides key management and crypto operation support. It uses trusted hardware bound crypto. All keys generated are bound to the device cryptographically. More...

class	telux::sec::CryptoParamBuilder

class	telux::sec::SecurityFactory
	SecurityFactory allows creation of ICryptoManager and ICryptoAcceleratorManager. More...

Typedefs
using	telux::sec::CryptoOperationTypes = int32_t

using	telux::sec::BlockModeTypes = int32_t

using	telux::sec::PaddingTypes = int32_t

using	telux::sec::DigestTypes = int32_t

using	telux::sec::AlgorithmTypes = int32_t

using	telux::sec::CurveTypes = int32_t

Enumerations
enum	telux::sec::Mode { telux::sec::Mode::MODE_SYNC, telux::sec::Mode::MODE_ASYNC_POLL, telux::sec::Mode::MODE_ASYNC_LISTENER }

enum	telux::sec::RequestPriority { telux::sec::RequestPriority::REQ_PRIORITY_HIGH, telux::sec::RequestPriority::REQ_PRIORITY_NORMAL }

enum	telux::sec::ECCCurve { telux::sec::ECCCurve::CURVE_SM2, telux::sec::ECCCurve::CURVE_NISTP256, telux::sec::ECCCurve::CURVE_NISTP384, telux::sec::ECCCurve::CURVE_BRAINPOOLP256R1, telux::sec::ECCCurve::CURVE_BRAINPOOLP384R1 }

enum	telux::sec::OperationType { telux::sec::OperationType::OP_TYPE_VERIFY, telux::sec::OperationType::OP_TYPE_CALCULATE }

enum	telux::sec::CryptoOperation { telux::sec::CRYPTO_OP_ENCRYPT = (1 << 1), telux::sec::CRYPTO_OP_DECRYPT = (1 << 2), telux::sec::CRYPTO_OP_SIGN = (1 << 3), telux::sec::CRYPTO_OP_VERIFY = (1 << 4) }

enum	telux::sec::BlockMode { telux::sec::BLOCK_MODE_ECB = (1 << 1), telux::sec::BLOCK_MODE_CBC = (1 << 2), telux::sec::BLOCK_MODE_CTR = (1 << 3), telux::sec::BLOCK_MODE_GCM = (1 << 4) }

enum	telux::sec::Padding { telux::sec::PADDING_NONE = (1 << 1), telux::sec::PADDING_RSA_OAEP = (1 << 2), telux::sec::PADDING_RSA_PSS = (1 << 3), telux::sec::PADDING_RSA_PKCS1_1_5_ENC = (1 << 4), telux::sec::PADDING_RSA_PKCS1_1_5_SIGN = (1 << 5), telux::sec::PADDING_PKCS7 = (1 << 6) }

enum	telux::sec::Digest { telux::sec::DIGEST_NONE = (1 << 1), telux::sec::DIGEST_MD5 = (1 << 2), telux::sec::DIGEST_SHA1 = (1 << 3), telux::sec::DIGEST_SHA_2_224 = (1 << 4), telux::sec::DIGEST_SHA_2_256 = (1 << 5), telux::sec::DIGEST_SHA_2_384 = (1 << 6), telux::sec::DIGEST_SHA_2_512 = (1 << 7) }

enum	telux::sec::Algorithm { telux::sec::ALGORITHM_UNKNOWN, telux::sec::ALGORITHM_RSA, telux::sec::ALGORITHM_EC, telux::sec::ALGORITHM_AES, telux::sec::ALGORITHM_HMAC }

enum	telux::sec::Curve { telux::sec::CURVE_P_224, telux::sec::CURVE_P_256, telux::sec::CURVE_P_384, telux::sec::CURVE_P_521 }

enum	telux::sec::KeyFormat { telux::sec::KEY_FORMAT_X509, telux::sec::KEY_FORMAT_PKCS8, telux::sec::KEY_FORMAT_RAW }

Variables
static const uint32_t	telux::sec::CA_RESULT_DATA_LENGTH = 96

Detailed Description

Data Structure Documentation

struct telux::sec::ECCPoint

Represents a point on an elliptic curve.

Data Fields
uint8_t *	x
size_t	xLength
uint8_t *	y
size_t	yLength

struct telux::sec::DataDigest

Represents digest of the data whose signature is to be verified.

Data Fields
uint8_t *	digest
size_t	digestLength

struct telux::sec::Signature

Represents signature of the digest to be verified.

Data Fields
uint8_t *	rSignature
uint8_t *	sSignature
size_t	rsLength

struct telux::sec::Scalar

Represents scalar value to be used with an ECQV operation.

Data Fields
uint8_t *	scalar
size_t	scalarLength

struct telux::sec::OperationResult

Represents a result obtained from the crypto accelerator. The value of an individual field must only be interpreted through helper methods in ResultParser.

Data Fields
uint32_t	reserved:4
uint32_t	id:12
uint32_t	operationType:3
uint32_t	result:4
uint32_t	errCode:9
uint8_t	data[CA_RESULT_DATA_LENGTH]

class telux::sec::ICryptoAcceleratorListener

Receives ECC signature verification and ECQV calculation result.

Public Member Functions
virtual void	onVerificationResult (uint32_t uniqueId, telux::common::ErrorCode errorCode, std::vector< uint8_t > resultData)

virtual void	onCalculationResult (uint32_t uniqueId, telux::common::ErrorCode errorCode, std::vector< uint8_t > resultData)

virtual	~ICryptoAcceleratorListener ()

Constructor & Destructor Documentation

virtual telux::sec::ICryptoAcceleratorListener::~ICryptoAcceleratorListener ( )

virtual

Destructor for ICryptoAcceleratorListener.

Member Function Documentation

virtual void telux::sec::ICryptoAcceleratorListener::onVerificationResult	(	uint32_t	uniqueId,
		telux::common::ErrorCode	errorCode,
		std::vector< uint8_t >	resultData
	)

virtual

Invoked to provide an ECC signature verification result.

Parameters

[in]	uniqueId	Unique request identifier. This is the same as what was passed to ICryptoAcceleratorManager::eccPostDigestForVerification()
[in]	errorCode	telux::common::ErrorCode::SUCCESS, if signature passed validation, telux::common::ErrorCode::VERIFICATION_FAILED if all inputs were correct, verification completed and signature was invalid, an appropriate error code in all other cases
[in]	resultData	Contains the r' (computed r-component of the signature)

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual void telux::sec::ICryptoAcceleratorListener::onCalculationResult	(	uint32_t	uniqueId,
		telux::common::ErrorCode	errorCode,
		std::vector< uint8_t >	resultData
	)

virtual

Invoked to provide an ECQV calculation result.

Parameters

[in]	uniqueId	Unique request identifier. This is the same as what was passed to ICryptoAcceleratorManager::ecqvPostDataForMultiplyAndAdd()
[in]	errorCode	telux::common::ErrorCode::SUCCESS, if calculation succeeded, otherwise, an appropriate error code
[in]	resultData	Output point Q (Q=kP+A). For CURVE_SM2, CURVE_NISTP256 and CURVE_BRAINPOOLP256R1, byte from 0 to 31 contains x-coordinate, and byte from 32 to 63 contains y-coordinate. For CURVE_NISTP384 and CURVE_BRAINPOOLP384R1, byte from 0 to 47 contains x-coordinate, and byte from 48 to 95 contains y-coordinate.

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

class telux::sec::ICryptoAcceleratorManager

Provides support for ECC based signature verification and calculation related crypto operations.

APIs with asynchronous and synchronous semantics are provided for the same operation, providing flexibility to optimally support multiple client solutions.

Clients that prefer to invoke verifications from a thread and consume the results on a different thread should use the asynchronous APIs. Clients that prefer to invoke verification APIs and block until the result is ready, should use the synchronous APIs.

Public Member Functions
virtual telux::common::ErrorCode	eccPostDigestForVerification (const DataDigest &digest, const ECCPoint &publicKey, const Signature &signature, telux::sec::ECCCurve curve, uint32_t uniqueId, telux::sec::RequestPriority priority)=0

virtual telux::common::ErrorCode	ecqvPostDataForMultiplyAndAdd (const ECCPoint &multiplicandPoint, const ECCPoint &addendPoint, const Scalar &scalar, telux::sec::ECCCurve curve, uint32_t uniqueId, telux::sec::RequestPriority priority)=0

virtual telux::common::ErrorCode	getAsyncResults (std::vector< OperationResult > &results, uint32_t numResultsToRead, int32_t timeout, uint32_t &numResultsRead)=0

virtual telux::common::ErrorCode	eccVerifyDigest (const DataDigest &digest, const ECCPoint &publicKey, const Signature &signature, telux::sec::ECCCurve curve, uint32_t uniqueId, telux::sec::RequestPriority priority, std::vector< uint8_t > &resultData)=0

virtual telux::common::ErrorCode	ecqvPointMultiplyAndAdd (const ECCPoint &multiplicandPoint, const ECCPoint &addendPoint, const Scalar &scalar, telux::sec::ECCCurve curve, uint32_t uniqueId, telux::sec::RequestPriority priority, std::vector< uint8_t > &resultData)=0

virtual	~ICryptoAcceleratorManager ()

Constructor & Destructor Documentation

virtual telux::sec::ICryptoAcceleratorManager::~ICryptoAcceleratorManager ( )

virtual

Destructor of ICryptoAcceleratorManager. Cleans up as applicable.

Member Function Documentation

virtual telux::common::ErrorCode telux::sec::ICryptoAcceleratorManager::eccPostDigestForVerification	(	const DataDigest &	digest,
		const ECCPoint &	publicKey,
		const Signature &	signature,
		telux::sec::ECCCurve	curve,
		uint32_t	uniqueId,
		telux::sec::RequestPriority	priority
	)

pure virtual

Sends hashed ECC data to the crypto accelerator for integrity verification using the given public key and signature.

Verification result is received by the ICryptoAcceleratorListener::onVerificationResult() method for MODE_ASYNC_LISTENER. For MODE_ASYNC_POLL, getAsyncResults() is used to obtain the results.

Parameters

[in]	digest	Digest of data
[in]	publicKey	Uncompressed public key used to verify the signature
[in]	signature	Signature of the digest
[in]	curve	ECC curve on which given public key lies
[in]	uniqueId	Unique identifier for each request. This number must be unique across all requests for which results are pending. Once the result for a request is received, the same number can be reused. Valid value range is 0 <= uniqueId <= 4095.
[in]	priority	Relative priority indicating this digest should be verified before any other low priority digest

Returns: telux::common::ErrorCode::SUCCESS, if the data is sent to the accelerator, otherwise an appropriate error code

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual telux::common::ErrorCode telux::sec::ICryptoAcceleratorManager::ecqvPostDataForMultiplyAndAdd	(	const ECCPoint &	multiplicandPoint,
		const ECCPoint &	addendPoint,
		const Scalar &	scalar,
		telux::sec::ECCCurve	curve,
		uint32_t	uniqueId,
		telux::sec::RequestPriority	priority
	)

pure virtual

Sends data to the crypto accelerator to perform a point multiplication and addition for 'Short Weierstrass' curves; Q=kP+A.

Calculation result is received by the ICryptoAcceleratorListener::onCalculationResult() method for MODE_ASYNC_LISTENER. For MODE_ASYNC_POLL, getAsyncResults() is used to obtain the results.

Parameters

[in]	multiplicandPoint	Point to multiply (P). In context of public key reconstruction, it represents the reconstruction value
[in]	addendPoint	Point to add (A). In context of public key reconstruction, it represents the CA public key
[in]	scalar	Scalar for the scalar multiplication (k). In context of public key reconstruction, it represents the hash construct
[in]	curve	ECC curve associated with point P and A
[in]	uniqueId	Unique identifier for each request. This number must be unique across all requests for which results are pending. Once the result for a request is received, the the same number can be reused. Valid value range is 0 <= uniqueId <= 4095.
[in]	priority	Relative priority indicating this calculation should be performed before any other low priority operation

Returns: telux::common::ErrorCode::SUCCESS, if the data is sent to the accelerator, otherwise an appropriate error code

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual telux::common::ErrorCode telux::sec::ICryptoAcceleratorManager::getAsyncResults	(	std::vector< OperationResult > &	results,
		uint32_t	numResultsToRead,
		int32_t	timeout,
		uint32_t &	numResultsRead
	)

pure virtual

When using Mode::MODE_ASYNC_POLL, ICryptoAcceleratorManager::eccPostDigestForVerification() and ICryptoAcceleratorManager::ecqvPostDataForMultiplyAndAdd() APIs are used to send request.

The result of these request is obtained asynchronously using this method. It blocks until result(s) is available or timeout occurs.

Caller should allocate sufficient memory pointed by 'results'.

Parameters

[in,out]	results	Buffer that will contain the results
[in]	numResultsToRead	Number of the results to read
[in]	timeout	Time to wait (in milliseconds) for the result(s)
[out]	numResultsRead	Number of results actually read

Returns: telux::common::ErrorCode::SUCCESS, if the result(s) are obtained successfully, otherwise an appropriate error code

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual telux::common::ErrorCode telux::sec::ICryptoAcceleratorManager::eccVerifyDigest	(	const DataDigest &	digest,
		const ECCPoint &	publicKey,
		const Signature &	signature,
		telux::sec::ECCCurve	curve,
		uint32_t	uniqueId,
		telux::sec::RequestPriority	priority,
		std::vector< uint8_t > &	resultData
	)

pure virtual

Verifies the signature of the digest using given public key.

Parameters

[in]	digest	Digest of data
[in]	publicKey	Uncompressed public key used to verify the signature
[in]	signature	Signature of the digest
[in]	curve	ECC curve on which given public key lies
[in]	uniqueId	Unique identifier for each request. This number must be unique across all requests for which results are pending. Once the result for a request is received, the same number can be reused. Valid value range is 0 <= uniqueId <= 4095.
[in]	priority	Relative priority indicating this digest should be verified before any other low priority digest
[out]	resultData	Contains the r' prime (computed r-component of the signature)

Returns: telux::common::ErrorCode::SUCCESS, if signature passed validation, telux::common::ErrorCode::VERIFICATION_FAILED if all inputs were correct, verification completed and signature was invalid, an appropriate error code in all other cases

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual telux::common::ErrorCode telux::sec::ICryptoAcceleratorManager::ecqvPointMultiplyAndAdd	(	const ECCPoint &	multiplicandPoint,
		const ECCPoint &	addendPoint,
		const Scalar &	scalar,
		telux::sec::ECCCurve	curve,
		uint32_t	uniqueId,
		telux::sec::RequestPriority	priority,
		std::vector< uint8_t > &	resultData
	)

pure virtual

Performs a point multiplication and addition for 'Short Weierstrass' curves; Q=kP+A with the help of accelerator. This can be used, for example; to reconstruct a public key, using 'Elliptic Curve Qu-Vanstone (ECQV)' implicit certificate scheme.

Parameters

[in]	multiplicandPoint	Point to multiply (P). In context of public key reconstruction, it represents the reconstruction value
[in]	addendPoint	Point to add (A). In context of public key reconstruction, it represents the CA public key
[in]	scalar	Scalar for the scalar multiplication (k). In context of public key reconstruction, it represents the hash construct
[in]	curve	ECC curve associated with point P and A
[in]	uniqueId	Unique identifier for each request. This number must be unique across all requests for which results are pending. Once the result for a request is received, the the same number can be reused. Valid value range is 0 <= uniqueId <= 4095.
[in]	priority	Relative priority indicating this calculation should be performed before any other low priority operation
[out]	resultData	Output point Q (Q=kP+A). For CURVE_SM2, CURVE_NISTP256 and CURVE_BRAINPOOLP256R1, byte from 0 to 31 contains x-coordinate, and byte from 32 to 63 contains y-coordinate. For CURVE_NISTP384 and CURVE_BRAINPOOLP384R1, byte from 0 to 47 contains x-coordinate, and byte from 48 to 95 contains y-coordinate.

Returns: telux::common::ErrorCode::SUCCESS, if the calculation succeeded, otherwise an appropriate error code

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

class telux::sec::ResultParser

Provides helpers to parse fields in the OperationResult.

Static Public Member Functions
static uint32_t	getId (const OperationResult &result)

static OperationType	getOperationType (const OperationResult &result)

static telux::common::ErrorCode	getErrorCode (const OperationResult &result)

static telux::common::ErrorCode	getCAErrorCode (const OperationResult &result)

static uint8_t *	getData (OperationResult &result)

Member Function Documentation

static uint32_t telux::sec::ResultParser::getId ( const OperationResult & result )

static

Gets the unique identifier associated with the result.

Parameters

[in] result Result obtained from ICryptoAcceleratorManager::getAsyncResults()

Returns: Unique identifier associated with the result. This is the same as what was passed in request

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

static OperationType telux::sec::ResultParser::getOperationType ( const OperationResult & result )

static

Gets the type of operation corresponding to this result; values are and OperationType::OP_TYPE_VERIFY and OperationType::OP_TYPE_CALCULATE.

Parameters

[in] result Result obtained from ICryptoAcceleratorManager::getAsyncResults()

Returns: Operation type - OperationType::OP_TYPE_VERIFY for signature verification, OperationType::OP_TYPE_CALCULATE for point calculation.

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

static telux::common::ErrorCode telux::sec::ResultParser::getErrorCode ( const OperationResult & result )

static

Indicates if the operation passed.

Parameters

[in] result Result obtained from ICryptoAcceleratorManager::getAsyncResults()

Returns: For ECC verification, telux::common::ErrorCode::SUCCESS, if signature passed validation, telux::common::ErrorCode::VERIFICATION_FAILED if all inputs were correct, verification completed and signature was invalid, an appropriate error code in all other cases. For ECQV calculation, telux::common::ErrorCode::SUCCESS, if the calculation succeeded, an appropriate error code in all other cases

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

static telux::common::ErrorCode telux::sec::ResultParser::getCAErrorCode ( const OperationResult & result )

static

Provides a crypto accelerator hardware specific error code to further identify the actual error. Should be used only if getErrorCode() indicates an error occurred.

Parameters

[in] result Result obtained from ICryptoAcceleratorManager::getAsyncResults()

Returns: Error code - telux::common::ErrorCode::* as obtained from the accelerator

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

static uint8_t* telux::sec::ResultParser::getData ( OperationResult & result )

static

Gets the actual result data. For ECC verification, it contains r-prime and for ECQV it contains coordinates.

Parameters

[in] result Result obtained from ICryptoAcceleratorManager::getAsyncResults()

Returns: Pointer to the data, For ECC verification contains r-prime, For ECQV calculatio contains coordinates

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

class telux::sec::ICryptoParam

Specifies how a crypto operation should be performed. An instance of this must be created only thorough CryptoParamBuilder.

Public Member Functions
virtual	~ICryptoParam ()

Constructor & Destructor Documentation

virtual telux::sec::ICryptoParam::~ICryptoParam ( )

virtual

class telux::sec::ICryptoManager

ICryptoManager provides key management and crypto operation support. It uses trusted hardware bound crypto. All keys generated are bound to the device cryptographically.

Public Member Functions
virtual telux::common::ErrorCode	generateKey (std::shared_ptr< ICryptoParam > cryptoParam, std::vector< uint8_t > &keyBlob)=0

virtual telux::common::ErrorCode	importKey (std::shared_ptr< ICryptoParam > cryptoParam, telux::sec::KeyFormat keyFmt, std::vector< uint8_t > const &keyData, std::vector< uint8_t > &keyBlob)=0

virtual telux::common::ErrorCode	exportKey (telux::sec::KeyFormat keyFmt, std::vector< uint8_t > const &keyBlob, std::vector< uint8_t > &keyData)=0

virtual telux::common::ErrorCode	upgradeKey (std::shared_ptr< ICryptoParam > cryptoParam, std::vector< uint8_t > const &oldKeyBlob, std::vector< uint8_t > &newKeyBlob)=0

virtual telux::common::ErrorCode	signData (std::shared_ptr< ICryptoParam > cryptoParam, std::vector< uint8_t > const &keyBlob, std::vector< uint8_t > const &plainText, std::vector< uint8_t > &signature)=0

virtual telux::common::ErrorCode	verifyData (std::shared_ptr< ICryptoParam > cryptoParam, std::vector< uint8_t > const &keyBlob, std::vector< uint8_t > const &plainText, std::vector< uint8_t > const &signature)=0

virtual telux::common::ErrorCode	encryptData (std::shared_ptr< ICryptoParam > cryptoParam, std::vector< uint8_t > const &keyBlob, std::vector< uint8_t > const &plainText, std::vector< uint8_t > &encryptedText)=0

virtual telux::common::ErrorCode	decryptData (std::shared_ptr< ICryptoParam > cryptoParam, std::vector< uint8_t > const &keyBlob, std::vector< uint8_t > const &encryptedText, std::vector< uint8_t > &decryptedText)=0

virtual	~ICryptoManager ()

Constructor & Destructor Documentation

virtual telux::sec::ICryptoManager::~ICryptoManager ( )

virtual

Destructor of ICryptoManager. Performs cleanup as applicable.

Member Function Documentation

virtual telux::common::ErrorCode telux::sec::ICryptoManager::generateKey	(	std::shared_ptr< ICryptoParam >	cryptoParam,
		std::vector< uint8_t > &	keyBlob
	)

pure virtual

Generates key and provides it in the form of corresponding key blob. The key's secret is encrypted in this key blob.

Parameters

[in]	cryptoParam	Specifications of the key
[out]	keyBlob	Key blob representing the key

Returns: telux::common::ErrorCode as appropriate.

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual telux::common::ErrorCode telux::sec::ICryptoManager::importKey	(	std::shared_ptr< ICryptoParam >	cryptoParam,
		telux::sec::KeyFormat	keyFmt,
		std::vector< uint8_t > const &	keyData,
		std::vector< uint8_t > &	keyBlob
	)

pure virtual

Creates key blob from the given key data.

Parameters

[in]	cryptoParam	Specifications of the key
[in]	keyFmt	KeyFormat Format in which key should be imported
[in]	keyData	Key's data in specific format to be imported
[out]	keyBlob	Key blob Key blob created from the given key data

Returns: telux::common::ErrorCode as appropriate.

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual telux::common::ErrorCode telux::sec::ICryptoManager::exportKey	(	telux::sec::KeyFormat	keyFmt,
		std::vector< uint8_t > const &	keyBlob,
		std::vector< uint8_t > &	keyData
	)

pure virtual

Generates equivalent key data from the given key blob.

Parameters

[in]	keyFmt	KeyFormat Format in which key should be exported
[in]	keyBlob	Key blob representing the key to be exported
[out]	keyData	Key's data generated from the given key blob

Returns: telux::common::ErrorCode as appropriate.

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual telux::common::ErrorCode telux::sec::ICryptoManager::upgradeKey	(	std::shared_ptr< ICryptoParam >	cryptoParam,
		std::vector< uint8_t > const &	oldKeyBlob,
		std::vector< uint8_t > &	newKeyBlob
	)

pure virtual

Upgrade the given key if it has expired for example due to system software upgrade.

Parameters

[in]	cryptoParam	Input parameters specifically unique data should be set if it was used when creating the key originally.
[in]	oldKeyBlob	Key blob representing key to be upgraded
[out]	newKeyBlob	Key blob representing upgraded key

Returns: telux::common::ErrorCode as appropriate.

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual telux::common::ErrorCode telux::sec::ICryptoManager::signData	(	std::shared_ptr< ICryptoParam >	cryptoParam,
		std::vector< uint8_t > const &	keyBlob,
		std::vector< uint8_t > const &	plainText,
		std::vector< uint8_t > &	signature
	)

pure virtual

Generates signature to verify integrity of the given data.

Parameters

[in]	cryptoParam	Input parameters to signature generator algorithm
[in]	keyBlob	Key blob to sign given data
[in]	plainText	Data to be signed
[out]	signature	Signature generated for the given data

Returns: telux::common::ErrorCode as appropriate.

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual telux::common::ErrorCode telux::sec::ICryptoManager::verifyData	(	std::shared_ptr< ICryptoParam >	cryptoParam,
		std::vector< uint8_t > const &	keyBlob,
		std::vector< uint8_t > const &	plainText,
		std::vector< uint8_t > const &	signature
	)

pure virtual

Verifies integrity of the given data through its signature.

Parameters

[in]	cryptoParam	Input parameters to signature validator algorithm
[in]	keyBlob	Key blob to verify this data
[in]	plainText	Data to be verified
[in]	signature	Signature of the data

Returns: telux::common::ErrorCode::SUCCESS if verification is passed otherwise telux::common::ErrorCode as appropriate.

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual telux::common::ErrorCode telux::sec::ICryptoManager::encryptData	(	std::shared_ptr< ICryptoParam >	cryptoParam,
		std::vector< uint8_t > const &	keyBlob,
		std::vector< uint8_t > const &	plainText,
		std::vector< uint8_t > &	encryptedText
	)

pure virtual

Encrypts data as per the given inputs to the encryption algorithm.

Parameters

[in]	cryptoParam	Input parameters to encryption algorithm
[in]	keyBlob	Key blob to be used for encryption
[in]	plainText	Data to be encrypted
[out]	encryptedText	Encrypted data

Returns: telux::common::ErrorCode as appropriate.

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual telux::common::ErrorCode telux::sec::ICryptoManager::decryptData	(	std::shared_ptr< ICryptoParam >	cryptoParam,
		std::vector< uint8_t > const &	keyBlob,
		std::vector< uint8_t > const &	encryptedText,
		std::vector< uint8_t > &	decryptedText
	)

pure virtual

Decrypts data as per the given inputs to the decryption algorithm.

Parameters

[in]	cryptoParam	Input parameters to decryption algorithm
[in]	keyBlob	Key blob to be used for decryption
[in]	encryptedText	Encrypted data to be decrypted
[out]	decryptedText	Decrypted data

Returns: telux::common::ErrorCode as appropriate.

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

class telux::sec::CryptoParamBuilder

CryptoParamBuilder helps to setup input parameters for a given crypto operation.

Public Member Functions
	CryptoParamBuilder ()

CryptoParamBuilder	setAlgorithm (AlgorithmTypes algorithm)

CryptoParamBuilder	setCryptoOperation (CryptoOperationTypes operation)

CryptoParamBuilder	setDigest (DigestTypes digest)

CryptoParamBuilder	setPadding (PaddingTypes padding)

CryptoParamBuilder	setKeySize (int32_t keySize)

CryptoParamBuilder	setMinimumMacLength (int32_t minMacLength)

CryptoParamBuilder	setMacLength (int32_t macLength)

CryptoParamBuilder	setBlockMode (BlockModeTypes blockMode)

CryptoParamBuilder	setCurve (int32_t curve)

CryptoParamBuilder	setCallerNonce (bool callerNonce)

CryptoParamBuilder	setPublicExponent (uint64_t publicExponent)

CryptoParamBuilder	setInitVector (std::vector< uint8_t > initVector)

CryptoParamBuilder	setUniqueData (std::vector< uint8_t > uniqueData)

CryptoParamBuilder	setAssociatedData (std::vector< uint8_t > associatedData)

std::shared_ptr< ICryptoParam >	build (void)

Constructor & Destructor Documentation

telux::sec::CryptoParamBuilder::CryptoParamBuilder ( )

Allocates an instance of CryptoParamBuilder.

Member Function Documentation

CryptoParamBuilder telux::sec::CryptoParamBuilder::setAlgorithm ( AlgorithmTypes algorithm )

When generating the keys, specifies with which algorithm these keys will be used. For crypto operation, specifies the algorithm to use. Use telux::sec::Algorithm enumeration to define this.

CryptoParamBuilder telux::sec::CryptoParamBuilder::setCryptoOperation ( CryptoOperationTypes operation )

When generating the keys, specifies crypto operation(s) for which the key will be used. For crypto operation, specifies operation itself (encryption/decryption/ signing/verification). Use telux::sec::CryptoOperation enumeration to define this. Multiple operation values can be OR'ed.

CryptoParamBuilder telux::sec::CryptoParamBuilder::setDigest ( DigestTypes digest )

When generating the keys, specifies the digest algorithm(s) that may be used with the key to perform signing and verification operations using RSA, ECDSA and HMAC keys For crypto operation, specifies exact digest algorithm to be used. Use telux::sec::Digest enumeration to define this. Multiple values can be OR'ed.

CryptoParamBuilder telux::sec::CryptoParamBuilder::setPadding ( PaddingTypes padding )

When generating the keys, specifies the padding modes that may be used with the RSA and AES key. For crypto operation, specifies exact padding to be used. Use telux::sec::Padding enumeration to define this. Multiple padding values can be OR'ed.

CryptoParamBuilder telux::sec::CryptoParamBuilder::setKeySize ( int32_t keySize )

When generating the keys, specifies size in bits, of the key, measured in the regular way for the key's algorithm. For RSA keys, specifies the size of the public modulus. For AES keys, specifies length of the secret key material. For HMAC key, it specifies the key size in bits. For EC, it is used to select the EC group.

CryptoParamBuilder telux::sec::CryptoParamBuilder::setMinimumMacLength ( int32_t minMacLength )

When generating the keys, specifies minimum length of the MAC in bits that can be requested or verified with this key for HMAC keys and AES keys that support GCM mode.

CryptoParamBuilder telux::sec::CryptoParamBuilder::setMacLength ( int32_t macLength )

For crypto operation, specifies requested length of a MAC or GCM (which is guaranteed to be no less then minimum length of the MAC/GCM used when generating the key.

CryptoParamBuilder telux::sec::CryptoParamBuilder::setBlockMode ( BlockModeTypes blockMode )

When generating the keys, specifies block cipher mode(s) with which this key can be used. For crypto operation, specifies exact block mode to be used. Use telux::sec::BlockMode enumeration to define this. Multiple block mode values can be OR'ed.

CryptoParamBuilder telux::sec::CryptoParamBuilder::setCurve ( int32_t curve )

When generating the keys using EC algorithm, only key size, only curve or both key size and curve can be specified. If only key size is specified, appropriate NIST curve is selected automatically. If only curve is specified, given curve is used. If both are specified then given curve is used and also key size is validated.

CryptoParamBuilder telux::sec::CryptoParamBuilder::setCallerNonce ( bool callerNonce )

When generating the AES key, set this to true. And when performing AES crypto operations define initialization vector using iv field in this structure.

CryptoParamBuilder telux::sec::CryptoParamBuilder::setPublicExponent ( uint64_t publicExponent )

When generating the RSA key, specifies the value of the public exponent for an RSA key pair (necessary for all RSA keys).

CryptoParamBuilder telux::sec::CryptoParamBuilder::setInitVector ( std::vector< uint8_t > initVector )

When performing AES crypto operations, specifies initialization vector to be used.

CryptoParamBuilder telux::sec::CryptoParamBuilder::setUniqueData ( std::vector< uint8_t > uniqueData )

When generating or importing a key, an optional arbitrary value can be supplied through this method. In all subsequent use of the key, this value must be supplied again. The data given is bound to the key cryptographically. This data ties the key to the caller.

CryptoParamBuilder telux::sec::CryptoParamBuilder::setAssociatedData ( std::vector< uint8_t > associatedData )

When encrypting/decrypting data, this specifies optional associated data to be used. This is applicable only for AES-GCM algorithm.

std::shared_ptr<ICryptoParam> telux::sec::CryptoParamBuilder::build ( void )

Finally creates an instance of ICryptoParam based on the setter methods invoked on the builder. After building the builder's state is resetted.

class telux::sec::SecurityFactory

SecurityFactory allows creation of ICryptoManager and ICryptoAcceleratorManager.

Public Member Functions
virtual std::shared_ptr< ICryptoManager >	getCryptoManager (telux::common::ErrorCode &ec)=0

virtual std::shared_ptr< ICryptoAcceleratorManager >	getCryptoAcceleratorManager (telux::common::ErrorCode &ec, Mode mode, std::weak_ptr< ICryptoAcceleratorListener > cryptoAccelListener=std::weak_ptr< ICryptoAcceleratorListener >())=0

Static Public Member Functions
static SecurityFactory &	getInstance ()

Member Function Documentation

static SecurityFactory& telux::sec::SecurityFactory::getInstance ( )

static

Gets the SecurityFactory instance.

virtual std::shared_ptr<ICryptoManager> telux::sec::SecurityFactory::getCryptoManager ( telux::common::ErrorCode & ec )

pure virtual

Provides a CryptoManager instance that can be used to perform key management and cryptographic operations.

Parameters

[out] ec telux::common::ErrorCode::SUCCESS if ICryptoManager is created successfully, otherwise, an appropriate error code

Returns: ICryptoManager instance

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

virtual std::shared_ptr<ICryptoAcceleratorManager> telux::sec::SecurityFactory::getCryptoAcceleratorManager	(	telux::common::ErrorCode &	ec,
		Mode	mode,
		std::weak_ptr< ICryptoAcceleratorListener >	cryptoAccelListener = `std::weak_ptr< ICryptoAcceleratorListener >()`
	)

pure virtual

Provides a CryptoAcceleratorManager instance that can be used to perform cryptographic operations requiring elliptic-curve cryptography (ECC) verifications and calculations.

Parameters

[out]	ec	telux::common::ErrorCode::SUCCESS if ICryptoAcceleratorManager is created successfully, otherwise, an appropriate error code
[in]	mode	Defines how users obtain verification and calculation results
[in]	cryptoAccelListener	Optional, listener for ECC signature verification and ECQV calculation results

Returns: ICryptoAcceleratorManager instance

Note: Eval: This is a new API and is being evaluated. It is subject to change and could break backwards compatibility.

Typedef Documentation

using telux::sec::CryptoOperationTypes = typedef int32_t

This is a list of operation types consisting of entries from CryptoOperation. Multiple values can be OR'ed together. e.g. (CRYPTO_OP_ENCRYPT | CRYPTO_OP_DECRYPT).

using telux::sec::BlockModeTypes = typedef int32_t

This is a list of block mode types consisting of entries from BlockMode. Multiple values can be OR'ed together. e.g. (BLOCK_MODE_ECB | BLOCK_MODE_CBC).

using telux::sec::PaddingTypes = typedef int32_t

This is a list of padding types to use consisting of entries from Padding. Multiple values can be OR'ed together. e.g. (PADDING_PKCS7 | PADDING_RSA_PSS).

using telux::sec::DigestTypes = typedef int32_t

This is a list of digest types to use consisting of entries from Digest. Multiple values can be OR'ed together. e.g. (DIGEST_SHA_2_256 | DIGEST_SHA_2_512).

using telux::sec::AlgorithmTypes = typedef int32_t

This is one of the entry from Algorithm to specify algorithm to use.

using telux::sec::CurveTypes = typedef int32_t

This is one of the entry from Curve to specify curve to use.

Enumeration Type Documentation

enum telux::sec::Mode

strong

Defines how the user gets verification and calculation results.

Enumerator
MODE_SYNC	ICryptoAcceleratorManager::eccVerifyDigest() and ICryptoAcceleratorManager::ecqvPointMultiplyAndAdd() APIs are used to send verification and calculation data and obtain results synchronously.
MODE_ASYNC_POLL	ICryptoAcceleratorManager::eccPostDigestForVerification() and ICryptoAcceleratorManager::ecqvPostDataForMultiplyAndAdd() APIs are used to send verification and calculation data. Results are obtained via ICryptoAcceleratorManager::getAsyncResults() API.
MODE_ASYNC_LISTENER	ICryptoAcceleratorManager::eccPostDigestForVerification() and ICryptoAcceleratorManager::ecqvPostDataForMultiplyAndAdd() APIs are used to send verification and calculation data. Results are obtained asynchronously in ICryptoAcceleratorListener::onVerificationResult() and ICryptoAcceleratorListener::onCalculationResult() callbacks.

enum telux::sec::RequestPriority

strong

Relative priority of the request.

Enumerator
REQ_PRIORITY_HIGH	High priority
REQ_PRIORITY_NORMAL	Lower priority (compared to high priority data)

enum telux::sec::ECCCurve

strong

Elliptic curve used by ECC algorithm.

Enumerator
CURVE_SM2
CURVE_NISTP256
CURVE_NISTP384
CURVE_BRAINPOOLP256R1
CURVE_BRAINPOOLP384R1

enum telux::sec::OperationType

strong

Type of operation carried by crypto accelerator.

Enumerator
OP_TYPE_VERIFY
OP_TYPE_CALCULATE

enum telux::sec::CryptoOperation

Specifies the operation for which the key can be used. A key can be used for multiple type of operations.

Enumerator
CRYPTO_OP_ENCRYPT	Key will be used for encryption
CRYPTO_OP_DECRYPT	Key will be used for decryption
CRYPTO_OP_SIGN	Key will be used for signing
CRYPTO_OP_VERIFY	Key will be used for verification

enum telux::sec::BlockMode

Specifies the block cipher mode(s) with which the AES key may be used.

Enumerator
BLOCK_MODE_ECB	Electronic code block mode
BLOCK_MODE_CBC	Cipher block chain mode
BLOCK_MODE_CTR	Counter-based mode
BLOCK_MODE_GCM	Galois/Counter mode

enum telux::sec::Padding

Padding modes that may be applied to plain text for encryption operations. Only cryptographically-appropriate pairs are specified here.

Enumerator
PADDING_NONE	No padding
PADDING_RSA_OAEP	RSA optimal asymmetric encryption padding
PADDING_RSA_PSS	RSA probabilistic signature scheme
PADDING_RSA_PKCS1_1_5_ENC	RSA PKCS#1 v1.5 padding for encryption
PADDING_RSA_PKCS1_1_5_SIGN	RSA PKCS#1 v1.5 padding for signing
PADDING_PKCS7	Public-key cryptography standard

enum telux::sec::Digest

Specifies the digest algorithms that may be used with the key to perform signing and verification operations using RSA, ECDSA and HMAC keys. The digest used during signing/verification must match with the digest associated with the key when key was generated.

Enumerator
DIGEST_NONE	No digest
DIGEST_MD5	Message-digest algorithm
DIGEST_SHA1	Secure hash algorithm 1
DIGEST_SHA_2_224	Secure hash algorithm 2, digest 224
DIGEST_SHA_2_256	Secure hash algorithm 2, digest 256
DIGEST_SHA_2_384	Secure hash algorithm 2, digest 384
DIGEST_SHA_2_512	Secure hash algorithm 2, digest 512

enum telux::sec::Algorithm

Algorithm for signing, verification, encryption and decryption operations.

Enumerator
ALGORITHM_UNKNOWN	Unspecified algorithm
ALGORITHM_RSA	RSA (Rivest–Shamir–Adleman) algorithm
ALGORITHM_EC	Elliptic-curve algorithm
ALGORITHM_AES	Advanced encryption standard algorithm
ALGORITHM_HMAC	Hash-based message authentication code algorithm

enum telux::sec::Curve

NIST curves used with ECDSA.

Enumerator
CURVE_P_224	NIST curve P-224
CURVE_P_256	NIST curve P-256
CURVE_P_384	NIST curve P-384
CURVE_P_521	NIST curve P-521

enum telux::sec::KeyFormat

Formats for key import and export.

Enumerator
KEY_FORMAT_X509	Public key export
KEY_FORMAT_PKCS8	Asymmetric key pair import
KEY_FORMAT_RAW	Symmetric key import and export

Variable Documentation

const uint32_t telux::sec::CA_RESULT_DATA_LENGTH = 96

static

Length of the unparsed raw result from the crypto accelerator.

Data Structures

Typedefs

Enumerations

Variables

Detailed Description

Data Structure Documentation

Public Member Functions

Constructor & Destructor Documentation

Member Function Documentation

Public Member Functions

Constructor & Destructor Documentation

Member Function Documentation

Static Public Member Functions

Member Function Documentation

Public Member Functions

Constructor & Destructor Documentation

Public Member Functions

Constructor & Destructor Documentation

Member Function Documentation

Public Member Functions

Constructor & Destructor Documentation

Member Function Documentation

Public Member Functions

Static Public Member Functions

Member Function Documentation

Typedef Documentation

Enumeration Type Documentation

Variable Documentation