Tizen Native API  4.0
Key Manager Client

It provides APIs accessing on the secure repository and additional secure cryptographic operations.

Required Header

#include <ckmc/ckmc-manager.h>

Overview

It provides APIs for storing, getting, and removing APIs for keys, certificates, and sensitive data on/from the Key Manager secure repository which is protected by a user’s passwords. Additionally, it provides secure cryptographic operations for non-exportable keys without revealing key values to clients.

Functions

int ckmc_save_key (const char *alias, const ckmc_key_s key, const ckmc_policy_s policy)
 Stores a key inside key manager based on the provided policy.
int ckmc_remove_key (const char *alias) TIZEN_DEPRECATED_API
 Removes a key from key manager.
int ckmc_get_key (const char *alias, const char *password, ckmc_key_s **ppkey)
 Gets a key from key manager.
int ckmc_get_key_alias_list (ckmc_alias_list_s **ppalias_list)
 Gets all the alias of keys that the client can access.
int ckmc_save_cert (const char *alias, const ckmc_cert_s cert, const ckmc_policy_s policy)
 Stores a certificate inside key manager based on the provided policy.
int ckmc_remove_cert (const char *alias) TIZEN_DEPRECATED_API
 Removes a certificate from key manager.
int ckmc_get_cert (const char *alias, const char *password, ckmc_cert_s **ppcert)
 Gets a certificate from key manager.
int ckmc_get_cert_alias_list (ckmc_alias_list_s **ppalias_list)
 Gets all alias of certificates which the client can access.
int ckmc_save_pkcs12 (const char *alias, const ckmc_pkcs12_s *pkcs, const ckmc_policy_s key_policy, const ckmc_policy_s cert_policy)
 Stores PKCS12's contents inside key manager based on the provided policies. All items from the PKCS12 will use the same alias.
int ckmc_get_pkcs12 (const char *alias, const char *key_password, const char *cert_password, ckmc_pkcs12_s **pkcs12)
 Gets a pkcs12 from key manager.
int ckmc_save_data (const char *alias, ckmc_raw_buffer_s data, const ckmc_policy_s policy)
 Stores a data inside key manager based on the provided policy.
int ckmc_remove_data (const char *alias) TIZEN_DEPRECATED_API
 Removes a data from key manager.
int ckmc_get_data (const char *alias, const char *password, ckmc_raw_buffer_s **ppdata)
 Gets a data from key manager.
int ckmc_get_data_alias_list (ckmc_alias_list_s **ppalias_list)
 Gets all alias of data which the client can access.
int ckmc_create_key_pair_rsa (const size_t size, const char *private_key_alias, const char *public_key_alias, const ckmc_policy_s policy_private_key, const ckmc_policy_s policy_public_key)
 Creates RSA private/public key pair and stores them inside key manager based on each policy.
int ckmc_create_key_pair_dsa (const size_t size, const char *private_key_alias, const char *public_key_alias, const ckmc_policy_s policy_private_key, const ckmc_policy_s policy_public_key)
 Creates DSA private/public key pair and stores them inside key manager based on each policy.
int ckmc_create_key_pair_ecdsa (const ckmc_ec_type_e type, const char *private_key_alias, const char *public_key_alias, const ckmc_policy_s policy_private_key, const ckmc_policy_s policy_public_key)
 Creates ECDSA private/public key pair and stores them inside key manager based on each policy.
int ckmc_create_key_aes (size_t size, const char *key_alias, ckmc_policy_s key_policy)
 Creates AES key and stores it inside key manager based on the policy.
int ckmc_create_signature (const char *private_key_alias, const char *password, const ckmc_raw_buffer_s message, const ckmc_hash_algo_e hash, const ckmc_rsa_padding_algo_e padding, ckmc_raw_buffer_s **ppsignature)
 Creates a signature on a given message using a private key and returns the signature.
int ckmc_verify_signature (const char *public_key_alias, const char *password, const ckmc_raw_buffer_s message, const ckmc_raw_buffer_s signature, const ckmc_hash_algo_e hash, const ckmc_rsa_padding_algo_e padding)
 Verifies a given signature on a given message using a public key and returns the signature status.
int ckmc_get_cert_chain (const ckmc_cert_s *cert, const ckmc_cert_list_s *untrustedcerts, ckmc_cert_list_s **ppcert_chain_list)
 Verifies a certificate chain and returns that chain.
int ckmc_get_cert_chain_with_alias (const ckmc_cert_s *cert, const ckmc_alias_list_s *untrustedcerts, ckmc_cert_list_s **ppcert_chain_list) TIZEN_DEPRECATED_API
 Verifies a certificate chain using an alias list of untrusted certificates and return that chain.
int ckmc_get_cert_chain_with_trustedcert (const ckmc_cert_s *cert, const ckmc_cert_list_s *untrustedcerts, const ckmc_cert_list_s *trustedcerts, const bool use_trustedsystemcerts, ckmc_cert_list_s **ppcert_chain_list)
 Verifies a certificate chain and returns that chain using user-entered, trusted, and untrusted CA certificates.
int ckmc_ocsp_check (const ckmc_cert_list_s *pcert_chain_list, ckmc_ocsp_status_e *ocsp_status)
 Perform OCSP that checks certificate is whether revoked or not.
int ckmc_allow_access (const char *alias, const char *accessor, ckmc_access_right_e granted) TIZEN_DEPRECATED_API
 Allows another application to access client's application data.
int ckmc_set_permission (const char *alias, const char *accessor, int permissions)
 Allows another application to access client's application data.
int ckmc_deny_access (const char *alias, const char *accessor) TIZEN_DEPRECATED_API
 Revokes another application's access to client's application data.
int ckmc_remove_alias (const char *alias)
 Removes an entry (no matter of type) from the key manager.
int ckmc_encrypt_data (ckmc_param_list_h params, const char *key_alias, const char *password, const ckmc_raw_buffer_s decrypted, ckmc_raw_buffer_s **ppencrypted)
 Encrypts data using selected key and algorithm.
int ckmc_decrypt_data (ckmc_param_list_h params, const char *key_alias, const char *password, const ckmc_raw_buffer_s encrypted, ckmc_raw_buffer_s **ppdecrypted)
 Decrypts data using selected key and algorithm.

Function Documentation

int ckmc_allow_access ( const char *  alias,
const char *  accessor,
ckmc_access_right_e  granted 
)

Allows another application to access client's application data.

Deprecated:
Deprecated since 2.4.[Use ckmc_set_permission() instead]
Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
Data identified by alias should exist.
Parameters:
[in]aliasData alias for which access will be granted
[in]accessorPackage id of the application that will gain access rights
[in]grantedRights granted for accessor application
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_deny_access()
int ckmc_create_key_aes ( size_t  size,
const char *  key_alias,
ckmc_policy_s  key_policy 
)

Creates AES key and stores it inside key manager based on the policy.

Since :
3.0
Remarks:
If password in the policy is provided, the key is additionally encrypted with the password in the policy.
Parameters:
[in]sizeThe size of key strength to be created
128, 192 and 256 are supported
[in]key_aliasThe name of key to be stored
[in]key_policyThe policy about how to store the key securely
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ALIAS_EXISTSAlias already exists
CKMC_ERROR_DB_ERRORFailed due to other DB transaction unexpectedly
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_create_key_pair_rsa()
ckmc_create_key_pair_dsa()
ckmc_create_key_pair_ecdsa()
ckmc_policy_s
int ckmc_create_key_pair_dsa ( const size_t  size,
const char *  private_key_alias,
const char *  public_key_alias,
const ckmc_policy_s  policy_private_key,
const ckmc_policy_s  policy_public_key 
)

Creates DSA private/public key pair and stores them inside key manager based on each policy.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
If password in the policy is provided, the key is additionally encrypted with the password in the policy.
Parameters:
[in]sizeThe size of key strength to be created
1024, 2048, 3072 and 4096 are supported
[in]private_key_aliasThe name of private key to be stored
[in]public_key_aliasThe name of public key to be stored
[in]policy_private_keyThe policy about how to store a private key securely
[in]policy_public_keyThe policy about how to store a public key securely
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ALIAS_EXISTSAlias already exists
CKMC_ERROR_DB_ERRORFailed due to other DB transaction unexpectedly
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_create_key_pair_rsa()
ckmc_create_key_pair_ecdsa()
ckmc_create_signature()
ckmc_verify_signature()
int ckmc_create_key_pair_ecdsa ( const ckmc_ec_type_e  type,
const char *  private_key_alias,
const char *  public_key_alias,
const ckmc_policy_s  policy_private_key,
const ckmc_policy_s  policy_public_key 
)

Creates ECDSA private/public key pair and stores them inside key manager based on each policy.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
If password in the policy is provided, the key is additionally encrypted with the password in the policy.
Parameters:
[in]typeThe type of elliptic curve of ECDSA
[in]private_key_aliasThe name of private key to be stored
[in]public_key_aliasThe name of public key to be stored
[in]policy_private_keyThe policy about how to store a private key securely
[in]policy_public_keyThe policy about how to store a public key securely
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ALIAS_EXISTSAlias already exists
CKMC_ERROR_DB_ERRORFailed due to other DB transaction unexpectedly
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_create_key_pair_rsa()
ckmc_create_key_pair_dsa()
ckmc_create_signature()
ckmc_verify_signature()
ckmc_ec_type_e
int ckmc_create_key_pair_rsa ( const size_t  size,
const char *  private_key_alias,
const char *  public_key_alias,
const ckmc_policy_s  policy_private_key,
const ckmc_policy_s  policy_public_key 
)

Creates RSA private/public key pair and stores them inside key manager based on each policy.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
If password in the policy is provided, the key is additionally encrypted with the password in the policy.
Parameters:
[in]sizeThe size of key strength to be created
1024, 2048, and 4096 are supported
[in]private_key_aliasThe name of private key to be stored
[in]public_key_aliasThe name of public key to be stored
[in]policy_private_keyThe policy about how to store a private key securely
[in]policy_public_keyThe policy about how to store a public key securely
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ALIAS_EXISTSAlias already exists
CKMC_ERROR_DB_ERRORFailed due to other DB transaction unexpectedly
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_create_key_pair_dsa()
ckmc_create_key_pair_ecdsa()
ckmc_create_signature()
ckmc_verify_signature()
int ckmc_create_signature ( const char *  private_key_alias,
const char *  password,
const ckmc_raw_buffer_s  message,
const ckmc_hash_algo_e  hash,
const ckmc_rsa_padding_algo_e  padding,
ckmc_raw_buffer_s **  ppsignature 
)

Creates a signature on a given message using a private key and returns the signature.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
If password of policy is provided during storing a key, the same password should be provided.
You must destroy the newly created ppsignature by calling ckmc_buffer_free() if it is no longer needed.
Parameters:
[in]private_key_aliasThe name of private key
[in]passwordThe password used in decrypting a private key value
[in]messageThe message that is signed with a private key
[in]hashThe hash algorithm used in creating signature
[in]paddingThe RSA padding algorithm used in creating signature
It is used only when the signature algorithm is RSA. If padding is CKMC_NONE_PADDING you must use CKMC_HASH_NONE and the message must be equal to key length
[out]ppsignatureThe pointer to a newly created signature
If an error occurs, *ppsignature will be null
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
CKMC_ERROR_AUTHENTICATION_FAILEDDecryption failed because password is incorrect
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_create_key_pair_rsa()
ckmc_create_key_pair_ecdsa()
ckmc_verify_signature()
ckmc_buffer_free()
ckmc_hash_algo_e
ckmc_rsa_padding_algo_e
int ckmc_decrypt_data ( ckmc_param_list_h  params,
const char *  key_alias,
const char *  password,
const ckmc_raw_buffer_s  encrypted,
ckmc_raw_buffer_s **  ppdecrypted 
)

Decrypts data using selected key and algorithm.

Since :
3.0
Remarks:
Key identified by key_alias should exist.
Parameters:
[in]paramsAlgorithm parameter list handle. You should use the same parameters that were used for encryption. See ckmc_param_list_h and ckmc_algo_type_e for details
[in]key_aliasAlias of the key to be used for encryption
[in]passwordThe password used in decrypting a key value
If password of the policy is provided in ckmc_save_key(), the same password should be provided
[in]encryptedData to be decrypted (some algorithms may require additional information embedded in encrypted data. AES GCM is an example)
[out]ppdecryptedDecrypted data
The caller is responsible for freeing decrypted with ckmc_buffer_free()
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid (missing or invalid mandatory algorithm parameter, encrypted = NULL, ppdecrypted = NULL)
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_DB_ALIAS_UNKNOWNKey with given alias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
CKMC_ERROR_AUTHENTICATION_FAILEDKey decryption failed because password is incorrect
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_buffer_free()
ckmc_param_list_new()
ckmc_param_list_free()
ckmc_param_list_set_integer()
ckmc_param_list_set_buffer()
ckmc_generate_new_params()
ckmc_param_list_h
ckmc_param_name_e
ckmc_algo_type_e
int ckmc_deny_access ( const char *  alias,
const char *  accessor 
)

Revokes another application's access to client's application data.

Deprecated:
Deprecated since 2.4.[Use ckmc_set_permission() instead]
Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
Data identified by alias should exist.
Only access previously granted with ckmc_allow_access can be revoked.
Parameters:
[in]aliasData alias for which access will be revoked
[in]accessorPackage id of the application that will lose access rights
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid or the accessor doesn't have access to alias
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_allow_access()
ckmc_set_permission()
int ckmc_encrypt_data ( ckmc_param_list_h  params,
const char *  key_alias,
const char *  password,
const ckmc_raw_buffer_s  decrypted,
ckmc_raw_buffer_s **  ppencrypted 
)

Encrypts data using selected key and algorithm.

Since :
3.0
Remarks:
Key identified by key_alias should exist.
Parameters:
[in]paramsAlgorithm parameter list handle. See ckmc_param_list_h and ckmc_algo_type_e for details
[in]key_aliasAlias of the key to be used for encryption
[in]passwordThe password used in decrypting a key value
If password of the policy is provided in ckmc_save_key(), the same password should be provided
[in]decryptedData to be encrypted. In case of AES algorithm there are no restrictions on the size of data. For RSA the size must be smaller or equal to key size in bytes - 42. Example: for 1024 RSA key the maximum data size is 1024/8 - 42 = 86
[out]ppencryptedEncrypted data (some algorithms may return additional information embedded in encrypted data. AES GCM is an example)
The caller is responsible for freeing encrypted with ckmc_buffer_free()
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid (missing or invalid mandatory algorithm parameter, decrypted = NULL, ppencrypted = NULL)
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_DB_ALIAS_UNKNOWNKey with given alias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
CKMC_ERROR_AUTHENTICATION_FAILEDKey decryption failed because password is incorrect
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_buffer_free()
ckmc_param_list_new()
ckmc_param_list_free()
ckmc_param_list_set_integer()
ckmc_param_list_set_buffer()
ckmc_generate_new_params()
ckmc_param_list_h
ckmc_param_name_e
ckmc_algo_type_e
int ckmc_get_cert ( const char *  alias,
const char *  password,
ckmc_cert_s **  ppcert 
)

Gets a certificate from key manager.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
A client can access only certificate stored by the client.
A DER encoded certificate will be returned as a return value.
You must destroy the newly created ppcert by calling ckmc_cert_free() if it is no longer needed.
Parameters:
[in]aliasThe name of a certificate to retrieve
[in]passwordThe password used in decrypting a certificate value
If password of policy is provided in ckmc_save_cert(), the same password should be provided
[out]ppcertThe pointer to a newly created ckmc_cert_s handle
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to a database error
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exists
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
CKMC_ERROR_AUTHENTICATION_FAILEDDecryption failed because password is incorrect
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_save_cert()
ckmc_remove_alias()
ckmc_get_cert_alias_list()
int ckmc_get_cert_alias_list ( ckmc_alias_list_s **  ppalias_list)

Gets all alias of certificates which the client can access.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
A client can access only data stored by the client.
You must destroy the newly created ppalias_list by calling ckmc_alias_list_all_free() if it is no longer needed.
Parameters:
[out]ppalias_listThe pointer to a newly created ckmc_alias_list_s handle containing all available alias of keys
If there is no available key alias, *ppalias_list will be null
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to a database error
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_save_cert()
ckmc_remove_alias()
ckmc_get_cert()
int ckmc_get_cert_chain ( const ckmc_cert_s cert,
const ckmc_cert_list_s untrustedcerts,
ckmc_cert_list_s **  ppcert_chain_list 
)

Verifies a certificate chain and returns that chain.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
The trusted root certificate of the chain should exist in the system's certificate storage.
You must destroy the newly created ppcert_chain_list by calling ckmc_cert_list_all_free() if it is no longer needed.
Parameters:
[in]certThe certificate to be verified
[in]untrustedcertsThe untrusted CA certificates to be used in verifying a certificate chain
[out]ppcert_chain_listThe pointer to a newly created certificate chain's handle
If an error occurs, *ppcert_chain_list will be null
Returns:
0 on success and the signature is valid, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_VERIFICATION_FAILEDThe certificate chain is not valid
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_INVALID_FORMATThe format of certificate is not valid
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
CKMC_ERROR_AUTHENTICATION_FAILEDDecryption failed because password is incorrect
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_cert_list_all_free()
int ckmc_get_cert_chain_with_alias ( const ckmc_cert_s cert,
const ckmc_alias_list_s untrustedcerts,
ckmc_cert_list_s **  ppcert_chain_list 
)

Verifies a certificate chain using an alias list of untrusted certificates and return that chain.

Deprecated:
Deprecated since 2.4.[Use ckmc_get_cert_chain() instead]
Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
The trusted root certificate of the chain should exist in the system's certificate storage.
You must destroy the newly created ppcert_chain_list by calling ckmc_cert_list_all_free() if it is no longer needed.
untrustedcerts shouldn't be protected with optional password.
Parameters:
[in]certThe certificate to be verified
[in]untrustedcertsThe alias list of untrusted CA certificates stored in key manager to be used in verifying a certificate chain
[out]ppcert_chain_listThe pointer to a newly created certificate chain's handle
If an error occurs, *ppcert_chain_list will be null
Returns:
0 on success and the signature is valid, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_VERIFICATION_FAILEDThe certificate chain is not valid
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_INVALID_FORMATThe format of certificate is not valid
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
CKMC_ERROR_AUTHENTICATION_FAILEDSome certificates were encrypted with password and could not be used
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_get_cert_chain()
ckmc_cert_list_all_free()
int ckmc_get_cert_chain_with_trustedcert ( const ckmc_cert_s cert,
const ckmc_cert_list_s untrustedcerts,
const ckmc_cert_list_s trustedcerts,
const bool  use_trustedsystemcerts,
ckmc_cert_list_s **  ppcert_chain_list 
)

Verifies a certificate chain and returns that chain using user-entered, trusted, and untrusted CA certificates.

Since :
2.4
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
If the trusted root certificates are provided as a user input, these certificates do not need to exist in the system's certificate storage.
You must destroy the newly created ppcert_chain_list by calling ckmc_cert_list_all_free() if it is no longer needed.
Parameters:
[in]certThe certificate to be verified
[in]untrustedcertsThe untrusted CA certificates to be used in verifying a certificate chain
[in]trustedcertsThe trusted CA certificates to be used in verifying a certificate chain
[in]use_trustedsystemcertsThe flag indicating the use of the trusted root certificates in the system's certificate storage
[out]ppcert_chain_listThe pointer to a newly created certificate chain's handle
If an error occurs, *ppcert_chain_list will be null
Returns:
0 on success and the signature is valid, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_VERIFICATION_FAILEDThe certificate chain is not valid
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_INVALID_FORMATThe format of certificate is not valid
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_cert_list_all_free()
int ckmc_get_data ( const char *  alias,
const char *  password,
ckmc_raw_buffer_s **  ppdata 
)

Gets a data from key manager.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
A client can access only data stored by the client.
You must destroy the newly created ppdata by calling ckmc_buffer_free() if it is no longer needed.
Parameters:
[in]aliasThe name of a data to retrieve
[in]passwordThe password used in decrypting a data value
If password of policy is provided in ckmc_save_data(), the same password should be provided
[out]ppdataThe pointer to a newly created ckmc_raw_buffer_s handle
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
CKMC_ERROR_AUTHENTICATION_FAILEDDecryption failed because password is incorrect
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_save_data()
ckmc_remove_alias()
ckmc_get_data_alias_list()
int ckmc_get_data_alias_list ( ckmc_alias_list_s **  ppalias_list)

Gets all alias of data which the client can access.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
A client can access only data stored by the client.
You must destroy the newly created ppalias_list by calling ckmc_alias_list_all_free() if it is no longer needed.
Parameters:
[out]ppalias_listThe pointer to a newly created ckmc_alias_list_s handle containing all available alias of keys
If there is no available key alias, *ppalias_list will be null
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_save_data()
ckmc_remove_alias()
ckmc_get_data()
int ckmc_get_key ( const char *  alias,
const char *  password,
ckmc_key_s **  ppkey 
)

Gets a key from key manager.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
A client can access only data stored by the client.
You must destroy the newly created ppkey by calling ckmc_key_free() if it is no longer needed.
Parameters:
[in]aliasThe name of a key to retrieve
[in]passwordThe password used in decrypting a key value
If password of policy is provided in ckmc_save_key(), the same password should be provided
[out]ppkeyThe pointer to a newly created ckmc_key_s handle
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to a database error
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
CKMC_ERROR_AUTHENTICATION_FAILEDDecryption failed because password is incorrect
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_save_key()
ckmc_remove_alias()
ckmc_get_key_alias_list()
int ckmc_get_key_alias_list ( ckmc_alias_list_s **  ppalias_list)

Gets all the alias of keys that the client can access.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
A client can access only data stored by the client.
You must destroy the newly created ppalias_list by calling ckmc_alias_list_all_free() if it is no longer needed.
Parameters:
[out]ppalias_listThe pointer to a newly created ckmc_alias_list_s handle containing all available alias of keys
If there is no available key alias, *ppalias_list will be null
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to a database error
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_save_key()
ckmc_remove_alias()
ckmc_get_key()
int ckmc_get_pkcs12 ( const char *  alias,
const char *  key_password,
const char *  cert_password,
ckmc_pkcs12_s **  pkcs12 
)

Gets a pkcs12 from key manager.

Since :
2.4
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
A client can access only data stored by the client.
You must destroy the newly created pkcs12 by calling ckmc_pkcs12_free() if it is no longer needed.
Parameters:
[in]aliasThe name of a data to retrieve
[in]key_passwordPassword that was used to encrypt privateKey (may be NULL)
[in]cert_passwordPassword used to encrypt certificates (may be NULL)
[out]pkcs12The pointer to a newly created ckmc_pkcs12_s handle
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to a database error
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
CKMC_ERROR_AUTHENTICATION_FAILEDkey_password or cert_password does not match with password used to encrypt data
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_save_pkcs12()
ckmc_remove_alias()
int ckmc_ocsp_check ( const ckmc_cert_list_s pcert_chain_list,
ckmc_ocsp_status_e ocsp_status 
)

Perform OCSP that checks certificate is whether revoked or not.

Since :
2.4
Privilege Level:
public
Privilege:
http://tizen.org/privilege/internet
Remarks:
http://tizen.org/privilege/internet (public level privilege) is required to use this API instead of http://tizen.org/privilege/keymanager (public level privilege) since 3.0.
Parameters:
[in]pcert_chain_listValid certificate chain to perform OCSP check
[out]ocsp_statusThe pointer to status result of OCSP check
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
CKMC_ERROR_NOT_SUPPORTEDDevice needed to run API is not supported
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
pcert_chain_list is created with ckmc_get_certificate_chain() or ckmc_get_certificate_chain_with_alias().
See also:
ckmc_get_cert_chain())
ckmc_cert_list_all_free()
int ckmc_remove_alias ( const char *  alias)

Removes an entry (no matter of type) from the key manager.

Since :
2.4
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
To remove item, client must have remove permission to the specified item.
The item owner can remove by default.
Parameters:
[in]aliasItem alias to be removed
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to a database error
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_save_key()
ckmc_save_cert()
ckmc_save_data()
ckmc_save_pkcs12()
ckmc_create_key_pair_rsa()
ckmc_create_key_pair_dsa()
ckmc_create_key_pair_ecdsa()
int ckmc_remove_cert ( const char *  alias)

Removes a certificate from key manager.

Deprecated:
Deprecated since 2.4.[Use ckmc_remove_alias() instead]
Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
To remove certificate, client must have remove permission to the specified certificate.
The key owner can remove by default.
Parameters:
[in]aliasThe name of a certificate to be removed
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to a database error
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_save_cert()
ckmc_get_cert()
ckmc_get_cert_alias_list()
int ckmc_remove_data ( const char *  alias)

Removes a data from key manager.

Deprecated:
Deprecated since 2.4.[Use ckmc_remove_alias() instead]
Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
To remove data, client must have remove permission to the specified data object.
The data owner can remove by default.
Parameters:
[in]aliasThe name of a data to be removed
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_save_data()
ckmc_get_data()
ckmc_get_data_alias_list()
int ckmc_remove_key ( const char *  alias)

Removes a key from key manager.

Deprecated:
Deprecated since 2.4.[Use ckmc_remove_alias() instead]
Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
To remove key, client must have remove permission to the specified key.
The key owner can remove by default.
Parameters:
[in]aliasThe name of a key to be removed
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to a database error
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_save_key()
ckmc_get_key()
ckmc_get_key_alias_list()
int ckmc_save_cert ( const char *  alias,
const ckmc_cert_s  cert,
const ckmc_policy_s  policy 
)

Stores a certificate inside key manager based on the provided policy.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0
The certificate's binary value will be converted and saved as binary DER encoded certificates.
Parameters:
[in]aliasThe name of a certificate to be stored
[in]certThe certificate's binary value to be stored
[in]policyThe policy about how to store a certificate securely
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ALIAS_EXISTSAlias already exists
CKMC_ERROR_INVALID_FORMATThe format of raw_cert is not valid
CKMC_ERROR_DB_ERRORFailed due to a database error
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_remove_alias()
ckmc_get_cert()
ckmc_get_cert_alias_list()
ckmc_cert_s
ckmc_policy_s
int ckmc_save_data ( const char *  alias,
ckmc_raw_buffer_s  data,
const ckmc_policy_s  policy 
)

Stores a data inside key manager based on the provided policy.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
Parameters:
[in]aliasThe name of a data to be stored
[in]dataThe binary value to be stored
[in]policyThe policy about how to store a data securely
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ALIAS_EXISTSAlias already exists
CKMC_ERROR_DB_ERRORFailed due to a database error
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_remove_alias()
ckmc_get_data()
ckmc_get_data_alias_list()
ckmc_raw_buffer_s
ckmc_policy_s
int ckmc_save_key ( const char *  alias,
const ckmc_key_s  key,
const ckmc_policy_s  policy 
)

Stores a key inside key manager based on the provided policy.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
Currently API supports seven types of keys. These are RSA public/private key, DSA public/private key, ECDSA public/private key, and AES symmetric key.
key_type in key may be set to CKMC_KEY_NONE as an input. key_type is determined inside key manager during storing keys.
Some private key files are protected by a password. If raw_key in key read from those encrypted files is encrypted with a password, the password should be provided in the ckmc_key_s structure.
If password in policy is provided, the key is additionally encrypted with the password in the policy.
Parameters:
[in]aliasThe name of a key to be stored
[in]keyThe key's binary value to be stored
[in]policyThe policy about how to store a key securely
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ALIAS_EXISTSAlias already exists
CKMC_ERROR_INVALID_FORMATThe format of raw_key is not valid
CKMC_ERROR_DB_ERRORFailed due to a database error
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_remove_alias()
ckmc_get_key()
ckmc_get_key_alias_list()
ckmc_key_s
ckmc_policy_s
int ckmc_save_pkcs12 ( const char *  alias,
const ckmc_pkcs12_s pkcs,
const ckmc_policy_s  key_policy,
const ckmc_policy_s  cert_policy 
)

Stores PKCS12's contents inside key manager based on the provided policies. All items from the PKCS12 will use the same alias.

Since :
2.4
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
Parameters:
[in]aliasThe name of a data to be stored
[in]pkcsPointer to the pkcs12 structure to be saved
[in]key_policyThe policy about how to store pkcs's private key
[in]cert_policyThe policy about how to store pkcs's certificate
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ALIAS_EXISTSAlias already exists
CKMC_ERROR_DB_ERRORFailed due to a database error
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_remove_alias()
ckmc_get_pkcs12()
ckmc_get_data_alias_list()
ckmc_pkcs12_load()
ckmc_pkcs12_s
ckmc_policy_s
int ckmc_set_permission ( const char *  alias,
const char *  accessor,
int  permissions 
)

Allows another application to access client's application data.

Since :
2.4
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
Data identified by alias should exist.
Parameters:
[in]aliasData alias for which access will be granted
[in]accessorPackage id of the application that will gain access rights
[in]permissionsMask of permissions granted for accessor application (ckmc_permission_e) (previous permission mask will be replaced with the new mask value)
Returns:
0 on success, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
int ckmc_verify_signature ( const char *  public_key_alias,
const char *  password,
const ckmc_raw_buffer_s  message,
const ckmc_raw_buffer_s  signature,
const ckmc_hash_algo_e  hash,
const ckmc_rsa_padding_algo_e  padding 
)

Verifies a given signature on a given message using a public key and returns the signature status.

Since :
2.3
Remarks:
http://tizen.org/privilege/keymanager (public level privilege) is no longer required to use this API since 3.0.
If password of policy is provided during storing a key, the same password should be provided.
Parameters:
[in]public_key_aliasThe name of public key
[in]passwordThe password used in decrypting a public key value
[in]messageThe input on which the signature is created
[in]signatureThe signature that is verified with public key
[in]hashThe hash algorithm used in verifying signature
[in]paddingThe RSA padding algorithm used in verifying signature
It is used only when the signature algorithm is RSA. If padding is CKMC_NONE_PADDING you must use CKMC_HASH_NONE and the message must be equal to key length
Returns:
0 on success and the signature is valid, otherwise a negative error value
Return values:
CKMC_ERROR_NONESuccessful
CKMC_ERROR_VERIFICATION_FAILEDThe signature is invalid
CKMC_ERROR_INVALID_PARAMETERInput parameter is invalid
CKMC_ERROR_DB_LOCKEDA user key is not loaded in memory (a user is not logged in)
CKMC_ERROR_DB_ERRORFailed due to the error with unknown reason
CKMC_ERROR_DB_ALIAS_UNKNOWNAlias does not exist
CKMC_ERROR_PERMISSION_DENIEDFailed to access key manager
CKMC_ERROR_AUTHENTICATION_FAILEDDecryption failed because password is incorrect
Precondition:
User is already logged in and the user key is already loaded into memory in plain text form.
See also:
ckmc_create_key_pair_rsa()
ckmc_create_key_pair_ecdsa()
ckmc_verify_signature()
ckmc_hash_algo_e
ckmc_rsa_padding_algo_e