Move actual key store into Mock BPA

docs/api/00-mainpage.md

@@ -34,33 +34,47 @@ The BSL as a whole is separated into two primary layers of implementation: an AP
 The Frontend library provides the service API for the BSL to be called by its associated [BPA integration](@ref bpa-integrators) and for stable public APIs used by [Policy Provider implementations](@ref policy-providers) and [Security Context implementations](@ref security-contexts).
 The Backend library implements forward-declared structs and functions from the Frontend using specific concrete data containers, algorithms, _etc._
 
-The BSL source repository also contains @ref example-pps and @ref example-default-scs to actually exercise the BSL during testing, and a @ref mock-bpa which allows as-built integration testing of the BSL using a pseudo-daemon process.
+The following diagram shows the relationships between major BSL components, where solid lines indicate direct API calls and dashed lines indicate registered callback uses.
 
 @dot
 digraph example {
-    node [shape=record, fontname=Helvetica, fontsize=10];
+    graph [fontname=Helvetica];
+    node [shape=box, fontname=Helvetica, fontsize=10];
+    newrank=true;
 
-    frontend [ label="Frontend" ];
-    backend [ label=<<i>Backend</i>> ];
-    frontend -> backend [ dir=back ];
+    subgraph cluster_bsl {
+        label="BSL";
+        frontend [ label="Frontend" ];
+        backend [ label=<<i>Backend</i>> ];
+    }
+    frontend -> backend [ style=solid ];
 
     host [ label="Host" ];
     bpa [ label="BPA" ];
-    crypto [ label="Crypto\nFunctions" ];
-    reg_pol [ label="Policy\nRegistry" ];
-    reg_sc [ label="Security Context\nRegistry" ];
-    backend -> host [ arrowhead="open", style="dashed" ];
-    backend -> bpa [ arrowhead="open", style="dashed" ];
-    backend -> crypto [ arrowhead="open", style="dashed" ];
-    backend -> reg_pol [ arrowhead="open", style="dashed" ];
-    backend -> reg_sc [ arrowhead="open", style="dashed" ];
+    reg_pp [ label=<<i>Policy Providers</i>> ];
+    reg_sc [ label=<<i>Security Contexts</i>> ];
+    backend -> host [ arrowhead="open", style=dashed ];
+    backend -> bpa [ arrowhead="open", style=dashed ];
+    backend -> reg_pp [ arrowhead="open", style=dashed ];
+    backend -> reg_sc [ arrowhead="open", style=dashed ];
+    { rank=same; host; bpa; reg_sc; reg_pp; }
+
+    subgraph cluster_crypto {
+        label="BSL crypto";
+        rank=same;
+        crypto [ label="Crypto\nFunctions" ];
+        keystore [ label="Key Store" ];
+    }
+    reg_sc -> crypto [ arrowhead="open", style=solid ];
+    crypto -> keystore [ arrowhead="open", style=solid ];
+    keystore -> bpa [ arrowhead="open", style=dashed ];
 }
 @enddot
 
 The BSL comes with a @ref frontend and a @ref backend_dyn implementation which uses heap-allocated, dynamically-sized data structures and run-time registration capabilities.
 For a more constrained (_e.g._, flight software) environment an alternative backend could be implemented with fixed-size data containers and constant-time registry lookup algorithms.
 
-Along with these libraries are also two integration extensions: an _Example Policy_ module and a _Default Security Contexts_ module.
+The BSL source repository also contains @ref example-pps and @ref example-scs to actually exercise the BSL during testing, and a @ref mock-bpa which allows as-built integration testing of the BSL using a pseudo-daemon process.
 Together these use the abstract Frontend and populate the otherwise empty Dynamic Backend registries to create an out-of-the-box usable BPSec implementation.
 
 # Dependencies
@@ -88,8 +102,8 @@ This is the concrete implementation of a backend using dynamic heap-allocated co
 It uses POSIX APIs to provide necessary Host functions for the BSL, and OpenSSL APIs to provide crypto functions for the BSL.
 
 
-@defgroup example_pp Example Policy Provider
-@brief Implementation of a simple rule-based policy provider.
+@defgroup example_pp Sample Policy Provider
+@brief Implementation of a simple rule-based policy provider configured with JSON input.
 
 This group contains files used by the Example Policy Provider library included with the BSL.
 
@@ -100,12 +114,26 @@ This group contains files used by the Example Policy Provider library included w
 This group contains files used by the Default Security Contexts (RFC 9173 @cite rfc9173) library included with the BSL.
 
 
+@defgroup cose_sc COSE Context
+@brief Implementation of the COSE Context using the BSL crypto API.
+
+This group contains files used by the COSE Context (draft @cite draft-ietf-dtn-bpsec-cose) library included with the BSL.
+
+
+@defgroup crypto Cryptographic Processing and Key Store API
+@brief Implementation of the BSL crypto API by a software backend and user of the BSL key store interface.
+
+This group contains files used by the Default Security Contexts (RFC 9173 @cite rfc9173) library included with the BSL.
+
+
 @defgroup mock_bpa Example/Mock BP Agent
 @brief Files used in the Mock BPA used for testing.
 
 The Mock BPA performs whole-bundle encoding and decoding (CODEC) functions, but no other stateful bundle processing.
 This allows end-to-end bundle testing with real policy configurations.
 
+The Mock BPA also implements an in-memory key store registered with the BSL crypto library.
+
 
 @defgroup unit_test Unit Testing
 @brief Files used for unit testing of BSL behaviors.

docs/api/02-bpa-integrators.md

@@ -77,9 +77,13 @@ digraph bpa_interaction {
 }
 @enddot
 
-# BPA Callback API {#bpa-callback-api}
+# BPA Callback APIs {#bpa-callback-api}
 
 Separate from the API used to call into the BSL to initiate security processing, the BSL relies on specific functions provided by the BPA to do its normal processing.
-Some of these functions are for introspecting and manipulating specific bundle or block contents, others are for encoding and decoding EID and EID Pattern values.
+Some of these functions are for introspecting and manipulating specific bundle or block contents, others are for encoding and decoding EID and EID Pattern values, and a separate set are used by the internal BSL crypto library for key store access.
 
-The BSL dynamic backend declares a set of functions which are delegated to the BPA, which are registered in the dynamic backend using the ::BSL_HostDescriptors_t struct and the BSL_HostDescriptors_Set() function.
+The BSL dynamic backend declares a set of functions which are delegated to the BPA.
+These are registered in the dynamic backend using the ::BSL_HostDescriptors_t struct and the BSL_HostDescriptors_Set() function.
+
+The BSL crypto library declares a set of functions which are delegated to the BPA.
+These are registered in the crypto library using the ::BSL_KeyStore_Descriptors_t struct and the BSL_KeyStore_Init() function.

docs/api/04-examples-and-mocks.md

@@ -39,11 +39,13 @@ This PP is registered and used by the @ref mock-bpa for many BSL testing cases.
 
 Sources related to these example PPs are associated with the @ref example_pp group.
 
-# Example Default Security Contexts {#example-default-scs}
+# Example Security Contexts {#example-scs}
 
 The two Default Security Contexts defined in RFC 9173 @cite rfc9173 offer minimal, interoperable, and pre-shared-key-focused integrity and confidentiality operations.
 
-An implementation of these two SCs is maintained as part of the BSL source and uses the BSL crypto library as an interface to the OpenSSL library @cite lib:openssl from the host OS.
+The COSE Context defined in an internet draft @cite draft-ietf-dtn-bpsec-cose offers more full-featured, layered symmetric key options including key wrapping and key derivation.
+
+An implementation of each of these SCs is maintained as part of the BSL source and uses the BSL crypto library as an wrapper for the OpenSSL library @cite lib:openssl from the host OS and a key store registered with the crypto library (part of the @ref bpa-callback-api).
 These SCs are registered and used by the @ref mock-bpa for BSL testing.
 
 Sources related to these example SCs are associated with the @ref default_sc group.
@@ -55,7 +57,7 @@ The Mock BPA uses an un-framed UDPCL-like interface for its underlayer and also
 
 The Mock BPA is limited to a single registered endpoint, and does no other handling normally required by RFC 9171 @cite rfc9171. So for this reason it is not a true BPA and must not be treated as one.
 
-Upon startup, the Mock BPA registers a single [ION-based Example Policy Provider](@ref example-pps) and the two [example Default Security Contexts](@ref example-default-scs).
+Upon startup, the Mock BPA registers a single [ION-based Example Policy Provider](@ref example-pps) and all of the [example Security Contexts](@ref example-scs).
 
 Sources related to the Mock BPA are associated with the @ref mock_bpa group.
 
@@ -75,7 +77,7 @@ The path to the JSON file should be passed to the Mock BPA with the `-j` command
 
 ## Key Management
 
-The keys used by the example SCs registered in the Mock BPA's Cryptographic Library instance are obtained from a file using the JSON Web Key (JWK) format of RFC 7517 @cite rfc7517.
+The keys used by the example SCs registered in the Mock BPA's key store are obtained from a file using either the JSON Web Key (JWK) Set format of RFC 7517 @cite rfc7517 or the COSE Key Set format of RFC 9052 @cite rfc9052.
 
 The implementation to support these SCs only handles symmetric keys and only the minimal header parameters needed for key ID ("kid") and symmetric key material itself ("k").
 
@@ -94,4 +96,4 @@ The table below contains the Mock BPA executable command line options. See the M
 | `-s`      | The endpoint ID of the local security source used to handle BPSec.                                                                |
 | `-p`      | The comma-separated bit fields representing policies to initialize Mock BPA with.                                                 |
 | `-j`      | The path to a ION-Like Policy JSON-encoded policy structure file containing policies to initialize Mock BPA with.                 |
-| `-k`      | The path to a JSON Web Key (JWK) formatted file containing keys to register with the BPA's Cryptographic Library instance.        |
+| `-k`      | The path to a JSON Web Key (JWK) file (named ".json") or COSE Key Set (named ".cbor") containing keys to register with the BPA's key store.        |

docs/api/dictionary.txt

@@ -51,6 +51,7 @@ callee's
 calloc
 CALLOC
 Carsten
+cbor
 CBOR
 CCSDS
 cek
@@ -127,6 +128,7 @@ isspace
 JHU
 Josefsson
 JPL
+json
 JSON
 JWK
 JWKs

src/CMakeLists.txt

@@ -54,9 +54,11 @@ target_include_directories(bsl_front PUBLIC
 add_library(bsl_crypto)
 target_sources(bsl_crypto PUBLIC
     ${CMAKE_CURRENT_SOURCE_DIR}/bsl/crypto/CryptoInterface.h
+    ${CMAKE_CURRENT_SOURCE_DIR}/bsl/crypto/KeyStore.h
 )
 target_sources(bsl_crypto PRIVATE
     ${CMAKE_CURRENT_SOURCE_DIR}/bsl/crypto/CryptoInterface.c
+    ${CMAKE_CURRENT_SOURCE_DIR}/bsl/crypto/KeyStore.c
 )
 set_target_properties(bsl_crypto
     PROPERTIES
@@ -180,7 +182,7 @@ target_sources(
   ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/eidpat.h
   ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/encode.h
   ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/decode.h
-  ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/key_registry.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/KeyStore.h
   ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/ctr.h
   ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/MockBPA.h
 )
@@ -194,7 +196,7 @@ target_sources(
   ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/eidpat.c
   ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/encode.c
   ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/decode.c
-  ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/key_registry.c
+  ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/KeyStore.c
   ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/ctr.c
 )
 set_target_properties(bsl_mock_bpa