1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2014, STMicroelectronics International N.V. 4 */ 5 #include <stdlib.h> 6 #include <string.h> 7 #include <string_ext.h> 8 9 #include <tee_api.h> 10 #include <tee_api_defines_extensions.h> 11 #include <tee_internal_api_extensions.h> 12 #include <utee_syscalls.h> 13 #include <utee_defines.h> 14 #include <util.h> 15 #include "tee_api_private.h" 16 17 struct __TEE_OperationHandle { 18 TEE_OperationInfo info; 19 TEE_ObjectHandle key1; 20 TEE_ObjectHandle key2; 21 uint32_t operationState;/* Operation state : INITIAL or ACTIVE */ 22 uint8_t *buffer; /* buffer to collect complete blocks */ 23 bool buffer_two_blocks; /* True if two blocks need to be buffered */ 24 size_t block_size; /* Block size of cipher */ 25 size_t buffer_offs; /* Offset in buffer */ 26 uint32_t state; /* Handle to state in TEE Core */ 27 uint32_t ae_tag_len; /* 28 * tag_len in bytes for AE operation else unused 29 */ 30 }; 31 32 /* Cryptographic Operations API - Generic Operation Functions */ 33 34 TEE_Result TEE_AllocateOperation(TEE_OperationHandle *operation, 35 uint32_t algorithm, uint32_t mode, 36 uint32_t maxKeySize) 37 { 38 TEE_Result res; 39 TEE_OperationHandle op = TEE_HANDLE_NULL; 40 uint32_t handle_state = 0; 41 size_t block_size = 1; 42 uint32_t req_key_usage; 43 bool with_private_key = false; 44 bool buffer_two_blocks = false; 45 46 if (!operation) 47 TEE_Panic(0); 48 49 if (algorithm == TEE_ALG_AES_XTS) 50 handle_state = TEE_HANDLE_FLAG_EXPECT_TWO_KEYS; 51 52 /* Check algorithm max key size */ 53 switch (algorithm) { 54 case TEE_ALG_DSA_SHA1: 55 if (maxKeySize < 512) 56 return TEE_ERROR_NOT_SUPPORTED; 57 if (maxKeySize > 1024) 58 return TEE_ERROR_NOT_SUPPORTED; 59 if (maxKeySize % 64 != 0) 60 return TEE_ERROR_NOT_SUPPORTED; 61 break; 62 63 case TEE_ALG_DSA_SHA224: 64 if (maxKeySize != 2048) 65 return TEE_ERROR_NOT_SUPPORTED; 66 break; 67 68 case TEE_ALG_DSA_SHA256: 69 if (maxKeySize != 2048 && maxKeySize != 3072) 70 return TEE_ERROR_NOT_SUPPORTED; 71 break; 72 73 case TEE_ALG_ECDSA_P192: 74 case TEE_ALG_ECDH_P192: 75 if (maxKeySize != 192) 76 return TEE_ERROR_NOT_SUPPORTED; 77 break; 78 79 case TEE_ALG_ECDSA_P224: 80 case TEE_ALG_ECDH_P224: 81 if (maxKeySize != 224) 82 return TEE_ERROR_NOT_SUPPORTED; 83 break; 84 85 case TEE_ALG_ECDSA_P256: 86 case TEE_ALG_ECDH_P256: 87 case TEE_ALG_SM2_PKE: 88 if (maxKeySize != 256) 89 return TEE_ERROR_NOT_SUPPORTED; 90 break; 91 92 case TEE_ALG_ECDSA_P384: 93 case TEE_ALG_ECDH_P384: 94 if (maxKeySize != 384) 95 return TEE_ERROR_NOT_SUPPORTED; 96 break; 97 98 case TEE_ALG_ECDSA_P521: 99 case TEE_ALG_ECDH_P521: 100 if (maxKeySize != 521) 101 return TEE_ERROR_NOT_SUPPORTED; 102 break; 103 104 default: 105 break; 106 } 107 108 /* Check algorithm mode */ 109 switch (algorithm) { 110 case TEE_ALG_AES_CTS: 111 case TEE_ALG_AES_XTS: 112 buffer_two_blocks = true; 113 /* FALLTHROUGH */ 114 case TEE_ALG_AES_ECB_NOPAD: 115 case TEE_ALG_AES_CBC_NOPAD: 116 case TEE_ALG_AES_CCM: 117 case TEE_ALG_DES_ECB_NOPAD: 118 case TEE_ALG_DES_CBC_NOPAD: 119 case TEE_ALG_DES3_ECB_NOPAD: 120 case TEE_ALG_DES3_CBC_NOPAD: 121 case TEE_ALG_SM4_ECB_NOPAD: 122 case TEE_ALG_SM4_CBC_NOPAD: 123 case TEE_ALG_SM4_CTR: 124 if (TEE_ALG_GET_MAIN_ALG(algorithm) == TEE_MAIN_ALGO_AES) 125 block_size = TEE_AES_BLOCK_SIZE; 126 else if (TEE_ALG_GET_MAIN_ALG(algorithm) == TEE_MAIN_ALGO_SM4) 127 block_size = TEE_SM4_BLOCK_SIZE; 128 else 129 block_size = TEE_DES_BLOCK_SIZE; 130 /* FALLTHROUGH */ 131 case TEE_ALG_AES_CTR: 132 case TEE_ALG_AES_GCM: 133 if (mode == TEE_MODE_ENCRYPT) 134 req_key_usage = TEE_USAGE_ENCRYPT; 135 else if (mode == TEE_MODE_DECRYPT) 136 req_key_usage = TEE_USAGE_DECRYPT; 137 else 138 return TEE_ERROR_NOT_SUPPORTED; 139 break; 140 141 #if defined(CFG_CRYPTO_RSASSA_NA1) 142 case TEE_ALG_RSASSA_PKCS1_V1_5: 143 #endif 144 case TEE_ALG_RSASSA_PKCS1_V1_5_MD5: 145 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA1: 146 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA224: 147 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA256: 148 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA384: 149 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA512: 150 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA1: 151 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA224: 152 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256: 153 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA384: 154 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA512: 155 case TEE_ALG_DSA_SHA1: 156 case TEE_ALG_DSA_SHA224: 157 case TEE_ALG_DSA_SHA256: 158 case TEE_ALG_ECDSA_P192: 159 case TEE_ALG_ECDSA_P224: 160 case TEE_ALG_ECDSA_P256: 161 case TEE_ALG_ECDSA_P384: 162 case TEE_ALG_ECDSA_P521: 163 if (mode == TEE_MODE_SIGN) { 164 with_private_key = true; 165 req_key_usage = TEE_USAGE_SIGN; 166 } else if (mode == TEE_MODE_VERIFY) { 167 req_key_usage = TEE_USAGE_VERIFY; 168 } else { 169 return TEE_ERROR_NOT_SUPPORTED; 170 } 171 break; 172 173 case TEE_ALG_RSAES_PKCS1_V1_5: 174 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA1: 175 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA224: 176 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA256: 177 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA384: 178 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA512: 179 case TEE_ALG_SM2_PKE: 180 if (mode == TEE_MODE_ENCRYPT) { 181 req_key_usage = TEE_USAGE_ENCRYPT; 182 } else if (mode == TEE_MODE_DECRYPT) { 183 with_private_key = true; 184 req_key_usage = TEE_USAGE_DECRYPT; 185 } else { 186 return TEE_ERROR_NOT_SUPPORTED; 187 } 188 break; 189 190 case TEE_ALG_RSA_NOPAD: 191 if (mode == TEE_MODE_ENCRYPT) { 192 req_key_usage = TEE_USAGE_ENCRYPT | TEE_USAGE_VERIFY; 193 } else if (mode == TEE_MODE_DECRYPT) { 194 with_private_key = true; 195 req_key_usage = TEE_USAGE_DECRYPT | TEE_USAGE_SIGN; 196 } else { 197 return TEE_ERROR_NOT_SUPPORTED; 198 } 199 break; 200 201 case TEE_ALG_DH_DERIVE_SHARED_SECRET: 202 case TEE_ALG_ECDH_P192: 203 case TEE_ALG_ECDH_P224: 204 case TEE_ALG_ECDH_P256: 205 case TEE_ALG_ECDH_P384: 206 case TEE_ALG_ECDH_P521: 207 case TEE_ALG_HKDF_MD5_DERIVE_KEY: 208 case TEE_ALG_HKDF_SHA1_DERIVE_KEY: 209 case TEE_ALG_HKDF_SHA224_DERIVE_KEY: 210 case TEE_ALG_HKDF_SHA256_DERIVE_KEY: 211 case TEE_ALG_HKDF_SHA384_DERIVE_KEY: 212 case TEE_ALG_HKDF_SHA512_DERIVE_KEY: 213 case TEE_ALG_CONCAT_KDF_SHA1_DERIVE_KEY: 214 case TEE_ALG_CONCAT_KDF_SHA224_DERIVE_KEY: 215 case TEE_ALG_CONCAT_KDF_SHA256_DERIVE_KEY: 216 case TEE_ALG_CONCAT_KDF_SHA384_DERIVE_KEY: 217 case TEE_ALG_CONCAT_KDF_SHA512_DERIVE_KEY: 218 case TEE_ALG_PBKDF2_HMAC_SHA1_DERIVE_KEY: 219 if (mode != TEE_MODE_DERIVE) 220 return TEE_ERROR_NOT_SUPPORTED; 221 with_private_key = true; 222 req_key_usage = TEE_USAGE_DERIVE; 223 break; 224 225 case TEE_ALG_MD5: 226 case TEE_ALG_SHA1: 227 case TEE_ALG_SHA224: 228 case TEE_ALG_SHA256: 229 case TEE_ALG_SHA384: 230 case TEE_ALG_SHA512: 231 case TEE_ALG_SM3: 232 if (mode != TEE_MODE_DIGEST) 233 return TEE_ERROR_NOT_SUPPORTED; 234 /* v1.1: flags always set for digest operations */ 235 handle_state |= TEE_HANDLE_FLAG_KEY_SET; 236 req_key_usage = 0; 237 break; 238 239 case TEE_ALG_DES_CBC_MAC_NOPAD: 240 case TEE_ALG_AES_CBC_MAC_NOPAD: 241 case TEE_ALG_AES_CBC_MAC_PKCS5: 242 case TEE_ALG_AES_CMAC: 243 case TEE_ALG_DES_CBC_MAC_PKCS5: 244 case TEE_ALG_DES3_CBC_MAC_NOPAD: 245 case TEE_ALG_DES3_CBC_MAC_PKCS5: 246 case TEE_ALG_HMAC_MD5: 247 case TEE_ALG_HMAC_SHA1: 248 case TEE_ALG_HMAC_SHA224: 249 case TEE_ALG_HMAC_SHA256: 250 case TEE_ALG_HMAC_SHA384: 251 case TEE_ALG_HMAC_SHA512: 252 case TEE_ALG_HMAC_SM3: 253 if (mode != TEE_MODE_MAC) 254 return TEE_ERROR_NOT_SUPPORTED; 255 req_key_usage = TEE_USAGE_MAC; 256 break; 257 258 default: 259 return TEE_ERROR_NOT_SUPPORTED; 260 } 261 262 op = TEE_Malloc(sizeof(*op), TEE_MALLOC_FILL_ZERO); 263 if (!op) 264 return TEE_ERROR_OUT_OF_MEMORY; 265 266 op->info.algorithm = algorithm; 267 op->info.operationClass = TEE_ALG_GET_CLASS(algorithm); 268 #ifdef CFG_CRYPTO_RSASSA_NA1 269 if (algorithm == TEE_ALG_RSASSA_PKCS1_V1_5) 270 op->info.operationClass = TEE_OPERATION_ASYMMETRIC_SIGNATURE; 271 #endif 272 op->info.mode = mode; 273 op->info.maxKeySize = maxKeySize; 274 op->info.requiredKeyUsage = req_key_usage; 275 op->info.handleState = handle_state; 276 277 if (block_size > 1) { 278 size_t buffer_size = block_size; 279 280 if (buffer_two_blocks) 281 buffer_size *= 2; 282 283 op->buffer = TEE_Malloc(buffer_size, 284 TEE_USER_MEM_HINT_NO_FILL_ZERO); 285 if (op->buffer == NULL) { 286 res = TEE_ERROR_OUT_OF_MEMORY; 287 goto out; 288 } 289 } 290 op->block_size = block_size; 291 op->buffer_two_blocks = buffer_two_blocks; 292 293 if (TEE_ALG_GET_CLASS(algorithm) != TEE_OPERATION_DIGEST) { 294 uint32_t mks = maxKeySize; 295 TEE_ObjectType key_type = TEE_ALG_GET_KEY_TYPE(algorithm, 296 with_private_key); 297 298 /* 299 * If two keys are expected the max key size is the sum of 300 * the size of both keys. 301 */ 302 if (op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) 303 mks /= 2; 304 305 res = TEE_AllocateTransientObject(key_type, mks, &op->key1); 306 if (res != TEE_SUCCESS) 307 goto out; 308 309 if (op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) { 310 res = TEE_AllocateTransientObject(key_type, mks, 311 &op->key2); 312 if (res != TEE_SUCCESS) 313 goto out; 314 } 315 } 316 317 res = utee_cryp_state_alloc(algorithm, mode, (unsigned long)op->key1, 318 (unsigned long)op->key2, &op->state); 319 if (res != TEE_SUCCESS) 320 goto out; 321 322 /* 323 * Initialize digest operations 324 * Other multi-stage operations initialized w/ TEE_xxxInit functions 325 * Non-applicable on asymmetric operations 326 */ 327 if (TEE_ALG_GET_CLASS(algorithm) == TEE_OPERATION_DIGEST) { 328 res = utee_hash_init(op->state, NULL, 0); 329 if (res != TEE_SUCCESS) 330 goto out; 331 /* v1.1: flags always set for digest operations */ 332 op->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 333 } 334 335 op->operationState = TEE_OPERATION_STATE_INITIAL; 336 337 *operation = op; 338 339 out: 340 if (res != TEE_SUCCESS) { 341 if (res != TEE_ERROR_OUT_OF_MEMORY && 342 res != TEE_ERROR_NOT_SUPPORTED) 343 TEE_Panic(res); 344 if (op) { 345 if (op->state) { 346 TEE_FreeOperation(op); 347 } else { 348 TEE_Free(op->buffer); 349 TEE_FreeTransientObject(op->key1); 350 TEE_FreeTransientObject(op->key2); 351 TEE_Free(op); 352 } 353 } 354 } 355 356 return res; 357 } 358 359 void TEE_FreeOperation(TEE_OperationHandle operation) 360 { 361 TEE_Result res; 362 363 if (operation == TEE_HANDLE_NULL) 364 TEE_Panic(0); 365 366 /* 367 * Note that keys should not be freed here, since they are 368 * claimed by the operation they will be freed by 369 * utee_cryp_state_free(). 370 */ 371 res = utee_cryp_state_free(operation->state); 372 if (res != TEE_SUCCESS) 373 TEE_Panic(res); 374 375 TEE_Free(operation->buffer); 376 TEE_Free(operation); 377 } 378 379 void TEE_GetOperationInfo(TEE_OperationHandle operation, 380 TEE_OperationInfo *operationInfo) 381 { 382 if (operation == TEE_HANDLE_NULL) 383 TEE_Panic(0); 384 385 if (!operationInfo) 386 TEE_Panic(0); 387 388 *operationInfo = operation->info; 389 } 390 391 TEE_Result TEE_GetOperationInfoMultiple(TEE_OperationHandle operation, 392 TEE_OperationInfoMultiple *operationInfoMultiple, 393 uint32_t *operationSize) 394 { 395 TEE_Result res = TEE_SUCCESS; 396 TEE_ObjectInfo key_info1; 397 TEE_ObjectInfo key_info2; 398 uint32_t num_of_keys; 399 size_t n; 400 401 if (operation == TEE_HANDLE_NULL) { 402 res = TEE_ERROR_BAD_PARAMETERS; 403 goto out; 404 } 405 406 if (!operationInfoMultiple) { 407 res = TEE_ERROR_BAD_PARAMETERS; 408 goto out; 409 } 410 411 if (!operationSize) { 412 res = TEE_ERROR_BAD_PARAMETERS; 413 goto out; 414 } 415 416 num_of_keys = (*operationSize-sizeof(TEE_OperationInfoMultiple))/ 417 sizeof(TEE_OperationInfoKey); 418 419 if (num_of_keys > 2) { 420 res = TEE_ERROR_BAD_PARAMETERS; 421 goto out; 422 } 423 424 /* Two keys flag (TEE_ALG_AES_XTS only) */ 425 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) != 426 0 && 427 (num_of_keys != 2)) { 428 res = TEE_ERROR_SHORT_BUFFER; 429 goto out; 430 } 431 432 /* Clear */ 433 for (n = 0; n < num_of_keys; n++) { 434 operationInfoMultiple->keyInformation[n].keySize = 0; 435 operationInfoMultiple->keyInformation[n].requiredKeyUsage = 0; 436 } 437 438 if (num_of_keys == 2) { 439 res = TEE_GetObjectInfo1(operation->key2, &key_info2); 440 /* Key2 is not a valid handle */ 441 if (res != TEE_SUCCESS) 442 goto out; 443 444 operationInfoMultiple->keyInformation[1].keySize = 445 key_info2.keySize; 446 operationInfoMultiple->keyInformation[1].requiredKeyUsage = 447 operation->info.requiredKeyUsage; 448 } 449 450 if (num_of_keys >= 1) { 451 res = TEE_GetObjectInfo1(operation->key1, &key_info1); 452 /* Key1 is not a valid handle */ 453 if (res != TEE_SUCCESS) { 454 if (num_of_keys == 2) { 455 operationInfoMultiple->keyInformation[1]. 456 keySize = 0; 457 operationInfoMultiple->keyInformation[1]. 458 requiredKeyUsage = 0; 459 } 460 goto out; 461 } 462 463 operationInfoMultiple->keyInformation[0].keySize = 464 key_info1.keySize; 465 operationInfoMultiple->keyInformation[0].requiredKeyUsage = 466 operation->info.requiredKeyUsage; 467 } 468 469 /* No key */ 470 operationInfoMultiple->algorithm = operation->info.algorithm; 471 operationInfoMultiple->operationClass = operation->info.operationClass; 472 operationInfoMultiple->mode = operation->info.mode; 473 operationInfoMultiple->digestLength = operation->info.digestLength; 474 operationInfoMultiple->maxKeySize = operation->info.maxKeySize; 475 operationInfoMultiple->handleState = operation->info.handleState; 476 operationInfoMultiple->operationState = operation->operationState; 477 operationInfoMultiple->numberOfKeys = num_of_keys; 478 479 out: 480 if (res != TEE_SUCCESS && 481 res != TEE_ERROR_SHORT_BUFFER) 482 TEE_Panic(res); 483 484 return res; 485 } 486 487 void TEE_ResetOperation(TEE_OperationHandle operation) 488 { 489 TEE_Result res; 490 491 if (operation == TEE_HANDLE_NULL) 492 TEE_Panic(0); 493 494 if (!(operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET)) 495 TEE_Panic(0); 496 497 operation->operationState = TEE_OPERATION_STATE_INITIAL; 498 499 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 500 res = utee_hash_init(operation->state, NULL, 0); 501 if (res != TEE_SUCCESS) 502 TEE_Panic(res); 503 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 504 } else { 505 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 506 } 507 } 508 509 TEE_Result TEE_SetOperationKey(TEE_OperationHandle operation, 510 TEE_ObjectHandle key) 511 { 512 TEE_Result res; 513 uint32_t key_size = 0; 514 TEE_ObjectInfo key_info; 515 516 if (operation == TEE_HANDLE_NULL) { 517 res = TEE_ERROR_BAD_PARAMETERS; 518 goto out; 519 } 520 521 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) { 522 res = TEE_ERROR_BAD_PARAMETERS; 523 goto out; 524 } 525 526 if (key == TEE_HANDLE_NULL) { 527 /* Operation key cleared */ 528 TEE_ResetTransientObject(operation->key1); 529 res = TEE_ERROR_BAD_PARAMETERS; 530 goto out; 531 } 532 533 /* No key for digest operation */ 534 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 535 res = TEE_ERROR_BAD_PARAMETERS; 536 goto out; 537 } 538 539 /* Two keys flag not expected (TEE_ALG_AES_XTS excluded) */ 540 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) != 541 0) { 542 res = TEE_ERROR_BAD_PARAMETERS; 543 goto out; 544 } 545 546 res = TEE_GetObjectInfo1(key, &key_info); 547 /* Key is not a valid handle */ 548 if (res != TEE_SUCCESS) 549 goto out; 550 551 /* Supplied key has to meet required usage */ 552 if ((key_info.objectUsage & operation->info.requiredKeyUsage) != 553 operation->info.requiredKeyUsage) { 554 res = TEE_ERROR_BAD_PARAMETERS; 555 goto out; 556 } 557 558 if (operation->info.maxKeySize < key_info.keySize) { 559 res = TEE_ERROR_BAD_PARAMETERS; 560 goto out; 561 } 562 563 key_size = key_info.keySize; 564 565 TEE_ResetTransientObject(operation->key1); 566 operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET; 567 568 res = TEE_CopyObjectAttributes1(operation->key1, key); 569 if (res != TEE_SUCCESS) 570 goto out; 571 572 operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET; 573 574 operation->info.keySize = key_size; 575 576 out: 577 if (res != TEE_SUCCESS && 578 res != TEE_ERROR_CORRUPT_OBJECT && 579 res != TEE_ERROR_STORAGE_NOT_AVAILABLE) 580 TEE_Panic(res); 581 582 return res; 583 } 584 585 TEE_Result TEE_SetOperationKey2(TEE_OperationHandle operation, 586 TEE_ObjectHandle key1, TEE_ObjectHandle key2) 587 { 588 TEE_Result res; 589 uint32_t key_size = 0; 590 TEE_ObjectInfo key_info1; 591 TEE_ObjectInfo key_info2; 592 593 if (operation == TEE_HANDLE_NULL) { 594 res = TEE_ERROR_BAD_PARAMETERS; 595 goto out; 596 } 597 598 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) { 599 res = TEE_ERROR_BAD_PARAMETERS; 600 goto out; 601 } 602 603 /* 604 * Key1/Key2 and/or are not initialized and 605 * Either both keys are NULL or both are not NULL 606 */ 607 if (key1 == TEE_HANDLE_NULL || key2 == TEE_HANDLE_NULL) { 608 /* Clear operation key1 (if needed) */ 609 if (key1 == TEE_HANDLE_NULL) 610 TEE_ResetTransientObject(operation->key1); 611 /* Clear operation key2 (if needed) */ 612 if (key2 == TEE_HANDLE_NULL) 613 TEE_ResetTransientObject(operation->key2); 614 res = TEE_ERROR_BAD_PARAMETERS; 615 goto out; 616 } 617 618 /* No key for digest operation */ 619 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 620 res = TEE_ERROR_BAD_PARAMETERS; 621 goto out; 622 } 623 624 /* Two keys flag expected (TEE_ALG_AES_XTS only) */ 625 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) == 626 0) { 627 res = TEE_ERROR_BAD_PARAMETERS; 628 goto out; 629 } 630 631 res = TEE_GetObjectInfo1(key1, &key_info1); 632 /* Key1 is not a valid handle */ 633 if (res != TEE_SUCCESS) 634 goto out; 635 636 /* Supplied key has to meet required usage */ 637 if ((key_info1.objectUsage & operation->info. 638 requiredKeyUsage) != operation->info.requiredKeyUsage) { 639 res = TEE_ERROR_BAD_PARAMETERS; 640 goto out; 641 } 642 643 res = TEE_GetObjectInfo1(key2, &key_info2); 644 /* Key2 is not a valid handle */ 645 if (res != TEE_SUCCESS) { 646 if (res == TEE_ERROR_CORRUPT_OBJECT) 647 res = TEE_ERROR_CORRUPT_OBJECT_2; 648 goto out; 649 } 650 651 /* Supplied key has to meet required usage */ 652 if ((key_info2.objectUsage & operation->info. 653 requiredKeyUsage) != operation->info.requiredKeyUsage) { 654 res = TEE_ERROR_BAD_PARAMETERS; 655 goto out; 656 } 657 658 /* 659 * AES-XTS (the only multi key algorithm supported, requires the 660 * keys to be of equal size. 661 */ 662 if (operation->info.algorithm == TEE_ALG_AES_XTS && 663 key_info1.keySize != key_info2.keySize) { 664 res = TEE_ERROR_BAD_PARAMETERS; 665 goto out; 666 667 } 668 669 if (operation->info.maxKeySize < key_info1.keySize) { 670 res = TEE_ERROR_BAD_PARAMETERS; 671 goto out; 672 } 673 674 /* 675 * Odd that only the size of one key should be reported while 676 * size of two key are used when allocating the operation. 677 */ 678 key_size = key_info1.keySize; 679 680 TEE_ResetTransientObject(operation->key1); 681 TEE_ResetTransientObject(operation->key2); 682 operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET; 683 684 res = TEE_CopyObjectAttributes1(operation->key1, key1); 685 if (res != TEE_SUCCESS) 686 goto out; 687 688 res = TEE_CopyObjectAttributes1(operation->key2, key2); 689 if (res != TEE_SUCCESS) { 690 if (res == TEE_ERROR_CORRUPT_OBJECT) 691 res = TEE_ERROR_CORRUPT_OBJECT_2; 692 goto out; 693 } 694 695 operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET; 696 697 operation->info.keySize = key_size; 698 699 out: 700 if (res != TEE_SUCCESS && 701 res != TEE_ERROR_CORRUPT_OBJECT && 702 res != TEE_ERROR_CORRUPT_OBJECT_2 && 703 res != TEE_ERROR_STORAGE_NOT_AVAILABLE && 704 res != TEE_ERROR_STORAGE_NOT_AVAILABLE_2) 705 TEE_Panic(res); 706 707 return res; 708 } 709 710 void TEE_CopyOperation(TEE_OperationHandle dst_op, TEE_OperationHandle src_op) 711 { 712 TEE_Result res; 713 714 if (dst_op == TEE_HANDLE_NULL || src_op == TEE_HANDLE_NULL) 715 TEE_Panic(0); 716 if (dst_op->info.algorithm != src_op->info.algorithm) 717 TEE_Panic(0); 718 if (src_op->info.operationClass != TEE_OPERATION_DIGEST) { 719 TEE_ObjectHandle key1 = TEE_HANDLE_NULL; 720 TEE_ObjectHandle key2 = TEE_HANDLE_NULL; 721 722 if (src_op->info.handleState & TEE_HANDLE_FLAG_KEY_SET) { 723 key1 = src_op->key1; 724 key2 = src_op->key2; 725 } 726 727 if ((src_op->info.handleState & 728 TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) == 0) { 729 TEE_SetOperationKey(dst_op, key1); 730 } else { 731 TEE_SetOperationKey2(dst_op, key1, key2); 732 } 733 } 734 dst_op->info.handleState = src_op->info.handleState; 735 dst_op->info.keySize = src_op->info.keySize; 736 dst_op->operationState = src_op->operationState; 737 738 if (dst_op->buffer_two_blocks != src_op->buffer_two_blocks || 739 dst_op->block_size != src_op->block_size) 740 TEE_Panic(0); 741 742 if (dst_op->buffer != NULL) { 743 if (src_op->buffer == NULL) 744 TEE_Panic(0); 745 746 memcpy(dst_op->buffer, src_op->buffer, src_op->buffer_offs); 747 dst_op->buffer_offs = src_op->buffer_offs; 748 } else if (src_op->buffer != NULL) { 749 TEE_Panic(0); 750 } 751 752 res = utee_cryp_state_copy(dst_op->state, src_op->state); 753 if (res != TEE_SUCCESS) 754 TEE_Panic(res); 755 } 756 757 /* Cryptographic Operations API - Message Digest Functions */ 758 759 static void init_hash_operation(TEE_OperationHandle operation, const void *IV, 760 uint32_t IVLen) 761 { 762 TEE_Result res; 763 764 /* 765 * Note : IV and IVLen are never used in current implementation 766 * This is why coherent values of IV and IVLen are not checked 767 */ 768 res = utee_hash_init(operation->state, IV, IVLen); 769 if (res != TEE_SUCCESS) 770 TEE_Panic(res); 771 operation->buffer_offs = 0; 772 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 773 } 774 775 void TEE_DigestUpdate(TEE_OperationHandle operation, 776 const void *chunk, uint32_t chunkSize) 777 { 778 TEE_Result res = TEE_ERROR_GENERIC; 779 780 if (operation == TEE_HANDLE_NULL || 781 operation->info.operationClass != TEE_OPERATION_DIGEST) 782 TEE_Panic(0); 783 784 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 785 786 res = utee_hash_update(operation->state, chunk, chunkSize); 787 if (res != TEE_SUCCESS) 788 TEE_Panic(res); 789 } 790 791 TEE_Result TEE_DigestDoFinal(TEE_OperationHandle operation, const void *chunk, 792 uint32_t chunkLen, void *hash, uint32_t *hashLen) 793 { 794 TEE_Result res; 795 uint64_t hl; 796 797 if ((operation == TEE_HANDLE_NULL) || 798 (!chunk && chunkLen) || 799 !hash || 800 !hashLen || 801 (operation->info.operationClass != TEE_OPERATION_DIGEST)) { 802 res = TEE_ERROR_BAD_PARAMETERS; 803 goto out; 804 } 805 806 hl = *hashLen; 807 res = utee_hash_final(operation->state, chunk, chunkLen, hash, &hl); 808 *hashLen = hl; 809 if (res != TEE_SUCCESS) 810 goto out; 811 812 /* Reset operation state */ 813 init_hash_operation(operation, NULL, 0); 814 815 operation->operationState = TEE_OPERATION_STATE_INITIAL; 816 817 out: 818 if (res != TEE_SUCCESS && 819 res != TEE_ERROR_SHORT_BUFFER) 820 TEE_Panic(res); 821 822 return res; 823 } 824 825 /* Cryptographic Operations API - Symmetric Cipher Functions */ 826 827 void TEE_CipherInit(TEE_OperationHandle operation, const void *IV, 828 uint32_t IVLen) 829 { 830 TEE_Result res; 831 832 if (operation == TEE_HANDLE_NULL) 833 TEE_Panic(0); 834 835 if (operation->info.operationClass != TEE_OPERATION_CIPHER) 836 TEE_Panic(0); 837 838 if (!(operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) || 839 !(operation->key1)) 840 TEE_Panic(0); 841 842 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) 843 TEE_ResetOperation(operation); 844 845 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 846 847 res = utee_cipher_init(operation->state, IV, IVLen); 848 if (res != TEE_SUCCESS) 849 TEE_Panic(res); 850 851 operation->buffer_offs = 0; 852 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 853 } 854 855 static TEE_Result tee_buffer_update( 856 TEE_OperationHandle op, 857 TEE_Result(*update_func)(unsigned long state, const void *src, 858 size_t slen, void *dst, uint64_t *dlen), 859 const void *src_data, size_t src_len, 860 void *dest_data, uint64_t *dest_len) 861 { 862 TEE_Result res; 863 const uint8_t *src = src_data; 864 size_t slen = src_len; 865 uint8_t *dst = dest_data; 866 size_t dlen = *dest_len; 867 size_t acc_dlen = 0; 868 uint64_t tmp_dlen; 869 size_t l; 870 size_t buffer_size; 871 size_t buffer_left; 872 873 if (!src) { 874 if (slen) 875 TEE_Panic(0); 876 goto out; 877 } 878 879 if (op->buffer_two_blocks) { 880 buffer_size = op->block_size * 2; 881 buffer_left = 1; 882 } else { 883 buffer_size = op->block_size; 884 buffer_left = 0; 885 } 886 887 if (op->buffer_offs > 0) { 888 /* Fill up complete block */ 889 if (op->buffer_offs < op->block_size) 890 l = MIN(slen, op->block_size - op->buffer_offs); 891 else 892 l = MIN(slen, buffer_size - op->buffer_offs); 893 memcpy(op->buffer + op->buffer_offs, src, l); 894 op->buffer_offs += l; 895 src += l; 896 slen -= l; 897 if ((op->buffer_offs % op->block_size) != 0) 898 goto out; /* Nothing left to do */ 899 } 900 901 /* If we can feed from buffer */ 902 if ((op->buffer_offs > 0) && 903 ((op->buffer_offs + slen) >= (buffer_size + buffer_left))) { 904 l = ROUNDUP(op->buffer_offs + slen - buffer_size, 905 op->block_size); 906 l = MIN(op->buffer_offs, l); 907 tmp_dlen = dlen; 908 res = update_func(op->state, op->buffer, l, dst, &tmp_dlen); 909 if (res != TEE_SUCCESS) 910 TEE_Panic(res); 911 dst += tmp_dlen; 912 dlen -= tmp_dlen; 913 acc_dlen += tmp_dlen; 914 op->buffer_offs -= l; 915 if (op->buffer_offs > 0) { 916 /* 917 * Slen is small enough to be contained in rest buffer. 918 */ 919 memcpy(op->buffer, op->buffer + l, buffer_size - l); 920 memcpy(op->buffer + op->buffer_offs, src, slen); 921 op->buffer_offs += slen; 922 goto out; /* Nothing left to do */ 923 } 924 } 925 926 if (slen >= (buffer_size + buffer_left)) { 927 /* Buffer is empty, feed as much as possible from src */ 928 if (op->info.algorithm == TEE_ALG_AES_CTS) 929 l = ROUNDUP(slen - buffer_size, op->block_size); 930 else 931 l = ROUNDUP(slen - buffer_size + 1, op->block_size); 932 933 tmp_dlen = dlen; 934 res = update_func(op->state, src, l, dst, &tmp_dlen); 935 if (res != TEE_SUCCESS) 936 TEE_Panic(res); 937 src += l; 938 slen -= l; 939 dst += tmp_dlen; 940 dlen -= tmp_dlen; 941 acc_dlen += tmp_dlen; 942 } 943 944 /* Slen is small enough to be contained in buffer. */ 945 memcpy(op->buffer + op->buffer_offs, src, slen); 946 op->buffer_offs += slen; 947 948 out: 949 *dest_len = acc_dlen; 950 return TEE_SUCCESS; 951 } 952 953 TEE_Result TEE_CipherUpdate(TEE_OperationHandle operation, const void *srcData, 954 uint32_t srcLen, void *destData, uint32_t *destLen) 955 { 956 TEE_Result res; 957 size_t req_dlen; 958 uint64_t dl; 959 960 if (operation == TEE_HANDLE_NULL || 961 (srcData == NULL && srcLen != 0) || 962 destLen == NULL || 963 (destData == NULL && *destLen != 0)) { 964 res = TEE_ERROR_BAD_PARAMETERS; 965 goto out; 966 } 967 968 if (operation->info.operationClass != TEE_OPERATION_CIPHER) { 969 res = TEE_ERROR_BAD_PARAMETERS; 970 goto out; 971 } 972 973 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 974 res = TEE_ERROR_BAD_PARAMETERS; 975 goto out; 976 } 977 978 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 979 res = TEE_ERROR_BAD_PARAMETERS; 980 goto out; 981 } 982 983 if (!srcData && !srcLen) { 984 *destLen = 0; 985 res = TEE_SUCCESS; 986 goto out; 987 } 988 989 /* Calculate required dlen */ 990 if (operation->block_size > 1) { 991 req_dlen = ((operation->buffer_offs + srcLen) / 992 operation->block_size) * operation->block_size; 993 } else { 994 req_dlen = srcLen; 995 } 996 if (operation->buffer_two_blocks) { 997 if (req_dlen > operation->block_size * 2) 998 req_dlen -= operation->block_size * 2; 999 else 1000 req_dlen = 0; 1001 } 1002 /* 1003 * Check that required destLen is big enough before starting to feed 1004 * data to the algorithm. Errors during feeding of data are fatal as we 1005 * can't restore sync with this API. 1006 */ 1007 if (*destLen < req_dlen) { 1008 *destLen = req_dlen; 1009 res = TEE_ERROR_SHORT_BUFFER; 1010 goto out; 1011 } 1012 1013 dl = *destLen; 1014 if (operation->block_size > 1) { 1015 res = tee_buffer_update(operation, utee_cipher_update, srcData, 1016 srcLen, destData, &dl); 1017 } else { 1018 if (srcLen > 0) { 1019 res = utee_cipher_update(operation->state, srcData, 1020 srcLen, destData, &dl); 1021 } else { 1022 res = TEE_SUCCESS; 1023 dl = 0; 1024 } 1025 } 1026 *destLen = dl; 1027 1028 out: 1029 if (res != TEE_SUCCESS && 1030 res != TEE_ERROR_SHORT_BUFFER) 1031 TEE_Panic(res); 1032 1033 return res; 1034 } 1035 1036 TEE_Result TEE_CipherDoFinal(TEE_OperationHandle operation, 1037 const void *srcData, uint32_t srcLen, 1038 void *destData, uint32_t *destLen) 1039 { 1040 TEE_Result res; 1041 uint8_t *dst = destData; 1042 size_t acc_dlen = 0; 1043 uint64_t tmp_dlen; 1044 size_t req_dlen; 1045 1046 if (operation == TEE_HANDLE_NULL || 1047 (srcData == NULL && srcLen != 0) || 1048 destLen == NULL || 1049 (destData == NULL && *destLen != 0)) { 1050 res = TEE_ERROR_BAD_PARAMETERS; 1051 goto out; 1052 } 1053 1054 if (operation->info.operationClass != TEE_OPERATION_CIPHER) { 1055 res = TEE_ERROR_BAD_PARAMETERS; 1056 goto out; 1057 } 1058 1059 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1060 res = TEE_ERROR_BAD_PARAMETERS; 1061 goto out; 1062 } 1063 1064 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 1065 res = TEE_ERROR_BAD_PARAMETERS; 1066 goto out; 1067 } 1068 1069 /* 1070 * Check that the final block doesn't require padding for those 1071 * algorithms that requires client to supply padding. 1072 */ 1073 if (operation->info.algorithm == TEE_ALG_AES_ECB_NOPAD || 1074 operation->info.algorithm == TEE_ALG_AES_CBC_NOPAD || 1075 operation->info.algorithm == TEE_ALG_DES_ECB_NOPAD || 1076 operation->info.algorithm == TEE_ALG_DES_CBC_NOPAD || 1077 operation->info.algorithm == TEE_ALG_DES3_ECB_NOPAD || 1078 operation->info.algorithm == TEE_ALG_DES3_CBC_NOPAD || 1079 operation->info.algorithm == TEE_ALG_SM4_ECB_NOPAD || 1080 operation->info.algorithm == TEE_ALG_SM4_CBC_NOPAD) { 1081 if (((operation->buffer_offs + srcLen) % operation->block_size) 1082 != 0) { 1083 res = TEE_ERROR_BAD_PARAMETERS; 1084 goto out; 1085 } 1086 } 1087 1088 /* 1089 * Check that required destLen is big enough before starting to feed 1090 * data to the algorithm. Errors during feeding of data are fatal as we 1091 * can't restore sync with this API. 1092 */ 1093 if (operation->block_size > 1) { 1094 req_dlen = operation->buffer_offs + srcLen; 1095 } else { 1096 req_dlen = srcLen; 1097 } 1098 if (*destLen < req_dlen) { 1099 *destLen = req_dlen; 1100 res = TEE_ERROR_SHORT_BUFFER; 1101 goto out; 1102 } 1103 1104 tmp_dlen = *destLen - acc_dlen; 1105 if (operation->block_size > 1) { 1106 res = tee_buffer_update(operation, utee_cipher_update, 1107 srcData, srcLen, dst, &tmp_dlen); 1108 if (res != TEE_SUCCESS) 1109 goto out; 1110 1111 dst += tmp_dlen; 1112 acc_dlen += tmp_dlen; 1113 1114 tmp_dlen = *destLen - acc_dlen; 1115 res = utee_cipher_final(operation->state, operation->buffer, 1116 operation->buffer_offs, dst, &tmp_dlen); 1117 } else { 1118 res = utee_cipher_final(operation->state, srcData, 1119 srcLen, dst, &tmp_dlen); 1120 } 1121 if (res != TEE_SUCCESS) 1122 goto out; 1123 1124 acc_dlen += tmp_dlen; 1125 *destLen = acc_dlen; 1126 1127 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1128 1129 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1130 1131 out: 1132 if (res != TEE_SUCCESS && 1133 res != TEE_ERROR_SHORT_BUFFER) 1134 TEE_Panic(res); 1135 1136 return res; 1137 } 1138 1139 /* Cryptographic Operations API - MAC Functions */ 1140 1141 void TEE_MACInit(TEE_OperationHandle operation, const void *IV, uint32_t IVLen) 1142 { 1143 if (operation == TEE_HANDLE_NULL) 1144 TEE_Panic(0); 1145 1146 if (operation->info.operationClass != TEE_OPERATION_MAC) 1147 TEE_Panic(0); 1148 1149 if (!(operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) || 1150 !(operation->key1)) 1151 TEE_Panic(0); 1152 1153 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) 1154 TEE_ResetOperation(operation); 1155 1156 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 1157 1158 init_hash_operation(operation, IV, IVLen); 1159 } 1160 1161 void TEE_MACUpdate(TEE_OperationHandle operation, const void *chunk, 1162 uint32_t chunkSize) 1163 { 1164 TEE_Result res; 1165 1166 if (operation == TEE_HANDLE_NULL || (chunk == NULL && chunkSize != 0)) 1167 TEE_Panic(0); 1168 1169 if (operation->info.operationClass != TEE_OPERATION_MAC) 1170 TEE_Panic(0); 1171 1172 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 1173 TEE_Panic(0); 1174 1175 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) 1176 TEE_Panic(0); 1177 1178 res = utee_hash_update(operation->state, chunk, chunkSize); 1179 if (res != TEE_SUCCESS) 1180 TEE_Panic(res); 1181 } 1182 1183 TEE_Result TEE_MACComputeFinal(TEE_OperationHandle operation, 1184 const void *message, uint32_t messageLen, 1185 void *mac, uint32_t *macLen) 1186 { 1187 TEE_Result res; 1188 uint64_t ml; 1189 1190 if (operation == TEE_HANDLE_NULL || 1191 (message == NULL && messageLen != 0) || 1192 mac == NULL || 1193 macLen == NULL) { 1194 res = TEE_ERROR_BAD_PARAMETERS; 1195 goto out; 1196 } 1197 1198 if (operation->info.operationClass != TEE_OPERATION_MAC) { 1199 res = TEE_ERROR_BAD_PARAMETERS; 1200 goto out; 1201 } 1202 1203 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1204 res = TEE_ERROR_BAD_PARAMETERS; 1205 goto out; 1206 } 1207 1208 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 1209 res = TEE_ERROR_BAD_PARAMETERS; 1210 goto out; 1211 } 1212 1213 ml = *macLen; 1214 res = utee_hash_final(operation->state, message, messageLen, mac, &ml); 1215 *macLen = ml; 1216 if (res != TEE_SUCCESS) 1217 goto out; 1218 1219 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1220 1221 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1222 1223 out: 1224 if (res != TEE_SUCCESS && 1225 res != TEE_ERROR_SHORT_BUFFER) 1226 TEE_Panic(res); 1227 1228 return res; 1229 } 1230 1231 TEE_Result TEE_MACCompareFinal(TEE_OperationHandle operation, 1232 const void *message, uint32_t messageLen, 1233 const void *mac, uint32_t macLen) 1234 { 1235 TEE_Result res; 1236 uint8_t computed_mac[TEE_MAX_HASH_SIZE]; 1237 uint32_t computed_mac_size = TEE_MAX_HASH_SIZE; 1238 1239 if (operation->info.operationClass != TEE_OPERATION_MAC) { 1240 res = TEE_ERROR_BAD_PARAMETERS; 1241 goto out; 1242 } 1243 1244 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1245 res = TEE_ERROR_BAD_PARAMETERS; 1246 goto out; 1247 } 1248 1249 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 1250 res = TEE_ERROR_BAD_PARAMETERS; 1251 goto out; 1252 } 1253 1254 res = TEE_MACComputeFinal(operation, message, messageLen, computed_mac, 1255 &computed_mac_size); 1256 if (res != TEE_SUCCESS) 1257 goto out; 1258 1259 if (computed_mac_size != macLen) { 1260 res = TEE_ERROR_MAC_INVALID; 1261 goto out; 1262 } 1263 1264 if (consttime_memcmp(mac, computed_mac, computed_mac_size) != 0) { 1265 res = TEE_ERROR_MAC_INVALID; 1266 goto out; 1267 } 1268 1269 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1270 1271 out: 1272 if (res != TEE_SUCCESS && 1273 res != TEE_ERROR_MAC_INVALID) 1274 TEE_Panic(res); 1275 1276 return res; 1277 } 1278 1279 /* Cryptographic Operations API - Authenticated Encryption Functions */ 1280 1281 TEE_Result TEE_AEInit(TEE_OperationHandle operation, const void *nonce, 1282 uint32_t nonceLen, uint32_t tagLen, uint32_t AADLen, 1283 uint32_t payloadLen) 1284 { 1285 TEE_Result res; 1286 1287 if (operation == TEE_HANDLE_NULL || nonce == NULL) { 1288 res = TEE_ERROR_BAD_PARAMETERS; 1289 goto out; 1290 } 1291 1292 if (operation->info.operationClass != TEE_OPERATION_AE) { 1293 res = TEE_ERROR_BAD_PARAMETERS; 1294 goto out; 1295 } 1296 1297 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) { 1298 res = TEE_ERROR_BAD_PARAMETERS; 1299 goto out; 1300 } 1301 1302 /* 1303 * AES-CCM tag len is specified by AES-CCM spec and handled in TEE Core 1304 * in the implementation. But AES-GCM spec doesn't specify the tag len 1305 * according to the same principle so we have to check here instead to 1306 * be GP compliant. 1307 */ 1308 if (operation->info.algorithm == TEE_ALG_AES_GCM) { 1309 /* 1310 * From GP spec: For AES-GCM, can be 128, 120, 112, 104, or 96 1311 */ 1312 if (tagLen < 96 || tagLen > 128 || (tagLen % 8 != 0)) { 1313 res = TEE_ERROR_NOT_SUPPORTED; 1314 goto out; 1315 } 1316 } 1317 1318 res = utee_authenc_init(operation->state, nonce, nonceLen, 1319 tagLen / 8, AADLen, payloadLen); 1320 if (res != TEE_SUCCESS) 1321 goto out; 1322 1323 operation->ae_tag_len = tagLen / 8; 1324 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 1325 1326 out: 1327 if (res != TEE_SUCCESS && 1328 res != TEE_ERROR_NOT_SUPPORTED) 1329 TEE_Panic(res); 1330 1331 return res; 1332 } 1333 1334 void TEE_AEUpdateAAD(TEE_OperationHandle operation, const void *AADdata, 1335 uint32_t AADdataLen) 1336 { 1337 TEE_Result res; 1338 1339 if (operation == TEE_HANDLE_NULL || 1340 (AADdata == NULL && AADdataLen != 0)) 1341 TEE_Panic(0); 1342 1343 if (operation->info.operationClass != TEE_OPERATION_AE) 1344 TEE_Panic(0); 1345 1346 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 1347 TEE_Panic(0); 1348 1349 res = utee_authenc_update_aad(operation->state, AADdata, AADdataLen); 1350 1351 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 1352 1353 if (res != TEE_SUCCESS) 1354 TEE_Panic(res); 1355 } 1356 1357 TEE_Result TEE_AEUpdate(TEE_OperationHandle operation, const void *srcData, 1358 uint32_t srcLen, void *destData, uint32_t *destLen) 1359 { 1360 TEE_Result res; 1361 size_t req_dlen; 1362 uint64_t dl; 1363 1364 if (operation == TEE_HANDLE_NULL || 1365 (srcData == NULL && srcLen != 0) || 1366 destLen == NULL || 1367 (destData == NULL && *destLen != 0)) { 1368 res = TEE_ERROR_BAD_PARAMETERS; 1369 goto out; 1370 } 1371 1372 if (operation->info.operationClass != TEE_OPERATION_AE) { 1373 res = TEE_ERROR_BAD_PARAMETERS; 1374 goto out; 1375 } 1376 1377 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1378 res = TEE_ERROR_BAD_PARAMETERS; 1379 goto out; 1380 } 1381 1382 if (!srcData && !srcLen) { 1383 *destLen = 0; 1384 res = TEE_SUCCESS; 1385 goto out; 1386 } 1387 1388 /* 1389 * Check that required destLen is big enough before starting to feed 1390 * data to the algorithm. Errors during feeding of data are fatal as we 1391 * can't restore sync with this API. 1392 */ 1393 if (operation->block_size > 1) { 1394 req_dlen = ROUNDDOWN(operation->buffer_offs + srcLen, 1395 operation->block_size); 1396 } else { 1397 req_dlen = srcLen; 1398 } 1399 1400 if (*destLen < req_dlen) { 1401 *destLen = req_dlen; 1402 res = TEE_ERROR_SHORT_BUFFER; 1403 goto out; 1404 } 1405 1406 dl = *destLen; 1407 if (operation->block_size > 1) { 1408 res = tee_buffer_update(operation, utee_authenc_update_payload, 1409 srcData, srcLen, destData, &dl); 1410 } else { 1411 if (srcLen > 0) { 1412 res = utee_authenc_update_payload(operation->state, 1413 srcData, srcLen, 1414 destData, &dl); 1415 } else { 1416 dl = 0; 1417 res = TEE_SUCCESS; 1418 } 1419 } 1420 if (res != TEE_SUCCESS) 1421 goto out; 1422 1423 *destLen = dl; 1424 1425 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 1426 1427 out: 1428 if (res != TEE_SUCCESS && 1429 res != TEE_ERROR_SHORT_BUFFER) 1430 TEE_Panic(res); 1431 1432 return res; 1433 } 1434 1435 TEE_Result TEE_AEEncryptFinal(TEE_OperationHandle operation, 1436 const void *srcData, uint32_t srcLen, 1437 void *destData, uint32_t *destLen, void *tag, 1438 uint32_t *tagLen) 1439 { 1440 TEE_Result res; 1441 uint8_t *dst = destData; 1442 size_t acc_dlen = 0; 1443 uint64_t tmp_dlen; 1444 size_t req_dlen; 1445 uint64_t tl; 1446 1447 if (operation == TEE_HANDLE_NULL || 1448 (srcData == NULL && srcLen != 0) || 1449 destLen == NULL || 1450 (destData == NULL && *destLen != 0) || 1451 tag == NULL || tagLen == NULL) { 1452 res = TEE_ERROR_BAD_PARAMETERS; 1453 goto out; 1454 } 1455 1456 if (operation->info.operationClass != TEE_OPERATION_AE) { 1457 res = TEE_ERROR_BAD_PARAMETERS; 1458 goto out; 1459 } 1460 1461 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1462 res = TEE_ERROR_BAD_PARAMETERS; 1463 goto out; 1464 } 1465 1466 /* 1467 * Check that required destLen is big enough before starting to feed 1468 * data to the algorithm. Errors during feeding of data are fatal as we 1469 * can't restore sync with this API. 1470 * 1471 * Need to check this before update_payload since sync would be lost if 1472 * we return short buffer after that. 1473 */ 1474 res = TEE_ERROR_GENERIC; 1475 1476 req_dlen = operation->buffer_offs + srcLen; 1477 if (*destLen < req_dlen) { 1478 *destLen = req_dlen; 1479 res = TEE_ERROR_SHORT_BUFFER; 1480 } 1481 1482 if (*tagLen < operation->ae_tag_len) { 1483 *tagLen = operation->ae_tag_len; 1484 res = TEE_ERROR_SHORT_BUFFER; 1485 } 1486 1487 if (res == TEE_ERROR_SHORT_BUFFER) 1488 goto out; 1489 1490 tl = *tagLen; 1491 tmp_dlen = *destLen - acc_dlen; 1492 if (operation->block_size > 1) { 1493 res = tee_buffer_update(operation, utee_authenc_update_payload, 1494 srcData, srcLen, dst, &tmp_dlen); 1495 if (res != TEE_SUCCESS) 1496 goto out; 1497 1498 dst += tmp_dlen; 1499 acc_dlen += tmp_dlen; 1500 1501 tmp_dlen = *destLen - acc_dlen; 1502 res = utee_authenc_enc_final(operation->state, 1503 operation->buffer, 1504 operation->buffer_offs, dst, 1505 &tmp_dlen, tag, &tl); 1506 } else { 1507 res = utee_authenc_enc_final(operation->state, srcData, 1508 srcLen, dst, &tmp_dlen, 1509 tag, &tl); 1510 } 1511 *tagLen = tl; 1512 if (res != TEE_SUCCESS) 1513 goto out; 1514 1515 acc_dlen += tmp_dlen; 1516 *destLen = acc_dlen; 1517 1518 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1519 1520 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1521 1522 out: 1523 if (res != TEE_SUCCESS && 1524 res != TEE_ERROR_SHORT_BUFFER) 1525 TEE_Panic(res); 1526 1527 return res; 1528 } 1529 1530 TEE_Result TEE_AEDecryptFinal(TEE_OperationHandle operation, 1531 const void *srcData, uint32_t srcLen, 1532 void *destData, uint32_t *destLen, void *tag, 1533 uint32_t tagLen) 1534 { 1535 TEE_Result res; 1536 uint8_t *dst = destData; 1537 size_t acc_dlen = 0; 1538 uint64_t tmp_dlen; 1539 size_t req_dlen; 1540 1541 if (operation == TEE_HANDLE_NULL || 1542 (srcData == NULL && srcLen != 0) || 1543 destLen == NULL || 1544 (destData == NULL && *destLen != 0) || 1545 (tag == NULL && tagLen != 0)) { 1546 res = TEE_ERROR_BAD_PARAMETERS; 1547 goto out; 1548 } 1549 1550 if (operation->info.operationClass != TEE_OPERATION_AE) { 1551 res = TEE_ERROR_BAD_PARAMETERS; 1552 goto out; 1553 } 1554 1555 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1556 res = TEE_ERROR_BAD_PARAMETERS; 1557 goto out; 1558 } 1559 1560 /* 1561 * Check that required destLen is big enough before starting to feed 1562 * data to the algorithm. Errors during feeding of data are fatal as we 1563 * can't restore sync with this API. 1564 */ 1565 req_dlen = operation->buffer_offs + srcLen; 1566 if (*destLen < req_dlen) { 1567 *destLen = req_dlen; 1568 res = TEE_ERROR_SHORT_BUFFER; 1569 goto out; 1570 } 1571 1572 tmp_dlen = *destLen - acc_dlen; 1573 if (operation->block_size > 1) { 1574 res = tee_buffer_update(operation, utee_authenc_update_payload, 1575 srcData, srcLen, dst, &tmp_dlen); 1576 if (res != TEE_SUCCESS) 1577 goto out; 1578 1579 dst += tmp_dlen; 1580 acc_dlen += tmp_dlen; 1581 1582 tmp_dlen = *destLen - acc_dlen; 1583 res = utee_authenc_dec_final(operation->state, 1584 operation->buffer, 1585 operation->buffer_offs, dst, 1586 &tmp_dlen, tag, tagLen); 1587 } else { 1588 res = utee_authenc_dec_final(operation->state, srcData, 1589 srcLen, dst, &tmp_dlen, 1590 tag, tagLen); 1591 } 1592 if (res != TEE_SUCCESS) 1593 goto out; 1594 1595 /* Supplied tagLen should match what we initiated with */ 1596 if (tagLen != operation->ae_tag_len) 1597 res = TEE_ERROR_MAC_INVALID; 1598 1599 acc_dlen += tmp_dlen; 1600 *destLen = acc_dlen; 1601 1602 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1603 1604 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1605 1606 out: 1607 if (res != TEE_SUCCESS && 1608 res != TEE_ERROR_SHORT_BUFFER && 1609 res != TEE_ERROR_MAC_INVALID) 1610 TEE_Panic(res); 1611 1612 return res; 1613 } 1614 1615 /* Cryptographic Operations API - Asymmetric Functions */ 1616 1617 TEE_Result TEE_AsymmetricEncrypt(TEE_OperationHandle operation, 1618 const TEE_Attribute *params, 1619 uint32_t paramCount, const void *srcData, 1620 uint32_t srcLen, void *destData, 1621 uint32_t *destLen) 1622 { 1623 TEE_Result res; 1624 struct utee_attribute ua[paramCount]; 1625 uint64_t dl; 1626 1627 if (operation == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 1628 destLen == NULL || (destData == NULL && *destLen != 0)) 1629 TEE_Panic(0); 1630 if (params == NULL && paramCount != 0) 1631 TEE_Panic(0); 1632 if (!operation->key1) 1633 TEE_Panic(0); 1634 if (operation->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER) 1635 TEE_Panic(0); 1636 if (operation->info.mode != TEE_MODE_ENCRYPT) 1637 TEE_Panic(0); 1638 1639 __utee_from_attr(ua, params, paramCount); 1640 dl = *destLen; 1641 res = utee_asymm_operate(operation->state, ua, paramCount, srcData, 1642 srcLen, destData, &dl); 1643 *destLen = dl; 1644 1645 if (res != TEE_SUCCESS && 1646 res != TEE_ERROR_SHORT_BUFFER && 1647 res != TEE_ERROR_BAD_PARAMETERS) 1648 TEE_Panic(res); 1649 1650 return res; 1651 } 1652 1653 TEE_Result TEE_AsymmetricDecrypt(TEE_OperationHandle operation, 1654 const TEE_Attribute *params, 1655 uint32_t paramCount, const void *srcData, 1656 uint32_t srcLen, void *destData, 1657 uint32_t *destLen) 1658 { 1659 TEE_Result res; 1660 struct utee_attribute ua[paramCount]; 1661 uint64_t dl; 1662 1663 if (operation == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 1664 destLen == NULL || (destData == NULL && *destLen != 0)) 1665 TEE_Panic(0); 1666 if (params == NULL && paramCount != 0) 1667 TEE_Panic(0); 1668 if (!operation->key1) 1669 TEE_Panic(0); 1670 if (operation->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER) 1671 TEE_Panic(0); 1672 if (operation->info.mode != TEE_MODE_DECRYPT) 1673 TEE_Panic(0); 1674 1675 __utee_from_attr(ua, params, paramCount); 1676 dl = *destLen; 1677 res = utee_asymm_operate(operation->state, ua, paramCount, srcData, 1678 srcLen, destData, &dl); 1679 *destLen = dl; 1680 1681 if (res != TEE_SUCCESS && 1682 res != TEE_ERROR_SHORT_BUFFER && 1683 res != TEE_ERROR_BAD_PARAMETERS) 1684 TEE_Panic(res); 1685 1686 return res; 1687 } 1688 1689 TEE_Result TEE_AsymmetricSignDigest(TEE_OperationHandle operation, 1690 const TEE_Attribute *params, 1691 uint32_t paramCount, const void *digest, 1692 uint32_t digestLen, void *signature, 1693 uint32_t *signatureLen) 1694 { 1695 TEE_Result res; 1696 struct utee_attribute ua[paramCount]; 1697 uint64_t sl; 1698 1699 if (operation == TEE_HANDLE_NULL || 1700 (digest == NULL && digestLen != 0) || 1701 signature == NULL || signatureLen == NULL) 1702 TEE_Panic(0); 1703 if (params == NULL && paramCount != 0) 1704 TEE_Panic(0); 1705 if (!operation->key1) 1706 TEE_Panic(0); 1707 if (operation->info.operationClass != 1708 TEE_OPERATION_ASYMMETRIC_SIGNATURE) 1709 TEE_Panic(0); 1710 if (operation->info.mode != TEE_MODE_SIGN) 1711 TEE_Panic(0); 1712 1713 __utee_from_attr(ua, params, paramCount); 1714 sl = *signatureLen; 1715 res = utee_asymm_operate(operation->state, ua, paramCount, digest, 1716 digestLen, signature, &sl); 1717 *signatureLen = sl; 1718 1719 if (res != TEE_SUCCESS && res != TEE_ERROR_SHORT_BUFFER) 1720 TEE_Panic(res); 1721 1722 return res; 1723 } 1724 1725 TEE_Result TEE_AsymmetricVerifyDigest(TEE_OperationHandle operation, 1726 const TEE_Attribute *params, 1727 uint32_t paramCount, const void *digest, 1728 uint32_t digestLen, 1729 const void *signature, 1730 uint32_t signatureLen) 1731 { 1732 TEE_Result res; 1733 struct utee_attribute ua[paramCount]; 1734 1735 if (operation == TEE_HANDLE_NULL || 1736 (digest == NULL && digestLen != 0) || 1737 (signature == NULL && signatureLen != 0)) 1738 TEE_Panic(0); 1739 if (params == NULL && paramCount != 0) 1740 TEE_Panic(0); 1741 if (!operation->key1) 1742 TEE_Panic(0); 1743 if (operation->info.operationClass != 1744 TEE_OPERATION_ASYMMETRIC_SIGNATURE) 1745 TEE_Panic(0); 1746 if (operation->info.mode != TEE_MODE_VERIFY) 1747 TEE_Panic(0); 1748 1749 __utee_from_attr(ua, params, paramCount); 1750 res = utee_asymm_verify(operation->state, ua, paramCount, digest, 1751 digestLen, signature, signatureLen); 1752 1753 if (res != TEE_SUCCESS && res != TEE_ERROR_SIGNATURE_INVALID) 1754 TEE_Panic(res); 1755 1756 return res; 1757 } 1758 1759 /* Cryptographic Operations API - Key Derivation Functions */ 1760 1761 void TEE_DeriveKey(TEE_OperationHandle operation, 1762 const TEE_Attribute *params, uint32_t paramCount, 1763 TEE_ObjectHandle derivedKey) 1764 { 1765 TEE_Result res; 1766 TEE_ObjectInfo key_info; 1767 struct utee_attribute ua[paramCount]; 1768 1769 if (operation == TEE_HANDLE_NULL || derivedKey == 0) 1770 TEE_Panic(0); 1771 if (params == NULL && paramCount != 0) 1772 TEE_Panic(0); 1773 if (TEE_ALG_GET_CLASS(operation->info.algorithm) != 1774 TEE_OPERATION_KEY_DERIVATION) 1775 TEE_Panic(0); 1776 1777 if (operation->info.operationClass != TEE_OPERATION_KEY_DERIVATION) 1778 TEE_Panic(0); 1779 if (!operation->key1) 1780 TEE_Panic(0); 1781 if (operation->info.mode != TEE_MODE_DERIVE) 1782 TEE_Panic(0); 1783 if ((operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) == 0) 1784 TEE_Panic(0); 1785 1786 res = utee_cryp_obj_get_info((unsigned long)derivedKey, &key_info); 1787 if (res != TEE_SUCCESS) 1788 TEE_Panic(res); 1789 1790 if (key_info.objectType != TEE_TYPE_GENERIC_SECRET) 1791 TEE_Panic(0); 1792 if ((key_info.handleFlags & TEE_HANDLE_FLAG_INITIALIZED) != 0) 1793 TEE_Panic(0); 1794 1795 __utee_from_attr(ua, params, paramCount); 1796 res = utee_cryp_derive_key(operation->state, ua, paramCount, 1797 (unsigned long)derivedKey); 1798 if (res != TEE_SUCCESS) 1799 TEE_Panic(res); 1800 } 1801 1802 /* Cryptographic Operations API - Random Number Generation Functions */ 1803 1804 void TEE_GenerateRandom(void *randomBuffer, uint32_t randomBufferLen) 1805 { 1806 TEE_Result res; 1807 1808 res = utee_cryp_random_number_generate(randomBuffer, randomBufferLen); 1809 if (res != TEE_SUCCESS) 1810 TEE_Panic(res); 1811 } 1812 1813 int rand(void) 1814 { 1815 int rc; 1816 1817 TEE_GenerateRandom(&rc, sizeof(rc)); 1818 1819 /* 1820 * RAND_MAX is the larges int, INT_MAX which is all bits but the 1821 * highest bit set. 1822 */ 1823 return rc & RAND_MAX; 1824 } 1825