Source: security/tpm/tpm-back-end-file.js

  1. /**
  2.  * Copyright (C) 2017-2018 Regents of the University of California.
  3.  * @author: Jeff Thompson <jefft0@remap.ucla.edu>
  4.  * @author: From ndn-cxx security https://github.com/named-data/ndn-cxx/blob/master/src/security/tpm/back-end-file.hpp
  5.  *
  6.  * This program is free software: you can redistribute it and/or modify
  7.  * it under the terms of the GNU Lesser General Public License as published by
  8.  * the Free Software Foundation, either version 3 of the License, or
  9.  * (at your option) any later version.
  10.  *
  11.  * This program is distributed in the hope that it will be useful,
  12.  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13.  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14.  * GNU Lesser General Public License for more details.
  15.  *
  16.  * You should have received a copy of the GNU Lesser General Public License
  17.  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18.  * A copy of the GNU Lesser General Public License is in the file COPYING.
  19.  */
  21. /** @ignore */
  22. var path = require('path'); /** @ignore */
  23. var fs = require('fs'); /** @ignore */
  24. var Crypto = require('../../crypto.js'); /** @ignore */
  25. var Blob = require('../../util/blob.js').Blob; /** @ignore */
  26. var TpmPrivateKey = require('./tpm-private-key.js').TpmPrivateKey; /** @ignore */
  27. var TpmKeyHandleMemory = require('./tpm-key-handle-memory.js').TpmKeyHandleMemory; /** @ignore */
  28. var TpmBackEnd = require('./tpm-back-end.js').TpmBackEnd; /** @ignore */
  29. var SyncPromise = require('../../util/sync-promise.js').SyncPromise;
  31. /**
  32.  * TpmBackEndFile extends TpmBackEnd to implement a TPM back-end using on-disk
  33.  * file storage. In this TPM, each private key is stored in a separate file with
  34.  * permission 0400, i.e., owner read-only. The key is stored in PKCS #1 format
  35.  * in base64 encoding.
  36.  *
  37.  * Create a TpmBackEndFile to use the given path to store files (of provided) or
  38.  * to the default location.
  39.  * @param {string} locationPath (optional) The full path of the directory to
  40.  * store private keys. If omitted or null or "", use the default location
  41.  * ~/.ndn/ndnsec-key-file.
  42.  * @constructor
  43.  */
  44. var TpmBackEndFile = function TpmBackEndFile(locationPath)
  45. {
  46.   // Call the base constructor.
  47.   TpmBackEnd.call(this);
  49.   if (locationPath == undefined || locationPath == "") {
  50.     var home = process.env.HOME || process.env.HOMEPATH || process.env.USERPROFILE;
  51.     locationPath = path.join(home, ".ndn", "ndnsec-key-file");
  52.   }
  54.   this.keyStorePath_ = locationPath;
  55. };
  57. TpmBackEndFile.prototype = new TpmBackEnd();
  58. TpmBackEndFile.prototype.name = "TpmBackEndFile";
  60. exports.TpmBackEndFile = TpmBackEndFile;
  62. /**
  63.  * Create a TpmBackEndFile.Error which extends TpmBackEnd.Error and represents a
  64.  * non-semantic error in backend TPM file processing.
  65.  * Call with: throw new TpmBackEndFile.Error(new Error("message")).
  66.  * @constructor
  67.  * @param {Error} error The exception created with new Error.
  68.  */
  69. TpmBackEndFile.Error = function TpmBackEndFileError(error)
  70. {
  71.   // Call the base constructor.
  72.   TpmBackEnd.Error.call(this, error);
  73. }
  74. TpmBackEndFile.Error.prototype = new TpmBackEnd.Error();
  75. TpmBackEndFile.Error.prototype.name = "TpmBackEndFileError";
  77. TpmBackEndFile.getScheme = function() { return "tpm-file"; };
  79. /**
  80.  * A protected method to check if the key with name keyName exists in the TPM.
  81.  * @param {Name} keyName The name of the key.
  82.  * @param {boolean} useSync (optional) If true then return a SyncPromise which
  83.  * is already fulfilled. If omitted or false, this may return a SyncPromise or
  84.  * an async Promise.
  85.  * @return {Promise|SyncPromise} A promise which returns true if the key exists.
  86.  */
  87. TpmBackEndFile.prototype.doHasKeyPromise_ = function(keyName, useSync)
  88. {
  89.   return Promise.resolve(this.hasKey_(keyName));
  90. };
  92. /**
  93.  * Do the work of doHasKeyPromise_
  94.  * @param {Name} keyName The name of the key.
  95.  * @return {boolean} True if the key exists.
  96.  */
  97. TpmBackEndFile.prototype.hasKey_ = function(keyName)
  98. {
  99.   if (!fs.existsSync(this.toFilePath_(keyName)))
  100.     return false;
  102.   try {
  103.     this.loadKey_(keyName);
  104.     return true;
  105.   } catch (ex) {
  106.     return false;
  107.   }
  108. };
  110. /**
  111.  * A protected method to get the handle of the key with name keyName.
  112.  * @param {Name} keyName The name of the key.
  113.  * @param {boolean} useSync (optional) If true then return a SyncPromise which
  114.  * is already fulfilled. If omitted or false, this may return a SyncPromise or
  115.  * an async Promise.
  116.  * @return {Promise|SyncPromise} A promise which returns a TpmKeyHandle of the
  117.  * key, or returns null if the key does not exist.
  118.  */
  119. TpmBackEndFile.prototype.doGetKeyHandlePromise_ = function(keyName, useSync)
  120. {
  121.   if (!this.hasKey_(keyName))
  122.     return null;
  124.   return new TpmKeyHandleMemory(this.loadKey_(keyName));
  125. };
  127. /**
  128.  * A protected method to create a key for identityName according to params. The
  129.  * created key is named as: /<identityName>/[keyId]/KEY . The key name is set in
  130.  * the returned TpmKeyHandle.
  131.  * @param {Name} identityName The name if the identity.
  132.  * @param {KeyParams} params The KeyParams for creating the key.
  133.  * @param {boolean} useSync (optional) If true then return a SyncPromise which
  134.  * is already fulfilled. If omitted or false, this may return a SyncPromise or
  135.  * an async Promise.
  136.  * @return {Promise|SyncPromise} A promise which returns the TpmKeyHandle of
  137.  * the created key, or a promise rejected with TpmBackEnd.Error if the key
  138.  * cannot be created.
  139.  */
  140. TpmBackEndFile.prototype.doCreateKeyPromise_ = function
  141.   (identityName, params, useSync)
  142. {
  143.   var key;
  144.   try {
  145.     // We know that TpmPrivateKey.generatePrivateKeyPromise is sync.
  146.     key = SyncPromise.getValue(TpmPrivateKey.generatePrivateKeyPromise(params));
  147.   } catch (ex) {
  148.     return Promise.reject(new TpmBackEndFile.Error(new Error
  149.       ("Error in TpmPrivateKey.generatePrivateKey: " + ex)));
  150.   }
  151.   var keyHandle = new TpmKeyHandleMemory(key);
  153.   TpmBackEnd.setKeyName(keyHandle, identityName, params);
  155.   try {
  156.     this.saveKey_(keyHandle.getKeyName(), key);
  157.   } catch (ex) {
  158.     return Promise.reject(ex);
  159.   }
  160.   return Promise.resolve(keyHandle);
  161. };
  163. /**
  164.  * A protected method to delete the key with name keyName. If the key doesn't
  165.  * exist, do nothing.
  166.  * @param {Name} keyName The name of the key to delete.
  167.  * @param {boolean} useSync (optional) If true then return a SyncPromise which
  168.  * is already fulfilled. If omitted or false, this may return a SyncPromise or
  169.  * an async Promise.
  170.  * @return {Promise|SyncPromise} A promise which fulfills when finished, or a
  171.  * promise rejected with TpmBackEnd.Error if the deletion fails.
  172.  */
  173. TpmBackEndFile.prototype.doDeleteKeyPromise_ = function(keyName, useSync)
  174. {
  175.   var filePath = this.toFilePath_(keyName);
  176.   if (fs.existsSync(filePath)) {
  177.     try {
  178.       fs.unlinkSync(filePath);
  179.     } catch (ex) {
  180.       return Promise.reject(new TpmBackEndFile.Error(new Error
  181.         ("Error deleting private key file: " + ex)));
  182.     }
  183.   }
  185.   return Promise.resolve();
  186. };
  188. // TODO: doExportKeyPromise_
  189. // TODO: doImportKeyPromise_
  191. /**
  192.  * Load the private key with name keyName from the key file directory.
  193.  * @param {Name} keyName The name of the key.
  194.  * @return {TpmPrivateKey} The key loaded into a TpmPrivateKey.
  195.  */
  196. TpmBackEndFile.prototype.loadKey_ = function(keyName)
  197. {
  198.   var key = new TpmPrivateKey();
  199.   var pkcs;
  200.   try {
  201.     var base64Content = fs.readFileSync(this.toFilePath_(keyName)).toString();
  202.     pkcs = new Buffer(base64Content, 'base64');
  203.   } catch (ex) {
  204.     throw new TpmBackEndFile.Error(new Error
  205.       ("Error reading private key file: " + ex));
  206.   }
  208.   try {
  209.     key.loadPkcs1(pkcs, null);
  210.   } catch (ex) {
  211.     throw new TpmBackEndFile.Error(new Error
  212.       ("Error decoding private key file: " + ex));
  213.   }
  215.   return key;
  216. };
  218. /**
  219.  * Save the private key using keyName into the key file directory.
  220.  * @param {Name} keyName The name of the key.
  221.  * @param {TpmPrivateKey} key The private key to save.
  222.  */
  223. TpmBackEndFile.prototype.saveKey_ = function(keyName, key)
  224. {
  225.   var filePath = this.toFilePath_(keyName);
  226.   var base64;
  227.   try {
  228.     base64 = key.toPkcs1().buf().toString('base64');
  229.   } catch (ex) {
  230.     throw new TpmBackEndFile.Error(new Error
  231.       ("Error encoding private key file: " + ex));
  232.   }
  234.   try {
  235.     var options = { mode: parseInt('0400', 8) };
  236.     fs.writeFileSync(filePath, base64, options);
  237.   } catch (ex) {
  238.     throw new TpmBackEndFile.Error(new Error
  239.       ("Error writing private key file: " + ex));
  240.   }
  241. };
  243. /**
  244.  * Get the file path for the keyName, which is keyStorePath_ + "/" +
  245.  * hex(sha256(keyName-wire-encoding)) + ".privkey" .
  246.  * @param {Name} keyName The name of the key.
  247.  * @return {string} The file path for the key.
  248.  */
  249. TpmBackEndFile.prototype.toFilePath_ = function(keyName)
  250. {
  251.   var keyEncoding = keyName.wireEncode();
  252.   var hash = Crypto.createHash('sha256');
  253.   hash.update(keyEncoding.buf());
  254.   var digest = hash.digest();
  256.   return path.join
  257.     (this.keyStorePath_, new Blob(digest, false).toHex() + ".privkey");
  258. };