keychain/ckks/CKKSTLKShare.h

   1 /*
   2  * Copyright (c) 2017 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #if OCTAGON
  25
  26 #import <Foundation/Foundation.h>
  27
  28 #import "keychain/ckks/CKKS.h"
  29 #import "keychain/ckks/CKKSItem.h"
  30 #import "keychain/ckks/CKKSKey.h"
  31 #import "keychain/ckks/CKKSPeer.h"
  32
  33 #import <SecurityFoundation/SFEncryptionOperation.h>
  34 #import <SecurityFoundation/SFKey.h>
  35
  36 NS_ASSUME_NONNULL_BEGIN
  37
  38 typedef NS_ENUM(NSUInteger, SecCKKSTLKShareVersion) {
  39     SecCKKSTLKShareVersion0 = 0,  // Signature is over all fields except (signature) and (receiverPublicKey)
  40     // Unknown fields in the CKRecord will be appended to the end, in sorted order based on column ID
  41 };
  42
  43 #define SecCKKSTLKShareCurrentVersion SecCKKSTLKShareVersion0
  44
  45
  46 @interface CKKSTLKShare : CKKSCKRecordHolder
  47 @property SFEllipticCurve curve;
  48 @property SecCKKSTLKShareVersion version;
  49
  50 @property NSString* tlkUUID;
  51
  52 @property id<CKKSPeer> receiver;
  53 @property NSString* senderPeerID;
  54
  55 @property NSInteger epoch;
  56 @property NSInteger poisoned;
  57
  58 @property (nullable) NSData* wrappedTLK;
  59 @property (nullable) NSData* signature;
  60
  61 - (instancetype)init NS_UNAVAILABLE;
  62
  63 - (CKKSKey* _Nullable)recoverTLK:(id<CKKSSelfPeer>)recoverer trustedPeers:(NSSet<id<CKKSPeer>>*)peers error:(NSError**)error;
  64
  65 + (CKKSTLKShare* _Nullable)share:(CKKSKey*)key
  66                               as:(id<CKKSSelfPeer>)sender
  67                               to:(id<CKKSPeer>)receiver
  68                            epoch:(NSInteger)epoch
  69                         poisoned:(NSInteger)poisoned
  70                            error:(NSError**)error;
  71
  72 - (bool)signatureVerifiesWithPeerSet:(NSSet<id<CKKSPeer>>*)peerSet error:(NSError**)error;
  73
  74 // Database loading
  75 + (instancetype _Nullable)fromDatabase:(NSString*)uuid
  76                         receiverPeerID:(NSString*)receiverPeerID
  77                           senderPeerID:(NSString*)senderPeerID
  78                                 zoneID:(CKRecordZoneID*)zoneID
  79                                  error:(NSError* __autoreleasing*)error;
  80 + (instancetype _Nullable)tryFromDatabase:(NSString*)uuid
  81                            receiverPeerID:(NSString*)receiverPeerID
  82                              senderPeerID:(NSString*)senderPeerID
  83                                    zoneID:(CKRecordZoneID*)zoneID
  84                                     error:(NSError**)error;
  85 + (NSArray<CKKSTLKShare*>*)allFor:(NSString*)receiverPeerID
  86                           keyUUID:(NSString*)uuid
  87                            zoneID:(CKRecordZoneID*)zoneID
  88                             error:(NSError* __autoreleasing*)error;
  89 + (NSArray<CKKSTLKShare*>*)allForUUID:(NSString*)uuid zoneID:(CKRecordZoneID*)zoneID error:(NSError**)error;
  90 + (NSArray<CKKSTLKShare*>*)allInZone:(CKRecordZoneID*)zoneID error:(NSError**)error;
  91 + (instancetype _Nullable)tryFromDatabaseFromCKRecordID:(CKRecordID*)recordID error:(NSError**)error;
  92
  93 // Returns a prefix that all every CKKSTLKShare CKRecord will have
  94 + (NSString*)ckrecordPrefix;
  95
  96 // For tests
  97 - (CKKSKey* _Nullable)unwrapUsing:(id<CKKSSelfPeer>)localPeer error:(NSError**)error;
  98 - (NSData* _Nullable)signRecord:(SFECKeyPair*)signingKey error:(NSError**)error;
  99 - (bool)verifySignature:(NSData*)signature verifyingPeer:(id<CKKSPeer>)peer error:(NSError**)error;
 100 - (NSData*)dataForSigning;
 101 @end
 102
 103 NS_ASSUME_NONNULL_END
 104
 105 #endif  // OCTAGON