ta: pkcs11: define TA command for signing/verification

Adds commands
- PKCS11_CMD_SIGN_INIT
- PKCS11_CMD_VERIFY_INIT
- PKCS11_CMD_SIGN_UPDATE
- PKCS11_CMD_VERIFY_UPDATE
- PKCS11_CMD_SIGN_FINAL
- PKC

ta: pkcs11: define TA command for signing/verification

Adds commands
- PKCS11_CMD_SIGN_INIT
- PKCS11_CMD_VERIFY_INIT
- PKCS11_CMD_SIGN_UPDATE
- PKCS11_CMD_VERIFY_UPDATE
- PKCS11_CMD_SIGN_FINAL
- PKCS11_CMD_VERIFY_FINAL
- PKCS11_CMD_SIGN_ONESHOT
- PKCS11_CMD_VERIFY_ONESHOT
in enum pkcs11_ta_cmd.

Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>

show more ...

ta: pkcs11: define TA mechanisms for HMAC modes

Adds the mechanisms
- PKCS11_CKM_MD5_HMAC
- PKCS11_CKM_SHA_1_HMAC
- PKCS11_CKM_SHA256_HMAC
- PKCS11_CKM_SHA224_HMAC
- PKCS11_CKM_SHA384_HMAC
- PKCS11_

ta: pkcs11: define TA mechanisms for HMAC modes

Adds the mechanisms
- PKCS11_CKM_MD5_HMAC
- PKCS11_CKM_SHA_1_HMAC
- PKCS11_CKM_SHA256_HMAC
- PKCS11_CKM_SHA224_HMAC
- PKCS11_CKM_SHA384_HMAC
- PKCS11_CKM_SHA512_HMAC
in enum pkcs11_mechanism_id.

Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>

show more ...

ta: pkcs11: fix return code on one-shot process of a updated operation

Fix return value when one-short processing is requested over an operation
that has already gone through a operation update proc

ta: pkcs11: fix return code on one-shot process of a updated operation

Fix return value when one-short processing is requested over an operation
that has already gone through a operation update processing. Prior this
change the PKCS11 TA return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED which
is not accurate when key permits the operation but not the specification.

For clarity, this change splits one-shot and update steps case in
check_mechanism_against_processing().

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>

show more ...

ta: pkcs11: fix error handling when reading ALLOWED_MECHANISMS list

If parent_key_complies_allowed_processings() cannot return a clear
status on the mechanism IDs allowed by a key object, then somet

ta: pkcs11: fix error handling when reading ALLOWED_MECHANISMS list

If parent_key_complies_allowed_processings() cannot return a clear
status on the mechanism IDs allowed by a key object, then something
is broken. This cannot happen hence panic.

Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: sks: stringify error core KEY_SIZE_RANGE

Add string converter for PKCS11_CKR_KEY_SIZE_RANGE that can be returned
by check_created_attrs().

Actually check_created_attrs() is currently never call

ta: sks: stringify error core KEY_SIZE_RANGE

Add string converter for PKCS11_CKR_KEY_SIZE_RANGE that can be returned
by check_created_attrs().

Actually check_created_attrs() is currently never called. It is however
intended to key/object wrapping, derivation and generation.

Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: CKA_SIGN and CKA_VERIFY default to empty

Change CKA_SIGN and CKA_VERIFY attributes default value to false
as other keys cryptography processing support boolean attributes.
No reason only

ta: pkcs11: CKA_SIGN and CKA_VERIFY default to empty

Change CKA_SIGN and CKA_VERIFY attributes default value to false
as other keys cryptography processing support boolean attributes.
No reason only sign and verify support default to true.

Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: fix for spec WRAP_WITH_TRUSTED/ALWAYS_AUTHENTICATE defaults

Set PKCS11_CKA_WRAP_WITH_TRUSTED and PKCS11_CKA_ALWAYS_AUTHENTICATE
default values in the static values list of the specificat

ta: pkcs11: fix for spec WRAP_WITH_TRUSTED/ALWAYS_AUTHENTICATE defaults

Set PKCS11_CKA_WRAP_WITH_TRUSTED and PKCS11_CKA_ALWAYS_AUTHENTICATE
default values in the static values list of the specification.
No functional change.

Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: Handle optional attributes without default values

In the current implementation all optional attributes of an object
if not specified in the template while creating object, are assigned

ta: pkcs11: Handle optional attributes without default values

In the current implementation all optional attributes of an object
if not specified in the template while creating object, are assigned
empty value by default. This works fine for the attributes where
specification mentions that default value is empty or the
attribute is modifiable later.

However for attributes like CKA_ALLOWED_MECHANISM, adding an empty
default value results in a failure later in crypto operations when
attribute of the object are checked against the mechanism.

To avoid such errors, the optional attributes array are split in 2 parts,
one with the default empty value and ones which don't require a
default value. All attributes in the specification which either should
have default empty value or are allowed to be modified later by call to
C_SetAttributes() or C_CopyObjects() would fall in the former category
and be initialized with empty/NULL value.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>

show more ...

ta: pkcs11: fix get_attribute_ptrs() against empty attributes

Fix get_attribute_ptrs() to output NULL attribute value references
when the target attribute value is empty, that is when the attribute

ta: pkcs11: fix get_attribute_ptrs() against empty attributes

Fix get_attribute_ptrs() to output NULL attribute value references
when the target attribute value is empty, that is when the attribute
value size is 0.

Fixes: 63f89caa9022 ("ta: pkcs11: attribute helper functions")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: fix trace_attributes() to support empty attribute arrays

Fix trace_attributes() to not print meaningless data when an attribute
array is empty.

Also fix a local variable that is not ini

ta: pkcs11: fix trace_attributes() to support empty attribute arrays

Fix trace_attributes() to not print meaningless data when an attribute
array is empty.

Also fix a local variable that is not initialized in trace_attributes().

Fixes: 63f89caa9022 ("ta: pkcs11: attribute helper functions")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: remove local helper function supported_mechanism_key_size()

Remove local helper function supported_mechanism_key_size() that is
superseded by newly introduced mechanism_supported_key_siz

ta: pkcs11: remove local helper function supported_mechanism_key_size()

Remove local helper function supported_mechanism_key_size() that is
superseded by newly introduced mechanism_supported_key_sizes() that
does the jobs and is up to date.

Fixes: 512cbf1d30 ("ta: pkcs11: adds support for symmetric AES cipher modes")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: minor fixes

Minor ID reordering in enum pkcs11_mechanism_id.

Fix inline comments referring to PKCS11_OK instead of PKCS11_CKR_OK.

Add 0x prefix in error trace in init_persistent_db().

ta: pkcs11: minor fixes

Minor ID reordering in enum pkcs11_mechanism_id.

Fix inline comments referring to PKCS11_OK instead of PKCS11_CKR_OK.

Add 0x prefix in error trace in init_persistent_db().

Use serialargs_get_session_from_handle() instead of the 2 step calls
to serialargs_get() and pkcs11_handle2session().

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: adds support for symmetric AES cipher modes

Adds support for the AES modes ECB, CBC, CTR and CTS.

Much infrastructure is added to handle mechanisms.

Reviewed-by: Vesa Jääskeläinen <ves

ta: pkcs11: adds support for symmetric AES cipher modes

Adds support for the AES modes ECB, CBC, CTR and CTS.

Much infrastructure is added to handle mechanisms.

Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: define TA command for encryption/decryption

Adds commands
- PKCS11_CMD_ENCRYPT_INIT
- PKCS11_CMD_DECRYPT_INIT
- PKCS11_CMD_ENCRYPT_UPDATE
- PKCS11_CMD_DECRYPT_UPDATE
- PKCS11_CMD_ENCRYPT

ta: pkcs11: define TA command for encryption/decryption

Adds commands
- PKCS11_CMD_ENCRYPT_INIT
- PKCS11_CMD_DECRYPT_INIT
- PKCS11_CMD_ENCRYPT_UPDATE
- PKCS11_CMD_DECRYPT_UPDATE
- PKCS11_CMD_ENCRYPT_FINAL
- PKCS11_CMD_ENCRYPT_FINAL
- PKCS11_CMD_ENCRYPT_ONESHOT
- PKCS11_CMD_DECRYPT_ONESHOT
in enum pkcs11_ta_cmd.

Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: define TA mechanisms for AES cipher modes

Adds the mechanisms
- PKCS11_CKM_AES_KEY_GEN
- PKCS11_CKM_AES_CBC
- PKCS11_CKM_AES_CTR
- PKCS11_CKM_AES_CTS
- PKCS11_CKM_AES_CBC_PAD
- PKCS11_CK

ta: pkcs11: define TA mechanisms for AES cipher modes

Adds the mechanisms
- PKCS11_CKM_AES_KEY_GEN
- PKCS11_CKM_AES_CBC
- PKCS11_CKM_AES_CTR
- PKCS11_CKM_AES_CTS
- PKCS11_CKM_AES_CBC_PAD
- PKCS11_CKM_AES_ECB_ENCRYPT_DATA
- PKCS11_CKM_AES_CBC_ENCRYPT_DATA
in enum pkcs11_mechanism_id.

Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: persistent object support

A persistent object (token object in PKCS#11 spec) is stored as
a binary blob of attribute list identified by a UUID.

The persistent database stores the UUIDs

ta: pkcs11: persistent object support

A persistent object (token object in PKCS#11 spec) is stored as
a binary blob of attribute list identified by a UUID.

The persistent database stores the UUIDs of the persistent objects
of the token.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: support command to import and destroy object

Implement commands PKCS11_CMD_CREATE_OBJECT and PKCS11_CMD_DESTROY_OBJECT.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-

ta: pkcs11: support command to import and destroy object

Implement commands PKCS11_CMD_CREATE_OBJECT and PKCS11_CMD_DESTROY_OBJECT.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: attribute helper functions

* Helper functions for object attributes management.
* Helper functions to safely parse client attributes template
to create a list of attributes for a objec

ta: pkcs11: attribute helper functions

* Helper functions for object attributes management.
* Helper functions to safely parse client attributes template
to create a list of attributes for a object in the PKCS11 ta.
* Helper functions for assigning or checking object attributes
according to PKCS#11 specification.
* Add id-to-string conversion for attribute/class/key types.
* Helper functions to analyze object attributes.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: helper for serial arguments with allocation

Helper functions for serial arguments that expect memory allocation.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Eti

ta: pkcs11: helper for serial arguments with allocation

Helper functions for serial arguments that expect memory allocation.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: helper function to serialize object attribute

Helper function to add attributes in serial list of object
attributes in PKCS11 TA.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Rev

ta: pkcs11: helper function to serialize object attribute

Helper function to add attributes in serial list of object
attributes in PKCS11 TA.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
[jw: change return types to enum pkcs11_rc]
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: add id-to-string conversion for new TA commands

Add missing user authentication commands id-to-string conversion.
Add new import/destroy commands id-to-string conversion.

Reviewed-by: R

ta: pkcs11: add id-to-string conversion for new TA commands

Add missing user authentication commands id-to-string conversion.
Add new import/destroy commands id-to-string conversion.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: define TA commands for object creation/destruction

Add commands PKCS11_CMD_IMPORT_OBJECT and PKCS11_CMD_DESTROY_OBJECT
in enum pkcs11_ta_cmd.

Reviewed-by: Ricardo Salveti <ricardo@found

ta: pkcs11: define TA commands for object creation/destruction

Add commands PKCS11_CMD_IMPORT_OBJECT and PKCS11_CMD_DESTROY_OBJECT
in enum pkcs11_ta_cmd.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: add vendor mechanism used for object import

Add PKCS11_PROCESSING_IMPORT and PKCS11_CKM_UNDEFINED_ID in
enum pkcs11_mechanism_id.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Rev

ta: pkcs11: add vendor mechanism used for object import

Add PKCS11_PROCESSING_IMPORT and PKCS11_CKM_UNDEFINED_ID in
enum pkcs11_mechanism_id.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: add attributes/class/key type IDs in TA API

Add attributes/class/key type IDs in TA API.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski

ta: pkcs11: add attributes/class/key type IDs in TA API

Add attributes/class/key type IDs in TA API.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: add object attribute ABI in TA header file

Define the ABI used to exchange attributes and lists of attributes
between the PKCS11 TA and its client.

Reviewed-by: Ricardo Salveti <ricardo

ta: pkcs11: add object attribute ABI in TA header file

Define the ABI used to exchange attributes and lists of attributes
between the PKCS11 TA and its client.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...