1 /* 2 * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <stddef.h> 9 #include <string.h> 10 11 /* mbed TLS headers */ 12 #include <mbedtls/gcm.h> 13 #include <mbedtls/md.h> 14 #include <mbedtls/memory_buffer_alloc.h> 15 #include <mbedtls/oid.h> 16 #include <mbedtls/platform.h> 17 #include <mbedtls/version.h> 18 #include <mbedtls/x509.h> 19 20 #include <common/debug.h> 21 #include <drivers/auth/crypto_mod.h> 22 #include <drivers/auth/mbedtls/mbedtls_common.h> 23 24 #include <plat/common/platform.h> 25 26 #define LIB_NAME "mbed TLS" 27 28 #if CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \ 29 CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC 30 /* 31 * CRYPTO_MD_MAX_SIZE value is as per current stronger algorithm available 32 * so make sure that mbed TLS MD maximum size must be lesser than this. 33 */ 34 CASSERT(CRYPTO_MD_MAX_SIZE >= MBEDTLS_MD_MAX_SIZE, 35 assert_mbedtls_md_size_overflow); 36 37 #endif /* CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \ 38 CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */ 39 40 /* 41 * AlgorithmIdentifier ::= SEQUENCE { 42 * algorithm OBJECT IDENTIFIER, 43 * parameters ANY DEFINED BY algorithm OPTIONAL 44 * } 45 * 46 * SubjectPublicKeyInfo ::= SEQUENCE { 47 * algorithm AlgorithmIdentifier, 48 * subjectPublicKey BIT STRING 49 * } 50 * 51 * DigestInfo ::= SEQUENCE { 52 * digestAlgorithm AlgorithmIdentifier, 53 * digest OCTET STRING 54 * } 55 */ 56 57 /* 58 * Initialize the library and export the descriptor 59 */ 60 static void init(void) 61 { 62 /* Initialize mbed TLS */ 63 mbedtls_init(); 64 } 65 66 #if CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \ 67 CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC 68 /* 69 * Verify a signature. 70 * 71 * Parameters are passed using the DER encoding format following the ASN.1 72 * structures detailed above. 73 */ 74 static int verify_signature(void *data_ptr, unsigned int data_len, 75 void *sig_ptr, unsigned int sig_len, 76 void *sig_alg, unsigned int sig_alg_len, 77 void *pk_ptr, unsigned int pk_len) 78 { 79 mbedtls_asn1_buf sig_oid, sig_params; 80 mbedtls_asn1_buf signature; 81 mbedtls_md_type_t md_alg; 82 mbedtls_pk_type_t pk_alg; 83 mbedtls_pk_context pk = {0}; 84 int rc; 85 void *sig_opts = NULL; 86 const mbedtls_md_info_t *md_info; 87 unsigned char *p, *end; 88 unsigned char hash[MBEDTLS_MD_MAX_SIZE]; 89 90 /* Get pointers to signature OID and parameters */ 91 p = (unsigned char *)sig_alg; 92 end = (unsigned char *)(p + sig_alg_len); 93 rc = mbedtls_asn1_get_alg(&p, end, &sig_oid, &sig_params); 94 if (rc != 0) { 95 return CRYPTO_ERR_SIGNATURE; 96 } 97 98 /* Get the actual signature algorithm (MD + PK) */ 99 rc = mbedtls_x509_get_sig_alg(&sig_oid, &sig_params, &md_alg, &pk_alg, &sig_opts); 100 if (rc != 0) { 101 return CRYPTO_ERR_SIGNATURE; 102 } 103 104 /* Parse the public key */ 105 mbedtls_pk_init(&pk); 106 p = (unsigned char *)pk_ptr; 107 end = (unsigned char *)(p + pk_len); 108 rc = mbedtls_pk_parse_subpubkey(&p, end, &pk); 109 if (rc != 0) { 110 rc = CRYPTO_ERR_SIGNATURE; 111 goto end2; 112 } 113 114 /* Get the signature (bitstring) */ 115 p = (unsigned char *)sig_ptr; 116 end = (unsigned char *)(p + sig_len); 117 signature.tag = *p; 118 rc = mbedtls_asn1_get_bitstring_null(&p, end, &signature.len); 119 if ((rc != 0) || ((size_t)(end - p) != signature.len)) { 120 rc = CRYPTO_ERR_SIGNATURE; 121 goto end1; 122 } 123 signature.p = p; 124 125 /* Calculate the hash of the data */ 126 md_info = mbedtls_md_info_from_type(md_alg); 127 if (md_info == NULL) { 128 rc = CRYPTO_ERR_SIGNATURE; 129 goto end1; 130 } 131 p = (unsigned char *)data_ptr; 132 rc = mbedtls_md(md_info, p, data_len, hash); 133 if (rc != 0) { 134 rc = CRYPTO_ERR_SIGNATURE; 135 goto end1; 136 } 137 138 /* Verify the signature */ 139 rc = mbedtls_pk_verify_ext(pk_alg, sig_opts, &pk, md_alg, hash, 140 mbedtls_md_get_size(md_info), 141 signature.p, signature.len); 142 if (rc != 0) { 143 rc = CRYPTO_ERR_SIGNATURE; 144 goto end1; 145 } 146 147 /* Signature verification success */ 148 rc = CRYPTO_SUCCESS; 149 150 end1: 151 mbedtls_pk_free(&pk); 152 end2: 153 mbedtls_free(sig_opts); 154 return rc; 155 } 156 157 /* 158 * Match a hash 159 * 160 * Digest info is passed in DER format following the ASN.1 structure detailed 161 * above. 162 */ 163 static int verify_hash(void *data_ptr, unsigned int data_len, 164 void *digest_info_ptr, unsigned int digest_info_len) 165 { 166 mbedtls_asn1_buf hash_oid, params; 167 mbedtls_md_type_t md_alg; 168 const mbedtls_md_info_t *md_info; 169 unsigned char *p, *end, *hash; 170 unsigned char data_hash[MBEDTLS_MD_MAX_SIZE]; 171 size_t len; 172 int rc; 173 174 /* 175 * Digest info should be an MBEDTLS_ASN1_SEQUENCE, but padding after 176 * it is allowed. This is necessary to support multiple hash 177 * algorithms. 178 */ 179 p = (unsigned char *)digest_info_ptr; 180 end = p + digest_info_len; 181 rc = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | 182 MBEDTLS_ASN1_SEQUENCE); 183 if (rc != 0) { 184 return CRYPTO_ERR_HASH; 185 } 186 187 end = p + len; 188 189 /* Get the hash algorithm */ 190 rc = mbedtls_asn1_get_alg(&p, end, &hash_oid, ¶ms); 191 if (rc != 0) { 192 return CRYPTO_ERR_HASH; 193 } 194 195 rc = mbedtls_oid_get_md_alg(&hash_oid, &md_alg); 196 if (rc != 0) { 197 return CRYPTO_ERR_HASH; 198 } 199 200 md_info = mbedtls_md_info_from_type(md_alg); 201 if (md_info == NULL) { 202 return CRYPTO_ERR_HASH; 203 } 204 205 /* Hash should be octet string type and consume all bytes */ 206 rc = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING); 207 if ((rc != 0) || ((size_t)(end - p) != len)) { 208 return CRYPTO_ERR_HASH; 209 } 210 211 /* Length of hash must match the algorithm's size */ 212 if (len != mbedtls_md_get_size(md_info)) { 213 return CRYPTO_ERR_HASH; 214 } 215 hash = p; 216 217 /* Calculate the hash of the data */ 218 p = (unsigned char *)data_ptr; 219 rc = mbedtls_md(md_info, p, data_len, data_hash); 220 if (rc != 0) { 221 return CRYPTO_ERR_HASH; 222 } 223 224 /* Compare values */ 225 rc = memcmp(data_hash, hash, mbedtls_md_get_size(md_info)); 226 if (rc != 0) { 227 return CRYPTO_ERR_HASH; 228 } 229 230 return CRYPTO_SUCCESS; 231 } 232 #endif /* CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \ 233 CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */ 234 235 #if CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \ 236 CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC 237 /* 238 * Map a generic crypto message digest algorithm to the corresponding macro used 239 * by Mbed TLS. 240 */ 241 static inline mbedtls_md_type_t md_type(enum crypto_md_algo algo) 242 { 243 switch (algo) { 244 case CRYPTO_MD_SHA512: 245 return MBEDTLS_MD_SHA512; 246 case CRYPTO_MD_SHA384: 247 return MBEDTLS_MD_SHA384; 248 case CRYPTO_MD_SHA256: 249 return MBEDTLS_MD_SHA256; 250 default: 251 /* Invalid hash algorithm. */ 252 return MBEDTLS_MD_NONE; 253 } 254 } 255 256 /* 257 * Calculate a hash 258 * 259 * output points to the computed hash 260 */ 261 static int calc_hash(enum crypto_md_algo md_algo, void *data_ptr, 262 unsigned int data_len, 263 unsigned char output[CRYPTO_MD_MAX_SIZE]) 264 { 265 const mbedtls_md_info_t *md_info; 266 267 md_info = mbedtls_md_info_from_type(md_type(md_algo)); 268 if (md_info == NULL) { 269 return CRYPTO_ERR_HASH; 270 } 271 272 /* 273 * Calculate the hash of the data, it is safe to pass the 274 * 'output' hash buffer pointer considering its size is always 275 * bigger than or equal to MBEDTLS_MD_MAX_SIZE. 276 */ 277 return mbedtls_md(md_info, data_ptr, data_len, output); 278 } 279 #endif /* CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \ 280 CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */ 281 282 #if TF_MBEDTLS_USE_AES_GCM 283 /* 284 * Stack based buffer allocation for decryption operation. It could 285 * be configured to balance stack usage vs execution speed. 286 */ 287 #define DEC_OP_BUF_SIZE 128 288 289 static int aes_gcm_decrypt(void *data_ptr, size_t len, const void *key, 290 unsigned int key_len, const void *iv, 291 unsigned int iv_len, const void *tag, 292 unsigned int tag_len) 293 { 294 mbedtls_gcm_context ctx; 295 mbedtls_cipher_id_t cipher = MBEDTLS_CIPHER_ID_AES; 296 unsigned char buf[DEC_OP_BUF_SIZE]; 297 unsigned char tag_buf[CRYPTO_MAX_TAG_SIZE]; 298 unsigned char *pt = data_ptr; 299 size_t dec_len; 300 int diff, i, rc; 301 size_t output_length __unused; 302 303 mbedtls_gcm_init(&ctx); 304 305 rc = mbedtls_gcm_setkey(&ctx, cipher, key, key_len * 8); 306 if (rc != 0) { 307 rc = CRYPTO_ERR_DECRYPTION; 308 goto exit_gcm; 309 } 310 311 #if (MBEDTLS_VERSION_MAJOR < 3) 312 rc = mbedtls_gcm_starts(&ctx, MBEDTLS_GCM_DECRYPT, iv, iv_len, NULL, 0); 313 #else 314 rc = mbedtls_gcm_starts(&ctx, MBEDTLS_GCM_DECRYPT, iv, iv_len); 315 #endif 316 if (rc != 0) { 317 rc = CRYPTO_ERR_DECRYPTION; 318 goto exit_gcm; 319 } 320 321 while (len > 0) { 322 dec_len = MIN(sizeof(buf), len); 323 324 #if (MBEDTLS_VERSION_MAJOR < 3) 325 rc = mbedtls_gcm_update(&ctx, dec_len, pt, buf); 326 #else 327 rc = mbedtls_gcm_update(&ctx, pt, dec_len, buf, sizeof(buf), &output_length); 328 #endif 329 330 if (rc != 0) { 331 rc = CRYPTO_ERR_DECRYPTION; 332 goto exit_gcm; 333 } 334 335 memcpy(pt, buf, dec_len); 336 pt += dec_len; 337 len -= dec_len; 338 } 339 340 #if (MBEDTLS_VERSION_MAJOR < 3) 341 rc = mbedtls_gcm_finish(&ctx, tag_buf, sizeof(tag_buf)); 342 #else 343 rc = mbedtls_gcm_finish(&ctx, NULL, 0, &output_length, tag_buf, sizeof(tag_buf)); 344 #endif 345 346 if (rc != 0) { 347 rc = CRYPTO_ERR_DECRYPTION; 348 goto exit_gcm; 349 } 350 351 /* Check tag in "constant-time" */ 352 for (diff = 0, i = 0; i < tag_len; i++) 353 diff |= ((const unsigned char *)tag)[i] ^ tag_buf[i]; 354 355 if (diff != 0) { 356 rc = CRYPTO_ERR_DECRYPTION; 357 goto exit_gcm; 358 } 359 360 /* GCM decryption success */ 361 rc = CRYPTO_SUCCESS; 362 363 exit_gcm: 364 mbedtls_gcm_free(&ctx); 365 return rc; 366 } 367 368 /* 369 * Authenticated decryption of an image 370 */ 371 static int auth_decrypt(enum crypto_dec_algo dec_algo, void *data_ptr, 372 size_t len, const void *key, unsigned int key_len, 373 unsigned int key_flags, const void *iv, 374 unsigned int iv_len, const void *tag, 375 unsigned int tag_len) 376 { 377 int rc; 378 379 assert((key_flags & ENC_KEY_IS_IDENTIFIER) == 0); 380 381 switch (dec_algo) { 382 case CRYPTO_GCM_DECRYPT: 383 rc = aes_gcm_decrypt(data_ptr, len, key, key_len, iv, iv_len, 384 tag, tag_len); 385 if (rc != 0) 386 return rc; 387 break; 388 default: 389 return CRYPTO_ERR_DECRYPTION; 390 } 391 392 return CRYPTO_SUCCESS; 393 } 394 #endif /* TF_MBEDTLS_USE_AES_GCM */ 395 396 /* 397 * Register crypto library descriptor 398 */ 399 #if CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC 400 #if TF_MBEDTLS_USE_AES_GCM 401 REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, calc_hash, 402 auth_decrypt, NULL); 403 #else 404 REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, calc_hash, 405 NULL, NULL); 406 #endif 407 #elif CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY 408 #if TF_MBEDTLS_USE_AES_GCM 409 REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, NULL, 410 auth_decrypt, NULL); 411 #else 412 REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, NULL, 413 NULL, NULL); 414 #endif 415 #elif CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY 416 REGISTER_CRYPTO_LIB(LIB_NAME, init, NULL, NULL, calc_hash, NULL, NULL); 417 #endif /* CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */ 418