this repo has no description
Various AKS improvments and fixes
...using hints from some Security code
+54
-28
+34
-8
src/libaks/include/libaks.h
+34
-8
src/libaks/include/libaks.h
···
12
12
// FIXME: I have no idea what these are for, so they are 0 for now
13
13
#define session_keybag_handle 0
14
14
#define device_keybag_handle 0
15
+
#define backup_keybag_handle 1 // ???
15
16
#define bad_keybag_handle (-1) // that's a pretty common "bad" signed integer value
16
17
17
18
typedef uint32_t keybag_state_t;
18
19
typedef int32_t keybag_handle_t;
19
-
20
-
#if TARGET_OS_MAC && !TARGET_OS_EMBEDDED
21
-
static keybag_handle_t g_keychain_keybag = session_keybag_handle;
22
-
#else
23
-
static keybag_handle_t g_keychain_keybag = device_keybag_handle;
24
-
#endif
25
20
26
21
enum keybag_state {
27
22
keybag_state_unlocked = 0,
···
60
55
kAKSReturnBadDeviceKey,
61
56
kAKSReturnBadSignature,
62
57
kAKSReturnPolicyInvalid,
58
+
kAKSReturnBadPassword,
63
59
};
60
+
61
+
// i'm 99.9999999...% sure this is a typo in Security, but whatever
62
+
#define kSKSReturnNoPermission kAKSReturnNoPermission
64
63
65
64
typedef int32_t keyclass_t;
66
65
···
72
71
kAppleKeyStoreAsymmetricBackupBag,
73
72
};
74
73
75
-
#define key_class_last (0)
76
-
77
74
kern_return_t aks_create_bag(uint8_t* secret, int secret_size, int bag_type, keybag_handle_t* handle);
78
75
kern_return_t aks_save_bag(keybag_handle_t handle, void** bytes, size_t* size);
79
76
kern_return_t aks_unload_bag(keybag_handle_t handle);
80
77
kern_return_t aks_unlock_bag(keybag_handle_t handle, const void* passcode, int length);
81
78
kern_return_t aks_load_bag(const void* data, int length, keybag_handle_t* handle);
79
+
80
+
typedef enum _aks_key_type_enum {
81
+
key_class_none,
82
+
key_type_sym,
83
+
key_class_ak,
84
+
key_class_ck,
85
+
key_class_dk,
86
+
key_class_aku,
87
+
key_class_cku,
88
+
key_class_dku,
89
+
key_class_akpu, // implied to exist by some Security code (`SecDbBackupmanager.m`)
90
+
key_class_last,
91
+
} aks_key_type_t;
92
+
93
+
// 4096-bit = 512-byte; i *think* that's the maximum key length?
94
+
#define APPLE_KEYSTORE_MAX_KEY_LEN (512)
95
+
96
+
// according to `mockaks.m` in Security, these seem to be the same?
97
+
#define APPLE_KEYSTORE_MAX_ASYM_WRAPPED_KEY_LEN (APPLE_KEYSTORE_MAX_KEY_LEN + 8)
98
+
#define APPLE_KEYSTORE_MAX_SYM_WRAPPED_KEY_LEN (APPLE_KEYSTORE_MAX_KEY_LEN + 8)
99
+
100
+
enum _generation_option_enum {
101
+
generation_noop,
102
+
generation_current,
103
+
generation_change_in_progress,
104
+
};
105
+
typedef enum _generation_option_enum generation_option_t;
106
+
107
+
kern_return_t aks_generation(keybag_handle_t handle, generation_option_t option, uint32_t* current);
82
108
83
109
#ifdef __cplusplus
84
110
}
+10
-10
src/libaks/include/libaks_acl_cf_keys.h
+10
-10
src/libaks/include/libaks_acl_cf_keys.h
···
3
3
4
4
//typedef aks_key_t *aks_ref_key_t;
5
5
6
-
extern CFStringRef kAKSKeyAcl;
7
-
extern CFStringRef kAKSKeyAclParamRequirePasscode;
6
+
extern const CFStringRef kAKSKeyAcl;
7
+
extern const CFStringRef kAKSKeyAclParamRequirePasscode;
8
8
9
-
extern CFStringRef kAKSKeyOpDefaultAcl;
10
-
extern CFStringRef kAKSKeyOpSign;
11
-
extern CFStringRef kAKSKeyOpComputeKey;
12
-
extern CFStringRef kAKSKeyOpAttest;
13
-
extern CFStringRef kAKSKeyOpDecrypt;
14
-
extern CFStringRef kAKSKeyOpEncrypt;
15
-
extern CFStringRef kAKSKeyOpDelete;
16
-
extern CFStringRef kAKSKeyOpECIESTranscode;
9
+
extern const CFStringRef kAKSKeyOpDefaultAcl;
10
+
extern const CFStringRef kAKSKeyOpSign;
11
+
extern const CFStringRef kAKSKeyOpComputeKey;
12
+
extern const CFStringRef kAKSKeyOpAttest;
13
+
extern const CFStringRef kAKSKeyOpDecrypt;
14
+
extern const CFStringRef kAKSKeyOpEncrypt;
15
+
extern const CFStringRef kAKSKeyOpDelete;
16
+
extern const CFStringRef kAKSKeyOpECIESTranscode;
17
17
18
18
#endif
+10
-10
src/libaks/libaks.c
+10
-10
src/libaks/libaks.c
···
1
1
#include "libaks.h"
2
2
#include "libaks_smartcard.h"
3
3
4
-
CFStringRef kAKSKeyAcl = CFSTR("AKSKeyAcl");
5
-
CFStringRef kAKSKeyAclParamRequirePasscode = CFSTR("AKSKeyAclParamRequirePasscode");
6
-
CFStringRef kAKSKeyOpDefaultAcl = CFSTR("AKSKeyOpDefaultAcl");
7
-
CFStringRef kAKSKeyOpSign = CFSTR("AKSKeyOpSign");
8
-
CFStringRef kAKSKeyOpComputeKey = CFSTR("AKSKeyOpComputeKey");
9
-
CFStringRef kAKSKeyOpAttest = CFSTR("AKSKeyOpAttest");
10
-
CFStringRef kAKSKeyOpDecrypt = CFSTR("AKSKeyOpDecrypt");
11
-
CFStringRef kAKSKeyOpEncrypt = CFSTR("AKSKeyOpEncrypt");
12
-
CFStringRef kAKSKeyOpDelete = CFSTR("AKSKeyOpDelete");
13
-
CFStringRef kAKSKeyOpECIESTranscode = CFSTR("AKSKeyOpECIESTranscode");
4
+
const CFStringRef kAKSKeyAcl = CFSTR("AKSKeyAcl");
5
+
const CFStringRef kAKSKeyAclParamRequirePasscode = CFSTR("AKSKeyAclParamRequirePasscode");
6
+
const CFStringRef kAKSKeyOpDefaultAcl = CFSTR("AKSKeyOpDefaultAcl");
7
+
const CFStringRef kAKSKeyOpSign = CFSTR("AKSKeyOpSign");
8
+
const CFStringRef kAKSKeyOpComputeKey = CFSTR("AKSKeyOpComputeKey");
9
+
const CFStringRef kAKSKeyOpAttest = CFSTR("AKSKeyOpAttest");
10
+
const CFStringRef kAKSKeyOpDecrypt = CFSTR("AKSKeyOpDecrypt");
11
+
const CFStringRef kAKSKeyOpEncrypt = CFSTR("AKSKeyOpEncrypt");
12
+
const CFStringRef kAKSKeyOpDelete = CFSTR("AKSKeyOpDelete");
13
+
const CFStringRef kAKSKeyOpECIESTranscode = CFSTR("AKSKeyOpECIESTranscode");
14
14
15
15
void aks_smartcard_unregister(int a)
16
16
{