1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2014, STMicroelectronics International N.V. 4 */ 5 #include <stdlib.h> 6 #include <string.h> 7 #include <string_ext.h> 8 9 #include <tee_api.h> 10 #include <tee_api_defines_extensions.h> 11 #include <tee_internal_api_extensions.h> 12 #include <utee_syscalls.h> 13 #include <utee_defines.h> 14 #include <util.h> 15 #include "tee_api_private.h" 16 17 struct __TEE_OperationHandle { 18 TEE_OperationInfo info; 19 TEE_ObjectHandle key1; 20 TEE_ObjectHandle key2; 21 uint32_t operationState;/* Operation state : INITIAL or ACTIVE */ 22 uint8_t *buffer; /* buffer to collect complete blocks */ 23 bool buffer_two_blocks; /* True if two blocks need to be buffered */ 24 size_t block_size; /* Block size of cipher */ 25 size_t buffer_offs; /* Offset in buffer */ 26 uint32_t state; /* Handle to state in TEE Core */ 27 uint32_t ae_tag_len; /* 28 * tag_len in bytes for AE operation else unused 29 */ 30 }; 31 32 /* Cryptographic Operations API - Generic Operation Functions */ 33 34 TEE_Result TEE_AllocateOperation(TEE_OperationHandle *operation, 35 uint32_t algorithm, uint32_t mode, 36 uint32_t maxKeySize) 37 { 38 TEE_Result res; 39 TEE_OperationHandle op = TEE_HANDLE_NULL; 40 uint32_t handle_state = 0; 41 size_t block_size = 1; 42 uint32_t req_key_usage; 43 bool with_private_key = false; 44 bool buffer_two_blocks = false; 45 46 if (!operation) 47 TEE_Panic(0); 48 49 if (algorithm == TEE_ALG_AES_XTS) 50 handle_state = TEE_HANDLE_FLAG_EXPECT_TWO_KEYS; 51 52 /* Check algorithm max key size */ 53 switch (algorithm) { 54 case TEE_ALG_DSA_SHA1: 55 if (maxKeySize < 512) 56 return TEE_ERROR_NOT_SUPPORTED; 57 if (maxKeySize > 1024) 58 return TEE_ERROR_NOT_SUPPORTED; 59 if (maxKeySize % 64 != 0) 60 return TEE_ERROR_NOT_SUPPORTED; 61 break; 62 63 case TEE_ALG_DSA_SHA224: 64 if (maxKeySize != 2048) 65 return TEE_ERROR_NOT_SUPPORTED; 66 break; 67 68 case TEE_ALG_DSA_SHA256: 69 if (maxKeySize != 2048 && maxKeySize != 3072) 70 return TEE_ERROR_NOT_SUPPORTED; 71 break; 72 73 case TEE_ALG_ECDSA_P192: 74 case TEE_ALG_ECDH_P192: 75 if (maxKeySize != 192) 76 return TEE_ERROR_NOT_SUPPORTED; 77 break; 78 79 case TEE_ALG_ECDSA_P224: 80 case TEE_ALG_ECDH_P224: 81 if (maxKeySize != 224) 82 return TEE_ERROR_NOT_SUPPORTED; 83 break; 84 85 case TEE_ALG_ECDSA_P256: 86 case TEE_ALG_ECDH_P256: 87 if (maxKeySize != 256) 88 return TEE_ERROR_NOT_SUPPORTED; 89 break; 90 91 case TEE_ALG_ECDSA_P384: 92 case TEE_ALG_ECDH_P384: 93 if (maxKeySize != 384) 94 return TEE_ERROR_NOT_SUPPORTED; 95 break; 96 97 case TEE_ALG_ECDSA_P521: 98 case TEE_ALG_ECDH_P521: 99 if (maxKeySize != 521) 100 return TEE_ERROR_NOT_SUPPORTED; 101 break; 102 103 default: 104 break; 105 } 106 107 /* Check algorithm mode */ 108 switch (algorithm) { 109 case TEE_ALG_AES_CTS: 110 case TEE_ALG_AES_XTS: 111 buffer_two_blocks = true; 112 /* FALLTHROUGH */ 113 case TEE_ALG_AES_ECB_NOPAD: 114 case TEE_ALG_AES_CBC_NOPAD: 115 case TEE_ALG_AES_CCM: 116 case TEE_ALG_DES_ECB_NOPAD: 117 case TEE_ALG_DES_CBC_NOPAD: 118 case TEE_ALG_DES3_ECB_NOPAD: 119 case TEE_ALG_DES3_CBC_NOPAD: 120 case TEE_ALG_SM4_ECB_NOPAD: 121 case TEE_ALG_SM4_CBC_NOPAD: 122 case TEE_ALG_SM4_CTR: 123 if (TEE_ALG_GET_MAIN_ALG(algorithm) == TEE_MAIN_ALGO_AES) 124 block_size = TEE_AES_BLOCK_SIZE; 125 else if (TEE_ALG_GET_MAIN_ALG(algorithm) == TEE_MAIN_ALGO_SM4) 126 block_size = TEE_SM4_BLOCK_SIZE; 127 else 128 block_size = TEE_DES_BLOCK_SIZE; 129 /* FALLTHROUGH */ 130 case TEE_ALG_AES_CTR: 131 case TEE_ALG_AES_GCM: 132 if (mode == TEE_MODE_ENCRYPT) 133 req_key_usage = TEE_USAGE_ENCRYPT; 134 else if (mode == TEE_MODE_DECRYPT) 135 req_key_usage = TEE_USAGE_DECRYPT; 136 else 137 return TEE_ERROR_NOT_SUPPORTED; 138 break; 139 140 #if defined(CFG_CRYPTO_RSASSA_NA1) 141 case TEE_ALG_RSASSA_PKCS1_V1_5: 142 #endif 143 case TEE_ALG_RSASSA_PKCS1_V1_5_MD5: 144 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA1: 145 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA224: 146 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA256: 147 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA384: 148 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA512: 149 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA1: 150 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA224: 151 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256: 152 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA384: 153 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA512: 154 case TEE_ALG_DSA_SHA1: 155 case TEE_ALG_DSA_SHA224: 156 case TEE_ALG_DSA_SHA256: 157 case TEE_ALG_ECDSA_P192: 158 case TEE_ALG_ECDSA_P224: 159 case TEE_ALG_ECDSA_P256: 160 case TEE_ALG_ECDSA_P384: 161 case TEE_ALG_ECDSA_P521: 162 if (mode == TEE_MODE_SIGN) { 163 with_private_key = true; 164 req_key_usage = TEE_USAGE_SIGN; 165 } else if (mode == TEE_MODE_VERIFY) { 166 req_key_usage = TEE_USAGE_VERIFY; 167 } else { 168 return TEE_ERROR_NOT_SUPPORTED; 169 } 170 break; 171 172 case TEE_ALG_RSAES_PKCS1_V1_5: 173 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA1: 174 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA224: 175 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA256: 176 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA384: 177 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA512: 178 if (mode == TEE_MODE_ENCRYPT) { 179 req_key_usage = TEE_USAGE_ENCRYPT; 180 } else if (mode == TEE_MODE_DECRYPT) { 181 with_private_key = true; 182 req_key_usage = TEE_USAGE_DECRYPT; 183 } else { 184 return TEE_ERROR_NOT_SUPPORTED; 185 } 186 break; 187 188 case TEE_ALG_RSA_NOPAD: 189 if (mode == TEE_MODE_ENCRYPT) { 190 req_key_usage = TEE_USAGE_ENCRYPT | TEE_USAGE_VERIFY; 191 } else if (mode == TEE_MODE_DECRYPT) { 192 with_private_key = true; 193 req_key_usage = TEE_USAGE_DECRYPT | TEE_USAGE_SIGN; 194 } else { 195 return TEE_ERROR_NOT_SUPPORTED; 196 } 197 break; 198 199 case TEE_ALG_DH_DERIVE_SHARED_SECRET: 200 case TEE_ALG_ECDH_P192: 201 case TEE_ALG_ECDH_P224: 202 case TEE_ALG_ECDH_P256: 203 case TEE_ALG_ECDH_P384: 204 case TEE_ALG_ECDH_P521: 205 case TEE_ALG_HKDF_MD5_DERIVE_KEY: 206 case TEE_ALG_HKDF_SHA1_DERIVE_KEY: 207 case TEE_ALG_HKDF_SHA224_DERIVE_KEY: 208 case TEE_ALG_HKDF_SHA256_DERIVE_KEY: 209 case TEE_ALG_HKDF_SHA384_DERIVE_KEY: 210 case TEE_ALG_HKDF_SHA512_DERIVE_KEY: 211 case TEE_ALG_CONCAT_KDF_SHA1_DERIVE_KEY: 212 case TEE_ALG_CONCAT_KDF_SHA224_DERIVE_KEY: 213 case TEE_ALG_CONCAT_KDF_SHA256_DERIVE_KEY: 214 case TEE_ALG_CONCAT_KDF_SHA384_DERIVE_KEY: 215 case TEE_ALG_CONCAT_KDF_SHA512_DERIVE_KEY: 216 case TEE_ALG_PBKDF2_HMAC_SHA1_DERIVE_KEY: 217 if (mode != TEE_MODE_DERIVE) 218 return TEE_ERROR_NOT_SUPPORTED; 219 with_private_key = true; 220 req_key_usage = TEE_USAGE_DERIVE; 221 break; 222 223 case TEE_ALG_MD5: 224 case TEE_ALG_SHA1: 225 case TEE_ALG_SHA224: 226 case TEE_ALG_SHA256: 227 case TEE_ALG_SHA384: 228 case TEE_ALG_SHA512: 229 case TEE_ALG_SM3: 230 if (mode != TEE_MODE_DIGEST) 231 return TEE_ERROR_NOT_SUPPORTED; 232 /* v1.1: flags always set for digest operations */ 233 handle_state |= TEE_HANDLE_FLAG_KEY_SET; 234 req_key_usage = 0; 235 break; 236 237 case TEE_ALG_DES_CBC_MAC_NOPAD: 238 case TEE_ALG_AES_CBC_MAC_NOPAD: 239 case TEE_ALG_AES_CBC_MAC_PKCS5: 240 case TEE_ALG_AES_CMAC: 241 case TEE_ALG_DES_CBC_MAC_PKCS5: 242 case TEE_ALG_DES3_CBC_MAC_NOPAD: 243 case TEE_ALG_DES3_CBC_MAC_PKCS5: 244 case TEE_ALG_HMAC_MD5: 245 case TEE_ALG_HMAC_SHA1: 246 case TEE_ALG_HMAC_SHA224: 247 case TEE_ALG_HMAC_SHA256: 248 case TEE_ALG_HMAC_SHA384: 249 case TEE_ALG_HMAC_SHA512: 250 case TEE_ALG_HMAC_SM3: 251 if (mode != TEE_MODE_MAC) 252 return TEE_ERROR_NOT_SUPPORTED; 253 req_key_usage = TEE_USAGE_MAC; 254 break; 255 256 default: 257 return TEE_ERROR_NOT_SUPPORTED; 258 } 259 260 op = TEE_Malloc(sizeof(*op), TEE_MALLOC_FILL_ZERO); 261 if (!op) 262 return TEE_ERROR_OUT_OF_MEMORY; 263 264 op->info.algorithm = algorithm; 265 op->info.operationClass = TEE_ALG_GET_CLASS(algorithm); 266 #ifdef CFG_CRYPTO_RSASSA_NA1 267 if (algorithm == TEE_ALG_RSASSA_PKCS1_V1_5) 268 op->info.operationClass = TEE_OPERATION_ASYMMETRIC_SIGNATURE; 269 #endif 270 op->info.mode = mode; 271 op->info.maxKeySize = maxKeySize; 272 op->info.requiredKeyUsage = req_key_usage; 273 op->info.handleState = handle_state; 274 275 if (block_size > 1) { 276 size_t buffer_size = block_size; 277 278 if (buffer_two_blocks) 279 buffer_size *= 2; 280 281 op->buffer = TEE_Malloc(buffer_size, 282 TEE_USER_MEM_HINT_NO_FILL_ZERO); 283 if (op->buffer == NULL) { 284 res = TEE_ERROR_OUT_OF_MEMORY; 285 goto out; 286 } 287 } 288 op->block_size = block_size; 289 op->buffer_two_blocks = buffer_two_blocks; 290 291 if (TEE_ALG_GET_CLASS(algorithm) != TEE_OPERATION_DIGEST) { 292 uint32_t mks = maxKeySize; 293 TEE_ObjectType key_type = TEE_ALG_GET_KEY_TYPE(algorithm, 294 with_private_key); 295 296 /* 297 * If two keys are expected the max key size is the sum of 298 * the size of both keys. 299 */ 300 if (op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) 301 mks /= 2; 302 303 res = TEE_AllocateTransientObject(key_type, mks, &op->key1); 304 if (res != TEE_SUCCESS) 305 goto out; 306 307 if (op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) { 308 res = TEE_AllocateTransientObject(key_type, mks, 309 &op->key2); 310 if (res != TEE_SUCCESS) 311 goto out; 312 } 313 } 314 315 res = utee_cryp_state_alloc(algorithm, mode, (unsigned long)op->key1, 316 (unsigned long)op->key2, &op->state); 317 if (res != TEE_SUCCESS) 318 goto out; 319 320 /* 321 * Initialize digest operations 322 * Other multi-stage operations initialized w/ TEE_xxxInit functions 323 * Non-applicable on asymmetric operations 324 */ 325 if (TEE_ALG_GET_CLASS(algorithm) == TEE_OPERATION_DIGEST) { 326 res = utee_hash_init(op->state, NULL, 0); 327 if (res != TEE_SUCCESS) 328 goto out; 329 /* v1.1: flags always set for digest operations */ 330 op->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 331 } 332 333 op->operationState = TEE_OPERATION_STATE_INITIAL; 334 335 *operation = op; 336 337 out: 338 if (res != TEE_SUCCESS) { 339 if (res != TEE_ERROR_OUT_OF_MEMORY && 340 res != TEE_ERROR_NOT_SUPPORTED) 341 TEE_Panic(res); 342 if (op) { 343 if (op->state) { 344 TEE_FreeOperation(op); 345 } else { 346 TEE_Free(op->buffer); 347 TEE_FreeTransientObject(op->key1); 348 TEE_FreeTransientObject(op->key2); 349 TEE_Free(op); 350 } 351 } 352 } 353 354 return res; 355 } 356 357 void TEE_FreeOperation(TEE_OperationHandle operation) 358 { 359 TEE_Result res; 360 361 if (operation == TEE_HANDLE_NULL) 362 TEE_Panic(0); 363 364 /* 365 * Note that keys should not be freed here, since they are 366 * claimed by the operation they will be freed by 367 * utee_cryp_state_free(). 368 */ 369 res = utee_cryp_state_free(operation->state); 370 if (res != TEE_SUCCESS) 371 TEE_Panic(res); 372 373 TEE_Free(operation->buffer); 374 TEE_Free(operation); 375 } 376 377 void TEE_GetOperationInfo(TEE_OperationHandle operation, 378 TEE_OperationInfo *operationInfo) 379 { 380 if (operation == TEE_HANDLE_NULL) 381 TEE_Panic(0); 382 383 if (!operationInfo) 384 TEE_Panic(0); 385 386 *operationInfo = operation->info; 387 } 388 389 TEE_Result TEE_GetOperationInfoMultiple(TEE_OperationHandle operation, 390 TEE_OperationInfoMultiple *operationInfoMultiple, 391 uint32_t *operationSize) 392 { 393 TEE_Result res = TEE_SUCCESS; 394 TEE_ObjectInfo key_info1; 395 TEE_ObjectInfo key_info2; 396 uint32_t num_of_keys; 397 size_t n; 398 399 if (operation == TEE_HANDLE_NULL) { 400 res = TEE_ERROR_BAD_PARAMETERS; 401 goto out; 402 } 403 404 if (!operationInfoMultiple) { 405 res = TEE_ERROR_BAD_PARAMETERS; 406 goto out; 407 } 408 409 if (!operationSize) { 410 res = TEE_ERROR_BAD_PARAMETERS; 411 goto out; 412 } 413 414 num_of_keys = (*operationSize-sizeof(TEE_OperationInfoMultiple))/ 415 sizeof(TEE_OperationInfoKey); 416 417 if (num_of_keys > 2) { 418 res = TEE_ERROR_BAD_PARAMETERS; 419 goto out; 420 } 421 422 /* Two keys flag (TEE_ALG_AES_XTS only) */ 423 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) != 424 0 && 425 (num_of_keys != 2)) { 426 res = TEE_ERROR_SHORT_BUFFER; 427 goto out; 428 } 429 430 /* Clear */ 431 for (n = 0; n < num_of_keys; n++) { 432 operationInfoMultiple->keyInformation[n].keySize = 0; 433 operationInfoMultiple->keyInformation[n].requiredKeyUsage = 0; 434 } 435 436 if (num_of_keys == 2) { 437 res = TEE_GetObjectInfo1(operation->key2, &key_info2); 438 /* Key2 is not a valid handle */ 439 if (res != TEE_SUCCESS) 440 goto out; 441 442 operationInfoMultiple->keyInformation[1].keySize = 443 key_info2.keySize; 444 operationInfoMultiple->keyInformation[1].requiredKeyUsage = 445 operation->info.requiredKeyUsage; 446 } 447 448 if (num_of_keys >= 1) { 449 res = TEE_GetObjectInfo1(operation->key1, &key_info1); 450 /* Key1 is not a valid handle */ 451 if (res != TEE_SUCCESS) { 452 if (num_of_keys == 2) { 453 operationInfoMultiple->keyInformation[1]. 454 keySize = 0; 455 operationInfoMultiple->keyInformation[1]. 456 requiredKeyUsage = 0; 457 } 458 goto out; 459 } 460 461 operationInfoMultiple->keyInformation[0].keySize = 462 key_info1.keySize; 463 operationInfoMultiple->keyInformation[0].requiredKeyUsage = 464 operation->info.requiredKeyUsage; 465 } 466 467 /* No key */ 468 operationInfoMultiple->algorithm = operation->info.algorithm; 469 operationInfoMultiple->operationClass = operation->info.operationClass; 470 operationInfoMultiple->mode = operation->info.mode; 471 operationInfoMultiple->digestLength = operation->info.digestLength; 472 operationInfoMultiple->maxKeySize = operation->info.maxKeySize; 473 operationInfoMultiple->handleState = operation->info.handleState; 474 operationInfoMultiple->operationState = operation->operationState; 475 operationInfoMultiple->numberOfKeys = num_of_keys; 476 477 out: 478 if (res != TEE_SUCCESS && 479 res != TEE_ERROR_SHORT_BUFFER) 480 TEE_Panic(res); 481 482 return res; 483 } 484 485 void TEE_ResetOperation(TEE_OperationHandle operation) 486 { 487 TEE_Result res; 488 489 if (operation == TEE_HANDLE_NULL) 490 TEE_Panic(0); 491 492 if (!(operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET)) 493 TEE_Panic(0); 494 495 operation->operationState = TEE_OPERATION_STATE_INITIAL; 496 497 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 498 res = utee_hash_init(operation->state, NULL, 0); 499 if (res != TEE_SUCCESS) 500 TEE_Panic(res); 501 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 502 } else { 503 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 504 } 505 } 506 507 TEE_Result TEE_SetOperationKey(TEE_OperationHandle operation, 508 TEE_ObjectHandle key) 509 { 510 TEE_Result res; 511 uint32_t key_size = 0; 512 TEE_ObjectInfo key_info; 513 514 if (operation == TEE_HANDLE_NULL) { 515 res = TEE_ERROR_BAD_PARAMETERS; 516 goto out; 517 } 518 519 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) { 520 res = TEE_ERROR_BAD_PARAMETERS; 521 goto out; 522 } 523 524 if (key == TEE_HANDLE_NULL) { 525 /* Operation key cleared */ 526 TEE_ResetTransientObject(operation->key1); 527 res = TEE_ERROR_BAD_PARAMETERS; 528 goto out; 529 } 530 531 /* No key for digest operation */ 532 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 533 res = TEE_ERROR_BAD_PARAMETERS; 534 goto out; 535 } 536 537 /* Two keys flag not expected (TEE_ALG_AES_XTS excluded) */ 538 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) != 539 0) { 540 res = TEE_ERROR_BAD_PARAMETERS; 541 goto out; 542 } 543 544 res = TEE_GetObjectInfo1(key, &key_info); 545 /* Key is not a valid handle */ 546 if (res != TEE_SUCCESS) 547 goto out; 548 549 /* Supplied key has to meet required usage */ 550 if ((key_info.objectUsage & operation->info.requiredKeyUsage) != 551 operation->info.requiredKeyUsage) { 552 res = TEE_ERROR_BAD_PARAMETERS; 553 goto out; 554 } 555 556 if (operation->info.maxKeySize < key_info.keySize) { 557 res = TEE_ERROR_BAD_PARAMETERS; 558 goto out; 559 } 560 561 key_size = key_info.keySize; 562 563 TEE_ResetTransientObject(operation->key1); 564 operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET; 565 566 res = TEE_CopyObjectAttributes1(operation->key1, key); 567 if (res != TEE_SUCCESS) 568 goto out; 569 570 operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET; 571 572 operation->info.keySize = key_size; 573 574 out: 575 if (res != TEE_SUCCESS && 576 res != TEE_ERROR_CORRUPT_OBJECT && 577 res != TEE_ERROR_STORAGE_NOT_AVAILABLE) 578 TEE_Panic(res); 579 580 return res; 581 } 582 583 TEE_Result TEE_SetOperationKey2(TEE_OperationHandle operation, 584 TEE_ObjectHandle key1, TEE_ObjectHandle key2) 585 { 586 TEE_Result res; 587 uint32_t key_size = 0; 588 TEE_ObjectInfo key_info1; 589 TEE_ObjectInfo key_info2; 590 591 if (operation == TEE_HANDLE_NULL) { 592 res = TEE_ERROR_BAD_PARAMETERS; 593 goto out; 594 } 595 596 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) { 597 res = TEE_ERROR_BAD_PARAMETERS; 598 goto out; 599 } 600 601 /* 602 * Key1/Key2 and/or are not initialized and 603 * Either both keys are NULL or both are not NULL 604 */ 605 if (key1 == TEE_HANDLE_NULL || key2 == TEE_HANDLE_NULL) { 606 /* Clear operation key1 (if needed) */ 607 if (key1 == TEE_HANDLE_NULL) 608 TEE_ResetTransientObject(operation->key1); 609 /* Clear operation key2 (if needed) */ 610 if (key2 == TEE_HANDLE_NULL) 611 TEE_ResetTransientObject(operation->key2); 612 res = TEE_ERROR_BAD_PARAMETERS; 613 goto out; 614 } 615 616 /* No key for digest operation */ 617 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 618 res = TEE_ERROR_BAD_PARAMETERS; 619 goto out; 620 } 621 622 /* Two keys flag expected (TEE_ALG_AES_XTS only) */ 623 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) == 624 0) { 625 res = TEE_ERROR_BAD_PARAMETERS; 626 goto out; 627 } 628 629 res = TEE_GetObjectInfo1(key1, &key_info1); 630 /* Key1 is not a valid handle */ 631 if (res != TEE_SUCCESS) 632 goto out; 633 634 /* Supplied key has to meet required usage */ 635 if ((key_info1.objectUsage & operation->info. 636 requiredKeyUsage) != operation->info.requiredKeyUsage) { 637 res = TEE_ERROR_BAD_PARAMETERS; 638 goto out; 639 } 640 641 res = TEE_GetObjectInfo1(key2, &key_info2); 642 /* Key2 is not a valid handle */ 643 if (res != TEE_SUCCESS) { 644 if (res == TEE_ERROR_CORRUPT_OBJECT) 645 res = TEE_ERROR_CORRUPT_OBJECT_2; 646 goto out; 647 } 648 649 /* Supplied key has to meet required usage */ 650 if ((key_info2.objectUsage & operation->info. 651 requiredKeyUsage) != operation->info.requiredKeyUsage) { 652 res = TEE_ERROR_BAD_PARAMETERS; 653 goto out; 654 } 655 656 /* 657 * AES-XTS (the only multi key algorithm supported, requires the 658 * keys to be of equal size. 659 */ 660 if (operation->info.algorithm == TEE_ALG_AES_XTS && 661 key_info1.keySize != key_info2.keySize) { 662 res = TEE_ERROR_BAD_PARAMETERS; 663 goto out; 664 665 } 666 667 if (operation->info.maxKeySize < key_info1.keySize) { 668 res = TEE_ERROR_BAD_PARAMETERS; 669 goto out; 670 } 671 672 /* 673 * Odd that only the size of one key should be reported while 674 * size of two key are used when allocating the operation. 675 */ 676 key_size = key_info1.keySize; 677 678 TEE_ResetTransientObject(operation->key1); 679 TEE_ResetTransientObject(operation->key2); 680 operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET; 681 682 res = TEE_CopyObjectAttributes1(operation->key1, key1); 683 if (res != TEE_SUCCESS) 684 goto out; 685 686 res = TEE_CopyObjectAttributes1(operation->key2, key2); 687 if (res != TEE_SUCCESS) { 688 if (res == TEE_ERROR_CORRUPT_OBJECT) 689 res = TEE_ERROR_CORRUPT_OBJECT_2; 690 goto out; 691 } 692 693 operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET; 694 695 operation->info.keySize = key_size; 696 697 out: 698 if (res != TEE_SUCCESS && 699 res != TEE_ERROR_CORRUPT_OBJECT && 700 res != TEE_ERROR_CORRUPT_OBJECT_2 && 701 res != TEE_ERROR_STORAGE_NOT_AVAILABLE && 702 res != TEE_ERROR_STORAGE_NOT_AVAILABLE_2) 703 TEE_Panic(res); 704 705 return res; 706 } 707 708 void TEE_CopyOperation(TEE_OperationHandle dst_op, TEE_OperationHandle src_op) 709 { 710 TEE_Result res; 711 712 if (dst_op == TEE_HANDLE_NULL || src_op == TEE_HANDLE_NULL) 713 TEE_Panic(0); 714 if (dst_op->info.algorithm != src_op->info.algorithm) 715 TEE_Panic(0); 716 if (src_op->info.operationClass != TEE_OPERATION_DIGEST) { 717 TEE_ObjectHandle key1 = TEE_HANDLE_NULL; 718 TEE_ObjectHandle key2 = TEE_HANDLE_NULL; 719 720 if (src_op->info.handleState & TEE_HANDLE_FLAG_KEY_SET) { 721 key1 = src_op->key1; 722 key2 = src_op->key2; 723 } 724 725 if ((src_op->info.handleState & 726 TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) == 0) { 727 TEE_SetOperationKey(dst_op, key1); 728 } else { 729 TEE_SetOperationKey2(dst_op, key1, key2); 730 } 731 } 732 dst_op->info.handleState = src_op->info.handleState; 733 dst_op->info.keySize = src_op->info.keySize; 734 dst_op->operationState = src_op->operationState; 735 736 if (dst_op->buffer_two_blocks != src_op->buffer_two_blocks || 737 dst_op->block_size != src_op->block_size) 738 TEE_Panic(0); 739 740 if (dst_op->buffer != NULL) { 741 if (src_op->buffer == NULL) 742 TEE_Panic(0); 743 744 memcpy(dst_op->buffer, src_op->buffer, src_op->buffer_offs); 745 dst_op->buffer_offs = src_op->buffer_offs; 746 } else if (src_op->buffer != NULL) { 747 TEE_Panic(0); 748 } 749 750 res = utee_cryp_state_copy(dst_op->state, src_op->state); 751 if (res != TEE_SUCCESS) 752 TEE_Panic(res); 753 } 754 755 /* Cryptographic Operations API - Message Digest Functions */ 756 757 static void init_hash_operation(TEE_OperationHandle operation, const void *IV, 758 uint32_t IVLen) 759 { 760 TEE_Result res; 761 762 /* 763 * Note : IV and IVLen are never used in current implementation 764 * This is why coherent values of IV and IVLen are not checked 765 */ 766 res = utee_hash_init(operation->state, IV, IVLen); 767 if (res != TEE_SUCCESS) 768 TEE_Panic(res); 769 operation->buffer_offs = 0; 770 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 771 } 772 773 void TEE_DigestUpdate(TEE_OperationHandle operation, 774 const void *chunk, uint32_t chunkSize) 775 { 776 TEE_Result res = TEE_ERROR_GENERIC; 777 778 if (operation == TEE_HANDLE_NULL || 779 operation->info.operationClass != TEE_OPERATION_DIGEST) 780 TEE_Panic(0); 781 782 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 783 784 res = utee_hash_update(operation->state, chunk, chunkSize); 785 if (res != TEE_SUCCESS) 786 TEE_Panic(res); 787 } 788 789 TEE_Result TEE_DigestDoFinal(TEE_OperationHandle operation, const void *chunk, 790 uint32_t chunkLen, void *hash, uint32_t *hashLen) 791 { 792 TEE_Result res; 793 uint64_t hl; 794 795 if ((operation == TEE_HANDLE_NULL) || 796 (!chunk && chunkLen) || 797 !hash || 798 !hashLen || 799 (operation->info.operationClass != TEE_OPERATION_DIGEST)) { 800 res = TEE_ERROR_BAD_PARAMETERS; 801 goto out; 802 } 803 804 hl = *hashLen; 805 res = utee_hash_final(operation->state, chunk, chunkLen, hash, &hl); 806 *hashLen = hl; 807 if (res != TEE_SUCCESS) 808 goto out; 809 810 /* Reset operation state */ 811 init_hash_operation(operation, NULL, 0); 812 813 operation->operationState = TEE_OPERATION_STATE_INITIAL; 814 815 out: 816 if (res != TEE_SUCCESS && 817 res != TEE_ERROR_SHORT_BUFFER) 818 TEE_Panic(res); 819 820 return res; 821 } 822 823 /* Cryptographic Operations API - Symmetric Cipher Functions */ 824 825 void TEE_CipherInit(TEE_OperationHandle operation, const void *IV, 826 uint32_t IVLen) 827 { 828 TEE_Result res; 829 830 if (operation == TEE_HANDLE_NULL) 831 TEE_Panic(0); 832 833 if (operation->info.operationClass != TEE_OPERATION_CIPHER) 834 TEE_Panic(0); 835 836 if (!(operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) || 837 !(operation->key1)) 838 TEE_Panic(0); 839 840 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) 841 TEE_ResetOperation(operation); 842 843 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 844 845 res = utee_cipher_init(operation->state, IV, IVLen); 846 if (res != TEE_SUCCESS) 847 TEE_Panic(res); 848 849 operation->buffer_offs = 0; 850 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 851 } 852 853 static TEE_Result tee_buffer_update( 854 TEE_OperationHandle op, 855 TEE_Result(*update_func)(unsigned long state, const void *src, 856 size_t slen, void *dst, uint64_t *dlen), 857 const void *src_data, size_t src_len, 858 void *dest_data, uint64_t *dest_len) 859 { 860 TEE_Result res; 861 const uint8_t *src = src_data; 862 size_t slen = src_len; 863 uint8_t *dst = dest_data; 864 size_t dlen = *dest_len; 865 size_t acc_dlen = 0; 866 uint64_t tmp_dlen; 867 size_t l; 868 size_t buffer_size; 869 size_t buffer_left; 870 871 if (!src) { 872 if (slen) 873 TEE_Panic(0); 874 goto out; 875 } 876 877 if (op->buffer_two_blocks) { 878 buffer_size = op->block_size * 2; 879 buffer_left = 1; 880 } else { 881 buffer_size = op->block_size; 882 buffer_left = 0; 883 } 884 885 if (op->buffer_offs > 0) { 886 /* Fill up complete block */ 887 if (op->buffer_offs < op->block_size) 888 l = MIN(slen, op->block_size - op->buffer_offs); 889 else 890 l = MIN(slen, buffer_size - op->buffer_offs); 891 memcpy(op->buffer + op->buffer_offs, src, l); 892 op->buffer_offs += l; 893 src += l; 894 slen -= l; 895 if ((op->buffer_offs % op->block_size) != 0) 896 goto out; /* Nothing left to do */ 897 } 898 899 /* If we can feed from buffer */ 900 if ((op->buffer_offs > 0) && 901 ((op->buffer_offs + slen) >= (buffer_size + buffer_left))) { 902 l = ROUNDUP(op->buffer_offs + slen - buffer_size, 903 op->block_size); 904 l = MIN(op->buffer_offs, l); 905 tmp_dlen = dlen; 906 res = update_func(op->state, op->buffer, l, dst, &tmp_dlen); 907 if (res != TEE_SUCCESS) 908 TEE_Panic(res); 909 dst += tmp_dlen; 910 dlen -= tmp_dlen; 911 acc_dlen += tmp_dlen; 912 op->buffer_offs -= l; 913 if (op->buffer_offs > 0) { 914 /* 915 * Slen is small enough to be contained in rest buffer. 916 */ 917 memcpy(op->buffer, op->buffer + l, buffer_size - l); 918 memcpy(op->buffer + op->buffer_offs, src, slen); 919 op->buffer_offs += slen; 920 goto out; /* Nothing left to do */ 921 } 922 } 923 924 if (slen >= (buffer_size + buffer_left)) { 925 /* Buffer is empty, feed as much as possible from src */ 926 if (op->info.algorithm == TEE_ALG_AES_CTS) 927 l = ROUNDUP(slen - buffer_size, op->block_size); 928 else 929 l = ROUNDUP(slen - buffer_size + 1, op->block_size); 930 931 tmp_dlen = dlen; 932 res = update_func(op->state, src, l, dst, &tmp_dlen); 933 if (res != TEE_SUCCESS) 934 TEE_Panic(res); 935 src += l; 936 slen -= l; 937 dst += tmp_dlen; 938 dlen -= tmp_dlen; 939 acc_dlen += tmp_dlen; 940 } 941 942 /* Slen is small enough to be contained in buffer. */ 943 memcpy(op->buffer + op->buffer_offs, src, slen); 944 op->buffer_offs += slen; 945 946 out: 947 *dest_len = acc_dlen; 948 return TEE_SUCCESS; 949 } 950 951 TEE_Result TEE_CipherUpdate(TEE_OperationHandle operation, const void *srcData, 952 uint32_t srcLen, void *destData, uint32_t *destLen) 953 { 954 TEE_Result res; 955 size_t req_dlen; 956 uint64_t dl; 957 958 if (operation == TEE_HANDLE_NULL || 959 (srcData == NULL && srcLen != 0) || 960 destLen == NULL || 961 (destData == NULL && *destLen != 0)) { 962 res = TEE_ERROR_BAD_PARAMETERS; 963 goto out; 964 } 965 966 if (operation->info.operationClass != TEE_OPERATION_CIPHER) { 967 res = TEE_ERROR_BAD_PARAMETERS; 968 goto out; 969 } 970 971 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 972 res = TEE_ERROR_BAD_PARAMETERS; 973 goto out; 974 } 975 976 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 977 res = TEE_ERROR_BAD_PARAMETERS; 978 goto out; 979 } 980 981 if (!srcData && !srcLen) { 982 *destLen = 0; 983 res = TEE_SUCCESS; 984 goto out; 985 } 986 987 /* Calculate required dlen */ 988 if (operation->block_size > 1) { 989 req_dlen = ((operation->buffer_offs + srcLen) / 990 operation->block_size) * operation->block_size; 991 } else { 992 req_dlen = srcLen; 993 } 994 if (operation->buffer_two_blocks) { 995 if (req_dlen > operation->block_size * 2) 996 req_dlen -= operation->block_size * 2; 997 else 998 req_dlen = 0; 999 } 1000 /* 1001 * Check that required destLen is big enough before starting to feed 1002 * data to the algorithm. Errors during feeding of data are fatal as we 1003 * can't restore sync with this API. 1004 */ 1005 if (*destLen < req_dlen) { 1006 *destLen = req_dlen; 1007 res = TEE_ERROR_SHORT_BUFFER; 1008 goto out; 1009 } 1010 1011 dl = *destLen; 1012 if (operation->block_size > 1) { 1013 res = tee_buffer_update(operation, utee_cipher_update, srcData, 1014 srcLen, destData, &dl); 1015 } else { 1016 if (srcLen > 0) { 1017 res = utee_cipher_update(operation->state, srcData, 1018 srcLen, destData, &dl); 1019 } else { 1020 res = TEE_SUCCESS; 1021 dl = 0; 1022 } 1023 } 1024 *destLen = dl; 1025 1026 out: 1027 if (res != TEE_SUCCESS && 1028 res != TEE_ERROR_SHORT_BUFFER) 1029 TEE_Panic(res); 1030 1031 return res; 1032 } 1033 1034 TEE_Result TEE_CipherDoFinal(TEE_OperationHandle operation, 1035 const void *srcData, uint32_t srcLen, 1036 void *destData, uint32_t *destLen) 1037 { 1038 TEE_Result res; 1039 uint8_t *dst = destData; 1040 size_t acc_dlen = 0; 1041 uint64_t tmp_dlen; 1042 size_t req_dlen; 1043 1044 if (operation == TEE_HANDLE_NULL || 1045 (srcData == NULL && srcLen != 0) || 1046 destLen == NULL || 1047 (destData == NULL && *destLen != 0)) { 1048 res = TEE_ERROR_BAD_PARAMETERS; 1049 goto out; 1050 } 1051 1052 if (operation->info.operationClass != TEE_OPERATION_CIPHER) { 1053 res = TEE_ERROR_BAD_PARAMETERS; 1054 goto out; 1055 } 1056 1057 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1058 res = TEE_ERROR_BAD_PARAMETERS; 1059 goto out; 1060 } 1061 1062 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 1063 res = TEE_ERROR_BAD_PARAMETERS; 1064 goto out; 1065 } 1066 1067 /* 1068 * Check that the final block doesn't require padding for those 1069 * algorithms that requires client to supply padding. 1070 */ 1071 if (operation->info.algorithm == TEE_ALG_AES_ECB_NOPAD || 1072 operation->info.algorithm == TEE_ALG_AES_CBC_NOPAD || 1073 operation->info.algorithm == TEE_ALG_DES_ECB_NOPAD || 1074 operation->info.algorithm == TEE_ALG_DES_CBC_NOPAD || 1075 operation->info.algorithm == TEE_ALG_DES3_ECB_NOPAD || 1076 operation->info.algorithm == TEE_ALG_DES3_CBC_NOPAD || 1077 operation->info.algorithm == TEE_ALG_SM4_ECB_NOPAD || 1078 operation->info.algorithm == TEE_ALG_SM4_CBC_NOPAD) { 1079 if (((operation->buffer_offs + srcLen) % operation->block_size) 1080 != 0) { 1081 res = TEE_ERROR_BAD_PARAMETERS; 1082 goto out; 1083 } 1084 } 1085 1086 /* 1087 * Check that required destLen is big enough before starting to feed 1088 * data to the algorithm. Errors during feeding of data are fatal as we 1089 * can't restore sync with this API. 1090 */ 1091 if (operation->block_size > 1) { 1092 req_dlen = operation->buffer_offs + srcLen; 1093 } else { 1094 req_dlen = srcLen; 1095 } 1096 if (*destLen < req_dlen) { 1097 *destLen = req_dlen; 1098 res = TEE_ERROR_SHORT_BUFFER; 1099 goto out; 1100 } 1101 1102 tmp_dlen = *destLen - acc_dlen; 1103 if (operation->block_size > 1) { 1104 res = tee_buffer_update(operation, utee_cipher_update, 1105 srcData, srcLen, dst, &tmp_dlen); 1106 if (res != TEE_SUCCESS) 1107 goto out; 1108 1109 dst += tmp_dlen; 1110 acc_dlen += tmp_dlen; 1111 1112 tmp_dlen = *destLen - acc_dlen; 1113 res = utee_cipher_final(operation->state, operation->buffer, 1114 operation->buffer_offs, dst, &tmp_dlen); 1115 } else { 1116 res = utee_cipher_final(operation->state, srcData, 1117 srcLen, dst, &tmp_dlen); 1118 } 1119 if (res != TEE_SUCCESS) 1120 goto out; 1121 1122 acc_dlen += tmp_dlen; 1123 *destLen = acc_dlen; 1124 1125 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1126 1127 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1128 1129 out: 1130 if (res != TEE_SUCCESS && 1131 res != TEE_ERROR_SHORT_BUFFER) 1132 TEE_Panic(res); 1133 1134 return res; 1135 } 1136 1137 /* Cryptographic Operations API - MAC Functions */ 1138 1139 void TEE_MACInit(TEE_OperationHandle operation, const void *IV, uint32_t IVLen) 1140 { 1141 if (operation == TEE_HANDLE_NULL) 1142 TEE_Panic(0); 1143 1144 if (operation->info.operationClass != TEE_OPERATION_MAC) 1145 TEE_Panic(0); 1146 1147 if (!(operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) || 1148 !(operation->key1)) 1149 TEE_Panic(0); 1150 1151 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) 1152 TEE_ResetOperation(operation); 1153 1154 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 1155 1156 init_hash_operation(operation, IV, IVLen); 1157 } 1158 1159 void TEE_MACUpdate(TEE_OperationHandle operation, const void *chunk, 1160 uint32_t chunkSize) 1161 { 1162 TEE_Result res; 1163 1164 if (operation == TEE_HANDLE_NULL || (chunk == NULL && chunkSize != 0)) 1165 TEE_Panic(0); 1166 1167 if (operation->info.operationClass != TEE_OPERATION_MAC) 1168 TEE_Panic(0); 1169 1170 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 1171 TEE_Panic(0); 1172 1173 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) 1174 TEE_Panic(0); 1175 1176 res = utee_hash_update(operation->state, chunk, chunkSize); 1177 if (res != TEE_SUCCESS) 1178 TEE_Panic(res); 1179 } 1180 1181 TEE_Result TEE_MACComputeFinal(TEE_OperationHandle operation, 1182 const void *message, uint32_t messageLen, 1183 void *mac, uint32_t *macLen) 1184 { 1185 TEE_Result res; 1186 uint64_t ml; 1187 1188 if (operation == TEE_HANDLE_NULL || 1189 (message == NULL && messageLen != 0) || 1190 mac == NULL || 1191 macLen == NULL) { 1192 res = TEE_ERROR_BAD_PARAMETERS; 1193 goto out; 1194 } 1195 1196 if (operation->info.operationClass != TEE_OPERATION_MAC) { 1197 res = TEE_ERROR_BAD_PARAMETERS; 1198 goto out; 1199 } 1200 1201 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1202 res = TEE_ERROR_BAD_PARAMETERS; 1203 goto out; 1204 } 1205 1206 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 1207 res = TEE_ERROR_BAD_PARAMETERS; 1208 goto out; 1209 } 1210 1211 ml = *macLen; 1212 res = utee_hash_final(operation->state, message, messageLen, mac, &ml); 1213 *macLen = ml; 1214 if (res != TEE_SUCCESS) 1215 goto out; 1216 1217 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1218 1219 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1220 1221 out: 1222 if (res != TEE_SUCCESS && 1223 res != TEE_ERROR_SHORT_BUFFER) 1224 TEE_Panic(res); 1225 1226 return res; 1227 } 1228 1229 TEE_Result TEE_MACCompareFinal(TEE_OperationHandle operation, 1230 const void *message, uint32_t messageLen, 1231 const void *mac, uint32_t macLen) 1232 { 1233 TEE_Result res; 1234 uint8_t computed_mac[TEE_MAX_HASH_SIZE]; 1235 uint32_t computed_mac_size = TEE_MAX_HASH_SIZE; 1236 1237 if (operation->info.operationClass != TEE_OPERATION_MAC) { 1238 res = TEE_ERROR_BAD_PARAMETERS; 1239 goto out; 1240 } 1241 1242 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1243 res = TEE_ERROR_BAD_PARAMETERS; 1244 goto out; 1245 } 1246 1247 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 1248 res = TEE_ERROR_BAD_PARAMETERS; 1249 goto out; 1250 } 1251 1252 res = TEE_MACComputeFinal(operation, message, messageLen, computed_mac, 1253 &computed_mac_size); 1254 if (res != TEE_SUCCESS) 1255 goto out; 1256 1257 if (computed_mac_size != macLen) { 1258 res = TEE_ERROR_MAC_INVALID; 1259 goto out; 1260 } 1261 1262 if (consttime_memcmp(mac, computed_mac, computed_mac_size) != 0) { 1263 res = TEE_ERROR_MAC_INVALID; 1264 goto out; 1265 } 1266 1267 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1268 1269 out: 1270 if (res != TEE_SUCCESS && 1271 res != TEE_ERROR_MAC_INVALID) 1272 TEE_Panic(res); 1273 1274 return res; 1275 } 1276 1277 /* Cryptographic Operations API - Authenticated Encryption Functions */ 1278 1279 TEE_Result TEE_AEInit(TEE_OperationHandle operation, const void *nonce, 1280 uint32_t nonceLen, uint32_t tagLen, uint32_t AADLen, 1281 uint32_t payloadLen) 1282 { 1283 TEE_Result res; 1284 1285 if (operation == TEE_HANDLE_NULL || nonce == NULL) { 1286 res = TEE_ERROR_BAD_PARAMETERS; 1287 goto out; 1288 } 1289 1290 if (operation->info.operationClass != TEE_OPERATION_AE) { 1291 res = TEE_ERROR_BAD_PARAMETERS; 1292 goto out; 1293 } 1294 1295 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) { 1296 res = TEE_ERROR_BAD_PARAMETERS; 1297 goto out; 1298 } 1299 1300 /* 1301 * AES-CCM tag len is specified by AES-CCM spec and handled in TEE Core 1302 * in the implementation. But AES-GCM spec doesn't specify the tag len 1303 * according to the same principle so we have to check here instead to 1304 * be GP compliant. 1305 */ 1306 if (operation->info.algorithm == TEE_ALG_AES_GCM) { 1307 /* 1308 * From GP spec: For AES-GCM, can be 128, 120, 112, 104, or 96 1309 */ 1310 if (tagLen < 96 || tagLen > 128 || (tagLen % 8 != 0)) { 1311 res = TEE_ERROR_NOT_SUPPORTED; 1312 goto out; 1313 } 1314 } 1315 1316 res = utee_authenc_init(operation->state, nonce, nonceLen, 1317 tagLen / 8, AADLen, payloadLen); 1318 if (res != TEE_SUCCESS) 1319 goto out; 1320 1321 operation->ae_tag_len = tagLen / 8; 1322 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 1323 1324 out: 1325 if (res != TEE_SUCCESS && 1326 res != TEE_ERROR_NOT_SUPPORTED) 1327 TEE_Panic(res); 1328 1329 return res; 1330 } 1331 1332 void TEE_AEUpdateAAD(TEE_OperationHandle operation, const void *AADdata, 1333 uint32_t AADdataLen) 1334 { 1335 TEE_Result res; 1336 1337 if (operation == TEE_HANDLE_NULL || 1338 (AADdata == NULL && AADdataLen != 0)) 1339 TEE_Panic(0); 1340 1341 if (operation->info.operationClass != TEE_OPERATION_AE) 1342 TEE_Panic(0); 1343 1344 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 1345 TEE_Panic(0); 1346 1347 res = utee_authenc_update_aad(operation->state, AADdata, AADdataLen); 1348 1349 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 1350 1351 if (res != TEE_SUCCESS) 1352 TEE_Panic(res); 1353 } 1354 1355 TEE_Result TEE_AEUpdate(TEE_OperationHandle operation, const void *srcData, 1356 uint32_t srcLen, void *destData, uint32_t *destLen) 1357 { 1358 TEE_Result res; 1359 size_t req_dlen; 1360 uint64_t dl; 1361 1362 if (operation == TEE_HANDLE_NULL || 1363 (srcData == NULL && srcLen != 0) || 1364 destLen == NULL || 1365 (destData == NULL && *destLen != 0)) { 1366 res = TEE_ERROR_BAD_PARAMETERS; 1367 goto out; 1368 } 1369 1370 if (operation->info.operationClass != TEE_OPERATION_AE) { 1371 res = TEE_ERROR_BAD_PARAMETERS; 1372 goto out; 1373 } 1374 1375 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1376 res = TEE_ERROR_BAD_PARAMETERS; 1377 goto out; 1378 } 1379 1380 if (!srcData && !srcLen) { 1381 *destLen = 0; 1382 res = TEE_SUCCESS; 1383 goto out; 1384 } 1385 1386 /* 1387 * Check that required destLen is big enough before starting to feed 1388 * data to the algorithm. Errors during feeding of data are fatal as we 1389 * can't restore sync with this API. 1390 */ 1391 if (operation->block_size > 1) { 1392 req_dlen = ROUNDDOWN(operation->buffer_offs + srcLen, 1393 operation->block_size); 1394 } else { 1395 req_dlen = srcLen; 1396 } 1397 1398 if (*destLen < req_dlen) { 1399 *destLen = req_dlen; 1400 res = TEE_ERROR_SHORT_BUFFER; 1401 goto out; 1402 } 1403 1404 dl = *destLen; 1405 if (operation->block_size > 1) { 1406 res = tee_buffer_update(operation, utee_authenc_update_payload, 1407 srcData, srcLen, destData, &dl); 1408 } else { 1409 if (srcLen > 0) { 1410 res = utee_authenc_update_payload(operation->state, 1411 srcData, srcLen, 1412 destData, &dl); 1413 } else { 1414 dl = 0; 1415 res = TEE_SUCCESS; 1416 } 1417 } 1418 if (res != TEE_SUCCESS) 1419 goto out; 1420 1421 *destLen = dl; 1422 1423 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 1424 1425 out: 1426 if (res != TEE_SUCCESS && 1427 res != TEE_ERROR_SHORT_BUFFER) 1428 TEE_Panic(res); 1429 1430 return res; 1431 } 1432 1433 TEE_Result TEE_AEEncryptFinal(TEE_OperationHandle operation, 1434 const void *srcData, uint32_t srcLen, 1435 void *destData, uint32_t *destLen, void *tag, 1436 uint32_t *tagLen) 1437 { 1438 TEE_Result res; 1439 uint8_t *dst = destData; 1440 size_t acc_dlen = 0; 1441 uint64_t tmp_dlen; 1442 size_t req_dlen; 1443 uint64_t tl; 1444 1445 if (operation == TEE_HANDLE_NULL || 1446 (srcData == NULL && srcLen != 0) || 1447 destLen == NULL || 1448 (destData == NULL && *destLen != 0) || 1449 tag == NULL || tagLen == NULL) { 1450 res = TEE_ERROR_BAD_PARAMETERS; 1451 goto out; 1452 } 1453 1454 if (operation->info.operationClass != TEE_OPERATION_AE) { 1455 res = TEE_ERROR_BAD_PARAMETERS; 1456 goto out; 1457 } 1458 1459 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1460 res = TEE_ERROR_BAD_PARAMETERS; 1461 goto out; 1462 } 1463 1464 /* 1465 * Check that required destLen is big enough before starting to feed 1466 * data to the algorithm. Errors during feeding of data are fatal as we 1467 * can't restore sync with this API. 1468 * 1469 * Need to check this before update_payload since sync would be lost if 1470 * we return short buffer after that. 1471 */ 1472 res = TEE_ERROR_GENERIC; 1473 1474 req_dlen = operation->buffer_offs + srcLen; 1475 if (*destLen < req_dlen) { 1476 *destLen = req_dlen; 1477 res = TEE_ERROR_SHORT_BUFFER; 1478 } 1479 1480 if (*tagLen < operation->ae_tag_len) { 1481 *tagLen = operation->ae_tag_len; 1482 res = TEE_ERROR_SHORT_BUFFER; 1483 } 1484 1485 if (res == TEE_ERROR_SHORT_BUFFER) 1486 goto out; 1487 1488 tl = *tagLen; 1489 tmp_dlen = *destLen - acc_dlen; 1490 if (operation->block_size > 1) { 1491 res = tee_buffer_update(operation, utee_authenc_update_payload, 1492 srcData, srcLen, dst, &tmp_dlen); 1493 if (res != TEE_SUCCESS) 1494 goto out; 1495 1496 dst += tmp_dlen; 1497 acc_dlen += tmp_dlen; 1498 1499 tmp_dlen = *destLen - acc_dlen; 1500 res = utee_authenc_enc_final(operation->state, 1501 operation->buffer, 1502 operation->buffer_offs, dst, 1503 &tmp_dlen, tag, &tl); 1504 } else { 1505 res = utee_authenc_enc_final(operation->state, srcData, 1506 srcLen, dst, &tmp_dlen, 1507 tag, &tl); 1508 } 1509 *tagLen = tl; 1510 if (res != TEE_SUCCESS) 1511 goto out; 1512 1513 acc_dlen += tmp_dlen; 1514 *destLen = acc_dlen; 1515 1516 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1517 1518 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1519 1520 out: 1521 if (res != TEE_SUCCESS && 1522 res != TEE_ERROR_SHORT_BUFFER) 1523 TEE_Panic(res); 1524 1525 return res; 1526 } 1527 1528 TEE_Result TEE_AEDecryptFinal(TEE_OperationHandle operation, 1529 const void *srcData, uint32_t srcLen, 1530 void *destData, uint32_t *destLen, void *tag, 1531 uint32_t tagLen) 1532 { 1533 TEE_Result res; 1534 uint8_t *dst = destData; 1535 size_t acc_dlen = 0; 1536 uint64_t tmp_dlen; 1537 size_t req_dlen; 1538 1539 if (operation == TEE_HANDLE_NULL || 1540 (srcData == NULL && srcLen != 0) || 1541 destLen == NULL || 1542 (destData == NULL && *destLen != 0) || 1543 (tag == NULL && tagLen != 0)) { 1544 res = TEE_ERROR_BAD_PARAMETERS; 1545 goto out; 1546 } 1547 1548 if (operation->info.operationClass != TEE_OPERATION_AE) { 1549 res = TEE_ERROR_BAD_PARAMETERS; 1550 goto out; 1551 } 1552 1553 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1554 res = TEE_ERROR_BAD_PARAMETERS; 1555 goto out; 1556 } 1557 1558 /* 1559 * Check that required destLen is big enough before starting to feed 1560 * data to the algorithm. Errors during feeding of data are fatal as we 1561 * can't restore sync with this API. 1562 */ 1563 req_dlen = operation->buffer_offs + srcLen; 1564 if (*destLen < req_dlen) { 1565 *destLen = req_dlen; 1566 res = TEE_ERROR_SHORT_BUFFER; 1567 goto out; 1568 } 1569 1570 tmp_dlen = *destLen - acc_dlen; 1571 if (operation->block_size > 1) { 1572 res = tee_buffer_update(operation, utee_authenc_update_payload, 1573 srcData, srcLen, dst, &tmp_dlen); 1574 if (res != TEE_SUCCESS) 1575 goto out; 1576 1577 dst += tmp_dlen; 1578 acc_dlen += tmp_dlen; 1579 1580 tmp_dlen = *destLen - acc_dlen; 1581 res = utee_authenc_dec_final(operation->state, 1582 operation->buffer, 1583 operation->buffer_offs, dst, 1584 &tmp_dlen, tag, tagLen); 1585 } else { 1586 res = utee_authenc_dec_final(operation->state, srcData, 1587 srcLen, dst, &tmp_dlen, 1588 tag, tagLen); 1589 } 1590 if (res != TEE_SUCCESS) 1591 goto out; 1592 1593 /* Supplied tagLen should match what we initiated with */ 1594 if (tagLen != operation->ae_tag_len) 1595 res = TEE_ERROR_MAC_INVALID; 1596 1597 acc_dlen += tmp_dlen; 1598 *destLen = acc_dlen; 1599 1600 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1601 1602 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1603 1604 out: 1605 if (res != TEE_SUCCESS && 1606 res != TEE_ERROR_SHORT_BUFFER && 1607 res != TEE_ERROR_MAC_INVALID) 1608 TEE_Panic(res); 1609 1610 return res; 1611 } 1612 1613 /* Cryptographic Operations API - Asymmetric Functions */ 1614 1615 TEE_Result TEE_AsymmetricEncrypt(TEE_OperationHandle operation, 1616 const TEE_Attribute *params, 1617 uint32_t paramCount, const void *srcData, 1618 uint32_t srcLen, void *destData, 1619 uint32_t *destLen) 1620 { 1621 TEE_Result res; 1622 struct utee_attribute ua[paramCount]; 1623 uint64_t dl; 1624 1625 if (operation == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 1626 destLen == NULL || (destData == NULL && *destLen != 0)) 1627 TEE_Panic(0); 1628 if (params == NULL && paramCount != 0) 1629 TEE_Panic(0); 1630 if (!operation->key1) 1631 TEE_Panic(0); 1632 if (operation->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER) 1633 TEE_Panic(0); 1634 if (operation->info.mode != TEE_MODE_ENCRYPT) 1635 TEE_Panic(0); 1636 1637 __utee_from_attr(ua, params, paramCount); 1638 dl = *destLen; 1639 res = utee_asymm_operate(operation->state, ua, paramCount, srcData, 1640 srcLen, destData, &dl); 1641 *destLen = dl; 1642 1643 if (res != TEE_SUCCESS && 1644 res != TEE_ERROR_SHORT_BUFFER && 1645 res != TEE_ERROR_BAD_PARAMETERS) 1646 TEE_Panic(res); 1647 1648 return res; 1649 } 1650 1651 TEE_Result TEE_AsymmetricDecrypt(TEE_OperationHandle operation, 1652 const TEE_Attribute *params, 1653 uint32_t paramCount, const void *srcData, 1654 uint32_t srcLen, void *destData, 1655 uint32_t *destLen) 1656 { 1657 TEE_Result res; 1658 struct utee_attribute ua[paramCount]; 1659 uint64_t dl; 1660 1661 if (operation == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 1662 destLen == NULL || (destData == NULL && *destLen != 0)) 1663 TEE_Panic(0); 1664 if (params == NULL && paramCount != 0) 1665 TEE_Panic(0); 1666 if (!operation->key1) 1667 TEE_Panic(0); 1668 if (operation->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER) 1669 TEE_Panic(0); 1670 if (operation->info.mode != TEE_MODE_DECRYPT) 1671 TEE_Panic(0); 1672 1673 __utee_from_attr(ua, params, paramCount); 1674 dl = *destLen; 1675 res = utee_asymm_operate(operation->state, ua, paramCount, srcData, 1676 srcLen, destData, &dl); 1677 *destLen = dl; 1678 1679 if (res != TEE_SUCCESS && 1680 res != TEE_ERROR_SHORT_BUFFER && 1681 res != TEE_ERROR_BAD_PARAMETERS) 1682 TEE_Panic(res); 1683 1684 return res; 1685 } 1686 1687 TEE_Result TEE_AsymmetricSignDigest(TEE_OperationHandle operation, 1688 const TEE_Attribute *params, 1689 uint32_t paramCount, const void *digest, 1690 uint32_t digestLen, void *signature, 1691 uint32_t *signatureLen) 1692 { 1693 TEE_Result res; 1694 struct utee_attribute ua[paramCount]; 1695 uint64_t sl; 1696 1697 if (operation == TEE_HANDLE_NULL || 1698 (digest == NULL && digestLen != 0) || 1699 signature == NULL || signatureLen == NULL) 1700 TEE_Panic(0); 1701 if (params == NULL && paramCount != 0) 1702 TEE_Panic(0); 1703 if (!operation->key1) 1704 TEE_Panic(0); 1705 if (operation->info.operationClass != 1706 TEE_OPERATION_ASYMMETRIC_SIGNATURE) 1707 TEE_Panic(0); 1708 if (operation->info.mode != TEE_MODE_SIGN) 1709 TEE_Panic(0); 1710 1711 __utee_from_attr(ua, params, paramCount); 1712 sl = *signatureLen; 1713 res = utee_asymm_operate(operation->state, ua, paramCount, digest, 1714 digestLen, signature, &sl); 1715 *signatureLen = sl; 1716 1717 if (res != TEE_SUCCESS && res != TEE_ERROR_SHORT_BUFFER) 1718 TEE_Panic(res); 1719 1720 return res; 1721 } 1722 1723 TEE_Result TEE_AsymmetricVerifyDigest(TEE_OperationHandle operation, 1724 const TEE_Attribute *params, 1725 uint32_t paramCount, const void *digest, 1726 uint32_t digestLen, 1727 const void *signature, 1728 uint32_t signatureLen) 1729 { 1730 TEE_Result res; 1731 struct utee_attribute ua[paramCount]; 1732 1733 if (operation == TEE_HANDLE_NULL || 1734 (digest == NULL && digestLen != 0) || 1735 (signature == NULL && signatureLen != 0)) 1736 TEE_Panic(0); 1737 if (params == NULL && paramCount != 0) 1738 TEE_Panic(0); 1739 if (!operation->key1) 1740 TEE_Panic(0); 1741 if (operation->info.operationClass != 1742 TEE_OPERATION_ASYMMETRIC_SIGNATURE) 1743 TEE_Panic(0); 1744 if (operation->info.mode != TEE_MODE_VERIFY) 1745 TEE_Panic(0); 1746 1747 __utee_from_attr(ua, params, paramCount); 1748 res = utee_asymm_verify(operation->state, ua, paramCount, digest, 1749 digestLen, signature, signatureLen); 1750 1751 if (res != TEE_SUCCESS && res != TEE_ERROR_SIGNATURE_INVALID) 1752 TEE_Panic(res); 1753 1754 return res; 1755 } 1756 1757 /* Cryptographic Operations API - Key Derivation Functions */ 1758 1759 void TEE_DeriveKey(TEE_OperationHandle operation, 1760 const TEE_Attribute *params, uint32_t paramCount, 1761 TEE_ObjectHandle derivedKey) 1762 { 1763 TEE_Result res; 1764 TEE_ObjectInfo key_info; 1765 struct utee_attribute ua[paramCount]; 1766 1767 if (operation == TEE_HANDLE_NULL || derivedKey == 0) 1768 TEE_Panic(0); 1769 if (params == NULL && paramCount != 0) 1770 TEE_Panic(0); 1771 if (TEE_ALG_GET_CLASS(operation->info.algorithm) != 1772 TEE_OPERATION_KEY_DERIVATION) 1773 TEE_Panic(0); 1774 1775 if (operation->info.operationClass != TEE_OPERATION_KEY_DERIVATION) 1776 TEE_Panic(0); 1777 if (!operation->key1) 1778 TEE_Panic(0); 1779 if (operation->info.mode != TEE_MODE_DERIVE) 1780 TEE_Panic(0); 1781 if ((operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) == 0) 1782 TEE_Panic(0); 1783 1784 res = utee_cryp_obj_get_info((unsigned long)derivedKey, &key_info); 1785 if (res != TEE_SUCCESS) 1786 TEE_Panic(res); 1787 1788 if (key_info.objectType != TEE_TYPE_GENERIC_SECRET) 1789 TEE_Panic(0); 1790 if ((key_info.handleFlags & TEE_HANDLE_FLAG_INITIALIZED) != 0) 1791 TEE_Panic(0); 1792 1793 __utee_from_attr(ua, params, paramCount); 1794 res = utee_cryp_derive_key(operation->state, ua, paramCount, 1795 (unsigned long)derivedKey); 1796 if (res != TEE_SUCCESS) 1797 TEE_Panic(res); 1798 } 1799 1800 /* Cryptographic Operations API - Random Number Generation Functions */ 1801 1802 void TEE_GenerateRandom(void *randomBuffer, uint32_t randomBufferLen) 1803 { 1804 TEE_Result res; 1805 1806 res = utee_cryp_random_number_generate(randomBuffer, randomBufferLen); 1807 if (res != TEE_SUCCESS) 1808 TEE_Panic(res); 1809 } 1810 1811 int rand(void) 1812 { 1813 int rc; 1814 1815 TEE_GenerateRandom(&rc, sizeof(rc)); 1816 1817 /* 1818 * RAND_MAX is the larges int, INT_MAX which is all bits but the 1819 * highest bit set. 1820 */ 1821 return rc & RAND_MAX; 1822 } 1823