yubihsm-unwrap command

.github/codeql/codeql-config.yml

@@ -7,6 +7,7 @@ paths:
   - lib
   - pkcs11
   - src
+  - yhunwrap
   - yhwrap
   - ykhsmauth
 paths-ignore:

.gitignore

@@ -51,6 +51,8 @@ build*/
 cscope.*
 yhauth/cmdline.c
 yhauth/cmdline.h
+yhunwrap/cmdline.c
+yhunwrap/cmdline.h
 yhwrap/cmdline.c
 yhwrap/cmdline.h
 yubihsm-auth/cmdline.c

CMakeLists.txt

@@ -218,6 +218,8 @@ if(NOT BUILD_ONLY_LIB)
   add_subdirectory (examples)
 
   add_subdirectory(yhwrap)
+
+  add_subdirectory(yhunwrap)
 endif()
 
 add_custom_target (

yhunwrap/CMakeLists.txt

@@ -0,0 +1,88 @@
+#
+# Copyright 2015-2018 Yubico AB
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+include(${CMAKE_SOURCE_DIR}/cmake/openssl.cmake)
+find_libcrypto()
+
+set (
+  SOURCE
+  ../common/hash.c
+  ../common/parsing.c
+  ../common/util.c
+  ../common/openssl-compat.c
+  main.c
+  )
+
+if(WIN32)
+  set(SOURCE ${SOURCE} cmdline.c)
+  include(${CMAKE_SOURCE_DIR}/cmake/getopt.cmake)
+  find_getopt()
+else(WIN32)
+  include(gengetopt)
+  add_gengetopt_files (cmdline)
+  set(SOURCE ${SOURCE} ${GGO_C})
+  message("${GGO_C}")
+endif(WIN32)
+
+include_directories (
+  ${LIBCRYPTO_INCLUDEDIR}
+  ${CMAKE_CURRENT_SOURCE_DIR}/../lib
+  ${CMAKE_CURRENT_SOURCE_DIR}/../common
+)
+
+if(${WIN32})
+  list(APPEND SOURCE ${CMAKE_CURRENT_BINARY_DIR}/version.rc)
+  configure_file(${CMAKE_CURRENT_SOURCE_DIR}/version.rc.in ${CMAKE_CURRENT_BINARY_DIR}/version.rc @ONLY)
+endif(${WIN32})
+
+# NOTE(adma): required by gengetopt
+add_definitions (-DPACKAGE="yubihsm-unwrap")
+add_definitions (-DVERSION="${yubihsm_shell_VERSION_MAJOR}.${yubihsm_shell_VERSION_MINOR}.${yubihsm_shell_VERSION_PATCH}")
+
+list(APPEND LCOV_REMOVE_PATTERNS "'${PROJECT_SOURCE_DIR}/yhunwrap/cmdline.c'")
+
+if ("${CMAKE_C_COMPILER_ID}" STREQUAL "GNU")
+set_property(SOURCE ${GGO_C} APPEND_STRING PROPERTY COMPILE_FLAGS " -Wno-unused-but-set-variable ")
+endif()
+
+add_executable (yubihsm-unwrap ${SOURCE})
+
+target_link_libraries (
+  yubihsm-unwrap
+  ${LIBCRYPTO_LDFLAGS}
+  ${GETOPT_LIBS}
+  yubihsm
+  )
+
+set_target_properties(yubihsm-unwrap PROPERTIES INSTALL_RPATH "${YUBIHSM_INSTALL_LIB_DIR}")
+
+add_coverage(yubihsm-unwrap)
+
+install(
+  TARGETS yubihsm-unwrap
+  ARCHIVE DESTINATION "${YUBIHSM_INSTALL_LIB_DIR}"
+  LIBRARY DESTINATION "${YUBIHSM_INSTALL_LIB_DIR}"
+  RUNTIME DESTINATION "${YUBIHSM_INSTALL_BIN_DIR}")
+
+if (NOT WITHOUT_MANPAGES)
+  include (help2man)
+  add_help2man_manpage (yubihsm-unwrap.1 yubihsm-unwrap)
+
+  add_custom_target (yubihsm-unwrap-man ALL
+    DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/yubihsm-unwrap.1
+    )
+  install(FILES "${CMAKE_CURRENT_BINARY_DIR}/yubihsm-unwrap.1" DESTINATION "${YUBIHSM_INSTALL_MAN_DIR}/man1")
+endif ()

yhunwrap/README.adoc

@@ -0,0 +1,41 @@
+== YubiHSM Unwrap
+
+YubiHSM Unwrap is a command-line tool to decrypt "offline wraps"
+from a YubiHSM 2 device. See `yubihsm-wrap` to create "offline wraps"
+or key backups encrypted with a wrap key.
+
+One of the functionalities supported by the YubiHSM is to import
+objects under wrap. The typical use is to generate an object on one
+device, export it under wrap using a Wrap Key and import it to a
+different device which has the same Wrap Key.
+
+At times it is also useful to be able to decrypt these keys under wrap
+on a computer, so that they can be encrypted using alternative methods and
+also easily sent to other types of devices for use.
+
+=== Example
+
+This example assumes that you created a wrapped object by exporting
+a key from a YubiHSM device or using the example in the `yubihsm-wrap`
+documentation. Make sure the wrap key is the binary format documented
+under `yubihsm-wrap`.
+
+For example the wrap key
+`00112233445566778899aabbccddeeff`
+
+can be saved as `wrap.key` by running
+
+[source, bash]
+----
+$ echo -en '\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\xaa\xbb\xcc\xdd\xee\xff' >wrap.key
+----
+
+We can now use `yubihsm-unwrap` to produce the decrypted version of the
+private key.
+
+[source, bash]
+----
+$ yubihsm-unwrap --in private.yhw --wrapkey wrap.key --out private.pem
+----
+
+The output file `private.pem` is the unwrapped version of the key.

yhunwrap/cmdline.ggo

@@ -0,0 +1,19 @@
+#
+# Copyright 2015-2018 Yubico AB
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+option "in" - "Input data (filename)" string
+option "out" - "Output data (filename)" string
+option "wrapkey" k "Key to wrap data with (filename)" string