| 460ba621 | 27-Nov-2020 |
Ruchika Gupta <ruchika.gupta@linaro.org> |
ta: pkcs11: Add minimum key size checking for HMAC Mechanisms
For HMAC mechanisms for hash operations, if the size of the key object
is less than the minimum size supported by the implementation,
er
ta: pkcs11: Add minimum key size checking for HMAC Mechanisms
For HMAC mechanisms for hash operations, if the size of the key object
is less than the minimum size supported by the implementation,
error PKCS11_CKR_KEY_SIZE_RANGE should be returned. If this check
is not done before TEE_AllocateOperation(), passing a key size not
supported by TEE results in a PKCS11_CKR_MECHANISM_INVALID error,
which is ambiguous as Mehcanism is supported here and the issue is
with key size.
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| de94d6f8 | 27-Nov-2020 |
Ruchika Gupta <ruchika.gupta@linaro.org> |
ta: pkcs11: Fix usage of CKK_GENERIC_SECRET for HMAC Functions
The use of CKK_GENERIC_SECRET is allowed with HMAC mechanisms.
In earlier implementation, CKK_GENERIC_SECRET was mapped to
TEE_GENERIC_
ta: pkcs11: Fix usage of CKK_GENERIC_SECRET for HMAC Functions
The use of CKK_GENERIC_SECRET is allowed with HMAC mechanisms.
In earlier implementation, CKK_GENERIC_SECRET was mapped to
TEE_GENERIC_KEY. TEE_AllocateOperation() would return an error
when TEE key of type TEE_GENERIC_KEY is used with HMAC algorithms.
So, special handling is required for such keys where the PKCS11
mechanism should be used to determine the corresponding TEE
KEY Type for CKK_GENERIC_SECRET when used with HMAC mechanisms.
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 1f45c9cf | 26-Nov-2020 |
Ruchika Gupta <ruchika.gupta@linaro.org> |
ta: pkcs11: Add support for HMAC keys in get_key_min_max_sizes()
The PKCS11_CKK_<h>_HMAC key entries were missing in
get_key_min_max_sizes(). These have been added.
Signed-off-by: Ruchika Gupta <ru
ta: pkcs11: Add support for HMAC keys in get_key_min_max_sizes()
The PKCS11_CKK_<h>_HMAC key entries were missing in
get_key_min_max_sizes(). These have been added.
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| d92c3cdd | 19-Nov-2020 |
Ruchika Gupta <ruchika.gupta@linaro.org> |
ta: pkcs11: Correct the key size for HMAC mechanisms
The minimum and maximum key sizes supported by HMAC mechanism
should be in sync with the Global Platform API's used for
implementing them. The si
ta: pkcs11: Correct the key size for HMAC mechanisms
The minimum and maximum key sizes supported by HMAC mechanism
should be in sync with the Global Platform API's used for
implementing them. The sizes are now in sync with the key
sizes as specified in TEE_AllocateTransientObjects() in [1].
[1] GlobalPlatform Technology TEE Internal Core API Specification
Version 1.1.2.50
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 3284d935 | 10-Nov-2020 |
Ruchika Gupta <ruchika.gupta@linaro.org> |
ta: pkcs11: Remove unused function entry_verify_oneshot()
entry_verify_oneshot() is currently not used in any of the
flows. Hence remove it.
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
ta: pkcs11: Remove unused function entry_verify_oneshot()
entry_verify_oneshot() is currently not used in any of the
flows. Hence remove it.
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
show more ...
|
| 689f4e5b | 29-Oct-2020 |
Ruchika Gupta <ruchika.gupta@linaro.org> |
ta: pkcs11 : add support for HMAC modes for Sign/Verify
Add support for HMAC modes for hash functions - MD5, SHA1,
SHA256, SHA224, SHA284 and SHA512 in Sign/Verify operations.
PKCS#11 offers 2 HMAC
ta: pkcs11 : add support for HMAC modes for Sign/Verify
Add support for HMAC modes for hash functions - MD5, SHA1,
SHA256, SHA224, SHA284 and SHA512 in Sign/Verify operations.
PKCS#11 offers 2 HMAC methods for each hash function <h>,
CKM_<h>_HMAC and CKM_<h>_HMAC_GENERAL. Fixed tag length of the
output size of hash function i.e CKM_h_HMAC is currently supported.
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
show more ...
|
| 0460a039 | 03-Nov-2020 |
Ruchika Gupta <ruchika.gupta@linaro.org> |
ta: pkcs11: fix return code on one-shot process of a updated operation
Fix return value when one-short processing is requested over an operation
that has already gone through a operation update proc
ta: pkcs11: fix return code on one-shot process of a updated operation
Fix return value when one-short processing is requested over an operation
that has already gone through a operation update processing. Prior this
change the PKCS11 TA return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED which
is not accurate when key permits the operation but not the specification.
For clarity, this change splits one-shot and update steps case in
check_mechanism_against_processing().
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
show more ...
|
| 6a760c9e | 03-Nov-2020 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: fix error handling when reading ALLOWED_MECHANISMS list
If parent_key_complies_allowed_processings() cannot return a clear
status on the mechanism IDs allowed by a key object, then somet
ta: pkcs11: fix error handling when reading ALLOWED_MECHANISMS list
If parent_key_complies_allowed_processings() cannot return a clear
status on the mechanism IDs allowed by a key object, then something
is broken. This cannot happen hence panic.
Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 27024524 | 03-Nov-2020 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: sks: stringify error core KEY_SIZE_RANGE
Add string converter for PKCS11_CKR_KEY_SIZE_RANGE that can be returned
by check_created_attrs().
Actually check_created_attrs() is currently never call
ta: sks: stringify error core KEY_SIZE_RANGE
Add string converter for PKCS11_CKR_KEY_SIZE_RANGE that can be returned
by check_created_attrs().
Actually check_created_attrs() is currently never called. It is however
intended to key/object wrapping, derivation and generation.
Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 17ee31f8 | 03-Nov-2020 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: CKA_SIGN and CKA_VERIFY default to empty
Change CKA_SIGN and CKA_VERIFY attributes default value to false
as other keys cryptography processing support boolean attributes.
No reason only
ta: pkcs11: CKA_SIGN and CKA_VERIFY default to empty
Change CKA_SIGN and CKA_VERIFY attributes default value to false
as other keys cryptography processing support boolean attributes.
No reason only sign and verify support default to true.
Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 39fc24fa | 03-Nov-2020 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: fix for spec WRAP_WITH_TRUSTED/ALWAYS_AUTHENTICATE defaults
Set PKCS11_CKA_WRAP_WITH_TRUSTED and PKCS11_CKA_ALWAYS_AUTHENTICATE
default values in the static values list of the specificat
ta: pkcs11: fix for spec WRAP_WITH_TRUSTED/ALWAYS_AUTHENTICATE defaults
Set PKCS11_CKA_WRAP_WITH_TRUSTED and PKCS11_CKA_ALWAYS_AUTHENTICATE
default values in the static values list of the specification.
No functional change.
Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 4eb88651 | 29-Oct-2020 |
Ruchika Gupta <ruchika.gupta@linaro.org> |
ta: pkcs11: Handle optional attributes without default values
In the current implementation all optional attributes of an object
if not specified in the template while creating object, are assigned
ta: pkcs11: Handle optional attributes without default values
In the current implementation all optional attributes of an object
if not specified in the template while creating object, are assigned
empty value by default. This works fine for the attributes where
specification mentions that default value is empty or the
attribute is modifiable later.
However for attributes like CKA_ALLOWED_MECHANISM, adding an empty
default value results in a failure later in crypto operations when
attribute of the object are checked against the mechanism.
To avoid such errors, the optional attributes array are split in 2 parts,
one with the default empty value and ones which don't require a
default value. All attributes in the specification which either should
have default empty value or are allowed to be modified later by call to
C_SetAttributes() or C_CopyObjects() would fall in the former category
and be initialized with empty/NULL value.
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
show more ...
|
| 0b912584 | 28-Aug-2020 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: fix get_attribute_ptrs() against empty attributes
Fix get_attribute_ptrs() to output NULL attribute value references
when the target attribute value is empty, that is when the attribute
ta: pkcs11: fix get_attribute_ptrs() against empty attributes
Fix get_attribute_ptrs() to output NULL attribute value references
when the target attribute value is empty, that is when the attribute
value size is 0.
Fixes: 63f89caa9022 ("ta: pkcs11: attribute helper functions")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
show more ...
|
| ef5f7584 | 28-Aug-2020 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: fix trace_attributes() to support empty attribute arrays
Fix trace_attributes() to not print meaningless data when an attribute
array is empty.
Also fix a local variable that is not ini
ta: pkcs11: fix trace_attributes() to support empty attribute arrays
Fix trace_attributes() to not print meaningless data when an attribute
array is empty.
Also fix a local variable that is not initialized in trace_attributes().
Fixes: 63f89caa9022 ("ta: pkcs11: attribute helper functions")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
show more ...
|
| 78adf52f | 28-Aug-2020 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: remove local helper function supported_mechanism_key_size()
Remove local helper function supported_mechanism_key_size() that is
superseded by newly introduced mechanism_supported_key_siz
ta: pkcs11: remove local helper function supported_mechanism_key_size()
Remove local helper function supported_mechanism_key_size() that is
superseded by newly introduced mechanism_supported_key_sizes() that
does the jobs and is up to date.
Fixes: 512cbf1d30 ("ta: pkcs11: adds support for symmetric AES cipher modes")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
show more ...
|
| 59a5257e | 28-Aug-2020 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: minor fixes
Minor ID reordering in enum pkcs11_mechanism_id.
Fix inline comments referring to PKCS11_OK instead of PKCS11_CKR_OK.
Add 0x prefix in error trace in init_persistent_db().
ta: pkcs11: minor fixes
Minor ID reordering in enum pkcs11_mechanism_id.
Fix inline comments referring to PKCS11_OK instead of PKCS11_CKR_OK.
Add 0x prefix in error trace in init_persistent_db().
Use serialargs_get_session_from_handle() instead of the 2 step calls
to serialargs_get() and pkcs11_handle2session().
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
show more ...
|
| 512cbf1d | 15-Jul-2020 |
Jens Wiklander <jens.wiklander@linaro.org> |
ta: pkcs11: adds support for symmetric AES cipher modes
Adds support for the AES modes ECB, CBC, CTR and CTS.
Much infrastructure is added to handle mechanisms.
Reviewed-by: Vesa Jääskeläinen <ves
ta: pkcs11: adds support for symmetric AES cipher modes
Adds support for the AES modes ECB, CBC, CTR and CTS.
Much infrastructure is added to handle mechanisms.
Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 334316fe | 04-May-2020 |
Jens Wiklander <jens.wiklander@linaro.org> |
ta: pkcs11: persistent object support
A persistent object (token object in PKCS#11 spec) is stored as
a binary blob of attribute list identified by a UUID.
The persistent database stores the UUIDs
ta: pkcs11: persistent object support
A persistent object (token object in PKCS#11 spec) is stored as
a binary blob of attribute list identified by a UUID.
The persistent database stores the UUIDs of the persistent objects
of the token.
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| b56b3d07 | 04-May-2020 |
Jens Wiklander <jens.wiklander@linaro.org> |
ta: pkcs11: support command to import and destroy object
Implement commands PKCS11_CMD_CREATE_OBJECT and PKCS11_CMD_DESTROY_OBJECT.
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-
ta: pkcs11: support command to import and destroy object
Implement commands PKCS11_CMD_CREATE_OBJECT and PKCS11_CMD_DESTROY_OBJECT.
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 63f89caa | 04-May-2020 |
Jens Wiklander <jens.wiklander@linaro.org> |
ta: pkcs11: attribute helper functions
* Helper functions for object attributes management.
* Helper functions to safely parse client attributes template
to create a list of attributes for a objec
ta: pkcs11: attribute helper functions
* Helper functions for object attributes management.
* Helper functions to safely parse client attributes template
to create a list of attributes for a object in the PKCS11 ta.
* Helper functions for assigning or checking object attributes
according to PKCS#11 specification.
* Add id-to-string conversion for attribute/class/key types.
* Helper functions to analyze object attributes.
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 55dcd3cc | 30-Apr-2020 |
Jens Wiklander <jens.wiklander@linaro.org> |
ta: pkcs11: helper for serial arguments with allocation
Helper functions for serial arguments that expect memory allocation.
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Eti
ta: pkcs11: helper for serial arguments with allocation
Helper functions for serial arguments that expect memory allocation.
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| bd62f6a3 | 21-Apr-2020 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: helper function to serialize object attribute
Helper function to add attributes in serial list of object
attributes in PKCS11 TA.
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Rev
ta: pkcs11: helper function to serialize object attribute
Helper function to add attributes in serial list of object
attributes in PKCS11 TA.
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
[jw: change return types to enum pkcs11_rc]
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| ddf63ac3 | 21-Apr-2020 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: add id-to-string conversion for new TA commands
Add missing user authentication commands id-to-string conversion.
Add new import/destroy commands id-to-string conversion.
Reviewed-by: R
ta: pkcs11: add id-to-string conversion for new TA commands
Add missing user authentication commands id-to-string conversion.
Add new import/destroy commands id-to-string conversion.
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 7b69686a | 15-May-2020 |
Markus S. Wamser <github-dev@mail2013.wamser.eu> |
ta: simple typo fixes in comments in ta/pkcs11 tree
* changed "a input" to "an input" in pcks11_ta.h
* changed "the the" to "if the" in handle.c
Signed-off-by: Markus S. Wamser <github-dev@mail2013
ta: simple typo fixes in comments in ta/pkcs11 tree
* changed "a input" to "an input" in pcks11_ta.h
* changed "the the" to "if the" in handle.c
Signed-off-by: Markus S. Wamser <github-dev@mail2013.wamser.eu>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| eb8fd7b9 | 21-Apr-2020 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pksc11: update for trace and command exit
Use character flag '#' instead of plain "0x" prefix.
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome
ta: pksc11: update for trace and command exit
Use character flag '#' instead of plain "0x" prefix.
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|