|
|
|
|
Instead of specifiying signature or encryption key in the
corresponding context object (signKey
member of xmlSecDSigCtx
structure or encKey member of
xmlSecEncCtx structure),
the application can use keys manager to select the
signature or encryption key. This is especialy useful
when you are encrypting or signing something with a session key
which is by itself should be encrypted. The key for the
session key encryption in the
<EncryptedKey/>
node could be selected using
<dsig:KeyName/>
node in the template.
Example 17. Encrypting file using a session key and a permanent key from keys manager.
/**
* load_rsa_keys:
* @key_file: the key filename.
*
* Creates default keys manager and load RSA key from #key_file in it.
* The caller is responsible for destroing returned keys manager using
* @xmlSecKeysMngrDestroy.
*
* Returns the pointer to newly created keys manager or NULL if an error
* occurs.
*/
xmlSecKeysMngrPtr
load_rsa_keys(char* key_file) {
xmlSecKeysMngrPtr mngr;
xmlSecKeyPtr key;
assert(key_file);
/* create and initialize keys manager, we use a default list based
* keys manager, implement your own xmlSecKeysStore klass if you need
* something more sophisticated
*/
mngr = xmlSecKeysMngrCreate();
if(mngr == NULL) {
fprintf(stderr, "Error: failed to create keys manager.\n");
return(NULL);
}
if(xmlSecCryptoAppDefaultKeysMngrInit(mngr) < 0) {
fprintf(stderr, "Error: failed to initialize keys manager.\n");
xmlSecKeysMngrDestroy(mngr);
return(NULL);
}
/* load private RSA key */
key = xmlSecCryptoAppKeyLoad(key_file, xmlSecKeyDataFormatPem, NULL, NULL, NULL);
if(key == NULL) {
fprintf(stderr,"Error: failed to load rsa key from file \"%s\"\n", key_file);
xmlSecKeysMngrDestroy(mngr);
return(NULL);
}
/* set key name to the file name, this is just an example! */
if(xmlSecKeySetName(key, BAD_CAST key_file) < 0) {
fprintf(stderr,"Error: failed to set key name for key from \"%s\"\n", key_file);
xmlSecKeyDestroy(key);
xmlSecKeysMngrDestroy(mngr);
return(NULL);
}
/* add key to keys manager, from now on keys manager is responsible
* for destroying key
*/
if(xmlSecCryptoAppDefaultKeysMngrAdoptKey(mngr, key) < 0) {
fprintf(stderr,"Error: failed to add key from \"%s\" to keys manager\n", key_file);
xmlSecKeyDestroy(key);
xmlSecKeysMngrDestroy(mngr);
return(NULL);
}
return(mngr);
}
/**
* encrypt_file:
* @mngr: the pointer to keys manager.
* @xml_file: the encryption template file name.
* @key_name: the RSA key name.
*
* Encrypts #xml_file using a dynamicaly created template, a session DES key
* and an RSA key from keys manager.
*
* Returns 0 on success or a negative value if an error occurs.
*/
int
encrypt_file(xmlSecKeysMngrPtr mngr, const char* xml_file, const char* key_name) {
xmlDocPtr doc = NULL;
xmlNodePtr encDataNode = NULL;
xmlNodePtr keyInfoNode = NULL;
xmlNodePtr encKeyNode = NULL;
xmlNodePtr keyInfoNode2 = NULL;
xmlSecEncCtxPtr encCtx = NULL;
int res = -1;
assert(mngr);
assert(xml_file);
assert(key_name);
/* load template */
doc = xmlParseFile(xml_file);
if ((doc == NULL) || (xmlDocGetRootElement(doc) == NULL)){
fprintf(stderr, "Error: unable to parse file \"%s\"\n", xml_file);
goto done;
}
/* create encryption template to encrypt XML file and replace
* its content with encryption result */
encDataNode = xmlSecTmplEncDataCreate(doc, xmlSecTransformDes3CbcId,
NULL, xmlSecTypeEncElement, NULL, NULL);
if(encDataNode == NULL) {
fprintf(stderr, "Error: failed to create encryption template\n");
goto done;
}
/* we want to put encrypted data in the <enc:CipherValue/> node */
if(xmlSecTmplEncDataEnsureCipherValue(encDataNode) == NULL) {
fprintf(stderr, "Error: failed to add CipherValue node\n");
goto done;
}
/* add <dsig:KeyInfo/> */
keyInfoNode = xmlSecTmplEncDataEnsureKeyInfo(encDataNode, NULL);
if(keyInfoNode == NULL) {
fprintf(stderr, "Error: failed to add key info\n");
goto done;
}
/* add <enc:EncryptedKey/> to store the encrypted session key */
encKeyNode = xmlSecTmplKeyInfoAddEncryptedKey(keyInfoNode,
xmlSecTransformRsaOaepId,
NULL, NULL, NULL);
if(encKeyNode == NULL) {
fprintf(stderr, "Error: failed to add key info\n");
goto done;
}
/* we want to put encrypted key in the <enc:CipherValue/> node */
if(xmlSecTmplEncDataEnsureCipherValue(encKeyNode) == NULL) {
fprintf(stderr, "Error: failed to add CipherValue node\n");
goto done;
}
/* add <dsig:KeyInfo/> and <dsig:KeyName/> nodes to <enc:EncryptedKey/> */
keyInfoNode2 = xmlSecTmplEncDataEnsureKeyInfo(encKeyNode, NULL);
if(keyInfoNode2 == NULL) {
fprintf(stderr, "Error: failed to add key info\n");
goto done;
}
/* set key name so we can lookup key when needed */
if(xmlSecTmplKeyInfoAddKeyName(keyInfoNode2, key_name) == NULL) {
fprintf(stderr, "Error: failed to add key name\n");
goto done;
}
/* create encryption context */
encCtx = xmlSecEncCtxCreate(mngr);
if(encCtx == NULL) {
fprintf(stderr,"Error: failed to create encryption context\n");
goto done;
}
/* generate a Triple DES key */
encCtx->encKey = xmlSecKeyGenerate(xmlSecKeyDataDesId, 192, xmlSecKeyDataTypeSession);
if(encCtx->encKey == NULL) {
fprintf(stderr,"Error: failed to generate session des key\n");
goto done;
}
/* encrypt the data */
if(xmlSecEncCtxXmlEncrypt(encCtx, encDataNode, xmlDocGetRootElement(doc)) < 0) {
fprintf(stderr,"Error: encryption failed\n");
goto done;
}
/* we template is inserted in the doc */
encDataNode = NULL;
/* print encrypted data with document to stdout */
xmlDocDump(stdout, doc);
/* success */
res = 0;
done:
/* cleanup */
if(encCtx != NULL) {
xmlSecEncCtxDestroy(encCtx);
}
if(encDataNode != NULL) {
xmlFreeNode(encDataNode);
}
if(doc != NULL) {
xmlFreeDoc(doc);
}
return(res);
}