1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2014, STMicroelectronics International N.V. 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions are met: 8 * 9 * 1. Redistributions of source code must retain the above copyright notice, 10 * this list of conditions and the following disclaimer. 11 * 12 * 2. Redistributions in binary form must reproduce the above copyright notice, 13 * this list of conditions and the following disclaimer in the documentation 14 * and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 20 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 #include <stdlib.h> 29 #include <string.h> 30 #include <string_ext.h> 31 32 #include <tee_api.h> 33 #include <tee_api_defines_extensions.h> 34 #include <tee_internal_api_extensions.h> 35 #include <utee_syscalls.h> 36 #include <utee_defines.h> 37 #include <util.h> 38 #include "tee_api_private.h" 39 40 struct __TEE_OperationHandle { 41 TEE_OperationInfo info; 42 TEE_ObjectHandle key1; 43 TEE_ObjectHandle key2; 44 uint32_t operationState;/* Operation state : INITIAL or ACTIVE */ 45 uint8_t *buffer; /* buffer to collect complete blocks */ 46 bool buffer_two_blocks; /* True if two blocks need to be buffered */ 47 size_t block_size; /* Block size of cipher */ 48 size_t buffer_offs; /* Offset in buffer */ 49 uint32_t state; /* Handle to state in TEE Core */ 50 uint32_t ae_tag_len; /* 51 * tag_len in bytes for AE operation else unused 52 */ 53 }; 54 55 /* Cryptographic Operations API - Generic Operation Functions */ 56 57 TEE_Result TEE_AllocateOperation(TEE_OperationHandle *operation, 58 uint32_t algorithm, uint32_t mode, 59 uint32_t maxKeySize) 60 { 61 TEE_Result res; 62 TEE_OperationHandle op = TEE_HANDLE_NULL; 63 uint32_t handle_state = 0; 64 size_t block_size = 1; 65 uint32_t req_key_usage; 66 bool with_private_key = false; 67 bool buffer_two_blocks = false; 68 69 if (!operation) 70 TEE_Panic(0); 71 72 if (algorithm == TEE_ALG_AES_XTS) 73 handle_state = TEE_HANDLE_FLAG_EXPECT_TWO_KEYS; 74 75 /* Check algorithm max key size */ 76 switch (algorithm) { 77 case TEE_ALG_DSA_SHA1: 78 if (maxKeySize < 512) 79 return TEE_ERROR_NOT_SUPPORTED; 80 if (maxKeySize > 1024) 81 return TEE_ERROR_NOT_SUPPORTED; 82 if (maxKeySize % 64 != 0) 83 return TEE_ERROR_NOT_SUPPORTED; 84 break; 85 86 case TEE_ALG_DSA_SHA224: 87 if (maxKeySize != 2048) 88 return TEE_ERROR_NOT_SUPPORTED; 89 break; 90 91 case TEE_ALG_DSA_SHA256: 92 if (maxKeySize != 2048 && maxKeySize != 3072) 93 return TEE_ERROR_NOT_SUPPORTED; 94 break; 95 96 case TEE_ALG_ECDSA_P192: 97 case TEE_ALG_ECDH_P192: 98 if (maxKeySize != 192) 99 return TEE_ERROR_NOT_SUPPORTED; 100 break; 101 102 case TEE_ALG_ECDSA_P224: 103 case TEE_ALG_ECDH_P224: 104 if (maxKeySize != 224) 105 return TEE_ERROR_NOT_SUPPORTED; 106 break; 107 108 case TEE_ALG_ECDSA_P256: 109 case TEE_ALG_ECDH_P256: 110 if (maxKeySize != 256) 111 return TEE_ERROR_NOT_SUPPORTED; 112 break; 113 114 case TEE_ALG_ECDSA_P384: 115 case TEE_ALG_ECDH_P384: 116 if (maxKeySize != 384) 117 return TEE_ERROR_NOT_SUPPORTED; 118 break; 119 120 case TEE_ALG_ECDSA_P521: 121 case TEE_ALG_ECDH_P521: 122 if (maxKeySize != 521) 123 return TEE_ERROR_NOT_SUPPORTED; 124 break; 125 126 default: 127 break; 128 } 129 130 /* Check algorithm mode */ 131 switch (algorithm) { 132 case TEE_ALG_AES_CTS: 133 case TEE_ALG_AES_XTS: 134 buffer_two_blocks = true; 135 /* FALLTHROUGH */ 136 case TEE_ALG_AES_ECB_NOPAD: 137 case TEE_ALG_AES_CBC_NOPAD: 138 case TEE_ALG_AES_CCM: 139 case TEE_ALG_DES_ECB_NOPAD: 140 case TEE_ALG_DES_CBC_NOPAD: 141 case TEE_ALG_DES3_ECB_NOPAD: 142 case TEE_ALG_DES3_CBC_NOPAD: 143 if (TEE_ALG_GET_MAIN_ALG(algorithm) == TEE_MAIN_ALGO_AES) 144 block_size = TEE_AES_BLOCK_SIZE; 145 else 146 block_size = TEE_DES_BLOCK_SIZE; 147 /* FALLTHROUGH */ 148 case TEE_ALG_AES_CTR: 149 case TEE_ALG_AES_GCM: 150 if (mode == TEE_MODE_ENCRYPT) 151 req_key_usage = TEE_USAGE_ENCRYPT; 152 else if (mode == TEE_MODE_DECRYPT) 153 req_key_usage = TEE_USAGE_DECRYPT; 154 else 155 return TEE_ERROR_NOT_SUPPORTED; 156 break; 157 158 case TEE_ALG_RSASSA_PKCS1_V1_5_MD5: 159 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA1: 160 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA224: 161 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA256: 162 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA384: 163 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA512: 164 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA1: 165 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA224: 166 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256: 167 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA384: 168 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA512: 169 case TEE_ALG_DSA_SHA1: 170 case TEE_ALG_DSA_SHA224: 171 case TEE_ALG_DSA_SHA256: 172 case TEE_ALG_ECDSA_P192: 173 case TEE_ALG_ECDSA_P224: 174 case TEE_ALG_ECDSA_P256: 175 case TEE_ALG_ECDSA_P384: 176 case TEE_ALG_ECDSA_P521: 177 if (mode == TEE_MODE_SIGN) { 178 with_private_key = true; 179 req_key_usage = TEE_USAGE_SIGN; 180 } else if (mode == TEE_MODE_VERIFY) { 181 req_key_usage = TEE_USAGE_VERIFY; 182 } else { 183 return TEE_ERROR_NOT_SUPPORTED; 184 } 185 break; 186 187 case TEE_ALG_RSAES_PKCS1_V1_5: 188 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA1: 189 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA224: 190 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA256: 191 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA384: 192 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA512: 193 if (mode == TEE_MODE_ENCRYPT) { 194 req_key_usage = TEE_USAGE_ENCRYPT; 195 } else if (mode == TEE_MODE_DECRYPT) { 196 with_private_key = true; 197 req_key_usage = TEE_USAGE_DECRYPT; 198 } else { 199 return TEE_ERROR_NOT_SUPPORTED; 200 } 201 break; 202 203 case TEE_ALG_RSA_NOPAD: 204 if (mode == TEE_MODE_ENCRYPT) { 205 req_key_usage = TEE_USAGE_ENCRYPT | TEE_USAGE_VERIFY; 206 } else if (mode == TEE_MODE_DECRYPT) { 207 with_private_key = true; 208 req_key_usage = TEE_USAGE_DECRYPT | TEE_USAGE_SIGN; 209 } else { 210 return TEE_ERROR_NOT_SUPPORTED; 211 } 212 break; 213 214 case TEE_ALG_DH_DERIVE_SHARED_SECRET: 215 case TEE_ALG_ECDH_P192: 216 case TEE_ALG_ECDH_P224: 217 case TEE_ALG_ECDH_P256: 218 case TEE_ALG_ECDH_P384: 219 case TEE_ALG_ECDH_P521: 220 case TEE_ALG_HKDF_MD5_DERIVE_KEY: 221 case TEE_ALG_HKDF_SHA1_DERIVE_KEY: 222 case TEE_ALG_HKDF_SHA224_DERIVE_KEY: 223 case TEE_ALG_HKDF_SHA256_DERIVE_KEY: 224 case TEE_ALG_HKDF_SHA384_DERIVE_KEY: 225 case TEE_ALG_HKDF_SHA512_DERIVE_KEY: 226 case TEE_ALG_CONCAT_KDF_SHA1_DERIVE_KEY: 227 case TEE_ALG_CONCAT_KDF_SHA224_DERIVE_KEY: 228 case TEE_ALG_CONCAT_KDF_SHA256_DERIVE_KEY: 229 case TEE_ALG_CONCAT_KDF_SHA384_DERIVE_KEY: 230 case TEE_ALG_CONCAT_KDF_SHA512_DERIVE_KEY: 231 case TEE_ALG_PBKDF2_HMAC_SHA1_DERIVE_KEY: 232 if (mode != TEE_MODE_DERIVE) 233 return TEE_ERROR_NOT_SUPPORTED; 234 with_private_key = true; 235 req_key_usage = TEE_USAGE_DERIVE; 236 break; 237 238 case TEE_ALG_MD5: 239 case TEE_ALG_SHA1: 240 case TEE_ALG_SHA224: 241 case TEE_ALG_SHA256: 242 case TEE_ALG_SHA384: 243 case TEE_ALG_SHA512: 244 if (mode != TEE_MODE_DIGEST) 245 return TEE_ERROR_NOT_SUPPORTED; 246 /* v1.1: flags always set for digest operations */ 247 handle_state |= TEE_HANDLE_FLAG_KEY_SET; 248 req_key_usage = 0; 249 break; 250 251 case TEE_ALG_DES_CBC_MAC_NOPAD: 252 case TEE_ALG_AES_CBC_MAC_NOPAD: 253 case TEE_ALG_AES_CBC_MAC_PKCS5: 254 case TEE_ALG_AES_CMAC: 255 case TEE_ALG_DES_CBC_MAC_PKCS5: 256 case TEE_ALG_DES3_CBC_MAC_NOPAD: 257 case TEE_ALG_DES3_CBC_MAC_PKCS5: 258 case TEE_ALG_HMAC_MD5: 259 case TEE_ALG_HMAC_SHA1: 260 case TEE_ALG_HMAC_SHA224: 261 case TEE_ALG_HMAC_SHA256: 262 case TEE_ALG_HMAC_SHA384: 263 case TEE_ALG_HMAC_SHA512: 264 if (mode != TEE_MODE_MAC) 265 return TEE_ERROR_NOT_SUPPORTED; 266 req_key_usage = TEE_USAGE_MAC; 267 break; 268 269 default: 270 return TEE_ERROR_NOT_SUPPORTED; 271 } 272 273 op = TEE_Malloc(sizeof(*op), TEE_MALLOC_FILL_ZERO); 274 if (!op) 275 return TEE_ERROR_OUT_OF_MEMORY; 276 277 op->info.algorithm = algorithm; 278 op->info.operationClass = TEE_ALG_GET_CLASS(algorithm); 279 op->info.mode = mode; 280 op->info.maxKeySize = maxKeySize; 281 op->info.requiredKeyUsage = req_key_usage; 282 op->info.handleState = handle_state; 283 284 if (block_size > 1) { 285 size_t buffer_size = block_size; 286 287 if (buffer_two_blocks) 288 buffer_size *= 2; 289 290 op->buffer = TEE_Malloc(buffer_size, 291 TEE_USER_MEM_HINT_NO_FILL_ZERO); 292 if (op->buffer == NULL) { 293 res = TEE_ERROR_OUT_OF_MEMORY; 294 goto out; 295 } 296 } 297 op->block_size = block_size; 298 op->buffer_two_blocks = buffer_two_blocks; 299 300 if (TEE_ALG_GET_CLASS(algorithm) != TEE_OPERATION_DIGEST) { 301 uint32_t mks = maxKeySize; 302 TEE_ObjectType key_type = TEE_ALG_GET_KEY_TYPE(algorithm, 303 with_private_key); 304 305 /* 306 * If two keys are expected the max key size is the sum of 307 * the size of both keys. 308 */ 309 if (op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) 310 mks /= 2; 311 312 res = TEE_AllocateTransientObject(key_type, mks, &op->key1); 313 if (res != TEE_SUCCESS) 314 goto out; 315 316 if (op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) { 317 res = TEE_AllocateTransientObject(key_type, mks, 318 &op->key2); 319 if (res != TEE_SUCCESS) 320 goto out; 321 } 322 } 323 324 res = utee_cryp_state_alloc(algorithm, mode, (unsigned long)op->key1, 325 (unsigned long)op->key2, &op->state); 326 if (res != TEE_SUCCESS) 327 goto out; 328 329 /* 330 * Initialize digest operations 331 * Other multi-stage operations initialized w/ TEE_xxxInit functions 332 * Non-applicable on asymmetric operations 333 */ 334 if (TEE_ALG_GET_CLASS(algorithm) == TEE_OPERATION_DIGEST) { 335 res = utee_hash_init(op->state, NULL, 0); 336 if (res != TEE_SUCCESS) 337 goto out; 338 /* v1.1: flags always set for digest operations */ 339 op->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 340 } 341 342 op->operationState = TEE_OPERATION_STATE_INITIAL; 343 344 *operation = op; 345 346 out: 347 if (res != TEE_SUCCESS) { 348 if (res != TEE_ERROR_OUT_OF_MEMORY && 349 res != TEE_ERROR_NOT_SUPPORTED) 350 TEE_Panic(res); 351 if (op) { 352 if (op->state) { 353 TEE_FreeOperation(op); 354 } else { 355 TEE_Free(op->buffer); 356 TEE_FreeTransientObject(op->key1); 357 TEE_FreeTransientObject(op->key2); 358 TEE_Free(op); 359 } 360 } 361 } 362 363 return res; 364 } 365 366 void TEE_FreeOperation(TEE_OperationHandle operation) 367 { 368 TEE_Result res; 369 370 if (operation == TEE_HANDLE_NULL) 371 TEE_Panic(0); 372 373 /* 374 * Note that keys should not be freed here, since they are 375 * claimed by the operation they will be freed by 376 * utee_cryp_state_free(). 377 */ 378 res = utee_cryp_state_free(operation->state); 379 if (res != TEE_SUCCESS) 380 TEE_Panic(res); 381 382 TEE_Free(operation->buffer); 383 TEE_Free(operation); 384 } 385 386 void TEE_GetOperationInfo(TEE_OperationHandle operation, 387 TEE_OperationInfo *operationInfo) 388 { 389 if (operation == TEE_HANDLE_NULL) 390 TEE_Panic(0); 391 392 if (!operationInfo) 393 TEE_Panic(0); 394 395 *operationInfo = operation->info; 396 } 397 398 TEE_Result TEE_GetOperationInfoMultiple(TEE_OperationHandle operation, 399 TEE_OperationInfoMultiple *operationInfoMultiple, 400 uint32_t *operationSize) 401 { 402 TEE_Result res = TEE_SUCCESS; 403 TEE_ObjectInfo key_info1; 404 TEE_ObjectInfo key_info2; 405 uint32_t num_of_keys; 406 size_t n; 407 408 if (operation == TEE_HANDLE_NULL) { 409 res = TEE_ERROR_BAD_PARAMETERS; 410 goto out; 411 } 412 413 if (!operationInfoMultiple) { 414 res = TEE_ERROR_BAD_PARAMETERS; 415 goto out; 416 } 417 418 if (!operationSize) { 419 res = TEE_ERROR_BAD_PARAMETERS; 420 goto out; 421 } 422 423 num_of_keys = (*operationSize-sizeof(TEE_OperationInfoMultiple))/ 424 sizeof(TEE_OperationInfoKey); 425 426 if (num_of_keys > 2) { 427 res = TEE_ERROR_BAD_PARAMETERS; 428 goto out; 429 } 430 431 /* Two keys flag (TEE_ALG_AES_XTS only) */ 432 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) != 433 0 && 434 (num_of_keys != 2)) { 435 res = TEE_ERROR_SHORT_BUFFER; 436 goto out; 437 } 438 439 /* Clear */ 440 for (n = 0; n < num_of_keys; n++) { 441 operationInfoMultiple->keyInformation[n].keySize = 0; 442 operationInfoMultiple->keyInformation[n].requiredKeyUsage = 0; 443 } 444 445 if (num_of_keys == 2) { 446 res = TEE_GetObjectInfo1(operation->key2, &key_info2); 447 /* Key2 is not a valid handle */ 448 if (res != TEE_SUCCESS) 449 goto out; 450 451 operationInfoMultiple->keyInformation[1].keySize = 452 key_info2.keySize; 453 operationInfoMultiple->keyInformation[1].requiredKeyUsage = 454 operation->info.requiredKeyUsage; 455 } 456 457 if (num_of_keys >= 1) { 458 res = TEE_GetObjectInfo1(operation->key1, &key_info1); 459 /* Key1 is not a valid handle */ 460 if (res != TEE_SUCCESS) { 461 if (num_of_keys == 2) { 462 operationInfoMultiple->keyInformation[1]. 463 keySize = 0; 464 operationInfoMultiple->keyInformation[1]. 465 requiredKeyUsage = 0; 466 } 467 goto out; 468 } 469 470 operationInfoMultiple->keyInformation[0].keySize = 471 key_info1.keySize; 472 operationInfoMultiple->keyInformation[0].requiredKeyUsage = 473 operation->info.requiredKeyUsage; 474 } 475 476 /* No key */ 477 operationInfoMultiple->algorithm = operation->info.algorithm; 478 operationInfoMultiple->operationClass = operation->info.operationClass; 479 operationInfoMultiple->mode = operation->info.mode; 480 operationInfoMultiple->digestLength = operation->info.digestLength; 481 operationInfoMultiple->maxKeySize = operation->info.maxKeySize; 482 operationInfoMultiple->handleState = operation->info.handleState; 483 operationInfoMultiple->operationState = operation->operationState; 484 operationInfoMultiple->numberOfKeys = num_of_keys; 485 486 out: 487 if (res != TEE_SUCCESS && 488 res != TEE_ERROR_SHORT_BUFFER) 489 TEE_Panic(res); 490 491 return res; 492 } 493 494 void TEE_ResetOperation(TEE_OperationHandle operation) 495 { 496 TEE_Result res; 497 498 if (operation == TEE_HANDLE_NULL) 499 TEE_Panic(0); 500 501 if (!(operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET)) 502 TEE_Panic(0); 503 504 operation->operationState = TEE_OPERATION_STATE_INITIAL; 505 506 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 507 res = utee_hash_init(operation->state, NULL, 0); 508 if (res != TEE_SUCCESS) 509 TEE_Panic(res); 510 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 511 } else { 512 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 513 } 514 } 515 516 TEE_Result TEE_SetOperationKey(TEE_OperationHandle operation, 517 TEE_ObjectHandle key) 518 { 519 TEE_Result res; 520 uint32_t key_size = 0; 521 TEE_ObjectInfo key_info; 522 523 if (operation == TEE_HANDLE_NULL) { 524 res = TEE_ERROR_BAD_PARAMETERS; 525 goto out; 526 } 527 528 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) { 529 res = TEE_ERROR_BAD_PARAMETERS; 530 goto out; 531 } 532 533 if (key == TEE_HANDLE_NULL) { 534 /* Operation key cleared */ 535 TEE_ResetTransientObject(operation->key1); 536 res = TEE_ERROR_BAD_PARAMETERS; 537 goto out; 538 } 539 540 /* No key for digest operation */ 541 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 542 res = TEE_ERROR_BAD_PARAMETERS; 543 goto out; 544 } 545 546 /* Two keys flag not expected (TEE_ALG_AES_XTS excluded) */ 547 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) != 548 0) { 549 res = TEE_ERROR_BAD_PARAMETERS; 550 goto out; 551 } 552 553 res = TEE_GetObjectInfo1(key, &key_info); 554 /* Key is not a valid handle */ 555 if (res != TEE_SUCCESS) 556 goto out; 557 558 /* Supplied key has to meet required usage */ 559 if ((key_info.objectUsage & operation->info.requiredKeyUsage) != 560 operation->info.requiredKeyUsage) { 561 res = TEE_ERROR_BAD_PARAMETERS; 562 goto out; 563 } 564 565 if (operation->info.maxKeySize < key_info.keySize) { 566 res = TEE_ERROR_BAD_PARAMETERS; 567 goto out; 568 } 569 570 key_size = key_info.keySize; 571 572 TEE_ResetTransientObject(operation->key1); 573 operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET; 574 575 res = TEE_CopyObjectAttributes1(operation->key1, key); 576 if (res != TEE_SUCCESS) 577 goto out; 578 579 operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET; 580 581 operation->info.keySize = key_size; 582 583 out: 584 if (res != TEE_SUCCESS && 585 res != TEE_ERROR_CORRUPT_OBJECT && 586 res != TEE_ERROR_STORAGE_NOT_AVAILABLE) 587 TEE_Panic(res); 588 589 return res; 590 } 591 592 TEE_Result TEE_SetOperationKey2(TEE_OperationHandle operation, 593 TEE_ObjectHandle key1, TEE_ObjectHandle key2) 594 { 595 TEE_Result res; 596 uint32_t key_size = 0; 597 TEE_ObjectInfo key_info1; 598 TEE_ObjectInfo key_info2; 599 600 if (operation == TEE_HANDLE_NULL) { 601 res = TEE_ERROR_BAD_PARAMETERS; 602 goto out; 603 } 604 605 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) { 606 res = TEE_ERROR_BAD_PARAMETERS; 607 goto out; 608 } 609 610 /* 611 * Key1/Key2 and/or are not initialized and 612 * Either both keys are NULL or both are not NULL 613 */ 614 if (key1 == TEE_HANDLE_NULL || key2 == TEE_HANDLE_NULL) { 615 /* Clear operation key1 (if needed) */ 616 if (key1 == TEE_HANDLE_NULL) 617 TEE_ResetTransientObject(operation->key1); 618 /* Clear operation key2 (if needed) */ 619 if (key2 == TEE_HANDLE_NULL) 620 TEE_ResetTransientObject(operation->key2); 621 res = TEE_ERROR_BAD_PARAMETERS; 622 goto out; 623 } 624 625 /* No key for digest operation */ 626 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 627 res = TEE_ERROR_BAD_PARAMETERS; 628 goto out; 629 } 630 631 /* Two keys flag expected (TEE_ALG_AES_XTS only) */ 632 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) == 633 0) { 634 res = TEE_ERROR_BAD_PARAMETERS; 635 goto out; 636 } 637 638 res = TEE_GetObjectInfo1(key1, &key_info1); 639 /* Key1 is not a valid handle */ 640 if (res != TEE_SUCCESS) 641 goto out; 642 643 /* Supplied key has to meet required usage */ 644 if ((key_info1.objectUsage & operation->info. 645 requiredKeyUsage) != operation->info.requiredKeyUsage) { 646 res = TEE_ERROR_BAD_PARAMETERS; 647 goto out; 648 } 649 650 res = TEE_GetObjectInfo1(key2, &key_info2); 651 /* Key2 is not a valid handle */ 652 if (res != TEE_SUCCESS) { 653 if (res == TEE_ERROR_CORRUPT_OBJECT) 654 res = TEE_ERROR_CORRUPT_OBJECT_2; 655 goto out; 656 } 657 658 /* Supplied key has to meet required usage */ 659 if ((key_info2.objectUsage & operation->info. 660 requiredKeyUsage) != operation->info.requiredKeyUsage) { 661 res = TEE_ERROR_BAD_PARAMETERS; 662 goto out; 663 } 664 665 /* 666 * AES-XTS (the only multi key algorithm supported, requires the 667 * keys to be of equal size. 668 */ 669 if (operation->info.algorithm == TEE_ALG_AES_XTS && 670 key_info1.keySize != key_info2.keySize) { 671 res = TEE_ERROR_BAD_PARAMETERS; 672 goto out; 673 674 } 675 676 if (operation->info.maxKeySize < key_info1.keySize) { 677 res = TEE_ERROR_BAD_PARAMETERS; 678 goto out; 679 } 680 681 /* 682 * Odd that only the size of one key should be reported while 683 * size of two key are used when allocating the operation. 684 */ 685 key_size = key_info1.keySize; 686 687 TEE_ResetTransientObject(operation->key1); 688 TEE_ResetTransientObject(operation->key2); 689 operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET; 690 691 res = TEE_CopyObjectAttributes1(operation->key1, key1); 692 if (res != TEE_SUCCESS) 693 goto out; 694 695 res = TEE_CopyObjectAttributes1(operation->key2, key2); 696 if (res != TEE_SUCCESS) { 697 if (res == TEE_ERROR_CORRUPT_OBJECT) 698 res = TEE_ERROR_CORRUPT_OBJECT_2; 699 goto out; 700 } 701 702 operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET; 703 704 operation->info.keySize = key_size; 705 706 out: 707 if (res != TEE_SUCCESS && 708 res != TEE_ERROR_CORRUPT_OBJECT && 709 res != TEE_ERROR_CORRUPT_OBJECT_2 && 710 res != TEE_ERROR_STORAGE_NOT_AVAILABLE && 711 res != TEE_ERROR_STORAGE_NOT_AVAILABLE_2) 712 TEE_Panic(res); 713 714 return res; 715 } 716 717 void TEE_CopyOperation(TEE_OperationHandle dst_op, TEE_OperationHandle src_op) 718 { 719 TEE_Result res; 720 721 if (dst_op == TEE_HANDLE_NULL || src_op == TEE_HANDLE_NULL) 722 TEE_Panic(0); 723 if (dst_op->info.algorithm != src_op->info.algorithm) 724 TEE_Panic(0); 725 if (src_op->info.operationClass != TEE_OPERATION_DIGEST) { 726 TEE_ObjectHandle key1 = TEE_HANDLE_NULL; 727 TEE_ObjectHandle key2 = TEE_HANDLE_NULL; 728 729 if (src_op->info.handleState & TEE_HANDLE_FLAG_KEY_SET) { 730 key1 = src_op->key1; 731 key2 = src_op->key2; 732 } 733 734 if ((src_op->info.handleState & 735 TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) == 0) { 736 TEE_SetOperationKey(dst_op, key1); 737 } else { 738 TEE_SetOperationKey2(dst_op, key1, key2); 739 } 740 } 741 dst_op->info.handleState = src_op->info.handleState; 742 dst_op->info.keySize = src_op->info.keySize; 743 dst_op->operationState = src_op->operationState; 744 745 if (dst_op->buffer_two_blocks != src_op->buffer_two_blocks || 746 dst_op->block_size != src_op->block_size) 747 TEE_Panic(0); 748 749 if (dst_op->buffer != NULL) { 750 if (src_op->buffer == NULL) 751 TEE_Panic(0); 752 753 memcpy(dst_op->buffer, src_op->buffer, src_op->buffer_offs); 754 dst_op->buffer_offs = src_op->buffer_offs; 755 } else if (src_op->buffer != NULL) { 756 TEE_Panic(0); 757 } 758 759 res = utee_cryp_state_copy(dst_op->state, src_op->state); 760 if (res != TEE_SUCCESS) 761 TEE_Panic(res); 762 } 763 764 /* Cryptographic Operations API - Message Digest Functions */ 765 766 static void init_hash_operation(TEE_OperationHandle operation, const void *IV, 767 uint32_t IVLen) 768 { 769 TEE_Result res; 770 771 /* 772 * Note : IV and IVLen are never used in current implementation 773 * This is why coherent values of IV and IVLen are not checked 774 */ 775 res = utee_hash_init(operation->state, IV, IVLen); 776 if (res != TEE_SUCCESS) 777 TEE_Panic(res); 778 operation->buffer_offs = 0; 779 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 780 } 781 782 void TEE_DigestUpdate(TEE_OperationHandle operation, 783 const void *chunk, uint32_t chunkSize) 784 { 785 TEE_Result res = TEE_ERROR_GENERIC; 786 787 if (operation == TEE_HANDLE_NULL || 788 operation->info.operationClass != TEE_OPERATION_DIGEST) 789 TEE_Panic(0); 790 791 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 792 793 res = utee_hash_update(operation->state, chunk, chunkSize); 794 if (res != TEE_SUCCESS) 795 TEE_Panic(res); 796 } 797 798 TEE_Result TEE_DigestDoFinal(TEE_OperationHandle operation, const void *chunk, 799 uint32_t chunkLen, void *hash, uint32_t *hashLen) 800 { 801 TEE_Result res; 802 uint64_t hl; 803 804 if ((operation == TEE_HANDLE_NULL) || 805 (!chunk && chunkLen) || 806 !hash || 807 !hashLen || 808 (operation->info.operationClass != TEE_OPERATION_DIGEST)) { 809 res = TEE_ERROR_BAD_PARAMETERS; 810 goto out; 811 } 812 813 hl = *hashLen; 814 res = utee_hash_final(operation->state, chunk, chunkLen, hash, &hl); 815 *hashLen = hl; 816 if (res != TEE_SUCCESS) 817 goto out; 818 819 /* Reset operation state */ 820 init_hash_operation(operation, NULL, 0); 821 822 operation->operationState = TEE_OPERATION_STATE_INITIAL; 823 824 out: 825 if (res != TEE_SUCCESS && 826 res != TEE_ERROR_SHORT_BUFFER) 827 TEE_Panic(res); 828 829 return res; 830 } 831 832 /* Cryptographic Operations API - Symmetric Cipher Functions */ 833 834 void TEE_CipherInit(TEE_OperationHandle operation, const void *IV, 835 uint32_t IVLen) 836 { 837 TEE_Result res; 838 839 if (operation == TEE_HANDLE_NULL) 840 TEE_Panic(0); 841 842 if (operation->info.operationClass != TEE_OPERATION_CIPHER) 843 TEE_Panic(0); 844 845 if (!(operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) || 846 !(operation->key1)) 847 TEE_Panic(0); 848 849 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) 850 TEE_ResetOperation(operation); 851 852 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 853 854 res = utee_cipher_init(operation->state, IV, IVLen); 855 if (res != TEE_SUCCESS) 856 TEE_Panic(res); 857 858 operation->buffer_offs = 0; 859 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 860 } 861 862 static TEE_Result tee_buffer_update( 863 TEE_OperationHandle op, 864 TEE_Result(*update_func)(unsigned long state, const void *src, 865 size_t slen, void *dst, uint64_t *dlen), 866 const void *src_data, size_t src_len, 867 void *dest_data, uint64_t *dest_len) 868 { 869 TEE_Result res; 870 const uint8_t *src = src_data; 871 size_t slen = src_len; 872 uint8_t *dst = dest_data; 873 size_t dlen = *dest_len; 874 size_t acc_dlen = 0; 875 uint64_t tmp_dlen; 876 size_t l; 877 size_t buffer_size; 878 size_t buffer_left; 879 880 if (!src) { 881 if (slen) 882 TEE_Panic(0); 883 goto out; 884 } 885 886 if (op->buffer_two_blocks) { 887 buffer_size = op->block_size * 2; 888 buffer_left = 1; 889 } else { 890 buffer_size = op->block_size; 891 buffer_left = 0; 892 } 893 894 if (op->buffer_offs > 0) { 895 /* Fill up complete block */ 896 if (op->buffer_offs < op->block_size) 897 l = MIN(slen, op->block_size - op->buffer_offs); 898 else 899 l = MIN(slen, buffer_size - op->buffer_offs); 900 memcpy(op->buffer + op->buffer_offs, src, l); 901 op->buffer_offs += l; 902 src += l; 903 slen -= l; 904 if ((op->buffer_offs % op->block_size) != 0) 905 goto out; /* Nothing left to do */ 906 } 907 908 /* If we can feed from buffer */ 909 if ((op->buffer_offs > 0) && 910 ((op->buffer_offs + slen) >= (buffer_size + buffer_left))) { 911 l = ROUNDUP(op->buffer_offs + slen - buffer_size, 912 op->block_size); 913 l = MIN(op->buffer_offs, l); 914 tmp_dlen = dlen; 915 res = update_func(op->state, op->buffer, l, dst, &tmp_dlen); 916 if (res != TEE_SUCCESS) 917 TEE_Panic(res); 918 dst += tmp_dlen; 919 dlen -= tmp_dlen; 920 acc_dlen += tmp_dlen; 921 op->buffer_offs -= l; 922 if (op->buffer_offs > 0) { 923 /* 924 * Slen is small enough to be contained in rest buffer. 925 */ 926 memcpy(op->buffer, op->buffer + l, buffer_size - l); 927 memcpy(op->buffer + op->buffer_offs, src, slen); 928 op->buffer_offs += slen; 929 goto out; /* Nothing left to do */ 930 } 931 } 932 933 if (slen >= (buffer_size + buffer_left)) { 934 /* Buffer is empty, feed as much as possible from src */ 935 if (op->info.algorithm == TEE_ALG_AES_CTS) 936 l = ROUNDUP(slen - buffer_size, op->block_size); 937 else 938 l = ROUNDUP(slen - buffer_size + 1, op->block_size); 939 940 tmp_dlen = dlen; 941 res = update_func(op->state, src, l, dst, &tmp_dlen); 942 if (res != TEE_SUCCESS) 943 TEE_Panic(res); 944 src += l; 945 slen -= l; 946 dst += tmp_dlen; 947 dlen -= tmp_dlen; 948 acc_dlen += tmp_dlen; 949 } 950 951 /* Slen is small enough to be contained in buffer. */ 952 memcpy(op->buffer + op->buffer_offs, src, slen); 953 op->buffer_offs += slen; 954 955 out: 956 *dest_len = acc_dlen; 957 return TEE_SUCCESS; 958 } 959 960 TEE_Result TEE_CipherUpdate(TEE_OperationHandle operation, const void *srcData, 961 uint32_t srcLen, void *destData, uint32_t *destLen) 962 { 963 TEE_Result res; 964 size_t req_dlen; 965 uint64_t dl; 966 967 if (operation == TEE_HANDLE_NULL || 968 (srcData == NULL && srcLen != 0) || 969 destLen == NULL || 970 (destData == NULL && *destLen != 0)) { 971 res = TEE_ERROR_BAD_PARAMETERS; 972 goto out; 973 } 974 975 if (operation->info.operationClass != TEE_OPERATION_CIPHER) { 976 res = TEE_ERROR_BAD_PARAMETERS; 977 goto out; 978 } 979 980 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 981 res = TEE_ERROR_BAD_PARAMETERS; 982 goto out; 983 } 984 985 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 986 res = TEE_ERROR_BAD_PARAMETERS; 987 goto out; 988 } 989 990 if (!srcData && !srcLen) { 991 *destLen = 0; 992 res = TEE_SUCCESS; 993 goto out; 994 } 995 996 /* Calculate required dlen */ 997 if (operation->block_size > 1) { 998 req_dlen = ((operation->buffer_offs + srcLen) / 999 operation->block_size) * operation->block_size; 1000 } else { 1001 req_dlen = srcLen; 1002 } 1003 if (operation->buffer_two_blocks) { 1004 if (req_dlen > operation->block_size * 2) 1005 req_dlen -= operation->block_size * 2; 1006 else 1007 req_dlen = 0; 1008 } 1009 /* 1010 * Check that required destLen is big enough before starting to feed 1011 * data to the algorithm. Errors during feeding of data are fatal as we 1012 * can't restore sync with this API. 1013 */ 1014 if (*destLen < req_dlen) { 1015 *destLen = req_dlen; 1016 res = TEE_ERROR_SHORT_BUFFER; 1017 goto out; 1018 } 1019 1020 dl = *destLen; 1021 if (operation->block_size > 1) { 1022 res = tee_buffer_update(operation, utee_cipher_update, srcData, 1023 srcLen, destData, &dl); 1024 } else { 1025 if (srcLen > 0) { 1026 res = utee_cipher_update(operation->state, srcData, 1027 srcLen, destData, &dl); 1028 } else { 1029 res = TEE_SUCCESS; 1030 dl = 0; 1031 } 1032 } 1033 *destLen = dl; 1034 1035 out: 1036 if (res != TEE_SUCCESS && 1037 res != TEE_ERROR_SHORT_BUFFER) 1038 TEE_Panic(res); 1039 1040 return res; 1041 } 1042 1043 TEE_Result TEE_CipherDoFinal(TEE_OperationHandle operation, 1044 const void *srcData, uint32_t srcLen, 1045 void *destData, uint32_t *destLen) 1046 { 1047 TEE_Result res; 1048 uint8_t *dst = destData; 1049 size_t acc_dlen = 0; 1050 uint64_t tmp_dlen; 1051 size_t req_dlen; 1052 1053 if (operation == TEE_HANDLE_NULL || 1054 (srcData == NULL && srcLen != 0) || 1055 destLen == NULL || 1056 (destData == NULL && *destLen != 0)) { 1057 res = TEE_ERROR_BAD_PARAMETERS; 1058 goto out; 1059 } 1060 1061 if (operation->info.operationClass != TEE_OPERATION_CIPHER) { 1062 res = TEE_ERROR_BAD_PARAMETERS; 1063 goto out; 1064 } 1065 1066 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1067 res = TEE_ERROR_BAD_PARAMETERS; 1068 goto out; 1069 } 1070 1071 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 1072 res = TEE_ERROR_BAD_PARAMETERS; 1073 goto out; 1074 } 1075 1076 /* 1077 * Check that the final block doesn't require padding for those 1078 * algorithms that requires client to supply padding. 1079 */ 1080 if (operation->info.algorithm == TEE_ALG_AES_ECB_NOPAD || 1081 operation->info.algorithm == TEE_ALG_AES_CBC_NOPAD || 1082 operation->info.algorithm == TEE_ALG_DES_ECB_NOPAD || 1083 operation->info.algorithm == TEE_ALG_DES_CBC_NOPAD || 1084 operation->info.algorithm == TEE_ALG_DES3_ECB_NOPAD || 1085 operation->info.algorithm == TEE_ALG_DES3_CBC_NOPAD) { 1086 if (((operation->buffer_offs + srcLen) % operation->block_size) 1087 != 0) { 1088 res = TEE_ERROR_BAD_PARAMETERS; 1089 goto out; 1090 } 1091 } 1092 1093 /* 1094 * Check that required destLen is big enough before starting to feed 1095 * data to the algorithm. Errors during feeding of data are fatal as we 1096 * can't restore sync with this API. 1097 */ 1098 if (operation->block_size > 1) { 1099 req_dlen = operation->buffer_offs + srcLen; 1100 } else { 1101 req_dlen = srcLen; 1102 } 1103 if (*destLen < req_dlen) { 1104 *destLen = req_dlen; 1105 res = TEE_ERROR_SHORT_BUFFER; 1106 goto out; 1107 } 1108 1109 tmp_dlen = *destLen - acc_dlen; 1110 if (operation->block_size > 1) { 1111 res = tee_buffer_update(operation, utee_cipher_update, 1112 srcData, srcLen, dst, &tmp_dlen); 1113 if (res != TEE_SUCCESS) 1114 goto out; 1115 1116 dst += tmp_dlen; 1117 acc_dlen += tmp_dlen; 1118 1119 tmp_dlen = *destLen - acc_dlen; 1120 res = utee_cipher_final(operation->state, operation->buffer, 1121 operation->buffer_offs, dst, &tmp_dlen); 1122 } else { 1123 res = utee_cipher_final(operation->state, srcData, 1124 srcLen, dst, &tmp_dlen); 1125 } 1126 if (res != TEE_SUCCESS) 1127 goto out; 1128 1129 acc_dlen += tmp_dlen; 1130 *destLen = acc_dlen; 1131 1132 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1133 1134 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1135 1136 out: 1137 if (res != TEE_SUCCESS && 1138 res != TEE_ERROR_SHORT_BUFFER) 1139 TEE_Panic(res); 1140 1141 return res; 1142 } 1143 1144 /* Cryptographic Operations API - MAC Functions */ 1145 1146 void TEE_MACInit(TEE_OperationHandle operation, const void *IV, uint32_t IVLen) 1147 { 1148 if (operation == TEE_HANDLE_NULL) 1149 TEE_Panic(0); 1150 1151 if (operation->info.operationClass != TEE_OPERATION_MAC) 1152 TEE_Panic(0); 1153 1154 if (!(operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) || 1155 !(operation->key1)) 1156 TEE_Panic(0); 1157 1158 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) 1159 TEE_ResetOperation(operation); 1160 1161 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 1162 1163 init_hash_operation(operation, IV, IVLen); 1164 } 1165 1166 void TEE_MACUpdate(TEE_OperationHandle operation, const void *chunk, 1167 uint32_t chunkSize) 1168 { 1169 TEE_Result res; 1170 1171 if (operation == TEE_HANDLE_NULL || (chunk == NULL && chunkSize != 0)) 1172 TEE_Panic(0); 1173 1174 if (operation->info.operationClass != TEE_OPERATION_MAC) 1175 TEE_Panic(0); 1176 1177 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 1178 TEE_Panic(0); 1179 1180 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) 1181 TEE_Panic(0); 1182 1183 res = utee_hash_update(operation->state, chunk, chunkSize); 1184 if (res != TEE_SUCCESS) 1185 TEE_Panic(res); 1186 } 1187 1188 TEE_Result TEE_MACComputeFinal(TEE_OperationHandle operation, 1189 const void *message, uint32_t messageLen, 1190 void *mac, uint32_t *macLen) 1191 { 1192 TEE_Result res; 1193 uint64_t ml; 1194 1195 if (operation == TEE_HANDLE_NULL || 1196 (message == NULL && messageLen != 0) || 1197 mac == NULL || 1198 macLen == NULL) { 1199 res = TEE_ERROR_BAD_PARAMETERS; 1200 goto out; 1201 } 1202 1203 if (operation->info.operationClass != TEE_OPERATION_MAC) { 1204 res = TEE_ERROR_BAD_PARAMETERS; 1205 goto out; 1206 } 1207 1208 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1209 res = TEE_ERROR_BAD_PARAMETERS; 1210 goto out; 1211 } 1212 1213 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 1214 res = TEE_ERROR_BAD_PARAMETERS; 1215 goto out; 1216 } 1217 1218 ml = *macLen; 1219 res = utee_hash_final(operation->state, message, messageLen, mac, &ml); 1220 *macLen = ml; 1221 if (res != TEE_SUCCESS) 1222 goto out; 1223 1224 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1225 1226 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1227 1228 out: 1229 if (res != TEE_SUCCESS && 1230 res != TEE_ERROR_SHORT_BUFFER) 1231 TEE_Panic(res); 1232 1233 return res; 1234 } 1235 1236 TEE_Result TEE_MACCompareFinal(TEE_OperationHandle operation, 1237 const void *message, uint32_t messageLen, 1238 const void *mac, uint32_t macLen) 1239 { 1240 TEE_Result res; 1241 uint8_t computed_mac[TEE_MAX_HASH_SIZE]; 1242 uint32_t computed_mac_size = TEE_MAX_HASH_SIZE; 1243 1244 if (operation->info.operationClass != TEE_OPERATION_MAC) { 1245 res = TEE_ERROR_BAD_PARAMETERS; 1246 goto out; 1247 } 1248 1249 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1250 res = TEE_ERROR_BAD_PARAMETERS; 1251 goto out; 1252 } 1253 1254 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 1255 res = TEE_ERROR_BAD_PARAMETERS; 1256 goto out; 1257 } 1258 1259 res = TEE_MACComputeFinal(operation, message, messageLen, computed_mac, 1260 &computed_mac_size); 1261 if (res != TEE_SUCCESS) 1262 goto out; 1263 1264 if (computed_mac_size != macLen) { 1265 res = TEE_ERROR_MAC_INVALID; 1266 goto out; 1267 } 1268 1269 if (buf_compare_ct(mac, computed_mac, computed_mac_size) != 0) { 1270 res = TEE_ERROR_MAC_INVALID; 1271 goto out; 1272 } 1273 1274 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1275 1276 out: 1277 if (res != TEE_SUCCESS && 1278 res != TEE_ERROR_MAC_INVALID) 1279 TEE_Panic(res); 1280 1281 return res; 1282 } 1283 1284 /* Cryptographic Operations API - Authenticated Encryption Functions */ 1285 1286 TEE_Result TEE_AEInit(TEE_OperationHandle operation, const void *nonce, 1287 uint32_t nonceLen, uint32_t tagLen, uint32_t AADLen, 1288 uint32_t payloadLen) 1289 { 1290 TEE_Result res; 1291 1292 if (operation == TEE_HANDLE_NULL || nonce == NULL) { 1293 res = TEE_ERROR_BAD_PARAMETERS; 1294 goto out; 1295 } 1296 1297 if (operation->info.operationClass != TEE_OPERATION_AE) { 1298 res = TEE_ERROR_BAD_PARAMETERS; 1299 goto out; 1300 } 1301 1302 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) { 1303 res = TEE_ERROR_BAD_PARAMETERS; 1304 goto out; 1305 } 1306 1307 /* 1308 * AES-CCM tag len is specified by AES-CCM spec and handled in TEE Core 1309 * in the implementation. But AES-GCM spec doesn't specify the tag len 1310 * according to the same principle so we have to check here instead to 1311 * be GP compliant. 1312 */ 1313 if (operation->info.algorithm == TEE_ALG_AES_GCM) { 1314 /* 1315 * From GP spec: For AES-GCM, can be 128, 120, 112, 104, or 96 1316 */ 1317 if (tagLen < 96 || tagLen > 128 || (tagLen % 8 != 0)) { 1318 res = TEE_ERROR_NOT_SUPPORTED; 1319 goto out; 1320 } 1321 } 1322 1323 res = utee_authenc_init(operation->state, nonce, nonceLen, 1324 tagLen / 8, AADLen, payloadLen); 1325 if (res != TEE_SUCCESS) 1326 goto out; 1327 1328 operation->ae_tag_len = tagLen / 8; 1329 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 1330 1331 out: 1332 if (res != TEE_SUCCESS && 1333 res != TEE_ERROR_NOT_SUPPORTED) 1334 TEE_Panic(res); 1335 1336 return res; 1337 } 1338 1339 void TEE_AEUpdateAAD(TEE_OperationHandle operation, const void *AADdata, 1340 uint32_t AADdataLen) 1341 { 1342 TEE_Result res; 1343 1344 if (operation == TEE_HANDLE_NULL || 1345 (AADdata == NULL && AADdataLen != 0)) 1346 TEE_Panic(0); 1347 1348 if (operation->info.operationClass != TEE_OPERATION_AE) 1349 TEE_Panic(0); 1350 1351 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 1352 TEE_Panic(0); 1353 1354 res = utee_authenc_update_aad(operation->state, AADdata, AADdataLen); 1355 1356 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 1357 1358 if (res != TEE_SUCCESS) 1359 TEE_Panic(res); 1360 } 1361 1362 TEE_Result TEE_AEUpdate(TEE_OperationHandle operation, const void *srcData, 1363 uint32_t srcLen, void *destData, uint32_t *destLen) 1364 { 1365 TEE_Result res; 1366 size_t req_dlen; 1367 uint64_t dl; 1368 1369 if (operation == TEE_HANDLE_NULL || 1370 (srcData == NULL && srcLen != 0) || 1371 destLen == NULL || 1372 (destData == NULL && *destLen != 0)) { 1373 res = TEE_ERROR_BAD_PARAMETERS; 1374 goto out; 1375 } 1376 1377 if (operation->info.operationClass != TEE_OPERATION_AE) { 1378 res = TEE_ERROR_BAD_PARAMETERS; 1379 goto out; 1380 } 1381 1382 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1383 res = TEE_ERROR_BAD_PARAMETERS; 1384 goto out; 1385 } 1386 1387 if (!srcData && !srcLen) { 1388 *destLen = 0; 1389 res = TEE_SUCCESS; 1390 goto out; 1391 } 1392 1393 /* 1394 * Check that required destLen is big enough before starting to feed 1395 * data to the algorithm. Errors during feeding of data are fatal as we 1396 * can't restore sync with this API. 1397 */ 1398 if (operation->block_size > 1) { 1399 req_dlen = ROUNDDOWN(operation->buffer_offs + srcLen, 1400 operation->block_size); 1401 } else { 1402 req_dlen = srcLen; 1403 } 1404 1405 if (*destLen < req_dlen) { 1406 *destLen = req_dlen; 1407 res = TEE_ERROR_SHORT_BUFFER; 1408 goto out; 1409 } 1410 1411 dl = *destLen; 1412 if (operation->block_size > 1) { 1413 res = tee_buffer_update(operation, utee_authenc_update_payload, 1414 srcData, srcLen, destData, &dl); 1415 } else { 1416 if (srcLen > 0) { 1417 res = utee_authenc_update_payload(operation->state, 1418 srcData, srcLen, 1419 destData, &dl); 1420 } else { 1421 dl = 0; 1422 res = TEE_SUCCESS; 1423 } 1424 } 1425 if (res != TEE_SUCCESS) 1426 goto out; 1427 1428 *destLen = dl; 1429 1430 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 1431 1432 out: 1433 if (res != TEE_SUCCESS && 1434 res != TEE_ERROR_SHORT_BUFFER) 1435 TEE_Panic(res); 1436 1437 return res; 1438 } 1439 1440 TEE_Result TEE_AEEncryptFinal(TEE_OperationHandle operation, 1441 const void *srcData, uint32_t srcLen, 1442 void *destData, uint32_t *destLen, void *tag, 1443 uint32_t *tagLen) 1444 { 1445 TEE_Result res; 1446 uint8_t *dst = destData; 1447 size_t acc_dlen = 0; 1448 uint64_t tmp_dlen; 1449 size_t req_dlen; 1450 uint64_t tl; 1451 1452 if (operation == TEE_HANDLE_NULL || 1453 (srcData == NULL && srcLen != 0) || 1454 destLen == NULL || 1455 (destData == NULL && *destLen != 0) || 1456 tag == NULL || tagLen == NULL) { 1457 res = TEE_ERROR_BAD_PARAMETERS; 1458 goto out; 1459 } 1460 1461 if (operation->info.operationClass != TEE_OPERATION_AE) { 1462 res = TEE_ERROR_BAD_PARAMETERS; 1463 goto out; 1464 } 1465 1466 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1467 res = TEE_ERROR_BAD_PARAMETERS; 1468 goto out; 1469 } 1470 1471 /* 1472 * Check that required destLen is big enough before starting to feed 1473 * data to the algorithm. Errors during feeding of data are fatal as we 1474 * can't restore sync with this API. 1475 */ 1476 req_dlen = operation->buffer_offs + srcLen; 1477 if (*destLen < req_dlen) { 1478 *destLen = req_dlen; 1479 res = TEE_ERROR_SHORT_BUFFER; 1480 goto out; 1481 } 1482 1483 /* 1484 * Need to check this before update_payload since sync would be lost if 1485 * we return short buffer after that. 1486 */ 1487 if (*tagLen < operation->ae_tag_len) { 1488 *tagLen = operation->ae_tag_len; 1489 res = TEE_ERROR_SHORT_BUFFER; 1490 goto out; 1491 } 1492 1493 tl = *tagLen; 1494 tmp_dlen = *destLen - acc_dlen; 1495 if (operation->block_size > 1) { 1496 res = tee_buffer_update(operation, utee_authenc_update_payload, 1497 srcData, srcLen, dst, &tmp_dlen); 1498 if (res != TEE_SUCCESS) 1499 goto out; 1500 1501 dst += tmp_dlen; 1502 acc_dlen += tmp_dlen; 1503 1504 tmp_dlen = *destLen - acc_dlen; 1505 res = utee_authenc_enc_final(operation->state, 1506 operation->buffer, 1507 operation->buffer_offs, dst, 1508 &tmp_dlen, tag, &tl); 1509 } else { 1510 res = utee_authenc_enc_final(operation->state, srcData, 1511 srcLen, dst, &tmp_dlen, 1512 tag, &tl); 1513 } 1514 *tagLen = tl; 1515 if (res != TEE_SUCCESS) 1516 goto out; 1517 1518 acc_dlen += tmp_dlen; 1519 *destLen = acc_dlen; 1520 1521 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1522 1523 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1524 1525 out: 1526 if (res != TEE_SUCCESS && 1527 res != TEE_ERROR_SHORT_BUFFER) 1528 TEE_Panic(res); 1529 1530 return res; 1531 } 1532 1533 TEE_Result TEE_AEDecryptFinal(TEE_OperationHandle operation, 1534 const void *srcData, uint32_t srcLen, 1535 void *destData, uint32_t *destLen, void *tag, 1536 uint32_t tagLen) 1537 { 1538 TEE_Result res; 1539 uint8_t *dst = destData; 1540 size_t acc_dlen = 0; 1541 uint64_t tmp_dlen; 1542 size_t req_dlen; 1543 1544 if (operation == TEE_HANDLE_NULL || 1545 (srcData == NULL && srcLen != 0) || 1546 destLen == NULL || 1547 (destData == NULL && *destLen != 0) || 1548 (tag == NULL && tagLen != 0)) { 1549 res = TEE_ERROR_BAD_PARAMETERS; 1550 goto out; 1551 } 1552 1553 if (operation->info.operationClass != TEE_OPERATION_AE) { 1554 res = TEE_ERROR_BAD_PARAMETERS; 1555 goto out; 1556 } 1557 1558 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1559 res = TEE_ERROR_BAD_PARAMETERS; 1560 goto out; 1561 } 1562 1563 /* 1564 * Check that required destLen is big enough before starting to feed 1565 * data to the algorithm. Errors during feeding of data are fatal as we 1566 * can't restore sync with this API. 1567 */ 1568 req_dlen = operation->buffer_offs + srcLen; 1569 if (*destLen < req_dlen) { 1570 *destLen = req_dlen; 1571 res = TEE_ERROR_SHORT_BUFFER; 1572 goto out; 1573 } 1574 1575 tmp_dlen = *destLen - acc_dlen; 1576 if (operation->block_size > 1) { 1577 res = tee_buffer_update(operation, utee_authenc_update_payload, 1578 srcData, srcLen, dst, &tmp_dlen); 1579 if (res != TEE_SUCCESS) 1580 goto out; 1581 1582 dst += tmp_dlen; 1583 acc_dlen += tmp_dlen; 1584 1585 tmp_dlen = *destLen - acc_dlen; 1586 res = utee_authenc_dec_final(operation->state, 1587 operation->buffer, 1588 operation->buffer_offs, dst, 1589 &tmp_dlen, tag, tagLen); 1590 } else { 1591 res = utee_authenc_dec_final(operation->state, srcData, 1592 srcLen, dst, &tmp_dlen, 1593 tag, tagLen); 1594 } 1595 if (res != TEE_SUCCESS) 1596 goto out; 1597 1598 /* Supplied tagLen should match what we initiated with */ 1599 if (tagLen != operation->ae_tag_len) 1600 res = TEE_ERROR_MAC_INVALID; 1601 1602 acc_dlen += tmp_dlen; 1603 *destLen = acc_dlen; 1604 1605 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1606 1607 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1608 1609 out: 1610 if (res != TEE_SUCCESS && 1611 res != TEE_ERROR_SHORT_BUFFER && 1612 res != TEE_ERROR_MAC_INVALID) 1613 TEE_Panic(res); 1614 1615 return res; 1616 } 1617 1618 /* Cryptographic Operations API - Asymmetric Functions */ 1619 1620 TEE_Result TEE_AsymmetricEncrypt(TEE_OperationHandle operation, 1621 const TEE_Attribute *params, 1622 uint32_t paramCount, const void *srcData, 1623 uint32_t srcLen, void *destData, 1624 uint32_t *destLen) 1625 { 1626 TEE_Result res; 1627 struct utee_attribute ua[paramCount]; 1628 uint64_t dl; 1629 1630 if (operation == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 1631 destLen == NULL || (destData == NULL && *destLen != 0)) 1632 TEE_Panic(0); 1633 if (params == NULL && paramCount != 0) 1634 TEE_Panic(0); 1635 if (!operation->key1) 1636 TEE_Panic(0); 1637 if (operation->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER) 1638 TEE_Panic(0); 1639 if (operation->info.mode != TEE_MODE_ENCRYPT) 1640 TEE_Panic(0); 1641 1642 __utee_from_attr(ua, params, paramCount); 1643 dl = *destLen; 1644 res = utee_asymm_operate(operation->state, ua, paramCount, srcData, 1645 srcLen, destData, &dl); 1646 *destLen = dl; 1647 1648 if (res != TEE_SUCCESS && 1649 res != TEE_ERROR_SHORT_BUFFER && 1650 res != TEE_ERROR_BAD_PARAMETERS) 1651 TEE_Panic(res); 1652 1653 return res; 1654 } 1655 1656 TEE_Result TEE_AsymmetricDecrypt(TEE_OperationHandle operation, 1657 const TEE_Attribute *params, 1658 uint32_t paramCount, const void *srcData, 1659 uint32_t srcLen, void *destData, 1660 uint32_t *destLen) 1661 { 1662 TEE_Result res; 1663 struct utee_attribute ua[paramCount]; 1664 uint64_t dl; 1665 1666 if (operation == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 1667 destLen == NULL || (destData == NULL && *destLen != 0)) 1668 TEE_Panic(0); 1669 if (params == NULL && paramCount != 0) 1670 TEE_Panic(0); 1671 if (!operation->key1) 1672 TEE_Panic(0); 1673 if (operation->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER) 1674 TEE_Panic(0); 1675 if (operation->info.mode != TEE_MODE_DECRYPT) 1676 TEE_Panic(0); 1677 1678 __utee_from_attr(ua, params, paramCount); 1679 dl = *destLen; 1680 res = utee_asymm_operate(operation->state, ua, paramCount, srcData, 1681 srcLen, destData, &dl); 1682 *destLen = dl; 1683 1684 if (res != TEE_SUCCESS && 1685 res != TEE_ERROR_SHORT_BUFFER && 1686 res != TEE_ERROR_BAD_PARAMETERS) 1687 TEE_Panic(res); 1688 1689 return res; 1690 } 1691 1692 TEE_Result TEE_AsymmetricSignDigest(TEE_OperationHandle operation, 1693 const TEE_Attribute *params, 1694 uint32_t paramCount, const void *digest, 1695 uint32_t digestLen, void *signature, 1696 uint32_t *signatureLen) 1697 { 1698 TEE_Result res; 1699 struct utee_attribute ua[paramCount]; 1700 uint64_t sl; 1701 1702 if (operation == TEE_HANDLE_NULL || 1703 (digest == NULL && digestLen != 0) || 1704 signature == NULL || signatureLen == NULL) 1705 TEE_Panic(0); 1706 if (params == NULL && paramCount != 0) 1707 TEE_Panic(0); 1708 if (!operation->key1) 1709 TEE_Panic(0); 1710 if (operation->info.operationClass != 1711 TEE_OPERATION_ASYMMETRIC_SIGNATURE) 1712 TEE_Panic(0); 1713 if (operation->info.mode != TEE_MODE_SIGN) 1714 TEE_Panic(0); 1715 1716 __utee_from_attr(ua, params, paramCount); 1717 sl = *signatureLen; 1718 res = utee_asymm_operate(operation->state, ua, paramCount, digest, 1719 digestLen, signature, &sl); 1720 *signatureLen = sl; 1721 1722 if (res != TEE_SUCCESS && res != TEE_ERROR_SHORT_BUFFER) 1723 TEE_Panic(res); 1724 1725 return res; 1726 } 1727 1728 TEE_Result TEE_AsymmetricVerifyDigest(TEE_OperationHandle operation, 1729 const TEE_Attribute *params, 1730 uint32_t paramCount, const void *digest, 1731 uint32_t digestLen, 1732 const void *signature, 1733 uint32_t signatureLen) 1734 { 1735 TEE_Result res; 1736 struct utee_attribute ua[paramCount]; 1737 1738 if (operation == TEE_HANDLE_NULL || 1739 (digest == NULL && digestLen != 0) || 1740 (signature == NULL && signatureLen != 0)) 1741 TEE_Panic(0); 1742 if (params == NULL && paramCount != 0) 1743 TEE_Panic(0); 1744 if (!operation->key1) 1745 TEE_Panic(0); 1746 if (operation->info.operationClass != 1747 TEE_OPERATION_ASYMMETRIC_SIGNATURE) 1748 TEE_Panic(0); 1749 if (operation->info.mode != TEE_MODE_VERIFY) 1750 TEE_Panic(0); 1751 1752 __utee_from_attr(ua, params, paramCount); 1753 res = utee_asymm_verify(operation->state, ua, paramCount, digest, 1754 digestLen, signature, signatureLen); 1755 1756 if (res != TEE_SUCCESS && res != TEE_ERROR_SIGNATURE_INVALID) 1757 TEE_Panic(res); 1758 1759 return res; 1760 } 1761 1762 /* Cryptographic Operations API - Key Derivation Functions */ 1763 1764 void TEE_DeriveKey(TEE_OperationHandle operation, 1765 const TEE_Attribute *params, uint32_t paramCount, 1766 TEE_ObjectHandle derivedKey) 1767 { 1768 TEE_Result res; 1769 TEE_ObjectInfo key_info; 1770 struct utee_attribute ua[paramCount]; 1771 1772 if (operation == TEE_HANDLE_NULL || derivedKey == 0) 1773 TEE_Panic(0); 1774 if (params == NULL && paramCount != 0) 1775 TEE_Panic(0); 1776 if (TEE_ALG_GET_CLASS(operation->info.algorithm) != 1777 TEE_OPERATION_KEY_DERIVATION) 1778 TEE_Panic(0); 1779 1780 if (operation->info.operationClass != TEE_OPERATION_KEY_DERIVATION) 1781 TEE_Panic(0); 1782 if (!operation->key1) 1783 TEE_Panic(0); 1784 if (operation->info.mode != TEE_MODE_DERIVE) 1785 TEE_Panic(0); 1786 if ((operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) == 0) 1787 TEE_Panic(0); 1788 1789 res = utee_cryp_obj_get_info((unsigned long)derivedKey, &key_info); 1790 if (res != TEE_SUCCESS) 1791 TEE_Panic(res); 1792 1793 if (key_info.objectType != TEE_TYPE_GENERIC_SECRET) 1794 TEE_Panic(0); 1795 if ((key_info.handleFlags & TEE_HANDLE_FLAG_INITIALIZED) != 0) 1796 TEE_Panic(0); 1797 1798 __utee_from_attr(ua, params, paramCount); 1799 res = utee_cryp_derive_key(operation->state, ua, paramCount, 1800 (unsigned long)derivedKey); 1801 if (res != TEE_SUCCESS) 1802 TEE_Panic(res); 1803 } 1804 1805 /* Cryptographic Operations API - Random Number Generation Functions */ 1806 1807 void TEE_GenerateRandom(void *randomBuffer, uint32_t randomBufferLen) 1808 { 1809 TEE_Result res; 1810 1811 res = utee_cryp_random_number_generate(randomBuffer, randomBufferLen); 1812 if (res != TEE_SUCCESS) 1813 TEE_Panic(res); 1814 } 1815