1 /* 2 * Copyright (c) 2014, STMicroelectronics International N.V. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions are met: 7 * 8 * 1. Redistributions of source code must retain the above copyright notice, 9 * this list of conditions and the following disclaimer. 10 * 11 * 2. Redistributions in binary form must reproduce the above copyright notice, 12 * this list of conditions and the following disclaimer in the documentation 13 * and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 16 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 19 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 * POSSIBILITY OF SUCH DAMAGE. 26 */ 27 #include <stdlib.h> 28 #include <string.h> 29 #include <string_ext.h> 30 31 #include <tee_api.h> 32 #include <tee_api_defines_extensions.h> 33 #include <tee_internal_api_extensions.h> 34 #include <utee_syscalls.h> 35 #include <utee_defines.h> 36 #include <util.h> 37 #include "tee_api_private.h" 38 39 struct __TEE_OperationHandle { 40 TEE_OperationInfo info; 41 TEE_ObjectHandle key1; 42 TEE_ObjectHandle key2; 43 uint32_t operationState;/* Operation state : INITIAL or ACTIVE */ 44 uint8_t *buffer; /* buffer to collect complete blocks */ 45 bool buffer_two_blocks; /* True if two blocks need to be buffered */ 46 size_t block_size; /* Block size of cipher */ 47 size_t buffer_offs; /* Offset in buffer */ 48 uint32_t state; /* Handle to state in TEE Core */ 49 uint32_t ae_tag_len; /* 50 * tag_len in bytes for AE operation else unused 51 */ 52 }; 53 54 /* Cryptographic Operations API - Generic Operation Functions */ 55 56 TEE_Result TEE_AllocateOperation(TEE_OperationHandle *operation, 57 uint32_t algorithm, uint32_t mode, 58 uint32_t maxKeySize) 59 { 60 TEE_Result res; 61 TEE_OperationHandle op = TEE_HANDLE_NULL; 62 uint32_t handle_state = 0; 63 size_t block_size = 1; 64 uint32_t req_key_usage; 65 bool with_private_key = false; 66 bool buffer_two_blocks = false; 67 68 if (!operation) 69 TEE_Panic(0); 70 71 if (algorithm == TEE_ALG_AES_XTS) 72 handle_state = TEE_HANDLE_FLAG_EXPECT_TWO_KEYS; 73 74 /* Check algorithm max key size */ 75 switch (algorithm) { 76 case TEE_ALG_DSA_SHA1: 77 if (maxKeySize < 512) 78 return TEE_ERROR_NOT_SUPPORTED; 79 if (maxKeySize > 1024) 80 return TEE_ERROR_NOT_SUPPORTED; 81 if (maxKeySize % 64 != 0) 82 return TEE_ERROR_NOT_SUPPORTED; 83 break; 84 85 case TEE_ALG_DSA_SHA224: 86 if (maxKeySize != 2048) 87 return TEE_ERROR_NOT_SUPPORTED; 88 break; 89 90 case TEE_ALG_DSA_SHA256: 91 if (maxKeySize != 2048 && maxKeySize != 3072) 92 return TEE_ERROR_NOT_SUPPORTED; 93 break; 94 95 case TEE_ALG_ECDSA_P192: 96 case TEE_ALG_ECDH_P192: 97 if (maxKeySize != 192) 98 return TEE_ERROR_NOT_SUPPORTED; 99 break; 100 101 case TEE_ALG_ECDSA_P224: 102 case TEE_ALG_ECDH_P224: 103 if (maxKeySize != 224) 104 return TEE_ERROR_NOT_SUPPORTED; 105 break; 106 107 case TEE_ALG_ECDSA_P256: 108 case TEE_ALG_ECDH_P256: 109 if (maxKeySize != 256) 110 return TEE_ERROR_NOT_SUPPORTED; 111 break; 112 113 case TEE_ALG_ECDSA_P384: 114 case TEE_ALG_ECDH_P384: 115 if (maxKeySize != 384) 116 return TEE_ERROR_NOT_SUPPORTED; 117 break; 118 119 case TEE_ALG_ECDSA_P521: 120 case TEE_ALG_ECDH_P521: 121 if (maxKeySize != 521) 122 return TEE_ERROR_NOT_SUPPORTED; 123 break; 124 125 default: 126 break; 127 } 128 129 /* Check algorithm mode */ 130 switch (algorithm) { 131 case TEE_ALG_AES_CTS: 132 case TEE_ALG_AES_XTS: 133 buffer_two_blocks = true; 134 /*FALLTHROUGH*/ case TEE_ALG_AES_ECB_NOPAD: 135 case TEE_ALG_AES_CBC_NOPAD: 136 case TEE_ALG_AES_CTR: 137 case TEE_ALG_AES_CCM: 138 case TEE_ALG_AES_GCM: 139 case TEE_ALG_DES_ECB_NOPAD: 140 case TEE_ALG_DES_CBC_NOPAD: 141 case TEE_ALG_DES3_ECB_NOPAD: 142 case TEE_ALG_DES3_CBC_NOPAD: 143 if (TEE_ALG_GET_MAIN_ALG(algorithm) == TEE_MAIN_ALGO_AES) 144 block_size = TEE_AES_BLOCK_SIZE; 145 else 146 block_size = TEE_DES_BLOCK_SIZE; 147 148 if (mode == TEE_MODE_ENCRYPT) 149 req_key_usage = TEE_USAGE_ENCRYPT; 150 else if (mode == TEE_MODE_DECRYPT) 151 req_key_usage = TEE_USAGE_DECRYPT; 152 else 153 return TEE_ERROR_NOT_SUPPORTED; 154 break; 155 156 case TEE_ALG_RSASSA_PKCS1_V1_5_MD5: 157 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA1: 158 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA224: 159 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA256: 160 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA384: 161 case TEE_ALG_RSASSA_PKCS1_V1_5_SHA512: 162 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA1: 163 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA224: 164 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256: 165 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA384: 166 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA512: 167 case TEE_ALG_DSA_SHA1: 168 case TEE_ALG_DSA_SHA224: 169 case TEE_ALG_DSA_SHA256: 170 case TEE_ALG_ECDSA_P192: 171 case TEE_ALG_ECDSA_P224: 172 case TEE_ALG_ECDSA_P256: 173 case TEE_ALG_ECDSA_P384: 174 case TEE_ALG_ECDSA_P521: 175 if (mode == TEE_MODE_SIGN) { 176 with_private_key = true; 177 req_key_usage = TEE_USAGE_SIGN; 178 } else if (mode == TEE_MODE_VERIFY) { 179 req_key_usage = TEE_USAGE_VERIFY; 180 } else { 181 return TEE_ERROR_NOT_SUPPORTED; 182 } 183 break; 184 185 case TEE_ALG_RSAES_PKCS1_V1_5: 186 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA1: 187 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA224: 188 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA256: 189 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA384: 190 case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA512: 191 if (mode == TEE_MODE_ENCRYPT) { 192 req_key_usage = TEE_USAGE_ENCRYPT; 193 } else if (mode == TEE_MODE_DECRYPT) { 194 with_private_key = true; 195 req_key_usage = TEE_USAGE_DECRYPT; 196 } else { 197 return TEE_ERROR_NOT_SUPPORTED; 198 } 199 break; 200 201 case TEE_ALG_RSA_NOPAD: 202 if (mode == TEE_MODE_ENCRYPT) { 203 req_key_usage = TEE_USAGE_ENCRYPT | TEE_USAGE_VERIFY; 204 } else if (mode == TEE_MODE_DECRYPT) { 205 with_private_key = true; 206 req_key_usage = TEE_USAGE_DECRYPT | TEE_USAGE_SIGN; 207 } else { 208 return TEE_ERROR_NOT_SUPPORTED; 209 } 210 break; 211 212 case TEE_ALG_DH_DERIVE_SHARED_SECRET: 213 case TEE_ALG_ECDH_P192: 214 case TEE_ALG_ECDH_P224: 215 case TEE_ALG_ECDH_P256: 216 case TEE_ALG_ECDH_P384: 217 case TEE_ALG_ECDH_P521: 218 case TEE_ALG_HKDF_MD5_DERIVE_KEY: 219 case TEE_ALG_HKDF_SHA1_DERIVE_KEY: 220 case TEE_ALG_HKDF_SHA224_DERIVE_KEY: 221 case TEE_ALG_HKDF_SHA256_DERIVE_KEY: 222 case TEE_ALG_HKDF_SHA384_DERIVE_KEY: 223 case TEE_ALG_HKDF_SHA512_DERIVE_KEY: 224 case TEE_ALG_CONCAT_KDF_SHA1_DERIVE_KEY: 225 case TEE_ALG_CONCAT_KDF_SHA224_DERIVE_KEY: 226 case TEE_ALG_CONCAT_KDF_SHA256_DERIVE_KEY: 227 case TEE_ALG_CONCAT_KDF_SHA384_DERIVE_KEY: 228 case TEE_ALG_CONCAT_KDF_SHA512_DERIVE_KEY: 229 case TEE_ALG_PBKDF2_HMAC_SHA1_DERIVE_KEY: 230 if (mode != TEE_MODE_DERIVE) 231 return TEE_ERROR_NOT_SUPPORTED; 232 with_private_key = true; 233 req_key_usage = TEE_USAGE_DERIVE; 234 break; 235 236 case TEE_ALG_MD5: 237 case TEE_ALG_SHA1: 238 case TEE_ALG_SHA224: 239 case TEE_ALG_SHA256: 240 case TEE_ALG_SHA384: 241 case TEE_ALG_SHA512: 242 if (mode != TEE_MODE_DIGEST) 243 return TEE_ERROR_NOT_SUPPORTED; 244 /* v1.1: flags always set for digest operations */ 245 handle_state |= TEE_HANDLE_FLAG_KEY_SET; 246 req_key_usage = 0; 247 break; 248 249 case TEE_ALG_DES_CBC_MAC_NOPAD: 250 case TEE_ALG_AES_CBC_MAC_NOPAD: 251 case TEE_ALG_AES_CBC_MAC_PKCS5: 252 case TEE_ALG_AES_CMAC: 253 case TEE_ALG_DES_CBC_MAC_PKCS5: 254 case TEE_ALG_DES3_CBC_MAC_NOPAD: 255 case TEE_ALG_DES3_CBC_MAC_PKCS5: 256 case TEE_ALG_HMAC_MD5: 257 case TEE_ALG_HMAC_SHA1: 258 case TEE_ALG_HMAC_SHA224: 259 case TEE_ALG_HMAC_SHA256: 260 case TEE_ALG_HMAC_SHA384: 261 case TEE_ALG_HMAC_SHA512: 262 if (mode != TEE_MODE_MAC) 263 return TEE_ERROR_NOT_SUPPORTED; 264 req_key_usage = TEE_USAGE_MAC; 265 break; 266 267 default: 268 return TEE_ERROR_NOT_SUPPORTED; 269 } 270 271 op = TEE_Malloc(sizeof(*op), TEE_MALLOC_FILL_ZERO); 272 if (!op) 273 return TEE_ERROR_OUT_OF_MEMORY; 274 275 op->info.algorithm = algorithm; 276 op->info.operationClass = TEE_ALG_GET_CLASS(algorithm); 277 op->info.mode = mode; 278 op->info.maxKeySize = maxKeySize; 279 op->info.requiredKeyUsage = req_key_usage; 280 op->info.handleState = handle_state; 281 282 if (block_size > 1) { 283 size_t buffer_size = block_size; 284 285 if (buffer_two_blocks) 286 buffer_size *= 2; 287 288 op->buffer = TEE_Malloc(buffer_size, 289 TEE_USER_MEM_HINT_NO_FILL_ZERO); 290 if (op->buffer == NULL) { 291 res = TEE_ERROR_OUT_OF_MEMORY; 292 goto out; 293 } 294 } 295 op->block_size = block_size; 296 op->buffer_two_blocks = buffer_two_blocks; 297 298 if (TEE_ALG_GET_CLASS(algorithm) != TEE_OPERATION_DIGEST) { 299 uint32_t mks = maxKeySize; 300 TEE_ObjectType key_type = TEE_ALG_GET_KEY_TYPE(algorithm, 301 with_private_key); 302 303 /* 304 * If two keys are expected the max key size is the sum of 305 * the size of both keys. 306 */ 307 if (op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) 308 mks /= 2; 309 310 res = TEE_AllocateTransientObject(key_type, mks, &op->key1); 311 if (res != TEE_SUCCESS) 312 goto out; 313 314 if (op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) { 315 res = TEE_AllocateTransientObject(key_type, mks, 316 &op->key2); 317 if (res != TEE_SUCCESS) 318 goto out; 319 } 320 } 321 322 res = utee_cryp_state_alloc(algorithm, mode, (unsigned long)op->key1, 323 (unsigned long)op->key2, &op->state); 324 if (res != TEE_SUCCESS) 325 goto out; 326 327 /* 328 * Initialize digest operations 329 * Other multi-stage operations initialized w/ TEE_xxxInit functions 330 * Non-applicable on asymmetric operations 331 */ 332 if (TEE_ALG_GET_CLASS(algorithm) == TEE_OPERATION_DIGEST) { 333 res = utee_hash_init(op->state, NULL, 0); 334 if (res != TEE_SUCCESS) 335 goto out; 336 /* v1.1: flags always set for digest operations */ 337 op->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 338 } 339 340 op->operationState = TEE_OPERATION_STATE_INITIAL; 341 342 *operation = op; 343 344 out: 345 if (res != TEE_SUCCESS) { 346 if (res != TEE_ERROR_OUT_OF_MEMORY && 347 res != TEE_ERROR_NOT_SUPPORTED) 348 TEE_Panic(0); 349 if (op) { 350 if (op->state) { 351 TEE_FreeOperation(op); 352 } else { 353 TEE_Free(op->buffer); 354 TEE_FreeTransientObject(op->key1); 355 TEE_FreeTransientObject(op->key2); 356 TEE_Free(op); 357 } 358 } 359 } 360 361 return res; 362 } 363 364 void TEE_FreeOperation(TEE_OperationHandle operation) 365 { 366 TEE_Result res; 367 368 if (operation == TEE_HANDLE_NULL) 369 TEE_Panic(0); 370 371 /* 372 * Note that keys should not be freed here, since they are 373 * claimed by the operation they will be freed by 374 * utee_cryp_state_free(). 375 */ 376 res = utee_cryp_state_free(operation->state); 377 if (res != TEE_SUCCESS) 378 TEE_Panic(0); 379 380 TEE_Free(operation->buffer); 381 TEE_Free(operation); 382 } 383 384 void TEE_GetOperationInfo(TEE_OperationHandle operation, 385 TEE_OperationInfo *operationInfo) 386 { 387 if (operation == TEE_HANDLE_NULL) 388 TEE_Panic(0); 389 390 if (!operationInfo) 391 TEE_Panic(0); 392 393 *operationInfo = operation->info; 394 } 395 396 TEE_Result TEE_GetOperationInfoMultiple(TEE_OperationHandle operation, 397 TEE_OperationInfoMultiple *operationInfoMultiple, 398 uint32_t *operationSize) 399 { 400 TEE_Result res = TEE_SUCCESS; 401 TEE_ObjectInfo key_info1; 402 TEE_ObjectInfo key_info2; 403 uint32_t num_of_keys; 404 size_t n; 405 406 if (operation == TEE_HANDLE_NULL) { 407 res = TEE_ERROR_BAD_PARAMETERS; 408 goto out; 409 } 410 411 if (!operationInfoMultiple) { 412 res = TEE_ERROR_BAD_PARAMETERS; 413 goto out; 414 } 415 416 if (!operationSize) { 417 res = TEE_ERROR_BAD_PARAMETERS; 418 goto out; 419 } 420 421 num_of_keys = (*operationSize-sizeof(TEE_OperationInfoMultiple))/ 422 sizeof(TEE_OperationInfoKey); 423 424 if (num_of_keys > 2) { 425 res = TEE_ERROR_BAD_PARAMETERS; 426 goto out; 427 } 428 429 /* Two keys flag (TEE_ALG_AES_XTS only) */ 430 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) != 431 0 && 432 (num_of_keys != 2)) { 433 res = TEE_ERROR_SHORT_BUFFER; 434 goto out; 435 } 436 437 /* Clear */ 438 for (n = 0; n < num_of_keys; n++) { 439 operationInfoMultiple->keyInformation[n].keySize = 0; 440 operationInfoMultiple->keyInformation[n].requiredKeyUsage = 0; 441 } 442 443 if (num_of_keys == 2) { 444 res = TEE_GetObjectInfo1(operation->key2, &key_info2); 445 /* Key2 is not a valid handle */ 446 if (res != TEE_SUCCESS) 447 goto out; 448 449 operationInfoMultiple->keyInformation[1].keySize = 450 key_info2.keySize; 451 operationInfoMultiple->keyInformation[1].requiredKeyUsage = 452 operation->info.requiredKeyUsage; 453 } 454 455 if (num_of_keys >= 1) { 456 res = TEE_GetObjectInfo1(operation->key1, &key_info1); 457 /* Key1 is not a valid handle */ 458 if (res != TEE_SUCCESS) { 459 if (num_of_keys == 2) { 460 operationInfoMultiple->keyInformation[1]. 461 keySize = 0; 462 operationInfoMultiple->keyInformation[1]. 463 requiredKeyUsage = 0; 464 } 465 goto out; 466 } 467 468 operationInfoMultiple->keyInformation[0].keySize = 469 key_info1.keySize; 470 operationInfoMultiple->keyInformation[0].requiredKeyUsage = 471 operation->info.requiredKeyUsage; 472 } 473 474 /* No key */ 475 operationInfoMultiple->algorithm = operation->info.algorithm; 476 operationInfoMultiple->operationClass = operation->info.operationClass; 477 operationInfoMultiple->mode = operation->info.mode; 478 operationInfoMultiple->digestLength = operation->info.digestLength; 479 operationInfoMultiple->maxKeySize = operation->info.maxKeySize; 480 operationInfoMultiple->handleState = operation->info.handleState; 481 operationInfoMultiple->operationState = operation->operationState; 482 operationInfoMultiple->numberOfKeys = num_of_keys; 483 484 out: 485 if (res != TEE_SUCCESS && 486 res != TEE_ERROR_SHORT_BUFFER) 487 TEE_Panic(0); 488 489 return res; 490 } 491 492 void TEE_ResetOperation(TEE_OperationHandle operation) 493 { 494 TEE_Result res; 495 496 if (operation == TEE_HANDLE_NULL) 497 TEE_Panic(0); 498 499 if (!(operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET)) 500 TEE_Panic(0); 501 502 operation->operationState = TEE_OPERATION_STATE_INITIAL; 503 504 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 505 res = utee_hash_init(operation->state, NULL, 0); 506 if (res != TEE_SUCCESS) 507 TEE_Panic(res); 508 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 509 } else { 510 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 511 } 512 } 513 514 TEE_Result TEE_SetOperationKey(TEE_OperationHandle operation, 515 TEE_ObjectHandle key) 516 { 517 TEE_Result res; 518 uint32_t key_size = 0; 519 TEE_ObjectInfo key_info; 520 521 if (operation == TEE_HANDLE_NULL) { 522 res = TEE_ERROR_BAD_PARAMETERS; 523 goto out; 524 } 525 526 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) { 527 res = TEE_ERROR_BAD_PARAMETERS; 528 goto out; 529 } 530 531 if (key == TEE_HANDLE_NULL) { 532 /* Operation key cleared */ 533 TEE_ResetTransientObject(operation->key1); 534 res = TEE_ERROR_BAD_PARAMETERS; 535 goto out; 536 } 537 538 /* No key for digest operation */ 539 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 540 res = TEE_ERROR_BAD_PARAMETERS; 541 goto out; 542 } 543 544 /* Two keys flag not expected (TEE_ALG_AES_XTS excluded) */ 545 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) != 546 0) { 547 res = TEE_ERROR_BAD_PARAMETERS; 548 goto out; 549 } 550 551 res = TEE_GetObjectInfo1(key, &key_info); 552 /* Key is not a valid handle */ 553 if (res != TEE_SUCCESS) 554 goto out; 555 556 /* Supplied key has to meet required usage */ 557 if ((key_info.objectUsage & operation->info.requiredKeyUsage) != 558 operation->info.requiredKeyUsage) { 559 res = TEE_ERROR_BAD_PARAMETERS; 560 goto out; 561 } 562 563 if (operation->info.maxKeySize < key_info.keySize) { 564 res = TEE_ERROR_BAD_PARAMETERS; 565 goto out; 566 } 567 568 key_size = key_info.keySize; 569 570 TEE_ResetTransientObject(operation->key1); 571 operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET; 572 573 res = TEE_CopyObjectAttributes1(operation->key1, key); 574 if (res != TEE_SUCCESS) 575 goto out; 576 577 operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET; 578 579 operation->info.keySize = key_size; 580 581 out: 582 if (res != TEE_SUCCESS && 583 res != TEE_ERROR_CORRUPT_OBJECT && 584 res != TEE_ERROR_STORAGE_NOT_AVAILABLE) 585 TEE_Panic(0); 586 587 return res; 588 } 589 590 TEE_Result TEE_SetOperationKey2(TEE_OperationHandle operation, 591 TEE_ObjectHandle key1, TEE_ObjectHandle key2) 592 { 593 TEE_Result res; 594 uint32_t key_size = 0; 595 TEE_ObjectInfo key_info1; 596 TEE_ObjectInfo key_info2; 597 598 if (operation == TEE_HANDLE_NULL) { 599 res = TEE_ERROR_BAD_PARAMETERS; 600 goto out; 601 } 602 603 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) { 604 res = TEE_ERROR_BAD_PARAMETERS; 605 goto out; 606 } 607 608 /* 609 * Key1/Key2 and/or are not initialized and 610 * Either both keys are NULL or both are not NULL 611 */ 612 if (key1 == TEE_HANDLE_NULL || key2 == TEE_HANDLE_NULL) { 613 /* Clear operation key1 (if needed) */ 614 if (key1 == TEE_HANDLE_NULL) 615 TEE_ResetTransientObject(operation->key1); 616 /* Clear operation key2 (if needed) */ 617 if (key2 == TEE_HANDLE_NULL) 618 TEE_ResetTransientObject(operation->key2); 619 res = TEE_ERROR_BAD_PARAMETERS; 620 goto out; 621 } 622 623 /* No key for digest operation */ 624 if (operation->info.operationClass == TEE_OPERATION_DIGEST) { 625 res = TEE_ERROR_BAD_PARAMETERS; 626 goto out; 627 } 628 629 /* Two keys flag expected (TEE_ALG_AES_XTS only) */ 630 if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) == 631 0) { 632 res = TEE_ERROR_BAD_PARAMETERS; 633 goto out; 634 } 635 636 res = TEE_GetObjectInfo1(key1, &key_info1); 637 /* Key1 is not a valid handle */ 638 if (res != TEE_SUCCESS) 639 goto out; 640 641 /* Supplied key has to meet required usage */ 642 if ((key_info1.objectUsage & operation->info. 643 requiredKeyUsage) != operation->info.requiredKeyUsage) { 644 res = TEE_ERROR_BAD_PARAMETERS; 645 goto out; 646 } 647 648 res = TEE_GetObjectInfo1(key2, &key_info2); 649 /* Key2 is not a valid handle */ 650 if (res != TEE_SUCCESS) { 651 if (res == TEE_ERROR_CORRUPT_OBJECT) 652 res = TEE_ERROR_CORRUPT_OBJECT_2; 653 goto out; 654 } 655 656 /* Supplied key has to meet required usage */ 657 if ((key_info2.objectUsage & operation->info. 658 requiredKeyUsage) != operation->info.requiredKeyUsage) { 659 res = TEE_ERROR_BAD_PARAMETERS; 660 goto out; 661 } 662 663 /* 664 * AES-XTS (the only multi key algorithm supported, requires the 665 * keys to be of equal size. 666 */ 667 if (operation->info.algorithm == TEE_ALG_AES_XTS && 668 key_info1.keySize != key_info2.keySize) { 669 res = TEE_ERROR_BAD_PARAMETERS; 670 goto out; 671 672 } 673 674 if (operation->info.maxKeySize < key_info1.keySize) { 675 res = TEE_ERROR_BAD_PARAMETERS; 676 goto out; 677 } 678 679 /* 680 * Odd that only the size of one key should be reported while 681 * size of two key are used when allocating the operation. 682 */ 683 key_size = key_info1.keySize; 684 685 TEE_ResetTransientObject(operation->key1); 686 TEE_ResetTransientObject(operation->key2); 687 operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET; 688 689 res = TEE_CopyObjectAttributes1(operation->key1, key1); 690 if (res != TEE_SUCCESS) 691 goto out; 692 693 res = TEE_CopyObjectAttributes1(operation->key2, key2); 694 if (res != TEE_SUCCESS) { 695 if (res == TEE_ERROR_CORRUPT_OBJECT) 696 res = TEE_ERROR_CORRUPT_OBJECT_2; 697 goto out; 698 } 699 700 operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET; 701 702 operation->info.keySize = key_size; 703 704 out: 705 if (res != TEE_SUCCESS && 706 res != TEE_ERROR_CORRUPT_OBJECT && 707 res != TEE_ERROR_CORRUPT_OBJECT_2 && 708 res != TEE_ERROR_STORAGE_NOT_AVAILABLE && 709 res != TEE_ERROR_STORAGE_NOT_AVAILABLE_2) 710 TEE_Panic(0); 711 712 return res; 713 } 714 715 void TEE_CopyOperation(TEE_OperationHandle dst_op, TEE_OperationHandle src_op) 716 { 717 TEE_Result res; 718 719 if (dst_op == TEE_HANDLE_NULL || src_op == TEE_HANDLE_NULL) 720 TEE_Panic(0); 721 if (dst_op->info.algorithm != src_op->info.algorithm) 722 TEE_Panic(0); 723 if (src_op->info.operationClass != TEE_OPERATION_DIGEST) { 724 TEE_ObjectHandle key1 = TEE_HANDLE_NULL; 725 TEE_ObjectHandle key2 = TEE_HANDLE_NULL; 726 727 if (src_op->info.handleState & TEE_HANDLE_FLAG_KEY_SET) { 728 key1 = src_op->key1; 729 key2 = src_op->key2; 730 } 731 732 if ((src_op->info.handleState & 733 TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) == 0) { 734 TEE_SetOperationKey(dst_op, key1); 735 } else { 736 TEE_SetOperationKey2(dst_op, key1, key2); 737 } 738 } 739 dst_op->info.handleState = src_op->info.handleState; 740 dst_op->info.keySize = src_op->info.keySize; 741 dst_op->operationState = src_op->operationState; 742 743 if (dst_op->buffer_two_blocks != src_op->buffer_two_blocks || 744 dst_op->block_size != src_op->block_size) 745 TEE_Panic(0); 746 747 if (dst_op->buffer != NULL) { 748 if (src_op->buffer == NULL) 749 TEE_Panic(0); 750 751 memcpy(dst_op->buffer, src_op->buffer, src_op->buffer_offs); 752 dst_op->buffer_offs = src_op->buffer_offs; 753 } else if (src_op->buffer != NULL) { 754 TEE_Panic(0); 755 } 756 757 res = utee_cryp_state_copy(dst_op->state, src_op->state); 758 if (res != TEE_SUCCESS) 759 TEE_Panic(res); 760 } 761 762 /* Cryptographic Operations API - Message Digest Functions */ 763 764 static void init_hash_operation(TEE_OperationHandle operation, void *IV, 765 uint32_t IVLen) 766 { 767 TEE_Result res; 768 769 /* 770 * Note : IV and IVLen are never used in current implementation 771 * This is why coherent values of IV and IVLen are not checked 772 */ 773 res = utee_hash_init(operation->state, IV, IVLen); 774 if (res != TEE_SUCCESS) 775 TEE_Panic(res); 776 operation->buffer_offs = 0; 777 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 778 } 779 780 void TEE_DigestUpdate(TEE_OperationHandle operation, 781 void *chunk, uint32_t chunkSize) 782 { 783 TEE_Result res = TEE_ERROR_GENERIC; 784 785 if (operation == TEE_HANDLE_NULL || 786 operation->info.operationClass != TEE_OPERATION_DIGEST) 787 TEE_Panic(0); 788 789 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 790 791 res = utee_hash_update(operation->state, chunk, chunkSize); 792 if (res != TEE_SUCCESS) 793 TEE_Panic(res); 794 } 795 796 TEE_Result TEE_DigestDoFinal(TEE_OperationHandle operation, void *chunk, 797 uint32_t chunkLen, void *hash, uint32_t *hashLen) 798 { 799 TEE_Result res; 800 uint64_t hl; 801 802 if ((operation == TEE_HANDLE_NULL) || 803 (!chunk && chunkLen) || 804 !hash || 805 !hashLen || 806 (operation->info.operationClass != TEE_OPERATION_DIGEST)) { 807 res = TEE_ERROR_BAD_PARAMETERS; 808 goto out; 809 } 810 811 hl = *hashLen; 812 res = utee_hash_final(operation->state, chunk, chunkLen, hash, &hl); 813 *hashLen = hl; 814 if (res != TEE_SUCCESS) 815 goto out; 816 817 /* Reset operation state */ 818 init_hash_operation(operation, NULL, 0); 819 820 operation->operationState = TEE_OPERATION_STATE_INITIAL; 821 822 out: 823 if (res != TEE_SUCCESS && 824 res != TEE_ERROR_SHORT_BUFFER) 825 TEE_Panic(0); 826 827 return res; 828 } 829 830 /* Cryptographic Operations API - Symmetric Cipher Functions */ 831 832 void TEE_CipherInit(TEE_OperationHandle operation, void *IV, uint32_t IVLen) 833 { 834 TEE_Result res; 835 836 if (operation == TEE_HANDLE_NULL) 837 TEE_Panic(0); 838 839 if (operation->info.operationClass != TEE_OPERATION_CIPHER) 840 TEE_Panic(0); 841 842 if (!(operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) || 843 !(operation->key1)) 844 TEE_Panic(0); 845 846 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) 847 TEE_ResetOperation(operation); 848 849 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 850 851 res = utee_cipher_init(operation->state, IV, IVLen); 852 if (res != TEE_SUCCESS) 853 TEE_Panic(res); 854 855 operation->buffer_offs = 0; 856 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 857 } 858 859 static TEE_Result tee_buffer_update( 860 TEE_OperationHandle op, 861 TEE_Result(*update_func)(unsigned long state, const void *src, 862 size_t slen, void *dst, uint64_t *dlen), 863 const void *src_data, size_t src_len, 864 void *dest_data, uint64_t *dest_len) 865 { 866 TEE_Result res; 867 const uint8_t *src = src_data; 868 size_t slen = src_len; 869 uint8_t *dst = dest_data; 870 size_t dlen = *dest_len; 871 size_t acc_dlen = 0; 872 uint64_t tmp_dlen; 873 size_t l; 874 size_t buffer_size; 875 size_t buffer_left; 876 877 if (op->buffer_two_blocks) { 878 buffer_size = op->block_size * 2; 879 buffer_left = 1; 880 } else { 881 buffer_size = op->block_size; 882 buffer_left = 0; 883 } 884 885 if (op->buffer_offs > 0) { 886 /* Fill up complete block */ 887 if (op->buffer_offs < op->block_size) 888 l = MIN(slen, op->block_size - op->buffer_offs); 889 else 890 l = MIN(slen, buffer_size - op->buffer_offs); 891 memcpy(op->buffer + op->buffer_offs, src, l); 892 op->buffer_offs += l; 893 src += l; 894 slen -= l; 895 if ((op->buffer_offs % op->block_size) != 0) 896 goto out; /* Nothing left to do */ 897 } 898 899 /* If we can feed from buffer */ 900 if ((op->buffer_offs > 0) && 901 ((op->buffer_offs + slen) >= (buffer_size + buffer_left))) { 902 l = ROUNDUP(op->buffer_offs + slen - buffer_size, 903 op->block_size); 904 l = MIN(op->buffer_offs, l); 905 tmp_dlen = dlen; 906 res = update_func(op->state, op->buffer, l, dst, &tmp_dlen); 907 if (res != TEE_SUCCESS) 908 TEE_Panic(res); 909 dst += tmp_dlen; 910 dlen -= tmp_dlen; 911 acc_dlen += tmp_dlen; 912 op->buffer_offs -= l; 913 if (op->buffer_offs > 0) { 914 /* 915 * Slen is small enough to be contained in rest buffer. 916 */ 917 memcpy(op->buffer, op->buffer + l, buffer_size - l); 918 memcpy(op->buffer + op->buffer_offs, src, slen); 919 op->buffer_offs += slen; 920 goto out; /* Nothing left to do */ 921 } 922 } 923 924 if (slen >= (buffer_size + buffer_left)) { 925 /* Buffer is empty, feed as much as possible from src */ 926 l = ROUNDUP(slen - buffer_size + 1, op->block_size); 927 928 tmp_dlen = dlen; 929 res = update_func(op->state, src, l, dst, &tmp_dlen); 930 if (res != TEE_SUCCESS) 931 TEE_Panic(res); 932 src += l; 933 slen -= l; 934 dst += tmp_dlen; 935 dlen -= tmp_dlen; 936 acc_dlen += tmp_dlen; 937 } 938 939 /* Slen is small enough to be contained in buffer. */ 940 memcpy(op->buffer + op->buffer_offs, src, slen); 941 op->buffer_offs += slen; 942 943 out: 944 *dest_len = acc_dlen; 945 return TEE_SUCCESS; 946 } 947 948 TEE_Result TEE_CipherUpdate(TEE_OperationHandle operation, void *srcData, 949 uint32_t srcLen, void *destData, uint32_t *destLen) 950 { 951 TEE_Result res; 952 size_t req_dlen; 953 uint64_t dl; 954 955 if (operation == TEE_HANDLE_NULL || 956 (srcData == NULL && srcLen != 0) || 957 destLen == NULL || 958 (destData == NULL && *destLen != 0)) { 959 res = TEE_ERROR_BAD_PARAMETERS; 960 goto out; 961 } 962 963 if (operation->info.operationClass != TEE_OPERATION_CIPHER) { 964 res = TEE_ERROR_BAD_PARAMETERS; 965 goto out; 966 } 967 968 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 969 res = TEE_ERROR_BAD_PARAMETERS; 970 goto out; 971 } 972 973 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 974 res = TEE_ERROR_BAD_PARAMETERS; 975 goto out; 976 } 977 978 if (!srcData && !srcLen) { 979 res = TEE_SUCCESS; 980 goto out; 981 } 982 983 /* Calculate required dlen */ 984 req_dlen = ((operation->buffer_offs + srcLen) / operation->block_size) * 985 operation->block_size; 986 if (operation->buffer_two_blocks) { 987 if (req_dlen > operation->block_size * 2) 988 req_dlen -= operation->block_size * 2; 989 else 990 req_dlen = 0; 991 } 992 /* 993 * Check that required destLen is big enough before starting to feed 994 * data to the algorithm. Errors during feeding of data are fatal as we 995 * can't restore sync with this API. 996 */ 997 if (*destLen < req_dlen) { 998 *destLen = req_dlen; 999 res = TEE_ERROR_SHORT_BUFFER; 1000 goto out; 1001 } 1002 1003 dl = *destLen; 1004 res = tee_buffer_update(operation, utee_cipher_update, srcData, srcLen, 1005 destData, &dl); 1006 *destLen = dl; 1007 1008 out: 1009 if (res != TEE_SUCCESS && 1010 res != TEE_ERROR_SHORT_BUFFER) 1011 TEE_Panic(0); 1012 1013 return res; 1014 } 1015 1016 TEE_Result TEE_CipherDoFinal(TEE_OperationHandle operation, 1017 void *srcData, uint32_t srcLen, void *destData, 1018 uint32_t *destLen) 1019 { 1020 TEE_Result res; 1021 uint8_t *dst = destData; 1022 size_t acc_dlen = 0; 1023 uint64_t tmp_dlen; 1024 size_t req_dlen; 1025 1026 if (operation == TEE_HANDLE_NULL || 1027 (srcData == NULL && srcLen != 0) || 1028 destLen == NULL || 1029 (destData == NULL && *destLen != 0)) { 1030 res = TEE_ERROR_BAD_PARAMETERS; 1031 goto out; 1032 } 1033 1034 if (operation->info.operationClass != TEE_OPERATION_CIPHER) { 1035 res = TEE_ERROR_BAD_PARAMETERS; 1036 goto out; 1037 } 1038 1039 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1040 res = TEE_ERROR_BAD_PARAMETERS; 1041 goto out; 1042 } 1043 1044 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 1045 res = TEE_ERROR_BAD_PARAMETERS; 1046 goto out; 1047 } 1048 1049 /* 1050 * Check that the final block doesn't require padding for those 1051 * algorithms that requires client to supply padding. 1052 */ 1053 if (operation->info.algorithm == TEE_ALG_AES_ECB_NOPAD || 1054 operation->info.algorithm == TEE_ALG_AES_CBC_NOPAD || 1055 operation->info.algorithm == TEE_ALG_DES_ECB_NOPAD || 1056 operation->info.algorithm == TEE_ALG_DES_CBC_NOPAD || 1057 operation->info.algorithm == TEE_ALG_DES3_ECB_NOPAD || 1058 operation->info.algorithm == TEE_ALG_DES3_CBC_NOPAD) { 1059 if (((operation->buffer_offs + srcLen) % operation->block_size) 1060 != 0) { 1061 res = TEE_ERROR_BAD_PARAMETERS; 1062 goto out; 1063 } 1064 } 1065 1066 if (!srcData && !srcLen) { 1067 res = TEE_SUCCESS; 1068 goto out; 1069 } 1070 1071 /* 1072 * Check that required destLen is big enough before starting to feed 1073 * data to the algorithm. Errors during feeding of data are fatal as we 1074 * can't restore sync with this API. 1075 */ 1076 req_dlen = operation->buffer_offs + srcLen; 1077 if (*destLen < req_dlen) { 1078 *destLen = req_dlen; 1079 res = TEE_ERROR_SHORT_BUFFER; 1080 goto out; 1081 } 1082 1083 tmp_dlen = *destLen - acc_dlen; 1084 res = tee_buffer_update(operation, utee_cipher_update, srcData, srcLen, 1085 dst, &tmp_dlen); 1086 if (res != TEE_SUCCESS) 1087 goto out; 1088 1089 dst += tmp_dlen; 1090 acc_dlen += tmp_dlen; 1091 1092 tmp_dlen = *destLen - acc_dlen; 1093 res = utee_cipher_final(operation->state, operation->buffer, 1094 operation->buffer_offs, dst, &tmp_dlen); 1095 if (res != TEE_SUCCESS) 1096 goto out; 1097 1098 acc_dlen += tmp_dlen; 1099 *destLen = acc_dlen; 1100 1101 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1102 1103 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1104 1105 out: 1106 if (res != TEE_SUCCESS && 1107 res != TEE_ERROR_SHORT_BUFFER) 1108 TEE_Panic(0); 1109 1110 return res; 1111 } 1112 1113 /* Cryptographic Operations API - MAC Functions */ 1114 1115 void TEE_MACInit(TEE_OperationHandle operation, void *IV, uint32_t IVLen) 1116 { 1117 if (operation == TEE_HANDLE_NULL) 1118 TEE_Panic(0); 1119 1120 if (operation->info.operationClass != TEE_OPERATION_MAC) 1121 TEE_Panic(0); 1122 1123 if (!(operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) || 1124 !(operation->key1)) 1125 TEE_Panic(0); 1126 1127 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) 1128 TEE_ResetOperation(operation); 1129 1130 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 1131 1132 init_hash_operation(operation, IV, IVLen); 1133 } 1134 1135 void TEE_MACUpdate(TEE_OperationHandle operation, void *chunk, 1136 uint32_t chunkSize) 1137 { 1138 TEE_Result res; 1139 1140 if (operation == TEE_HANDLE_NULL || (chunk == NULL && chunkSize != 0)) 1141 TEE_Panic(0); 1142 1143 if (operation->info.operationClass != TEE_OPERATION_MAC) 1144 TEE_Panic(0); 1145 1146 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 1147 TEE_Panic(0); 1148 1149 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) 1150 TEE_Panic(0); 1151 1152 res = utee_hash_update(operation->state, chunk, chunkSize); 1153 if (res != TEE_SUCCESS) 1154 TEE_Panic(res); 1155 } 1156 1157 TEE_Result TEE_MACComputeFinal(TEE_OperationHandle operation, 1158 void *message, uint32_t messageLen, 1159 void *mac, uint32_t *macLen) 1160 { 1161 TEE_Result res; 1162 uint64_t ml; 1163 1164 if (operation == TEE_HANDLE_NULL || 1165 (message == NULL && messageLen != 0) || 1166 mac == NULL || 1167 macLen == NULL) { 1168 res = TEE_ERROR_BAD_PARAMETERS; 1169 goto out; 1170 } 1171 1172 if (operation->info.operationClass != TEE_OPERATION_MAC) { 1173 res = TEE_ERROR_BAD_PARAMETERS; 1174 goto out; 1175 } 1176 1177 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1178 res = TEE_ERROR_BAD_PARAMETERS; 1179 goto out; 1180 } 1181 1182 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 1183 res = TEE_ERROR_BAD_PARAMETERS; 1184 goto out; 1185 } 1186 1187 ml = *macLen; 1188 res = utee_hash_final(operation->state, message, messageLen, mac, &ml); 1189 *macLen = ml; 1190 if (res != TEE_SUCCESS) 1191 goto out; 1192 1193 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1194 1195 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1196 1197 out: 1198 if (res != TEE_SUCCESS && 1199 res != TEE_ERROR_SHORT_BUFFER) 1200 TEE_Panic(res); 1201 1202 return res; 1203 } 1204 1205 TEE_Result TEE_MACCompareFinal(TEE_OperationHandle operation, 1206 void *message, uint32_t messageLen, 1207 void *mac, uint32_t macLen) 1208 { 1209 TEE_Result res; 1210 uint8_t computed_mac[TEE_MAX_HASH_SIZE]; 1211 uint32_t computed_mac_size = TEE_MAX_HASH_SIZE; 1212 1213 if (operation->info.operationClass != TEE_OPERATION_MAC) { 1214 res = TEE_ERROR_BAD_PARAMETERS; 1215 goto out; 1216 } 1217 1218 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1219 res = TEE_ERROR_BAD_PARAMETERS; 1220 goto out; 1221 } 1222 1223 if (operation->operationState != TEE_OPERATION_STATE_ACTIVE) { 1224 res = TEE_ERROR_BAD_PARAMETERS; 1225 goto out; 1226 } 1227 1228 res = TEE_MACComputeFinal(operation, message, messageLen, computed_mac, 1229 &computed_mac_size); 1230 if (res != TEE_SUCCESS) 1231 goto out; 1232 1233 if (computed_mac_size != macLen) { 1234 res = TEE_ERROR_MAC_INVALID; 1235 goto out; 1236 } 1237 1238 if (buf_compare_ct(mac, computed_mac, computed_mac_size) != 0) { 1239 res = TEE_ERROR_MAC_INVALID; 1240 goto out; 1241 } 1242 1243 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1244 1245 out: 1246 if (res != TEE_SUCCESS && 1247 res != TEE_ERROR_MAC_INVALID) 1248 TEE_Panic(res); 1249 1250 return res; 1251 } 1252 1253 /* Cryptographic Operations API - Authenticated Encryption Functions */ 1254 1255 TEE_Result TEE_AEInit(TEE_OperationHandle operation, void *nonce, 1256 uint32_t nonceLen, uint32_t tagLen, uint32_t AADLen, 1257 uint32_t payloadLen) 1258 { 1259 TEE_Result res; 1260 1261 if (operation == TEE_HANDLE_NULL || nonce == NULL) { 1262 res = TEE_ERROR_BAD_PARAMETERS; 1263 goto out; 1264 } 1265 1266 if (operation->info.operationClass != TEE_OPERATION_AE) { 1267 res = TEE_ERROR_BAD_PARAMETERS; 1268 goto out; 1269 } 1270 1271 if (operation->operationState != TEE_OPERATION_STATE_INITIAL) { 1272 res = TEE_ERROR_BAD_PARAMETERS; 1273 goto out; 1274 } 1275 1276 /* 1277 * AES-CCM tag len is specified by AES-CCM spec and handled in TEE Core 1278 * in the implementation. But AES-GCM spec doesn't specify the tag len 1279 * according to the same principle so we have to check here instead to 1280 * be GP compliant. 1281 */ 1282 if (operation->info.algorithm == TEE_ALG_AES_GCM) { 1283 /* 1284 * From GP spec: For AES-GCM, can be 128, 120, 112, 104, or 96 1285 */ 1286 if (tagLen < 96 || tagLen > 128 || (tagLen % 8 != 0)) { 1287 res = TEE_ERROR_NOT_SUPPORTED; 1288 goto out; 1289 } 1290 } 1291 1292 res = utee_authenc_init(operation->state, nonce, nonceLen, 1293 tagLen / 8, AADLen, payloadLen); 1294 if (res != TEE_SUCCESS) 1295 goto out; 1296 1297 operation->ae_tag_len = tagLen / 8; 1298 operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED; 1299 1300 out: 1301 if (res != TEE_SUCCESS && 1302 res != TEE_ERROR_NOT_SUPPORTED) 1303 TEE_Panic(res); 1304 1305 return res; 1306 } 1307 1308 void TEE_AEUpdateAAD(TEE_OperationHandle operation, void *AADdata, 1309 uint32_t AADdataLen) 1310 { 1311 TEE_Result res; 1312 1313 if (operation == TEE_HANDLE_NULL || 1314 (AADdata == NULL && AADdataLen != 0)) 1315 TEE_Panic(0); 1316 1317 if (operation->info.operationClass != TEE_OPERATION_AE) 1318 TEE_Panic(0); 1319 1320 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) 1321 TEE_Panic(0); 1322 1323 res = utee_authenc_update_aad(operation->state, AADdata, AADdataLen); 1324 1325 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 1326 1327 if (res != TEE_SUCCESS) 1328 TEE_Panic(res); 1329 } 1330 1331 TEE_Result TEE_AEUpdate(TEE_OperationHandle operation, void *srcData, 1332 uint32_t srcLen, void *destData, uint32_t *destLen) 1333 { 1334 TEE_Result res; 1335 size_t req_dlen; 1336 uint64_t dl; 1337 1338 if (operation == TEE_HANDLE_NULL || 1339 (srcData == NULL && srcLen != 0) || 1340 destLen == NULL || 1341 (destData == NULL && *destLen != 0)) { 1342 res = TEE_ERROR_BAD_PARAMETERS; 1343 goto out; 1344 } 1345 1346 if (operation->info.operationClass != TEE_OPERATION_AE) { 1347 res = TEE_ERROR_BAD_PARAMETERS; 1348 goto out; 1349 } 1350 1351 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1352 res = TEE_ERROR_BAD_PARAMETERS; 1353 goto out; 1354 } 1355 1356 /* 1357 * Check that required destLen is big enough before starting to feed 1358 * data to the algorithm. Errors during feeding of data are fatal as we 1359 * can't restore sync with this API. 1360 */ 1361 req_dlen = ROUNDDOWN(operation->buffer_offs + srcLen, 1362 operation->block_size); 1363 if (*destLen < req_dlen) { 1364 *destLen = req_dlen; 1365 res = TEE_ERROR_SHORT_BUFFER; 1366 goto out; 1367 } 1368 1369 dl = *destLen; 1370 res = tee_buffer_update(operation, utee_authenc_update_payload, srcData, 1371 srcLen, destData, &dl); 1372 *destLen = dl; 1373 1374 operation->operationState = TEE_OPERATION_STATE_ACTIVE; 1375 1376 out: 1377 if (res != TEE_SUCCESS && 1378 res != TEE_ERROR_SHORT_BUFFER) 1379 TEE_Panic(res); 1380 1381 return res; 1382 } 1383 1384 TEE_Result TEE_AEEncryptFinal(TEE_OperationHandle operation, 1385 void *srcData, uint32_t srcLen, 1386 void *destData, uint32_t *destLen, void *tag, 1387 uint32_t *tagLen) 1388 { 1389 TEE_Result res; 1390 uint8_t *dst = destData; 1391 size_t acc_dlen = 0; 1392 uint64_t tmp_dlen; 1393 size_t req_dlen; 1394 uint64_t tl; 1395 1396 if (operation == TEE_HANDLE_NULL || 1397 (srcData == NULL && srcLen != 0) || 1398 destLen == NULL || 1399 (destData == NULL && *destLen != 0) || 1400 tag == NULL || tagLen == NULL) { 1401 res = TEE_ERROR_BAD_PARAMETERS; 1402 goto out; 1403 } 1404 1405 if (operation->info.operationClass != TEE_OPERATION_AE) { 1406 res = TEE_ERROR_BAD_PARAMETERS; 1407 goto out; 1408 } 1409 1410 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1411 res = TEE_ERROR_BAD_PARAMETERS; 1412 goto out; 1413 } 1414 1415 /* 1416 * Check that required destLen is big enough before starting to feed 1417 * data to the algorithm. Errors during feeding of data are fatal as we 1418 * can't restore sync with this API. 1419 */ 1420 req_dlen = operation->buffer_offs + srcLen; 1421 if (*destLen < req_dlen) { 1422 *destLen = req_dlen; 1423 res = TEE_ERROR_SHORT_BUFFER; 1424 goto out; 1425 } 1426 1427 /* 1428 * Need to check this before update_payload since sync would be lost if 1429 * we return short buffer after that. 1430 */ 1431 if (*tagLen < operation->ae_tag_len) { 1432 *tagLen = operation->ae_tag_len; 1433 res = TEE_ERROR_SHORT_BUFFER; 1434 goto out; 1435 } 1436 1437 tmp_dlen = *destLen - acc_dlen; 1438 res = tee_buffer_update(operation, utee_authenc_update_payload, srcData, 1439 srcLen, dst, &tmp_dlen); 1440 if (res != TEE_SUCCESS) 1441 goto out; 1442 1443 dst += tmp_dlen; 1444 acc_dlen += tmp_dlen; 1445 1446 tmp_dlen = *destLen - acc_dlen; 1447 tl = *tagLen; 1448 res = utee_authenc_enc_final(operation->state, operation->buffer, 1449 operation->buffer_offs, dst, &tmp_dlen, 1450 tag, &tl); 1451 *tagLen = tl; 1452 if (res != TEE_SUCCESS) 1453 goto out; 1454 1455 acc_dlen += tmp_dlen; 1456 *destLen = acc_dlen; 1457 1458 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1459 1460 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1461 1462 out: 1463 if (res != TEE_SUCCESS && 1464 res != TEE_ERROR_SHORT_BUFFER) 1465 TEE_Panic(res); 1466 1467 return res; 1468 } 1469 1470 TEE_Result TEE_AEDecryptFinal(TEE_OperationHandle operation, 1471 void *srcData, uint32_t srcLen, 1472 void *destData, uint32_t *destLen, void *tag, 1473 uint32_t tagLen) 1474 { 1475 TEE_Result res; 1476 uint8_t *dst = destData; 1477 size_t acc_dlen = 0; 1478 uint64_t tmp_dlen; 1479 size_t req_dlen; 1480 1481 if (operation == TEE_HANDLE_NULL || 1482 (srcData == NULL && srcLen != 0) || 1483 destLen == NULL || 1484 (destData == NULL && *destLen != 0) || 1485 (tag == NULL && tagLen != 0)) { 1486 res = TEE_ERROR_BAD_PARAMETERS; 1487 goto out; 1488 } 1489 1490 if (operation->info.operationClass != TEE_OPERATION_AE) { 1491 res = TEE_ERROR_BAD_PARAMETERS; 1492 goto out; 1493 } 1494 1495 if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) { 1496 res = TEE_ERROR_BAD_PARAMETERS; 1497 goto out; 1498 } 1499 1500 /* 1501 * Check that required destLen is big enough before starting to feed 1502 * data to the algorithm. Errors during feeding of data are fatal as we 1503 * can't restore sync with this API. 1504 */ 1505 req_dlen = operation->buffer_offs + srcLen; 1506 if (*destLen < req_dlen) { 1507 *destLen = req_dlen; 1508 res = TEE_ERROR_SHORT_BUFFER; 1509 goto out; 1510 } 1511 1512 tmp_dlen = *destLen - acc_dlen; 1513 res = tee_buffer_update(operation, utee_authenc_update_payload, srcData, 1514 srcLen, dst, &tmp_dlen); 1515 if (res != TEE_SUCCESS) 1516 goto out; 1517 1518 dst += tmp_dlen; 1519 acc_dlen += tmp_dlen; 1520 1521 tmp_dlen = *destLen - acc_dlen; 1522 res = utee_authenc_dec_final(operation->state, operation->buffer, 1523 operation->buffer_offs, dst, &tmp_dlen, 1524 tag, tagLen); 1525 if (res != TEE_SUCCESS) 1526 goto out; 1527 1528 /* Supplied tagLen should match what we initiated with */ 1529 if (tagLen != operation->ae_tag_len) 1530 res = TEE_ERROR_MAC_INVALID; 1531 1532 acc_dlen += tmp_dlen; 1533 *destLen = acc_dlen; 1534 1535 operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED; 1536 1537 operation->operationState = TEE_OPERATION_STATE_INITIAL; 1538 1539 out: 1540 if (res != TEE_SUCCESS && 1541 res != TEE_ERROR_SHORT_BUFFER && 1542 res != TEE_ERROR_MAC_INVALID) 1543 TEE_Panic(res); 1544 1545 return res; 1546 } 1547 1548 /* Cryptographic Operations API - Asymmetric Functions */ 1549 1550 TEE_Result TEE_AsymmetricEncrypt(TEE_OperationHandle operation, 1551 TEE_Attribute *params, 1552 uint32_t paramCount, void *srcData, 1553 uint32_t srcLen, void *destData, 1554 uint32_t *destLen) 1555 { 1556 TEE_Result res; 1557 struct utee_attribute ua[paramCount]; 1558 uint64_t dl; 1559 1560 if (operation == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 1561 destLen == NULL || (destData == NULL && *destLen != 0)) 1562 TEE_Panic(0); 1563 if (params == NULL && paramCount != 0) 1564 TEE_Panic(0); 1565 if (!operation->key1) 1566 TEE_Panic(0); 1567 if (operation->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER) 1568 TEE_Panic(0); 1569 if (operation->info.mode != TEE_MODE_ENCRYPT) 1570 TEE_Panic(0); 1571 1572 __utee_from_attr(ua, params, paramCount); 1573 dl = *destLen; 1574 res = utee_asymm_operate(operation->state, ua, paramCount, srcData, 1575 srcLen, destData, &dl); 1576 *destLen = dl; 1577 1578 if (res != TEE_SUCCESS && 1579 res != TEE_ERROR_SHORT_BUFFER && 1580 res != TEE_ERROR_BAD_PARAMETERS) 1581 TEE_Panic(res); 1582 1583 return res; 1584 } 1585 1586 TEE_Result TEE_AsymmetricDecrypt(TEE_OperationHandle operation, 1587 TEE_Attribute *params, 1588 uint32_t paramCount, void *srcData, 1589 uint32_t srcLen, void *destData, 1590 uint32_t *destLen) 1591 { 1592 TEE_Result res; 1593 struct utee_attribute ua[paramCount]; 1594 uint64_t dl; 1595 1596 if (operation == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) || 1597 destLen == NULL || (destData == NULL && *destLen != 0)) 1598 TEE_Panic(0); 1599 if (params == NULL && paramCount != 0) 1600 TEE_Panic(0); 1601 if (!operation->key1) 1602 TEE_Panic(0); 1603 if (operation->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER) 1604 TEE_Panic(0); 1605 if (operation->info.mode != TEE_MODE_DECRYPT) 1606 TEE_Panic(0); 1607 1608 __utee_from_attr(ua, params, paramCount); 1609 dl = *destLen; 1610 res = utee_asymm_operate(operation->state, ua, paramCount, srcData, 1611 srcLen, destData, &dl); 1612 *destLen = dl; 1613 1614 if (res != TEE_SUCCESS && 1615 res != TEE_ERROR_SHORT_BUFFER && 1616 res != TEE_ERROR_BAD_PARAMETERS) 1617 TEE_Panic(res); 1618 1619 return res; 1620 } 1621 1622 TEE_Result TEE_AsymmetricSignDigest(TEE_OperationHandle operation, 1623 TEE_Attribute *params, 1624 uint32_t paramCount, void *digest, 1625 uint32_t digestLen, void *signature, 1626 uint32_t *signatureLen) 1627 { 1628 TEE_Result res; 1629 struct utee_attribute ua[paramCount]; 1630 uint64_t sl; 1631 1632 if (operation == TEE_HANDLE_NULL || 1633 (digest == NULL && digestLen != 0) || 1634 signature == NULL || signatureLen == NULL) 1635 TEE_Panic(0); 1636 if (params == NULL && paramCount != 0) 1637 TEE_Panic(0); 1638 if (!operation->key1) 1639 TEE_Panic(0); 1640 if (operation->info.operationClass != 1641 TEE_OPERATION_ASYMMETRIC_SIGNATURE) 1642 TEE_Panic(0); 1643 if (operation->info.mode != TEE_MODE_SIGN) 1644 TEE_Panic(0); 1645 1646 __utee_from_attr(ua, params, paramCount); 1647 sl = *signatureLen; 1648 res = utee_asymm_operate(operation->state, ua, paramCount, digest, 1649 digestLen, signature, &sl); 1650 *signatureLen = sl; 1651 1652 if (res != TEE_SUCCESS && res != TEE_ERROR_SHORT_BUFFER) 1653 TEE_Panic(res); 1654 1655 return res; 1656 } 1657 1658 TEE_Result TEE_AsymmetricVerifyDigest(TEE_OperationHandle operation, 1659 TEE_Attribute *params, 1660 uint32_t paramCount, void *digest, 1661 uint32_t digestLen, void *signature, 1662 uint32_t signatureLen) 1663 { 1664 TEE_Result res; 1665 struct utee_attribute ua[paramCount]; 1666 1667 if (operation == TEE_HANDLE_NULL || 1668 (digest == NULL && digestLen != 0) || 1669 (signature == NULL && signatureLen != 0)) 1670 TEE_Panic(0); 1671 if (params == NULL && paramCount != 0) 1672 TEE_Panic(0); 1673 if (!operation->key1) 1674 TEE_Panic(0); 1675 if (operation->info.operationClass != 1676 TEE_OPERATION_ASYMMETRIC_SIGNATURE) 1677 TEE_Panic(0); 1678 if (operation->info.mode != TEE_MODE_VERIFY) 1679 TEE_Panic(0); 1680 1681 __utee_from_attr(ua, params, paramCount); 1682 res = utee_asymm_verify(operation->state, ua, paramCount, digest, 1683 digestLen, signature, signatureLen); 1684 1685 if (res != TEE_SUCCESS && res != TEE_ERROR_SIGNATURE_INVALID) 1686 TEE_Panic(res); 1687 1688 return res; 1689 } 1690 1691 /* Cryptographic Operations API - Key Derivation Functions */ 1692 1693 void TEE_DeriveKey(TEE_OperationHandle operation, 1694 const TEE_Attribute *params, uint32_t paramCount, 1695 TEE_ObjectHandle derivedKey) 1696 { 1697 TEE_Result res; 1698 TEE_ObjectInfo key_info; 1699 struct utee_attribute ua[paramCount]; 1700 1701 if (operation == TEE_HANDLE_NULL || derivedKey == 0) 1702 TEE_Panic(0); 1703 if (params == NULL && paramCount != 0) 1704 TEE_Panic(0); 1705 if (TEE_ALG_GET_CLASS(operation->info.algorithm) != 1706 TEE_OPERATION_KEY_DERIVATION) 1707 TEE_Panic(0); 1708 1709 if (operation->info.operationClass != TEE_OPERATION_KEY_DERIVATION) 1710 TEE_Panic(0); 1711 if (!operation->key1) 1712 TEE_Panic(0); 1713 if (operation->info.mode != TEE_MODE_DERIVE) 1714 TEE_Panic(0); 1715 if ((operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) == 0) 1716 TEE_Panic(0); 1717 1718 res = utee_cryp_obj_get_info((unsigned long)derivedKey, &key_info); 1719 if (res != TEE_SUCCESS) 1720 TEE_Panic(0); 1721 1722 if (key_info.objectType != TEE_TYPE_GENERIC_SECRET) 1723 TEE_Panic(0); 1724 if ((key_info.handleFlags & TEE_HANDLE_FLAG_INITIALIZED) != 0) 1725 TEE_Panic(0); 1726 1727 __utee_from_attr(ua, params, paramCount); 1728 res = utee_cryp_derive_key(operation->state, ua, paramCount, 1729 (unsigned long)derivedKey); 1730 if (res != TEE_SUCCESS) 1731 TEE_Panic(res); 1732 } 1733 1734 /* Cryptographic Operations API - Random Number Generation Functions */ 1735 1736 void TEE_GenerateRandom(void *randomBuffer, uint32_t randomBufferLen) 1737 { 1738 TEE_Result res; 1739 1740 res = utee_cryp_random_number_generate(randomBuffer, randomBufferLen); 1741 if (res != TEE_SUCCESS) 1742 TEE_Panic(res); 1743 } 1744