| 3bc92b91 | 08-Jan-2024 |
Etienne Carriere <etienne.carriere@foss.st.com> |
ta: pkcs11: use TEE_InitRefAttribute() to compute key check value
Use TEE_InitRefAttribute() helper function to set key data attribute
in compute_check_value_with_ecb().
Fixes: bcac2127a7f1 ("ta: p
ta: pkcs11: use TEE_InitRefAttribute() to compute key check value
Use TEE_InitRefAttribute() helper function to set key data attribute
in compute_check_value_with_ecb().
Fixes: bcac2127a7f1 ("ta: pkcs11: pkcs11_attributes.c: support PKCS11_CKA_CHECK_VALUE")
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| cfbe7874 | 08-Jan-2024 |
Etienne Carriere <etienne.carriere@foss.st.com> |
ta: pkcs11: key check value may not be applicable
Key check value attribute is required only for objects of types
certificate and symmetric keys. Fix set_check_value_attr()
to return a successful st
ta: pkcs11: key check value may not be applicable
Key check value attribute is required only for objects of types
certificate and symmetric keys. Fix set_check_value_attr()
to return a successful status instead of bad argument error code when
there is no key check value attribute to compute.
Fixes: bcac2127a7f1 ("ta: pkcs11: pkcs11_attributes.c: support PKCS11_CKA_CHECK_VALUE")
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| 7c243321 | 29-Jul-2023 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: fix EC private key import
When importing EC private key also generate hidden EC public key for that.
This fixes EC private key import problem.
Signed-off-by: Vesa Jääskeläinen <vesa.ja
ta: pkcs11: fix EC private key import
When importing EC private key also generate hidden EC public key for that.
This fixes EC private key import problem.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Tested-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| c9cf3320 | 27-Jul-2023 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: add hidden EC point support
The PKCS#11 standard does not allow one to have CKA_EC_POINT for private
keys but TEE internal API requires one to be present when performing
private key oper
ta: pkcs11: add hidden EC point support
The PKCS#11 standard does not allow one to have CKA_EC_POINT for private
keys but TEE internal API requires one to be present when performing
private key operations. Instead of calculating it each time it is needed
store it as hidden attribute.
This fixes EC private key generation to function as specified in standard.
There is backwards support for existing keys that has been created
inadvertently with CKA_EC_POINT included.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Tested-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| 981966bc | 27-Jul-2023 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: add OP-TEE hidden attribute extension
Attributes which has hidden OP-TEE vendor flag specified are not exported
to user space nor can be imported from user space.
Signed-off-by: Vesa Jä
ta: pkcs11: add OP-TEE hidden attribute extension
Attributes which has hidden OP-TEE vendor flag specified are not exported
to user space nor can be imported from user space.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Tested-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
show more ...
|
| 58282936 | 27-Jul-2023 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: specify OP-TEE's vendor specific attribute scheme
Add vendor allocation specification for OP-TEE specific attributes.
Specifies which bits of attribute identifier is for what purpose.
ta: pkcs11: specify OP-TEE's vendor specific attribute scheme
Add vendor allocation specification for OP-TEE specific attributes.
Specifies which bits of attribute identifier is for what purpose.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Tested-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| bb5d1825 | 12-May-2023 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: invalidate handle of destroyed token objects
Marks as invalid any object handle that refers to the token object
that is being destroying so that any use of the related handle will
consid
ta: pkcs11: invalidate handle of destroyed token objects
Marks as invalid any object handle that refers to the token object
that is being destroying so that any use of the related handle will
consider the object handle as invalid.
Link: https://github.com/OP-TEE/optee_os/issues/6005
Reviewed-by: Valerii Chubar <valerii_chubar@epam.com>
Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 2bc50ed5 | 12-May-2023 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: invalidating handle in a database
Introduces a specific pointer value for handles that are no more valid
and API function handle_invalidate() to mark that a handle is no
more valid.
Rev
ta: pkcs11: invalidating handle in a database
Introduces a specific pointer value for handles that are no more valid
and API function handle_invalidate() to mark that a handle is no
more valid.
Reviewed-by: Valerii Chubar <valerii_chubar@epam.com>
Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 920e0127 | 26-Mar-2023 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: Allow authentication mode switch with PIN change
In order to enable one to switch from PIN mode to TEE Identity mode or
vice versa enable the mode switch when token has just been initial
ta: pkcs11: Allow authentication mode switch with PIN change
In order to enable one to switch from PIN mode to TEE Identity mode or
vice versa enable the mode switch when token has just been initialized but
not taken in use (eg. no user PIN set).
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 9894fdb4 | 24-Feb-2023 |
Clement Faure <clement.faure@nxp.com> |
ta: pkcs11: fix trace compilation warning
Fix the following compilation issue:
$ make PLATFORM=imx-mx8mmevk CFG_TEE_TA_LOG_LEVEL=4 CFG_PKCS11_TA=y
In file included from out/arm-plat-imx/export-ta_a
ta: pkcs11: fix trace compilation warning
Fix the following compilation issue:
$ make PLATFORM=imx-mx8mmevk CFG_TEE_TA_LOG_LEVEL=4 CFG_PKCS11_TA=y
In file included from out/arm-plat-imx/export-ta_arm64/include/assert.h:9,
from ta/pkcs11/src/entry.c:6:
ta/pkcs11/src/entry.c: In function ‘TA_InvokeCommandEntryPoint’:
ta/pkcs11/src/entry.c:143:14: warning: format ‘%u’ expects argument of type ‘unsigned int’, but argument 7 has type ‘size_t’ {aka ‘long unsigned int’} [-Wformat=]
143 | DMSG("%s p#0 %"PRIu32"@%p, p#1 %s %"PRIu32"@%p, p#2 %s %"PRIu32"@%p",
| ^~~~~~~~~~
144 | id2str_ta_cmd(cmd),
145 | params[0].memref.size, params[0].memref.buffer,
| ~~~~~~~~~~~~~~~~~~~~~
| |
| size_t {aka long unsigned int}
out/arm-plat-imx/export-ta_arm64/include/trace.h:41:22: note: in definition of macro ‘trace_printf_helper’
41 | __VA_ARGS__)
| ^~~~~~~~~~~
ta/pkcs11/src/entry.c:143:9: note: in expansion of macro ‘DMSG’
143 | DMSG("%s p#0 %"PRIu32"@%p, p#1 %s %"PRIu32"@%p, p#2 %s %"PRIu32"@%p",
| ^~~~
ta/pkcs11/src/entry.c:143:23: note: format string is defined here
143 | DMSG("%s p#0 %"PRIu32"@%p, p#1 %s %"PRIu32"@%p, p#2 %s %"PRIu32"@%p",
| ~^
| |
| unsigned int
| %lu
ta/pkcs11/src/entry.c:143:14: warning: format ‘%u’ expects argument of type ‘unsigned int’, but argument 10 has type ‘size_t’ {aka ‘long unsigned int’} [-Wformat=]
143 | DMSG("%s p#0 %"PRIu32"@%p, p#1 %s %"PRIu32"@%p, p#2 %s %"PRIu32"@%p",
| ^~~~~~~~~~
......
148 | param_is_memref(ptypes, 1) ? params[1].memref.size : 0,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| size_t {aka long unsigned int}
out/arm-plat-imx/export-ta_arm64/include/trace.h:41:22: note: in definition of macro ‘trace_printf_helper’
41 | __VA_ARGS__)
| ^~~~~~~~~~~
ta/pkcs11/src/entry.c:143:9: note: in expansion of macro ‘DMSG’
143 | DMSG("%s p#0 %"PRIu32"@%p, p#1 %s %"PRIu32"@%p, p#2 %s %"PRIu32"@%p",
| ^~~~
ta/pkcs11/src/entry.c:143:14: warning: format ‘%u’ expects argument of type ‘unsigned int’, but argument 13 has type ‘size_t’ {aka ‘long unsigned int’} [-Wformat=]
143 | DMSG("%s p#0 %"PRIu32"@%p, p#1 %s %"PRIu32"@%p, p#2 %s %"PRIu32"@%p",
| ^~~~~~~~~~
......
152 | param_is_memref(ptypes, 2) ? params[2].memref.size : 0,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| size_t {aka long unsigned int}
out/arm-plat-imx/export-ta_arm64/include/trace.h:41:22: note: in definition of macro ‘trace_printf_helper’
41 | __VA_ARGS__)
| ^~~~~~~~~~~
ta/pkcs11/src/entry.c:143:9: note: in expansion of macro ‘DMSG’
143 | DMSG("%s p#0 %"PRIu32"@%p, p#1 %s %"PRIu32"@%p, p#2 %s %"PRIu32"@%p",
| ^~~~
Signed-off-by: Clement Faure <clement.faure@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|