Fix secret pwd passing in TZ backend KBKDF

[platform/core/security/key-manager.git] / src / manager / crypto / tz-backend / tz-context.cpp

diff --git a/src/manager/crypto/tz-backend/tz-context.cpp b/src/manager/crypto/tz-backend/tz-context.cpp
index bf603c9..ad09c65 100644 (file)
--- a/src/manager/crypto/tz-backend/tz-context.cpp
+++ b/src/manager/crypto/tz-backend/tz-context.cpp
@@ -50,6 +50,9 @@ namespace {
 // whatever TA will return us.
 const uint32_t CIPHER_EXTRA_PADDING_SIZE = 16;
 
+// Maximum size of GCM tag in bytes.
+const size_t MAX_GCM_TAG_SIZE = 16;
+
 // Identifier of our TA
 const TEEC_UUID KEY_MANAGER_TA_UUID = KM_TA_UUID;
 
@@ -66,7 +69,8 @@ static std::string rawToHexString(const RawBuffer &raw)
 const std::unordered_map<tz_algo_type, size_t> MAX_KEY_SIZE = {
        { ALGO_RSA, 4096 / 8 },
        { ALGO_RSA_SV, 4096 / 8 },
-       { ALGO_DSA_SV, 4096 / 8 }
+       { ALGO_DSA_SV, 4096 / 8 },
+       { ALGO_ECDSA_SV, 1024 / 8 } // 384*2 + additional space for DERR encoding
 };
 
 struct EncPwd {
@@ -476,6 +480,91 @@ void TrustZoneContext::executeDecryptAE(const RawBuffer &keyId,
        sOut.Pull(out);
 }
 
+uint32_t TrustZoneContext::initGcmCipher(uint32_t encrypt,
+                                                                                const RawBuffer &keyId,
+                                                                                const Pwd &pwd,
+                                                                                const RawBuffer &iv,
+                                                                                int tagSizeBits,
+                                                                                const RawBuffer &aad)
+{
+       // command ID = CMD_CIPHER_INIT (from km_ta_defines.h)
+       if (keyId.size() != KM_KEY_ID_SIZE) {
+               ThrowErr(Exc::Crypto::InternalError, "TZ Backend received incorrect key buffer");
+       }
+
+       auto sIn = makeSerializer(pwd, iv, keyId, aad, tagSizeBits);
+       TrustZoneMemory inMemory(m_Context, sIn.GetSize(), TEEC_MEM_INPUT);
+       sIn.Serialize(inMemory);
+
+       TEEC_Operation op = makeOp(TEEC_VALUE_INOUT, inMemory);
+       op.params[0].value.a = ALGO_AES_GCM;
+       op.params[0].value.b = encrypt;
+
+       Execute(CMD_CIPHER_INIT, &op);
+
+       return op.params[0].value.b;
+}
+
+void TrustZoneContext::addGcmAAD(uint32_t opId,
+                                                                const RawBuffer &aad)
+{
+       // command ID = CMD_CIPHER_INIT_AAD (from km_ta_defines.h)
+       auto sIn = makeSerializer(aad);
+       TrustZoneMemory inMemory(m_Context, sIn.GetSize(), TEEC_MEM_INPUT);
+       sIn.Serialize(inMemory);
+
+       TEEC_Operation op = makeOp(TEEC_VALUE_INOUT, inMemory);
+       op.params[0].value.a = opId;
+
+       Execute(CMD_CIPHER_INIT_AAD, &op);
+}
+
+RawBuffer TrustZoneContext::updateGcmCipher(uint32_t opId,
+                                                                                       const RawBuffer &data)
+{
+       auto sIn = makeSerializer(data);
+       TrustZoneMemory inMemory(m_Context, sIn.GetSize(), TEEC_MEM_INPUT);
+       sIn.Serialize(inMemory);
+
+       TZSerializer sOut;
+       sOut.Push(new TZSerializableBinary(data.size()));
+       TrustZoneMemory outMemory(m_Context, sOut.GetSize(), TEEC_MEM_OUTPUT);
+
+       TEEC_Operation op = makeOp(TEEC_VALUE_INOUT, inMemory, outMemory);
+       op.params[0].value.a = opId;
+
+       Execute(CMD_CIPHER_UPDATE, &op);
+
+       sOut.Deserialize(outMemory);
+
+       RawBuffer out;
+       sOut.Pull(out);
+       return out;
+}
+
+RawBuffer TrustZoneContext::finalizeGcmCipher(uint32_t opId,
+                                                                                         const RawBuffer &data)
+{
+       auto sIn = makeSerializer(data);
+       TrustZoneMemory inMemory(m_Context, sIn.GetSize(), TEEC_MEM_INPUT);
+       sIn.Serialize(inMemory);
+
+       TZSerializer sOut;
+       sOut.Push(new TZSerializableBinary(MAX_GCM_TAG_SIZE, false));
+       TrustZoneMemory outMemory(m_Context, sOut.GetSize(), TEEC_MEM_OUTPUT);
+
+       TEEC_Operation op = makeOp(TEEC_VALUE_INOUT, inMemory, outMemory);
+       op.params[0].value.a = opId;
+
+       Execute(CMD_CIPHER_FINALIZE, &op);
+
+       sOut.Deserialize(outMemory);
+
+       RawBuffer out;
+       sOut.Pull(out);
+       return out;
+}
+
 void TrustZoneContext::executeSign(tz_algo_type algo,
                                                                tz_hash_type hash,
                                                                const RawBuffer &keyId,
@@ -599,7 +688,7 @@ void TrustZoneContext::importData(
        LogDebug("Imported object ID is (hex): " << rawToHexString(hash));
 }
 
-void TrustZoneContext::importWrappedKey(const RawBuffer &wrappingKey,
+void TrustZoneContext::importWrappedKey(const RawBuffer &wrappingKeyId,
                                                                                const Pwd &wrappingKeyPwd,
                                                                                tz_algo_type algo,
                                                                                const RawBuffer &iv,
@@ -615,7 +704,7 @@ void TrustZoneContext::importWrappedKey(const RawBuffer &wrappingKey,
        // command ID = CMD_IMPORT_WRAPPED_KEY
        LogDebug("TrustZoneContext::importWrappedKey encryptedKey size = [" << encryptedKey.size() << "]");
 
-       auto sIn = makeSerializer(wrappingKey,
+       auto sIn = makeSerializer(wrappingKeyId,
                                                          wrappingKeyPwd,
                                                          algo,
                                                          iv,
@@ -650,7 +739,7 @@ void TrustZoneContext::importWrappedKey(const RawBuffer &wrappingKey,
        LogDebug("Imported object ID is (hex): " << rawToHexString(encryptedKeyId));
 }
 
-RawBuffer TrustZoneContext::exportWrappedKey(const RawBuffer &wrappingKey,
+RawBuffer TrustZoneContext::exportWrappedKey(const RawBuffer &wrappingKeyId,
                                                                                         const Pwd &wrappingKeyPwd,
                                                                                         tz_algo_type algo,
                                                                                         const RawBuffer &iv,
@@ -662,7 +751,7 @@ RawBuffer TrustZoneContext::exportWrappedKey(const RawBuffer &wrappingKey,
        // command ID = CMD_EXPORT_WRAPPED_KEY
        LogDebug("TrustZoneContext::exportWrappedKey");
 
-       auto sIn = makeSerializer(wrappingKey,
+       auto sIn = makeSerializer(wrappingKeyId,
                                                          wrappingKeyPwd,
                                                          algo,
                                                          iv,
@@ -800,7 +889,11 @@ void TrustZoneContext::executeEcdh(const RawBuffer &prvKeyId,
        LogDebug("Derived object ID is (hex): " << rawToHexString(secretHash));
 }
 
-void TrustZoneContext::executeKbkdf(const RawBuffer& secret,
+void TrustZoneContext::executeKbkdf(const RawBuffer& secretId,
+                                                                       const Pwd& secretPwd,
+                                                                       const RawBuffer& label,
+                                                                       const RawBuffer& context,
+                                                                       const RawBuffer& fixed,
                                                                        tz_prf prf,
                                                                        tz_kbkdf_mode mode,
                                                                        tz_kbkdf_ctr_loc location,
@@ -815,8 +908,19 @@ void TrustZoneContext::executeKbkdf(const RawBuffer& secret,
        // command ID = CMD_DERIVE
        LogDebug("TrustZoneContext::executeKbkdf");
 
-       auto sIn = makeSerializer(
-               secret, prf, mode, location, rlen, llen, noSeparator, EncPwd{keyPwdBuf, keyPwdIV}, keyHash);
+       auto sIn = makeSerializer(secretId,
+                                                         secretPwd,
+                                                         label,
+                                                         context,
+                                                         fixed,
+                                                         prf,
+                                                         mode,
+                                                         location,
+                                                         rlen,
+                                                         llen,
+                                                         noSeparator,
+                                                         EncPwd{keyPwdBuf, keyPwdIV}, keyHash);
+
        TrustZoneMemory inMemory(m_Context, sIn.GetSize(), TEEC_MEM_INPUT);
        sIn.Serialize(inMemory);