| /* |
| * Copyright 2018-2020 NXP |
| * SPDX-License-Identifier: Apache-2.0 |
| */ |
| |
| #include <fsl_sss_sscp.h> |
| |
| #if SSS_HAVE_A71CH || SSS_HAVE_A71CH_SIM |
| |
| #include <HLSEAPI.h> |
| #include <a71ch_api.h> |
| #include <fsl_sscp.h> |
| #include <fsl_sscp_a71ch.h> |
| #include <fsl_sscp_commands.h> |
| #include <fsl_sss_keyid_map.h> |
| #include <stdio.h> |
| #include <string.h> |
| |
| #include "ax_sss_scp.h" |
| #include "sm_apdu.h" |
| #include "stdlib.h" |
| //#define NX_LOG_ENABLE_SSCP_DEBUG 1 |
| #include <fsl_sss_util_asn1_der.h> |
| #include <nxLog_sscp.h> |
| #include <nxScp03_Types.h> |
| |
| /* ************************************************************************** */ |
| /* Includes */ |
| /* ************************************************************************** */ |
| |
| /* ************************************************************************** */ |
| /* Local Defines */ |
| /* ************************************************************************** */ |
| #define DER_ECC_NISTP256_HEADER 26 |
| #define ADD_DER_ECC_NISTP256_HEADER(x) (x) + DER_ECC_NISTP256_HEADER |
| #define REMOVE_DER_ECC_NISTP256_HEADER(x) (x) - DER_ECC_NISTP256_HEADER |
| #define CONVERT_BYTE(x) (x) / 8 |
| #define CONVERT_BIT(x) (x) * 8 |
| |
| /* ************************************************************************** */ |
| /* Structures and Typedefs */ |
| /* ************************************************************************** */ |
| |
| /* ************************************************************************** */ |
| /* Global Variables */ |
| /* ************************************************************************** */ |
| |
| keyStoreTable_t gkeystore_shadow_ch; |
| keyIdAndTypeIndexLookup_t gLookupEntires_ch[KS_N_ENTIRES]; |
| |
| typedef struct |
| { |
| /** Fixed - Unique 32bit magic number. |
| * |
| * In case some one over-writes we can know. */ |
| uint32_t magic; |
| /** Fixed - constant based on version number */ |
| uint16_t version; |
| |
| uint16_t maxEntries; |
| /** Dynamic entries */ |
| keyIdAndTypeIndexLookup_t entries[KS_N_ENTIRES]; |
| } keyStoreTableEEPROM_t; |
| /* ************************************************************************** */ |
| /* Static function declarations */ |
| /* ************************************************************************** */ |
| |
| static HLSE_RET_CODE a71ch_GenerateKey( |
| keyStoreTable_t *keystore_shadow, uint8_t keyType, uint8_t cipherType, uint32_t extKeyID); |
| static HLSE_RET_CODE a71ch_EraseKey( |
| keyStoreTable_t *keystore_shadow, uint8_t keyType, uint8_t cipherType, uint32_t extKeyID); |
| static HLSE_RET_CODE a71ch_FreezeKey( |
| keyStoreTable_t *keystore_shadow, uint8_t keyType, uint8_t cipherType, uint32_t extKeyID); |
| |
| static sss_status_t swToSSSResult(uint16_t checkSW); |
| |
| static HLSE_RET_CODE a71ch_AllocateKeyStore(sss_a71ch_key_store_t *keyStore, uint32_t keyStoreID); |
| |
| static HLSE_RET_CODE a71ch_loadKeyStore(sss_a71ch_key_store_t *keyStore); |
| static HLSE_RET_CODE a71ch_saveKeyStore(sss_a71ch_key_store_t *keyStore); |
| |
| static HLSE_RET_CODE a71ch_AllocateKeyObject(sss_a71ch_key_store_t *keyStore, |
| uint32_t extKeyID, |
| sss_key_part_t keyPart, |
| sss_cipher_type_t cipherType, |
| size_t keyByteLenMax, |
| uint32_t options, |
| uint8_t *a71ch_slotid); |
| |
| static HLSE_RET_CODE a71ch_KeyObjectGetHandle( |
| sss_a71ch_key_store_t *keyStore, uint32_t extKeyID, uint32_t *keyType, uint32_t *cipherType); |
| |
| static HLSE_RET_CODE a71ch_getKey(keyStoreTable_t *keystore_shadow, |
| sss_key_part_t key_part, |
| sss_cipher_type_t cipher_type, |
| uint32_t extId, |
| uint8_t *key, |
| uint32_t *keyByteLen, |
| uint32_t *keyBitLen); |
| |
| static HLSE_RET_CODE a71ch_setKey(keyStoreTable_t *keystore_shadow, |
| sss_key_part_t key_part, |
| sss_cipher_type_t cipher_type, |
| uint32_t extId, |
| uint8_t *key, |
| size_t keyLen, |
| size_t keyBitLen); |
| |
| static HLSE_RET_CODE a71ch_DhDeriveKey(sss_a71ch_key_store_t *keyStore, |
| uint32_t extKeyID, |
| uint8_t *pubKeyBuf, |
| size_t pubKeyBufBitLen, |
| uint8_t *pDerivekey, |
| size_t *pDerivekeykeyBitlen); |
| |
| static HLSE_RET_CODE a71ch_SymDeriveKey(sss_a71ch_key_store_t *keyStore, |
| uint32_t extKeyID, |
| const uint8_t *saltData, |
| size_t saltLen, |
| const uint8_t *info, |
| size_t infoLen, |
| uint8_t *pDerivekey, |
| size_t derivekeykeylen); |
| |
| static HLSE_RET_CODE a71ch_CalHmacSha256(sss_a71ch_key_store_t *keyStore, |
| uint32_t extKeyID, |
| const uint8_t *info, |
| size_t infoLen, |
| uint8_t *hmac, |
| size_t hmaclen); |
| |
| static HLSE_RET_CODE a71ch_eccSign(keyStoreTable_t *keystore_shadow, |
| uint32_t extKeyID, |
| uint8_t *pHash, |
| uint16_t hashLen, |
| uint8_t *pSignature, |
| uint16_t *pSignatureLen); |
| |
| static HLSE_RET_CODE a71ch_eccVerify(keyStoreTable_t *keystore_shadow, |
| uint32_t extKeyID, |
| uint8_t *pHash, |
| uint16_t hashLen, |
| uint8_t *pSignature, |
| uint16_t SignatureLen); |
| |
| /* ************************************************************************** */ |
| /* Public Functions */ |
| /* ************************************************************************** */ |
| |
| sss_status_t sscp_a71ch_openSession(void *connectionData, sss_sscp_session_t *openSession) |
| |
| { |
| uint32_t retval = kStatus_SSS_Fail; |
| if (connectionData == NULL) { |
| return kStatus_SSS_InvalidArgument; |
| } |
| SE_Connect_Ctx_t *pA71Auth = (SE_Connect_Ctx_t *)connectionData; |
| memset(openSession, 0, sizeof(*openSession)); |
| SmCommState_t CommState = {0}; |
| CommState.connType = pA71Auth->connType; |
| uint8_t atr[100]; |
| uint16_t atrLen = ARRAY_SIZE(atr); |
| U16 lReturn; |
| |
| #if defined(SMCOM_JRCP_V1) || defined(SMCOM_JRCP_V2) || defined(RJCT_VCOM) || defined(SMCOM_PCSC) |
| lReturn = SM_RjctConnect(NULL, pA71Auth->portName, &CommState, atr, &atrLen); |
| { |
| if (lReturn == SW_OK) { |
| openSession->fp_closeConnection = &sscp_a71ch_closeConnect; |
| retval = kStatus_SSS_Success; |
| } |
| else if (lReturn == ERR_COM_ALREADY_OPEN) |
| retval = kStatus_SSS_Success; |
| else if (lReturn == ERR_API_ERROR) |
| retval = kStatus_SSS_InvalidArgument; |
| } |
| #else |
| /* AX_EMBEDDED Or Native */ |
| lReturn = SM_Connect(NULL, &CommState, atr, &atrLen); |
| if (lReturn != SW_OK) { |
| LOG_E("SM_Connect Failed. Status %04X", lReturn); |
| return retval; |
| } |
| else { |
| retval = kStatus_SSS_Success; |
| } |
| #endif |
| if (retval == kStatus_SSS_Success) { |
| #if SSS_HAVE_SCP_SCP03_SSS |
| if ((retval == kStatus_SSS_Success) && (pA71Auth->auth.authType == kSSS_AuthType_SCP03)) { |
| retval = kStatus_SSS_Fail; |
| |
| LOG_I("Invoking SM_ChannelAuthenticate()"); |
| lReturn = SM_ChannelAuthenticate(&pA71Auth->auth.ctx.a71chAuthKeys, NULL); |
| if (lReturn == SW_OK) { |
| retval = kStatus_SSS_Success; |
| } |
| else { |
| LOG_E("SM_ChannelAuthenticate() failed."); |
| } |
| } |
| #endif |
| } |
| |
| return (sss_status_t)retval; |
| } |
| |
| void sscp_a71chkey_store_context_free(sss_a71ch_key_store_t *context) |
| { |
| memset(&gLookupEntires_ch, 0, sizeof(gLookupEntires_ch)); |
| memset(&gkeystore_shadow_ch, 0, sizeof(gkeystore_shadow_ch)); |
| } |
| void sscp_a71ch_closeSession(sss_sscp_session_t *closeSession) |
| { |
| if (closeSession->sessionId != 0) { |
| } |
| if (closeSession->fp_closeConnection != NULL) { |
| closeSession->fp_closeConnection(); |
| closeSession->fp_closeConnection = NULL; |
| } |
| } |
| void sscp_a71ch_closeConnect(void) |
| { |
| HLSE_CloseConnection(HLSE_CLOSE_CONNECTION_NO_RESET); |
| } |
| |
| sss_status_t sscp_a71ch_init(sscp_a71ch_context_t *context, sss_a71ch_key_store_t *keyStore) |
| { |
| /* assign A71ch implementation of ::sscp_invoke_command() */ |
| context->keyStore = keyStore; |
| context->invoke = &sscp_a71ch_invoke_command; |
| keyStore->session->sscp_context = (sscp_context_t *)context; |
| return kStatus_SSS_Success; |
| } |
| |
| void sscp_a71ch_free(sscp_a71ch_context_t *context) |
| { |
| if (context != NULL) { |
| memset(context, 0, sizeof(*context)); |
| } |
| } |
| |
| void getA7CHKeyStore(sss_a71ch_key_store_t **ks, sscp_context_reference_t *ref) |
| { |
| switch (ref->type) { |
| case kSSCP_ParamContextType_SSS_Symmetric: { |
| sss_sscp_symmetric_t *ctx = (sss_sscp_symmetric_t *)ref->ptr; |
| *ks = (sss_a71ch_key_store_t *)ctx->keyObject->keyStore; |
| } break; |
| case kSSCP_ParamContextType_SSS_Aead: |
| break; |
| case kSSCP_ParamContextType_SSS_Digest: |
| break; |
| case kSSCP_ParamContextType_SSS_Mac: { |
| sss_mac_t *ctx = (sss_mac_t *)ref->ptr; |
| *ks = (sss_a71ch_key_store_t *)ctx->keyObject->keyStore; |
| break; |
| } |
| case kSSCP_ParamContextType_SSS_Tunnel: |
| break; |
| case kSSCP_ParamContextType_SSS_DeriveKey: { |
| sss_derive_key_t *ctx = (sss_derive_key_t *)ref->ptr; |
| *ks = (sss_a71ch_key_store_t *)ctx->keyObject->keyStore; |
| break; |
| } |
| case kSSCP_ParamContextType_SSS_Asymmetric: { |
| sss_asymmetric_t *ctx = (sss_asymmetric_t *)ref->ptr; |
| *ks = (sss_a71ch_key_store_t *)ctx->keyObject->keyStore; |
| break; |
| } |
| case kSSCP_ParamContextType_SSS_Object: { |
| sss_object_t *pobj = (sss_object_t *)ref->ptr; |
| *ks = (sss_a71ch_key_store_t *)pobj->keyStore; |
| break; |
| } |
| case kSSCP_ParamContextType_SSS_KeyStore: { |
| *ks = (sss_a71ch_key_store_t *)ref->ptr; |
| break; |
| } |
| case kSSCP_ParamContextType_SSS_RandomGen: |
| *ks = (sss_a71ch_key_store_t *)ref->ptr; |
| break; |
| } |
| } |
| |
| sscp_status_t sscp_a71ch_invoke_command( |
| sscp_context_t *a71chContext, uint32_t commandID, sscp_operation_t *op, uint32_t *returnOrigin) |
| { |
| uint16_t resSW = SMCOM_SND_FAILED; |
| sscp_status_t retSSCP = kStatus_SSCP_Success; |
| uint32_t keyId; |
| sss_a71ch_key_store_t *a71ch_keystore = NULL; |
| sss_derive_key_t *derctx; |
| sscp_a71ch_context_t *context = (sscp_a71ch_context_t *)a71chContext; |
| if (kSSCP_ParamType_ContextReference == SSCP_OP_GET_PARAM(0, op->paramTypes)) { |
| getA7CHKeyStore(&a71ch_keystore, &op->params[0].context); |
| } |
| |
| #if SSS_HAVE_A71CH_SIM |
| if (a71ch_keystore != NULL) { |
| if (a71ch_keystore->session->sessionId != 0) { |
| set_SessionId_Tlv(a71ch_keystore->session->sessionId); |
| } |
| } |
| #endif |
| |
| switch (commandID) { |
| case kSSCP_CMD_GENERATE_KEY: |
| resSW = a71ch_GenerateKey( |
| a71ch_keystore->keystore_shadow, op->params[1].value.a, op->params[2].value.b, op->params[1].value.b); |
| break; |
| |
| case kSSCP_CMD_ERASE_KEY: |
| resSW = a71ch_EraseKey( |
| a71ch_keystore->keystore_shadow, op->params[1].value.a, op->params[2].value.a, op->params[1].value.b); |
| if (resSW == SMCOM_OK) { |
| resSW = a71ch_saveKeyStore(a71ch_keystore); |
| } |
| break; |
| |
| case kSSCP_CMD_GET_KEY: |
| resSW = a71ch_getKey(a71ch_keystore->keystore_shadow, |
| op->params[1].value.a, |
| op->params[3].value.b, |
| op->params[1].value.b, |
| op->params[2].memref.buffer, |
| &op->params[3].value.a, |
| &op->params[3].value.b); |
| break; |
| |
| case kSSCP_CMD_FREEZE_KEY: |
| resSW = a71ch_FreezeKey( |
| a71ch_keystore->keystore_shadow, op->params[1].value.a, op->params[2].value.a, op->params[1].value.b); |
| break; |
| |
| case kSSCP_CMD_ALLOCATE_KEYSTORE: |
| resSW = a71ch_AllocateKeyStore(a71ch_keystore, op->params[1].value.a); |
| break; |
| |
| case kSSCP_CMD_LOAD_KEYSTORE: |
| if (a71ch_keystore->shadow_handle == 0) { |
| /* It's OK. Allocate + Load here. */ |
| resSW = a71ch_AllocateKeyStore(a71ch_keystore, __LINE__); |
| } |
| else { |
| resSW = a71ch_loadKeyStore(a71ch_keystore); |
| } |
| break; |
| |
| case kSSCP_CMD_SAVE_KEYSTORE: |
| resSW = a71ch_saveKeyStore(a71ch_keystore); |
| break; |
| case kSSCP_CMD_SET_KEY: { |
| resSW = a71ch_setKey(a71ch_keystore->keystore_shadow, |
| op->params[1].value.a, |
| op->params[3].value.b, |
| op->params[1].value.b, |
| op->params[2].memref.buffer, |
| op->params[2].memref.size, |
| op->params[3].value.a); |
| } break; |
| case kSSCP_KEYOBJ_CMD_ALLOCATE_HANDLE: { |
| uint8_t a71ch_slotid = 0; |
| resSW = a71ch_AllocateKeyObject(a71ch_keystore, |
| op->params[1].value.a, |
| op->params[1].value.b, |
| op->params[3].value.a, |
| op->params[2].value.a, |
| op->params[2].value.b, |
| &a71ch_slotid); |
| op->params[4].value.a = a71ch_slotid; |
| } break; |
| case kSSCP_KEYOBJ_CMD_GET_HANDLE: |
| resSW = a71ch_KeyObjectGetHandle( |
| a71ch_keystore, op->params[1].value.a, &(op->params[2].value.a), &(op->params[2].value.b)); |
| break; |
| |
| case kSSCP_ASYMMETRIC_CTX_INIT: |
| op->params[3].value.a = (0xFFFFFFFFu ^ op->params[2].value.a); |
| resSW = SMCOM_OK; |
| break; |
| case kSSCP_ASYMMETRIC_CMD_ENCRYPT: |
| break; |
| case kSSCP_ASYMMETRIC_CMD_DECRYPT: |
| break; |
| case kSSCP_ASYMMETRIC_CMD_SIGN_DIGEST: |
| keyId = (0xFFFFFFFFu ^ op->params[1].value.a); |
| resSW = a71ch_eccSign(a71ch_keystore->keystore_shadow, |
| keyId, |
| op->params[2].memref.buffer, |
| (uint16_t)op->params[2].memref.size, |
| op->params[3].memref.buffer, |
| (uint16_t *)&op->params[3].memref.size); |
| break; |
| case kSSCP_ASYMMETRIC_CMD_VERIFY_DIGEST: |
| keyId = (0xFFFFFFFFu ^ op->params[1].value.a); |
| resSW = a71ch_eccVerify(context->keyStore->keystore_shadow, |
| keyId, |
| op->params[2].memref.buffer, |
| (uint16_t)op->params[2].memref.size, |
| op->params[3].memref.buffer, |
| (uint16_t)op->params[3].memref.size); |
| break; |
| |
| case kSSCP_SYMM_CIPHER_CTX_INIT: |
| op->params[2].value.a = (0xFFFFFFFFu ^ op->params[1].value.a); |
| resSW = SMCOM_OK; |
| break; |
| |
| case kSSCP_DERIVE_CTX_INIT: |
| op->params[3].value.a = (0xFFFFFFFFu ^ op->params[2].value.a); |
| resSW = SMCOM_OK; |
| break; |
| |
| case kSSCP_ASYMM_DH_DERIVE_KEY: { |
| resSW = a71ch_DhDeriveKey(a71ch_keystore, |
| (0xFFFFFFFFu ^ (op->params[1].value.a)), /* = context->sessionId*/ |
| op->params[2].memref.buffer, /* key*/ |
| op->params[2].memref.size, /*keylen*/ |
| op->params[3].memref.buffer, /* derivekey*/ |
| &(op->params[4].memref.size)); /* derivekeykeylen;*/ |
| } break; |
| |
| case kSSCP_DERIVE_KEY: |
| derctx = (sss_derive_key_t *)op->params[0].context.ptr; |
| if (derctx != NULL) { |
| if ((derctx->algorithm == kAlgorithm_SSS_HMAC_SHA256) && (derctx->mode == kMode_SSS_Mac)) { |
| resSW = a71ch_CalHmacSha256(a71ch_keystore, |
| (0xFFFFFFFFu ^ (op->params[1].value.a)), /* extKeyID = ~context->sessionId*/ |
| op->params[3].memref.buffer, /* info */ |
| op->params[3].memref.size, /* infoLen */ |
| op->params[4].memref.buffer, /* hmac*/ |
| op->params[4].memref.size); /* hmaclen;*/ |
| } |
| else if ((derctx->algorithm == kAlgorithm_SSS_HMAC_SHA256) && |
| (derctx->mode == kMode_SSS_ComputeSharedSecret)) { |
| resSW = a71ch_SymDeriveKey(a71ch_keystore, |
| (0xFFFFFFFFu ^ (op->params[1].value.a)), /* extKeyID = ~context->sessionId*/ |
| op->params[2].memref.buffer, /* (void *)saltData*/ |
| op->params[2].memref.size, /* saltLen */ |
| op->params[3].memref.buffer, /* info */ |
| op->params[3].memref.size, /* infoLen */ |
| op->params[4].memref.buffer, /* derivekey*/ |
| op->params[4].memref.size); /* derivekeykeylen;*/ |
| } |
| } |
| break; |
| case kSSCP_CMD_SSS_MacOneGo: |
| derctx = (sss_derive_key_t *)op->params[0].context.ptr; |
| if (derctx != NULL) { |
| if ((derctx->algorithm == kAlgorithm_SSS_HMAC_SHA256) && (derctx->mode == kMode_SSS_Mac)) { |
| resSW = a71ch_CalHmacSha256(a71ch_keystore, |
| op->params[3].value.a, |
| op->params[1].memref.buffer, /* info */ |
| op->params[1].memref.size, /* infoLen */ |
| op->params[2].memref.buffer, /* hmac*/ |
| op->params[2].memref.size); /* hmaclen;*/ |
| |
| if (HLSE_SW_OK == resSW) { |
| op->params[2].memref.size = 32; //Only HMAC SHA256 is supported |
| } |
| } |
| } |
| break; |
| case kSSCP_CMD_SSS_MacInit: { |
| derctx = (sss_derive_key_t *)op->params[0].context.ptr; |
| if (derctx != NULL) { |
| if ((derctx->algorithm == kAlgorithm_SSS_HMAC_SHA256) && (derctx->mode == kMode_SSS_Mac)) { |
| uint16_t intId = 0; |
| uint8_t nBlock = 1; |
| sss_status_t status = |
| ks_common_extId_to_int_index(a71ch_keystore->keystore_shadow, op->params[1].value.a, &intId); |
| if (status != kStatus_SSS_Success) { |
| LOG_E("Could not find Ext ID 0x%X in keystore_shadow", op->params[1].value.a); |
| resSW = HLSE_ERR_API_ERROR; |
| } |
| else { |
| nBlock = (intId & 0xF0) >> 4; |
| resSW = A71_HmacSha256Init((intId & 0x0F), nBlock); |
| } |
| } |
| } |
| } break; |
| case kSSCP_CMD_SSS_MacUpdate: { |
| derctx = (sss_derive_key_t *)op->params[0].context.ptr; |
| if (derctx != NULL) { |
| if ((derctx->algorithm == kAlgorithm_SSS_HMAC_SHA256) && (derctx->mode == kMode_SSS_Mac)) { |
| uint16_t intId = 0; |
| uint8_t nBlock = 1; |
| sss_status_t status = |
| ks_common_extId_to_int_index(a71ch_keystore->keystore_shadow, op->params[1].value.a, &intId); |
| if (status != kStatus_SSS_Success) { |
| LOG_E("Could not find Ext ID 0x%X in keystore_shadow", op->params[1].value.a); |
| resSW = HLSE_ERR_API_ERROR; |
| } |
| else { |
| nBlock = (intId & 0xF0) >> 4; |
| resSW = A71_HmacSha256Update( |
| (intId & 0x0F), nBlock, op->params[2].memref.buffer, (U16)op->params[2].memref.size); |
| } |
| } |
| } |
| } break; |
| case kSSCP_CMD_SSS_MacFinish: { |
| derctx = (sss_derive_key_t *)op->params[0].context.ptr; |
| if (derctx != NULL) { |
| if ((derctx->algorithm == kAlgorithm_SSS_HMAC_SHA256) && (derctx->mode == kMode_SSS_Mac)) { |
| uint16_t intId = 0; |
| uint8_t nBlock = 1; |
| U16 dataLen = (U16)op->params[2].memref.size; |
| sss_status_t status = |
| ks_common_extId_to_int_index(a71ch_keystore->keystore_shadow, op->params[1].value.a, &intId); |
| if (status != kStatus_SSS_Success) { |
| LOG_E("Could not find Ext ID 0x%X in keystore_shadow", op->params[1].value.a); |
| resSW = HLSE_ERR_API_ERROR; |
| } |
| else { |
| nBlock = (intId & 0xF0) >> 4; |
| resSW = A71_HmacSha256Final((intId & 0x0F), nBlock, op->params[2].memref.buffer, &dataLen); |
| if (HLSE_SW_OK == resSW) { |
| op->params[2].memref.size = 32; //Only HMAC SHA256 is supported |
| } |
| } |
| } |
| } |
| } break; |
| case kSSCP_GEN_RANDOM_NUM: { |
| resSW = A71_GetRandom(op->params[2].memref.buffer, (uint8_t)op->params[2].memref.size); |
| } break; |
| case kSSCP_CMD_SSS_DigestOneGo: { |
| U16 shaLen = (U16)op->params[2].memref.size; |
| resSW = A71_GetSha256( |
| op->params[1].memref.buffer, (U16)op->params[1].memref.size, op->params[2].memref.buffer, &shaLen); |
| op->params[2].memref.size = shaLen; |
| } break; |
| case kSSCP_CMD_SSS_DigestInit: { |
| resSW = A71_Sha256Init(); |
| } break; |
| case kSSCP_CMD_SSS_DigestUpdate: { |
| resSW = A71_Sha256Update(op->params[1].memref.buffer, (U16)op->params[1].memref.size); |
| } break; |
| case kSSCP_CMD_SSS_DigestFinish: { |
| U16 shaLen = (U16)op->params[1].memref.size; |
| resSW = A71_Sha256Final(op->params[1].memref.buffer, &shaLen); |
| op->params[1].memref.size = shaLen; |
| } break; |
| case kSSCP_GET_UID: { |
| U16 bufSize = (U16)op->params[1].memref.size; |
| resSW = A71_GetUniqueID(op->params[1].memref.buffer, &bufSize); |
| op->params[1].memref.size = bufSize; |
| } break; |
| case kSSCP_GET_CERT_UID: { |
| U16 bufSize = (U16)op->params[1].memref.size; |
| resSW = A71_GetCertUid(op->params[1].memref.buffer, &bufSize); |
| op->params[1].memref.size = bufSize; |
| } break; |
| default: |
| retSSCP = kStatus_SSCP_Fail; |
| LOG_E("Not a SSCP command"); |
| } |
| *returnOrigin = (uint32_t)swToSSSResult(resSW); |
| return (retSSCP); |
| } |
| |
| /* ************************************************************************** */ |
| /* Private Functions */ |
| /* ************************************************************************** */ |
| static HLSE_RET_CODE a71ch_CalHmacSha256(sss_a71ch_key_store_t *keyStore, |
| uint32_t extKeyID, |
| const uint8_t *info, |
| size_t infoLen, |
| uint8_t *pDerivekey, |
| size_t derivekeykeylen) |
| { |
| HLSE_RET_CODE hlseret; |
| uint16_t intId = 0; |
| uint8_t nBlock = 1; |
| U16 Hmaclen = 64; |
| |
| sss_status_t status = ks_common_extId_to_int_index(keyStore->keystore_shadow, extKeyID, &intId); |
| if (status != kStatus_SSS_Success) { |
| LOG_E("Could not find Ext ID 0x%X in keytore_shadow", extKeyID); |
| hlseret = HLSE_ERR_API_ERROR; |
| } |
| else { |
| nBlock = (intId & 0xF0) >> 4; |
| hlseret = A71_GetHmacSha256((U8)(intId & 0x0F), nBlock, info, (U16)infoLen, pDerivekey, &Hmaclen); |
| } |
| return hlseret; |
| } |
| |
| static HLSE_RET_CODE a71ch_SymDeriveKey(sss_a71ch_key_store_t *keyStore, |
| uint32_t extKeyID, |
| const uint8_t *saltData, |
| size_t saltLen, |
| const uint8_t *info, |
| size_t infoLen, |
| uint8_t *pDerivekey, |
| size_t derivekeykeylen) |
| { |
| HLSE_RET_CODE hlseret; |
| uint16_t intId = 0; |
| uint8_t nBlock = 1; |
| |
| sss_status_t status = ks_common_extId_to_int_index(keyStore->keystore_shadow, extKeyID, &intId); |
| if (status != kStatus_SSS_Success) { |
| LOG_E("Could not find Ext ID 0x%X in keytore_shadow", extKeyID); |
| hlseret = HLSE_ERR_API_ERROR; |
| } |
| else { |
| nBlock = (intId & 0xF0) >> 4; |
| hlseret = A71_HkdfSymKey((U8)(intId & 0x0F), |
| nBlock, |
| saltData, |
| (uint16_t)saltLen, |
| info, |
| (uint16_t)infoLen, |
| pDerivekey, |
| (uint16_t)derivekeykeylen); |
| } |
| |
| return hlseret; |
| } |
| |
| static HLSE_RET_CODE a71ch_DhDeriveKey(sss_a71ch_key_store_t *keyStore, |
| uint32_t extKeyID, |
| uint8_t *pubKeyBuf, |
| size_t pubKeyBufBitLen, |
| uint8_t *pDerivekey, |
| size_t *pDerivekeykeyBitlen) |
| { |
| HLSE_RET_CODE hlseret; |
| sss_status_t asn_retval = kStatus_SSS_Fail; |
| uint16_t intId = 0; |
| uint16_t derivekeyBytelen; |
| uint16_t pubKeyBufByteLen; |
| size_t publicKeyLen = 0; |
| uint16_t publicKeyIndex = 0; |
| |
| sss_status_t status = ks_common_extId_to_int_index(keyStore->keystore_shadow, extKeyID, &intId); |
| if (status != kStatus_SSS_Success) { |
| LOG_E("Could not find Ext ID 0x%X in keytore_shadow", extKeyID); |
| hlseret = HLSE_ERR_API_ERROR; |
| } |
| else { |
| pubKeyBufByteLen = (uint16_t)CONVERT_BYTE(pubKeyBufBitLen); |
| derivekeyBytelen = (uint16_t)CONVERT_BYTE(*pDerivekeykeyBitlen); |
| |
| asn_retval = |
| sss_util_pkcs8_asn1_get_ec_public_key_index(pubKeyBuf, pubKeyBufByteLen, &publicKeyIndex, &publicKeyLen); |
| if (asn_retval != kStatus_SSS_Success) { |
| LOG_W("error in sss_util_pkcs8_asn1_get_ec_public_key_index"); |
| return HLSE_ERR_API_ERROR; |
| } |
| |
| hlseret = A71_EcdhGetSharedSecret( |
| (U8)intId, &pubKeyBuf[publicKeyIndex], (U16)publicKeyLen, pDerivekey, &derivekeyBytelen); |
| *pDerivekeykeyBitlen = CONVERT_BIT(derivekeyBytelen); |
| } |
| |
| return hlseret; |
| } |
| |
| static HLSE_RET_CODE a71ch_GenerateKey( |
| keyStoreTable_t *keystore_shadow, uint8_t keyType, uint8_t cipherType, uint32_t extKeyID) |
| { |
| HLSE_RET_CODE hlseret = HLSE_ERR_API_ERROR; |
| if (keyType == kSSS_KeyPart_Pair && cipherType == kSSS_CipherType_EC_NIST_P) { |
| uint16_t intId = 0; |
| sss_status_t status = ks_common_extId_to_int_index(keystore_shadow, extKeyID, &intId); |
| if (status == kStatus_SSS_Success) { |
| hlseret = A71_GenerateEccKeyPair((U8)intId); |
| } |
| else { |
| LOG_E("Could not find Ext ID 0x%X in keytore_shadow", extKeyID); |
| hlseret = HLSE_ERR_API_ERROR; |
| } |
| } |
| return hlseret; |
| } |
| |
| static HLSE_RET_CODE a71ch_EraseKey( |
| keyStoreTable_t *keystore_shadow, uint8_t keyType, uint8_t cipherType, uint32_t extKeyID) |
| { |
| HLSE_RET_CODE hlseret = HLSE_ERR_API_ERROR; |
| uint16_t intId = 0; |
| |
| sss_status_t status = ks_common_extId_to_int_index(keystore_shadow, extKeyID, &intId); |
| if (status != kStatus_SSS_Success) { |
| LOG_E("Could not find Ext ID 0x%X in keytore_shadow", extKeyID); |
| hlseret = HLSE_ERR_API_ERROR; |
| } |
| else { |
| if (keyType == kSSS_KeyPart_Pair && cipherType == kSSS_CipherType_EC_NIST_P) { |
| hlseret = A71_EraseEccKeyPair((U8)intId); |
| } |
| else if (keyType == kSSS_KeyPart_Public && cipherType == kSSS_CipherType_EC_NIST_P) { |
| hlseret = A71_EraseEccPublicKey((U8)intId); |
| } |
| else if (keyType == kSSS_KeyPart_Default && |
| (cipherType == kSSS_CipherType_AES || cipherType == kSSS_CipherType_HMAC)) { |
| hlseret = A71_EraseSymKey((U8)(intId & 0x0F)); |
| } |
| else if (keyType == kSSS_KeyPart_Default && cipherType == kSSS_CipherType_Binary) { |
| HLSE_OBJECT_HANDLE Handles[5]; |
| U16 HandlesNum = sizeof(Handles) / sizeof(HLSE_OBJECT_HANDLE); |
| U16 HandlesNum_copy; |
| U8 i = 0; |
| |
| hlseret = HLSE_EnumerateObjects(HLSE_CERTIFICATE, Handles, &HandlesNum); |
| |
| if (hlseret == HLSE_SW_OK) { |
| HandlesNum_copy = HandlesNum; |
| while (HandlesNum_copy) { |
| if (HLSE_GET_OBJECT_INDEX(Handles[i]) == intId) { |
| break; |
| } |
| i++; |
| HandlesNum_copy--; |
| } |
| hlseret = HLSE_EraseObject(Handles[i]); |
| } |
| } |
| } |
| if (hlseret == HLSE_SW_OK) { |
| status = ks_common_remove_fat(keystore_shadow, extKeyID); |
| if (status != kStatus_SSS_Success) { |
| hlseret = HLSE_ERR_API_ERROR; |
| } |
| } |
| return hlseret; |
| } |
| |
| static HLSE_RET_CODE a71ch_FreezeKey( |
| keyStoreTable_t *keystore_shadow, uint8_t keyType, uint8_t cipherType, uint32_t extKeyID) |
| { |
| HLSE_RET_CODE hlseret = HLSE_ERR_API_ERROR; |
| uint16_t intId = 0; |
| sss_status_t status = ks_common_extId_to_int_index(keystore_shadow, extKeyID, &intId); |
| if (status != kStatus_SSS_Success) { |
| LOG_E("Could not find Ext ID 0x%X in keytore_shadow", extKeyID); |
| hlseret = HLSE_ERR_API_ERROR; |
| } |
| else { |
| if (keyType == kSSS_KeyPart_Pair && cipherType == kSSS_CipherType_EC_NIST_P) { |
| hlseret = A71_FreezeEccKeyPair((U8)intId); |
| } |
| if (keyType == kSSS_KeyPart_Public && cipherType == kSSS_CipherType_EC_NIST_P) { |
| hlseret = A71_FreezeEccPublicKey((U8)intId); |
| } |
| if (keyType == kSSS_KeyPart_Default && |
| (cipherType == kSSS_CipherType_AES || cipherType == kSSS_CipherType_HMAC)) { |
| hlseret = A71_FreezeSymKey((U8)intId); |
| } |
| } |
| |
| return hlseret; |
| } |
| |
| static sss_status_t swToSSSResult(uint16_t checkSW) |
| { |
| switch (checkSW) { |
| case SMCOM_OK: |
| return kStatus_SSS_Success; |
| default: |
| return kStatus_SSS_Fail; |
| } |
| } |
| |
| static HLSE_RET_CODE a71ch_AllocateKeyStore(sss_a71ch_key_store_t *keyStore, uint32_t keyStoreID) |
| { |
| HLSE_RET_CODE hlseret = HLSE_ERR_API_ERROR; |
| HLSE_OBJECT_HANDLE Handles[5]; |
| U16 HandlesNum = sizeof(Handles) / sizeof(HLSE_OBJECT_HANDLE); |
| U16 HandlesNum_copy; |
| U8 i = 0; |
| HLSE_OBJECT_INDEX index = 0; |
| |
| /* Search for our data table @ index */ |
| if (keyStore->shadow_handle == 0) { |
| hlseret = HLSE_EnumerateObjects(HLSE_DATA, Handles, &HandlesNum); |
| if (hlseret == HLSE_SW_OK) { |
| HandlesNum_copy = HandlesNum; |
| while (HandlesNum_copy) { |
| if (HLSE_GET_OBJECT_INDEX(Handles[i]) == index) { |
| keyStore->shadow_handle = Handles[i]; |
| ks_common_init_fat(&gkeystore_shadow_ch, gLookupEntires_ch, ARRAY_SIZE(gLookupEntires_ch)); |
| break; |
| } |
| i++; |
| HandlesNum_copy--; |
| } |
| } |
| } |
| |
| if (gkeystore_shadow_ch.magic == 0) { |
| ks_common_init_fat(&gkeystore_shadow_ch, gLookupEntires_ch, ARRAY_SIZE(gLookupEntires_ch)); |
| } |
| keyStore->keystore_shadow = &gkeystore_shadow_ch; |
| |
| /* If it was never there, create it @ index */ |
| if (keyStore->shadow_handle == 0) { |
| /* Could not find it yet*/ |
| HLSE_OBJECT_TYPE objType = HLSE_DATA; |
| U16 templateSize = 3; |
| HLSE_ATTRIBUTE attr[3]; |
| keyStoreTableEEPROM_t eeKeyStore; |
| |
| eeKeyStore.magic = gkeystore_shadow_ch.magic; |
| eeKeyStore.version = gkeystore_shadow_ch.version; |
| eeKeyStore.maxEntries = gkeystore_shadow_ch.maxEntries; |
| memcpy(eeKeyStore.entries, gkeystore_shadow_ch.entries, sizeof(eeKeyStore.entries)); |
| |
| attr[0].type = HLSE_ATTR_OBJECT_TYPE; |
| attr[0].value = &objType; |
| attr[0].valueLen = sizeof(objType); |
| attr[1].type = HLSE_ATTR_OBJECT_INDEX; |
| attr[1].value = &index; |
| attr[1].valueLen = sizeof(index); |
| attr[2].type = HLSE_ATTR_OBJECT_VALUE; |
| attr[2].value = &eeKeyStore; |
| attr[2].valueLen = sizeof(eeKeyStore); |
| |
| hlseret = HLSE_CreateObject(attr, templateSize, &keyStore->shadow_handle); |
| } |
| |
| /* Either we created it. Or it was already existing, read it. */ |
| if (keyStore->shadow_handle != 0) { |
| hlseret = a71ch_loadKeyStore(keyStore); |
| } |
| return hlseret; |
| } |
| |
| static HLSE_RET_CODE a71ch_loadKeyStore(sss_a71ch_key_store_t *keyStore) |
| { |
| HLSE_RET_CODE hlseret; |
| HLSE_ATTRIBUTE attr; |
| keyStoreTableEEPROM_t eeKeyStore = {0}; |
| |
| if (keyStore->shadow_handle == 0) { |
| /* With shadow handle == 0, no point of reading. */ |
| hlseret = HLSE_ERR_MEMORY; |
| goto cleanup; |
| } |
| |
| attr.type = HLSE_ATTR_OBJECT_VALUE; |
| attr.value = &eeKeyStore; |
| attr.valueLen = sizeof(eeKeyStore); |
| /* Read from Key Store and load it here in gkeystore_shadow_ch */ |
| hlseret = HLSE_GetObjectAttribute(keyStore->shadow_handle, &attr); |
| |
| if (hlseret != HLSE_SW_OK) |
| goto cleanup; |
| if (eeKeyStore.magic == gkeystore_shadow_ch.magic && eeKeyStore.maxEntries == gkeystore_shadow_ch.maxEntries) { |
| keyStore->keystore_shadow = &gkeystore_shadow_ch; |
| if (eeKeyStore.version > gkeystore_shadow_ch.version) { |
| LOG_E("Keystore version mismatch"); |
| hlseret = HLSE_ERR_NOT_SUPPORTED; |
| goto cleanup; |
| } |
| memcpy(gkeystore_shadow_ch.entries, eeKeyStore.entries, sizeof(eeKeyStore.entries)); |
| keyStore->keystore_shadow->version = eeKeyStore.version; |
| } |
| else { |
| LOG_E(" Mismatch in eeKeyStore == gkeystore_shadow_ch"); |
| /* This is the case when there is mismatch between KeyStore and Middleware */ |
| hlseret = HLSE_ERR_MEMORY; |
| } |
| |
| cleanup: |
| return hlseret; |
| } |
| static HLSE_RET_CODE a71ch_saveKeyStore(sss_a71ch_key_store_t *keyStore) |
| { |
| HLSE_RET_CODE hlseret; |
| if (keyStore->shadow_handle == 0) { |
| hlseret = HLSE_ERR_API_ERROR; |
| } |
| else { |
| keyStoreTableEEPROM_t eeKeyStore; |
| if (KEYSTORE_VERSION > gkeystore_shadow_ch.version) { |
| gkeystore_shadow_ch.version = KEYSTORE_VERSION; |
| } |
| |
| eeKeyStore.magic = gkeystore_shadow_ch.magic; |
| eeKeyStore.version = gkeystore_shadow_ch.version; |
| eeKeyStore.maxEntries = gkeystore_shadow_ch.maxEntries; |
| memcpy(eeKeyStore.entries, gkeystore_shadow_ch.entries, sizeof(eeKeyStore.entries)); |
| |
| HLSE_ATTRIBUTE attr; |
| attr.type = HLSE_ATTR_OBJECT_VALUE; |
| attr.value = &eeKeyStore; |
| attr.valueLen = sizeof(eeKeyStore); |
| /* write gkeystore_shadow_ch */ |
| hlseret = HLSE_SetObjectAttribute(keyStore->shadow_handle, &attr); |
| } |
| return hlseret; |
| } |
| |
| static HLSE_RET_CODE a71ch_KeyObjectGetHandle( |
| sss_a71ch_key_store_t *keyStore, uint32_t extKeyID, uint32_t *keyType, uint32_t *cipherType) |
| { |
| HLSE_RET_CODE hlseret = HLSE_ERR_GENERAL_ERROR; |
| sss_status_t ks_status = kStatus_SSS_Success; |
| *keyType = kSSS_KeyPart_NONE; |
| ks_status = ks_common_get_keyType_from_keyid(keyStore->keystore_shadow, extKeyID, keyType, cipherType); |
| if (ks_status == kStatus_SSS_Success) |
| hlseret = HLSE_SW_OK; |
| return hlseret; |
| } |
| |
| static HLSE_RET_CODE a71ch_AllocateKeyObject(sss_a71ch_key_store_t *keyStore, |
| uint32_t extKeyID, |
| sss_key_part_t key_part, |
| sss_cipher_type_t cipherType, |
| size_t keyByteLenMax, |
| uint32_t options, |
| uint8_t *a71ch_slotid) |
| { |
| HLSE_RET_CODE hlseret = HLSE_SW_OK; |
| uint16_t intIndex = 0; |
| sss_status_t ks_status; |
| |
| ks_status = ks_common_check_available_int_index( |
| keyStore->keystore_shadow, (uint8_t)key_part, cipherType, &intIndex, (uint16_t)keyByteLenMax); |
| |
| if (ks_status != kStatus_SSS_Success) { |
| hlseret = HLSE_ERR_MEMORY; |
| } |
| *a71ch_slotid = (uint8_t)intIndex; |
| |
| if (hlseret == HLSE_SW_OK) { |
| ks_status = ks_common_update_fat(keyStore->keystore_shadow, |
| extKeyID, |
| (uint8_t)key_part, |
| (uint8_t)cipherType, |
| (uint8_t)intIndex, |
| 0, |
| (uint16_t)keyByteLenMax); |
| } |
| if (ks_status != kStatus_SSS_Success) { |
| hlseret = HLSE_ERR_MEMORY; |
| } |
| if (hlseret == HLSE_SW_OK) { |
| switch (cipherType) { |
| case kSSS_CipherType_Binary: { |
| HLSE_OBJECT_INDEX index = intIndex; |
| HLSE_OBJECT_TYPE objType = HLSE_CERTIFICATE; |
| U16 templateSize = 3; |
| HLSE_ATTRIBUTE attr[3]; |
| HLSE_OBJECT_HANDLE handle = 0; |
| void *pMem; |
| pMem = SSS_MALLOC(keyByteLenMax); |
| if (NULL != pMem) { |
| attr[0].type = HLSE_ATTR_OBJECT_TYPE; |
| attr[0].value = &objType; |
| attr[0].valueLen = sizeof(objType); |
| attr[1].type = HLSE_ATTR_OBJECT_INDEX; |
| attr[1].value = &index; |
| attr[1].valueLen = sizeof(index); |
| attr[2].type = HLSE_ATTR_OBJECT_VALUE; |
| /* This is dummy value we write... Actually this source code */ |
| attr[2].value = pMem; |
| attr[2].valueLen = (U16)keyByteLenMax; |
| |
| memset(pMem, 0, keyByteLenMax); |
| hlseret = HLSE_CreateObject(attr, templateSize, &handle); |
| /* TODO: if object is already present and all attributes are same then mark it as success*/ |
| if (hlseret == HLSE_OBJ_ALREADY_EXISTS) |
| hlseret = HLSE_SW_OK; |
| } |
| if (NULL != pMem) { |
| SSS_FREE(pMem); |
| } |
| break; |
| } |
| case kSSS_CipherType_EC_NIST_P: |
| case kSSS_CipherType_AES: |
| case kSSS_CipherType_HMAC: |
| case kSSS_CipherType_UserID: |
| break; |
| default: |
| hlseret = HLSE_ERR_API_ERROR; |
| } |
| } |
| if (hlseret == HLSE_SW_OK) { |
| /* Persist to EEPROM */ |
| hlseret = a71ch_saveKeyStore(keyStore); |
| } |
| else { |
| /* Reset the structure based on EEPROM */ |
| a71ch_loadKeyStore(keyStore); |
| } |
| return hlseret; |
| } |
| |
| static HLSE_RET_CODE a71ch_getKey(keyStoreTable_t *keystore_shadow, |
| sss_key_part_t key_part, |
| sss_cipher_type_t cipher_type, |
| uint32_t extId, |
| uint8_t *key, |
| uint32_t *keyByteLen, |
| uint32_t *keyBitLen) |
| { |
| HLSE_RET_CODE resSW = HLSE_ERR_API_ERROR; |
| uint16_t intId = 0; |
| U8 i = 0; |
| HLSE_OBJECT_HANDLE Handles[5]; |
| HLSE_OBJECT_HANDLE GetHandle = 0; |
| U16 HandlesNum = sizeof(Handles) / sizeof(HLSE_OBJECT_HANDLE); |
| U16 HandlesNum_copy; |
| HLSE_ATTRIBUTE attr; |
| U16 keyLen = *keyByteLen; |
| /* clang-format off */ |
| const uint8_t der_header[DER_ECC_NISTP256_HEADER] = { 0x30, 0x59, 0x30, 0x13,0x06, 0x07, 0x2A, 0x86, |
| 0x48, 0xCE, 0x3D, 0x02,0x01, 0x06, 0x08, 0x2A, |
| 0x86, 0x48, 0xCE, 0x3D,0x03, 0x01, 0x07, 0x03, |
| 0x42, 0x00 |
| }; |
| /* clang-format on */ |
| sss_status_t status = ks_common_extId_to_int_index(keystore_shadow, extId, &intId); |
| if (status == kStatus_SSS_Success) { |
| if (key_part == kSSS_KeyPart_Pair && cipher_type == kSSS_CipherType_EC_NIST_P) { |
| if (keyLen < DER_ECC_NISTP256_HEADER + 65 /* NIST256 public key len */) { |
| LOG_E("Buffer size insufficient "); |
| return resSW; |
| } |
| memcpy(key, der_header, DER_ECC_NISTP256_HEADER); |
| resSW = A71_GetPublicKeyEccKeyPair((U8)intId, ADD_DER_ECC_NISTP256_HEADER(key), &keyLen); |
| /* Return the Key length including the ECC DER Header */ |
| keyLen = ADD_DER_ECC_NISTP256_HEADER(keyLen); |
| /* Return the Key length in bits */ |
| *keyByteLen = keyLen; |
| *keyBitLen = 256; |
| } |
| else if (key_part == kSSS_KeyPart_Public && cipher_type == kSSS_CipherType_EC_NIST_P) { |
| if (keyLen < DER_ECC_NISTP256_HEADER + 32 /* NIST256 public key len */) { |
| LOG_E("Buffer size insufficient "); |
| return resSW; |
| } |
| memcpy(key, der_header, DER_ECC_NISTP256_HEADER); |
| resSW = A71_GetEccPublicKey((U8)intId, ADD_DER_ECC_NISTP256_HEADER(key), &keyLen); |
| /* Return the Key length including the ECC DER Header */ |
| keyLen = ADD_DER_ECC_NISTP256_HEADER(keyLen); |
| /* Return the Key length in bits */ |
| *keyByteLen = keyLen; |
| *keyBitLen = 256; |
| } |
| else if (key_part == kSSS_KeyPart_Default && cipher_type == kSSS_CipherType_Binary) { |
| resSW = HLSE_EnumerateObjects(HLSE_CERTIFICATE, Handles, &HandlesNum); |
| if (resSW == HLSE_SW_OK) { |
| HandlesNum_copy = HandlesNum; |
| while (HandlesNum_copy) { |
| if (HLSE_GET_OBJECT_INDEX(Handles[i]) == intId) { |
| GetHandle = Handles[i]; |
| break; |
| } |
| i++; |
| HandlesNum_copy--; |
| } |
| } |
| if (GetHandle != 0) { |
| attr.type = HLSE_ATTR_OBJECT_VALUE; |
| attr.value = key; |
| attr.valueLen = keyLen; |
| resSW = HLSE_GetObjectAttribute(GetHandle, &attr); |
| *keyByteLen = attr.valueLen; |
| *keyBitLen = (attr.valueLen * 8); |
| } |
| } |
| } |
| else { |
| LOG_E("Could not find Ext ID 0x%X in keystore_shadow", extId); |
| } |
| return resSW; |
| } |
| |
| static HLSE_RET_CODE a71ch_setKey(keyStoreTable_t *keystore_shadow, |
| sss_key_part_t key_part, |
| sss_cipher_type_t cipher_type, |
| uint32_t extId, |
| uint8_t *key, |
| size_t keyLen, |
| size_t keyBitLen) |
| { |
| HLSE_RET_CODE resSW = HLSE_ERR_API_ERROR; |
| sss_status_t asn_retval = kStatus_SSS_Fail; |
| uint16_t intId = 0; |
| U8 i = 0; |
| HLSE_OBJECT_HANDLE Handles[5]; |
| HLSE_OBJECT_HANDLE GetHandle = 0; |
| U16 HandlesNum = sizeof(Handles) / sizeof(HLSE_OBJECT_HANDLE); |
| U16 HandlesNum_copy; |
| HLSE_ATTRIBUTE attr; |
| sss_status_t status = ks_common_extId_to_int_index(keystore_shadow, extId, &intId); |
| |
| if (status == kStatus_SSS_Success) { |
| if (key_part == kSSS_KeyPart_Public && cipher_type == kSSS_CipherType_EC_NIST_P) { |
| size_t publicKeyLen = 0; |
| uint16_t publicKeyIndex = 0; |
| const uint8_t *pPublicKey = NULL; |
| if (keyBitLen != 256) { |
| LOG_E("Invalid bit length. Only NIST256 is supported in A71CH"); |
| return resSW; |
| } |
| asn_retval = sss_util_pkcs8_asn1_get_ec_public_key_index(key, keyLen, &publicKeyIndex, &publicKeyLen); |
| if (asn_retval != kStatus_SSS_Success) { |
| LOG_E("error in sss_util_pkcs8_asn1_get_ec_public_key_index"); |
| return resSW; |
| } |
| |
| if (publicKeyLen == 0) { |
| LOG_E("Public key len is 0"); |
| return resSW; |
| } |
| |
| pPublicKey = &key[publicKeyIndex]; |
| resSW = A71_SetEccPublicKey((U8)intId, pPublicKey, (U16)publicKeyLen); |
| } |
| else if (key_part == kSSS_KeyPart_Default && |
| (cipher_type == kSSS_CipherType_AES || cipher_type == kSSS_CipherType_HMAC)) { |
| uint8_t slot_id = intId & 0x0F; |
| uint8_t slot_length = (intId & 0xF0) >> 4; |
| uint8_t j = 0; |
| U16 maxKeyLen = 16; |
| size_t keyLenRem = keyLen; |
| size_t KeyLenToWrite = 0; |
| size_t keyLen_roundoff = ((keyLen / 16) * 16) + ((keyLen % 16) == 0 ? 0 : 16); |
| size_t slots_req = (keyLen_roundoff / 16); |
| |
| if (slot_length != slots_req) { |
| return resSW; |
| } |
| |
| while (j < slot_length) { |
| KeyLenToWrite = (keyLenRem < maxKeyLen) ? keyLenRem : maxKeyLen; |
| if (KeyLenToWrite < maxKeyLen) { |
| uint8_t temp_key[16] = { |
| 0, |
| }; |
| memcpy(temp_key, (key + (j * maxKeyLen)), KeyLenToWrite); |
| resSW = A71_SetSymKey((U8)slot_id, temp_key, (U16)maxKeyLen); |
| } |
| else { |
| resSW = A71_SetSymKey((U8)slot_id, (key + (j * maxKeyLen)), (U16)maxKeyLen); |
| } |
| if (HLSE_SW_OK != resSW) { |
| break; |
| } |
| j++; |
| slot_id++; |
| keyLenRem = keyLenRem - KeyLenToWrite; |
| } |
| } |
| else if (key_part == kSSS_KeyPart_Pair && cipher_type == kSSS_CipherType_EC_NIST_P) { |
| uint8_t *pPrivateKey = NULL; |
| size_t privateKeyLen = 0; |
| uint8_t *pPublicKey = NULL; |
| size_t publicKeyLen = 0; |
| uint16_t privateKeyIndex = 0; |
| uint16_t publicKeyIndex = 0; |
| |
| if (keyBitLen != 256) { |
| LOG_E("Invalid bit length. Only NIST256 is supported in A71CH"); |
| return resSW; |
| } |
| |
| asn_retval = sss_util_pkcs8_asn1_get_ec_pair_key_index( |
| key, keyLen, &publicKeyIndex, &publicKeyLen, &privateKeyIndex, &privateKeyLen); |
| if (asn_retval != kStatus_SSS_Success) { |
| LOG_W("error in sss_util_pkcs8_asn1_get_ec_pair_key_index"); |
| return resSW; |
| } |
| |
| if (privateKeyLen == 0) { |
| LOG_E("private key len is 0"); |
| return resSW; |
| } |
| if (publicKeyLen == 0) { |
| LOG_E("Public key len is 0"); |
| return resSW; |
| } |
| |
| pPrivateKey = &key[privateKeyIndex]; |
| pPublicKey = &key[publicKeyIndex]; |
| |
| resSW = A71_SetEccKeyPair((U8)intId, pPublicKey, (U16)publicKeyLen, pPrivateKey, (U16)privateKeyLen); |
| } |
| else if (key_part == kSSS_KeyPart_Default && cipher_type == kSSS_CipherType_Binary) { |
| resSW = HLSE_EnumerateObjects(HLSE_CERTIFICATE, Handles, &HandlesNum); |
| if (resSW == HLSE_SW_OK) { |
| HandlesNum_copy = HandlesNum; |
| while (HandlesNum_copy) { |
| if (HLSE_GET_OBJECT_INDEX(Handles[i]) == intId) { |
| GetHandle = Handles[i]; |
| break; |
| } |
| i++; |
| HandlesNum_copy--; |
| } |
| } |
| if (GetHandle != 0) { |
| attr.type = HLSE_ATTR_OBJECT_VALUE; |
| attr.value = key; |
| attr.valueLen = (U16)keyLen; |
| resSW = HLSE_SetObjectAttribute(GetHandle, &attr); |
| } |
| } |
| } |
| else { |
| LOG_E("Could not find Ext ID 0x%X in keystore_shadow", extId); |
| } |
| return resSW; |
| } |
| |
| static HLSE_RET_CODE a71ch_eccSign(keyStoreTable_t *keystore_shadow, |
| uint32_t extKeyID, |
| uint8_t *pHash, |
| uint16_t hashLen, |
| uint8_t *pSignature, |
| uint16_t *pSignatureLen) |
| { |
| uint16_t intId = 0; |
| HLSE_RET_CODE resSW = HLSE_ERR_API_ERROR; |
| sss_status_t status = ks_common_extId_to_int_index(keystore_shadow, extKeyID, &intId); |
| /* A71CH Max hashlen is AX_SHA256_LEN*/ |
| if (hashLen != AX_SHA256_LEN) { |
| LOG_E("Only SHA256(input) is supported "); |
| return resSW; |
| } |
| if (status == kStatus_SSS_Success) { |
| resSW = A71_EccSign((SST_Index_t)intId, pHash, hashLen, pSignature, pSignatureLen); |
| } |
| return resSW; |
| } |
| |
| static HLSE_RET_CODE a71ch_eccVerify(keyStoreTable_t *keystore_shadow, |
| uint32_t extKeyID, |
| uint8_t *pHash, |
| uint16_t hashLen, |
| uint8_t *pSignature, |
| uint16_t SignatureLen) |
| { |
| uint16_t intId = 0; |
| uint8_t result = 0; |
| HLSE_RET_CODE resSW = HLSE_ERR_API_ERROR; |
| sss_status_t status = ks_common_extId_to_int_index(keystore_shadow, extKeyID, &intId); |
| if (status == kStatus_SSS_Success) { |
| resSW = A71_EccVerify((SST_Index_t)intId, pHash, hashLen, pSignature, SignatureLen, &result); |
| } |
| if (resSW == SW_OK) |
| if (result == 0) |
| resSW = ERR_GENERAL_ERROR; |
| |
| return resSW; |
| } |
| |
| #endif /* SSS_HAVE_A71CH */ |
