| cc062b46 | 23-Feb-2022 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
ta: pkcs11: support for ECDH1_DERIVE
Add support for ECDH1_DERIVE operation.
Only the key derivation function CKD_NULL is supported: the raw shared
secret value is therefore generated without apply
ta: pkcs11: support for ECDH1_DERIVE
Add support for ECDH1_DERIVE operation.
Only the key derivation function CKD_NULL is supported: the raw shared
secret value is therefore generated without applying any key
derivation function.
Tested with pkcs11_tool -m ECDH1-DERIVE
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Co-developed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 76948876 | 15-Dec-2021 |
Mengchi Cheng <mengcc@amazon.com> |
ta: pkcs11: Clean up temporary_object_list on object creation failure
Calls LIST_REMOVE() only from cleanup_volatile_obj_ref() this is always
called to finalize object release. Allocated objects are
ta: pkcs11: Clean up temporary_object_list on object creation failure
Calls LIST_REMOVE() only from cleanup_volatile_obj_ref() this is always
called to finalize object release. Allocated objects are always inserted
into a list after being created and therefore need to be removed for its
owner list before the memory is released.
This changes fixes an issue when handle_get() failed in create_object()
and does not remove the reference from temporary_object_list.
Signed-off-by: Mengchi Cheng <mengcc@amazon.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| dbc2184e | 08-Dec-2021 |
Ruchika Gupta <ruchika.gupta@linaro.org> |
ta: pkcs11: Fix memory leak
When sanitizing indirect templates, obj2 was getting allocated
twice leading to memory leak.
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Etienne
ta: pkcs11: Fix memory leak
When sanitizing indirect templates, obj2 was getting allocated
twice leading to memory leak.
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Fixes: https://github.com/OP-TEE/optee_os/issues/5022
show more ...
|
| 5818fdfd | 07-Dec-2021 |
Sahil Malhotra <sahil.malhotra@nxp.com> |
ta: pkcs11: increase default heap size to 32kB
In some test cases, 16kB memory configured is not enough, specifically
while generating RSA keys, so increasing the default heap size to 32kB.
Signed-
ta: pkcs11: increase default heap size to 32kB
In some test cases, 16kB memory configured is not enough, specifically
while generating RSA keys, so increasing the default heap size to 32kB.
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Signed-off-by: Clement Faure <clement.faure@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 28eb53ac | 25-Nov-2021 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
ta: pkcs11: remove unnecessary code
Remove unnecessary assignment.
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org> |
| a5ea52c2 | 08-Oct-2021 |
Elvira Khabirova <e.khabirova@omp.ru> |
ta: pkcs11: fix a double-free
entry_processing_key() frees out_buf on error from
derive_key_by_symm_enc(). Before this change, that led to a double-free.
Fixes: 8c499324e457 ("ta: pkcs11: Add funct
ta: pkcs11: fix a double-free
entry_processing_key() frees out_buf on error from
derive_key_by_symm_enc(). Before this change, that led to a double-free.
Fixes: 8c499324e457 ("ta: pkcs11: Add function to set key data")
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Elvira Khabirova <e.khabirova@omp.ru>
show more ...
|
| b7964037 | 08-Oct-2021 |
Elvira Khabirova <e.khabirova@omp.ru> |
ta: pkcs11: fix a memory leak
Before this change, entry_find_objects_init() leaked e.g. find_ctx.
Fixes: fa1ac7676f39 ("ta: pkcs11: Don't load objects that don't match the search during find")
Revi
ta: pkcs11: fix a memory leak
Before this change, entry_find_objects_init() leaked e.g. find_ctx.
Fixes: fa1ac7676f39 ("ta: pkcs11: Don't load objects that don't match the search during find")
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Elvira Khabirova <e.khabirova@omp.ru>
show more ...
|
| 4137952d | 23-Jan-2021 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: Add certificate object support
Adds support for:
PKCS #11 Cryptographic Token Interface Base Specification Version 2.40
Plus Errata 01
4.6 Certificate objects
4.6.3 X.509 public key ce
ta: pkcs11: Add certificate object support
Adds support for:
PKCS #11 Cryptographic Token Interface Base Specification Version 2.40
Plus Errata 01
4.6 Certificate objects
4.6.3 X.509 public key certificate objects
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 0ef6b144 | 25-Sep-2021 |
Victor Chong <victor.chong@linaro.org> |
ta: pkcs11: Add support for AES CMAC mechanisms
Add support for CKM_AES_CMAC* mechanisms.
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linar
ta: pkcs11: Add support for AES CMAC mechanisms
Add support for CKM_AES_CMAC* mechanisms.
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Ruchika Gupta <ruchika.gupta@linaro.org>
show more ...
|
| 70b6683b | 03-Jun-2021 |
Victor Chong <victor.chong@linaro.org> |
ta: pkcs11: Add support for more HMAC mechanisms
Add support for *_GENERAL MD5 and SHA based HMAC mechanisms.
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Etienne Carriere <et
ta: pkcs11: Add support for more HMAC mechanisms
Add support for *_GENERAL MD5 and SHA based HMAC mechanisms.
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
show more ...
|
| 42765f82 | 12-Jul-2021 |
Victor Chong <victor.chong@linaro.org> |
ta: pkcs11: Fix sign size comparison
The current check does not take into account input signature sizes that
are larger than the hash size, which are invalid and should return an
error. The input si
ta: pkcs11: Fix sign size comparison
The current check does not take into account input signature sizes that
are larger than the hash size, which are invalid and should return an
error. The input signature size can be less than the hash size, but not
for the mechanisms the function is currently used for. Change the check
to match exactly the hash size.
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
show more ...
|
| 6f6d5e75 | 02-Jun-2021 |
Victor Chong <victor.chong@linaro.org> |
ta: pkcs11: Fix typo
Fix typo in comment.
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Ruchika Gupta <ruchika.gupta
ta: pkcs11: Fix typo
Fix typo in comment.
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
show more ...
|
| 95636b36 | 25-Aug-2021 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: make heap size configurable
Add a configuration switch for the PKCS11 TA heap size defaulting
to 16kB as legacy.
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-b
ta: pkcs11: make heap size configurable
Add a configuration switch for the PKCS11 TA heap size defaulting
to 16kB as legacy.
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
show more ...
|
| edce8377 | 25-Aug-2021 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: describe CFG_PKCS11_TA_TOKEN_COUNT
Add a default value and a description for PKCS11 TA config switch
CFG_PKCS11_TA_TOKEN_COUNT in ta/pkcs11/sub.mk.
Signed-off-by: Etienne Carriere <etie
ta: pkcs11: describe CFG_PKCS11_TA_TOKEN_COUNT
Add a default value and a description for PKCS11 TA config switch
CFG_PKCS11_TA_TOKEN_COUNT in ta/pkcs11/sub.mk.
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
show more ...
|
| 06bc8d19 | 25-Aug-2021 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: move default config to ta sub.mk
Move PKCS#11 TA default configuration settings from mk/config.mk
to ta/pkcs11/sub.mk.
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Revi
ta: pkcs11: move default config to ta sub.mk
Move PKCS#11 TA default configuration settings from mk/config.mk
to ta/pkcs11/sub.mk.
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
show more ...
|
| 9df68186 | 24-Aug-2021 |
Etienne Carriere <etienne.carriere@linaro.org> |
ta: pkcs11: fix error code in asymmetric signature update sequence
Correct return code in asymmetric update sequence when digest of
the input data is updated on a multi-stage operation. Prior this
c
ta: pkcs11: fix error code in asymmetric signature update sequence
Correct return code in asymmetric update sequence when digest of
the input data is updated on a multi-stage operation. Prior this
change, the implementation returned CKR_GENERAL_ERROR instead of
CKR_OK because the expected success return value was loaded for
that stage.
Fixes: fb279d8b608e ("ta: pkcs11: Add support for elliptic curve signing & verification")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
show more ...
|
| 2364aa69 | 29-Jul-2021 |
Ruchika Gupta <ruchika.gupta@linaro.org> |
ta: pkcs11: Add operation state in session
Add more operation states to take care of scenarios like failure
of an incremental (update) operation if a one-shot/final operation
has been started.
Sign
ta: pkcs11: Add operation state in session
Add more operation states to take care of scenarios like failure
of an incremental (update) operation if a one-shot/final operation
has been started.
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 324b9e14 | 18-Jul-2021 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: Enforce that helpers are up to date
During each build enforce that src/pkcs11-helpers.c is up to date.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etie
ta: pkcs11: Enforce that helpers are up to date
During each build enforce that src/pkcs11-helpers.c is up to date.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
show more ...
|
| f3cc23fe | 18-Jul-2021 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: Add missing PKCS11_CKR_ helpers
Adds used but missing PKCS11_CKR_ helpers:
- PKCS11_CKR_KEY_TYPE_INCONSISTENT
- PKCS11_CKR_KEY_NOT_WRAPPABLE
- PKCS11_CKR_KEY_UNEXTRACTABLE
Signed-off-by
ta: pkcs11: Add missing PKCS11_CKR_ helpers
Adds used but missing PKCS11_CKR_ helpers:
- PKCS11_CKR_KEY_TYPE_INCONSISTENT
- PKCS11_CKR_KEY_NOT_WRAPPABLE
- PKCS11_CKR_KEY_UNEXTRACTABLE
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
show more ...
|
| 73124d51 | 18-Jul-2021 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: Sort PKCS11_CKR_ helper lines
Sort PKCS11_CKR_ helper lines to match their order in pkcs11_ta.h.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Ca
ta: pkcs11: Sort PKCS11_CKR_ helper lines
Sort PKCS11_CKR_ helper lines to match their order in pkcs11_ta.h.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
show more ...
|
| 5dfe80d6 | 18-Jul-2021 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: Add script to verify that helpers are present
Extracts list of symbols from include/pkcs11_ta.h and verifies that they
are present in src/pkcs11_helpers.c or are not used.
Signed-off-by
ta: pkcs11: Add script to verify that helpers are present
Extracts list of symbols from include/pkcs11_ta.h and verifies that they
are present in src/pkcs11_helpers.c or are not used.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
show more ...
|
| 9cf1afce | 09-Jan-2021 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: Fix RSA public key import
Different requirements are in place when importing RSA public key vs.
generaing a new RSA key pair.
Specified in:
PKCS #11 Cryptographic Token Interface Curren
ta: pkcs11: Fix RSA public key import
Different requirements are in place when importing RSA public key vs.
generaing a new RSA key pair.
Specified in:
PKCS #11 Cryptographic Token Interface Current Mechanisms Specification
Version 2.40 Plus Errata 01
2.1.2 RSA public key objects
and
2.1.4 PKCS #1 RSA key pair generation
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| f27310a5 | 06-Aug-2021 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: Correct return value for decryption with invalid ciphertext
When invalid input data is provided for TEE_AsymmetricDecrypt() it will
fail with TEE_ERROR_BAD_PARAMETERS.
PCSK#11 operation
ta: pkcs11: Correct return value for decryption with invalid ciphertext
When invalid input data is provided for TEE_AsymmetricDecrypt() it will
fail with TEE_ERROR_BAD_PARAMETERS.
PCSK#11 operation for C_Decrypt()/C_DecryptFinal() should return in this
case CKR_ENCRYPTED_DATA_INVALID or CKR_ENCRYPTED_DATA_LEN_RANGE.
As it is hard to determine which case it is return matching error similar
to encryption case.
Specified in:
PKCS #11 Cryptographic Token Interface Base Specification
Version 2.40 Plus Errata 01
5.9 Decryption functions
C_Decrypt/C_DecryptFinal
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 6a6299fb | 06-Aug-2021 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: Correct return value for encryption with invalid input
When invalid input data is provided for TEE_AsymmetricEncrypt() it will
fail with TEE_ERROR_BAD_PARAMETERS.
PCSK#11 operation for
ta: pkcs11: Correct return value for encryption with invalid input
When invalid input data is provided for TEE_AsymmetricEncrypt() it will
fail with TEE_ERROR_BAD_PARAMETERS.
PCSK#11 operation for C_Encrypt()/C_EncryptFinal() should return in this
case CKR_DATA_LEN_RANGE.
Specified in:
PKCS #11 Cryptographic Token Interface Base Specification
Version 2.40 Plus Errata 01
5.8 Encryption functions
C_Encrypt/C_EncryptFinal
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| dc8c77fc | 06-Aug-2021 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: Add support for RSA OAEP encryption & decryption
Add support for performing PKCS #1 RSA OAEP encryption & decryption
operations for:
- MGF1 SHA-1
- MGF1 SHA-224
- MGF1 SHA-256
- MGF1 SH
ta: pkcs11: Add support for RSA OAEP encryption & decryption
Add support for performing PKCS #1 RSA OAEP encryption & decryption
operations for:
- MGF1 SHA-1
- MGF1 SHA-224
- MGF1 SHA-256
- MGF1 SHA-384
- MGF1 SHA-512
Specified in:
PKCS #11 Cryptographic Token Interface Current Mechanisms Specification
Version 2.40 Plus Errata 01
2.1.8 PKCS #1 RSA OAEP
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|