Apache Portable Runtime
apr_crypto.h
Go to the documentation of this file.
1 /* Licensed to the Apache Software Foundation (ASF) under one or more
2  * contributor license agreements. See the NOTICE file distributed with
3  * this work for additional information regarding copyright ownership.
4  * The ASF licenses this file to You under the Apache License, Version 2.0
5  * (the "License"); you may not use this file except in compliance with
6  * the License. You may obtain a copy of the License at
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef APR_CRYPTO_H
18 #define APR_CRYPTO_H
19 
20 #include "apu.h"
21 #include "apr_pools.h"
22 #include "apr_tables.h"
23 #include "apr_hash.h"
24 #include "apu_errno.h"
25 #include "apr_thread_proc.h"
26 
27 #ifdef __cplusplus
28 extern "C" {
29 #endif
30 
31 /**
32  * @file apr_crypto.h
33  * @brief APR-UTIL Crypto library
34  */
35 /**
36  * @defgroup APR_Util_Crypto Crypto routines
37  * @ingroup APR
38  * @{
39  */
40 
41 #if APU_HAVE_CRYPTO || defined(DOXYGEN)
42 
43 #ifndef APU_CRYPTO_RECOMMENDED_DRIVER
44 #if APU_HAVE_COMMONCRYPTO
45 /** Recommended driver for this platform */
46 #define APU_CRYPTO_RECOMMENDED_DRIVER "commoncrypto"
47 #else
48 #if APU_HAVE_OPENSSL
49 /** Recommended driver for this platform */
50 #define APU_CRYPTO_RECOMMENDED_DRIVER "openssl"
51 #else
52 #if APU_HAVE_NSS
53 /** Recommended driver for this platform */
54 #define APU_CRYPTO_RECOMMENDED_DRIVER "nss"
55 #else
56 #if APU_HAVE_MSCNG
57 /** Recommended driver for this platform */
58 #define APU_CRYPTO_RECOMMENDED_DRIVER "mscng"
59 #else
60 #if APU_HAVE_MSCAPI
61 /** Recommended driver for this platform */
62 #define APU_CRYPTO_RECOMMENDED_DRIVER "mscapi"
63 #else
64 #endif
65 #endif
66 #endif
67 #endif
68 #endif
69 #endif
70 
71 /**
72  * Symmetric Key types understood by the library.
73  *
74  * NOTE: It is expected that this list will grow over time.
75  *
76  * Interoperability Matrix:
77  *
78  * The matrix is based on the testcrypto.c unit test, which attempts to
79  * test whether a simple encrypt/decrypt will succeed, as well as testing
80  * whether an encrypted string by one library can be decrypted by the
81  * others.
82  *
83  * Some libraries will successfully encrypt and decrypt their own data,
84  * but won't decrypt data from another library. It is hoped that over
85  * time these anomalies will be found and fixed, but until then it is
86  * recommended that ciphers are chosen that interoperate across platform.
87  *
88  * An X below means the test passes, it does not necessarily mean that
89  * encryption performed is correct or secure. Applications should stick
90  * to ciphers that pass the interoperablity tests on the right hand side
91  * of the table.
92  *
93  * Aligned data is data whose length is a multiple of the block size for
94  * the chosen cipher. Padded data is data that is not aligned by block
95  * size and must be padded by the crypto library.
96  *
97  * OpenSSL CommonCrypto NSS Interop
98  * Align Pad Align Pad Align Pad Align Pad
99  * 3DES_192/CBC X X X X X X X X
100  * 3DES_192/ECB X X X X
101  * AES_256/CBC X X X X X X X X
102  * AES_256/ECB X X X X X X
103  * AES_192/CBC X X X X X X
104  * AES_192/ECB X X X X X
105  * AES_128/CBC X X X X X X
106  * AES_128/ECB X X X X X
107  *
108  * Conclusion: for padded data, use 3DES_192/CBC or AES_256/CBC. For
109  * aligned data, use 3DES_192/CBC, AES_256/CBC or AES_256/ECB.
110  */
111 
112 /**
113  * Types of ciphers.
114  */
115 typedef enum
116 {
117  APR_KEY_NONE, APR_KEY_3DES_192, /** 192 bit (3-Key) 3DES */
118  APR_KEY_AES_128, /** 128 bit AES */
119  APR_KEY_AES_192, /** 192 bit AES */
121 /** 256 bit AES */
123 
124 /**
125  * Types of modes supported by the ciphers.
126  */
127 typedef enum
128 {
129  APR_MODE_NONE, /** An error condition */
130  APR_MODE_ECB, /** Electronic Code Book */
132 /** Cipher Block Chaining */
134 
135 /**
136  * Types of digests supported by the apr_crypto_key() function.
137  */
138 typedef enum
139 {
140  APR_CRYPTO_DIGEST_NONE, /** An error condition */
148 
149 /**
150  * Structure returned by the crypto_get_block_key_digests() function.
151  */
153  /** The digest used with this crypto operation. */
155  /** The digest size used with this digest operation */
157  /** The block size used with this digest operation */
160 
161 /**
162  * Types of ciphers supported by the apr_
163  */
164 typedef enum
165 {
166  APR_CRYPTO_CIPHER_AUTO, /** Choose the recommended cipher / autodetect the cipher */
167  APR_CRYPTO_CIPHER_AES_256_CTR, /** AES 256 - CTR mode */
168  APR_CRYPTO_CIPHER_CHACHA20, /** ChaCha20 */
170 
171 /**
172  * Structure representing a backend crypto driver.
173  *
174  * This structure is created with apr_crypto_get_driver().
175  */
177 
178 /**
179  * Structure to support a group of crypto operations.
180  *
181  * This structure is created with apr_crypto_make().
182  */
183 typedef struct apr_crypto_t apr_crypto_t;
184 
185 /**
186  * Structure representing the configuration of the given backend
187  * crypto library.
188  */
190 
191 /**
192  * Structure representing a key prepared for encryption, decryption,
193  * signing or verifying.
194  *
195  * This structure is created using the apr_crypto_key() function.
196  */
197 typedef struct apr_crypto_key_t apr_crypto_key_t;
198 
199 /**
200  * Structure representing a block context for encryption, decryption,
201  * signing or verifying.
202  *
203  * This structure is created using the apr_crypto_block_encrypt_init()
204  * and apr_crypto_block_decrypt_init() functions.
205  */
207 
208 /**
209  * Structure representing a digest context for signing or verifying.
210  *
211  * This structure is created using the apr_crypto_digest_init() function.
212  */
214 
215 /**
216  * Structure returned by the crypto_get_block_key_types() function.
217  */
219  /** The cipher used with this crypto operation. */
221  /** The key size used with this crypto operation */
222  int keysize;
223  /** The block size used with this crypto operation */
225  /** The initialisation vector size used with this crypto operation */
226  int ivsize;
228 
229 /**
230  * Structure returned by the crypto_get_block_key_modes() function.
231  */
233  /** The mode used with this crypto operation. */
236 
237 /**
238  * Structure describing a key to be derived from PBKDF2 to be passed by the
239  * apr_crypto_key() function.
240  *
241  * Derived keys are used for encryption and decryption.
242  *
243  * Implementations must use apr_crypto_key_rec_make() to allocate
244  * this structure.
245  */
246 typedef struct apr_crypto_passphrase_t {
247  /** The passphrase used by the key generation algorithm */
248  const char *pass;
249  /** The length of the passphrase */
250  apr_size_t passLen;
251  /** The salt used by the key derivation algorithm */
252  const unsigned char * salt;
253  /** The length of the salt. */
254  apr_size_t saltLen;
255  /** The number of iterations used by the key derivation function */
258 
259 /**
260  * Structure describing a raw key to be passed by the
261  * apr_crypto_key() function.
262  *
263  * Raw keys are used for encryption and decryption, and must match
264  * the correct sizes for each cipher.
265  *
266  * Implementations must use apr_crypto_key_rec_make() to allocate
267  * this structure.
268  */
269 typedef struct apr_crypto_secret_t {
270  /** The raw secret key used for encrypt / decrypt. Must be
271  * the same size as the block size of the cipher being used.
272  */
273  const unsigned char *secret;
274  /** The length of the secret key. */
275  apr_size_t secretLen;
277 
278 /**
279  * Structure describing a simple digest hash to be generated by the
280  * apr_crypto_key() function.
281  *
282  * Implementations must use apr_crypto_key_rec_make() to allocate
283  * this structure.
284  */
285 typedef struct apr_crypto_key_hash_t {
286  /** The digest used for the HMAC. */
289 
290 /**
291  * Structure describing a HMAC key and digest to be generated by the
292  * apr_crypto_key() function.
293  *
294  * Implementations must use apr_crypto_key_rec_make() to allocate
295  * this structure.
296  */
297 typedef struct apr_crypto_key_hmac_t {
298  /** The secret used for the HMAC */
299  const unsigned char *secret;
300  /** The length of the secret used for the HMAC */
301  apr_size_t secretLen;
302  /** The digest used for the HMAC. */
305 
306 /**
307  * Structure describing a CMAC key and digest to be generated by the
308  * apr_crypto_key() function.
309  *
310  * Implementations must use apr_crypto_key_rec_make() to allocate
311  * this structure.
312  */
313 typedef struct apr_crypto_key_cmac_t {
314  /** The secret used for the CMAC */
315  const unsigned char *secret;
316  /** The length of the secret used for the CMAC */
317  apr_size_t secretLen;
318  /** The digest used for the CMAC. */
321 
322 /**
323  * Structure used to create a hashed digest.
324  *
325  * Implementations must use apr_crypto_digest_rec_make() to allocate
326  * this structure.
327  */
328 typedef struct apr_crypto_digest_hash_t {
329  /** The message digest */
330  unsigned char *s;
331  /** The length of the message digest */
332  apr_size_t slen;
333  /** The digest algorithm */
336 
337 /**
338  * Structure used to create a signature.
339  *
340  * Implementations must use apr_crypto_digest_rec_make() to allocate
341  * this structure.
342  */
343 typedef struct apr_crypto_digest_sign_t {
344  /** The message digest */
345  unsigned char *s;
346  /** The length of the message digest */
347  apr_size_t slen;
348  /** The digest algorithm */
351 
352 /**
353  * Structure used to create a signature for verification.
354  *
355  * Implementations must use apr_crypto_digest_rec_make() to allocate
356  * this structure.
357  */
359  /** The message digest generated */
360  unsigned char *s;
361  /** The length of the message digest */
362  apr_size_t slen;
363  /** The message digest to be verified against */
364  const unsigned char *v;
365  /** The length of the message digest */
366  apr_size_t vlen;
367  /** The digest algorithm */
370 
371 /**
372  * Types of keys supported by the apr_crypto_key() function and the
373  * apr_crypto_key_rec_t structure.
374  */
375 typedef enum {
376  /**
377  * Key is derived from a passphrase.
378  *
379  * Used with the encrypt / decrypt functions.
380  */
382  /**
383  * Key is derived from a raw key.
384  *
385  * Used with the encrypt / decrypt functions.
386  */
388  /**
389  * Simple digest, no key.
390  *
391  * Used with the digest functions.
392  */
394  /**
395  * HMAC Key is derived from a raw key.
396  *
397  * Used with the digest functions.
398  */
400  /**
401  * CMAC Key is derived from a raw key.
402  *
403  * Used with the digest functions.
404  */
407 
408 /**
409  * Types of digests supported by the apr_crypto_digest() functions and the
410  * apr_crypto_digest_rec_t structure.
411  */
412 typedef enum {
413  /**
414  * Simple digest operation.
415  *
416  * Use with apr_crypto_key_rec_t APR_CRYPTO_KTYPE_HASH.
417  */
419  /**
420  * Sign operation.
421  *
422  * Use with apr_crypto_key_rec_t APR_CRYPTO_KTYPE_HMAC or
423  * APR_CRYPTO_KTYPE_CMAC.
424  */
426  /**
427  * Verify operation.
428  *
429  * Use with apr_crypto_key_rec_t APR_CRYPTO_KTYPE_HMAC or
430  * APR_CRYPTO_KTYPE_CMAC.
431  */
434 
435 /**
436  * Structure describing a key to be generated by the
437  * apr_crypto_key() function.
438  *
439  * Implementations must use apr_crypto_key_rec_make() to allocate
440  * this structure.
441  */
442 typedef struct apr_crypto_key_rec_t {
443  /** The type of the key. */
445  /** The cipher used with this crypto operation. */
447  /** The mode used with this crypto operation. */
449  /** Non zero if padding should be used with this crypto operation. */
450  int pad;
451  /** Details of each key, based on the key type. */
452  union {
453  /**
454  * This key is generated using a PBE algorithm from a given
455  * passphrase, and can be used to encrypt / decrypt.
456  *
457  * Key type: APR_CRYPTO_KTYPE_PASSPHRASE
458  */
460  /**
461  * This is a raw key matching the block size of the given
462  * cipher, and can be used to encrypt / decrypt.
463  *
464  * Key type: APR_CRYPTO_KTYPE_SECRET
465  */
467  /**
468  * This represents a simple digest with no key.
469  *
470  * Key type: APR_CRYPTO_KTYPE_HASH
471  */
473  /**
474  * This is a key of arbitrary length used with an HMAC.
475  *
476  * Key type: APR_CRYPTO_KTYPE_HMAC
477  */
479  /**
480  * This is a key of arbitrary length used with a CMAC.
481  *
482  * Key type: APR_CRYPTO_KTYPE_CMAC
483  */
485  } k;
487 
488 /**
489  * Structure describing a digest to be hashed, signed or verified.
490  *
491  * This structure is passed to the apr_crypto_digest_init() and
492  * apr_crypto_digest() functions.
493  *
494  * Implementations must use apr_crypto_digest_rec_make() to allocate
495  * this structure.
496  */
497 typedef struct apr_crypto_digest_rec_t {
498  /** The type of the digest record. */
500  /** Details of each digest, based on the digest type. */
501  union {
505  } d;
507 
508 /**
509  * @brief Perform once-only initialisation. Call once only.
510  *
511  * @param pool - pool to register any shutdown cleanups, etc
512  * @return APR_ENOTIMPL in case of no crypto support.
513  */
515 
516 /* TODO: doxygen */
517 APR_DECLARE(apr_status_t) apr_crypto_lib_version(const char *name,
518  const char **version);
519 APR_DECLARE(apr_status_t) apr_crypto_lib_init(const char *name,
520  const char *params,
521  const apu_err_t **result,
522  apr_pool_t *pool);
523 APR_DECLARE(apr_status_t) apr_crypto_lib_term(const char *name);
524 APR_DECLARE(int) apr_crypto_lib_is_active(const char *name);
525 
526 /**
527  * @brief Zero out the buffer provided when the pool is cleaned up.
528  *
529  * @param pool - pool to register the cleanup
530  * @param buffer - buffer to zero out
531  * @param size - size of the buffer to zero out
532  */
534  apr_size_t size);
535 
536 /**
537  * @brief Always zero out the buffer provided, without being optimized out by
538  * the compiler.
539  *
540  * @param buffer - buffer to zero out
541  * @param size - size of the buffer to zero out
542  */
543 APR_DECLARE(apr_status_t) apr_crypto_memzero(void *buffer, apr_size_t size);
544 
545 /**
546  * @brief Timing attacks safe buffers comparison, where the executing time does
547  * not depend on the bytes compared but solely on the number of bytes.
548  *
549  * @param buf1 - first buffer to compare
550  * @param buf2 - second buffer to compare
551  * @param size - size of the buffers to compare
552  * @return 1 if the buffers are equals, 0 otherwise.
553  */
554 APR_DECLARE(int) apr_crypto_equals(const void *buf1, const void *buf2,
555  apr_size_t size);
556 
557 /**
558  * @brief Get the driver struct for a name
559  *
560  * @param driver - pointer to driver struct.
561  * @param name - driver name
562  * @param params - array of initialisation parameters
563  * @param result - result and error message on failure
564  * @param pool - (process) pool to register cleanup
565  * @return APR_SUCCESS for success
566  * @return APR_ENOTIMPL for no driver (when DSO not enabled)
567  * @return APR_EDSOOPEN if DSO driver file can't be opened
568  * @return APR_ESYMNOTFOUND if the driver file doesn't contain a driver
569  * @remarks NSS: the params can have "dir", "key3", "cert7" and "secmod"
570  * keys, each followed by an equal sign and a value. Such key/value pairs can
571  * be delimited by space or tab. If the value contains a space, surround the
572  * whole key value pair in quotes: "dir=My Directory".
573  * @remarks OpenSSL: currently no params are supported.
574  */
576  const apr_crypto_driver_t **driver,
577  const char *name, const char *params, const apu_err_t **result,
578  apr_pool_t *pool);
579 
580 /**
581  * @brief Return the name of the driver.
582  *
583  * @param driver - The driver in use.
584  * @return The name of the driver.
585  */
587  const apr_crypto_driver_t *driver);
588 
589 /**
590  * @brief Get the result of the last operation on a context. If the result
591  * is NULL, the operation was successful.
592  * @param result - the result structure
593  * @param f - context pointer
594  * @return APR_SUCCESS for success
595  */
597  const apr_crypto_t *f);
598 
599 /**
600  * @brief Create a context for supporting encryption. Keys, certificates,
601  * algorithms and other parameters will be set per context. More than
602  * one context can be created at one time. A cleanup will be automatically
603  * registered with the given pool to guarantee a graceful shutdown.
604  * @param f - context pointer will be written here
605  * @param driver - driver to use
606  * @param params - array of key parameters
607  * @param pool - process pool
608  * @return APR_ENOENGINE when the engine specified does not exist. APR_EINITENGINE
609  * if the engine cannot be initialised.
610  * @remarks NSS: currently no params are supported.
611  * @remarks OpenSSL: the params can have "engine" as a key, followed by an equal
612  * sign and a value.
613  */
615  const apr_crypto_driver_t *driver, const char *params,
616  apr_pool_t *pool);
617 
618 /**
619  * @brief Get a hash table of key digests, keyed by the name of the digest against
620  * a pointer to apr_crypto_block_key_digest_t, which in turn begins with an
621  * integer.
622  *
623  * @param digests - hashtable of key digests keyed to constants.
624  * @param f - encryption context
625  * @return APR_SUCCESS for success
626  */
628  const apr_crypto_t *f);
629 
630 /**
631  * @brief Get a hash table of key types, keyed by the name of the type against
632  * a pointer to apr_crypto_block_key_type_t, which in turn begins with an
633  * integer.
634  *
635  * @param types - hashtable of key types keyed to constants.
636  * @param f - encryption context
637  * @return APR_SUCCESS for success
638  */
640  const apr_crypto_t *f);
641 
642 /**
643  * @brief Get a hash table of key modes, keyed by the name of the mode against
644  * a pointer to apr_crypto_block_key_mode_t, which in turn begins with an
645  * integer.
646  *
647  * @param modes - hashtable of key modes keyed to constants.
648  * @param f - encryption context
649  * @return APR_SUCCESS for success
650  */
652  const apr_crypto_t *f);
653 
654 /**
655  * @brief Create a key record to be passed to apr_crypto_key().
656  * @param ktype The apr_crypto_key_type to use.
657  * @param p The pool to use.
658  * @return Returns a blank structure of the correct size.
659  */
661  apr_crypto_key_type ktype, apr_pool_t *p);
662 
663 /**
664  * @brief Create a digest record to be passed to apr_crypto_digest_init().
665  * @param dtype The type of digest record to create.
666  * @param p The pool to use.
667  * @return Returns a blank structure of the correct size.
668  */
671 
672 /**
673  * @brief Create a key from the provided secret or passphrase. The key is cleaned
674  * up when the context is cleaned, and may be reused with multiple
675  * encryption, decryption, signing or verifying operations. The choice of
676  * key type much match the intended operation.
677  * @note If *key is NULL, a apr_crypto_key_t will be created from a pool. If
678  * *key is not NULL, *key must point at a previously created structure.
679  * @param key The key returned, see note.
680  * @param rec The key record, from which the key will be derived.
681  * @param f The context to use.
682  * @param p The pool to use.
683  * @return APR_ENOKEY if the pass phrase is missing or empty, or if a backend
684  * error occurred while generating the key.
685  * @return APR_ENOCIPHER if the type or mode
686  * is not supported by the particular backend.
687  * @return APR_EKEYTYPE if the key type is
688  * not known.
689  * @return APR_EPADDING if padding was requested but is not supported.
690  * @return APR_ENOTIMPL if not implemented.
691  */
693  const apr_crypto_key_rec_t *rec, const apr_crypto_t *f, apr_pool_t *p);
694 
695 /**
696  * @brief Create a key from the given passphrase. By default, the PBKDF2
697  * algorithm is used to generate the key from the passphrase. It is expected
698  * that the same pass phrase will generate the same key, regardless of the
699  * backend crypto platform used. The key is cleaned up when the context
700  * is cleaned, and may be reused with multiple encryption or decryption
701  * operations.
702  * @note If *key is NULL, a apr_crypto_key_t will be created from a pool. If
703  * *key is not NULL, *key must point at a previously created structure.
704  * @param key The key returned, see note.
705  * @param ivSize The size of the initialisation vector will be returned, based
706  * on whether an IV is relevant for this type of crypto.
707  * @param pass The passphrase to use.
708  * @param passLen The passphrase length in bytes
709  * @param salt The salt to use.
710  * @param saltLen The salt length in bytes
711  * @param type 3DES_192, AES_128, AES_192, AES_256.
712  * @param mode Electronic Code Book / Cipher Block Chaining.
713  * @param doPad Pad if necessary.
714  * @param iterations Number of iterations to use in algorithm
715  * @param f The context to use.
716  * @param p The pool to use.
717  * @return APR_ENOKEY if the pass phrase is missing or empty, or if a backend
718  * error occurred while generating the key.
719  * @return APR_ENOCIPHER if the type or mode
720  * is not supported by the particular backend.
721  * @return APR_EKEYTYPE if the key type is
722  * not known.
723  * @return APR_EPADDING if padding was requested but is not supported.
724  * @return APR_ENOTIMPL if not implemented.
725  * @deprecated Replaced by apr_crypto_key().
726  */
728  apr_size_t *ivSize, const char *pass, apr_size_t passLen,
729  const unsigned char * salt, apr_size_t saltLen,
730  const apr_crypto_block_key_type_e type,
731  const apr_crypto_block_key_mode_e mode, const int doPad,
732  const int iterations, const apr_crypto_t *f, apr_pool_t *p);
733 
734 /**
735  * @brief Initialise a context for encrypting arbitrary data using the given key.
736  * @note If *ctx is NULL, a apr_crypto_block_t will be created from a pool. If
737  * *ctx is not NULL, *ctx must point at a previously created structure.
738  * @param ctx The block context returned, see note.
739  * @param iv Optional initialisation vector. If the buffer pointed to is NULL,
740  * an IV will be created at random, in space allocated from the pool.
741  * If the buffer pointed to is not NULL, the IV in the buffer will be
742  * used.
743  * @param key The key structure to use.
744  * @param blockSize The block size of the cipher.
745  * @param p The pool to use.
746  * @return APR_ENOIV if an initialisation vector is required but not specified.
747  * @return APR_EINIT if the backend failed to initialise the context.
748  * @return APR_ENOTIMPL if not implemented.
749  * @return APR_EINVAL if the key type does not support the given operation.
750  */
752  apr_crypto_block_t **ctx, const unsigned char **iv,
753  const apr_crypto_key_t *key, apr_size_t *blockSize, apr_pool_t *p);
754 
755 /**
756  * @brief Encrypt data provided by in, write it to out.
757  * @note The number of bytes written will be written to outlen. If
758  * out is NULL, outlen will contain the maximum size of the
759  * buffer needed to hold the data, including any data
760  * generated by apr_crypto_block_encrypt_finish below. If *out points
761  * to NULL, a buffer sufficiently large will be created from
762  * the pool provided. If *out points to a not-NULL value, this
763  * value will be used as a buffer instead.
764  * @param out Address of a buffer to which data will be written,
765  * see note.
766  * @param outlen Length of the output will be written here.
767  * @param in Address of the buffer to read.
768  * @param inlen Length of the buffer to read.
769  * @param ctx The block context to use.
770  * @return APR_ECRYPT if an error occurred.
771  * @return APR_ENOTIMPL if not implemented.
772  * @return APR_EINVAL if the key type does not support the given operation.
773  */
775  apr_size_t *outlen, const unsigned char *in, apr_size_t inlen,
776  apr_crypto_block_t *ctx);
777 
778 /**
779  * @brief Encrypt final data block, write it to out.
780  * @note If necessary the final block will be written out after being
781  * padded. Typically the final block will be written to the
782  * same buffer used by apr_crypto_block_encrypt, offset by the
783  * number of bytes returned as actually written by the
784  * apr_crypto_block_encrypt() call. After this call, the context
785  * is cleaned and can be reused by apr_crypto_block_encrypt_init().
786  * @param out Address of a buffer to which data will be written. This
787  * buffer must already exist, and is usually the same
788  * buffer used by apr_crypto_block_encrypt(). See note.
789  * @param outlen Length of the output will be written here.
790  * @param ctx The block context to use.
791  * @return APR_ECRYPT if an error occurred.
792  * @return APR_EPADDING if padding was enabled and the block was incorrectly
793  * formatted.
794  * @return APR_ENOTIMPL if not implemented.
795  * @return APR_EINVAL if the key type does not support the given operation.
796  */
798  apr_size_t *outlen, apr_crypto_block_t *ctx);
799 
800 /**
801  * @brief Initialise a context for decrypting arbitrary data using the given key.
802  * @note If *ctx is NULL, a apr_crypto_block_t will be created from a pool. If
803  * *ctx is not NULL, *ctx must point at a previously created structure.
804  * @param ctx The block context returned, see note.
805  * @param blockSize The block size of the cipher.
806  * @param iv Optional initialisation vector.
807  * @param key The key structure to use.
808  * @param p The pool to use.
809  * @return APR_ENOIV if an initialisation vector is required but not specified.
810  * @return APR_EINIT if the backend failed to initialise the context.
811  * @return APR_ENOTIMPL if not implemented.
812  * @return APR_EINVAL if the key type does not support the given operation.
813  */
815  apr_crypto_block_t **ctx, apr_size_t *blockSize,
816  const unsigned char *iv, const apr_crypto_key_t *key, apr_pool_t *p);
817 
818 /**
819  * @brief Decrypt data provided by in, write it to out.
820  * @note The number of bytes written will be written to outlen. If
821  * out is NULL, outlen will contain the maximum size of the
822  * buffer needed to hold the data, including any data
823  * generated by apr_crypto_block_decrypt_finish below. If *out points
824  * to NULL, a buffer sufficiently large will be created from
825  * the pool provided. If *out points to a not-NULL value, this
826  * value will be used as a buffer instead.
827  * @param out Address of a buffer to which data will be written,
828  * see note.
829  * @param outlen Length of the output will be written here.
830  * @param in Address of the buffer to read.
831  * @param inlen Length of the buffer to read.
832  * @param ctx The block context to use.
833  * @return APR_ECRYPT if an error occurred.
834  * @return APR_ENOTIMPL if not implemented.
835  * @return APR_EINVAL if the key type does not support the given operation.
836  */
838  apr_size_t *outlen, const unsigned char *in, apr_size_t inlen,
839  apr_crypto_block_t *ctx);
840 
841 /**
842  * @brief Decrypt final data block, write it to out.
843  * @note If necessary the final block will be written out after being
844  * padded. Typically the final block will be written to the
845  * same buffer used by apr_crypto_block_decrypt, offset by the
846  * number of bytes returned as actually written by the
847  * apr_crypto_block_decrypt() call. After this call, the context
848  * is cleaned and can be reused by apr_crypto_block_decrypt_init().
849  * @param out Address of a buffer to which data will be written. This
850  * buffer must already exist, and is usually the same
851  * buffer used by apr_crypto_block_decrypt(). See note.
852  * @param outlen Length of the output will be written here.
853  * @param ctx The block context to use.
854  * @return APR_ECRYPT if an error occurred.
855  * @return APR_EPADDING if padding was enabled and the block was incorrectly
856  * formatted.
857  * @return APR_ENOTIMPL if not implemented.
858  * @return APR_EINVAL if the key type does not support the given operation.
859  */
861  apr_size_t *outlen, apr_crypto_block_t *ctx);
862 
863 /**
864  * @brief Clean encryption / decryption context.
865  * @note After cleanup, a context is free to be reused if necessary.
866  * @param ctx The block context to use.
867  * @return Returns APR_ENOTIMPL if not supported.
868  */
870 
871 /**
872  * @brief Initialise a context for hashing, signing or verifying arbitrary
873  * data.
874  *
875  * This function supports:
876  * - Simple hashing (MD5, SHA1, SHA224, SHA256, SHA384, SHA512).
877  * - HMAC (with a secret key)
878  * - CMAC (with a secret key)
879  *
880  * Details of the key and the type of digest to be performed are
881  * passed in the constant apr_crypto_key_t structure, which can be
882  * reused by many calls to apr_crypto_digest_init().
883  *
884  * Details of this particular operation are read from and written to
885  * the apr_crypto_digest_rec_t structure, which is expected to
886  * contain the message digest to be verified, as well as message
887  * digest generated during the hashing or signing process. This
888  * structure will be modified by each digest operation, and cannot be
889  * shared.
890  * @note If *d is NULL, a apr_crypto_digest_t will be created from a pool. If
891  * *d is not NULL, *d must point at a previously created structure.
892  * @param d The digest context returned, see note.
893  * @param key The key structure to use.
894  * @param rec The digest record indicating whether we want to sign or verify.
895  * This record contains digest we want to verify against, as well as
896  * the signature we have generated.
897  * @param p The pool to use.
898  * @return APR_SUCCESS if successful.
899  * @return APR_ENOIV if an initialisation vector is required but not specified.
900  * @return APR_EINIT if the backend failed to initialise the context.
901  * @return APR_ENOTIMPL if not implemented.
902  * @return APR_EINVAL if the key type does not support the given operation.
903  */
906 
907 /**
908  * @brief Update the digest with data provided by in.
909  * @param digest The block context to use.
910  * @param in Address of the buffer to digest.
911  * @param inlen Length of the buffer to digest.
912  * @return APR_SUCCESS if successful.
913  * @return APR_ECRYPT if an error occurred.
914  * @return APR_ENOTIMPL if not implemented.
915  * @return APR_EINVAL if the key type does not support the given operation.
916  */
918  const unsigned char *in, apr_size_t inlen);
919 
920 /**
921  * @brief Finalise the digest and write the result.
922  *
923  * The result is written to the apr_crypto_digest_rec_t structure
924  * passed into apr_crypto_digest_init().
925  *
926  * If verification is requested, this function will return the
927  * result of the verification.
928  * @note After this call, the context is cleaned and can be reused by
929  * apr_crypto_digest_init().
930  * @param digest The digest context to use.
931  * @return APR_SUCCESS if hash, signing or verification was successful.
932  * @return APR_ENOVERIFY if the verification failed.
933  * @return APR_ECRYPT if an error occurred.
934  * @return APR_EPADDING if padding was enabled and the block was incorrectly
935  * formatted.
936  * @return APR_ENOTIMPL if not implemented.
937  * @return APR_EINVAL if the key type does not support the given operation.
938  */
940 
941 /**
942  * @brief One shot digest on a single memory buffer.
943  * @param key The key structure to use.
944  * @param rec The digest record indicating whether we want to sign or verify.
945  * This record contains digest we want to verify against, as well as
946  * the signature we have generated. This record will contain the digest
947  * calculated.
948  * @param in Address of the buffer to digest.
949  * @param inlen Length of the buffer to digest.
950  * @param p The pool to use.
951  * @return APR_ENOIV if an initialisation vector is required but not specified.
952  * @return APR_EINIT if the backend failed to initialise the context.
953  * @return APR_ENOTIMPL if not implemented.
954  * @return APR_EINVAL if the key type does not support the given operation.
955  */
957  apr_crypto_digest_rec_t *rec, const unsigned char *in, apr_size_t inlen,
958  apr_pool_t *p);
959 
960 /**
961  * @brief Clean digest context.
962  * @note After cleanup, a digest context is free to be reused if necessary.
963  * @param ctx The digest context to use.
964  * @return Returns APR_ENOTIMPL if not supported.
965  */
967 
968 /**
969  * @brief Clean encryption / decryption context.
970  * @note After cleanup, a context is free to be reused if necessary.
971  * @param f The context to use.
972  * @return Returns APR_ENOTIMPL if not supported.
973  */
975 
976 /**
977  * @brief Shutdown the crypto library.
978  * @note After shutdown, it is expected that the init function can be called again.
979  * @param driver - driver to use
980  * @return Returns APR_ENOTIMPL if not supported.
981  */
983  const apr_crypto_driver_t *driver);
984 
985 #if APU_HAVE_CRYPTO_PRNG
986 
987 /**
988  * Cryptographic Pseudo Random Number Generator (CPRNG).
989  *
990  * Allows to generate cryptographically secure random bytes indefinitely
991  * given an initial seed of \ref APR_CRYPTO_PRNG_SEED_SIZE bytes (32), which
992  * is either provided by the caller or automatically gathered from the system.
993  * The CPRNG can also be re-seeded at any time, or after a process is fork()ed.
994  *
995  * The internal key is renewed every \ref APR_CRYPTO_PRNG_SEED_SIZE random
996  * bytes produced and those data once returned to the caller are cleared from
997  * the internal state, which ensures forward secrecy.
998  *
999  * This CPRNG is fast, based on a stream cipher, and will never block besides
1000  * the initial seed or any reseed if it depends on the system entropy.
1001  *
1002  * Finally, it can be used either globally (locked in multithread environment),
1003  * per-thread (a lock free instance is automatically created for each thread on
1004  * first use), or created as standalone instance (manageable independently).
1005  */
1006 
1007 #define APR_CRYPTO_PRNG_SEED_SIZE 32
1008 
1009 #define APR_CRYPTO_PRNG_LOCKED (0x1)
1010 #define APR_CRYPTO_PRNG_PER_THREAD (0x2)
1011 #define APR_CRYPTO_PRNG_MASK (0x3)
1012 
1013 /** Opaque CPRNG state */
1014 typedef struct apr_crypto_prng_t apr_crypto_prng_t;
1015 
1016 /**
1017  * @brief Perform global initialisation. Call once only.
1018  *
1019  * @param pool Used to allocate memory and register cleanups
1020  * @param crypto The crypto context to use. If NULL, one will be created from
1021  * the recommended crypto implementation.
1022  * @param cipher The cipher to use.
1023  * @param bufsize The size of the buffer used to cache upcoming random bytes.
1024  * @param seed A custom seed of \ref APR_CRYPTO_PRNG_SEED_SIZE bytes,
1025  * or NULL for the seed to be gathered from system entropy.
1026  * @param flags \ref APR_CRYPTO_PRNG_PER_THREAD to allow for per-thread CPRNG,
1027  * or zero.
1028  * @return APR_EREINIT if called more than once,
1029  * any system error (APR_ENOMEM, ...).
1030  */
1032  apr_crypto_cipher_e cipher, apr_size_t bufsize, const unsigned char seed[], int flags);
1033 
1034 /**
1035  * @brief Terminate global initialisation if needed, before automatic cleanups.
1036  *
1037  * @return APR_EINIT if \ref apr_crypto_prng_init() was not called.
1038  */
1040 
1041 /**
1042  * @brief Generate cryptographically secure random bytes from the global CPRNG.
1043  *
1044  * @param buf The destination buffer
1045  * @param len The destination length
1046  * @return APR_EINIT if \ref apr_crypto_prng_init() was not called.
1047  * any system error (APR_ENOMEM, ...).
1048  */
1050 
1051 #if APR_HAS_THREADS
1052 /**
1053  * @brief Generate cryptographically secure random bytes from the CPRNG of
1054  * the current thread.
1055  *
1056  * @param buf The destination buffer
1057  * @param len The destination length
1058  * @return APR_EINIT if \ref apr_crypto_prng_init() was not called or
1059  * called without \ref APR_CRYPTO_PRNG_PER_THREAD,
1060  * any system error (APR_ENOMEM, ...).
1061  */
1063  apr_size_t len);
1064 #endif
1065 
1066 /**
1067  * @brief Create a standalone CPRNG.
1068  *
1069  * @param pcprng The CPRNG created.
1070  * @param crypto The crypto context to use. If NULL, one will be created from
1071  * the recommended crypto implementation.
1072  * @param cipher The cipher to use.
1073  * @param bufsize The size of the buffer used to cache upcoming random bytes.
1074  * @param flags \ref APR_CRYPTO_PRNG_LOCKED to control concurrent accesses,
1075  * or zero.
1076  * @param seed A custom seed of \ref APR_CRYPTO_PRNG_SEED_SIZE bytes,
1077  * or NULL for the seed to be gathered from system entropy.
1078  * @param pool Used to allocate memory and register cleanups, or NULL
1079  * if the memory should be managed outside (besides per-thread
1080  * which has an automatic memory management with no pool, when
1081  * NULL is given the caller is responsible for calling
1082  * \ref apr_crypto_prng_destroy() or some memory would leak.
1083  * @return APR_EINVAL if \ref bufsize is too large or flags are unknown,
1084  * APR_ENOTIMPL if \ref APR_CRYPTO_PRNG_LOCKED with !APR_HAS_THREADS,
1085  * APR_ENOCIPHER if neither Chacha20 nor AES-256-CTR are available,
1086  * any system error (APR_ENOMEM, ...).
1087  */
1089  apr_crypto_t *crypto, apr_crypto_cipher_e cipher, apr_size_t bufsize,
1090  int flags, const unsigned char seed[], apr_pool_t *pool);
1091 
1092 /**
1093  * @brief Destroy a standalone CPRNG.
1094  *
1095  * @param cprng The CPRNG to destroy.
1096  * @return APR_SUCCESS.
1097  */
1099 
1100 /**
1101  * @brief Rekey a CPRNG.
1102  *
1103  * @param cprng The CPRNG, or NULL for all the created CPRNGs (but per-thread).
1104  * @return Any system error (APR_ENOMEM, ...).
1105  */
1107 
1108 /**
1109  * @brief Reseed a CPRNG.
1110  *
1111  * @param cprng The CPRNG to reseed, or NULL for the global CPRNG.
1112  * @param seed A custom seed of \ref APR_CRYPTO_PRNG_SEED_SIZE bytes,
1113  * or NULL for the seed to be gathered from system entropy.
1114  * @return Any system error (APR_ENOMEM, ...).
1115  */
1117  const unsigned char seed[]);
1118 
1119 #if APR_HAS_FORK
1120 #define APR_CRYPTO_FORK_INPARENT 0
1121 #define APR_CRYPTO_FORK_INCHILD 1
1122 
1123 /**
1124  * @brief Rekey a CPRNG in the parent and/or child process after a fork(),
1125  * so that they don't share the same state.
1126  *
1127  * @param cprng The CPRNG, or NULL for all the created CPRNGs (but per-thread).
1128  * @param in_child Whether in the child process (non zero), or in the parent
1129  * process otherwise (zero).
1130  *
1131  * @return Any system error (APR_ENOMEM, ...).
1132  */
1134  int flags);
1135 #endif
1136 
1137 /**
1138  * @brief Generate cryptographically secure random bytes from a CPRNG.
1139  *
1140  * @param cprng The CPRNG, or NULL for the global CPRNG.
1141  * @param buf The destination buffer
1142  * @param len The destination length
1143  * @return Any system error (APR_ENOMEM, ...).
1144  */
1146  void *buf, apr_size_t len);
1147 
1148 #endif /* APU_HAVE_CRYPTO_PRNG */
1149 
1150 #endif /* APU_HAVE_CRYPTO */
1151 
1152 /** @} */
1153 
1154 #ifdef __cplusplus
1155 }
1156 #endif
1157 
1158 #endif
APR Hash Tables.
APR memory allocation.
APR Table library.
APR Thread and Process Library.
APR-Util Error Codes.
apr_status_t apr_crypto_block_encrypt_finish(unsigned char *out, apr_size_t *outlen, apr_crypto_block_t *ctx)
Encrypt final data block, write it to out.
apr_status_t apr_crypto_prng_after_fork(apr_crypto_prng_t *cprng, int flags)
Rekey a CPRNG in the parent and/or child process after a fork(), so that they don't share the same st...
apr_status_t apr_crypto_get_driver(const apr_crypto_driver_t **driver, const char *name, const char *params, const apu_err_t **result, apr_pool_t *pool)
Get the driver struct for a name.
struct apr_crypto_prng_t apr_crypto_prng_t
Definition: apr_crypto.h:1014
apr_status_t apr_crypto_block_cleanup(apr_crypto_block_t *ctx)
Clean encryption / decryption context.
apr_status_t apr_crypto_digest_update(apr_crypto_digest_t *digest, const unsigned char *in, apr_size_t inlen)
Update the digest with data provided by in.
apr_status_t apr_crypto_block_encrypt_init(apr_crypto_block_t **ctx, const unsigned char **iv, const apr_crypto_key_t *key, apr_size_t *blockSize, apr_pool_t *p)
Initialise a context for encrypting arbitrary data using the given key.
apr_status_t apr_crypto_make(apr_crypto_t **f, const apr_crypto_driver_t *driver, const char *params, apr_pool_t *pool)
Create a context for supporting encryption. Keys, certificates, algorithms and other parameters will ...
apr_status_t apr_crypto_prng_reseed(apr_crypto_prng_t *cprng, const unsigned char seed[])
Reseed a CPRNG.
struct apr_crypto_key_cmac_t apr_crypto_key_cmac_t
apr_status_t apr_crypto_random_thread_bytes(void *buf, apr_size_t len)
Generate cryptographically secure random bytes from the CPRNG of the current thread.
apr_status_t apr_crypto_prng_init(apr_pool_t *pool, apr_crypto_t *crypto, apr_crypto_cipher_e cipher, apr_size_t bufsize, const unsigned char seed[], int flags)
Perform global initialisation. Call once only.
struct apr_crypto_digest_hash_t apr_crypto_digest_hash_t
int apr_crypto_equals(const void *buf1, const void *buf2, apr_size_t size)
Timing attacks safe buffers comparison, where the executing time does not depend on the bytes compare...
struct apr_crypto_key_hmac_t apr_crypto_key_hmac_t
apr_status_t apr_crypto_cleanup(apr_crypto_t *f)
Clean encryption / decryption context.
struct apr_crypto_key_rec_t apr_crypto_key_rec_t
const char * apr_crypto_driver_name(const apr_crypto_driver_t *driver)
Return the name of the driver.
apr_status_t apr_crypto_get_block_key_digests(apr_hash_t **digests, const apr_crypto_t *f)
Get a hash table of key digests, keyed by the name of the digest against a pointer to apr_crypto_bloc...
struct apr_crypto_key_t apr_crypto_key_t
Definition: apr_crypto.h:197
apr_status_t apr_crypto_get_block_key_modes(apr_hash_t **modes, const apr_crypto_t *f)
Get a hash table of key modes, keyed by the name of the mode against a pointer to apr_crypto_block_ke...
apr_status_t apr_crypto_prng_rekey(apr_crypto_prng_t *cprng)
Rekey a CPRNG.
struct apr_crypto_digest_verify_t apr_crypto_digest_verify_t
struct apr_crypto_digest_sign_t apr_crypto_digest_sign_t
apr_status_t apr_crypto_random_bytes(void *buf, apr_size_t len)
Generate cryptographically secure random bytes from the global CPRNG.
apr_status_t apr_crypto_prng_create(apr_crypto_prng_t **pcprng, apr_crypto_t *crypto, apr_crypto_cipher_e cipher, apr_size_t bufsize, int flags, const unsigned char seed[], apr_pool_t *pool)
Create a standalone CPRNG.
struct apr_crypto_block_key_digest_t apr_crypto_block_key_digest_t
apr_status_t apr_crypto_shutdown(const apr_crypto_driver_t *driver)
Shutdown the crypto library.
apr_crypto_key_rec_t * apr_crypto_key_rec_make(apr_crypto_key_type ktype, apr_pool_t *p)
Create a key record to be passed to apr_crypto_key().
apr_status_t apr_crypto_get_block_key_types(apr_hash_t **types, const apr_crypto_t *f)
Get a hash table of key types, keyed by the name of the type against a pointer to apr_crypto_block_ke...
struct apr_crypto_secret_t apr_crypto_secret_t
apr_status_t apr_crypto_memzero(void *buffer, apr_size_t size)
Always zero out the buffer provided, without being optimized out by the compiler.
struct apr_crypto_t apr_crypto_t
Definition: apr_crypto.h:183
apr_status_t apr_crypto_clear(apr_pool_t *pool, void *buffer, apr_size_t size)
Zero out the buffer provided when the pool is cleaned up.
apr_status_t apr_crypto_digest_final(apr_crypto_digest_t *digest)
Finalise the digest and write the result.
apr_crypto_digest_rec_t * apr_crypto_digest_rec_make(apr_crypto_digest_type_e dtype, apr_pool_t *p)
Create a digest record to be passed to apr_crypto_digest_init().
apr_status_t apr_crypto_key(apr_crypto_key_t **key, const apr_crypto_key_rec_t *rec, const apr_crypto_t *f, apr_pool_t *p)
Create a key from the provided secret or passphrase. The key is cleaned up when the context is cleane...
struct apr_crypto_driver_t apr_crypto_driver_t
Definition: apr_crypto.h:176
apr_status_t apr_crypto_digest(const apr_crypto_key_t *key, apr_crypto_digest_rec_t *rec, const unsigned char *in, apr_size_t inlen, apr_pool_t *p)
One shot digest on a single memory buffer.
apr_status_t apr_crypto_error(const apu_err_t **result, const apr_crypto_t *f)
Get the result of the last operation on a context. If the result is NULL, the operation was successfu...
apr_status_t apr_crypto_block_encrypt(unsigned char **out, apr_size_t *outlen, const unsigned char *in, apr_size_t inlen, apr_crypto_block_t *ctx)
Encrypt data provided by in, write it to out.
apr_status_t apr_crypto_passphrase(apr_crypto_key_t **key, apr_size_t *ivSize, const char *pass, apr_size_t passLen, const unsigned char *salt, apr_size_t saltLen, const apr_crypto_block_key_type_e type, const apr_crypto_block_key_mode_e mode, const int doPad, const int iterations, const apr_crypto_t *f, apr_pool_t *p)
Create a key from the given passphrase. By default, the PBKDF2 algorithm is used to generate the key ...
apr_crypto_key_type
Definition: apr_crypto.h:375
apr_status_t apr_crypto_prng_bytes(apr_crypto_prng_t *cprng, void *buf, apr_size_t len)
Generate cryptographically secure random bytes from a CPRNG.
apr_status_t apr_crypto_digest_init(apr_crypto_digest_t **d, const apr_crypto_key_t *key, apr_crypto_digest_rec_t *rec, apr_pool_t *p)
Initialise a context for hashing, signing or verifying arbitrary data.
apr_status_t apr_crypto_digest_cleanup(apr_crypto_digest_t *ctx)
Clean digest context.
apr_crypto_block_key_digest_e
Definition: apr_crypto.h:139
apr_status_t apr_crypto_block_decrypt_init(apr_crypto_block_t **ctx, apr_size_t *blockSize, const unsigned char *iv, const apr_crypto_key_t *key, apr_pool_t *p)
Initialise a context for decrypting arbitrary data using the given key.
apr_crypto_digest_type_e
Definition: apr_crypto.h:412
apr_status_t apr_crypto_block_decrypt_finish(unsigned char *out, apr_size_t *outlen, apr_crypto_block_t *ctx)
Decrypt final data block, write it to out.
apr_crypto_block_key_type_e
Definition: apr_crypto.h:116
apr_status_t apr_crypto_init(apr_pool_t *pool)
Perform once-only initialisation. Call once only.
struct apr_crypto_block_t apr_crypto_block_t
Definition: apr_crypto.h:206
apr_status_t apr_crypto_prng_term(void)
Terminate global initialisation if needed, before automatic cleanups.
struct apr_crypto_digest_t apr_crypto_digest_t
Definition: apr_crypto.h:213
apr_crypto_block_key_mode_e
Definition: apr_crypto.h:128
struct apr_crypto_config_t apr_crypto_config_t
Definition: apr_crypto.h:189
apr_status_t apr_crypto_prng_destroy(apr_crypto_prng_t *cprng)
Destroy a standalone CPRNG.
apr_crypto_cipher_e
Definition: apr_crypto.h:165
struct apr_crypto_block_key_mode_t apr_crypto_block_key_mode_t
struct apr_crypto_passphrase_t apr_crypto_passphrase_t
struct apr_crypto_block_key_type_t apr_crypto_block_key_type_t
struct apr_crypto_key_hash_t apr_crypto_key_hash_t
apr_status_t apr_crypto_block_decrypt(unsigned char **out, apr_size_t *outlen, const unsigned char *in, apr_size_t inlen, apr_crypto_block_t *ctx)
Decrypt data provided by in, write it to out.
struct apr_crypto_digest_rec_t apr_crypto_digest_rec_t
@ APR_CRYPTO_KTYPE_HASH
Definition: apr_crypto.h:393
@ APR_CRYPTO_KTYPE_PASSPHRASE
Definition: apr_crypto.h:381
@ APR_CRYPTO_KTYPE_SECRET
Definition: apr_crypto.h:387
@ APR_CRYPTO_KTYPE_HMAC
Definition: apr_crypto.h:399
@ APR_CRYPTO_KTYPE_CMAC
Definition: apr_crypto.h:405
@ APR_CRYPTO_DIGEST_SHA512
Definition: apr_crypto.h:146
@ APR_CRYPTO_DIGEST_SHA384
Definition: apr_crypto.h:145
@ APR_CRYPTO_DIGEST_SHA224
Definition: apr_crypto.h:143
@ APR_CRYPTO_DIGEST_SHA256
Definition: apr_crypto.h:144
@ APR_CRYPTO_DIGEST_MD5
Definition: apr_crypto.h:141
@ APR_CRYPTO_DIGEST_SHA1
Definition: apr_crypto.h:142
@ APR_CRYPTO_DTYPE_HASH
Definition: apr_crypto.h:418
@ APR_CRYPTO_DTYPE_SIGN
Definition: apr_crypto.h:425
@ APR_CRYPTO_DTYPE_VERIFY
Definition: apr_crypto.h:432
@ APR_KEY_AES_128
Definition: apr_crypto.h:118
@ APR_KEY_AES_256
Definition: apr_crypto.h:120
@ APR_KEY_AES_192
Definition: apr_crypto.h:119
@ APR_MODE_CBC
Definition: apr_crypto.h:131
@ APR_MODE_ECB
Definition: apr_crypto.h:130
@ APR_CRYPTO_CIPHER_CHACHA20
Definition: apr_crypto.h:168
@ APR_CRYPTO_CIPHER_AES_256_CTR
Definition: apr_crypto.h:167
int apr_status_t
Definition: apr_errno.h:44
struct apr_hash_t apr_hash_t
Definition: apr_hash.h:52
#define APR_DECLARE(type)
Definition: apr.h:516
struct apr_pool_t apr_pool_t
Definition: apr_pools.h:60
Definition: apr_crypto.h:152
int digestsize
Definition: apr_crypto.h:156
apr_crypto_block_key_digest_e type
Definition: apr_crypto.h:154
int blocksize
Definition: apr_crypto.h:158
Definition: apr_crypto.h:232
apr_crypto_block_key_mode_e mode
Definition: apr_crypto.h:234
Definition: apr_crypto.h:218
apr_crypto_block_key_type_e type
Definition: apr_crypto.h:220
int keysize
Definition: apr_crypto.h:222
int ivsize
Definition: apr_crypto.h:226
int blocksize
Definition: apr_crypto.h:224
Definition: apr_crypto.h:328
unsigned char * s
Definition: apr_crypto.h:330
apr_crypto_block_key_digest_e digest
Definition: apr_crypto.h:334
apr_size_t slen
Definition: apr_crypto.h:332
Definition: apr_crypto.h:497
apr_crypto_digest_type_e dtype
Definition: apr_crypto.h:499
union apr_crypto_digest_rec_t::@3 d
Definition: apr_crypto.h:343
unsigned char * s
Definition: apr_crypto.h:345
apr_size_t slen
Definition: apr_crypto.h:347
apr_crypto_block_key_digest_e digest
Definition: apr_crypto.h:349
Definition: apr_crypto.h:358
const unsigned char * v
Definition: apr_crypto.h:364
apr_size_t slen
Definition: apr_crypto.h:362
unsigned char * s
Definition: apr_crypto.h:360
apr_size_t vlen
Definition: apr_crypto.h:366
apr_crypto_block_key_digest_e digest
Definition: apr_crypto.h:368
Definition: apr_crypto.h:313
const unsigned char * secret
Definition: apr_crypto.h:315
apr_size_t secretLen
Definition: apr_crypto.h:317
apr_crypto_block_key_digest_e digest
Definition: apr_crypto.h:319
Definition: apr_crypto.h:285
apr_crypto_block_key_digest_e digest
Definition: apr_crypto.h:287
Definition: apr_crypto.h:297
apr_crypto_block_key_digest_e digest
Definition: apr_crypto.h:303
const unsigned char * secret
Definition: apr_crypto.h:299
apr_size_t secretLen
Definition: apr_crypto.h:301
Definition: apr_crypto.h:442
int pad
Definition: apr_crypto.h:450
apr_crypto_key_hash_t hash
Definition: apr_crypto.h:472
apr_crypto_key_type ktype
Definition: apr_crypto.h:444
apr_crypto_secret_t secret
Definition: apr_crypto.h:466
union apr_crypto_key_rec_t::@2 k
apr_crypto_key_hmac_t hmac
Definition: apr_crypto.h:478
apr_crypto_block_key_mode_e mode
Definition: apr_crypto.h:448
apr_crypto_block_key_type_e type
Definition: apr_crypto.h:446
apr_crypto_key_cmac_t cmac
Definition: apr_crypto.h:484
apr_crypto_passphrase_t passphrase
Definition: apr_crypto.h:459
Definition: apr_crypto.h:246
apr_size_t saltLen
Definition: apr_crypto.h:254
int iterations
Definition: apr_crypto.h:256
const unsigned char * salt
Definition: apr_crypto.h:252
const char * pass
Definition: apr_crypto.h:248
apr_size_t passLen
Definition: apr_crypto.h:250
Definition: apr_crypto.h:269
apr_size_t secretLen
Definition: apr_crypto.h:275
const unsigned char * secret
Definition: apr_crypto.h:273
Definition: apu_errno.h:289