Export/import "raw" keys for external storage.

Exported keys are wrapped with the MKM KEK, not a transit KEK, and can
only be imported back to the same HSM.

The idea is to support operators who have more keys than will fit on the
HSM, so they will cycle keys into and out of the HSM as needed.

NOTE that hashsig is, as always, special. The hashsig key has an internal
index that is updated on every signature. To prevent a hashsig key from
being re-imported with an old index (which would compromise the security
of the key), the hashsig key is disabled on export, and must be deleted
from the HSM before being re-imported.

1 files changed, 13 insertions, 0 deletions

diff --git a/hal.h b/hal.h
index 43ea6a0..1a08690 100644
--- a/hal.h
+++ b/hal.h
@@ -893,6 +893,9 @@ extern hal_error_t hal_rpc_pkey_export(const hal_pkey_handle_t pkey,
                                        uint8_t *pkcs8, size_t *pkcs8_len, const size_t pkcs8_max,
                                        uint8_t *kek,   size_t *kek_len,   const size_t kek_max);
 
+extern hal_error_t hal_rpc_pkey_export_raw(const hal_pkey_handle_t pkey,
+                                           uint8_t *pkcs8, size_t *pkcs8_len, const size_t pkcs8_max);
+
 extern hal_error_t hal_rpc_pkey_import(const hal_client_handle_t client,
                                        const hal_session_handle_t session,
                                        hal_pkey_handle_t *pkey,
@@ -902,6 +905,13 @@ extern hal_error_t hal_rpc_pkey_import(const hal_client_handle_t client,
                                        const uint8_t * const kek,   const size_t kek_len,
                                        const hal_key_flags_t flags);
 
+extern hal_error_t hal_rpc_pkey_import_raw(const hal_client_handle_t client,
+                                           const hal_session_handle_t session,
+                                           hal_pkey_handle_t *pkey,
+                                           hal_uuid_t *name,
+                                           const uint8_t * const pkcs8, const size_t pkcs8_len,
+                                           const hal_key_flags_t flags);
+
 extern hal_error_t hal_rpc_client_init(void);
 
 extern hal_error_t hal_rpc_client_close(void);
@@ -1005,6 +1015,9 @@ extern hal_error_t hal_hashsig_ks_init(void);
 extern hal_error_t hal_hashsig_export(const hal_uuid_t * const name,
                                       uint8_t *der, size_t *der_len, const size_t der_max);
 
+extern hal_error_t hal_hashsig_export_raw(const hal_uuid_t * const name,
+                                          uint8_t *der, size_t *der_len, const size_t der_max);
+
 extern hal_error_t hal_hashsig_import(const uint8_t *der, const size_t der_len,
                                       const hal_key_flags_t flags);