keychain/ckks/CKKSTLKShare.h

   1 /*
   2  * Copyright (c) 2017 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #if OCTAGON
  25
  26 #import <Foundation/Foundation.h>
  27 #import <SecurityFoundation/SFEncryptionOperation.h>
  28 #import <SecurityFoundation/SFKey.h>
  29
  30 #import "keychain/ckks/CKKS.h"
  31 #import "keychain/ckks/CKKSKeychainBackedKey.h"
  32 #import "keychain/ckks/CKKSPeer.h"
  33
  34 NS_ASSUME_NONNULL_BEGIN
  35
  36 typedef NS_ENUM(NSUInteger, SecCKKSTLKShareVersion) {
  37     SecCKKSTLKShareVersion0 = 0,  // Signature is over all fields except (signature) and (receiverPublicKey)
  38     // Unknown fields in the CKRecord will be appended to the end, in sorted order based on column ID
  39 };
  40
  41 #define SecCKKSTLKShareCurrentVersion SecCKKSTLKShareVersion0
  42
  43 // Note that a CKKSTLKShare attempts to be forward-compatible with newly-signed fields
  44 // To use this functionality, pass in a CKRecord to its interfaces. If it has extra data,
  45 // that data will be signed or its signature verified.
  46
  47 @interface CKKSTLKShare : NSObject <NSCopying, NSSecureCoding>
  48 @property SFEllipticCurve curve;
  49 @property SecCKKSTLKShareVersion version;
  50
  51 @property NSString* tlkUUID;
  52
  53 @property NSString* receiverPeerID;
  54 @property NSData* receiverPublicEncryptionKeySPKI;
  55
  56 @property NSString* senderPeerID;
  57
  58 @property NSInteger epoch;
  59 @property NSInteger poisoned;
  60
  61 @property (nullable) NSData* wrappedTLK;
  62 @property (nullable) NSData* signature;
  63
  64 @property CKRecordZoneID* zoneID;
  65
  66 - (instancetype)init NS_UNAVAILABLE;
  67 - (instancetype)init:(CKKSKeychainBackedKey*)key
  68               sender:(id<CKKSSelfPeer>)sender
  69             receiver:(id<CKKSPeer>)receiver
  70                curve:(SFEllipticCurve)curve
  71              version:(SecCKKSTLKShareVersion)version
  72                epoch:(NSInteger)epoch
  73             poisoned:(NSInteger)poisoned
  74               zoneID:(CKRecordZoneID*)zoneID;
  75 - (instancetype)initForKey:(NSString*)tlkUUID
  76               senderPeerID:(NSString*)senderPeerID
  77             recieverPeerID:(NSString*)receiverPeerID
  78   receiverEncPublicKeySPKI:(NSData*)publicKeySPKI
  79                      curve:(SFEllipticCurve)curve
  80                    version:(SecCKKSTLKShareVersion)version
  81                      epoch:(NSInteger)epoch
  82                   poisoned:(NSInteger)poisoned
  83                 wrappedKey:(NSData*)wrappedKey
  84                  signature:(NSData*)signature
  85                     zoneID:(CKRecordZoneID*)zoneID;
  86
  87 - (CKKSKeychainBackedKey* _Nullable)recoverTLK:(id<CKKSSelfPeer>)recoverer
  88                                   trustedPeers:(NSSet<id<CKKSPeer>>*)peers
  89                                       ckrecord:(CKRecord* _Nullable)ckrecord
  90                                          error:(NSError* __autoreleasing*)error;
  91
  92 + (CKKSTLKShare* _Nullable)share:(CKKSKeychainBackedKey*)key
  93                               as:(id<CKKSSelfPeer>)sender
  94                               to:(id<CKKSPeer>)receiver
  95                            epoch:(NSInteger)epoch
  96                         poisoned:(NSInteger)poisoned
  97                            error:(NSError**)error;
  98
  99 - (bool)signatureVerifiesWithPeerSet:(NSSet<id<CKKSPeer>>*)peerSet
 100                             ckrecord:(CKRecord* _Nullable)ckrecord
 101                                error:(NSError**)error;
 102
 103 // For tests
 104 - (CKKSKeychainBackedKey* _Nullable)unwrapUsing:(id<CKKSSelfPeer>)localPeer
 105                                           error:(NSError**)error;
 106
 107 - (NSData* _Nullable)signRecord:(SFECKeyPair*)signingKey
 108                        ckrecord:(CKRecord* _Nullable)ckrecord
 109                           error:(NSError**)error;
 110
 111 - (bool)verifySignature:(NSData*)signature
 112           verifyingPeer:(id<CKKSPeer>)peer
 113                ckrecord:(CKRecord* _Nullable)ckrecord
 114                   error:(NSError**)error;
 115
 116 // Pass in a CKRecord for forward-compatible signatures
 117 - (NSData*)dataForSigning:(CKRecord* _Nullable)record;
 118 @end
 119
 120 NS_ASSUME_NONNULL_END
 121
 122 #endif  // OCTAGON