* See the License for the specific language governing permissions and
* limitations under the License
*/
-/*
- * @file internals.cpp
- * @author isaac2.lee (isaac2.lee@samsung.com)
- * @version 1.0
- */
#include <functional>
#include <unistd.h>
#include <generic-backend/exception.h>
-#include <generic-backend/algo-validation.h>
-#include <generic-backend/crypto-params.h>
#include <dpl/log/log.h>
#include <ckm/ckm-type.h>
+#include <hal/hal-security-keys.h>
#include <se-backend/internals.h>
-#include <key-manager-se-backend.h>
-#include <key-provider.h>
-#ifndef UNUSED_PARAMETER
-#define UNUSED_PARAMETER(x) (void)(x)
-#endif
+struct data_free_deleter {
+ void operator()(hal_security_keys_data_s* p) const {
+ if (p->buffer)
+ free(p->buffer);
+ delete p;
+ }
+};
-namespace CKM {
-namespace Crypto {
-namespace SE {
-namespace Internals {
+class security_keys_data_ptr {
+public:
+ security_keys_data_ptr() : data(new hal_security_keys_data_s{nullptr, 0}) {}
-RawBuffer toRawBuffer(unsigned char* buf, uint32_t buf_len)
-{
- RawBuffer output;
- output.assign(buf, buf + buf_len);
- return output;
-}
+ hal_security_keys_data_s* Get() {
+ return data.get();
+ }
-kmsb_hash_algo_e getHashType(const CryptoAlgorithm &alg)
-{
- HashAlgorithm hash = unpack<HashAlgorithm>(alg, ParamName::SV_HASH_ALGO);
- switch (hash)
- {
- case HashAlgorithm::SHA1:
- return KMSB_HASH_SHA1;
- case HashAlgorithm::SHA256:
- return KMSB_HASH_SHA256;
- case HashAlgorithm::SHA384:
- return KMSB_HASH_SHA384;
- case HashAlgorithm::SHA512:
- return KMSB_HASH_SHA512;
- default:
- break;
+ unsigned char* GetBuffer() {
+ return data->buffer;
}
- return KMSB_HASH_SHA256;
-}
-kmsb_ec_type_e getEcType(const ElipticCurve ecType)
-{
- if (ecType == ElipticCurve::prime192v1)
- return KMSB_EC_PRIME192V1;
- else if (ecType == ElipticCurve::prime256v1)
- return KMSB_EC_PRIME256V1;
- else if (ecType == ElipticCurve::secp384r1)
- return KMSB_EC_SECP384R1;
- return KMSB_EC_PRIME256V1;
-}
+ size_t GetLength() {
+ return data->length;
+ }
+
+private:
+ std::unique_ptr<hal_security_keys_data_s, data_free_deleter> data;
+};
-int kmsb_failure_retry(std::function<int()> func)
+namespace CKM {
+namespace Crypto {
+namespace SE {
+namespace Internals {
+
+int retry_on_failure(std::function<int()> func)
{
- int result = KMSB_ERROR_NONE;
+ int result = HAL_SECURITY_KEYS_ERROR_NONE;
for (size_t attempt = 0; attempt < 3; ++attempt) {
result = func();
- if (result == KMSB_ERROR_NONE || result == KMSB_ERROR_NO_KEY)
+ if (result == HAL_SECURITY_KEYS_ERROR_NONE || result == HAL_SECURITY_KEYS_ERROR_NO_KEY)
break;
- LogError("occured err inside SE(errcode:" << result << ")");
+ LogError("SE backend error: " << result);
usleep(100000);
}
return result;
}
-void generateSKey(const CryptoAlgorithm &alg,
- const uint32_t key_idx)
+void generateSKey(const CryptoAlgorithm&,
+ const uint32_t)
{
- UNUSED_PARAMETER(alg);
- UNUSED_PARAMETER(key_idx);
-
- ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend not supported");
+ ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend does not support symmetric key generation");
}
-void generateAKey(const CryptoAlgorithm &alg,
- const uint32_t key_idx)
+void generateAKey(const CryptoAlgorithm&,
+ const uint32_t)
{
- UNUSED_PARAMETER(alg);
- UNUSED_PARAMETER(key_idx);
-
- ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend not supported");
+ ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend does not support asymmetric key generation");
}
-/// @brief encrypt key data using SE api for DB metadata
-/// @param key: target data for encryption
-/// @param key_len: target data length
-/// @param iv: iv data
-/// @param iv_len: iv data length
-/// @return Rawbuffer encrypted output
-RawBuffer encryptWithDbpKey(const unsigned char* key, const uint32_t key_len,
- const unsigned char* iv, const uint32_t iv_len)
+RawBuffer encryptWithDbpKey(const unsigned char* key,
+ const uint32_t key_len,
+ const unsigned char* iv,
+ const uint32_t iv_len)
{
- unsigned char* output_data = NULL;
- uint32_t output_len = 0;
LogDebug("DBP Key will be encrypted on SE backend");
- int ret = kmsb_failure_retry(std::bind(kmsb_encrypt_with_dbp_key,
- SE_BACKEND_DBP_SCHEME_VERSION,
- key, key_len,
- iv, iv_len,
- &output_data, &output_len));
- if (ret == KMSB_ERROR_NO_KEY) {
- ret = kmsb_failure_retry(std::bind(kmsb_generate_dbp_key,
- false));
- if (ret != KMSB_ERROR_NONE) {
+ hal_security_keys_data_s hal_data = {const_cast<unsigned char*>(key), key_len};
+ hal_security_keys_data_s hal_iv = {const_cast<unsigned char*>(iv), iv_len};
+ security_keys_data_ptr hal_out;
+ int ret = retry_on_failure(std::bind(hal_security_keys_encrypt_data_dbp,
+ HAL_SECURITY_KEYS_DBP_SCHEME_VERSION_1,
+ hal_data,
+ hal_iv,
+ hal_out.Get()));
+
+ if (ret == HAL_SECURITY_KEYS_ERROR_NO_KEY) {
+ ret = retry_on_failure(std::bind(hal_security_keys_create_key_dbp, false));
+ if (ret != HAL_SECURITY_KEYS_ERROR_NONE) {
LogError("Generate Key: SE Internal error: " << ret);
ThrowErr(Exc::Crypto::InternalError, "Generate Key: SE Internal error");
}
- ret = kmsb_failure_retry(std::bind(kmsb_encrypt_with_dbp_key,
- SE_BACKEND_DBP_SCHEME_VERSION,
- key, key_len,
- iv, iv_len,
- &output_data, &output_len));
+
+ ret = retry_on_failure(std::bind(hal_security_keys_encrypt_data_dbp,
+ HAL_SECURITY_KEYS_DBP_SCHEME_VERSION_1,
+ hal_data,
+ hal_iv,
+ hal_out.Get()));
}
- if (ret != KMSB_ERROR_NONE) {
+
+ if (ret != HAL_SECURITY_KEYS_ERROR_NONE) {
LogError("Encrypt Key: SE Internal error: " << ret);
ThrowErr(Exc::Crypto::InternalError, "Encrypt key: SE Internal error");
}
- return toRawBuffer(output_data, output_len);
-}
-
-RawBuffer halAES(const uint32_t key_idx,
- const CryptoAlgorithm &alg,
- RawBuffer &data,
- const bool isEncrypt)
-{
- UNUSED_PARAMETER(key_idx);
- UNUSED_PARAMETER(alg);
- UNUSED_PARAMETER(data);
- UNUSED_PARAMETER(isEncrypt);
- ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend not supported AES yet");
+ return RawBuffer(hal_out.GetBuffer(), hal_out.GetBuffer() + hal_out.GetLength());
}
-RawBuffer symmetricEncrypt(const uint32_t key_idx,
- const CryptoAlgorithm &alg,
- RawBuffer &data)
+RawBuffer symmetricEncrypt(const uint32_t,
+ const CryptoAlgorithm&,
+ RawBuffer&)
{
- return halAES(key_idx, alg, data, true);
+ ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend does not support AES");
}
-RawBuffer symmetricDecrypt(const uint32_t key_idx,
- const CryptoAlgorithm &alg,
- RawBuffer &data)
+RawBuffer symmetricDecrypt(const uint32_t,
+ const CryptoAlgorithm&,
+ RawBuffer&)
{
- return halAES(key_idx, alg, data, false);
+ ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend does not support AES");
}
-RawBuffer asymmetricEncrypt(const uint32_t key_idx,
- const CryptoAlgorithm &alg,
- RawBuffer &data)
+RawBuffer asymmetricEncrypt(const uint32_t,
+ const CryptoAlgorithm&,
+ RawBuffer&)
{
- UNUSED_PARAMETER(key_idx);
- UNUSED_PARAMETER(alg);
- UNUSED_PARAMETER(data);
-
- ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend not supported RSA");
+ ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend does not support RSA");
}
-RawBuffer asymmetricDecrypt(const uint32_t key_idx,
- const CryptoAlgorithm &alg,
- RawBuffer &data)
+RawBuffer asymmetricDecrypt(const uint32_t,
+ const CryptoAlgorithm&,
+ RawBuffer&)
{
- UNUSED_PARAMETER(key_idx);
- UNUSED_PARAMETER(alg);
- UNUSED_PARAMETER(data);
-
- ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend not supported RSA");
+ ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend does not support RSA");
}
-RawBuffer sign(const uint32_t key_idx,
- const CryptoAlgorithm &alg,
- RawBuffer &message)
+RawBuffer sign(const uint32_t,
+ const CryptoAlgorithm&,
+ RawBuffer&)
{
- UNUSED_PARAMETER(key_idx);
- UNUSED_PARAMETER(alg);
- UNUSED_PARAMETER(message);
-
- ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend not supported signing yet");
+ ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend does not support signing");
}
-int verify(const uint32_t key_idx,
- const CryptoAlgorithm &alg,
- RawBuffer &hash,
- RawBuffer &signature)
+int verify(const uint32_t,
+ const CryptoAlgorithm&,
+ RawBuffer&,
+ RawBuffer&)
{
- UNUSED_PARAMETER(key_idx);
- UNUSED_PARAMETER(alg);
- UNUSED_PARAMETER(hash);
- UNUSED_PARAMETER(signature);
-
- ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend not supported verifying yet");
+ ThrowErr(Exc::Crypto::OperationNotSupported, "SE Backend does not support verifying");
}
} // namespace Internals
projects / platform / core / security / key-manager.git / commitdiff