src/libcharon/sa/keymat_v1.h

   1 /*
   2  * Copyright (C) 2011 Tobias Brunner
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 /**
  17  * @defgroup keymat_v1 keymat_v1
  18  * @{ @ingroup sa
  19  */
  20
  21 #ifndef KEYMAT_V1_H_
  22 #define KEYMAT_V1_H_
  23
  24 #include <sa/keymat.h>
  25
  26 typedef struct keymat_v1_t keymat_v1_t;
  27
  28 /**
  29  * Derivation and management of sensitive keying material, IKEv1 variant.
  30  */
  31 struct keymat_v1_t {
  32
  33         /**
  34          * Implements keymat_t.
  35          */
  36         keymat_t keymat;
  37
  38         /**
  39          * Derive keys for the IKE_SA.
  40          *
  41          * These keys are not handed out, but are used by the associated signers,
  42          * crypters and authentication functions.
  43          *
  44          * @param proposal              selected algorithms
  45          * @param dh                    diffie hellman key allocated by create_dh()
  46          * @param dh_other              public DH value from other peer
  47          * @param nonce_i               initiators nonce value
  48          * @param nonce_r               responders nonce value
  49          * @param id                    IKE_SA identifier
  50          * @param auth                  authentication method
  51          * @param shared_key    PSK in case of AUTH_CLASS_PSK, NULL otherwise
  52          * @return                              TRUE on success
  53          */
  54         bool (*derive_ike_keys)(keymat_v1_t *this, proposal_t *proposal,
  55                                                         diffie_hellman_t *dh, chunk_t dh_other,
  56                                                         chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id,
  57                                                         auth_class_t auth, shared_key_t *shared_key);
  58
  59         /**
  60          * Returns the IV for a message with the given message ID.
  61          *
  62          * @param mid                   message ID
  63          * @return                              IV (needs to be freed)
  64          */
  65         chunk_t (*get_iv)(keymat_v1_t *this, u_int32_t mid);
  66
  67         /**
  68          * Updates the IV for the next message with the given message ID.
  69          *
  70          * A call of confirm_iv() is required in order to actually make the IV
  71          * available.  This is needed for the inbound case where we store the last
  72          * block of the encrypted message but want to update the IV only after
  73          * verification of the decrypted message.
  74          *
  75          * @param mid                   message ID
  76          * @param last_block    last block of encrypted message (gets cloned)
  77          */
  78         void (*update_iv)(keymat_v1_t *this, u_int32_t mid, chunk_t last_block);
  79
  80         /**
  81          * Confirms the updated IV for the given message ID.
  82          *
  83          * To actually make the new IV available via get_iv this method has to
  84          * be called after update_iv.
  85          *
  86          * @param mid                   message ID
  87          */
  88         void (*confirm_iv)(keymat_v1_t *this, u_int32_t mid);
  89
  90 };
  91
  92 /**
  93  * Create a keymat instance.
  94  *
  95  * @param initiator                     TRUE if we are the initiator
  96  * @return                                      keymat instance
  97  */
  98 keymat_v1_t *keymat_v1_create(bool initiator);
  99
 100 #endif /** KEYMAT_V1_H_ @}*/