Concatenated wrapping tz-backend implementation

Change-Id: I4e524f72b5cbc011c503f74172615e87e03fab18

diff --git a/src/manager/crypto/tz-backend/internals.cpp b/src/manager/crypto/tz-backend/internals.cpp
index c93054477c6d733131fcfe24551c9aef8b7809fb..d356570ec77fa346c3a9d163a7379df359fa6626 100644 (file)
--- a/src/manager/crypto/tz-backend/internals.cpp
+++ b/src/manager/crypto/tz-backend/internals.cpp
@@ -435,6 +435,55 @@ RawBuffer exportWrappedKey(const RawBuffer &wrappingKeyId,
 
 }
 
+RawBuffer wrapConcatenatedData(const RawBuffer &wrappingKeyId,
+                                                          const Pwd &wrappingKeyPwd,
+                                                          const CryptoAlgorithm &alg,
+                                                          const RawBuffer &keyToWrapId,
+                                                          const Pwd &keyToWrapPwd,
+                                                          const RawBuffer &userData)
+{
+       AlgoType algo = unpack<AlgoType>(alg, ParamName::ALGO_TYPE);
+       HashAlgorithm oaepHash = HashAlgorithm::SHA1;
+       alg.getParam(ParamName::ED_OAEP_HASH, oaepHash);
+
+       return TrustZoneContext::Instance().wrapConcatenatedData(wrappingKeyId,
+                                                                                                                        wrappingKeyPwd,
+                                                                                                                        getAlgType(algo),
+                                                                                                                        getHashType(oaepHash),
+                                                                                                                        keyToWrapId,
+                                                                                                                        keyToWrapPwd,
+                                                                                                                        userData);
+}
+
+RawBuffer unwrapConcatenatedData(const RawBuffer &wrappingKeyId,
+                                                                const Pwd &wrappingKeyPwd,
+                                                                const CryptoAlgorithm &alg,
+                                                                const Data &encryptedKey,
+                                                                const Password &encryptedKeyPassword,
+                                                                const RawBuffer &encryptedKeyIV,
+                                                                RawBuffer &encryptedKeyTag,
+                                                                const RawBuffer &encryptedKeyId,
+                                                                size_t keySize)
+{
+       RawBuffer encryptedKeyPwdBuf(encryptedKeyPassword.begin(), encryptedKeyPassword.end());
+
+       AlgoType algo = unpack<AlgoType>(alg, ParamName::ALGO_TYPE);
+       HashAlgorithm oaepHash = HashAlgorithm::SHA1;
+       alg.getParam(ParamName::ED_OAEP_HASH, oaepHash);
+
+       return TrustZoneContext::Instance().unwrapConcatenatedData(wrappingKeyId,
+                                                                                                                          wrappingKeyPwd,
+                                                                                                                          getAlgType(algo),
+                                                                                                                          getHashType(oaepHash),
+                                                                                                                          toTzDataType(encryptedKey.type),
+                                                                                                                          encryptedKey.data,
+                                                                                                                          encryptedKeyPwdBuf,
+                                                                                                                          encryptedKeyIV,
+                                                                                                                          encryptedKeyTag,
+                                                                                                                          encryptedKeyId,
+                                                                                                                          keySize);
+}
+
 RawBuffer getData(const RawBuffer &dataId,
                                  const Pwd &pwd,
                                  const DataType &type)

diff --git a/src/manager/crypto/tz-backend/internals.h b/src/manager/crypto/tz-backend/internals.h
index ad267ffa371ca906bde884836990b7bee9695083..14a79869fdaab7048b0939f7467353ed8f326624 100644 (file)
--- a/src/manager/crypto/tz-backend/internals.h
+++ b/src/manager/crypto/tz-backend/internals.h
@@ -78,6 +78,23 @@ RawBuffer exportWrappedKey(const RawBuffer &wrappingKeyId,
                                                   const Pwd &keyToWrapPwd,
                                                   const DataType &keyToWrapType);
 
+RawBuffer wrapConcatenatedData(const RawBuffer &wrappingKeyId,
+                                                          const Pwd &wrappingKeyPwd,
+                                                          const CryptoAlgorithm &alg,
+                                                          const RawBuffer &keyToWrapId,
+                                                          const Pwd &keyToWrapPwd,
+                                                          const RawBuffer &userData);
+
+RawBuffer unwrapConcatenatedData(const RawBuffer &wrappingKeyId,
+                                                                const Pwd &wrappingKeyPwd,
+                                                                const CryptoAlgorithm &alg,
+                                                                const Data &encryptedKey,
+                                                                const Password &encryptedKeyPassword,
+                                                                const RawBuffer &encryptedKeyIV,
+                                                                RawBuffer &encryptedKeyTag,
+                                                                const RawBuffer &encryptedKeyId,
+                                                                size_t keySize);
+
 RawBuffer getData(const RawBuffer &dataId,
                                  const Pwd &pwd,
                                  const DataType &type);

diff --git a/src/manager/crypto/tz-backend/obj.cpp b/src/manager/crypto/tz-backend/obj.cpp
index a1fbbb7ae988fca522c0b75ab8e5b35bec26f45a..b45ca747ef4d1fc82d528f8e4c9159d443fc1341 100644 (file)
--- a/src/manager/crypto/tz-backend/obj.cpp
+++ b/src/manager/crypto/tz-backend/obj.cpp
@@ -209,6 +209,61 @@ int AKey::verify(const CryptoAlgorithm &alg, const RawBuffer &message,
        return Internals::verify(getId(), getPassword(), algWithType, message, sign);
 }
 
+RawBuffer AKey::wrapConcatenated(const CryptoAlgorithm &params,
+                                                               const Token &keyToWrap,
+                                                               const Password &keyToWrapPass,
+                                                               const RawBuffer &userData)
+{
+       int keyToWrapScheme;
+       RawBuffer keyToWrapId;
+       RawBuffer keyToWrapIV;
+       RawBuffer keyToWrapTag;
+       Store::unpack(keyToWrap.data,
+                                 keyToWrapPass,
+                                 keyToWrapScheme,
+                                 keyToWrapId,
+                                 keyToWrapIV,
+                                 keyToWrapTag);
+
+       return Internals::wrapConcatenatedData(getId(),
+                                                                                  getPassword(),
+                                                                                  params,
+                                                                                  keyToWrapId,
+                                                                                  Pwd(keyToWrapPass, keyToWrapIV, keyToWrapTag),
+                                                                                  userData);
+}
+
+std::tuple<Token, RawBuffer> AKey::unwrapConcatenated(const CryptoAlgorithm &params,
+                                                                                                        const Data &encryptedKey,
+                                                                                                        const Password &pass,
+                                                                                                        size_t keySize,
+                                                                                                        const RawBuffer &hash)
+{
+
+       if (!encryptedKey.type.isSymmetricKey())
+               ThrowErr(Exc::Crypto::DataTypeNotSupported, "Invalid data provided for unwrap");
+
+       RawBuffer passIV;
+       RawBuffer tag;
+
+       if (!pass.empty()) {
+               // IV is needed for data encryption with pwd
+               passIV = Internals::generateIV();
+       }
+
+       RawBuffer data = Internals::unwrapConcatenatedData(getId(),
+                                                                                                          getPassword(),
+                                                                                                          params,
+                                                                                                          encryptedKey,
+                                                                                                          pass,
+                                                                                                          passIV,
+                                                                                                          tag,
+                                                                                                          hash,
+                                                                                                          keySize);
+
+       return std::make_tuple(Token(backendId(), encryptedKey.type, Store::pack(hash, pass, passIV, tag)), data);
+}
+
 Token Cert::unwrap(const CryptoAlgorithm &,
                                   const Data &,
                                   const Password &,
@@ -224,6 +279,23 @@ RawBuffer Cert::wrap(const CryptoAlgorithm &,
        ThrowErr(Exc::Crypto::OperationNotSupported);
 }
 
+RawBuffer Cert::wrapConcatenated(const CryptoAlgorithm &,
+                                                                const Token &,
+                                                                const Password &,
+                                                                const RawBuffer &)
+{
+       ThrowErr(Exc::Crypto::OperationNotSupported);
+}
+
+std::tuple<Token, RawBuffer> Cert::unwrapConcatenated(const CryptoAlgorithm &,
+                                                                                                         const Data &,
+                                                                                                         const Password &,
+                                                                                                         size_t,
+                                                                                                         const RawBuffer &)
+{
+       ThrowErr(Exc::Crypto::OperationNotSupported);
+}
+
 } // namespace TZ
 } // namespace Crypto
 } // namespace CKM

diff --git a/src/manager/crypto/tz-backend/obj.h b/src/manager/crypto/tz-backend/obj.h
index 3d406bec1ad40a8e627e4be7646d04ee2dc3bc50..70488e03eeb24ca817373764ebd587276b30b7f0 100644 (file)
--- a/src/manager/crypto/tz-backend/obj.h
+++ b/src/manager/crypto/tz-backend/obj.h
@@ -141,6 +141,17 @@ public:
        RawBuffer decrypt(const CryptoAlgorithm &, const RawBuffer &) override;
        Token derive(const CryptoAlgorithm &, const Password &, const RawBuffer &) override;
        GCtxShPtr initContext(const CryptoAlgorithm &, bool) override;
+
+       RawBuffer wrapConcatenated(const CryptoAlgorithm &params,
+                                                          const Token &keyToWrap,
+                                                          const Password &keyToWrapPass,
+                                                          const RawBuffer &userData) override;
+
+       std::tuple<Token, RawBuffer> unwrapConcatenated(const CryptoAlgorithm &params,
+                                                                                                       const Data &encryptedKey,
+                                                                                                       const Password &pass,
+                                                                                                       size_t keySize,
+                                                                                                       const RawBuffer &hash) override;
 };
 
 class Cert : public AKey {
@@ -156,6 +167,17 @@ public:
        RawBuffer wrap(const CryptoAlgorithm &params,
                                   const Token &keyToWrap,
                                   const Password &keyToWrapPass) override;
+
+       RawBuffer wrapConcatenated(const CryptoAlgorithm &,
+                                                          const Token &,
+                                                          const Password &,
+                                                          const RawBuffer &) override;
+
+       std::tuple<Token, RawBuffer> unwrapConcatenated(const CryptoAlgorithm &,
+                                                                                                       const Data &,
+                                                                                                       const Password &,
+                                                                                                       size_t,
+                                                                                                       const RawBuffer &) override;
 };
 
 } // namespace TZ

diff --git a/src/manager/crypto/tz-backend/tz-context.cpp b/src/manager/crypto/tz-backend/tz-context.cpp
index fd83d98e0e8f9385a87adba4f8615832e82f4a98..b581d87c730c27c969e1f8418b59365b9f714cbf 100644 (file)
--- a/src/manager/crypto/tz-backend/tz-context.cpp
+++ b/src/manager/crypto/tz-backend/tz-context.cpp
@@ -826,6 +826,103 @@ RawBuffer TrustZoneContext::exportWrappedKey(const RawBuffer &wrappingKeyId,
        return wrappedKey;
 }
 
+RawBuffer TrustZoneContext::wrapConcatenatedData(const RawBuffer &wrappingKeyId,
+                                                                                                const Pwd &wrappingKeyPwd,
+                                                                                                tz_algo_type algo,
+                                                                                                tz_hash_type oaepHash,
+                                                                                                const RawBuffer &keyToWrapId,
+                                                                                                const Pwd &keyToWrapPwd,
+                                                                                                const RawBuffer &userData)
+{
+       // command ID = CMD_WRAP_CONCATENATED_DATA
+       LogDebug("TrustZoneContext::wrapConcatenatedData");
+
+       if (algo != ALGO_RSA) {
+               ThrowErr(Exc::Crypto::InputParam, "Only RSA is supported in wrapConcatenatedData");
+       }
+
+       TZSerializer sIn = makeSerializer(wrappingKeyId,
+                                                        wrappingKeyPwd,
+                                                        algo,
+                                                        oaepHash,
+                                                        keyToWrapId,
+                                                        keyToWrapPwd,
+                                                        userData);
+
+       TrustZoneMemory inMemory(m_Context, sIn.GetSize(), TEEC_MEM_INPUT);
+       sIn.Serialize(inMemory);
+
+       uint32_t outMemorySize = KM_RSA_BLOCK_SIZE;
+       TZSerializer sOut;
+       sOut.Push(new TZSerializableBinary(outMemorySize, false));
+       TrustZoneMemory outMemory(m_Context, sOut.GetSize(), TEEC_MEM_OUTPUT);
+       sOut.Serialize(outMemory);
+
+       TEEC_Operation op = makeOp(TEEC_VALUE_INOUT, inMemory, outMemory);
+       Execute(CMD_WRAP_CONCATENATED_DATA, &op);
+       sOut.Deserialize(outMemory);
+
+       RawBuffer wrappedKey;
+       sOut.Pull(wrappedKey);
+
+       return wrappedKey;
+}
+
+RawBuffer TrustZoneContext::unwrapConcatenatedData(const RawBuffer &wrappingKeyId,
+                                                                                                  const Pwd &wrappingKeyPwd,
+                                                                                                  tz_algo_type algo,
+                                                                                                  tz_hash_type oaepHash,
+                                                                                                  const tz_data_type encryptedKeyType,
+                                                                                                  const RawBuffer &encryptedKey,
+                                                                                                  const RawBuffer &encryptedKeyPwdBuf,
+                                                                                                  const RawBuffer &encryptedKeyIV,
+                                                                                                  RawBuffer &encryptedKeyTag,
+                                                                                                  const RawBuffer &encryptedKeyId,
+                                                                                                  size_t keySize)
+{
+       // command ID = CMD_UNWRAP_CONCATENATED_DATA
+       LogDebug("TrustZoneContext::unwrapConcatenatedData");
+
+       if (algo != ALGO_RSA) {
+               ThrowErr(Exc::Crypto::InputParam, "Only RSA is supported in wrapConcatenatedData");
+       }
+
+       TZSerializer sIn = makeSerializer(wrappingKeyId,
+                                                        wrappingKeyPwd,
+                                                        algo,
+                                                        oaepHash,
+                                                        encryptedKeyType,
+                                                        encryptedKey,
+                                                        EncPwd{encryptedKeyPwdBuf, encryptedKeyIV},
+                                                        encryptedKeyId,
+                                                        keySize);
+
+       TrustZoneMemory inMemory(m_Context, sIn.GetSize(), TEEC_MEM_INPUT);
+       sIn.Serialize(inMemory);
+
+       TZSerializer sOut;
+       uint32_t outMemorySize = KM_RSA_BLOCK_SIZE;
+       if (!encryptedKeyPwdBuf.empty()) {
+               outMemorySize += Params::DEFAULT_AES_GCM_TAG_LEN_BYTES;
+       }
+       sOut.Push(new TZSerializableBinary(outMemorySize, false));
+       TrustZoneMemory outMemory(m_Context, sOut.GetSize(), TEEC_MEM_OUTPUT);
+       sOut.Serialize(outMemory);
+
+       TEEC_Operation op = makeOp(TEEC_VALUE_INOUT, inMemory, outMemory);
+       Execute(CMD_UNWRAP_CONCATENATED_DATA, &op);
+
+       sOut.Deserialize(outMemory);
+
+       RawBuffer userData;
+       sOut.Pull(userData);
+       if (!encryptedKeyPwdBuf.empty()) {
+               sOut.Pull(encryptedKeyTag);
+       }
+
+       return userData;
+}
+
 void TrustZoneContext::GetDataSize(const RawBuffer &dataId,
                                                                   const Pwd &pwd,
                                                                   const tz_data_type type,

diff --git a/src/manager/crypto/tz-backend/tz-context.h b/src/manager/crypto/tz-backend/tz-context.h
index 83d7650c63b9a640a4a6bce1058610642b9a1e55..0b16a8822258165e9a3e338b772b0bbcb12c08dd 100644 (file)
--- a/src/manager/crypto/tz-backend/tz-context.h
+++ b/src/manager/crypto/tz-backend/tz-context.h
@@ -114,6 +114,26 @@ public:
                                                           const Pwd &keyToWrapPwd,
                                                           tz_data_type keyToWrapType);
 
+       RawBuffer wrapConcatenatedData(const RawBuffer &wrappingKeyId,
+                                                                  const Pwd &wrappingKeyPwd,
+                                                                  tz_algo_type algo,
+                                                                  tz_hash_type oaepHash,
+                                                                  const RawBuffer &keyToWrapId,
+                                                                  const Pwd &keyToWrapPwd,
+                                                                  const RawBuffer &userData);
+
+       RawBuffer unwrapConcatenatedData(const RawBuffer &wrappingKeyId,
+                                                                        const Pwd &wrappingKeyPwd,
+                                                                        tz_algo_type algo,
+                                                                        tz_hash_type oaepHash,
+                                                                        const tz_data_type encryptedKeyType,
+                                                                        const RawBuffer &encryptedKey,
+                                                                        const RawBuffer &encryptedKeyPwdBuf,
+                                                                        const RawBuffer &encryptedKeyIV,
+                                                                        RawBuffer &encryptedKeyTag,
+                                                                        const RawBuffer &encryptedKeyId,
+                                                                        size_t keySize);
+
        void executeCrypt(tz_command cmd,
                                        tz_algo_type algo,
                                        tz_hash_type hash,