diff options
Diffstat (limited to 'schema.sql')
| -rw-r--r-- | schema.sql | 59 |
1 files changed, 3 insertions, 56 deletions
@@ -1,7 +1,7 @@ -- SQLite3 schema for Cryptech PKCS #11 implementation. -- -- Author: Rob Austein --- Copyright (c) 2015, NORDUnet A/S +-- Copyright (c) 2015-2016, NORDUnet A/S -- All rights reserved. -- -- Redistribution and use in source and binary forms, with or without @@ -53,58 +53,6 @@ PRAGMA foreign_keys = ON; --- Values we have to store somewhere and for which we have no better --- place. This is a table with exactly one row (enforced by the CHECK --- clause on the primary index). All columns must either allow NULL --- or provide default values. - -CREATE TABLE IF NOT EXISTS global ( - global_id INTEGER PRIMARY KEY NOT NULL DEFAULT 1 CHECK (global_id = 1), - - -- Key-encryption-key (KEK) - -- - -- The KEK **really** should be somewhere else, like in RAM - -- protected by tamper detection circuitry, but we don't have - -- that yet. Not obvious that a separate file would be more - -- secure, so keep it here until we do have a better place. - - kek BLOB CHECK (kek IS NULL OR (typeof(kek) = "blob" AND length(kek) IN (16, 32))), - - -- PBKDF2-based PIN storage and check values. - -- - -- "so_pin" and "user_pin" are PBKDF2 output, so only - -- moderately sensitive. - -- - -- Not obvious that PKCS #11 ever really allows "so_pin" to be - -- unset, so it may want a NOT NULL constraint, but in that - -- case we'll need to provide a default value, which doesn't - -- seem like much of an improvement. "so_pin" probably - -- requires out-of-band initialization. "user-pin" is allowed - -- to be unset, there's an error code specifically for that - -- situation. - -- - -- Numeric minima for PBKDF2 iterations, length of PIN, and - -- length of PBKDF2 salt are somewhat arbitrary, and will - -- probably change over time (which is why they are minima). - -- Initial testing was with 100000, which takes about 8 seconds - -- on a Novena with the current SHA256 and PBKDF2 - -- implementation, which seems a bit slow, so backed that down - -- a bit. Feel free to suggest better minima. - - pbkdf2_iterations INTEGER NOT NULL DEFAULT 20000, - so_pin BLOB, - user_pin BLOB, - so_pin_salt, BLOB, - user_pin_salt BLOB, - CHECK ((pbkdf2_iterations >= 10000) AND - (so_pin IS NULL OR (typeof(so_pin) = "blob" AND length(so_pin) >= 32)) AND - (user_pin IS NULL OR (typeof(user_pin) = "blob" AND length(user_pin) >= 32)) AND - (so_pin_salt IS NULL OR (typeof(so_pin_salt) = "blob" AND length(so_pin_salt) >= 16)) AND - (user_pin_salt IS NULL OR (typeof(user_pin_salt) = "blob" AND length(user_pin_salt) >= 16))) -); - -INSERT OR IGNORE INTO global DEFAULT VALUES; - CREATE TEMPORARY TABLE IF NOT EXISTS session ( session_id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, session_handle INTEGER NOT NULL UNIQUE @@ -115,6 +63,7 @@ CREATE TEMPORARY TABLE IF NOT EXISTS object ( object_id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, object_handle INTEGER NOT NULL UNIQUE CHECK (object_handle > 0 AND object_handle <= 0xFFFFFFFF), + hal_pkey_type INTEGER, session_id INTEGER REFERENCES session ON DELETE CASCADE ON UPDATE CASCADE DEFERRABLE INITIALLY DEFERRED, @@ -129,7 +78,6 @@ CREATE TEMPORARY TABLE IF NOT EXISTS object ( CREATE TEMPORARY TABLE IF NOT EXISTS session_object ( session_object_id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, - private_key BLOB UNIQUE, object_id INTEGER NOT NULL UNIQUE REFERENCES object ON DELETE CASCADE ON UPDATE CASCADE @@ -145,8 +93,7 @@ CREATE TEMPORARY TABLE IF NOT EXISTS session_attribute ( ); CREATE TABLE IF NOT EXISTS token_object ( - token_object_id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, - private_key BLOB UNIQUE + token_object_id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL ); CREATE TABLE IF NOT EXISTS token_attribute ( |