1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2018-2021, Linaro Limited 4 */ 5 6 #include <assert.h> 7 #include <pkcs11_ta.h> 8 #include <tee_api_defines.h> 9 #include <tee_internal_api.h> 10 #include <tee_internal_api_extensions.h> 11 12 #include "attributes.h" 13 #include "object.h" 14 #include "pkcs11_token.h" 15 #include "processing.h" 16 17 enum pkcs11_rc 18 pkcs2tee_proc_params_rsa_pss(struct active_processing *proc, 19 struct pkcs11_attribute_head *proc_params) 20 { 21 struct serialargs args = { }; 22 enum pkcs11_rc rc = PKCS11_CKR_GENERAL_ERROR; 23 struct rsa_pss_processing_ctx *ctx = NULL; 24 uint32_t hash = 0; 25 uint32_t mgf = 0; 26 uint32_t salt_len = 0; 27 28 serialargs_init(&args, proc_params->data, proc_params->size); 29 30 rc = serialargs_get_u32(&args, &hash); 31 if (rc) 32 return rc; 33 34 rc = serialargs_get_u32(&args, &mgf); 35 if (rc) 36 return rc; 37 38 rc = serialargs_get_u32(&args, &salt_len); 39 if (rc) 40 return rc; 41 42 if (serialargs_remaining_bytes(&args)) 43 return PKCS11_CKR_ARGUMENTS_BAD; 44 45 proc->extra_ctx = TEE_Malloc(sizeof(struct rsa_pss_processing_ctx), 46 TEE_USER_MEM_HINT_NO_FILL_ZERO); 47 if (!proc->extra_ctx) 48 return PKCS11_CKR_DEVICE_MEMORY; 49 50 ctx = proc->extra_ctx; 51 52 ctx->hash_alg = hash; 53 ctx->mgf_type = mgf; 54 ctx->salt_len = salt_len; 55 56 return PKCS11_CKR_OK; 57 } 58 59 enum pkcs11_rc pkcs2tee_validate_rsa_pss(struct active_processing *proc, 60 struct pkcs11_object *obj) 61 { 62 struct rsa_pss_processing_ctx *rsa_pss_ctx = NULL; 63 size_t modulus_size = 0; 64 size_t hash_size = 0; 65 uint32_t k = 0; 66 67 rsa_pss_ctx = proc->extra_ctx; 68 assert(rsa_pss_ctx); 69 70 switch (rsa_pss_ctx->hash_alg) { 71 case PKCS11_CKM_SHA_1: 72 hash_size = TEE_ALG_GET_DIGEST_SIZE(TEE_ALG_SHA1); 73 break; 74 case PKCS11_CKM_SHA224: 75 hash_size = TEE_ALG_GET_DIGEST_SIZE(TEE_ALG_SHA224); 76 break; 77 case PKCS11_CKM_SHA256: 78 hash_size = TEE_ALG_GET_DIGEST_SIZE(TEE_ALG_SHA256); 79 break; 80 case PKCS11_CKM_SHA384: 81 hash_size = TEE_ALG_GET_DIGEST_SIZE(TEE_ALG_SHA384); 82 break; 83 case PKCS11_CKM_SHA512: 84 hash_size = TEE_ALG_GET_DIGEST_SIZE(TEE_ALG_SHA512); 85 break; 86 default: 87 assert(0); 88 break; 89 } 90 91 modulus_size = get_object_key_bit_size(obj); 92 93 /** 94 * The sLen field must be less than or equal to k*-2-hLen where 95 * hLen is the length in bytes of the hash value. k* is the 96 * length in bytes of the RSA modulus, except if the length in 97 * bits of the RSA modulus is one more than a multiple of 8, in 98 * which case k* is one less than the length in bytes of the 99 * RSA modulus. 100 */ 101 if ((modulus_size % 8) == 1) 102 k = modulus_size / 8; 103 else 104 k = ROUNDUP(modulus_size, 8) / 8; 105 106 if (rsa_pss_ctx->salt_len > (k - 2 - hash_size)) 107 return PKCS11_CKR_KEY_SIZE_RANGE; 108 109 return PKCS11_CKR_OK; 110 } 111 112 /* 113 * Check or set TEE algorithm identifier upon PKCS11 mechanism parameters 114 * @tee_id: Input and/or output TEE algorithm identifier 115 * @proc_params: PKCS11 processing parameters 116 */ 117 enum pkcs11_rc pkcs2tee_algo_rsa_pss(uint32_t *tee_id, 118 struct pkcs11_attribute_head *proc_params) 119 { 120 struct serialargs args = { }; 121 enum pkcs11_rc rc = PKCS11_CKR_GENERAL_ERROR; 122 uint32_t hash = 0; 123 uint32_t mgf = 0; 124 uint32_t salt_len = 0; 125 126 serialargs_init(&args, proc_params->data, proc_params->size); 127 128 rc = serialargs_get_u32(&args, &hash); 129 if (rc) 130 return rc; 131 132 rc = serialargs_get_u32(&args, &mgf); 133 if (rc) 134 return rc; 135 136 rc = serialargs_get_u32(&args, &salt_len); 137 if (rc) 138 return rc; 139 140 if (serialargs_remaining_bytes(&args)) 141 return PKCS11_CKR_ARGUMENTS_BAD; 142 143 if (proc_params->id == PKCS11_CKM_RSA_PKCS_PSS) { 144 if (hash == PKCS11_CKM_SHA_1 && mgf == PKCS11_CKG_MGF1_SHA1) { 145 *tee_id = TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA1; 146 return PKCS11_CKR_OK; 147 } 148 if (hash == PKCS11_CKM_SHA224 && 149 mgf == PKCS11_CKG_MGF1_SHA224) { 150 *tee_id = TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA224; 151 return PKCS11_CKR_OK; 152 } 153 if (hash == PKCS11_CKM_SHA256 && 154 mgf == PKCS11_CKG_MGF1_SHA256) { 155 *tee_id = TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256; 156 return PKCS11_CKR_OK; 157 } 158 if (hash == PKCS11_CKM_SHA384 && 159 mgf == PKCS11_CKG_MGF1_SHA384) { 160 *tee_id = TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA384; 161 return PKCS11_CKR_OK; 162 } 163 if (hash == PKCS11_CKM_SHA512 && 164 mgf == PKCS11_CKG_MGF1_SHA512) { 165 *tee_id = TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA512; 166 return PKCS11_CKR_OK; 167 } 168 return PKCS11_CKR_MECHANISM_PARAM_INVALID; 169 } 170 171 switch (*tee_id) { 172 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA1: 173 if (hash != PKCS11_CKM_SHA_1 || mgf != PKCS11_CKG_MGF1_SHA1) 174 return PKCS11_CKR_MECHANISM_PARAM_INVALID; 175 break; 176 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA224: 177 if (hash != PKCS11_CKM_SHA224 || mgf != PKCS11_CKG_MGF1_SHA224) 178 return PKCS11_CKR_MECHANISM_PARAM_INVALID; 179 break; 180 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256: 181 if (hash != PKCS11_CKM_SHA256 || mgf != PKCS11_CKG_MGF1_SHA256) 182 return PKCS11_CKR_MECHANISM_PARAM_INVALID; 183 break; 184 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA384: 185 if (hash != PKCS11_CKM_SHA384 || mgf != PKCS11_CKG_MGF1_SHA384) 186 return PKCS11_CKR_MECHANISM_PARAM_INVALID; 187 break; 188 case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA512: 189 if (hash != PKCS11_CKM_SHA512 || mgf != PKCS11_CKG_MGF1_SHA512) 190 return PKCS11_CKR_MECHANISM_PARAM_INVALID; 191 break; 192 default: 193 return PKCS11_CKR_GENERAL_ERROR; 194 } 195 196 return PKCS11_CKR_OK; 197 } 198 199 enum pkcs11_rc 200 pkcs2tee_proc_params_rsa_oaep(struct active_processing *proc, 201 struct pkcs11_attribute_head *proc_params) 202 { 203 struct serialargs args = { }; 204 enum pkcs11_rc rc = PKCS11_CKR_GENERAL_ERROR; 205 struct rsa_oaep_processing_ctx *ctx = NULL; 206 uint32_t hash = 0; 207 uint32_t mgf = 0; 208 uint32_t source_type = 0; 209 void *source_data = NULL; 210 uint32_t source_size = 0; 211 212 serialargs_init(&args, proc_params->data, proc_params->size); 213 214 rc = serialargs_get_u32(&args, &hash); 215 if (rc) 216 return rc; 217 218 rc = serialargs_get_u32(&args, &mgf); 219 if (rc) 220 return rc; 221 222 rc = serialargs_get_u32(&args, &source_type); 223 if (rc) 224 return rc; 225 226 rc = serialargs_get_u32(&args, &source_size); 227 if (rc) 228 return rc; 229 230 rc = serialargs_get_ptr(&args, &source_data, source_size); 231 if (rc) 232 return rc; 233 234 if (serialargs_remaining_bytes(&args)) 235 return PKCS11_CKR_ARGUMENTS_BAD; 236 237 proc->extra_ctx = TEE_Malloc(sizeof(struct rsa_oaep_processing_ctx) + 238 source_size, 239 TEE_USER_MEM_HINT_NO_FILL_ZERO); 240 if (!proc->extra_ctx) 241 return PKCS11_CKR_DEVICE_MEMORY; 242 243 ctx = proc->extra_ctx; 244 245 ctx->hash_alg = hash; 246 ctx->mgf_type = mgf; 247 ctx->source_type = source_type; 248 ctx->source_data_len = source_size; 249 TEE_MemMove(ctx->source_data, source_data, source_size); 250 251 return PKCS11_CKR_OK; 252 } 253 254 /* 255 * Set TEE RSA OAEP algorithm identifier upon PKCS11 mechanism parameters 256 * @tee_id: output TEE RSA OAEP algorithm identifier 257 * @tee_hash_id: output TEE hash algorithm identifier 258 * @proc_params: PKCS11 processing parameters 259 */ 260 enum pkcs11_rc 261 pkcs2tee_algo_rsa_oaep(uint32_t *tee_id, uint32_t *tee_hash_id, 262 struct pkcs11_attribute_head *proc_params) 263 { 264 struct serialargs args = { }; 265 enum pkcs11_rc rc = PKCS11_CKR_GENERAL_ERROR; 266 uint32_t hash = 0; 267 uint32_t mgf = 0; 268 uint32_t source_type = 0; 269 void *source_data = NULL; 270 uint32_t source_size = 0; 271 272 serialargs_init(&args, proc_params->data, proc_params->size); 273 274 rc = serialargs_get_u32(&args, &hash); 275 if (rc) 276 return rc; 277 278 rc = serialargs_get_u32(&args, &mgf); 279 if (rc) 280 return rc; 281 282 rc = serialargs_get_u32(&args, &source_type); 283 if (rc) 284 return rc; 285 286 rc = serialargs_get_u32(&args, &source_size); 287 if (rc) 288 return rc; 289 290 rc = serialargs_get_ptr(&args, &source_data, source_size); 291 if (rc) 292 return rc; 293 294 if (serialargs_remaining_bytes(&args)) 295 return PKCS11_CKR_ARGUMENTS_BAD; 296 297 if (source_type != PKCS11_CKZ_DATA_SPECIFIED) 298 return PKCS11_CKR_MECHANISM_PARAM_INVALID; 299 300 switch (proc_params->id) { 301 case PKCS11_CKM_RSA_PKCS_OAEP: 302 switch (hash) { 303 case PKCS11_CKM_SHA_1: 304 if (mgf != PKCS11_CKG_MGF1_SHA1) 305 return PKCS11_CKR_MECHANISM_PARAM_INVALID; 306 *tee_id = TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA1; 307 *tee_hash_id = TEE_ALG_SHA1; 308 break; 309 case PKCS11_CKM_SHA224: 310 if (mgf != PKCS11_CKG_MGF1_SHA224) 311 return PKCS11_CKR_MECHANISM_PARAM_INVALID; 312 *tee_id = TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA224; 313 *tee_hash_id = TEE_ALG_SHA224; 314 break; 315 case PKCS11_CKM_SHA256: 316 if (mgf != PKCS11_CKG_MGF1_SHA256) 317 return PKCS11_CKR_MECHANISM_PARAM_INVALID; 318 *tee_id = TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA256; 319 *tee_hash_id = TEE_ALG_SHA256; 320 break; 321 case PKCS11_CKM_SHA384: 322 if (mgf != PKCS11_CKG_MGF1_SHA384) 323 return PKCS11_CKR_MECHANISM_PARAM_INVALID; 324 *tee_id = TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA384; 325 *tee_hash_id = TEE_ALG_SHA384; 326 break; 327 case PKCS11_CKM_SHA512: 328 if (mgf != PKCS11_CKG_MGF1_SHA512) 329 return PKCS11_CKR_MECHANISM_PARAM_INVALID; 330 *tee_id = TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA512; 331 *tee_hash_id = TEE_ALG_SHA512; 332 break; 333 default: 334 EMSG("Unexpected %#"PRIx32"/%s", hash, 335 id2str_proc(hash)); 336 337 return PKCS11_CKR_GENERAL_ERROR; 338 } 339 break; 340 default: 341 EMSG("Unexpected mechanism %#"PRIx32"/%s", proc_params->id, 342 id2str_proc(proc_params->id)); 343 344 return PKCS11_CKR_GENERAL_ERROR; 345 } 346 347 return PKCS11_CKR_OK; 348 } 349 350 enum pkcs11_rc load_tee_rsa_key_attrs(TEE_Attribute **tee_attrs, 351 size_t *tee_count, 352 struct pkcs11_object *obj) 353 { 354 TEE_Attribute *attrs = NULL; 355 size_t count = 0; 356 enum pkcs11_rc rc = PKCS11_CKR_GENERAL_ERROR; 357 void *a_ptr = NULL; 358 359 assert(get_key_type(obj->attributes) == PKCS11_CKK_RSA); 360 361 switch (get_class(obj->attributes)) { 362 case PKCS11_CKO_PUBLIC_KEY: 363 attrs = TEE_Malloc(2 * sizeof(TEE_Attribute), 364 TEE_USER_MEM_HINT_NO_FILL_ZERO); 365 if (!attrs) 366 return PKCS11_CKR_DEVICE_MEMORY; 367 368 if (pkcs2tee_load_attr(&attrs[count], TEE_ATTR_RSA_MODULUS, 369 obj, PKCS11_CKA_MODULUS)) 370 count++; 371 372 if (pkcs2tee_load_attr(&attrs[count], 373 TEE_ATTR_RSA_PUBLIC_EXPONENT, obj, 374 PKCS11_CKA_PUBLIC_EXPONENT)) 375 count++; 376 377 if (count == 2) 378 rc = PKCS11_CKR_OK; 379 380 break; 381 382 case PKCS11_CKO_PRIVATE_KEY: 383 attrs = TEE_Malloc(8 * sizeof(TEE_Attribute), 384 TEE_USER_MEM_HINT_NO_FILL_ZERO); 385 if (!attrs) 386 return PKCS11_CKR_DEVICE_MEMORY; 387 388 if (pkcs2tee_load_attr(&attrs[count], TEE_ATTR_RSA_MODULUS, 389 obj, PKCS11_CKA_MODULUS)) 390 count++; 391 392 if (pkcs2tee_load_attr(&attrs[count], 393 TEE_ATTR_RSA_PUBLIC_EXPONENT, obj, 394 PKCS11_CKA_PUBLIC_EXPONENT)) 395 count++; 396 397 if (pkcs2tee_load_attr(&attrs[count], 398 TEE_ATTR_RSA_PRIVATE_EXPONENT, obj, 399 PKCS11_CKA_PRIVATE_EXPONENT)) 400 count++; 401 402 if (count != 3) 403 break; 404 405 /* If pre-computed values are present load those */ 406 rc = get_attribute_ptr(obj->attributes, PKCS11_CKA_PRIME_1, 407 &a_ptr, NULL); 408 if (rc != PKCS11_CKR_OK && rc != PKCS11_RV_NOT_FOUND) 409 break; 410 if (rc == PKCS11_RV_NOT_FOUND || !a_ptr) { 411 rc = PKCS11_CKR_OK; 412 break; 413 } 414 415 if (pkcs2tee_load_attr(&attrs[count], TEE_ATTR_RSA_PRIME1, obj, 416 PKCS11_CKA_PRIME_1)) 417 count++; 418 419 if (pkcs2tee_load_attr(&attrs[count], TEE_ATTR_RSA_PRIME2, obj, 420 PKCS11_CKA_PRIME_2)) 421 count++; 422 423 if (pkcs2tee_load_attr(&attrs[count], TEE_ATTR_RSA_EXPONENT1, 424 obj, PKCS11_CKA_EXPONENT_1)) 425 count++; 426 427 if (pkcs2tee_load_attr(&attrs[count], TEE_ATTR_RSA_EXPONENT2, 428 obj, PKCS11_CKA_EXPONENT_2)) 429 count++; 430 431 if (pkcs2tee_load_attr(&attrs[count], TEE_ATTR_RSA_COEFFICIENT, 432 obj, PKCS11_CKA_COEFFICIENT)) 433 count++; 434 435 if (count == 8) 436 rc = PKCS11_CKR_OK; 437 438 break; 439 440 default: 441 assert(0); 442 break; 443 } 444 445 if (rc == PKCS11_CKR_OK) { 446 *tee_attrs = attrs; 447 *tee_count = count; 448 } else { 449 TEE_Free(attrs); 450 } 451 452 return rc; 453 } 454 455 static enum pkcs11_rc tee2pkcs_rsa_attributes(struct obj_attrs **pub_head, 456 struct obj_attrs **priv_head, 457 TEE_ObjectHandle tee_obj) 458 { 459 enum pkcs11_rc rc = PKCS11_CKR_GENERAL_ERROR; 460 void *a_ptr = NULL; 461 462 rc = tee2pkcs_add_attribute(pub_head, PKCS11_CKA_MODULUS, tee_obj, 463 TEE_ATTR_RSA_MODULUS); 464 if (rc) 465 goto out; 466 467 rc = get_attribute_ptr(*pub_head, PKCS11_CKA_PUBLIC_EXPONENT, &a_ptr, 468 NULL); 469 if (rc != PKCS11_CKR_OK && rc != PKCS11_RV_NOT_FOUND) 470 goto out; 471 472 if (rc == PKCS11_CKR_OK && !a_ptr) { 473 rc = remove_empty_attribute(pub_head, 474 PKCS11_CKA_PUBLIC_EXPONENT); 475 if (rc) 476 goto out; 477 rc = PKCS11_RV_NOT_FOUND; 478 } 479 480 if (rc == PKCS11_RV_NOT_FOUND) { 481 rc = tee2pkcs_add_attribute(pub_head, 482 PKCS11_CKA_PUBLIC_EXPONENT, 483 tee_obj, 484 TEE_ATTR_RSA_PUBLIC_EXPONENT); 485 if (rc) 486 goto out; 487 } 488 489 rc = tee2pkcs_add_attribute(priv_head, PKCS11_CKA_MODULUS, tee_obj, 490 TEE_ATTR_RSA_MODULUS); 491 if (rc) 492 goto out; 493 494 rc = tee2pkcs_add_attribute(priv_head, PKCS11_CKA_PUBLIC_EXPONENT, 495 tee_obj, TEE_ATTR_RSA_PUBLIC_EXPONENT); 496 if (rc) 497 goto out; 498 499 rc = tee2pkcs_add_attribute(priv_head, PKCS11_CKA_PRIVATE_EXPONENT, 500 tee_obj, TEE_ATTR_RSA_PRIVATE_EXPONENT); 501 if (rc) 502 goto out; 503 504 rc = tee2pkcs_add_attribute(priv_head, PKCS11_CKA_PRIME_1, tee_obj, 505 TEE_ATTR_RSA_PRIME1); 506 if (rc) 507 goto out; 508 509 rc = tee2pkcs_add_attribute(priv_head, PKCS11_CKA_PRIME_2, tee_obj, 510 TEE_ATTR_RSA_PRIME2); 511 if (rc) 512 goto out; 513 514 rc = tee2pkcs_add_attribute(priv_head, PKCS11_CKA_EXPONENT_1, tee_obj, 515 TEE_ATTR_RSA_EXPONENT1); 516 if (rc) 517 goto out; 518 519 rc = tee2pkcs_add_attribute(priv_head, PKCS11_CKA_EXPONENT_2, tee_obj, 520 TEE_ATTR_RSA_EXPONENT2); 521 if (rc) 522 goto out; 523 524 rc = tee2pkcs_add_attribute(priv_head, PKCS11_CKA_COEFFICIENT, tee_obj, 525 TEE_ATTR_RSA_COEFFICIENT); 526 out: 527 return rc; 528 } 529 530 enum pkcs11_rc generate_rsa_keys(struct pkcs11_attribute_head *proc_params, 531 struct obj_attrs **pub_head, 532 struct obj_attrs **priv_head) 533 { 534 enum pkcs11_rc rc = PKCS11_CKR_GENERAL_ERROR; 535 void *a_ptr = NULL; 536 uint32_t a_size = 0; 537 TEE_ObjectHandle tee_obj = TEE_HANDLE_NULL; 538 TEE_Result res = TEE_ERROR_GENERIC; 539 uint32_t modulus_bits = 0; 540 TEE_Attribute tee_attrs[1] = { }; 541 uint32_t tee_count = 0; 542 543 if (!proc_params || !*pub_head || !*priv_head) 544 return PKCS11_CKR_TEMPLATE_INCONSISTENT; 545 546 rc = get_attribute_ptr(*pub_head, PKCS11_CKA_MODULUS_BITS, &a_ptr, 547 &a_size); 548 if (rc != PKCS11_CKR_OK || a_size != sizeof(uint32_t)) 549 return PKCS11_CKR_TEMPLATE_INCONSISTENT; 550 551 TEE_MemMove(&modulus_bits, a_ptr, sizeof(uint32_t)); 552 553 rc = get_attribute_ptr(*pub_head, PKCS11_CKA_PUBLIC_EXPONENT, &a_ptr, 554 &a_size); 555 if (rc != PKCS11_CKR_OK && rc != PKCS11_RV_NOT_FOUND) 556 return rc; 557 558 if (rc == PKCS11_CKR_OK && a_ptr) { 559 TEE_InitRefAttribute(&tee_attrs[tee_count], 560 TEE_ATTR_RSA_PUBLIC_EXPONENT, 561 a_ptr, a_size); 562 tee_count++; 563 } 564 565 if (remove_empty_attribute(priv_head, PKCS11_CKA_MODULUS) || 566 remove_empty_attribute(priv_head, PKCS11_CKA_PUBLIC_EXPONENT) || 567 remove_empty_attribute(priv_head, PKCS11_CKA_PRIVATE_EXPONENT) || 568 remove_empty_attribute(priv_head, PKCS11_CKA_PRIME_1) || 569 remove_empty_attribute(priv_head, PKCS11_CKA_PRIME_2) || 570 remove_empty_attribute(priv_head, PKCS11_CKA_EXPONENT_1) || 571 remove_empty_attribute(priv_head, PKCS11_CKA_EXPONENT_2) || 572 remove_empty_attribute(priv_head, PKCS11_CKA_COEFFICIENT)) { 573 EMSG("Unexpected attribute(s) found"); 574 rc = PKCS11_CKR_TEMPLATE_INCONSISTENT; 575 goto out; 576 } 577 578 /* Create an RSA TEE key */ 579 res = TEE_AllocateTransientObject(TEE_TYPE_RSA_KEYPAIR, modulus_bits, 580 &tee_obj); 581 if (res) { 582 DMSG("TEE_AllocateTransientObject failed %#"PRIx32, res); 583 584 rc = tee2pkcs_error(res); 585 goto out; 586 } 587 588 res = TEE_RestrictObjectUsage1(tee_obj, TEE_USAGE_EXTRACTABLE); 589 if (res) { 590 DMSG("TEE_RestrictObjectUsage1 failed %#"PRIx32, res); 591 592 rc = tee2pkcs_error(res); 593 goto out; 594 } 595 596 res = TEE_GenerateKey(tee_obj, modulus_bits, tee_attrs, tee_count); 597 if (res) { 598 DMSG("TEE_GenerateKey failed %#"PRIx32, res); 599 600 rc = tee2pkcs_error(res); 601 goto out; 602 } 603 604 rc = tee2pkcs_rsa_attributes(pub_head, priv_head, tee_obj); 605 606 out: 607 if (tee_obj != TEE_HANDLE_NULL) 608 TEE_CloseObject(tee_obj); 609 610 return rc; 611 } 612 613 size_t rsa_get_input_max_byte_size(TEE_OperationHandle op) 614 { 615 TEE_OperationInfo info = { }; 616 617 TEE_GetOperationInfo(op, &info); 618 619 return info.maxKeySize / 8; 620 } 621