First pass on converting from direct libhal calls to libhal RPC calls.

This version isn't really expected to work properly, but it's far
enough along to be worth archiving before starting runtime testing.

1 files changed, 3 insertions, 56 deletions

diff --git a/schema.sql b/schema.sql
index ab09529..8a81505 100644
--- a/schema.sql
+++ b/schema.sql
@@ -1,7 +1,7 @@
 -- SQLite3 schema for Cryptech PKCS #11 implementation.
 --
 -- Author: Rob Austein
--- Copyright (c) 2015, NORDUnet A/S
+-- Copyright (c) 2015-2016, NORDUnet A/S
 -- All rights reserved.
 --
 -- Redistribution and use in source and binary forms, with or without
@@ -53,58 +53,6 @@
 
 PRAGMA foreign_keys = ON;
 
--- Values we have to store somewhere and for which we have no better
--- place.  This is a table with exactly one row (enforced by the CHECK
--- clause on the primary index).  All columns must either allow NULL
--- or provide default values.
-
-CREATE TABLE IF NOT EXISTS global (
-       global_id                INTEGER PRIMARY KEY NOT NULL DEFAULT 1 CHECK (global_id = 1),
-
-       -- Key-encryption-key (KEK)
-       --
-       -- The KEK **really** should be somewhere else, like in RAM
-       -- protected by tamper detection circuitry, but we don't have
-       -- that yet.  Not obvious that a separate file would be more
-       -- secure, so keep it here until we do have a better place.
-
-       kek                      BLOB CHECK (kek IS NULL OR (typeof(kek) = "blob" AND length(kek) IN (16, 32))),
-
-       -- PBKDF2-based PIN storage and check values.
-       --
-       -- "so_pin" and "user_pin" are PBKDF2 output, so only
-       -- moderately sensitive.
-       --
-       -- Not obvious that PKCS #11 ever really allows "so_pin" to be
-       -- unset, so it may want a NOT NULL constraint, but in that
-       -- case we'll need to provide a default value, which doesn't
-       -- seem like much of an improvement.  "so_pin" probably
-       -- requires out-of-band initialization.  "user-pin" is allowed
-       -- to be unset, there's an error code specifically for that
-       -- situation.
-       --
-       -- Numeric minima for PBKDF2 iterations, length of PIN, and
-       -- length of PBKDF2 salt are somewhat arbitrary, and will
-       -- probably change over time (which is why they are minima).
-       -- Initial testing was with 100000, which takes about 8 seconds
-       -- on a Novena with the current SHA256 and PBKDF2
-       -- implementation, which seems a bit slow, so backed that down
-       -- a bit.  Feel free to suggest better minima.
-
-       pbkdf2_iterations        INTEGER NOT NULL DEFAULT 20000,
-       so_pin                   BLOB,
-       user_pin                 BLOB,
-       so_pin_salt,             BLOB,
-       user_pin_salt            BLOB,
-       CHECK ((pbkdf2_iterations >= 10000)                                                                AND
-              (so_pin        IS NULL OR (typeof(so_pin)        = "blob" AND length(so_pin)        >= 32)) AND
-              (user_pin      IS NULL OR (typeof(user_pin)      = "blob" AND length(user_pin)      >= 32)) AND
-              (so_pin_salt   IS NULL OR (typeof(so_pin_salt)   = "blob" AND length(so_pin_salt)   >= 16)) AND
-              (user_pin_salt IS NULL OR (typeof(user_pin_salt) = "blob" AND length(user_pin_salt) >= 16)))
-);
-
-INSERT OR IGNORE INTO global DEFAULT VALUES;
-
 CREATE TEMPORARY TABLE IF NOT EXISTS session (
         session_id              INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
         session_handle          INTEGER NOT NULL UNIQUE
@@ -115,6 +63,7 @@ CREATE TEMPORARY TABLE IF NOT EXISTS object (
         object_id               INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
         object_handle           INTEGER NOT NULL UNIQUE
                                 CHECK (object_handle > 0 AND object_handle <= 0xFFFFFFFF),
+        hal_pkey_type           INTEGER,
         session_id              INTEGER REFERENCES session
                                 ON DELETE CASCADE ON UPDATE CASCADE
                                 DEFERRABLE INITIALLY DEFERRED,
@@ -129,7 +78,6 @@ CREATE TEMPORARY TABLE IF NOT EXISTS object (
 
 CREATE TEMPORARY TABLE IF NOT EXISTS session_object (
         session_object_id       INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
-        private_key             BLOB UNIQUE,
         object_id               INTEGER NOT NULL UNIQUE
                                 REFERENCES object
                                 ON DELETE CASCADE ON UPDATE CASCADE
@@ -145,8 +93,7 @@ CREATE TEMPORARY TABLE IF NOT EXISTS session_attribute (
 );
 
 CREATE TABLE IF NOT EXISTS token_object (
-        token_object_id         INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
-        private_key             BLOB UNIQUE
+        token_object_id         INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL
 );
 
 CREATE TABLE IF NOT EXISTS token_attribute (