1 /* 2 * Copyright (c) 2014, STMicroelectronics International N.V. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions are met: 7 * 8 * 1. Redistributions of source code must retain the above copyright notice, 9 * this list of conditions and the following disclaimer. 10 * 11 * 2. Redistributions in binary form must reproduce the above copyright notice, 12 * this list of conditions and the following disclaimer in the documentation 13 * and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 16 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 19 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 * POSSIBILITY OF SUCH DAMAGE. 26 */ 27 #include <stdlib.h> 28 #include <string.h> 29 #include <string_ext.h> 30 31 #include <tee_api.h> 32 #include <tee_internal_api_extensions.h> 33 #include <utee_syscalls.h> 34 #include <utee_defines.h> 35 36 struct __TEE_OperationHandle { 37 TEE_OperationInfo info; 38 TEE_ObjectHandle key1; 39 TEE_ObjectHandle key2; 40 uint8_t *buffer; /* buffer to collect complete blocks */ 41 bool buffer_two_blocks; /* True if two blocks need to be buffered */ 42 size_t block_size; /* Block size of cipher */ 43 size_t buffer_offs; /* Offset in buffer */ 44 uint32_t state; /* Handle to state in TEE Core */ 45 uint32_t ae_tag_len; /* 46 * tag_len in bytes for AE operation else unused 47 */ 48 }; 49 50 /* Cryptographic Operations API - Generic Operation Functions */ 51 52 TEE_Result TEE_AllocateOperation(TEE_OperationHandle *operation, 53 uint32_t algorithm, uint32_t mode, 54 uint32_t maxKeySize) 55 { 56 TEE_Result res; 57 TEE_OperationHandle op = TEE_HANDLE_NULL; 58 uint32_t handle_state = 0; 59 size_t block_size = 1; 60 uint32_t req_key_usage; 61 bool with_private_key = false; 62 bool buffer_two_blocks = false; 63 64 if (operation == NULL) 65 TEE_Panic(0); 66 67 if (algorithm == TEE_ALG_AES_XTS) 68 handle_state = TEE_HANDLE_FLAG_EXPECT_TWO_KEYS; 69 70 switch (algorithm) { 71 case TEE_ALG_AES_CTS: 72 case TEE_ALG_AES_XTS: 73 buffer_two_blocks = true; 74 /*FALLTHROUGH*/ case TEE_ALG_AES_ECB_NOPAD: 75 case TEE_ALG_AES_CBC_NOPAD: 76 case TEE_ALG_AES_CTR: 77 case TEE_ALG_AES_CCM: 78 case TEE_ALG_AES_GCM: 79 case TEE_ALG_DES_ECB_NOPAD: 80 case TEE_ALG_DES_CBC_NOPAD: 81 case TEE_ALG_DES3_ECB_NOPAD: 82 case TEE_ALG_DES3_CBC_NOPAD: 83 if (TEE_ALG_GET_MAIN_ALG(algorithm) == TEE_MAIN_ALGO_AES) 84 block_size = TEE_AES_BLOCK_SIZE; 85 else 86 block_size = TEE_DES_BLOCK_SIZE; 87 88 if (mode == TEE_MODE_ENCRYPT) 89 req_key_usage = TEE_USAGE_ENCRYPT; 90 else if (mode == TEE_MODE_DECRYPT) 91 req_key_usage = TEE_USAGE_DECRYPT; 92 else 93 return TEE_ERROR_NOT_SUPPORTED; 94 break; 95 96 case TEE_ALG_RSASSA_PKCS1_V1_5_MD5: 97 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA1: 98 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA224: 99 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA256: 100 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA384: 101 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA512: 102 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA1: 103 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA224: 104 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256: 105 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA384: 106 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA512: 107 case TEE_ALG_DSA_SHA1: 108 if (mode == TEE_MODE_SIGN) { 109 with_private_key = true; 110 req_key_usage = TEE_USAGE_SIGN; 111 } else if (mode == TEE_MODE_VERIFY) { 112 req_key_usage = TEE_USAGE_VERIFY; 113 } else { 114 return TEE_ERROR_NOT_SUPPORTED; 115 } 116 break; 117 118 case TEE_ALG_RSAES_PKCS1_V1_5: 119 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA1: 120 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA224: 121 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA256: 122 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA384: 123 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA512: 124 if (mode == TEE_MODE_ENCRYPT) { 125 req_key_usage = TEE_USAGE_ENCRYPT; 126 } else if (mode == TEE_MODE_DECRYPT) { 127 with_private_key = true; 128 req_key_usage = TEE_USAGE_DECRYPT; 129 } else { 130 return TEE_ERROR_NOT_SUPPORTED; 131 } 132 break; 133 134 case TEE_ALG_RSA_NOPAD: 135 if (mode == TEE_MODE_ENCRYPT) { 136 req_key_usage = TEE_USAGE_ENCRYPT | TEE_USAGE_VERIFY; 137 } else if (mode == TEE_MODE_DECRYPT) { 138 with_private_key = true; 139 req_key_usage = TEE_USAGE_DECRYPT | TEE_USAGE_SIGN; 140 } else { 141 return TEE_ERROR_NOT_SUPPORTED; 142 } 143 break; 144 145 case TEE_ALG_DH_DERIVE_SHARED_SECRET: 146 if (mode != TEE_MODE_DERIVE) 147 return TEE_ERROR_NOT_SUPPORTED; 148 with_private_key = true; 149 req_key_usage = TEE_USAGE_DERIVE; 150 break; 151 152 case TEE_ALG_MD5: 153 case TEE_ALG_SHA1: 154 case TEE_ALG_SHA224: 155 case TEE_ALG_SHA256: 156 case TEE_ALG_SHA384: 157 case TEE_ALG_SHA512: 158 if (mode != TEE_MODE_DIGEST) 159 return TEE_ERROR_NOT_SUPPORTED; 160 handle_state |= TEE_HANDLE_FLAG_KEY_SET; 161 req_key_usage = 0; 162 break; 163 164 case TEE_ALG_DES_CBC_MAC_NOPAD: 165 case TEE_ALG_AES_CBC_MAC_NOPAD: 166 case TEE_ALG_AES_CBC_MAC_PKCS5: 167 case TEE_ALG_AES_CMAC: 168 case TEE_ALG_DES_CBC_MAC_PKCS5: 169 case TEE_ALG_DES3_CBC_MAC_NOPAD: 170 case TEE_ALG_DES3_CBC_MAC_PKCS5: 171 case TEE_ALG_HMAC_MD5: 172 case TEE_ALG_HMAC_SHA1: 173 case TEE_ALG_HMAC_SHA224: 174 case TEE_ALG_HMAC_SHA256: 175 case TEE_ALG_HMAC_SHA384: 176 case TEE_ALG_HMAC_SHA512: 177 if (mode != TEE_MODE_MAC) 178 return TEE_ERROR_NOT_SUPPORTED; 179 req_key_usage = TEE_USAGE_MAC; 180 break; 181 182 default: 183 return TEE_ERROR_NOT_SUPPORTED; 184 } 185 186 op = TEE_Malloc(sizeof(*op), 0); 187 if (op == NULL) 188 return TEE_ERROR_OUT_OF_MEMORY; 189 190 op->info.algorithm = algorithm; 191 op->info.operationClass = TEE_ALG_GET_CLASS(algorithm); 192 op->info.mode = mode; 193 op->info.maxKeySize = maxKeySize; 194 op->info.requiredKeyUsage = req_key_usage; 195 op->info.handleState = handle_state; 196 197 if (block_size > 1) { 198 size_t buffer_size = block_size; 199 200 if (buffer_two_blocks) 201 buffer_size *= 2; 202 203 op->buffer = 204 TEE_Malloc(buffer_size, TEE_USER_MEM_HINT_NO_FILL_ZERO); 205 if (op->buffer == NULL) { 206 res = TEE_ERROR_OUT_OF_MEMORY; 207 goto out; 208 } 209 } 210 op->block_size = block_size; 211 op->buffer_two_blocks = buffer_two_blocks; 212 213 if (TEE_ALG_GET_CLASS(algorithm) != TEE_OPERATION_DIGEST) { 214 uint32_t mks = maxKeySize; 215 TEE_ObjectType key_type = TEE_ALG_GET_KEY_TYPE(algorithm, 216 with_private_key); 217 218 /* 219 * If two keys are expected the max key size is the sum of 220 * the size of both keys. 221 */ 222 if (op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) 223 mks /= 2; 224 225 res = TEE_AllocateTransientObject(key_type, mks, &op->key1); 226 if (res != TEE_SUCCESS) 227 goto out; 228 229 if ((op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) != 230 0) { 231 res = 232 TEE_AllocateTransientObject(key_type, mks, 233 &op->key2); 234 if (res != TEE_SUCCESS) 235 goto out; 236 } 237 } 238 239 res = utee_cryp_state_alloc(algorithm, mode, (uint32_t) op->key1, 240 (uint32_t) op->key2, &op->state); 241 if (res != TEE_SUCCESS) 242 goto out; 243 244 /* For multi-stage operation do an "init". */ 245 TEE_ResetOperation(op); 246 *operation = op; 247 248 out: 249 if (res != TEE_SUCCESS) { 250 TEE_FreeTransientObject(op->key1); 251 TEE_FreeTransientObject(op->key2); 252 TEE_FreeOperation(op); 253 } 254 255 return res; 256 } 257 258 void TEE_FreeOperation(TEE_OperationHandle operation) 259 { 260 if (operation != TEE_HANDLE_NULL) { 261 /* 262 * Note that keys should not be freed here, since they are 263 * claimed by the operation they will be freed by 264 * utee_cryp_state_free(). 265 */ 266 utee_cryp_state_free(operation->state); 267 TEE_Free(operation->buffer); 268 TEE_Free(operation); 269 } 270 } 271 272 void TEE_GetOperationInfo(TEE_OperationHandle operation, 273 TEE_OperationInfo *operationInfo) 274 { 275 if (operation == TEE_HANDLE_NULL) 276 TEE_Panic(0); 277 278 if (operationInfo == NULL) 279 TEE_Panic(0); 280 281 *operationInfo = operation->info; 282 } 283 284 void TEE_ResetOperation(TEE_OperationHandle operation) 285 { 286 TEE_Result res; 287 288 if (operation == TEE_HANDLE_NULL) 289 TEE_Panic(0); 290 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 291 res = utee_hash_init(operation->state, NULL, 0); 292 if (res != TEE_SUCCESS) 293 TEE_Panic(res); 294 } 295 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 296 } 297 298 TEE_Result TEE_SetOperationKey(TEE_OperationHandle operation, 299 TEE_ObjectHandle key) 300 { 301 uint32_t key_size = 0; 302 303 if (operation == TEE_HANDLE_NULL) 304 TEE_Panic(0); 305 306 /* No key for digests */ 307 if (operation->info.operationClass == TEE_OPERATION_DIGEST) 308 TEE_Panic(0); 309 310 /* Two keys expected */ 311 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) != 312 0) 313 TEE_Panic(0); 314 315 if (key != TEE_HANDLE_NULL) { 316 TEE_ObjectInfo key_info; 317 318 TEE_GetObjectInfo(key, &key_info); 319 /* Supplied key has to meet required usage */ 320 if ((key_info.objectUsage & operation->info.requiredKeyUsage) != 321 operation->info.requiredKeyUsage) { 322 TEE_Panic(0); 323 } 324 325 if (operation->info.maxKeySize < key_info.objectSize) 326 TEE_Panic(0); 327 328 key_size = key_info.objectSize; 329 } 330 331 TEE_ResetTransientObject(operation->key1); 332 operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET; 333 334 if (key != TEE_HANDLE_NULL) { 335 TEE_CopyObjectAttributes(operation->key1, key); 336 operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET; 337 } 338 339 operation->info.keySize = key_size; 340 341 return TEE_SUCCESS; 342 } 343 344 TEE_Result TEE_SetOperationKey2(TEE_OperationHandle operation, 345 TEE_ObjectHandle key1, TEE_ObjectHandle key2) 346 { 347 uint32_t key_size = 0; 348 349 if (operation == TEE_HANDLE_NULL) 350 TEE_Panic(0); 351 352 /* Two keys not expected */ 353 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) == 354 0) 355 TEE_Panic(0); 356 357 /* Either both keys are NULL or both are not NULL */ 358 if ((key1 == TEE_HANDLE_NULL || key2 == TEE_HANDLE_NULL) && 359 key1 != key2) 360 TEE_Panic(0); 361 362 if (key1 != TEE_HANDLE_NULL) { 363 TEE_ObjectInfo key_info1; 364 TEE_ObjectInfo key_info2; 365 366 TEE_GetObjectInfo(key1, &key_info1); 367 /* Supplied key has to meet required usage */ 368 if ((key_info1.objectUsage & operation->info. 369 requiredKeyUsage) != operation->info.requiredKeyUsage) { 370 TEE_Panic(0); 371 } 372 373 TEE_GetObjectInfo(key2, &key_info2); 374 /* Supplied key has to meet required usage */ 375 if ((key_info2.objectUsage & operation->info. 376 requiredKeyUsage) != operation->info.requiredKeyUsage) { 377 TEE_Panic(0); 378 } 379 380 /* 381 * AES-XTS (the only multi key algorithm supported, requires the 382 * keys to be of equal size. 383 */ 384 if (operation->info.algorithm == TEE_ALG_AES_XTS && 385 key_info1.objectSize != key_info2.objectSize) 386 TEE_Panic(0); 387 388 if (operation->info.maxKeySize < key_info1.objectSize) 389 TEE_Panic(0); 390 391 /* 392 * Odd that only the size of one key should be reported while 393 * size of two key are used when allocating the operation. 394 */ 395 key_size = key_info1.objectSize; 396 } 397 398 TEE_ResetTransientObject(operation->key1); 399 TEE_ResetTransientObject(operation->key2); 400 operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET; 401 402 if (key1 != TEE_HANDLE_NULL) { 403 TEE_CopyObjectAttributes(operation->key1, key1); 404 TEE_CopyObjectAttributes(operation->key2, key2); 405 operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET; 406 } 407 408 operation->info.keySize = key_size; 409 410 return TEE_SUCCESS; 411 } 412 413 void TEE_CopyOperation(TEE_OperationHandle dst_op, TEE_OperationHandle src_op) 414 { 415 TEE_Result res; 416 417 if (dst_op == TEE_HANDLE_NULL || src_op == TEE_HANDLE_NULL) 418 TEE_Panic(0); 419 if (dst_op->info.algorithm != src_op->info.algorithm) 420 TEE_Panic(0); 421 if (src_op->info.operationClass != TEE_OPERATION_DIGEST) { 422 TEE_ObjectHandle key1 = TEE_HANDLE_NULL; 423 TEE_ObjectHandle key2 = TEE_HANDLE_NULL; 424 425 if (src_op->info.handleState & TEE_HANDLE_FLAG_KEY_SET) { 426 key1 = src_op->key1; 427 key2 = src_op->key2; 428 } 429 430 if ((src_op->info.handleState & 431 TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) == 0) { 432 TEE_SetOperationKey(dst_op, key1); 433 } else { 434 TEE_SetOperationKey2(dst_op, key1, key2); 435 } 436 } 437 dst_op->info.handleState = src_op->info.handleState; 438 dst_op->info.keySize = src_op->info.keySize; 439 440 if (dst_op->buffer_two_blocks != src_op->buffer_two_blocks || 441 dst_op->block_size != src_op->block_size) 442 TEE_Panic(0); 443 444 if (dst_op->buffer != NULL) { 445 if (src_op->buffer == NULL) 446 TEE_Panic(0); 447 448 memcpy(dst_op->buffer, src_op->buffer, src_op->buffer_offs); 449 dst_op->buffer_offs = src_op->buffer_offs; 450 } else if (src_op->buffer != NULL) { 451 TEE_Panic(0); 452 } 453 454 res = utee_cryp_state_copy(dst_op->state, src_op->state); 455 if (res != TEE_SUCCESS) 456 TEE_Panic(res); 457 } 458 459 /* Cryptographic Operations API - Message Digest Functions */ 460 461 void TEE_DigestUpdate(TEE_OperationHandle operation, 462 void *chunk, size_t chunkSize) 463 { 464 TEE_Result res = TEE_ERROR_GENERIC; 465 466 if (operation == TEE_HANDLE_NULL || 467 operation->info.operationClass != TEE_OPERATION_DIGEST) 468 TEE_Panic(0); 469 470 res = utee_hash_update(operation->state, chunk, chunkSize); 471 if (res != TEE_SUCCESS) 472 TEE_Panic(res); 473 } 474 475 TEE_Result TEE_DigestDoFinal(TEE_OperationHandle operation, const void *chunk, 476 size_t chunkLen, void *hash, size_t *hashLen) 477 { 478 if ((operation == TEE_HANDLE_NULL) || (!chunk && chunkLen) || 479 !hash || !hashLen || 480 (operation->info.operationClass != TEE_OPERATION_DIGEST)) 481 TEE_Panic(0); 482 483 return utee_hash_final(operation->state, chunk, chunkLen, hash, 484 hashLen); 485 } 486 487 /* Cryptographic Operations API - Symmetric Cipher Functions */ 488 489 void TEE_CipherInit(TEE_OperationHandle operation, const void *IV, size_t IVLen) 490 { 491 TEE_Result res; 492 493 if (operation == TEE_HANDLE_NULL) 494 TEE_Panic(0); 495 if (operation->info.operationClass != TEE_OPERATION_CIPHER) 496 TEE_Panic(0); 497 res = utee_cipher_init(operation->state, IV, IVLen); 498 if (res != TEE_SUCCESS) 499 TEE_Panic(res); 500 operation->buffer_offs = 0; 501 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 502 } 503 504 static TEE_Result tee_buffer_update( 505 TEE_OperationHandle op, 506 TEE_Result(*update_func) (uint32_t state, const void *src, 507 size_t slen, void *dst, size_t *dlen), 508 const void *src_data, size_t src_len, 509 void *dest_data, size_t *dest_len) 510 { 511 TEE_Result res; 512 const uint8_t *src = src_data; 513 size_t slen = src_len; 514 uint8_t *dst = dest_data; 515 size_t dlen = *dest_len; 516 size_t acc_dlen = 0; 517 size_t tmp_dlen; 518 size_t l; 519 size_t buffer_size; 520 521 if (op->buffer_two_blocks) 522 buffer_size = op->block_size * 2; 523 else 524 buffer_size = op->block_size; 525 526 if (op->buffer_offs > 0) { 527 /* Fill up complete block */ 528 if (op->buffer_offs < op->block_size) 529 l = MIN(slen, op->block_size - op->buffer_offs); 530 else 531 l = MIN(slen, buffer_size - op->buffer_offs); 532 memcpy(op->buffer + op->buffer_offs, src, l); 533 op->buffer_offs += l; 534 src += l; 535 slen -= l; 536 if ((op->buffer_offs % op->block_size) != 0) 537 goto out; /* Nothing left to do */ 538 } 539 540 /* If we can feed from buffer */ 541 if (op->buffer_offs > 0 && (op->buffer_offs + slen) > buffer_size) { 542 l = ROUNDUP(op->buffer_offs + slen - buffer_size, 543 op->block_size); 544 l = MIN(op->buffer_offs, l); 545 tmp_dlen = dlen; 546 res = update_func(op->state, op->buffer, l, dst, &tmp_dlen); 547 if (res != TEE_SUCCESS) 548 TEE_Panic(res); 549 dst += tmp_dlen; 550 dlen -= tmp_dlen; 551 acc_dlen += tmp_dlen; 552 op->buffer_offs -= l; 553 if (op->buffer_offs > 0) { 554 /* 555 * Slen is small enough to be contained in rest buffer. 556 */ 557 memcpy(op->buffer, op->buffer + l, buffer_size - l); 558 memcpy(op->buffer + op->buffer_offs, src, slen); 559 op->buffer_offs += slen; 560 goto out; /* Nothing left to do */ 561 } 562 } 563 564 if (slen > buffer_size) { 565 /* Buffer is empty, feed as much as possible from src */ 566 if (TEE_ALIGNMENT_IS_OK(src, uint32_t)) { 567 l = ROUNDUP(slen - buffer_size + 1, op->block_size); 568 569 tmp_dlen = dlen; 570 res = update_func(op->state, src, l, dst, &tmp_dlen); 571 if (res != TEE_SUCCESS) 572 TEE_Panic(res); 573 src += l; 574 slen -= l; 575 dst += tmp_dlen; 576 dlen -= tmp_dlen; 577 acc_dlen += tmp_dlen; 578 } else { 579 /* 580 * Supplied data isn't well aligned, we're forced to 581 * feed through the buffer. 582 */ 583 while (slen >= op->block_size) { 584 memcpy(op->buffer, src, op->block_size); 585 586 tmp_dlen = dlen; 587 res = 588 update_func(op->state, op->buffer, 589 op->block_size, dst, &tmp_dlen); 590 if (res != TEE_SUCCESS) 591 TEE_Panic(res); 592 src += op->block_size; 593 slen -= op->block_size; 594 dst += tmp_dlen; 595 dlen -= tmp_dlen; 596 acc_dlen += tmp_dlen; 597 } 598 } 599 } 600 601 /* Slen is small enough to be contained in buffer. */ 602 memcpy(op->buffer + op->buffer_offs, src, slen); 603 op->buffer_offs += slen; 604 605 out: 606 *dest_len = acc_dlen; 607 return TEE_SUCCESS; 608 } 609 610 TEE_Result TEE_CipherUpdate(TEE_OperationHandle op, const void *srcData, 611 size_t srcLen, void *destData, size_t *destLen) 612 { 613 size_t req_dlen; 614 615 if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 616 destLen == NULL || (destData == NULL && *destLen != 0)) 617 TEE_Panic(0); 618 if (op->info.operationClass != TEE_OPERATION_CIPHER) 619 TEE_Panic(0); 620 if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 621 TEE_Panic(0); 622 623 /* Calculate required dlen */ 624 req_dlen = ((op->buffer_offs + srcLen) / op->block_size) * 625 op->block_size; 626 if (op->buffer_two_blocks) { 627 if (req_dlen > op->block_size * 2) 628 req_dlen -= op->block_size * 2; 629 else 630 req_dlen = 0; 631 } 632 /* 633 * Check that required destLen is big enough before starting to feed 634 * data to the algorithm. Errors during feeding of data are fatal as we 635 * can't restore sync with this API. 636 */ 637 if (*destLen < req_dlen) { 638 *destLen = req_dlen; 639 return TEE_ERROR_SHORT_BUFFER; 640 } 641 642 tee_buffer_update(op, utee_cipher_update, srcData, srcLen, destData, 643 destLen); 644 645 return TEE_SUCCESS; 646 } 647 648 TEE_Result TEE_CipherDoFinal(TEE_OperationHandle op, 649 const void *srcData, size_t srcLen, void *destData, 650 size_t *destLen) 651 { 652 TEE_Result res; 653 uint8_t *dst = destData; 654 size_t acc_dlen = 0; 655 size_t tmp_dlen; 656 size_t req_dlen; 657 658 if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 659 destLen == NULL || (destData == NULL && *destLen != 0)) 660 TEE_Panic(0); 661 if (op->info.operationClass != TEE_OPERATION_CIPHER) 662 TEE_Panic(0); 663 if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 664 TEE_Panic(0); 665 666 /* 667 * Check that the final block doesn't require padding for those 668 * algorithms that requires client to supply padding. 669 */ 670 if (op->info.algorithm == TEE_ALG_AES_ECB_NOPAD || 671 op->info.algorithm == TEE_ALG_AES_CBC_NOPAD || 672 op->info.algorithm == TEE_ALG_DES_ECB_NOPAD || 673 op->info.algorithm == TEE_ALG_DES_CBC_NOPAD || 674 op->info.algorithm == TEE_ALG_DES3_ECB_NOPAD || 675 op->info.algorithm == TEE_ALG_DES3_CBC_NOPAD) { 676 if (((op->buffer_offs + srcLen) % op->block_size) != 0) 677 return TEE_ERROR_BAD_PARAMETERS; 678 } 679 680 /* 681 * Check that required destLen is big enough before starting to feed 682 * data to the algorithm. Errors during feeding of data are fatal as we 683 * can't restore sync with this API. 684 */ 685 req_dlen = op->buffer_offs + srcLen; 686 if (*destLen < req_dlen) { 687 *destLen = req_dlen; 688 return TEE_ERROR_SHORT_BUFFER; 689 } 690 691 tmp_dlen = *destLen - acc_dlen; 692 tee_buffer_update(op, utee_cipher_update, srcData, srcLen, dst, 693 &tmp_dlen); 694 dst += tmp_dlen; 695 acc_dlen += tmp_dlen; 696 697 tmp_dlen = *destLen - acc_dlen; 698 res = utee_cipher_final(op->state, op->buffer, op->buffer_offs, 699 dst, &tmp_dlen); 700 if (res != TEE_SUCCESS) 701 TEE_Panic(res); 702 acc_dlen += tmp_dlen; 703 704 op->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 705 *destLen = acc_dlen; 706 return TEE_SUCCESS; 707 } 708 709 /* Cryptographic Operations API - MAC Functions */ 710 711 void TEE_MACInit(TEE_OperationHandle operation, const void *IV, size_t IVLen) 712 { 713 TEE_Result res; 714 715 if (operation == TEE_HANDLE_NULL) 716 TEE_Panic(0); 717 if (IV == NULL && IVLen != 0) 718 TEE_Panic(0); 719 if (operation->info.operationClass != TEE_OPERATION_MAC) 720 TEE_Panic(0); 721 res = utee_hash_init(operation->state, IV, IVLen); 722 if (res != TEE_SUCCESS) 723 TEE_Panic(res); 724 operation->buffer_offs = 0; 725 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 726 } 727 728 void TEE_MACUpdate(TEE_OperationHandle op, const void *chunk, size_t chunkSize) 729 { 730 TEE_Result res; 731 732 if (op == TEE_HANDLE_NULL || (chunk == NULL && chunkSize != 0)) 733 TEE_Panic(0); 734 if (op->info.operationClass != TEE_OPERATION_MAC) 735 TEE_Panic(0); 736 if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 737 TEE_Panic(0); 738 739 res = utee_hash_update(op->state, chunk, chunkSize); 740 if (res != TEE_SUCCESS) 741 TEE_Panic(res); 742 } 743 744 TEE_Result TEE_MACComputeFinal(TEE_OperationHandle op, 745 const void *message, size_t messageLen, 746 void *mac, size_t *macLen) 747 { 748 TEE_Result res; 749 750 if (op == TEE_HANDLE_NULL || (message == NULL && messageLen != 0) || 751 mac == NULL || macLen == NULL) 752 TEE_Panic(0); 753 if (op->info.operationClass != TEE_OPERATION_MAC) 754 TEE_Panic(0); 755 if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 756 TEE_Panic(0); 757 758 res = utee_hash_final(op->state, message, messageLen, mac, macLen); 759 op->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 760 return res; 761 } 762 763 TEE_Result TEE_MACCompareFinal(TEE_OperationHandle operation, 764 const void *message, size_t messageLen, 765 const void *mac, size_t macLen) 766 { 767 TEE_Result res; 768 uint8_t computed_mac[TEE_MAX_HASH_SIZE]; 769 size_t computed_mac_size = TEE_MAX_HASH_SIZE; 770 771 res = TEE_MACComputeFinal(operation, message, messageLen, computed_mac, 772 &computed_mac_size); 773 if (res != TEE_SUCCESS) 774 return res; 775 if (computed_mac_size != macLen) 776 return TEE_ERROR_MAC_INVALID; 777 if (buf_compare_ct(mac, computed_mac, computed_mac_size) != 0) 778 return TEE_ERROR_MAC_INVALID; 779 return TEE_SUCCESS; 780 } 781 782 /* Cryptographic Operations API - Authenticated Encryption Functions */ 783 784 TEE_Result TEE_AEInit(TEE_OperationHandle op, const void *nonce, 785 size_t nonceLen, uint32_t tagLen, uint32_t AADLen, 786 uint32_t payloadLen) 787 { 788 TEE_Result res; 789 790 if (op == TEE_HANDLE_NULL || nonce == NULL) 791 TEE_Panic(0); 792 if (op->info.operationClass != TEE_OPERATION_AE) 793 TEE_Panic(0); 794 795 /* 796 * AES-CCM tag len is specified by AES-CCM spec and handled in TEE Core 797 * in the implementation. But AES-GCM spec doesn't specify the tag len 798 * according to the same principle so we have to check here instead to 799 * be GP compliant. 800 */ 801 if (op->info.algorithm == TEE_ALG_AES_GCM) { 802 /* 803 * From GP spec: For AES-GCM, can be 128, 120, 112, 104, or 96 804 */ 805 if (tagLen < 96 || tagLen > 128 || (tagLen % 8 != 0)) 806 return TEE_ERROR_NOT_SUPPORTED; 807 } 808 809 res = utee_authenc_init(op->state, nonce, nonceLen, tagLen / 8, AADLen, 810 payloadLen); 811 if (res != TEE_SUCCESS) { 812 if (res != TEE_ERROR_NOT_SUPPORTED) 813 TEE_Panic(res); 814 return res; 815 } 816 op->ae_tag_len = tagLen / 8; 817 818 op->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 819 return TEE_SUCCESS; 820 } 821 822 void TEE_AEUpdateAAD(TEE_OperationHandle op, const void *AADdata, 823 size_t AADdataLen) 824 { 825 TEE_Result res; 826 827 if (op == TEE_HANDLE_NULL || (AADdata == NULL && AADdataLen != 0)) 828 TEE_Panic(0); 829 if (op->info.operationClass != TEE_OPERATION_AE) 830 TEE_Panic(0); 831 if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 832 TEE_Panic(0); 833 834 res = utee_authenc_update_aad(op->state, AADdata, AADdataLen); 835 if (res != TEE_SUCCESS) 836 TEE_Panic(res); 837 } 838 839 TEE_Result TEE_AEUpdate(TEE_OperationHandle op, const void *srcData, 840 size_t srcLen, void *destData, size_t *destLen) 841 { 842 size_t req_dlen; 843 844 if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 845 destLen == NULL || (destData == NULL && *destLen != 0)) 846 TEE_Panic(0); 847 if (op->info.operationClass != TEE_OPERATION_AE) 848 TEE_Panic(0); 849 if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 850 TEE_Panic(0); 851 852 /* 853 * Check that required destLen is big enough before starting to feed 854 * data to the algorithm. Errors during feeding of data are fatal as we 855 * can't restore sync with this API. 856 */ 857 req_dlen = ROUNDDOWN(op->buffer_offs + srcLen, op->block_size); 858 if (*destLen < req_dlen) { 859 *destLen = req_dlen; 860 return TEE_ERROR_SHORT_BUFFER; 861 } 862 863 tee_buffer_update(op, utee_authenc_update_payload, srcData, srcLen, 864 destData, destLen); 865 866 return TEE_SUCCESS; 867 } 868 869 TEE_Result TEE_AEEncryptFinal(TEE_OperationHandle op, 870 const void *srcData, size_t srcLen, 871 void *destData, size_t *destLen, void *tag, 872 size_t *tagLen) 873 { 874 TEE_Result res; 875 uint8_t *dst = destData; 876 size_t acc_dlen = 0; 877 size_t tmp_dlen; 878 size_t req_dlen; 879 880 if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 881 destLen == NULL || (destData == NULL && *destLen != 0) || 882 tag == NULL || tagLen == NULL) 883 TEE_Panic(0); 884 if (op->info.operationClass != TEE_OPERATION_AE) 885 TEE_Panic(0); 886 if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 887 TEE_Panic(0); 888 889 /* 890 * Check that required destLen is big enough before starting to feed 891 * data to the algorithm. Errors during feeding of data are fatal as we 892 * can't restore sync with this API. 893 */ 894 req_dlen = op->buffer_offs + srcLen; 895 if (*destLen < req_dlen) { 896 *destLen = req_dlen; 897 return TEE_ERROR_SHORT_BUFFER; 898 } 899 900 /* 901 * Need to check this before update_payload since sync would be lost if 902 * we return short buffer after that. 903 */ 904 if (*tagLen < op->ae_tag_len) { 905 *tagLen = op->ae_tag_len; 906 return TEE_ERROR_SHORT_BUFFER; 907 } 908 909 tmp_dlen = *destLen - acc_dlen; 910 tee_buffer_update(op, utee_authenc_update_payload, srcData, srcLen, 911 dst, &tmp_dlen); 912 dst += tmp_dlen; 913 acc_dlen += tmp_dlen; 914 915 tmp_dlen = *destLen - acc_dlen; 916 res = 917 utee_authenc_enc_final(op->state, op->buffer, op->buffer_offs, dst, 918 &tmp_dlen, tag, tagLen); 919 if (res != TEE_SUCCESS) 920 TEE_Panic(res); 921 acc_dlen += tmp_dlen; 922 923 *destLen = acc_dlen; 924 op->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 925 926 return res; 927 } 928 929 TEE_Result TEE_AEDecryptFinal(TEE_OperationHandle op, 930 const void *srcData, size_t srcLen, 931 void *destData, size_t *destLen, const void *tag, 932 size_t tagLen) 933 { 934 TEE_Result res; 935 uint8_t *dst = destData; 936 size_t acc_dlen = 0; 937 size_t tmp_dlen; 938 size_t req_dlen; 939 940 if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 941 destLen == NULL || (destData == NULL && *destLen != 0) || 942 (tag == NULL && tagLen != 0)) 943 TEE_Panic(0); 944 if (op->info.operationClass != TEE_OPERATION_AE) 945 TEE_Panic(0); 946 if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 947 TEE_Panic(0); 948 949 /* 950 * Check that required destLen is big enough before starting to feed 951 * data to the algorithm. Errors during feeding of data are fatal as we 952 * can't restore sync with this API. 953 */ 954 req_dlen = op->buffer_offs + srcLen; 955 if (*destLen < req_dlen) { 956 *destLen = req_dlen; 957 return TEE_ERROR_SHORT_BUFFER; 958 } 959 960 tmp_dlen = *destLen - acc_dlen; 961 tee_buffer_update(op, utee_authenc_update_payload, srcData, srcLen, 962 dst, &tmp_dlen); 963 dst += tmp_dlen; 964 acc_dlen += tmp_dlen; 965 966 tmp_dlen = *destLen - acc_dlen; 967 res = 968 utee_authenc_dec_final(op->state, op->buffer, op->buffer_offs, dst, 969 &tmp_dlen, tag, tagLen); 970 if (res != TEE_SUCCESS && res != TEE_ERROR_MAC_INVALID) 971 TEE_Panic(res); 972 /* Supplied tagLen should match what we initiated with */ 973 if (tagLen != op->ae_tag_len) 974 res = TEE_ERROR_MAC_INVALID; 975 976 acc_dlen += tmp_dlen; 977 978 *destLen = acc_dlen; 979 op->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 980 981 return res; 982 } 983 984 /* Cryptographic Operations API - Asymmetric Functions */ 985 986 TEE_Result TEE_AsymmetricEncrypt(TEE_OperationHandle op, 987 const TEE_Attribute *params, 988 uint32_t paramCount, const void *srcData, 989 size_t srcLen, void *destData, 990 size_t *destLen) 991 { 992 TEE_Result res; 993 994 if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 995 destLen == NULL || (destData == NULL && *destLen != 0)) 996 TEE_Panic(0); 997 if (paramCount != 0 && params == NULL) 998 TEE_Panic(0); 999 if (op->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER) 1000 TEE_Panic(0); 1001 if (op->info.mode != TEE_MODE_ENCRYPT) 1002 TEE_Panic(0); 1003 1004 res = utee_asymm_operate(op->state, params, paramCount, srcData, srcLen, 1005 destData, destLen); 1006 if (res != TEE_SUCCESS && 1007 res != TEE_ERROR_SHORT_BUFFER && 1008 res != TEE_ERROR_BAD_PARAMETERS) 1009 TEE_Panic(res); 1010 return res; 1011 } 1012 1013 TEE_Result TEE_AsymmetricDecrypt(TEE_OperationHandle op, 1014 const TEE_Attribute *params, 1015 uint32_t paramCount, const void *srcData, 1016 size_t srcLen, void *destData, 1017 size_t *destLen) 1018 { 1019 TEE_Result res; 1020 1021 if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 1022 destLen == NULL || (destData == NULL && *destLen != 0)) 1023 TEE_Panic(0); 1024 if (paramCount != 0 && params == NULL) 1025 TEE_Panic(0); 1026 if (op->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER) 1027 TEE_Panic(0); 1028 if (op->info.mode != TEE_MODE_DECRYPT) 1029 TEE_Panic(0); 1030 1031 res = utee_asymm_operate(op->state, params, paramCount, srcData, srcLen, 1032 destData, destLen); 1033 if (res != TEE_SUCCESS && 1034 res != TEE_ERROR_SHORT_BUFFER && 1035 res != TEE_ERROR_BAD_PARAMETERS) 1036 TEE_Panic(res); 1037 return res; 1038 } 1039 1040 TEE_Result TEE_AsymmetricSignDigest(TEE_OperationHandle op, 1041 const TEE_Attribute *params, 1042 uint32_t paramCount, const void *digest, 1043 size_t digestLen, void *signature, 1044 size_t *signatureLen) 1045 { 1046 TEE_Result res; 1047 1048 if (op == TEE_HANDLE_NULL || (digest == NULL && digestLen != 0) || 1049 signature == NULL || signatureLen == NULL) 1050 TEE_Panic(0); 1051 if (paramCount != 0 && params == NULL) 1052 TEE_Panic(0); 1053 if (op->info.operationClass != TEE_OPERATION_ASYMMETRIC_SIGNATURE) 1054 TEE_Panic(0); 1055 if (op->info.mode != TEE_MODE_SIGN) 1056 TEE_Panic(0); 1057 1058 res = 1059 utee_asymm_operate(op->state, params, paramCount, digest, digestLen, 1060 signature, signatureLen); 1061 if (res != TEE_SUCCESS && res != TEE_ERROR_SHORT_BUFFER) 1062 TEE_Panic(res); 1063 return res; 1064 } 1065 1066 TEE_Result TEE_AsymmetricVerifyDigest(TEE_OperationHandle op, 1067 const TEE_Attribute *params, 1068 uint32_t paramCount, const void *digest, 1069 size_t digestLen, const void *signature, 1070 size_t signatureLen) 1071 { 1072 TEE_Result res; 1073 1074 if (op == TEE_HANDLE_NULL || (digest == NULL && digestLen != 0) || 1075 (signature == NULL && signatureLen != 0)) 1076 TEE_Panic(0); 1077 if (paramCount != 0 && params == NULL) 1078 TEE_Panic(0); 1079 if (op->info.operationClass != TEE_OPERATION_ASYMMETRIC_SIGNATURE) 1080 TEE_Panic(0); 1081 if (op->info.mode != TEE_MODE_VERIFY) 1082 TEE_Panic(0); 1083 1084 res = 1085 utee_asymm_verify(op->state, params, paramCount, digest, digestLen, 1086 signature, signatureLen); 1087 if (res != TEE_SUCCESS && res != TEE_ERROR_SIGNATURE_INVALID) 1088 TEE_Panic(res); 1089 return res; 1090 } 1091 1092 /* Cryptographic Operations API - Key Derivation Functions */ 1093 1094 void TEE_DeriveKey(TEE_OperationHandle operation, 1095 const TEE_Attribute *params, uint32_t paramCount, 1096 TEE_ObjectHandle derivedKey) 1097 { 1098 TEE_Result res; 1099 TEE_ObjectInfo key_info; 1100 1101 if (operation == TEE_HANDLE_NULL || derivedKey == 0) 1102 TEE_Panic(0); 1103 if (paramCount != 0 && params == NULL) 1104 TEE_Panic(0); 1105 1106 if (operation->info.algorithm != TEE_ALG_DH_DERIVE_SHARED_SECRET) 1107 TEE_Panic(0); 1108 1109 if (operation->info.operationClass != TEE_OPERATION_KEY_DERIVATION) 1110 TEE_Panic(0); 1111 if (operation->info.mode != TEE_MODE_DERIVE) 1112 TEE_Panic(0); 1113 if ((operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) == 0) 1114 TEE_Panic(0); 1115 1116 res = utee_cryp_obj_get_info((uint32_t) derivedKey, &key_info); 1117 if (res != TEE_SUCCESS) 1118 TEE_Panic(0); 1119 1120 if (key_info.objectType != TEE_TYPE_GENERIC_SECRET) 1121 TEE_Panic(0); 1122 if ((key_info.handleFlags & TEE_HANDLE_FLAG_INITIALIZED) != 0) 1123 TEE_Panic(0); 1124 1125 if ((operation->info.algorithm == TEE_ALG_DH_DERIVE_SHARED_SECRET) && 1126 (paramCount != 1 || 1127 params[0].attributeID != TEE_ATTR_DH_PUBLIC_VALUE)) 1128 TEE_Panic(0); 1129 1130 res = utee_cryp_derive_key(operation->state, params, paramCount, 1131 (uint32_t) derivedKey); 1132 if (res != TEE_SUCCESS) 1133 TEE_Panic(res); 1134 } 1135 1136 /* Cryptographic Operations API - Random Number Generation Functions */ 1137 1138 void TEE_GenerateRandom(void *randomBuffer, size_t randomBufferLen) 1139 { 1140 TEE_Result res; 1141 1142 res = utee_cryp_random_number_generate(randomBuffer, randomBufferLen); 1143 if (res != TEE_SUCCESS) 1144 TEE_Panic(res); 1145 } 1146