MS OPM（输出保护管理器）初始化X509链

Question

I trying to OPM (Output Protection Manager) with Visual C++ (native) using OPMAPI. My goal is enable HDCP session between HDMI device driver and display to protect contents through out HDMI cable.

I got an example from MSDN

In example code there's some undocumented function about certifications. (ValidateX509Certificate, GetPublicKeyFromCertificate)

Here follows example code.

    OPM_RANDOM_NUMBER random;   // Random number from driver.
    ZeroMemory(&random, sizeof(random));
    BYTE *pbCertificate = NULL; // Pointer to a buffer to hold the certificate.
    ULONG cbCertificate = 0;    // Size of the certificate in bytes.

    PUBLIC_KEY_VALUES *pKey = NULL; // The driver's public key.

    // Get the driver's certificate chain + random number
    HRESULT hr = pVideoOutput->StartInitialization(
        &random,
        &pbCertificate,
        &cbCertificate );

    // Validate the X.509 certificate. (Not shown.)
    hr = ValidateX509Certificate(pbCertificate, cbCertificate);

    if (FAILED(hr))
    {
        goto done;
    }

    // Get the public key from the certificate. (Not shown.)
    hr = GetPublicKeyFromCertificate(
        pbCertificate,
        cbCertificate,
        &pKey );

According to MSDN , IOPMVideoOutput::StartInitialization() retrieves random number and X509 certificate chain (pbCertificate).

ValidateX509Certificate() and GetPublicKeyFromCertificate() function are not shown.

Could anyone explain to me the way to write above two function please?

Or I want to know how decode X.509 cert chain data (DER) into CERT_CHAIN_CONTEXT.

Answer 1

The StartInitialization function returns the complete certificate chain of the driver as signed PKCS7 data with DER encoding. This is not the usual X509 certificate with DER encoding we commonly deal with. Unfortunately this is not mentioned in the MSDN pages.

The certificates/certificate chain can be extracted from signed PKCS7 DER using any crypto library/framework. We can verify and get the public key using Microsoft crypto framework with the folloing steps.

1. Get certificate chain with CryptGetMessageCertificates function
2. Optionally you can verify the certificate chain as explained "Performing X.509 Certificate Verification with CryptoAPI"
3. Get the subject certificate CERT_CONTEXT as explained in Step 2. The subject public key can be retrieved from pCertInfo of CERT_CONTEXT.

It is much easier (at least I feel like) to do with OpenSSL which is explained "how to Read the certificates file from the PKCS7.p7b certificate file usind openssl" . It shows how to retrieve the certificates and you can easily retrieve public key using X509_get_pubkey function.

Answer 2

这是一个示例代码，用于实现提到的MSDN中缺少的功能，并展示如何基于标准窗口API https://github.com/wangf1978/D3DTest，CryptoUtil.cpp / OPMSession.cpp使用OPM和相关的加密实现。