|
sl@0
|
1 |
/*
|
|
sl@0
|
2 |
* Copyright (c) 2003-2009 Nokia Corporation and/or its subsidiary(-ies).
|
|
sl@0
|
3 |
* All rights reserved.
|
|
sl@0
|
4 |
* This component and the accompanying materials are made available
|
|
sl@0
|
5 |
* under the terms of the License "Eclipse Public License v1.0"
|
|
sl@0
|
6 |
* which accompanies this distribution, and is available
|
|
sl@0
|
7 |
* at the URL "http://www.eclipse.org/legal/epl-v10.html".
|
|
sl@0
|
8 |
*
|
|
sl@0
|
9 |
* Initial Contributors:
|
|
sl@0
|
10 |
* Nokia Corporation - initial contribution.
|
|
sl@0
|
11 |
*
|
|
sl@0
|
12 |
* Contributors:
|
|
sl@0
|
13 |
*
|
|
sl@0
|
14 |
* Description:
|
|
sl@0
|
15 |
* MKeystoreManager.h
|
|
sl@0
|
16 |
*
|
|
sl@0
|
17 |
*/
|
|
sl@0
|
18 |
|
|
sl@0
|
19 |
|
|
sl@0
|
20 |
/**
|
|
sl@0
|
21 |
@file
|
|
sl@0
|
22 |
@publishedPartner
|
|
sl@0
|
23 |
@released
|
|
sl@0
|
24 |
*/
|
|
sl@0
|
25 |
|
|
sl@0
|
26 |
#ifndef __MCTKEYSTOREMANAGER_H__
|
|
sl@0
|
27 |
#define __MCTKEYSTOREMANAGER_H__
|
|
sl@0
|
28 |
|
|
sl@0
|
29 |
#include "mctkeystore.h"
|
|
sl@0
|
30 |
|
|
sl@0
|
31 |
/** */
|
|
sl@0
|
32 |
const TInt KInterfaceKeyStoreManager = 0x101F7335;
|
|
sl@0
|
33 |
|
|
sl@0
|
34 |
class CPBEncryptParms;
|
|
sl@0
|
35 |
|
|
sl@0
|
36 |
/**
|
|
sl@0
|
37 |
* Defines the interface for a key store manager token.
|
|
sl@0
|
38 |
*
|
|
sl@0
|
39 |
* This documentation describes the security policy that must be enforced by
|
|
sl@0
|
40 |
* implementations of the interface.
|
|
sl@0
|
41 |
*
|
|
sl@0
|
42 |
* @publishedPartner
|
|
sl@0
|
43 |
* @released
|
|
sl@0
|
44 |
*/
|
|
sl@0
|
45 |
class MCTKeyStoreManager : public MCTKeyStore
|
|
sl@0
|
46 |
{
|
|
sl@0
|
47 |
public:
|
|
sl@0
|
48 |
/**
|
|
sl@0
|
49 |
* Key creation
|
|
sl@0
|
50 |
*/
|
|
sl@0
|
51 |
|
|
sl@0
|
52 |
/**
|
|
sl@0
|
53 |
* Generates a new key pair and store it in the keystore.
|
|
sl@0
|
54 |
*
|
|
sl@0
|
55 |
* @param aReturnedKey This is filled by the caller with required
|
|
sl@0
|
56 |
* attributes, leaving the TKeyIdentifier iID and object handle iHandle
|
|
sl@0
|
57 |
* uninitialised - these values are set if the key is created successfully
|
|
sl@0
|
58 |
* @param aStatus This will be completed with the final status code
|
|
sl@0
|
59 |
*
|
|
sl@0
|
60 |
* @capability WriteUserData Requires the caller to have WriteUserData capability
|
|
sl@0
|
61 |
* @leave KErrPermissionDenied If the caller does not have WriteUserData capability
|
|
sl@0
|
62 |
* @leave KErrAlreadyExists If a key with the specified label already
|
|
sl@0
|
63 |
* exists in the keystore.
|
|
sl@0
|
64 |
* @leave KErrKeySize If the requested key size is not supported.
|
|
sl@0
|
65 |
* @leave KErrKeyAccess If an invalid combination of key access flags were specified.
|
|
sl@0
|
66 |
* @leave KErrKeyValidity If a validity period was specified, but the end
|
|
sl@0
|
67 |
* date was in the past.
|
|
sl@0
|
68 |
*/
|
|
sl@0
|
69 |
virtual void CreateKey(CCTKeyInfo*& aReturnedKey,
|
|
sl@0
|
70 |
TRequestStatus& aStatus) = 0;
|
|
sl@0
|
71 |
|
|
sl@0
|
72 |
/** Cancels an ongoing CreateKey() operation. */
|
|
sl@0
|
73 |
virtual void CancelCreateKey() = 0;
|
|
sl@0
|
74 |
|
|
sl@0
|
75 |
/**
|
|
sl@0
|
76 |
* Import keys
|
|
sl@0
|
77 |
*/
|
|
sl@0
|
78 |
|
|
sl@0
|
79 |
/**
|
|
sl@0
|
80 |
* Imports a cleartext key pair into the keystore.
|
|
sl@0
|
81 |
*
|
|
sl@0
|
82 |
* The import data is DER-encoded PKCS#8 format.
|
|
sl@0
|
83 |
*
|
|
sl@0
|
84 |
* @param aKey This is a descriptor representation of the PKCS#8 key data.
|
|
sl@0
|
85 |
* @param aReturnedKey This is filled by the caller with required
|
|
sl@0
|
86 |
* attributes, leaving the TKeyIdentifier iID and object handle iHandle
|
|
sl@0
|
87 |
* uninitialised - these values are set if the key is created successfully.
|
|
sl@0
|
88 |
*
|
|
sl@0
|
89 |
* @capability WriteUserData Requires the caller to have WriteUserData capability
|
|
sl@0
|
90 |
* @leave KErrPermissionDenied If the caller does not have WriteUserData capability
|
|
sl@0
|
91 |
* @leave KErrAlreadyExists If a key with the specified label already exists
|
|
sl@0
|
92 |
* in the keystore.
|
|
sl@0
|
93 |
* @leave KErrKeySize If the requested key size is not supported.
|
|
sl@0
|
94 |
* @leave KErrKeyAccess If an invalid combination of key access flags were specified.
|
|
sl@0
|
95 |
* @leave KErrKeyValidity If a validity period was specified, but the end
|
|
sl@0
|
96 |
* date was in the past.
|
|
sl@0
|
97 |
* @leave KErrArgument If there is an error parsing the key data.
|
|
sl@0
|
98 |
*/
|
|
sl@0
|
99 |
virtual void ImportKey(const TDesC8& aKey,
|
|
sl@0
|
100 |
CCTKeyInfo*& aReturnedKey,
|
|
sl@0
|
101 |
TRequestStatus& aStatus) = 0;
|
|
sl@0
|
102 |
|
|
sl@0
|
103 |
/** Cancels an ongoing ImportKey() operation. */
|
|
sl@0
|
104 |
virtual void CancelImportKey() = 0;
|
|
sl@0
|
105 |
|
|
sl@0
|
106 |
/**
|
|
sl@0
|
107 |
* Imports an encrypted key pair into the keystore.
|
|
sl@0
|
108 |
*
|
|
sl@0
|
109 |
* The import data is DER-encoded PKCS#5/PKCS#8 format.
|
|
sl@0
|
110 |
*
|
|
sl@0
|
111 |
* @param aKey This is a descriptor representation of the PKCS#8 key data
|
|
sl@0
|
112 |
* @param aReturnedKey This is filled by the caller with required
|
|
sl@0
|
113 |
* attributes, leaving the TKeyIdentifier iID and object handle iHandle
|
|
sl@0
|
114 |
* uninitialised - these values are set if the key is created successfully
|
|
sl@0
|
115 |
*
|
|
sl@0
|
116 |
* @capability WriteUserData Requires the caller to have WriteUserData capability
|
|
sl@0
|
117 |
* @leave KErrPermissionDenied If the caller does not have WriteUserData capability
|
|
sl@0
|
118 |
* @leave KErrAlreadyExists If a key with the specified label already exists
|
|
sl@0
|
119 |
* in the keystore.
|
|
sl@0
|
120 |
* @leave KErrKeySize If the requested key size is not supported.
|
|
sl@0
|
121 |
* @leave KErrKeyAccess If an invalid combination of key access flags were specified.
|
|
sl@0
|
122 |
* @leave KErrKeyValidity If a validity period was specified, but the end
|
|
sl@0
|
123 |
* date was in the past.
|
|
sl@0
|
124 |
* @leave KErrArgument If there is an error parsing the key data.
|
|
sl@0
|
125 |
*/
|
|
sl@0
|
126 |
virtual void ImportEncryptedKey(const TDesC8& aKey,
|
|
sl@0
|
127 |
CCTKeyInfo*& aReturnedKey,
|
|
sl@0
|
128 |
TRequestStatus& aStatus) = 0;
|
|
sl@0
|
129 |
|
|
sl@0
|
130 |
/** Cancels an ongoing ImportEncryptedKey() operation. */
|
|
sl@0
|
131 |
virtual void CancelImportEncryptedKey() = 0;
|
|
sl@0
|
132 |
|
|
sl@0
|
133 |
/**
|
|
sl@0
|
134 |
* Export keys
|
|
sl@0
|
135 |
*/
|
|
sl@0
|
136 |
|
|
sl@0
|
137 |
/**
|
|
sl@0
|
138 |
* Exports a key pair in the clear.
|
|
sl@0
|
139 |
*
|
|
sl@0
|
140 |
* The key is exported as DER-encoded PKCS#8 data.
|
|
sl@0
|
141 |
*
|
|
sl@0
|
142 |
* @param aHandle The handle of the key to export
|
|
sl@0
|
143 |
* @param aKey A reference to a HBufC8 pointer. The pointer will be set to
|
|
sl@0
|
144 |
* a newly allocated buffer containing the key data. It is the caller's
|
|
sl@0
|
145 |
* responsibility to delete this buffer.
|
|
sl@0
|
146 |
*
|
|
sl@0
|
147 |
* @capability Dependent Requires the caller to have any capabilities specified in the
|
|
sl@0
|
148 |
* key management security policy.
|
|
sl@0
|
149 |
* @leave KErrPermissionDenied If the caller does not conform to the key
|
|
sl@0
|
150 |
* management security policy.
|
|
sl@0
|
151 |
* @leave KErrNotFound If the key the handle referes to does not exist.
|
|
sl@0
|
152 |
* @leave KErrKeyAccess If the sensitive flag is set for the key, or the
|
|
sl@0
|
153 |
* exportable flag is not set.
|
|
sl@0
|
154 |
* @leave KErrKeyAlgorithm If this type of key cannot be exported.
|
|
sl@0
|
155 |
*/
|
|
sl@0
|
156 |
virtual void ExportKey(TCTTokenObjectHandle aHandle,
|
|
sl@0
|
157 |
HBufC8*& aKey,
|
|
sl@0
|
158 |
TRequestStatus& aStatus) = 0;
|
|
sl@0
|
159 |
|
|
sl@0
|
160 |
/** Cancels an ongoing ExportKey() operation. */
|
|
sl@0
|
161 |
virtual void CancelExportKey() = 0;
|
|
sl@0
|
162 |
|
|
sl@0
|
163 |
/**
|
|
sl@0
|
164 |
* Exports an encrypted key pair.
|
|
sl@0
|
165 |
*
|
|
sl@0
|
166 |
* The key is exported as DER-encoded PKCS#5/PKCS#8 data.
|
|
sl@0
|
167 |
*
|
|
sl@0
|
168 |
* @param aHandle The handle of the key to export
|
|
sl@0
|
169 |
* @param aKey A reference to a HBufC8 pointer. The pointer will be set to
|
|
sl@0
|
170 |
* a newly allocated buffer containing the key data.
|
|
sl@0
|
171 |
* @param aParams The PBE encryption parameters to use when encrypting the key.
|
|
sl@0
|
172 |
*
|
|
sl@0
|
173 |
* @capability Dependent Requires the caller to have any capabilities specified in the
|
|
sl@0
|
174 |
* key management security policy.
|
|
sl@0
|
175 |
* @leave KErrPermissionDenied If the caller does not conform to the key
|
|
sl@0
|
176 |
* management security policy.
|
|
sl@0
|
177 |
* @leave KErrNotFound If the key the handle referes to does not exist.
|
|
sl@0
|
178 |
* @leave KErrKeyAccess If the exportable flag is not set for the key.
|
|
sl@0
|
179 |
* @leave KErrKeyAlgorithm If this type of key cannot be exported.
|
|
sl@0
|
180 |
*/
|
|
sl@0
|
181 |
virtual void ExportEncryptedKey(TCTTokenObjectHandle aHandle,
|
|
sl@0
|
182 |
const CPBEncryptParms& aEncryptParams,
|
|
sl@0
|
183 |
HBufC8*& aKey,
|
|
sl@0
|
184 |
TRequestStatus& aStatus) = 0;
|
|
sl@0
|
185 |
|
|
sl@0
|
186 |
/** Cancels an ongoing ExportEncryptedKey() operation. */
|
|
sl@0
|
187 |
virtual void CancelExportEncryptedKey() = 0;
|
|
sl@0
|
188 |
|
|
sl@0
|
189 |
/**
|
|
sl@0
|
190 |
* Deletes a key.
|
|
sl@0
|
191 |
*
|
|
sl@0
|
192 |
* @param aHandle The handle of the key to delete
|
|
sl@0
|
193 |
*
|
|
sl@0
|
194 |
* @capability Dependent Requires the caller to have any capabilities specified in the
|
|
sl@0
|
195 |
* key management security policy.
|
|
sl@0
|
196 |
* @leave KErrPermissionDenied If the caller does not conform to the key
|
|
sl@0
|
197 |
* management security policy.
|
|
sl@0
|
198 |
* @leave KErrNotFound If the key the handle referes to does not exist.
|
|
sl@0
|
199 |
* @leave KErrAccessDenied If the calling process is not allowed to delete the key.
|
|
sl@0
|
200 |
* @leave KErrInUse If another client is currently using the key.
|
|
sl@0
|
201 |
*/
|
|
sl@0
|
202 |
virtual void DeleteKey(TCTTokenObjectHandle aHandle,
|
|
sl@0
|
203 |
TRequestStatus& aStatus) = 0;
|
|
sl@0
|
204 |
|
|
sl@0
|
205 |
/** Cancels an ongoing DeleteKey() operation. */
|
|
sl@0
|
206 |
virtual void CancelDeleteKey() = 0;
|
|
sl@0
|
207 |
|
|
sl@0
|
208 |
/**
|
|
sl@0
|
209 |
* Sets the security policy for key use.
|
|
sl@0
|
210 |
*
|
|
sl@0
|
211 |
* Specifies which processes are allowed to use the key for cryptographic
|
|
sl@0
|
212 |
* operations.
|
|
sl@0
|
213 |
*
|
|
sl@0
|
214 |
* @param aHandle The handle of the key
|
|
sl@0
|
215 |
* @param aPolicy The new security policy.
|
|
sl@0
|
216 |
*
|
|
sl@0
|
217 |
* @capability Dependent Requires the caller to have any capabilities specified in the
|
|
sl@0
|
218 |
* key management security policy.
|
|
sl@0
|
219 |
* @leave KErrPermissionDenied If the caller does not conform to the key
|
|
sl@0
|
220 |
* management security policy.
|
|
sl@0
|
221 |
* @leave KErrNotFound If the key the handle referes to does not exist.
|
|
sl@0
|
222 |
*/
|
|
sl@0
|
223 |
virtual void SetUsePolicy(TCTTokenObjectHandle aHandle,
|
|
sl@0
|
224 |
const TSecurityPolicy& aPolicy,
|
|
sl@0
|
225 |
TRequestStatus& aStatus) = 0;
|
|
sl@0
|
226 |
|
|
sl@0
|
227 |
/** Cancels an ongoing SetUsePolicy() operation. */
|
|
sl@0
|
228 |
virtual void CancelSetUsePolicy() = 0;
|
|
sl@0
|
229 |
|
|
sl@0
|
230 |
/**
|
|
sl@0
|
231 |
* Sets the security policy for key management.
|
|
sl@0
|
232 |
*
|
|
sl@0
|
233 |
* Specifies which processes are allowed to perform management operations on
|
|
sl@0
|
234 |
* the key.
|
|
sl@0
|
235 |
*
|
|
sl@0
|
236 |
* @param aHandle The handle of the key
|
|
sl@0
|
237 |
* @param aPolicy The new security policy.
|
|
sl@0
|
238 |
*
|
|
sl@0
|
239 |
* @capability Dependent Requires the caller to have any capabilities specified in the
|
|
sl@0
|
240 |
* current and new key management security policies.
|
|
sl@0
|
241 |
* @leave KErrPermissionDenied If the caller does not conform to the current
|
|
sl@0
|
242 |
* and new key management security policies.
|
|
sl@0
|
243 |
* @leave KErrNotFound If the key the handle referes to does not exist.
|
|
sl@0
|
244 |
*/
|
|
sl@0
|
245 |
virtual void SetManagementPolicy(TCTTokenObjectHandle aHandle,
|
|
sl@0
|
246 |
const TSecurityPolicy& aPolicy,
|
|
sl@0
|
247 |
TRequestStatus& aStatus) = 0;
|
|
sl@0
|
248 |
|
|
sl@0
|
249 |
/** Cancels an ongoing SetManagementPolicy() operation. */
|
|
sl@0
|
250 |
virtual void CancelSetManagementPolicy() = 0;
|
|
sl@0
|
251 |
|
|
sl@0
|
252 |
/**
|
|
sl@0
|
253 |
* Sets the passphrase timeout for all keys owned by this process.
|
|
sl@0
|
254 |
*
|
|
sl@0
|
255 |
* @param aTimeout The timeout in seconds. 0 means that the passphrase is
|
|
sl@0
|
256 |
* always asked for, and -1 means that it is never expired
|
|
sl@0
|
257 |
* @param aStatus This will be completed with the final status code
|
|
sl@0
|
258 |
*
|
|
sl@0
|
259 |
* @capability Dependent Requires the caller to have any capabilities specified in the
|
|
sl@0
|
260 |
* key management security policy.
|
|
sl@0
|
261 |
* @leave KErrPermissionDenied If the caller does not conform to the key
|
|
sl@0
|
262 |
* management security policy.
|
|
sl@0
|
263 |
* @leave KErrArgument If the timeout specified is invalid.
|
|
sl@0
|
264 |
*/
|
|
sl@0
|
265 |
virtual void SetPassphraseTimeout(TInt aTimeout,
|
|
sl@0
|
266 |
TRequestStatus& aStatus) = 0;
|
|
sl@0
|
267 |
|
|
sl@0
|
268 |
/** Cancels an ongoing SetPassphraseTimeout() operation. */
|
|
sl@0
|
269 |
virtual void CancelSetPassphraseTimeout() = 0;
|
|
sl@0
|
270 |
|
|
sl@0
|
271 |
/**
|
|
sl@0
|
272 |
* Re-locks the entire store (i.e., forget the pasphrase)
|
|
sl@0
|
273 |
*
|
|
sl@0
|
274 |
* @param aStatus This will be completed with the final status code
|
|
sl@0
|
275 |
*/
|
|
sl@0
|
276 |
virtual void Relock(TRequestStatus& aStatus) = 0;
|
|
sl@0
|
277 |
|
|
sl@0
|
278 |
/** Cancels an ongoing Relock() operation. */
|
|
sl@0
|
279 |
virtual void CancelRelock() = 0;
|
|
sl@0
|
280 |
|
|
sl@0
|
281 |
#ifdef SYMBIAN_AUTH_SERVER
|
|
sl@0
|
282 |
/**
|
|
sl@0
|
283 |
* Generate a new key pair and store it in keystore. The key should be stored against an
|
|
sl@0
|
284 |
* already authenticated user. If there is no user currently authenticated then authentication
|
|
sl@0
|
285 |
* should be performed before creation of the key.
|
|
sl@0
|
286 |
*
|
|
sl@0
|
287 |
* @param aReturnedKey This is filled by the caller with required
|
|
sl@0
|
288 |
* attributes, leaving the TKeyIdentifier iID and object handle
|
|
sl@0
|
289 |
* iHandle uninitialised - these values are set if the key is
|
|
sl@0
|
290 |
* created successfully.
|
|
sl@0
|
291 |
* @param aAuthenticationString The expression through which a user can be authenticated.
|
|
sl@0
|
292 |
* Currently this should correspond to one of the alias values
|
|
sl@0
|
293 |
* set by the licensee for authentication server configuration.
|
|
sl@0
|
294 |
* This should be stored against the created key.
|
|
sl@0
|
295 |
* @param aFreshness The validity to be considered for an already authenticated
|
|
sl@0
|
296 |
* identity. This should be stored against the created key.
|
|
sl@0
|
297 |
* Specification is in seconds.
|
|
sl@0
|
298 |
*
|
|
sl@0
|
299 |
* @param aStatus This will be completed with the final status code. Some specific
|
|
sl@0
|
300 |
* codes are as follows.
|
|
sl@0
|
301 |
* KErrPermissionDenied If the caller does not have WriteUserData
|
|
sl@0
|
302 |
* capability.
|
|
sl@0
|
303 |
* KErrAlreadyExists If a key with the specified label already
|
|
sl@0
|
304 |
* exists in the keystore for the specific
|
|
sl@0
|
305 |
* user.
|
|
sl@0
|
306 |
* KErrKeySize If the requested key size is not supported.
|
|
sl@0
|
307 |
* KErrKeyAccess If an invalid combination of key access
|
|
sl@0
|
308 |
* flags were specified.
|
|
sl@0
|
309 |
* KErrKeyValidity If a validity period was specified, but the
|
|
sl@0
|
310 |
* end date was in the past.
|
|
sl@0
|
311 |
* KErrAuthenticationFailure If the user authentication fails.
|
|
sl@0
|
312 |
*
|
|
sl@0
|
313 |
* @see AuthServer::CAuthExpression
|
|
sl@0
|
314 |
*
|
|
sl@0
|
315 |
* @capability WriteUserData Should require the caller to have WriteUserData capability.
|
|
sl@0
|
316 |
*/
|
|
sl@0
|
317 |
virtual void CreateKey( const TDesC& /*aAuthenticationString*/,
|
|
sl@0
|
318 |
TInt /*aFreshness*/,
|
|
sl@0
|
319 |
CCTKeyInfo*& /*aReturnedKey*/,
|
|
sl@0
|
320 |
TRequestStatus& aStatus )
|
|
sl@0
|
321 |
{
|
|
sl@0
|
322 |
TRequestStatus* status = &aStatus;
|
|
sl@0
|
323 |
User::RequestComplete(status,KErrNotSupported);
|
|
sl@0
|
324 |
}
|
|
sl@0
|
325 |
|
|
sl@0
|
326 |
/**
|
|
sl@0
|
327 |
* Imports a der-encoded PKCS#8 format key pair into the keystore. The key should be stored against an
|
|
sl@0
|
328 |
* already authenticated user. If there is no user currently authenticated then authentication
|
|
sl@0
|
329 |
* should be performed before creation of the key.
|
|
sl@0
|
330 |
*
|
|
sl@0
|
331 |
*
|
|
sl@0
|
332 |
* @param aKey This is a descriptor representation of the PKCS#8 key data.
|
|
sl@0
|
333 |
* @param aAuthenticationString The expression through which a user can be authenticated.
|
|
sl@0
|
334 |
* Currently this should correspond to one of the alias values
|
|
sl@0
|
335 |
* set by the licensee for authentication server configuration.
|
|
sl@0
|
336 |
* This should be stored against the created key.
|
|
sl@0
|
337 |
* @param aFreshness The validity to be considered for an already authenticated
|
|
sl@0
|
338 |
* identity. This should be stored against the created key.
|
|
sl@0
|
339 |
* Specification is in seconds.
|
|
sl@0
|
340 |
* @param aReturnedKey This is filled by the caller with required
|
|
sl@0
|
341 |
* attributes, leaving the TKeyIdentifier iID and object handle
|
|
sl@0
|
342 |
* iHandle uninitialised - these values are set if the key is
|
|
sl@0
|
343 |
* created successfully.
|
|
sl@0
|
344 |
* @param aStatus This will be completed with the final status code. Some specific
|
|
sl@0
|
345 |
* codes are as follows.
|
|
sl@0
|
346 |
* KErrPermissionDenied If the caller does not have WriteUserData
|
|
sl@0
|
347 |
* capability.
|
|
sl@0
|
348 |
* KErrAlreadyExists If a key with the specified label already
|
|
sl@0
|
349 |
* exists in the keystore for the specific
|
|
sl@0
|
350 |
* user.
|
|
sl@0
|
351 |
* KErrKeySize If the requested key size is not supported.
|
|
sl@0
|
352 |
* KErrKeyAccess If an invalid combination of key access flags
|
|
sl@0
|
353 |
* were specified.
|
|
sl@0
|
354 |
* KErrKeyValidity If a validity period was specified, but the end
|
|
sl@0
|
355 |
* date was in the past.
|
|
sl@0
|
356 |
* KErrArgument If there is an error parsing the key data.
|
|
sl@0
|
357 |
* KErrAuthenticationFailure If the user authentication fails.
|
|
sl@0
|
358 |
*
|
|
sl@0
|
359 |
* @see AuthServer::CAuthExpression
|
|
sl@0
|
360 |
*
|
|
sl@0
|
361 |
* @capability WriteUserData Should require the caller to have WriteUserData capability
|
|
sl@0
|
362 |
*/
|
|
sl@0
|
363 |
virtual void ImportKey( const TDesC8& /*aKey*/,
|
|
sl@0
|
364 |
const TDesC& /*aAuthenticationString*/,
|
|
sl@0
|
365 |
TInt /*aFreshness*/,
|
|
sl@0
|
366 |
CCTKeyInfo*& /*aReturnedKey*/,
|
|
sl@0
|
367 |
TRequestStatus& aStatus )
|
|
sl@0
|
368 |
{
|
|
sl@0
|
369 |
TRequestStatus* status = &aStatus;
|
|
sl@0
|
370 |
User::RequestComplete(status,KErrNotSupported);
|
|
sl@0
|
371 |
}
|
|
sl@0
|
372 |
|
|
sl@0
|
373 |
/**
|
|
sl@0
|
374 |
* Imports an encrypted key pair into the keystore. The key should be stored against an
|
|
sl@0
|
375 |
* already authenticated user. If there is no user currently authenticated then authentication
|
|
sl@0
|
376 |
* should be performed before creation of the key.
|
|
sl@0
|
377 |
*
|
|
sl@0
|
378 |
* The import data should be der-encoded PKCS#8 format encrypted in accordance to PKCS#5
|
|
sl@0
|
379 |
* specification.
|
|
sl@0
|
380 |
*
|
|
sl@0
|
381 |
* @param aKey This is a descriptor representation of the PKCS#8 key data.
|
|
sl@0
|
382 |
* Encrypted in accordance to PKCS#5 specification.
|
|
sl@0
|
383 |
* @param aAuthenticationString The expression through which a user can be authenticated.
|
|
sl@0
|
384 |
* Currently this should correspond to one of the alias values
|
|
sl@0
|
385 |
* set by the licensee for authentication server configuration.
|
|
sl@0
|
386 |
* This should be stored against the created key.
|
|
sl@0
|
387 |
* @param aFreshness The validity to be considered for an already authenticated
|
|
sl@0
|
388 |
* identity. This should be stored against the created key.
|
|
sl@0
|
389 |
* Specification is in seconds.
|
|
sl@0
|
390 |
* @param aReturnedKey This is filled by the caller with required
|
|
sl@0
|
391 |
* attributes, leaving the TKeyIdentifier iID and object handle
|
|
sl@0
|
392 |
* iHandle uninitialised - these values are set if the key is
|
|
sl@0
|
393 |
* created successfully.
|
|
sl@0
|
394 |
* @param aStatus This will be completed with the final status code. Some specific
|
|
sl@0
|
395 |
* codes are as follows.
|
|
sl@0
|
396 |
* KErrPermissionDenied If the caller does not have WriteUserData
|
|
sl@0
|
397 |
* capability.
|
|
sl@0
|
398 |
* KErrAlreadyExists If a key with the specified label already
|
|
sl@0
|
399 |
* exists in the keystore for the specific
|
|
sl@0
|
400 |
* user.
|
|
sl@0
|
401 |
* KErrKeySize If the requested key size is not supported.
|
|
sl@0
|
402 |
* KErrKeyAccess If an invalid combination of key access flags
|
|
sl@0
|
403 |
* were specified.
|
|
sl@0
|
404 |
* KErrKeyValidity If a validity period was specified, but the end
|
|
sl@0
|
405 |
* date was in the past.
|
|
sl@0
|
406 |
* KErrArgument If there is an error parsing the key data.
|
|
sl@0
|
407 |
* KErrAuthenticationFailure If the user authentication fails.
|
|
sl@0
|
408 |
*
|
|
sl@0
|
409 |
* @see AuthServer::CAuthExpression
|
|
sl@0
|
410 |
*
|
|
sl@0
|
411 |
* @capability WriteUserData Should require the caller to have WriteUserData capability
|
|
sl@0
|
412 |
*/
|
|
sl@0
|
413 |
virtual void ImportEncryptedKey( const TDesC8& /*aKey*/,
|
|
sl@0
|
414 |
const TDesC& /*aAuthenticationString*/,
|
|
sl@0
|
415 |
TInt /*aFreshness*/,
|
|
sl@0
|
416 |
CCTKeyInfo*& /*aReturnedKey*/,
|
|
sl@0
|
417 |
TRequestStatus& aStatus )
|
|
sl@0
|
418 |
{
|
|
sl@0
|
419 |
TRequestStatus* status = &aStatus;
|
|
sl@0
|
420 |
User::RequestComplete(status, KErrNotSupported);
|
|
sl@0
|
421 |
}
|
|
sl@0
|
422 |
|
|
sl@0
|
423 |
/**
|
|
sl@0
|
424 |
* Set the authentication policy for an already existing key in the store.
|
|
sl@0
|
425 |
*
|
|
sl@0
|
426 |
* @param aHandle The handle of the key whose policy is to be changed.
|
|
sl@0
|
427 |
* @param aAuthenticationString The expression associated to this key.
|
|
sl@0
|
428 |
* @param aFreshness The validity associated to this key.
|
|
sl@0
|
429 |
* Specification is in seconds.
|
|
sl@0
|
430 |
* @param aStatus Final status of the operation.
|
|
sl@0
|
431 |
* KErrAuthenticationFailure If the user authentication fails.
|
|
sl@0
|
432 |
*
|
|
sl@0
|
433 |
* @see AuthServer::CAuthExpression
|
|
sl@0
|
434 |
*
|
|
sl@0
|
435 |
*/
|
|
sl@0
|
436 |
virtual void SetAuthenticationPolicy( const TCTTokenObjectHandle /*aHandle*/,
|
|
sl@0
|
437 |
const TDesC& /*aAuthenticationString*/,
|
|
sl@0
|
438 |
TInt /*aFreshness*/,
|
|
sl@0
|
439 |
TRequestStatus& aStatus)
|
|
sl@0
|
440 |
{
|
|
sl@0
|
441 |
TRequestStatus* status = &aStatus;
|
|
sl@0
|
442 |
User::RequestComplete(status, KErrNotSupported);
|
|
sl@0
|
443 |
}
|
|
sl@0
|
444 |
|
|
sl@0
|
445 |
/**
|
|
sl@0
|
446 |
* Retrieve authentication policy for an already existing key in the store.
|
|
sl@0
|
447 |
*
|
|
sl@0
|
448 |
* @param aHandle The handle of the key whose policy is to be retrieved.
|
|
sl@0
|
449 |
* @param aAuthenticationString The expression associated to this key. The memory would
|
|
sl@0
|
450 |
* be allocated at the server side.
|
|
sl@0
|
451 |
* @param aFreshness The validity associated to this key.
|
|
sl@0
|
452 |
* Specification is in seconds.
|
|
sl@0
|
453 |
* @param aStatus Final status of the operation.
|
|
sl@0
|
454 |
* KErrAuthenticationFailure If the user authentication fails.
|
|
sl@0
|
455 |
*
|
|
sl@0
|
456 |
* @see AuthServer::CAuthExpression
|
|
sl@0
|
457 |
*
|
|
sl@0
|
458 |
*/
|
|
sl@0
|
459 |
virtual void GetAuthenticationPolicy( const TCTTokenObjectHandle /*aHandle*/,
|
|
sl@0
|
460 |
HBufC*& /*aAuthenticationString*/,
|
|
sl@0
|
461 |
TInt& /*aFreshness*/,
|
|
sl@0
|
462 |
TRequestStatus& aStatus)
|
|
sl@0
|
463 |
{
|
|
sl@0
|
464 |
TRequestStatus* status = &aStatus;
|
|
sl@0
|
465 |
User::RequestComplete(status, KErrNotSupported);
|
|
sl@0
|
466 |
}
|
|
sl@0
|
467 |
#endif // SYMBIAN_AUTH_SERVER
|
|
sl@0
|
468 |
|
|
sl@0
|
469 |
};
|
|
sl@0
|
470 |
|
|
sl@0
|
471 |
|
|
sl@0
|
472 |
#endif // __MCTKEYSTOREMANAGER_H__
|