Skip to content

Commit

Permalink
Feature/hsm safe exit (#8290)
Browse files Browse the repository at this point in the history 
* exit with cleanup when needed

* error code required

* restyled

* return right
  • Loading branch information
@Jagadish-NXP @pull
Jagadish-NXP authored and pull[bot] committed Aug 25, 2021
1 parent e30c5ad commit 3550402
Show file tree
Hide file tree
Showing 4 changed files with 44 additions and 34 deletions.
13 changes: 7 additions & 6 deletions src/crypto/hsm/nxp/CHIPCryptoPALHsm_SE05X_HKDF.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ CHIP_ERROR HKDF_shaHSM::HKDF_SHA256(const uint8_t * secret, const size_t secret_
const size_t salt_length, const uint8_t * info, const size_t info_length, uint8_t * out_buffer,
size_t out_length)
{
CHIP_ERROR error = CHIP_ERROR_INTERNAL;
if (salt_length > 64 || info_length > 80 || secret_length > 256 || out_length > 768)
{
/* Length not supported by se05x. Rollback to SW */
Expand All @@ -60,6 +61,7 @@ CHIP_ERROR HKDF_shaHSM::HKDF_SHA256(const uint8_t * secret, const size_t secret_
VerifyOrReturnError(keyid != kKeyId_NotInitialized, CHIP_ERROR_HSM);

se05x_sessionOpen();
VerifyOrReturnError(gex_sss_chip_ctx.ks.session != NULL, CHIP_ERROR_INTERNAL);

sss_object_t keyObject = { 0 };
sss_status_t status = sss_key_object_init(&keyObject, &gex_sss_chip_ctx.ks);
Expand All @@ -72,17 +74,16 @@ CHIP_ERROR HKDF_shaHSM::HKDF_SHA256(const uint8_t * secret, const size_t secret_
status = sss_key_store_set_key(&gex_sss_chip_ctx.ks, &keyObject, secret, secret_length, secret_length * 8, NULL, 0);
VerifyOrReturnError(status == kStatus_SSS_Success, CHIP_ERROR_INTERNAL);

VerifyOrReturnError(gex_sss_chip_ctx.ks.session != NULL, CHIP_ERROR_INTERNAL);

const smStatus_t smstatus = Se05x_API_HKDF_Extended(
&((sss_se05x_session_t *) &gex_sss_chip_ctx.session)->s_ctx, keyObject.keyId, kSE05x_DigestMode_SHA256,
kSE05x_HkdfMode_ExtractExpand, salt, salt_length, 0, info, info_length, 0, (uint16_t) out_length, out_buffer, &out_length);
VerifyOrReturnError(smstatus == SM_OK, CHIP_ERROR_INTERNAL);
VerifyOrExit(smstatus == SM_OK, error = CHIP_ERROR_INTERNAL);

status = sss_key_store_erase_key(&gex_sss_chip_ctx.ks, &keyObject);
VerifyOrReturnError(status == kStatus_SSS_Success, CHIP_ERROR_INTERNAL);
error = CHIP_NO_ERROR;
exit:
sss_key_store_erase_key(&gex_sss_chip_ctx.ks, &keyObject);

return CHIP_NO_ERROR;
return error;
}

} // namespace Crypto
Expand Down
19 changes: 11 additions & 8 deletions src/crypto/hsm/nxp/CHIPCryptoPALHsm_SE05X_HMAC.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ CHIP_ERROR HMAC_shaHSM::HMAC_SHA256(const uint8_t * key, size_t key_length, cons
uint8_t * out_buffer, size_t out_length)

{
CHIP_ERROR error = CHIP_ERROR_INTERNAL;
sss_mac_t ctx_mac = { 0 };
sss_object_t keyObject = { 0 };

Expand Down Expand Up @@ -73,12 +74,12 @@ CHIP_ERROR HMAC_shaHSM::HMAC_SHA256(const uint8_t * key, size_t key_length, cons
VerifyOrReturnError(status == kStatus_SSS_Success, CHIP_ERROR_INTERNAL);

status = sss_mac_context_init(&ctx_mac, &gex_sss_chip_ctx.session, &keyObject, kAlgorithm_SSS_HMAC_SHA256, kMode_SSS_Mac);
VerifyOrReturnError(status == kStatus_SSS_Success, CHIP_ERROR_INTERNAL);
VerifyOrExit(status == kStatus_SSS_Success, error = CHIP_ERROR_INTERNAL);

if (message_length <= MAX_MAC_ONE_SHOT_DATA_LEN)
{
status = sss_mac_one_go(&ctx_mac, message, message_length, out_buffer, &out_length);
VerifyOrReturnError(status == kStatus_SSS_Success, CHIP_ERROR_INTERNAL);
VerifyOrExit(status == kStatus_SSS_Success, error = CHIP_ERROR_INTERNAL);
}
else
{
Expand All @@ -87,29 +88,31 @@ CHIP_ERROR HMAC_shaHSM::HMAC_SHA256(const uint8_t * key, size_t key_length, cons
size_t rem_len = message_length;

status = sss_mac_init(&ctx_mac);
VerifyOrReturnError(status == kStatus_SSS_Success, CHIP_ERROR_INTERNAL);
VerifyOrExit(status == kStatus_SSS_Success, error = CHIP_ERROR_INTERNAL);

while (rem_len > 0)
{
datalenTemp = (rem_len > MAX_MAC_ONE_SHOT_DATA_LEN) ? MAX_MAC_ONE_SHOT_DATA_LEN : rem_len;
status = sss_mac_update(&ctx_mac, (message + (message_length - rem_len)), datalenTemp);
VerifyOrReturnError(status == kStatus_SSS_Success, CHIP_ERROR_INTERNAL);
VerifyOrExit(status == kStatus_SSS_Success, error = CHIP_ERROR_INTERNAL);
rem_len = rem_len - datalenTemp;
}

status = sss_mac_finish(&ctx_mac, out_buffer, &out_length);
VerifyOrReturnError(status == kStatus_SSS_Success, CHIP_ERROR_INTERNAL);
VerifyOrExit(status == kStatus_SSS_Success, error = CHIP_ERROR_INTERNAL);
}

status = sss_key_store_erase_key(&gex_sss_chip_ctx.ks, &keyObject);
VerifyOrReturnError(status == kStatus_SSS_Success, CHIP_ERROR_INTERNAL);
error = CHIP_NO_ERROR;
exit:

if (ctx_mac.session != NULL)
{
sss_mac_context_free(&ctx_mac);
}

return CHIP_NO_ERROR;
sss_key_store_erase_key(&gex_sss_chip_ctx.ks, &keyObject);

return error;
}

} // namespace Crypto
Expand Down
31 changes: 19 additions & 12 deletions src/crypto/hsm/nxp/CHIPCryptoPALHsm_SE05X_P256.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -134,14 +134,15 @@ CHIP_ERROR P256KeypairHSM::ECDSA_sign_msg(const uint8_t * msg, size_t msg_length
sss_object_t keyObject = { 0 };
size_t siglen = out_signature.Capacity();

VerifyOrExit(msg != nullptr, error = CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrExit(msg_length > 0, error = CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrExit(out_signature != nullptr, error = CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrExit(keyid != kKeyId_NotInitialized, error = CHIP_ERROR_HSM);
VerifyOrReturnError(msg != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrReturnError(msg_length > 0, CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrReturnError(out_signature != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrReturnError(keyid != kKeyId_NotInitialized, CHIP_ERROR_HSM);

ChipLogDetail(Crypto, "ECDSA_sign_msg: Using SE05X for Ecc Sign!");

se05x_sessionOpen();
VerifyOrReturnError(gex_sss_chip_ctx.ks.session != NULL, CHIP_ERROR_INTERNAL);

status = sss_digest_context_init(&digest_ctx, &gex_sss_chip_ctx.session, kAlgorithm_SSS_SHA256, kMode_SSS_Digest);
VerifyOrExit(status == kStatus_SSS_Success, error = CHIP_ERROR_INTERNAL);
Expand Down Expand Up @@ -207,14 +208,15 @@ CHIP_ERROR P256KeypairHSM::ECDSA_sign_hash(const uint8_t * hash, size_t hash_len
sss_object_t keyObject = { 0 };
size_t siglen = out_signature.Capacity();

VerifyOrExit(hash != nullptr, error = CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrExit(hash_length == kSHA256_Hash_Length, error = CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrExit(out_signature != nullptr, error = CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrExit(keyid != kKeyId_NotInitialized, error = CHIP_ERROR_HSM);
VerifyOrReturnError(hash != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrReturnError(hash_length == kSHA256_Hash_Length, CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrReturnError(out_signature != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrReturnError(keyid != kKeyId_NotInitialized, CHIP_ERROR_HSM);

ChipLogDetail(Crypto, "ECDSA_sign_hash: Using SE05X for Ecc Sign!");

se05x_sessionOpen();
VerifyOrReturnError(gex_sss_chip_ctx.ks.session != NULL, CHIP_ERROR_INTERNAL);

status = sss_key_object_init(&keyObject, &gex_sss_chip_ctx.ks);
VerifyOrExit(status == kStatus_SSS_Success, error = CHIP_ERROR_INTERNAL);
Expand Down Expand Up @@ -302,6 +304,7 @@ CHIP_ERROR P256KeypairHSM::ECDH_derive_secret(const P256PublicKey & remote_publi
ChipLogDetail(Crypto, "ECDH_derive_secret: Using SE05X for ECDH !");

se05x_sessionOpen();
VerifyOrReturnError(gex_sss_chip_ctx.ks.session != NULL, CHIP_ERROR_INTERNAL);

const uint8_t * const rem_pubKey = Uint8::to_const_uchar(remote_public_key);
const size_t rem_pubKeyLen = remote_public_key.Length();
Expand All @@ -328,6 +331,8 @@ CHIP_ERROR SE05X_Set_ECDSA_Public_Key(sss_object_t * keyObject, const uint8_t *
const uint8_t nist256_header[] = { 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01,
0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00 };

se05x_sessionOpen();
VerifyOrReturnError(gex_sss_chip_ctx.ks.session != NULL, CHIP_ERROR_INTERNAL);
/* Set public key */
sss_status_t status = sss_key_object_init(keyObject, &gex_sss_chip_ctx.ks);
VerifyOrReturnError(status == kStatus_SSS_Success, CHIP_ERROR_INTERNAL);
Expand Down Expand Up @@ -362,12 +367,13 @@ CHIP_ERROR P256PublicKeyHSM::ECDSA_validate_msg_signature(const uint8_t * msg, s
size_t hash_length = sizeof(hash);
sss_object_t keyObject = { 0 };

VerifyOrExit(msg != nullptr, error = CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrExit(msg_length > 0, error = CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrReturnError(msg != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrReturnError(msg_length > 0, CHIP_ERROR_INVALID_ARGUMENT);

ChipLogDetail(Crypto, "ECDSA_validate_msg_signature: Using SE05X for ECDSA verify (msg) !");

se05x_sessionOpen();
VerifyOrReturnError(gex_sss_chip_ctx.ks.session != NULL, CHIP_ERROR_INTERNAL);

/* Create hash of input data */
status = sss_digest_context_init(&ctx_digest, &gex_sss_chip_ctx.session, kAlgorithm_SSS_SHA256, kMode_SSS_Digest);
Expand Down Expand Up @@ -451,12 +457,13 @@ CHIP_ERROR P256PublicKeyHSM::ECDSA_validate_hash_signature(const uint8_t * hash,
sss_asymmetric_t asymm_ctx = { 0 };
sss_object_t keyObject = { 0 };

VerifyOrExit(hash != nullptr, error = CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrExit(hash_length > 0, error = CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrReturnError(hash != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrReturnError(hash_length > 0, CHIP_ERROR_INVALID_ARGUMENT);

ChipLogDetail(Crypto, "ECDSA_validate_hash_signature: Using SE05X for ECDSA verify (hash) !");

se05x_sessionOpen();
VerifyOrReturnError(gex_sss_chip_ctx.ks.session != NULL, CHIP_ERROR_INTERNAL);

if (PublicKeyid == kKeyId_NotInitialized)
{
Expand Down
15 changes: 7 additions & 8 deletions src/crypto/hsm/nxp/CHIPCryptoPALHsm_SE05X_PBKDF.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ PBKDF2_sha256HSM::~PBKDF2_sha256HSM() {}
CHIP_ERROR PBKDF2_sha256HSM::pbkdf2_sha256(const uint8_t * password, size_t plen, const uint8_t * salt, size_t slen,
unsigned int iteration_count, uint32_t key_length, uint8_t * output)
{
CHIP_ERROR error = CHIP_ERROR_INTERNAL;
VerifyOrReturnError(password != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrReturnError(plen > 0, CHIP_ERROR_INVALID_ARGUMENT);
VerifyOrReturnError(key_length > 0, CHIP_ERROR_INVALID_ARGUMENT);
Expand All @@ -50,6 +51,7 @@ CHIP_ERROR PBKDF2_sha256HSM::pbkdf2_sha256(const uint8_t * password, size_t plen
VerifyOrReturnError(keyid != kKeyId_NotInitialized, CHIP_ERROR_HSM);

se05x_sessionOpen();
VerifyOrReturnError(gex_sss_chip_ctx.ks.session != NULL, CHIP_ERROR_INTERNAL);

sss_object_t hmacKeyObj = {
0,
Expand All @@ -64,17 +66,14 @@ CHIP_ERROR PBKDF2_sha256HSM::pbkdf2_sha256(const uint8_t * password, size_t plen
status = sss_key_store_set_key(&gex_sss_chip_ctx.ks, &hmacKeyObj, password, plen, plen * 8, NULL, 0);
VerifyOrReturnError(status == kStatus_SSS_Success, CHIP_ERROR_INTERNAL);

VerifyOrReturnError(gex_sss_chip_ctx.ks.session != NULL, CHIP_ERROR_INTERNAL);

const smStatus_t smStatus =
Se05x_API_PBKDF2(&((sss_se05x_session_t *) &gex_sss_chip_ctx.session)->s_ctx, keyid, kSE05x_Pbkdf2_HMAC_SHA256, salt, slen,
(uint16_t) iteration_count, (uint16_t) key_length, output, (size_t *) &key_length);
VerifyOrReturnError(smStatus == SM_OK, CHIP_ERROR_INTERNAL);

status = sss_key_store_erase_key(&gex_sss_chip_ctx.ks, &hmacKeyObj);
VerifyOrReturnError(status == kStatus_SSS_Success, CHIP_ERROR_INTERNAL);

return CHIP_NO_ERROR;
VerifyOrExit(smStatus == SM_OK, error = CHIP_ERROR_INTERNAL);
error = CHIP_NO_ERROR;
exit:
sss_key_store_erase_key(&gex_sss_chip_ctx.ks, &hmacKeyObj);
return error;
}

} // namespace Crypto
Expand Down

0 comments on commit 3550402

Please sign in to comment.