ta: pkcs11: be flexible on RSA private key optional attributes

Allow RSA private key to partially store the RSA private key optional
attributes without facing complaints from the GP TEE API.

On one

ta: pkcs11: be flexible on RSA private key optional attributes

Allow RSA private key to partially store the RSA private key optional
attributes without facing complaints from the GP TEE API.

On one hand, in the PKCS#11 specification, RSA private key attributes
CKA_PRIME_1, CKA_PRIME_2, CKA_EXPONENT_1, CKA_EXPONENT_2 and
CKA_COEFFICIENT are optional and the spec does not add much constraints
on their presence.

On the other hand, the GP TEE Internal Core API requests that these
5 optional attributes are all present or none is present at all.

As a trade-off, allow PKCS#11 client to partially provide them but do not
load them into the TEE object unless they are all present.

Fixes: 3dc4089afde2 ("ta: pkcs11: correct RSA keys extended attributes sanitation")
Closes: https://github.com/OP-TEE/optee_os/issues/5418
Closes: https://github.com/OP-TEE/optee_os/issues/7520
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

show more ...

tree-wide: use ROUNDUP_DIV() where applicable

Use ROUNDUP_DIV() instead of ROUNDUP(..., size) / size where applicable.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Je

tree-wide: use ROUNDUP_DIV() where applicable

Use ROUNDUP_DIV() instead of ROUNDUP(..., size) / size where applicable.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: add CKM_RSA_X_509 ciphering

Add support for CKM_RSA_X_509 mechanism for encrypt/decrypt operations.

Signed-off-by: Alexandre Marechal <alexandre.marechal@st.com>
Signed-off-by: Etienne

ta: pkcs11: add CKM_RSA_X_509 ciphering

Add support for CKM_RSA_X_509 mechanism for encrypt/decrypt operations.

Signed-off-by: Alexandre Marechal <alexandre.marechal@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: add CKM_RSA_X_509 authentication

Add support for CKM_RSA_X_509 mechanism for sing/verify operations.

Sign and verify operations are processed using TEE decrypt/encrypt
operation since G

ta: pkcs11: add CKM_RSA_X_509 authentication

Add support for CKM_RSA_X_509 mechanism for sing/verify operations.

Sign and verify operations are processed using TEE decrypt/encrypt
operation since GP TEE Internal Core API specification only allows
these modes for TEE_ALG_RSA_NOPAD algorithm. The pkcs11 TA only support
sign operation when the provided payload is exactly of the same size
as the RSA key used and checks the generate signature is of right size.

This mechanism can be needed to support CKM_RSA_X_509 for TLSv1.2
connections.

Add CFG_PKCS11_TA_RSA_X_509 to allow configuring the pkcs11 TA
with or without raw RSA crypto support. The config switch is default
enabled.

Signed-off-by: Alexandre Marechal <alexandre.marechal@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: fix memory leak

On update_persistent_object_attributes failure, head_new (stored in
obj->attributes) is not freed, causing a memory leak.

Reported-by: Christian Zoia <czoia@amazon.es>
C

ta: pkcs11: fix memory leak

On update_persistent_object_attributes failure, head_new (stored in
obj->attributes) is not freed, causing a memory leak.

Reported-by: Christian Zoia <czoia@amazon.es>
Closes: https://github.com/OP-TEE/optee_os/issues/7023
Fixes: 6959626e1621 ("ta: pkcs11: preserve object when set attribute fails")
Signed-off-by: Georges Savoundararadj <savoundg@amazon.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: write db_main and db_objs in one operation

Problem:
There is a potential issue in persistent_token.c::init_persistent_db().
There are two steps to initialize a token DB if it doesn’t exi

ta: pkcs11: write db_main and db_objs in one operation

Problem:
There is a potential issue in persistent_token.c::init_persistent_db().
There are two steps to initialize a token DB if it doesn’t exist:
1. Call TEE_CreatePersistentObject() with db_main as the initial data.
2. Truncate the object data and then insert db_obj data.
If a power loss occurs between above two steps, only the db_main data is
present in the database. When the device restarts, it detects the existing
database and successfully reads db_main, but fails to read db_obj, leading
to a TA panic each time.
https://github.com/OP-TEE/optee_os/issues/6977

Solution:
Write both db_main and the initial 4 bytes of db_objs (with a count of 0)
in a single operation during TEE_CreatePersistentObject().

Tested-by: Weizhao Jiang <weizhaoj@amazon.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Signed-off-by: Weizhao Jiang <weizhaoj@amazon.com>

show more ...

ta: pkcs11: correct RSA keys extended attributes sanitation

Fix RSA key attributes function load_tee_rsa_key_attrs() that badly
checks that the 5 extended RSA attributes are found in the key object.

ta: pkcs11: correct RSA keys extended attributes sanitation

Fix RSA key attributes function load_tee_rsa_key_attrs() that badly
checks that the 5 extended RSA attributes are found in the key object.

Link: https://github.com/OP-TEE/optee_test/issues/721#issuecomment-2068055537
Link: https://github.com/OP-TEE/optee_test/issues/721#issuecomment-2072064963
Fixes: 0442c956edfb ("ta: pkcs11: Add support for RSA signing & verification")
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>

show more ...

ta: pkcs11: Clarify context reference in step_symm_operation()

Function step_symm_operation() defines a local variable to reference
the session processing context but uses both session reference and

ta: pkcs11: Clarify context reference in step_symm_operation()

Function step_symm_operation() defines a local variable to reference
the session processing context but uses both session reference and
this local variable which can be confusing when reading the code. Change
the implementation to only use the local variable for consistency. No
functional changes.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: factorize second operation handle

Factorize fields tee_hash_op_handle and tee_op_handle2 of
struct active_processing that both are used as second operation
handle for specific algorithm.

ta: pkcs11: factorize second operation handle

Factorize fields tee_hash_op_handle and tee_op_handle2 of
struct active_processing that both are used as second operation
handle for specific algorithm.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: implement AES GCM operations

Implement AES GCM authenticated encryption and decryption.

AES GCM decryption requires that the output data is revealed only once
decryption is finalized an

ta: pkcs11: implement AES GCM operations

Implement AES GCM authenticated encryption and decryption.

AES GCM decryption requires that the output data is revealed only once
decryption is finalized and the MAC signature successfully verified.
For this operation, the AES GCM context references a dynamically
allocated data buffer to store output data as they are generated by
each call to TEE_AEUpdate().

AES GCM one-shot operation in the pkc11 TA is a bit specific in that
it requires an extra TEE operation handle to save the initialized
operation state in case of one shot processing request (C_Encrypt()
or C_Decrypt() cryptoki API functions) that queries the output buffer
size. GP TEE Internal Core API does not define a single API function
for such one shot operation that could be called to query the output
buffer size. We must first fully process the input data (TEE_AEUpdate())
before we can query the output buffer size with TEE_AEEncryptFinal() or
TEE_AEDecryptFinal(). Consequently we will need to process again the
input data when client provides a well sized output buffer as we are not
sure that input data will be the same. Therefore the implementation
allocates a 2nd operation handle, copy the operation state into after
it is initialized and use this context to restore this initial state in
case the one shot AE operation is returning PKCS11_CKR_BUFFER_TOO_SMALL.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Co-developed-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: fix build warning on unused arguments

Add missing __maybe_unused attribute for function arguments not
used when the pkcs11 TA is built with NDEBUG directive, as shown
by the following bu

ta: pkcs11: fix build warning on unused arguments

Add missing __maybe_unused attribute for function arguments not
used when the pkcs11 TA is built with NDEBUG directive, as shown
by the following build trace message:

ta/pkcs11/src/pkcs11_attributes.c: In function ‘get_default_value’:
ta/pkcs11/src/pkcs11_attributes.c:261:61: warning: unused parameter ‘id’ [-Wunused-parameter]
261 | static enum pkcs11_rc get_default_value(enum pkcs11_attr_id id, void **value,
| ~~~~~~~~~~~~~~~~~~~~^~
ta/pkcs11/src/pkcs11_attributes.c: In function ‘check_created_attrs_against_processing’:
ta/pkcs11/src/pkcs11_attributes.c:1647:73: warning: unused parameter ‘head’ [-Wunused-parameter]
1647 | struct obj_attrs *head)
| ~~~~~~~~~~~~~~~~~~^~~~

Fixes: 63f89caa9022 ("ta: pkcs11: attribute helper functions")
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: check returned value of mbedtls_pk_rsa()

Check returned pointer of mbedtls_pk_rsa() as it can return NULL.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Reviewed-by: Jerome Foris

ta: pkcs11: check returned value of mbedtls_pk_rsa()

Check returned pointer of mbedtls_pk_rsa() as it can return NULL.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: remove unnecessary includes

Remove unnecessary includes.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <

ta: remove unnecessary includes

Remove unnecessary includes.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: preserve object when set attribute fails

Preserve original object attributes when C_SetAttributeValue service
fails instead of possibly changing object attributes before the whole
new at

ta: pkcs11: preserve object when set attribute fails

Preserve original object attributes when C_SetAttributeValue service
fails instead of possibly changing object attributes before the whole
new attribute set is validated.

Fixes: bcac2127a7f1 ("ta: pkcs11: pkcs11_attributes.c: support PKCS11_CKA_CHECK_VALUE")
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: treat bad KCV size as a bad value case

Return PKCS11_CKR_ATTRIBUTE_VALUE_INVALID instead of a template
inconsistency when the key check value attribute is wrong due to its
size.

Fixes:

ta: pkcs11: treat bad KCV size as a bad value case

Return PKCS11_CKR_ATTRIBUTE_VALUE_INVALID instead of a template
inconsistency when the key check value attribute is wrong due to its
size.

Fixes: bcac2127a7f1 ("ta: pkcs11: pkcs11_attributes.c: support PKCS11_CKA_CHECK_VALUE")
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: use TEE_InitRefAttribute() to compute key check value

Use TEE_InitRefAttribute() helper function to set key data attribute
in compute_check_value_with_ecb().

Fixes: bcac2127a7f1 ("ta: p

ta: pkcs11: use TEE_InitRefAttribute() to compute key check value

Use TEE_InitRefAttribute() helper function to set key data attribute
in compute_check_value_with_ecb().

Fixes: bcac2127a7f1 ("ta: pkcs11: pkcs11_attributes.c: support PKCS11_CKA_CHECK_VALUE")
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: key check value may not be applicable

Key check value attribute is required only for objects of types
certificate and symmetric keys. Fix set_check_value_attr()
to return a successful st

ta: pkcs11: key check value may not be applicable

Key check value attribute is required only for objects of types
certificate and symmetric keys. Fix set_check_value_attr()
to return a successful status instead of bad argument error code when
there is no key check value attribute to compute.

Fixes: bcac2127a7f1 ("ta: pkcs11: pkcs11_attributes.c: support PKCS11_CKA_CHECK_VALUE")
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: fix block size to compute AES key check value

Fix AES block size in compute_check_value_with_ecb(). It is 16 bytes,
not the AES key size. By the way allocate cipher block in the stack
in

ta: pkcs11: fix block size to compute AES key check value

Fix AES block size in compute_check_value_with_ecb(). It is 16 bytes,
not the AES key size. By the way allocate cipher block in the stack
instead of in the heap since the block is quite small.

Fixes: bcac2127a7f1 ("ta: pkcs11: pkcs11_attributes.c: support PKCS11_CKA_CHECK_VALUE")
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: pkcs11_attributes.c: support PKCS11_CKA_CHECK_VALUE

Add PKCS11_CKA_CHECK_VALUE as an optional attribute of symmetric
key and certificate objects . As per the PKCS#11 specification, key
c

ta: pkcs11: pkcs11_attributes.c: support PKCS11_CKA_CHECK_VALUE

Add PKCS11_CKA_CHECK_VALUE as an optional attribute of symmetric
key and certificate objects . As per the PKCS#11 specification, key
check value attribute is optional therefore add pkcs11 TA configuration
switch CFG_PKCS11_TA_CHECK_VALUE_ATTRIBUTE to embed or not the support.

When supported, as per the spec, the attribute can be either the
legitimate value recomputed by the PKCS#11 token or a zero-sized value
called a no-value for when client does not want the attribute to set
in an object.

This change adds the support for the pcks11 TA commands related to
Cryptoki API functions C_GenerateKey(), C_CreateObject(), C_CopyObject(),
C_SetAttributeValue(), C_UnwrapKey() and C_DeriveKey(). TA command
related to C_FindOjects() support the attribute without any change.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: prevent user ID verification when user PIN is not set

Fix User PIN verification in ACL mode (protected authentication) so
that it always returns PKCS11_CKR_USER_PIN_NOT_INITIALIZED when

ta: pkcs11: prevent user ID verification when user PIN is not set

Fix User PIN verification in ACL mode (protected authentication) so
that it always returns PKCS11_CKR_USER_PIN_NOT_INITIALIZED when User
PIN has not been initialized yet by the Security Officer. Before this
change, this was tested only in the standard PIN path, not for the
authenticated TEE identity mode (CFG_PKCS11_TA_AUTH_TEE_IDENTITY=y).

Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: Improve PIN counter handling robustness

Make sure PIN check attempt is saved persistently before continuing with
the actual PIN verification, improving counter and flags coherency in
cas

ta: pkcs11: Improve PIN counter handling robustness

Make sure PIN check attempt is saved persistently before continuing with
the actual PIN verification, improving counter and flags coherency in
case of subsequent failure with persistent saving.

Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

Squashed commit upgrading to mbedtls-3.4.0

Squash merging branch import/mbedtls-3.4.0

8225713449d3 ("libmbedtls: fix unrecognized compiler option")
f03730842d7b ("core: ltc: configure internal MD5"

Squashed commit upgrading to mbedtls-3.4.0

Squash merging branch import/mbedtls-3.4.0

8225713449d3 ("libmbedtls: fix unrecognized compiler option")
f03730842d7b ("core: ltc: configure internal MD5")
2b0d0c50127c ("core: ltc: configure internal SHA-1 and SHA-224")
0e48a6e17630 ("libmedtls: core: update to mbedTLS 3.4.0 API")
049882b143af ("libutee: update to mbedTLS 3.4.0 API")
982307bf6169 ("core: LTC mpi_desc.c: update to mbedTLS 3.4.0 API")
33218e9eff7b ("ta: pkcs11: update to mbedTLS 3.4.0 API")
6956420cc064 ("libmbedtls: fix cipher_wrap.c for NIST AES Key Wrap mode")
ad67ef0b43fd ("libmbedtls: fix cipher_wrap.c for chacha20 and chachapoly")
7300f4d97bbf ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()")
cec89b62a86d ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext()")
e7e048796c44 ("libmbedtls: add SM2 curve")
096beff2cd31 ("libmbedtls: mbedtls_mpi_exp_mod(): optimize mempool usage")
7108668efd3f ("libmbedtls: mbedtls_mpi_exp_mod(): reduce stack usage")
0ba4eb8d0572 ("libmbedtls: mbedtls_mpi_exp_mod() initialize W")
3fd6ecf00382 ("libmbedtls: fix no CRT issue")
d5ea7e9e9aa7 ("libmbedtls: add interfaces in mbedtls for context memory operation")
2b0fb3f1fa3d ("libmedtls: mpi_miller_rabin: increase count limit")
2c3301ab99bb ("libmbedtls: add mbedtls_mpi_init_mempool()")
9a111f0da04b ("libmbedtls: make mbedtls_mpi_mont*() available")
804fe3a374f5 ("mbedtls: configure mbedtls to reach for config")
b28a41531427 ("mbedtls: remove default include/mbedtls/config.h")
dfafe507bbef ("Import mbedtls-3.4.0")

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a)

show more ...

ta: pkcs11: fix EC private key import

When importing EC private key also generate hidden EC public key for that.

This fixes EC private key import problem.

Signed-off-by: Vesa Jääskeläinen <vesa.ja

ta: pkcs11: fix EC private key import

When importing EC private key also generate hidden EC public key for that.

This fixes EC private key import problem.

Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Tested-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: add hidden EC point support

The PKCS#11 standard does not allow one to have CKA_EC_POINT for private
keys but TEE internal API requires one to be present when performing
private key oper

ta: pkcs11: add hidden EC point support

The PKCS#11 standard does not allow one to have CKA_EC_POINT for private
keys but TEE internal API requires one to be present when performing
private key operations. Instead of calculating it each time it is needed
store it as hidden attribute.

This fixes EC private key generation to function as specified in standard.

There is backwards support for existing keys that has been created
inadvertently with CKA_EC_POINT included.

Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Tested-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: pkcs11: add OP-TEE hidden attribute extension

Attributes which has hidden OP-TEE vendor flag specified are not exported
to user space nor can be imported from user space.

Signed-off-by: Vesa Jä

ta: pkcs11: add OP-TEE hidden attribute extension

Attributes which has hidden OP-TEE vendor flag specified are not exported
to user space nor can be imported from user space.

Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Tested-by: Ayoub Zaki <ayoub.zaki@embetrix.com>

show more ...