初始版本
This commit is contained in:
xiaozhengsheng
305
components/libraries/crypto/backend/optiga/optiga_backend_ecc.c
Normal file
305
components/libraries/crypto/backend/optiga/optiga_backend_ecc.c
Normal file
@@ -0,0 +1,305 @@
|
||||
/**
|
||||
* Copyright (c) 2018 - 2020, Nordic Semiconductor ASA
|
||||
*
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without modification,
|
||||
* are permitted provided that the following conditions are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright notice, this
|
||||
* list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form, except as embedded into a Nordic
|
||||
* Semiconductor ASA integrated circuit in a product or a software update for
|
||||
* such product, must reproduce the above copyright notice, this list of
|
||||
* conditions and the following disclaimer in the documentation and/or other
|
||||
* materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of Nordic Semiconductor ASA nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from this
|
||||
* software without specific prior written permission.
|
||||
*
|
||||
* 4. This software, with or without modification, must only be used with a
|
||||
* Nordic Semiconductor ASA integrated circuit.
|
||||
*
|
||||
* 5. Any software provided in binary form under this license must not be reverse
|
||||
* engineered, decompiled, modified and/or disassembled.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
|
||||
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
|
||||
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
||||
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#include "sdk_config.h"
|
||||
#include "nordic_common.h"
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
|
||||
#include <stdbool.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "nrf_crypto_ecc.h"
|
||||
#include "nrf_crypto_ecdh.h"
|
||||
#include "nrf_crypto_mem.h"
|
||||
#include "nrf_crypto_rng.h"
|
||||
#include "nrf_crypto_shared.h"
|
||||
#include "nrf_assert.h"
|
||||
#include "optiga_backend_ecc.h"
|
||||
|
||||
/*lint -save -e????*/
|
||||
#include "optiga/optiga_crypt.h"
|
||||
/*lint -restore*/
|
||||
|
||||
int nrf_crypto_backend_optiga_ecc_optiga_rng(void * p_param, unsigned char * p_data, size_t size)
|
||||
{
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO_RNG)
|
||||
return NRF_SUCCESS;
|
||||
|
||||
#else
|
||||
return NRF_ERROR_CRYPTO_FEATURE_UNAVAILABLE;
|
||||
#endif
|
||||
}
|
||||
|
||||
static const uint8_t der_pub_key_header[] = {
|
||||
0x03, // ASN.1 BITSTRING
|
||||
0x42, // bytes following
|
||||
0x00, // no unused bits
|
||||
0x04 // uncompressed key, see https://tools.ietf.org/html/rfc5480#section-2.2
|
||||
};
|
||||
|
||||
#define DER_PUB_KEY_HEADER_LEN (sizeof(der_pub_key_header)/sizeof(der_pub_key_header[0]))
|
||||
|
||||
// for our purposes we always have 1 byte tag + 1 byte length
|
||||
#define DER_OCTET_STRING_HEADER_LEN 2
|
||||
|
||||
// lengths for the ASN.1 DER encoded keys imported and exported by OPTIGA
|
||||
#define OPTIGA_SECP256R1_PRIV_KEY_LEN (DER_OCTET_STRING_HEADER_LEN + NRF_CRYPTO_ECC_SECP256R1_RAW_PRIVATE_KEY_SIZE)
|
||||
#define OPTIGA_SECP256R1_PUBL_KEY_LEN (DER_PUB_KEY_HEADER_LEN + NRF_CRYPTO_ECC_SECP256R1_RAW_PUBLIC_KEY_SIZE)
|
||||
|
||||
ret_code_t nrf_crypto_backend_optiga_key_pair_generate(
|
||||
void * p_context,
|
||||
void * p_private_key,
|
||||
void * p_public_key)
|
||||
{
|
||||
optiga_lib_status_t res = OPTIGA_LIB_ERROR;
|
||||
|
||||
nrf_crypto_backend_secp256r1_public_key_t * p_pub =
|
||||
(nrf_crypto_backend_secp256r1_public_key_t *) p_public_key;
|
||||
|
||||
nrf_crypto_backend_secp256r1_private_key_t * p_priv =
|
||||
(nrf_crypto_backend_secp256r1_private_key_t *) p_private_key;
|
||||
|
||||
bool export_private_key;
|
||||
if (p_priv->oid == 0)
|
||||
{
|
||||
// OID=0 was implicitly specified when initializising, mostly due to Nordic internal code calling our API
|
||||
p_priv->oid = (optiga_key_id_t)0xE100;
|
||||
export_private_key = false;
|
||||
}
|
||||
else if (p_priv->oid == NRF_CRYPTO_INFINEON_PRIVKEY_HOST_OID)
|
||||
{
|
||||
export_private_key = true;
|
||||
}
|
||||
else // any other value for OID, we assume the OID was purposefully specified by caller
|
||||
{
|
||||
export_private_key = false;
|
||||
}
|
||||
|
||||
void * priv_key;
|
||||
if (export_private_key)
|
||||
{
|
||||
//lint -save -e611 -e545 (Suspicious cast, Suspicious use of &)
|
||||
priv_key = (void*) &p_priv->raw_privkey;
|
||||
//lint -restore
|
||||
p_priv->oid = (optiga_key_id_t)NRF_CRYPTO_INFINEON_PRIVKEY_HOST_OID;
|
||||
}
|
||||
else
|
||||
{
|
||||
//lint -save -e611 -e545 (Suspicious cast, Suspicious use of &)
|
||||
priv_key = (void*) &p_priv->oid;
|
||||
|
||||
memset(p_priv->raw_privkey, 0, OPTIGA_SECP256R1_PRIV_KEY_LEN);
|
||||
//lint -restore
|
||||
}
|
||||
|
||||
// Set all flags because the nrf_crypto API does not allow to specify key use
|
||||
const optiga_key_usage_t key_usage = (optiga_key_usage_t)(OPTIGA_KEY_USAGE_AUTHENTICATION |
|
||||
OPTIGA_KEY_USAGE_SIGN |
|
||||
OPTIGA_KEY_USAGE_KEY_AGREEMENT);
|
||||
|
||||
uint16_t publ_key_len = OPTIGA_SECP256R1_PUBL_KEY_LEN;
|
||||
res = optiga_crypt_ecc_generate_keypair(OPTIGA_ECC_NIST_P_256,
|
||||
key_usage,
|
||||
export_private_key,
|
||||
priv_key,
|
||||
p_pub->raw_pubkey,
|
||||
&publ_key_len);
|
||||
|
||||
if(res != OPTIGA_LIB_SUCCESS)
|
||||
{
|
||||
// error in the optiga library
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
if(publ_key_len != OPTIGA_SECP256R1_PUBL_KEY_LEN)
|
||||
{
|
||||
// unexpected length
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
// mark the public key as stored in host memory
|
||||
p_pub->oid = (optiga_key_id_t)NRF_CRYPTO_INFINEON_PUBKEY_HOST_OID;
|
||||
return NRF_SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
ret_code_t nrf_crypto_backend_optiga_public_key_calculate(
|
||||
void * p_context,
|
||||
void const * p_private_key,
|
||||
void * p_public_key)
|
||||
{
|
||||
return NRF_ERROR_CRYPTO_FEATURE_UNAVAILABLE;
|
||||
}
|
||||
|
||||
|
||||
ret_code_t nrf_crypto_backend_optiga_private_key_from_raw(
|
||||
void * p_private_key,
|
||||
uint8_t const * p_raw_data)
|
||||
{
|
||||
return NRF_ERROR_CRYPTO_FEATURE_UNAVAILABLE;
|
||||
}
|
||||
|
||||
#define DER_TAG_OCTET_STRING 0x04
|
||||
|
||||
ret_code_t nrf_crypto_backend_optiga_private_key_to_raw(
|
||||
void const * p_private_key,
|
||||
uint8_t * p_raw_data)
|
||||
{
|
||||
nrf_crypto_backend_secp256r1_private_key_t * p_priv =
|
||||
(nrf_crypto_backend_secp256r1_private_key_t *)p_private_key;
|
||||
|
||||
nrf_crypto_ecc_curve_info_t const * p_info = p_priv->header.p_info;
|
||||
|
||||
if(p_priv->oid != NRF_CRYPTO_INFINEON_PRIVKEY_HOST_OID)
|
||||
{
|
||||
// must use magic OID for private key exported to host
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
uint8_t* p_key = p_priv->raw_privkey;
|
||||
if(*p_key != DER_TAG_OCTET_STRING)
|
||||
{
|
||||
// private key must be encoded as DER OCTET STRING
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
p_key++;
|
||||
|
||||
if(p_info == &g_nrf_crypto_ecc_secp256r1_curve_info)
|
||||
{
|
||||
if(*p_key != NRF_CRYPTO_ECC_SECP256R1_RAW_PRIVATE_KEY_SIZE)
|
||||
{
|
||||
// wrong length
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
p_key++;
|
||||
|
||||
memcpy(p_raw_data, p_key, NRF_CRYPTO_ECC_SECP256R1_RAW_PRIVATE_KEY_SIZE);
|
||||
|
||||
return NRF_SUCCESS;
|
||||
}
|
||||
|
||||
return NRF_ERROR_CRYPTO_FEATURE_UNAVAILABLE;
|
||||
}
|
||||
|
||||
ret_code_t nrf_crypto_backend_optiga_public_key_from_raw(
|
||||
void * p_public_key,
|
||||
uint8_t const * p_raw_data)
|
||||
{
|
||||
nrf_crypto_backend_secp256r1_public_key_t * p_pub =
|
||||
(nrf_crypto_backend_secp256r1_public_key_t *)p_public_key;
|
||||
|
||||
nrf_crypto_ecc_curve_info_t const * p_info = p_pub->header.p_info;
|
||||
|
||||
if (p_info == &g_nrf_crypto_ecc_secp256r1_curve_info)
|
||||
{
|
||||
// copy header
|
||||
memcpy(p_pub->raw_pubkey, der_pub_key_header, DER_PUB_KEY_HEADER_LEN);
|
||||
// copy public key data
|
||||
memcpy(p_pub->raw_pubkey + DER_PUB_KEY_HEADER_LEN, p_raw_data, NRF_CRYPTO_ECC_SECP256R1_RAW_PUBLIC_KEY_SIZE);
|
||||
// Set OID to magic number for host-supplied public key
|
||||
p_pub->oid = (optiga_key_id_t)NRF_CRYPTO_INFINEON_PUBKEY_HOST_OID;
|
||||
|
||||
return NRF_SUCCESS;
|
||||
}
|
||||
|
||||
return NRF_ERROR_CRYPTO_FEATURE_UNAVAILABLE;
|
||||
}
|
||||
|
||||
|
||||
ret_code_t nrf_crypto_backend_optiga_public_key_to_raw(
|
||||
void const * p_public_key,
|
||||
uint8_t * p_raw_data)
|
||||
{
|
||||
nrf_crypto_backend_secp256r1_public_key_t * p_pub =
|
||||
(nrf_crypto_backend_secp256r1_public_key_t *)p_public_key;
|
||||
|
||||
nrf_crypto_ecc_curve_info_t const * p_info = p_pub->header.p_info;
|
||||
|
||||
if(p_pub->oid != NRF_CRYPTO_INFINEON_PUBKEY_HOST_OID)
|
||||
{
|
||||
// must use magic OID for host supplied public key
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
if (p_info == &g_nrf_crypto_ecc_secp256r1_curve_info)
|
||||
{
|
||||
if(memcmp(p_pub->raw_pubkey, der_pub_key_header, DER_PUB_KEY_HEADER_LEN) != 0) {
|
||||
// public key not correctly encoded
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
memcpy(p_raw_data,
|
||||
p_pub->raw_pubkey + DER_PUB_KEY_HEADER_LEN,
|
||||
NRF_CRYPTO_ECC_SECP256R1_RAW_PUBLIC_KEY_SIZE);
|
||||
|
||||
return NRF_SUCCESS;
|
||||
}
|
||||
|
||||
return NRF_ERROR_CRYPTO_FEATURE_UNAVAILABLE;
|
||||
}
|
||||
|
||||
|
||||
ret_code_t nrf_crypto_backend_optiga_private_key_free(
|
||||
void * p_private_key)
|
||||
{
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
ret_code_t nrf_crypto_backend_optiga_public_key_free(
|
||||
void * p_public_key)
|
||||
{
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA_ECC_SECP256R1)
|
||||
const nrf_crypto_ecc_curve_info_t g_nrf_crypto_ecc_secp256r1_curve_info =
|
||||
{
|
||||
.public_key_size = sizeof(nrf_crypto_backend_secp256r1_public_key_t),
|
||||
.private_key_size = sizeof(nrf_crypto_backend_optiga_ecc_private_key_t),
|
||||
.curve_type = NRF_CRYPTO_ECC_SECP256R1_CURVE_TYPE,
|
||||
.raw_private_key_size = NRF_CRYPTO_ECC_SECP256R1_RAW_PRIVATE_KEY_SIZE,
|
||||
.raw_public_key_size = NRF_CRYPTO_ECC_SECP256R1_RAW_PUBLIC_KEY_SIZE,
|
||||
.p_backend_data = (void *)OPTIGA_ECC_NIST_P_256,
|
||||
};
|
||||
#endif
|
||||
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
200
components/libraries/crypto/backend/optiga/optiga_backend_ecc.h
Normal file
200
components/libraries/crypto/backend/optiga/optiga_backend_ecc.h
Normal file
@@ -0,0 +1,200 @@
|
||||
/**
|
||||
* Copyright (c) 2018 - 2020, Nordic Semiconductor ASA
|
||||
*
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without modification,
|
||||
* are permitted provided that the following conditions are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright notice, this
|
||||
* list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form, except as embedded into a Nordic
|
||||
* Semiconductor ASA integrated circuit in a product or a software update for
|
||||
* such product, must reproduce the above copyright notice, this list of
|
||||
* conditions and the following disclaimer in the documentation and/or other
|
||||
* materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of Nordic Semiconductor ASA nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from this
|
||||
* software without specific prior written permission.
|
||||
*
|
||||
* 4. This software, with or without modification, must only be used with a
|
||||
* Nordic Semiconductor ASA integrated circuit.
|
||||
*
|
||||
* 5. Any software provided in binary form under this license must not be reverse
|
||||
* engineered, decompiled, modified and/or disassembled.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
|
||||
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
|
||||
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
||||
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef OPTIGA_BACKEND_ECC_H__
|
||||
#define OPTIGA_BACKEND_ECC_H__
|
||||
|
||||
#include "sdk_config.h"
|
||||
#include "nordic_common.h"
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdbool.h>
|
||||
#include "nrf_crypto_ecc.h"
|
||||
|
||||
/*lint -save -e????*/
|
||||
#include "optiga/optiga_crypt.h"
|
||||
/*lint -restore*/
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/** @internal Magic OID that indicates a host supplied public key
|
||||
*/
|
||||
#define NRF_CRYPTO_INFINEON_PUBKEY_HOST_OID 0xFFFF
|
||||
|
||||
/** @internal Magic OID that indicates to export the private key
|
||||
*/
|
||||
#define NRF_CRYPTO_INFINEON_PRIVKEY_HOST_OID 0xFFFE
|
||||
|
||||
/** @internal @brief Common structure holding private key for the OPTIGA backend.
|
||||
*/
|
||||
typedef struct nrf_crypto_backend_optiga_ecc_private_key_t
|
||||
{
|
||||
nrf_crypto_internal_ecc_key_header_t header; /**< @internal @brief Common ECC key header */
|
||||
optiga_key_id_t oid; // OID where the private key is stored
|
||||
uint8_t raw_privkey[64+2]; // Private Key encoded as DER OCTET STRING
|
||||
} nrf_crypto_backend_optiga_ecc_private_key_t;
|
||||
|
||||
#define NRF_CRYPTO_INFINEON_SECP256R1_PRIVATE_KEY_FROM_OID(oid_value) { \
|
||||
.key_secp256r1 = { \
|
||||
.header = { \
|
||||
.init_value = NRF_CRYPTO_INTERNAL_ECC_PRIVATE_KEY_INIT_VALUE, \
|
||||
.p_info = &g_nrf_crypto_ecc_secp256r1_curve_info \
|
||||
}, \
|
||||
.oid = (optiga_key_id_t)(oid_value) \
|
||||
} \
|
||||
}
|
||||
|
||||
/** @internal @brief Common structure holding public key for the OPTIGA backend.
|
||||
*/
|
||||
typedef struct
|
||||
{
|
||||
nrf_crypto_internal_ecc_key_header_t header; /**< @internal @brief Common ECC key header */
|
||||
optiga_key_id_t oid; // OID where the public key is stored
|
||||
uint8_t raw_pubkey[64+4]; // Public Key encoded as DER BITSTRING with header
|
||||
} nrf_crypto_backend_secp256r1_public_key_t;
|
||||
|
||||
#define NRF_CRYPTO_INFINEON_SECP256R1_PUBLIC_KEY_FROM_OID(oid_value) { \
|
||||
.key_secp256r1 = { \
|
||||
.header = { \
|
||||
.init_value = NRF_CRYPTO_INTERNAL_ECC_PUBLIC_KEY_INIT_VALUE, \
|
||||
.p_info = &g_nrf_crypto_ecc_secp256r1_curve_info \
|
||||
}, \
|
||||
.oid = (optiga_key_id_t)(oid_value) \
|
||||
} \
|
||||
}
|
||||
|
||||
#define NRF_CRYPTO_INFINEON_SECP256R1_PUBLIC_KEY_RAW \
|
||||
NRF_CRYPTO_INFINEON_SECP256R1_PUBLIC_KEY_FROM_OID(NRF_CRYPTO_INFINEON_PUBKEY_HOST_OID)
|
||||
|
||||
|
||||
/** @internal See @ref nrf_crypto_backend_ecc_key_pair_generate_fn_t.
|
||||
*/
|
||||
ret_code_t nrf_crypto_backend_optiga_key_pair_generate(
|
||||
void * p_context,
|
||||
void * p_private_key,
|
||||
void * p_public_key);
|
||||
|
||||
|
||||
/** @internal See @ref nrf_crypto_backend_ecc_public_key_calculate_fn_t.
|
||||
*/
|
||||
ret_code_t nrf_crypto_backend_optiga_public_key_calculate(
|
||||
void * p_context,
|
||||
void const * p_private_key,
|
||||
void * p_public_key);
|
||||
|
||||
|
||||
/** @internal See @ref nrf_crypto_backend_ecc_private_key_from_raw_fn_t.
|
||||
*/
|
||||
ret_code_t nrf_crypto_backend_optiga_private_key_from_raw(
|
||||
void * p_private_key,
|
||||
uint8_t const * p_raw_data);
|
||||
|
||||
|
||||
/** @internal See @ref nrf_crypto_backend_ecc_private_key_to_raw_fn_t.
|
||||
*/
|
||||
ret_code_t nrf_crypto_backend_optiga_private_key_to_raw(
|
||||
void const * p_private_key,
|
||||
uint8_t * p_raw_data);
|
||||
|
||||
|
||||
/** @internal See @ref nrf_crypto_backend_ecc_public_key_from_raw_fn_t.
|
||||
*/
|
||||
ret_code_t nrf_crypto_backend_optiga_public_key_from_raw(
|
||||
void * p_public_key,
|
||||
uint8_t const * p_raw_data);
|
||||
|
||||
|
||||
/** @internal See @ref nrf_crypto_backend_ecc_public_key_to_raw_fn_t.
|
||||
*/
|
||||
ret_code_t nrf_crypto_backend_optiga_public_key_to_raw(
|
||||
void const * p_public_key,
|
||||
uint8_t * p_raw_data);
|
||||
|
||||
|
||||
/** @internal See @ref nrf_crypto_backend_ecc_key_free_fn_t.
|
||||
*/
|
||||
ret_code_t nrf_crypto_backend_optiga_private_key_free(
|
||||
void * p_private_key);
|
||||
|
||||
|
||||
/** @internal See @ref nrf_crypto_backend_ecc_key_free_fn_t.
|
||||
*/
|
||||
ret_code_t nrf_crypto_backend_optiga_public_key_free(
|
||||
void * p_public_key);
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA_ECC_SECP256R1)
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO_ECC_SECP256R1)
|
||||
#error "More than one backend enabled for secp256r1 (NIST 256-bit).");
|
||||
#endif
|
||||
#define NRF_CRYPTO_ECC_SECP256R1_ENABLED 1
|
||||
|
||||
// Aliases for one common OPTIGA implementation
|
||||
#define nrf_crypto_backend_secp256r1_key_pair_generate nrf_crypto_backend_optiga_key_pair_generate
|
||||
#define nrf_crypto_backend_secp256r1_public_key_calculate nrf_crypto_backend_optiga_public_key_calculate
|
||||
#define nrf_crypto_backend_secp256r1_private_key_from_raw nrf_crypto_backend_optiga_private_key_from_raw
|
||||
#define nrf_crypto_backend_secp256r1_private_key_to_raw nrf_crypto_backend_optiga_private_key_to_raw
|
||||
#define nrf_crypto_backend_secp256r1_public_key_from_raw nrf_crypto_backend_optiga_public_key_from_raw
|
||||
#define nrf_crypto_backend_secp256r1_public_key_to_raw nrf_crypto_backend_optiga_public_key_to_raw
|
||||
#define nrf_crypto_backend_secp256r1_private_key_free nrf_crypto_backend_optiga_private_key_free
|
||||
#define nrf_crypto_backend_secp256r1_public_key_free nrf_crypto_backend_optiga_public_key_free
|
||||
// OPTIGA does not require context, so its size is 0.
|
||||
#define NRF_CRYPTO_BACKEND_SECP256R1_KEY_PAIR_GENERATE_CONTEXT_SIZE 0
|
||||
#define NRF_CRYPTO_BACKEND_SECP256R1_PUBLIC_KEY_CALCULATE_CONTEXT_SIZE 0
|
||||
// All OPTIGA curve types share the same private key data structures
|
||||
typedef nrf_crypto_backend_optiga_ecc_private_key_t nrf_crypto_backend_secp256r1_private_key_t;
|
||||
// Dummy typedef for unused context
|
||||
typedef uint32_t nrf_crypto_backend_secp256r1_key_pair_generate_context_t;
|
||||
typedef uint32_t nrf_crypto_backend_secp256r1_public_key_calculate_context_t;
|
||||
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA_ECC_SECP256R1)
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
|
||||
#endif // OPTIGA_BACKEND_ECC_H__
|
||||
110
components/libraries/crypto/backend/optiga/optiga_backend_ecdh.c
Normal file
110
components/libraries/crypto/backend/optiga/optiga_backend_ecdh.c
Normal file
@@ -0,0 +1,110 @@
|
||||
/**
|
||||
* Copyright (c) 2018 - 2020, Nordic Semiconductor ASA
|
||||
*
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without modification,
|
||||
* are permitted provided that the following conditions are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright notice, this
|
||||
* list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form, except as embedded into a Nordic
|
||||
* Semiconductor ASA integrated circuit in a product or a software update for
|
||||
* such product, must reproduce the above copyright notice, this list of
|
||||
* conditions and the following disclaimer in the documentation and/or other
|
||||
* materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of Nordic Semiconductor ASA nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from this
|
||||
* software without specific prior written permission.
|
||||
*
|
||||
* 4. This software, with or without modification, must only be used with a
|
||||
* Nordic Semiconductor ASA integrated circuit.
|
||||
*
|
||||
* 5. Any software provided in binary form under this license must not be reverse
|
||||
* engineered, decompiled, modified and/or disassembled.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
|
||||
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
|
||||
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
||||
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#include "sdk_config.h"
|
||||
#include "nordic_common.h"
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
|
||||
#include <string.h>
|
||||
|
||||
#include "nrf_crypto_ecc_shared.h"
|
||||
#include "nrf_crypto_ecdh_shared.h"
|
||||
#include "nrf_crypto_shared.h"
|
||||
#include "nrf_crypto_ecdh.h"
|
||||
#include "optiga_backend_ecc.h"
|
||||
|
||||
/*lint -save -e????*/
|
||||
#include "optiga/optiga_crypt.h"
|
||||
/*lint -restore*/
|
||||
|
||||
|
||||
ret_code_t nrf_crypto_backend_optiga_ecdh_compute(
|
||||
void * p_context,
|
||||
void const * p_private_key,
|
||||
void const * p_public_key,
|
||||
uint8_t * p_shared_secret)
|
||||
{
|
||||
optiga_lib_status_t res = OPTIGA_LIB_ERROR;
|
||||
|
||||
// Prepare public key
|
||||
nrf_crypto_backend_secp256r1_public_key_t * p_pub =
|
||||
(nrf_crypto_backend_secp256r1_public_key_t *) p_public_key;
|
||||
if (p_pub->oid != NRF_CRYPTO_INFINEON_PUBKEY_HOST_OID)
|
||||
{
|
||||
// OPTIGA requires the peer' public key to be host-supplied
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
// magic OID for pubkey from host
|
||||
public_key_from_host_t pub_key = {
|
||||
.public_key = p_pub->raw_pubkey,
|
||||
.length = 64+4, // public key + DER BITSTRING header
|
||||
.curve = OPTIGA_ECC_NIST_P_256
|
||||
};
|
||||
|
||||
// Prepare private key
|
||||
nrf_crypto_backend_secp256r1_private_key_t * p_priv =
|
||||
(nrf_crypto_backend_secp256r1_private_key_t *) p_private_key;
|
||||
optiga_key_id_t priv_oid = p_priv->oid;
|
||||
if (priv_oid == NRF_CRYPTO_INFINEON_PRIVKEY_HOST_OID)
|
||||
{
|
||||
// OPTIGA Trust X can only compute ECDH with private key from inside OPTIGA
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
res = optiga_crypt_ecdh(
|
||||
priv_oid, // private key OID
|
||||
&pub_key, // peer public key details
|
||||
true, // true: export shared secret to host
|
||||
p_shared_secret // resulting shared secret
|
||||
);
|
||||
|
||||
if (res != OPTIGA_LIB_SUCCESS)
|
||||
{
|
||||
// error in the optiga library
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
return NRF_SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
|
||||
@@ -0,0 +1,83 @@
|
||||
/**
|
||||
* Copyright (c) 2018 - 2020, Nordic Semiconductor ASA
|
||||
*
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without modification,
|
||||
* are permitted provided that the following conditions are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright notice, this
|
||||
* list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form, except as embedded into a Nordic
|
||||
* Semiconductor ASA integrated circuit in a product or a software update for
|
||||
* such product, must reproduce the above copyright notice, this list of
|
||||
* conditions and the following disclaimer in the documentation and/or other
|
||||
* materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of Nordic Semiconductor ASA nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from this
|
||||
* software without specific prior written permission.
|
||||
*
|
||||
* 4. This software, with or without modification, must only be used with a
|
||||
* Nordic Semiconductor ASA integrated circuit.
|
||||
*
|
||||
* 5. Any software provided in binary form under this license must not be reverse
|
||||
* engineered, decompiled, modified and/or disassembled.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
|
||||
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
|
||||
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
||||
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef OPTIGA_BACKEND_ECDH_H__
|
||||
#define OPTIGA_BACKEND_ECDH_H__
|
||||
|
||||
#include "sdk_config.h"
|
||||
#include "nordic_common.h"
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
|
||||
#include "nrf_crypto_ecc.h"
|
||||
#include "nrf_crypto_ecdh_shared.h"
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
// This file is only needed to satisfy the nrf_crypto interface
|
||||
|
||||
|
||||
/** @internal See @ref nrf_crypto_backend_ecdh_compute_fn_t.
|
||||
*/
|
||||
ret_code_t nrf_crypto_backend_optiga_ecdh_compute(
|
||||
void * p_context,
|
||||
void const * p_private_key,
|
||||
void const * p_public_key,
|
||||
uint8_t * p_shared_secret);
|
||||
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA_ECC_SECP256R1)
|
||||
// Aliases for one common OPTIGA implementation
|
||||
#define nrf_crypto_backend_secp256r1_ecdh_compute nrf_crypto_backend_optiga_ecdh_compute
|
||||
typedef uint32_t nrf_crypto_backend_secp256r1_ecdh_context_t;
|
||||
#define NRF_CRYPTO_BACKEND_SECP256R1_ECDH_CONTEXT_SIZE 0
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA_ECC_SECP256R1)
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
|
||||
#endif // OPTIGA_BACKEND_ECDH_H__
|
||||
@@ -0,0 +1,155 @@
|
||||
/**
|
||||
* Copyright (c) 2018 - 2020, Nordic Semiconductor ASA
|
||||
*
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without modification,
|
||||
* are permitted provided that the following conditions are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright notice, this
|
||||
* list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form, except as embedded into a Nordic
|
||||
* Semiconductor ASA integrated circuit in a product or a software update for
|
||||
* such product, must reproduce the above copyright notice, this list of
|
||||
* conditions and the following disclaimer in the documentation and/or other
|
||||
* materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of Nordic Semiconductor ASA nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from this
|
||||
* software without specific prior written permission.
|
||||
*
|
||||
* 4. This software, with or without modification, must only be used with a
|
||||
* Nordic Semiconductor ASA integrated circuit.
|
||||
*
|
||||
* 5. Any software provided in binary form under this license must not be reverse
|
||||
* engineered, decompiled, modified and/or disassembled.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
|
||||
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
|
||||
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
||||
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#include "sdk_config.h"
|
||||
#include "nordic_common.h"
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdbool.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "nrf_crypto_ecc.h"
|
||||
#include "nrf_crypto_ecdsa.h"
|
||||
|
||||
/*lint -save -e????*/
|
||||
#include "optiga/optiga_crypt.h"
|
||||
#include "ecdsa_utils.h"
|
||||
/*lint -restore*/
|
||||
|
||||
ret_code_t nrf_crypto_backend_optiga_sign(
|
||||
void * p_context,
|
||||
void const * p_private_key,
|
||||
uint8_t const * p_data,
|
||||
size_t data_size,
|
||||
uint8_t * p_signature)
|
||||
{
|
||||
optiga_lib_status_t res = OPTIGA_LIB_ERROR;
|
||||
nrf_crypto_backend_optiga_ecc_private_key_t * p_prv =
|
||||
(nrf_crypto_backend_optiga_ecc_private_key_t *)p_private_key;
|
||||
|
||||
optiga_key_id_t oid = p_prv->oid;
|
||||
|
||||
uint16_t der_sig_len = NRF_CRYPTO_ECDSA_SECP256R1_SIGNATURE_SIZE + ECDSA_RS_MAX_ASN1_OVERHEAD;
|
||||
uint8_t der_sig[NRF_CRYPTO_ECDSA_SECP256R1_SIGNATURE_SIZE + ECDSA_RS_MAX_ASN1_OVERHEAD] = {0};
|
||||
|
||||
res = optiga_crypt_ecdsa_sign((uint8_t *)p_data, data_size, oid, der_sig, &der_sig_len);
|
||||
if(res != OPTIGA_LIB_SUCCESS) {
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
// convert signature to format suitable for nrf_crypto
|
||||
if (!asn1_to_ecdsa_rs(der_sig, der_sig_len,
|
||||
p_signature, NRF_CRYPTO_ECDSA_SECP256R1_SIGNATURE_SIZE))
|
||||
{
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
return NRF_SUCCESS;
|
||||
}
|
||||
|
||||
ret_code_t nrf_crypto_backend_optiga_verify(
|
||||
void * p_context,
|
||||
void const * p_public_key,
|
||||
uint8_t const * p_data,
|
||||
size_t data_size,
|
||||
uint8_t const * p_signature)
|
||||
{
|
||||
nrf_crypto_backend_secp256r1_public_key_t * p_pub =
|
||||
(nrf_crypto_backend_secp256r1_public_key_t *)p_public_key;
|
||||
|
||||
optiga_key_id_t oid = p_pub->oid;
|
||||
|
||||
size_t der_sig_len = NRF_CRYPTO_ECDSA_SECP256R1_SIGNATURE_SIZE + ECDSA_RS_MAX_ASN1_OVERHEAD;
|
||||
uint8_t der_sig[NRF_CRYPTO_ECDSA_SECP256R1_SIGNATURE_SIZE + ECDSA_RS_MAX_ASN1_OVERHEAD] = {0};
|
||||
|
||||
const size_t rs_size = NRF_CRYPTO_ECDSA_SECP256R1_SIGNATURE_SIZE/2;
|
||||
|
||||
optiga_lib_status_t res = OPTIGA_LIB_ERROR;
|
||||
|
||||
// Convert signature to DER format needed by OPTIGA
|
||||
if (!ecdsa_rs_to_asn1_integers(p_signature,
|
||||
p_signature + rs_size,
|
||||
rs_size,
|
||||
der_sig,
|
||||
&der_sig_len))
|
||||
{
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
if (oid == NRF_CRYPTO_INFINEON_PUBKEY_HOST_OID)
|
||||
{
|
||||
// Create magic OID for pubkey from host
|
||||
public_key_from_host_t pub_key = {
|
||||
.public_key = p_pub->raw_pubkey,
|
||||
.length = NRF_CRYPTO_ECC_SECP256R1_RAW_PUBLIC_KEY_SIZE + 4, // public key + DER BITSTRING header
|
||||
.curve = OPTIGA_ECC_NIST_P_256
|
||||
};
|
||||
|
||||
res = optiga_crypt_ecdsa_verify((uint8_t *)p_data,
|
||||
data_size,
|
||||
der_sig,
|
||||
der_sig_len,
|
||||
OPTIGA_CRYPT_HOST_DATA,
|
||||
&pub_key);
|
||||
}
|
||||
else
|
||||
{
|
||||
// Public key is in OPTIGA, referenced by OID
|
||||
res = optiga_crypt_ecdsa_verify((uint8_t *)p_data,
|
||||
data_size,
|
||||
der_sig,
|
||||
der_sig_len,
|
||||
OPTIGA_CRYPT_OID_DATA,
|
||||
&oid);
|
||||
}
|
||||
|
||||
// consider everything that is not success a signature failure
|
||||
if (res != OPTIGA_LIB_SUCCESS)
|
||||
{
|
||||
return NRF_ERROR_CRYPTO_ECDSA_INVALID_SIGNATURE;
|
||||
}
|
||||
|
||||
return NRF_SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
@@ -0,0 +1,98 @@
|
||||
/**
|
||||
* Copyright (c) 2018 - 2020, Nordic Semiconductor ASA
|
||||
*
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without modification,
|
||||
* are permitted provided that the following conditions are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright notice, this
|
||||
* list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form, except as embedded into a Nordic
|
||||
* Semiconductor ASA integrated circuit in a product or a software update for
|
||||
* such product, must reproduce the above copyright notice, this list of
|
||||
* conditions and the following disclaimer in the documentation and/or other
|
||||
* materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of Nordic Semiconductor ASA nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from this
|
||||
* software without specific prior written permission.
|
||||
*
|
||||
* 4. This software, with or without modification, must only be used with a
|
||||
* Nordic Semiconductor ASA integrated circuit.
|
||||
*
|
||||
* 5. Any software provided in binary form under this license must not be reverse
|
||||
* engineered, decompiled, modified and/or disassembled.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
|
||||
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
|
||||
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
||||
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef OPTIGA_BACKEND_ECDSA_H__
|
||||
#define OPTIGA_BACKEND_ECDSA_H__
|
||||
|
||||
#include "sdk_config.h"
|
||||
#include "nordic_common.h"
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
|
||||
#include <stdint.h>
|
||||
#include "nrf_crypto_ecc_shared.h"
|
||||
#include "nrf_crypto_ecdsa_shared.h"
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA_ECC_SECP256R1)
|
||||
|
||||
|
||||
/** @internal See @ref nrf_crypto_backend_ecdsa_sign_fn_t.
|
||||
*/
|
||||
ret_code_t nrf_crypto_backend_optiga_sign(
|
||||
void * p_context,
|
||||
void const * p_private_key,
|
||||
uint8_t const * p_data,
|
||||
size_t data_size,
|
||||
uint8_t * p_signature);
|
||||
|
||||
|
||||
/** @internal See @ref nrf_crypto_backend_ecdsa_verify_fn_t.
|
||||
*/
|
||||
ret_code_t nrf_crypto_backend_optiga_verify(
|
||||
void * p_context,
|
||||
void const * p_public_key,
|
||||
uint8_t const * p_data,
|
||||
size_t data_size,
|
||||
uint8_t const * p_signature);
|
||||
|
||||
|
||||
// Context is not used by OPTIGA, so its size is 0
|
||||
#define NRF_CRYPTO_BACKEND_SECP256R1_SIGN_CONTEXT_SIZE 0
|
||||
#define NRF_CRYPTO_BACKEND_SECP256R1_VERIFY_CONTEXT_SIZE 0
|
||||
// Dummy typedefs for unused contexts
|
||||
typedef uint32_t nrf_crypto_backend_secp256r1_sign_context_t;
|
||||
typedef uint32_t nrf_crypto_backend_secp256r1_verify_context_t;
|
||||
// Alias for common OPTIGA types
|
||||
#define nrf_crypto_backend_secp256r1_sign nrf_crypto_backend_optiga_sign
|
||||
#define nrf_crypto_backend_secp256r1_verify nrf_crypto_backend_optiga_verify
|
||||
#endif
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
|
||||
#endif // OPTIGA_BACKEND_ECDSA_H__
|
||||
128
components/libraries/crypto/backend/optiga/optiga_backend_init.c
Normal file
128
components/libraries/crypto/backend/optiga/optiga_backend_init.c
Normal file
@@ -0,0 +1,128 @@
|
||||
/**
|
||||
* Copyright (c) 2018 - 2020, Nordic Semiconductor ASA
|
||||
*
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without modification,
|
||||
* are permitted provided that the following conditions are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright notice, this
|
||||
* list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form, except as embedded into a Nordic
|
||||
* Semiconductor ASA integrated circuit in a product or a software update for
|
||||
* such product, must reproduce the above copyright notice, this list of
|
||||
* conditions and the following disclaimer in the documentation and/or other
|
||||
* materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of Nordic Semiconductor ASA nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from this
|
||||
* software without specific prior written permission.
|
||||
*
|
||||
* 4. This software, with or without modification, must only be used with a
|
||||
* Nordic Semiconductor ASA integrated circuit.
|
||||
*
|
||||
* 5. Any software provided in binary form under this license must not be reverse
|
||||
* engineered, decompiled, modified and/or disassembled.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
|
||||
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
|
||||
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
||||
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#include "sdk_common.h"
|
||||
#include "sdk_config.h"
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
|
||||
#include "nrf_crypto_init.h"
|
||||
#include "nrf_crypto_rng.h"
|
||||
#include "nrf_log.h"
|
||||
|
||||
/*lint -save -e????*/
|
||||
#include "optiga/optiga_util.h"
|
||||
#include "optiga/ifx_i2c/ifx_i2c.h"
|
||||
/*lint -restore*/
|
||||
|
||||
optiga_comms_t optiga_comms = {(void*)&ifx_i2c_context_0, NULL, NULL};
|
||||
|
||||
// need to forward declare these, because they are not exported through the PAL API
|
||||
void pal_gpio_init(void);
|
||||
void pal_os_event_init(void);
|
||||
|
||||
/*************************************************************************
|
||||
* functions
|
||||
*************************************************************************/
|
||||
|
||||
static int32_t optiga_init(void)
|
||||
{
|
||||
int32_t status = (int32_t) OPTIGA_LIB_ERROR;
|
||||
|
||||
// Initialize PAL
|
||||
pal_gpio_init();
|
||||
pal_os_event_init();
|
||||
|
||||
status = optiga_util_open_application(&optiga_comms);
|
||||
if (OPTIGA_LIB_SUCCESS != status)
|
||||
{
|
||||
NRF_LOG_INFO("Failure: CmdLib_OpenApplication(): 0x%04X", status);
|
||||
return status;
|
||||
}
|
||||
|
||||
NRF_LOG_INFO("Success: CmdLib_OpenApplication(): 0x%04X", status);
|
||||
|
||||
return OPTIGA_LIB_SUCCESS;
|
||||
}
|
||||
|
||||
/** @internal @brief Function to initialize OPTIGA backend - open the application.
|
||||
*/
|
||||
static ret_code_t optiga_backend_init(void)
|
||||
{
|
||||
if(optiga_init() != OPTIGA_LIB_SUCCESS)
|
||||
{
|
||||
return NRF_ERROR_INTERNAL;
|
||||
}
|
||||
|
||||
#if defined(NRF_CRYPTO_RNG_AUTO_INIT_ENABLED) && (NRF_CRYPTO_RNG_AUTO_INIT_ENABLED == 1)
|
||||
|
||||
ret_code_t ret_val;
|
||||
ret_val = nrf_crypto_rng_init(NULL, NULL);
|
||||
return ret_val;
|
||||
|
||||
#elif defined(NRF_CRYPTO_RNG_AUTO_INIT_ENABLED) && (NRF_CRYPTO_RNG_AUTO_INIT_ENABLED == 0)
|
||||
|
||||
return NRF_SUCCESS;
|
||||
|
||||
#else
|
||||
|
||||
#warning NRF_CRYPTO_RNG_AUTO_INIT_ENABLED define not found in sdk_config.h (Is the sdk_config.h valid?).
|
||||
|
||||
#endif // NRF_CRYPTO_RNG_AUTO_INIT_ENABLED
|
||||
|
||||
}
|
||||
|
||||
|
||||
/** @internal @brief Function to uninitialize OPTIGA backend - currently no implementation is required.
|
||||
*/
|
||||
static ret_code_t optiga_backend_uninit(void)
|
||||
{
|
||||
// Empty implementation
|
||||
return NRF_SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
CRYPTO_BACKEND_REGISTER(nrf_crypto_backend_info_t const optiga_backend) =
|
||||
{
|
||||
.init_fn = optiga_backend_init,
|
||||
.uninit_fn = optiga_backend_uninit,
|
||||
};
|
||||
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
147
components/libraries/crypto/backend/optiga/optiga_backend_rng.c
Normal file
147
components/libraries/crypto/backend/optiga/optiga_backend_rng.c
Normal file
@@ -0,0 +1,147 @@
|
||||
/**
|
||||
* Copyright (c) 2018 - 2020, Nordic Semiconductor ASA
|
||||
*
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without modification,
|
||||
* are permitted provided that the following conditions are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright notice, this
|
||||
* list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form, except as embedded into a Nordic
|
||||
* Semiconductor ASA integrated circuit in a product or a software update for
|
||||
* such product, must reproduce the above copyright notice, this list of
|
||||
* conditions and the following disclaimer in the documentation and/or other
|
||||
* materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of Nordic Semiconductor ASA nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from this
|
||||
* software without specific prior written permission.
|
||||
*
|
||||
* 4. This software, with or without modification, must only be used with a
|
||||
* Nordic Semiconductor ASA integrated circuit.
|
||||
*
|
||||
* 5. Any software provided in binary form under this license must not be reverse
|
||||
* engineered, decompiled, modified and/or disassembled.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
|
||||
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
|
||||
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
||||
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#include "sdk_common.h"
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO)
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA_RNG)
|
||||
|
||||
#include "nrf_crypto_rng.h"
|
||||
#include "optiga_backend_rng.h"
|
||||
#include "optiga/optiga_crypt.h"
|
||||
|
||||
|
||||
/** @brief Minimal size output of random data in OPTIGA Trust X
|
||||
*
|
||||
* @details See Solution Reference Manual v1.35, section 4.4.3.4
|
||||
*/
|
||||
#define OPTIGA_RNG_MIN_SIZE (0x8)
|
||||
|
||||
|
||||
/** @brief Maximum size output of random data in OPTIGA Trust X
|
||||
*
|
||||
* @details See Solution Reference Manual v1.35, section 4.4.3.4
|
||||
*/
|
||||
#define OPTIGA_RNG_MAX_SIZE (0x100)
|
||||
|
||||
|
||||
ret_code_t nrf_crypto_rng_backend_init(void * const p_context,
|
||||
void * const p_temp_buffer)
|
||||
{
|
||||
UNUSED_PARAMETER(p_context);
|
||||
UNUSED_PARAMETER(p_temp_buffer);
|
||||
|
||||
return NRF_SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
ret_code_t nrf_crypto_rng_backend_uninit(void * const p_context)
|
||||
{
|
||||
UNUSED_PARAMETER(p_context);
|
||||
|
||||
return NRF_SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
ret_code_t nrf_crypto_rng_backend_vector_generate(void * const p_context,
|
||||
uint8_t * const p_target,
|
||||
size_t size,
|
||||
bool use_mutex)
|
||||
{
|
||||
UNUSED_PARAMETER(use_mutex);
|
||||
UNUSED_PARAMETER(p_context);
|
||||
|
||||
uint8_t backup[OPTIGA_RNG_MIN_SIZE] = {0};
|
||||
optiga_lib_status_t err;
|
||||
|
||||
uint8_t * out_cur = p_target;
|
||||
|
||||
size_t size_left = size;
|
||||
size_t cur_len = size_left;
|
||||
|
||||
do
|
||||
{
|
||||
cur_len = size_left > OPTIGA_RNG_MAX_SIZE ? OPTIGA_RNG_MAX_SIZE : size_left;
|
||||
|
||||
if (cur_len < OPTIGA_RNG_MIN_SIZE)
|
||||
{
|
||||
err = optiga_crypt_random(OPTIGA_RNG_TYPE_TRNG, backup, OPTIGA_RNG_MIN_SIZE);
|
||||
if(err != OPTIGA_LIB_SUCCESS)
|
||||
{
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
memcpy(out_cur, backup, cur_len);
|
||||
}
|
||||
else
|
||||
{
|
||||
err = optiga_crypt_random(OPTIGA_RNG_TYPE_TRNG, out_cur, cur_len);
|
||||
if (err != OPTIGA_LIB_SUCCESS)
|
||||
{
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
}
|
||||
|
||||
out_cur += cur_len;
|
||||
size_left -= cur_len;
|
||||
|
||||
} while(size_left > 0);
|
||||
|
||||
return NRF_SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
ret_code_t nrf_crypto_rng_backend_reseed(void * const p_context,
|
||||
void * p_temp_buffer,
|
||||
uint8_t * p_input_data,
|
||||
size_t size)
|
||||
{
|
||||
UNUSED_PARAMETER(p_context);
|
||||
UNUSED_PARAMETER(p_temp_buffer);
|
||||
UNUSED_PARAMETER(p_input_data);
|
||||
UNUSED_PARAMETER(size);
|
||||
|
||||
return NRF_ERROR_CRYPTO_FEATURE_UNAVAILABLE;
|
||||
}
|
||||
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA_RNG)
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO)
|
||||
100
components/libraries/crypto/backend/optiga/optiga_backend_rng.h
Normal file
100
components/libraries/crypto/backend/optiga/optiga_backend_rng.h
Normal file
@@ -0,0 +1,100 @@
|
||||
/**
|
||||
* Copyright (c) 2018 - 2020, Nordic Semiconductor ASA
|
||||
*
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without modification,
|
||||
* are permitted provided that the following conditions are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright notice, this
|
||||
* list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form, except as embedded into a Nordic
|
||||
* Semiconductor ASA integrated circuit in a product or a software update for
|
||||
* such product, must reproduce the above copyright notice, this list of
|
||||
* conditions and the following disclaimer in the documentation and/or other
|
||||
* materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of Nordic Semiconductor ASA nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from this
|
||||
* software without specific prior written permission.
|
||||
*
|
||||
* 4. This software, with or without modification, must only be used with a
|
||||
* Nordic Semiconductor ASA integrated circuit.
|
||||
*
|
||||
* 5. Any software provided in binary form under this license must not be reverse
|
||||
* engineered, decompiled, modified and/or disassembled.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
|
||||
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
|
||||
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
||||
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef OPTIGA_BACKEND_RNG_H__
|
||||
#define OPTIGA_BACKEND_RNG_H__
|
||||
|
||||
/** @file
|
||||
*
|
||||
* @defgroup nrf_crypto_optiga_backend_rng nrf_crypto OPTIGA RNG backend
|
||||
* @{
|
||||
* @ingroup nrf_crypto_backends
|
||||
*
|
||||
* @brief RNG functionality provided by the nrf_crypto OPTIGA RNG backend.
|
||||
*/
|
||||
|
||||
#include "sdk_common.h"
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO)
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA_RNG)
|
||||
|
||||
|
||||
#include "nrf_crypto_rng_shared.h"
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
|
||||
#if NRF_MODULE_ENABLED(NRF_CRYPTO_RNG)
|
||||
#error "More than one RNG backend enabled."
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO_RNG)
|
||||
#define NRF_CRYPTO_RNG_ENABLED 1
|
||||
|
||||
/**
|
||||
* @internal @brief Context for nRF RNG peripheral.
|
||||
*/
|
||||
typedef struct
|
||||
{
|
||||
nrf_crypto_rng_internal_context_t header; //!< Internal common context header.
|
||||
} nrf_crypto_backend_rng_context_t;
|
||||
|
||||
/**
|
||||
* @internal @brief Dummy temp buffer for nRF RNG peripheral.
|
||||
*/
|
||||
typedef struct
|
||||
{
|
||||
uint32_t reserved;
|
||||
} nrf_crypto_backend_rng_temp_buffer_t;
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA_RNG)
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OPTIGA)
|
||||
#endif // NRF_MODULE_ENABLED(NRF_CRYPTO)
|
||||
|
||||
/**@} */
|
||||
|
||||
#endif // OPTIGA_BACKEND_RNG_H__
|
||||
@@ -0,0 +1,265 @@
|
||||
/**
|
||||
* Copyright (c) 2018 - 2020, Nordic Semiconductor ASA
|
||||
*
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without modification,
|
||||
* are permitted provided that the following conditions are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright notice, this
|
||||
* list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form, except as embedded into a Nordic
|
||||
* Semiconductor ASA integrated circuit in a product or a software update for
|
||||
* such product, must reproduce the above copyright notice, this list of
|
||||
* conditions and the following disclaimer in the documentation and/or other
|
||||
* materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of Nordic Semiconductor ASA nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from this
|
||||
* software without specific prior written permission.
|
||||
*
|
||||
* 4. This software, with or without modification, must only be used with a
|
||||
* Nordic Semiconductor ASA integrated circuit.
|
||||
*
|
||||
* 5. Any software provided in binary form under this license must not be reverse
|
||||
* engineered, decompiled, modified and/or disassembled.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
|
||||
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
|
||||
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
||||
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
|
||||
#include <string.h>
|
||||
#include "optiga_backend_utils.h"
|
||||
#include "nrf_crypto_error.h"
|
||||
|
||||
/**
|
||||
* @brief Decodes two ASN.1 integers to the R and S components of a ECC signature.
|
||||
*
|
||||
* @param[in] p_asn1 Pointer to buffer containing the ASN.1 encoded R and S values.
|
||||
* @param[in] asn1_len Length of the asn1 buffer.
|
||||
* @param[out] p_rs Pointer to buffer where to write the R and S values
|
||||
* @param[in,out] p_rs_len pointer to variable containing length of the rs buffer,
|
||||
* updated to actual length after the call.
|
||||
*
|
||||
* @returns NRF_SUCCESS on success, otherwise NRF_ERROR_CRYPTO_INTERNAL.
|
||||
*/
|
||||
ret_code_t asn1_to_ecdsa_rs(uint8_t const * p_asn1,
|
||||
size_t asn1_len,
|
||||
uint8_t * p_rs,
|
||||
size_t * p_rs_len)
|
||||
{
|
||||
|
||||
uint8_t const * p_cur = p_asn1;
|
||||
uint8_t const * p_end = p_asn1 + asn1_len; // Points to first invalid mem-location
|
||||
uint8_t r_len;
|
||||
uint8_t s_len;
|
||||
|
||||
if (p_asn1 == NULL || p_rs == NULL || p_rs_len == NULL)
|
||||
{
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
if (asn1_len == 0 || *p_rs_len == 0)
|
||||
{
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
if (*p_cur != DER_TAG_INTEGER)
|
||||
{
|
||||
// Wrong tag type
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
if ((p_cur + 2) >= p_end)
|
||||
{
|
||||
// Prevented out-of-bounds read
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
// Move to length value
|
||||
p_cur++;
|
||||
r_len = *p_cur;
|
||||
|
||||
if (r_len > DER_INTEGER_MAX_LEN)
|
||||
{
|
||||
// Unsupported length
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
// Move to first data value
|
||||
p_cur++;
|
||||
|
||||
// Check for stuffing bits
|
||||
if (*p_cur == 0x00)
|
||||
{
|
||||
p_cur++;
|
||||
r_len--;
|
||||
}
|
||||
|
||||
// Check for out-of-bounds read
|
||||
if ((p_cur + r_len) >= p_end)
|
||||
{
|
||||
// prevented out-of-bounds read
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
// Check for out-of-bounds write
|
||||
if ((p_rs + r_len) > (p_rs + *p_rs_len))
|
||||
{
|
||||
// prevented out-of-bounds write
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
// Copy R component to output
|
||||
memcpy(p_rs, p_cur, r_len);
|
||||
|
||||
// Move to next tag
|
||||
p_cur += r_len;
|
||||
|
||||
if (*p_cur != DER_TAG_INTEGER)
|
||||
{
|
||||
// Wrong tag type
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
if ((p_cur + 2) >= p_end)
|
||||
{
|
||||
// Prevented out-of-bounds read
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
p_cur++;
|
||||
s_len = *p_cur;
|
||||
|
||||
if (s_len > DER_INTEGER_MAX_LEN)
|
||||
{
|
||||
// Unsupported length
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
p_cur++;
|
||||
|
||||
if (*p_cur == 0x00)
|
||||
{
|
||||
p_cur++;
|
||||
s_len--;
|
||||
}
|
||||
|
||||
// Check for out-of-bounds read
|
||||
if ((p_cur + s_len) > p_end)
|
||||
{
|
||||
// prevented out-of-bounds read
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
// Check for out-of-bounds write
|
||||
if ((p_rs + r_len + s_len) > (p_rs + *p_rs_len))
|
||||
{
|
||||
// Prevented out-of-bounds write
|
||||
return NRF_ERROR_CRYPTO_INTERNAL;
|
||||
}
|
||||
|
||||
memcpy(p_rs + r_len, p_cur, s_len);
|
||||
|
||||
*p_rs_len = r_len + s_len;
|
||||
|
||||
return NRF_SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* @brief Encodes the ECDSA signature components (r, s) in ASN.1 format.
|
||||
*
|
||||
* @param[in] p_r Pointer to buffer containing component r of the ECDSA signature.
|
||||
* @param[in] r_len Length of the r component of the ECDSA signature.
|
||||
* @param[in] p_s Pointer to buffer containing component s of the ECDSA signature.
|
||||
* @param[in] s_len Length of the s component of the ECDSA signature.
|
||||
* @param[out] p_asn_sig Pointer to buffer to hold the resulting ASN.1-encoded ECDSA signature.
|
||||
* @param[out] p_asn_sig_len Pointer to variable holding the length of the buffer for ASN.1-encoded
|
||||
* ECDSA signature. This will be updated to the actual size when the
|
||||
* function is called.
|
||||
*
|
||||
* @returns True on success, otherwise false.
|
||||
*/
|
||||
bool ecdsa_rs_to_asn1(uint8_t const * p_r,
|
||||
size_t r_len,
|
||||
uint8_t const * p_s,
|
||||
size_t s_len,
|
||||
uint8_t * p_asn_sig,
|
||||
size_t * p_asn_sig_len)
|
||||
{
|
||||
size_t index = 0;
|
||||
// NULL checks
|
||||
if (p_r == NULL || p_s == NULL || p_asn_sig_len == NULL)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
if (r_len == 0 || r_len > DER_INTEGER_MAX_LEN || s_len == 0 || s_len > DER_INTEGER_MAX_LEN)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
if (*p_asn_sig_len < (r_len + s_len + DER_OVERHEAD))
|
||||
{
|
||||
// Not enough space in output buffer
|
||||
return false;
|
||||
}
|
||||
|
||||
// R component
|
||||
// DER TAG INTEGER
|
||||
p_asn_sig[index] = DER_TAG_INTEGER;
|
||||
index++;
|
||||
|
||||
// Set length
|
||||
p_asn_sig[index] = r_len;
|
||||
|
||||
// check if extra byte needed
|
||||
if (p_r[0] & 0x80)
|
||||
{
|
||||
// Update length value
|
||||
p_asn_sig[index] += 1;
|
||||
index++;
|
||||
// Insert zero byte for padding
|
||||
p_asn_sig[index] = 0;
|
||||
}
|
||||
|
||||
index++;
|
||||
|
||||
memcpy(&p_asn_sig[index], p_r, r_len);
|
||||
index += r_len;
|
||||
|
||||
// S component
|
||||
// DER TAG INTEGER
|
||||
p_asn_sig[index] = DER_TAG_INTEGER;
|
||||
index++;
|
||||
// Set length
|
||||
p_asn_sig[index] = s_len;
|
||||
|
||||
if (p_s[0] & 0x80)
|
||||
{
|
||||
// Update length value
|
||||
p_asn_sig[index] += 1;
|
||||
index++;
|
||||
// Insert zero byte for padding
|
||||
p_asn_sig[index] = 0;
|
||||
}
|
||||
|
||||
index++;
|
||||
|
||||
memcpy(&p_asn_sig[index], p_s, s_len);
|
||||
index += s_len;
|
||||
|
||||
// Return total length of ASN.1-encoded data structure
|
||||
*p_asn_sig_len = index;
|
||||
return true;
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
/**
|
||||
* Copyright (c) 2018 - 2020, Nordic Semiconductor ASA
|
||||
*
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without modification,
|
||||
* are permitted provided that the following conditions are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright notice, this
|
||||
* list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form, except as embedded into a Nordic
|
||||
* Semiconductor ASA integrated circuit in a product or a software update for
|
||||
* such product, must reproduce the above copyright notice, this list of
|
||||
* conditions and the following disclaimer in the documentation and/or other
|
||||
* materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of Nordic Semiconductor ASA nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from this
|
||||
* software without specific prior written permission.
|
||||
*
|
||||
* 4. This software, with or without modification, must only be used with a
|
||||
* Nordic Semiconductor ASA integrated circuit.
|
||||
*
|
||||
* 5. Any software provided in binary form under this license must not be reverse
|
||||
* engineered, decompiled, modified and/or disassembled.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
|
||||
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
|
||||
* GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
||||
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef OPTIGA_BACKEND_UTILS_H__
|
||||
#define OPTIGA_BACKEND_UTILS_H__
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdbool.h>
|
||||
#include <stddef.h>
|
||||
#include "sdk_config.h"
|
||||
#include "nordic_common.h"
|
||||
#include "sdk_errors.h"
|
||||
|
||||
/** @brief Define for a integer tag in DER encoding. */
|
||||
#define DER_TAG_INTEGER 0x02
|
||||
|
||||
|
||||
/** @brief Max size of integer in DER encoding.
|
||||
*
|
||||
* @note This limit is for this implementation only, ASN.1 DER supports more
|
||||
*/
|
||||
#define DER_INTEGER_MAX_LEN 0x7F
|
||||
|
||||
|
||||
/** @brief Define for overhead to encode a DER of two integers
|
||||
*
|
||||
* @details TAG + LENGTH needs 2 bytes if the highest bit of the integer is set
|
||||
* we need an extra byte
|
||||
*/
|
||||
#define DER_OVERHEAD ((2 + 1) * 2)
|
||||
|
||||
|
||||
/**
|
||||
* @brief Decodes two ASN.1 integers to the R and S components of a ECC signature.
|
||||
*
|
||||
* @param[in] p_asn1 Pointer to buffer containing the ASN.1 encoded R and S values.
|
||||
* @param[in] asn1_len Length of the asn1 buffer.
|
||||
* @param[out] p_rs Pointer to buffer where to write the R and S values
|
||||
* @param[in,out] p_rs_len pointer to variable containing length of the rs buffer,
|
||||
* updated to actual length after the call.
|
||||
*
|
||||
* @returns NRF_SUCCESS on success, otherwise NRF_ERROR_CRYPTO_INTERNAL.
|
||||
*/
|
||||
|
||||
ret_code_t asn1_to_ecdsa_rs(uint8_t const * p_asn1,
|
||||
size_t asn1_len,
|
||||
uint8_t * p_rs,
|
||||
size_t * p_rs_len);
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* @brief Encodes the ECDSA signature components (r, s) in ASN.1 format.
|
||||
*
|
||||
* @param[in] p_r Pointer to buffer containing component r of the ECDSA signature.
|
||||
* @param[in] r_len Length of the r component of the ECDSA signature.
|
||||
* @param[in] p_s Pointer to buffer containing component s of the ECDSA signature.
|
||||
* @param[in] s_len Length of the s component of the ECDSA signature.
|
||||
* @param[out] p_asn_sig Pointer to buffer to hold the resulting ASN.1-encoded ECDSA signature.
|
||||
* @param[out] p_asn_sig_len Pointer to variable holding the length of the buffer for ASN.1-encoded
|
||||
* ECDSA signature. This will be updated to the actual size when the
|
||||
* function is called.
|
||||
*
|
||||
* @returns True on success, otherwise false.
|
||||
*/
|
||||
bool ecdsa_rs_to_asn1(uint8_t const * p_r,
|
||||
size_t r_len,
|
||||
uint8_t const * p_s,
|
||||
size_t s_len,
|
||||
uint8_t * p_asn_sig,
|
||||
size_t * p_asn_sig_len);
|
||||
|
||||
|
||||
#endif // OPTIGA_BACKEND_UTILS_H__
|
||||
|
||||
Reference in New Issue
Block a user