1 /*
2 * Copyright (c) 2021-2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #ifdef HKS_CONFIG_FILE
17 #include HKS_CONFIG_FILE
18 #else
19 #include "hks_config.h"
20 #endif
21
22 #include "hks_check_paramset.h"
23
24 #include <stddef.h>
25
26 #include "hks_base_check.h"
27 #include "hks_common_check.h"
28 #include "hks_log.h"
29 #include "hks_param.h"
30 #include "hks_template.h"
31 #include "securec.h"
32
33 #ifdef _CUT_AUTHENTICATE_
34 #undef HKS_SUPPORT_HASH_C
35 #undef HKS_SUPPORT_RSA_C
36 #undef HKS_SUPPORT_ECC_C
37 #undef HKS_SUPPORT_X25519_C
38 #undef HKS_SUPPORT_ED25519_C
39 #undef HKS_SUPPORT_KDF_PBKDF2
40 #endif /* _CUT_AUTHENTICATE_ */
41
42 #define HKS_DEFAULT_PBKDF2_ITERATION 1000
43 #define HKS_DEFAULT_PBKDF2_SALT_SIZE 16
44
45 #ifndef _CUT_AUTHENTICATE_
46 static uint32_t g_genKeyAlg[] = {
47 #ifdef HKS_SUPPORT_RSA_C
48 HKS_ALG_RSA,
49 #endif
50 #ifdef HKS_SUPPORT_AES_C
51 HKS_ALG_AES,
52 #endif
53 #ifdef HKS_SUPPORT_ECC_C
54 HKS_ALG_ECC,
55 #endif
56 #ifdef HKS_SUPPORT_HMAC_C
57 HKS_ALG_HMAC,
58 #endif
59 #ifdef HKS_SUPPORT_X25519_C
60 HKS_ALG_X25519,
61 #endif
62 #ifdef HKS_SUPPORT_ED25519_C
63 HKS_ALG_ED25519,
64 #endif
65 #ifdef HKS_SUPPORT_DSA_C
66 HKS_ALG_DSA,
67 #endif
68 #ifdef HKS_SUPPORT_DH_C
69 HKS_ALG_DH,
70 #endif
71 #ifdef HKS_SUPPORT_ECDH_C
72 HKS_ALG_ECDH,
73 #endif
74 #ifdef HKS_SUPPORT_SM2_C
75 HKS_ALG_SM2,
76 #endif
77 #ifdef HKS_SUPPORT_SM3_C
78 HKS_ALG_SM3,
79 #endif
80 #ifdef HKS_SUPPORT_SM4_C
81 HKS_ALG_SM4,
82 #endif
83 };
84
85 static uint32_t g_importKeyAlg[] = {
86 #ifdef HKS_SUPPORT_RSA_C
87 HKS_ALG_RSA,
88 #endif
89 #ifdef HKS_SUPPORT_AES_C
90 HKS_ALG_AES,
91 #endif
92 #ifdef HKS_SUPPORT_ECC_C
93 HKS_ALG_ECC,
94 #endif
95 #ifdef HKS_SUPPORT_X25519_C
96 HKS_ALG_X25519,
97 #endif
98 #ifdef HKS_SUPPORT_ED25519_C
99 HKS_ALG_ED25519,
100 #endif
101 #ifdef HKS_SUPPORT_DSA_C
102 HKS_ALG_DSA,
103 #endif
104 #ifdef HKS_SUPPORT_DH_C
105 HKS_ALG_DH,
106 #endif
107 #ifdef HKS_SUPPORT_HMAC_C
108 HKS_ALG_HMAC,
109 #endif
110 #ifdef HKS_SUPPORT_SM2_C
111 HKS_ALG_SM2,
112 #endif
113 #ifdef HKS_SUPPORT_SM3_C
114 HKS_ALG_SM3,
115 #endif
116 #ifdef HKS_SUPPORT_SM4_C
117 HKS_ALG_SM4,
118 #endif
119 };
120
121 static uint32_t g_cipherAlg[] = {
122 #ifdef HKS_SUPPORT_RSA_C
123 HKS_ALG_RSA,
124 #endif
125 #ifdef HKS_SUPPORT_AES_C
126 HKS_ALG_AES,
127 #endif
128 };
129 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
130 static uint32_t g_signAlg[] = {
131 #ifdef HKS_SUPPORT_RSA_C
132 HKS_ALG_RSA,
133 #endif
134 #ifdef HKS_SUPPORT_DSA_C
135 HKS_ALG_DSA,
136 #endif
137 #ifdef HKS_SUPPORT_ECC_C
138 HKS_ALG_ECC,
139 #endif
140 #ifdef HKS_SUPPORT_ED25519_C
141 HKS_ALG_ED25519,
142 #endif
143 };
144 #endif
145
146 static uint32_t g_agreeAlg[] = {
147 #ifdef HKS_SUPPORT_ECDH_C
148 HKS_ALG_ECDH,
149 #endif
150 #ifdef HKS_SUPPORT_X25519_C
151 HKS_ALG_X25519,
152 #endif
153 #ifdef HKS_SUPPORT_DH_C
154 HKS_ALG_DH,
155 #endif
156 };
157
158 static uint32_t g_agreeAlgLocal[] = {
159 #ifdef HKS_SUPPORT_ECDH_C
160 HKS_ALG_ECDH,
161 #endif
162 #ifdef HKS_SUPPORT_X25519_C
163 HKS_ALG_X25519,
164 #endif
165 #ifdef HKS_SUPPORT_DH_C
166 HKS_ALG_DH,
167 #endif
168 };
169
170 static uint32_t g_unwrapSuite[] = {
171 #if defined(HKS_SUPPORT_X25519_C) && defined(HKS_SUPPORT_AES_GCM)
172 HKS_UNWRAP_SUITE_X25519_AES_256_GCM_NOPADDING,
173 #endif
174 #if defined(HKS_SUPPORT_ECDH_C) && defined(HKS_SUPPORT_AES_GCM)
175 HKS_UNWRAP_SUITE_ECDH_AES_256_GCM_NOPADDING,
176 #endif
177 };
178 #endif /* _CUT_AUTHENTICATE_ */
179
180 static uint32_t g_deriveAlg[] = {
181 #ifdef HKS_SUPPORT_KDF_HKDF
182 HKS_ALG_HKDF,
183 #endif
184 #ifdef HKS_SUPPORT_KDF_PBKDF2
185 HKS_ALG_PBKDF2,
186 #endif
187 };
188
189 static uint32_t g_deriveAlgLocal[] = {
190 #ifdef HKS_SUPPORT_KDF_HKDF
191 HKS_ALG_HKDF,
192 #endif
193 };
194
195 static uint32_t g_digest[] = {
196 HKS_DIGEST_SHA1,
197 HKS_DIGEST_SHA224,
198 HKS_DIGEST_SHA256,
199 HKS_DIGEST_SHA384,
200 HKS_DIGEST_SHA512,
201 };
202 static uint32_t g_macDigest[] = {
203 HKS_DIGEST_SHA1,
204 HKS_DIGEST_SHA224,
205 HKS_DIGEST_SHA256,
206 HKS_DIGEST_SHA384,
207 HKS_DIGEST_SHA512,
208 HKS_DIGEST_SM3
209 };
210 #ifdef HKS_SUPPORT_AES_C
211 static uint32_t g_aesKeySizeLocal[] = {
212 HKS_AES_KEY_SIZE_128,
213 HKS_AES_KEY_SIZE_192,
214 HKS_AES_KEY_SIZE_256,
215 };
216 #endif
217 #ifdef HKS_SUPPORT_RSA_C
218 static uint32_t g_rsaKeySizeLocal[] = {
219 HKS_RSA_KEY_SIZE_512,
220 HKS_RSA_KEY_SIZE_768,
221 HKS_RSA_KEY_SIZE_1024,
222 HKS_RSA_KEY_SIZE_2048,
223 HKS_RSA_KEY_SIZE_3072,
224 HKS_RSA_KEY_SIZE_4096,
225 };
226 #endif
227
228 static uint32_t g_cipherAlgLocal[] = {
229 #ifdef HKS_SUPPORT_AES_C
230 HKS_ALG_AES,
231 #endif
232 #ifdef HKS_SUPPORT_RSA_C
233 HKS_ALG_RSA,
234 #endif
235 };
236
CheckAndGetAlgorithm(const struct HksParamSet * paramSet,const uint32_t * expectAlg,uint32_t expectCnt,uint32_t * alg)237 static int32_t CheckAndGetAlgorithm(
238 const struct HksParamSet *paramSet, const uint32_t *expectAlg, uint32_t expectCnt, uint32_t *alg)
239 {
240 struct HksParam *algParam = NULL;
241 int32_t ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &algParam);
242 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_ALG_FAIL,
243 "get param 0x%" LOG_PUBLIC "x failed!", HKS_TAG_ALGORITHM)
244
245 ret = HksCheckValue(algParam->uint32Param, expectAlg, expectCnt);
246 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_ALGORITHM,
247 "alg value %" LOG_PUBLIC "u not expected", algParam->uint32Param)
248
249 *alg = algParam->uint32Param;
250 return ret;
251 }
252
CheckAndGetDigest(const struct HksParamSet * paramSet,const uint32_t * expectDigest,uint32_t expectCnt,uint32_t * digest)253 static int32_t CheckAndGetDigest(
254 const struct HksParamSet *paramSet, const uint32_t *expectDigest, uint32_t expectCnt, uint32_t *digest)
255 {
256 struct HksParam *digestParam = NULL;
257 int32_t ret = HksGetParam(paramSet, HKS_TAG_DIGEST, &digestParam);
258 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_DIGEST_FAIL,
259 "get param get 0x%" LOG_PUBLIC "x failed!", HKS_TAG_DIGEST)
260
261 ret = HksCheckValue(digestParam->uint32Param, expectDigest, expectCnt);
262 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_DIGEST,
263 "digest value %" LOG_PUBLIC "u not expected", digestParam->uint32Param)
264
265 *digest = digestParam->uint32Param;
266 return ret;
267 }
268
269 #ifndef _CUT_AUTHENTICATE_
CheckGenKeyParamsByAlg(uint32_t alg,const struct HksParamSet * paramSet,struct ParamsValues * params)270 static int32_t CheckGenKeyParamsByAlg(uint32_t alg, const struct HksParamSet *paramSet,
271 struct ParamsValues *params)
272 {
273 int32_t ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_GEN_KEY, paramSet, params);
274 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret,
275 "get input params by algorithm failed, ret = %" LOG_PUBLIC "d", ret)
276
277 ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_GEN_KEY, params);
278 HKS_IF_NOT_SUCC_RETURN(ret, ret)
279
280 ret = HksCheckGenKeyPurpose(alg, params->purpose.value);
281 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret,
282 "check purpose not expected, purpose = %" LOG_PUBLIC "d", params->purpose.value);
283 return HksCheckGenKeyMutableParams(alg, params);
284 }
285
CheckGenKeyMacDeriveParams(uint32_t alg,uint32_t inputPurpose,const struct HksParamSet * paramSet,struct ParamsValues * params)286 static int32_t CheckGenKeyMacDeriveParams(
287 uint32_t alg, uint32_t inputPurpose, const struct HksParamSet *paramSet, struct ParamsValues *params)
288 {
289 if (alg != HKS_ALG_AES && alg != HKS_ALG_HMAC && alg != HKS_ALG_SM3) {
290 HKS_LOG_E("check mac or derive, not aes alg, alg: %" LOG_PUBLIC "u", alg);
291 return HKS_ERROR_INVALID_PURPOSE;
292 }
293
294 int32_t ret = HksCheckGenKeyPurpose(alg, inputPurpose);
295 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check purpose invalid, purpose 0x%" LOG_PUBLIC "x", inputPurpose)
296
297 if (inputPurpose == HKS_KEY_PURPOSE_MAC) {
298 ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_GEN_MAC_KEY, paramSet, params);
299 } else {
300 ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_GEN_DERIVE_KEY, paramSet, params);
301 }
302 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get input params by algorithm failed, ret = %" LOG_PUBLIC "d", ret)
303
304 if (inputPurpose == HKS_KEY_PURPOSE_MAC) {
305 ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_GEN_MAC_KEY, params);
306 } else {
307 ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_GEN_DERIVE_KEY, params);
308 }
309 HKS_IF_NOT_SUCC_LOGE(ret, "get input params by algorithm failed, ret = %" LOG_PUBLIC "d", ret)
310
311 return ret;
312 }
313
CoreCheckGenKeyParams(const struct HksParamSet * paramSet,struct ParamsValues * params)314 static int32_t CoreCheckGenKeyParams(const struct HksParamSet *paramSet, struct ParamsValues *params)
315 {
316 uint32_t alg;
317 int32_t ret = HksCheckParamSetTag(paramSet);
318 HKS_IF_NOT_SUCC_RETURN(ret, ret)
319
320 ret = CheckAndGetAlgorithm(paramSet, g_genKeyAlg, HKS_ARRAY_SIZE(g_genKeyAlg), &alg);
321 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check and get alg failed")
322
323 struct HksParam *purposeParam = NULL;
324 ret = HksGetParam(paramSet, HKS_TAG_PURPOSE, &purposeParam);
325 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_PURPOSE_FAIL,
326 "get param get 0x%" LOG_PUBLIC "x failed", HKS_TAG_PURPOSE)
327
328 if (((purposeParam->uint32Param & HKS_KEY_PURPOSE_DERIVE) != 0) ||
329 ((purposeParam->uint32Param & HKS_KEY_PURPOSE_MAC) != 0)) {
330 return CheckGenKeyMacDeriveParams(alg, purposeParam->uint32Param, paramSet, params);
331 }
332
333 return CheckGenKeyParamsByAlg(alg, paramSet, params);
334 }
335
CheckImportKeySize(uint32_t alg,const struct ParamsValues * params,const struct HksBlob * key)336 static int32_t CheckImportKeySize(uint32_t alg, const struct ParamsValues *params, const struct HksBlob *key)
337 {
338 int32_t ret = HKS_SUCCESS;
339 switch (alg) {
340 case HKS_ALG_ED25519:
341 case HKS_ALG_X25519:
342 case HKS_ALG_RSA:
343 case HKS_ALG_ECC:
344 case HKS_ALG_SM2:
345 case HKS_ALG_DH: {
346 if (key->size < sizeof(struct HksPubKeyInfo)) {
347 ret = HKS_ERROR_INVALID_KEY_INFO;
348 break;
349 }
350 struct HksPubKeyInfo *keyMaterial = (struct HksPubKeyInfo *)(key->data);
351 if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
352 ret = HKS_ERROR_INVALID_KEY_INFO;
353 }
354 break;
355 }
356 #ifdef HKS_SUPPORT_DSA_C
357 case HKS_ALG_DSA:
358 break;
359 #endif
360 default:
361 return HKS_ERROR_INVALID_ALGORITHM;
362 }
363 return ret;
364 }
365
CheckAndGetWrappedKeyUnwrapAlgSuite(const struct HksParamSet * paramSet,uint32_t * algSuite)366 static int32_t CheckAndGetWrappedKeyUnwrapAlgSuite(const struct HksParamSet *paramSet, uint32_t *algSuite)
367 {
368 struct HksParam *algorithmSuite = NULL;
369 int32_t ret = HksGetParam(paramSet, HKS_TAG_UNWRAP_ALGORITHM_SUITE, &algorithmSuite);
370 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_ALG_FAIL, "get unwrap algorithm suite fail")
371
372 ret = HksCheckValue(algorithmSuite->uint32Param, g_unwrapSuite, HKS_ARRAY_SIZE(g_unwrapSuite));
373 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_ALGORITHM,
374 "unwrap algorithm suite value %" LOG_PUBLIC "u not expected", algorithmSuite->uint32Param)
375
376 *algSuite = algorithmSuite->uint32Param;
377 return HKS_SUCCESS;
378 }
379
380 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
CheckSignVerifyParamsByAlg(uint32_t cmdId,uint32_t alg,const struct ParamsValues * inputParams)381 static int32_t CheckSignVerifyParamsByAlg(uint32_t cmdId, uint32_t alg, const struct ParamsValues *inputParams)
382 {
383 int32_t ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_USE_KEY, inputParams);
384 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check sign or verify fixed params failed, ret = %" LOG_PUBLIC "d", ret)
385
386 ret = HksCheckSignVerifyMutableParams(cmdId, alg, inputParams);
387 HKS_IF_NOT_SUCC_LOGE(ret, "check sign or verify mutable params failed, ret = %" LOG_PUBLIC "d", ret)
388
389 return ret;
390 }
391 #endif
392 #endif /* _CUT_AUTHENTICATE_ */
393
CheckCipherParamsByAlg(uint32_t cmdId,uint32_t alg,const struct HksParamSet * paramSet,const struct ParamsValues * inputParams)394 static int32_t CheckCipherParamsByAlg(
395 uint32_t cmdId, uint32_t alg, const struct HksParamSet *paramSet, const struct ParamsValues *inputParams)
396 {
397 int32_t ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_USE_KEY, inputParams);
398 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher check fixed params failed, ret = %" LOG_PUBLIC "d", ret)
399
400 ret = HksCheckCipherMutableParams(cmdId, alg, inputParams);
401 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher check mutable params failed, ret = %" LOG_PUBLIC "d", ret)
402
403 ret = HksCheckCipherMaterialParams(alg, inputParams, paramSet);
404 HKS_IF_NOT_SUCC_LOGE(ret, "cipher check material params failed, ret = %" LOG_PUBLIC "d", ret)
405
406 return ret;
407 }
408
409 #ifndef _CUT_AUTHENTICATE_
410 #ifdef HKS_SUPPORT_KDF_PBKDF2
CheckPbkdf2DeriveKeyParams(const struct HksParamSet * paramSet)411 static int32_t CheckPbkdf2DeriveKeyParams(const struct HksParamSet *paramSet)
412 {
413 struct HksParam *iterationParam = NULL;
414 int32_t ret = HksGetParam(paramSet, HKS_TAG_ITERATION, &iterationParam);
415 HKS_IF_NOT_SUCC_RETURN(ret, HKS_ERROR_CHECK_GET_ITERATION_FAIL)
416
417 if (iterationParam->uint32Param < HKS_DEFAULT_PBKDF2_ITERATION) {
418 return HKS_ERROR_INVALID_ITERATION;
419 }
420
421 struct HksParam *saltParam = NULL;
422 ret = HksGetParam(paramSet, HKS_TAG_SALT, &saltParam);
423 HKS_IF_NOT_SUCC_RETURN(ret, HKS_ERROR_CHECK_GET_SALT_FAIL)
424
425 if ((CheckBlob(&saltParam->blob) != HKS_SUCCESS) || (saltParam->blob.size < HKS_DEFAULT_PBKDF2_SALT_SIZE)) {
426 return HKS_ERROR_INVALID_SALT;
427 }
428
429 return HKS_SUCCESS;
430 }
431 #endif
432
HksCoreCheckGenKeyParams(const struct HksBlob * keyAlias,const struct HksParamSet * paramSet,const struct HksBlob * keyIn,const struct HksBlob * keyOut)433 int32_t HksCoreCheckGenKeyParams(const struct HksBlob *keyAlias, const struct HksParamSet *paramSet,
434 const struct HksBlob *keyIn, const struct HksBlob *keyOut)
435 {
436 (void)keyAlias;
437 (void)keyIn;
438 (void)keyOut;
439 struct ParamsValues params;
440 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
441 return CoreCheckGenKeyParams(paramSet, ¶ms);
442 }
443
CheckRsaKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)444 static int32_t CheckRsaKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
445 const struct HksBlob *key)
446 {
447 (void)keyType;
448 if (key->size < sizeof(struct HksKeyMaterialRsa)) {
449 HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
450 return HKS_ERROR_INVALID_KEY_INFO;
451 }
452
453 struct HksKeyMaterialRsa *keyMaterial = (struct HksKeyMaterialRsa *)(key->data);
454 if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
455 HKS_LOG_E("invalid import key material");
456 return HKS_ERROR_INVALID_KEY_INFO;
457 }
458
459 if ((keyMaterial->nSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->nSize == 0) ||
460 (keyMaterial->dSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->dSize == 0) ||
461 (keyMaterial->eSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->eSize == 0)) {
462 HKS_LOG_E("invalid import key material n/d/e size");
463 return HKS_ERROR_INVALID_KEY_INFO;
464 }
465
466 uint32_t keySize = sizeof(struct HksKeyMaterialRsa) + keyMaterial->nSize + keyMaterial->dSize + keyMaterial->eSize;
467 if (key->size < keySize) {
468 HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
469 return HKS_ERROR_INVALID_KEY_INFO;
470 }
471
472 return HKS_SUCCESS;
473 }
474
CheckEccKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)475 static int32_t CheckEccKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
476 const struct HksBlob *key)
477 {
478 if (key->size < sizeof(struct HksKeyMaterialEcc)) {
479 HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
480 return HKS_ERROR_INVALID_KEY_INFO;
481 }
482
483 struct HksKeyMaterialEcc *keyMaterial = (struct HksKeyMaterialEcc *)(key->data);
484 if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
485 HKS_LOG_E("invalid import key material");
486 return HKS_ERROR_INVALID_KEY_INFO;
487 }
488
489 if ((keyMaterial->xSize > HKS_ECC_KEY_SIZE_521) || (keyMaterial->ySize > HKS_ECC_KEY_SIZE_521) ||
490 (keyMaterial->zSize > HKS_ECC_KEY_SIZE_521)) {
491 HKS_LOG_E("invalid import key material x/y/z size, bigger than 521");
492 return HKS_ERROR_INVALID_KEY_INFO;
493 }
494
495 if (keyMaterial->zSize == 0) {
496 HKS_LOG_E("invalid import key material z size: 0");
497 return HKS_ERROR_INVALID_KEY_INFO;
498 }
499 if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && ((keyMaterial->xSize == 0) || (keyMaterial->ySize == 0))) {
500 HKS_LOG_E("invalid import key material x/y size: 0");
501 return HKS_ERROR_INVALID_KEY_INFO;
502 }
503
504 uint32_t keySize = sizeof(struct HksKeyMaterialEcc) + keyMaterial->xSize + keyMaterial->ySize + keyMaterial->zSize;
505 if (key->size < keySize) {
506 HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
507 return HKS_ERROR_INVALID_KEY_INFO;
508 }
509
510 return HKS_SUCCESS;
511 }
512
CheckDsaKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)513 static int32_t CheckDsaKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
514 const struct HksBlob *key)
515 {
516 if (key->size < sizeof(struct HksKeyMaterialDsa)) {
517 HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
518 return HKS_ERROR_INVALID_KEY_INFO;
519 }
520
521 struct HksKeyMaterialDsa *keyMaterial = (struct HksKeyMaterialDsa *)(key->data);
522 if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
523 HKS_LOG_E("invalid import key material");
524 return HKS_ERROR_INVALID_KEY_INFO;
525 }
526
527 if ((keyMaterial->xSize > MAX_KEY_SIZE) || (keyMaterial->ySize > MAX_KEY_SIZE) ||
528 (keyMaterial->pSize > MAX_KEY_SIZE) || (keyMaterial->qSize > MAX_KEY_SIZE) ||
529 (keyMaterial->gSize > MAX_KEY_SIZE)) {
530 HKS_LOG_E("invalid import key material x/y/p/q/g size, bigger than 2048");
531 return HKS_ERROR_INVALID_KEY_INFO;
532 }
533
534 if ((keyMaterial->xSize == 0) ||
535 (keyMaterial->pSize == 0) || (keyMaterial->qSize == 0) || (keyMaterial->gSize == 0)) {
536 HKS_LOG_E("invalid import key material x/p/q/g size: 0");
537 return HKS_ERROR_INVALID_KEY_INFO;
538 }
539
540 if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->ySize == 0)) {
541 HKS_LOG_E("invalid import key material y size: 0");
542 return HKS_ERROR_INVALID_KEY_INFO;
543 }
544
545 uint32_t keySize = sizeof(struct HksKeyMaterialDsa) + keyMaterial->xSize + keyMaterial->ySize +
546 keyMaterial->pSize + keyMaterial->qSize + keyMaterial->gSize;
547 if (key->size < keySize) {
548 HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
549 return HKS_ERROR_INVALID_KEY_INFO;
550 }
551
552 return HKS_SUCCESS;
553 }
554
CheckCurve25519KeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)555 static int32_t CheckCurve25519KeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
556 const struct HksBlob *key)
557 {
558 if (key->size < sizeof(struct HksKeyMaterial25519)) {
559 HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
560 return HKS_ERROR_INVALID_KEY_INFO;
561 }
562
563 struct HksKeyMaterial25519 *keyMaterial = (struct HksKeyMaterial25519 *)(key->data);
564 if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
565 HKS_LOG_E("invalid import key material");
566 return HKS_ERROR_INVALID_KEY_INFO;
567 }
568
569 if ((keyMaterial->pubKeySize > HKS_CURVE25519_KEY_SIZE_256) ||
570 (keyMaterial->priKeySize > HKS_CURVE25519_KEY_SIZE_256)) {
571 HKS_LOG_E("invalid import key material pubKey/priKey size, bigger than 256");
572 return HKS_ERROR_INVALID_KEY_INFO;
573 }
574
575 if (keyMaterial->priKeySize == 0) {
576 HKS_LOG_E("invalid import key material priKey size: 0");
577 return HKS_ERROR_INVALID_KEY_INFO;
578 }
579
580 if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->pubKeySize == 0)) {
581 HKS_LOG_E("invalid import key material pubKey size: 0");
582 return HKS_ERROR_INVALID_KEY_INFO;
583 }
584
585 uint32_t keySize = sizeof(struct HksKeyMaterial25519) + keyMaterial->pubKeySize + keyMaterial->priKeySize;
586 if (key->size < keySize) {
587 HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
588 return HKS_ERROR_INVALID_KEY_INFO;
589 }
590
591 return HKS_SUCCESS;
592 }
593
CheckDHKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)594 static int32_t CheckDHKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
595 const struct HksBlob *key)
596 {
597 if (key->size < sizeof(struct HksKeyMaterialDh)) {
598 HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
599 return HKS_ERROR_INVALID_KEY_INFO;
600 }
601
602 struct HksKeyMaterialDh *keyMaterial = (struct HksKeyMaterialDh *)(key->data);
603 if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
604 HKS_LOG_E("invalid import key material");
605 return HKS_ERROR_INVALID_KEY_INFO;
606 }
607
608 if ((keyMaterial->pubKeySize > HKS_DH_KEY_SIZE_4096) || (keyMaterial->priKeySize > HKS_DH_KEY_SIZE_4096)) {
609 HKS_LOG_E("invalid import key material pubKey/priKey size, bigger than 4096");
610 return HKS_ERROR_INVALID_KEY_INFO;
611 }
612
613 if (keyMaterial->priKeySize == 0) {
614 HKS_LOG_E("invalid import key material priKey size: 0");
615 return HKS_ERROR_INVALID_KEY_INFO;
616 }
617
618 if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->pubKeySize == 0)) {
619 HKS_LOG_E("invalid import key material pubKey size: 0");
620 return HKS_ERROR_INVALID_KEY_INFO;
621 }
622
623 uint32_t keySize = sizeof(struct HksKeyMaterialDh) + keyMaterial->pubKeySize + keyMaterial->priKeySize;
624 if (key->size < keySize) {
625 HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
626 return HKS_ERROR_INVALID_KEY_INFO;
627 }
628
629 return HKS_SUCCESS;
630 }
631
CheckKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)632 static int32_t CheckKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
633 const struct HksBlob *key)
634 {
635 switch (alg) {
636 case HKS_ALG_RSA:
637 return CheckRsaKeyLen(alg, keyType, params, key);
638 case HKS_ALG_ECC:
639 case HKS_ALG_SM2:
640 return CheckEccKeyLen(alg, keyType, params, key);
641 case HKS_ALG_DSA:
642 return CheckDsaKeyLen(alg, keyType, params, key);
643 case HKS_ALG_X25519:
644 case HKS_ALG_ED25519:
645 return CheckCurve25519KeyLen(alg, keyType, params, key);
646 case HKS_ALG_DH:
647 return CheckDHKeyLen(alg, keyType, params, key);
648 default:
649 return HKS_ERROR_INVALID_ALGORITHM;
650 }
651 }
652
CheckMutableParams(uint32_t alg,uint32_t keyType,const struct ParamsValues * params)653 static int32_t CheckMutableParams(uint32_t alg, uint32_t keyType, const struct ParamsValues *params)
654 {
655 if (keyType == HKS_KEY_TYPE_KEY_PAIR) {
656 return HKS_SUCCESS;
657 }
658
659 switch (alg) {
660 case HKS_ALG_RSA:
661 if ((params->purpose.value != HKS_KEY_PURPOSE_SIGN) &&
662 (params->purpose.value != HKS_KEY_PURPOSE_DECRYPT)) {
663 HKS_LOG_E("Import rsa private key check purpose failed.");
664 return HKS_ERROR_INVALID_PURPOSE;
665 }
666 return HKS_SUCCESS;
667 case HKS_ALG_ECC:
668 if ((params->purpose.value != HKS_KEY_PURPOSE_SIGN) && (params->purpose.value != HKS_KEY_PURPOSE_AGREE) &&
669 (params->purpose.value != HKS_KEY_PURPOSE_UNWRAP)) {
670 HKS_LOG_E("Import ecc private key check purpose failed.");
671 return HKS_ERROR_INVALID_PURPOSE;
672 }
673 return HKS_SUCCESS;
674 case HKS_ALG_SM2:
675 case HKS_ALG_DSA:
676 case HKS_ALG_ED25519:
677 if (params->purpose.value != HKS_KEY_PURPOSE_SIGN) {
678 HKS_LOG_E("Import sm2 or dsa or ed25519 private key check purpose failed.");
679 return HKS_ERROR_INVALID_PURPOSE;
680 }
681 return HKS_SUCCESS;
682 case HKS_ALG_X25519:
683 case HKS_ALG_DH:
684 return HKS_SUCCESS;
685 default:
686 return HKS_ERROR_INVALID_ALGORITHM;
687 }
688 }
689
CheckImportKey(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)690 static int32_t CheckImportKey(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
691 const struct HksBlob *key)
692 {
693 int32_t ret = CheckKeyLen(alg, keyType, params, key);
694 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check key len failed, ret = %" LOG_PUBLIC "d", ret)
695
696 ret = CheckMutableParams(alg, keyType, params);
697 HKS_IF_NOT_SUCC_LOGE(ret, "check mutable params faile, ret = %" LOG_PUBLIC "d", ret)
698 return ret;
699 }
700
CheckImportSymmetricKeySize(const struct ParamsValues * params,const struct HksBlob * key)701 static int32_t CheckImportSymmetricKeySize(const struct ParamsValues *params, const struct HksBlob *key)
702 {
703 if (key->size != HKS_KEY_BYTES(params->keyLen.value)) {
704 return HKS_ERROR_INVALID_KEY_INFO;
705 }
706 return HKS_SUCCESS;
707 }
708
HksCoreCheckImportKeyParams(const struct HksBlob * keyAlias,const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * keyOut)709 int32_t HksCoreCheckImportKeyParams(const struct HksBlob *keyAlias, const struct HksBlob *key,
710 const struct HksParamSet *paramSet, const struct HksBlob *keyOut)
711 {
712 (void)keyAlias;
713 (void)keyOut;
714 /* import key paramset is subset of generate key paramset */
715 struct ParamsValues params;
716 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
717 int32_t ret = CoreCheckGenKeyParams(paramSet, ¶ms);
718 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "CheckImportKeyParams failed")
719
720 uint32_t alg;
721 ret = CheckAndGetAlgorithm(paramSet, g_importKeyAlg, HKS_ARRAY_SIZE(g_importKeyAlg), &alg);
722 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "import key check and get alg failed")
723
724 if ((alg == HKS_ALG_AES) || (alg == HKS_ALG_SM3) || (alg == HKS_ALG_SM4) || (alg == HKS_ALG_HMAC)) {
725 return CheckImportSymmetricKeySize(¶ms, key);
726 }
727
728 struct HksParam *importKeyTypeParam = NULL;
729 ret = HksGetParam(paramSet, HKS_TAG_IMPORT_KEY_TYPE, &importKeyTypeParam);
730 if ((ret == HKS_SUCCESS) &&
731 ((importKeyTypeParam->uint32Param == HKS_KEY_TYPE_PRIVATE_KEY) ||
732 (importKeyTypeParam->uint32Param == HKS_KEY_TYPE_KEY_PAIR))) {
733 /* check private key or keypair key params */
734 return CheckImportKey(alg, importKeyTypeParam->uint32Param, ¶ms, key);
735 }
736
737 /* check public key params: 1. check keySize */
738 ret = CheckImportKeySize(alg, ¶ms, key);
739 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "import key check key size invalid")
740
741 /* check public key params: 2. check mutable params */
742 return CheckImportMutableParams(alg, ¶ms);
743 }
744
HksCoreCheckImportWrappedKeyParams(const struct HksBlob * key,const struct HksBlob * wrappedKeyData,const struct HksParamSet * paramSet,struct HksBlob * keyOut,uint32_t * outUnwrapSuite)745 int32_t HksCoreCheckImportWrappedKeyParams(const struct HksBlob *key, const struct HksBlob *wrappedKeyData,
746 const struct HksParamSet *paramSet, struct HksBlob *keyOut, uint32_t *outUnwrapSuite)
747 {
748 (void)key;
749 (void)keyOut;
750
751 /* first check wrapping-related params and wrapped key data */
752 uint32_t unwrapSuite = 0;
753 int32_t ret = CheckAndGetWrappedKeyUnwrapAlgSuite(paramSet, &unwrapSuite);
754 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check import wrapped params set failed")
755
756 ret = HksCheckWrappedDataFormatValidity(wrappedKeyData, HKS_IMPORT_WRAPPED_KEY_TOTAL_BLOBS, NULL);
757 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check import wrapped key data format failed")
758
759 /* then check the origin key paramset which is the same as import key */
760 struct ParamsValues params;
761 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
762 ret = CoreCheckGenKeyParams(paramSet, ¶ms);
763 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check origin key param set failed")
764
765 uint32_t alg;
766 ret = CheckAndGetAlgorithm(paramSet, g_importKeyAlg, HKS_ARRAY_SIZE(g_importKeyAlg), &alg);
767 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "CheckImportKeyParams get alg failed")
768 *outUnwrapSuite = unwrapSuite;
769 return HKS_SUCCESS;
770 }
771
HksCoreCheckSignVerifyParams(uint32_t cmdId,const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * srcData,const struct HksBlob * signature)772 int32_t HksCoreCheckSignVerifyParams(uint32_t cmdId, const struct HksBlob *key, const struct HksParamSet *paramSet,
773 const struct HksBlob *srcData, const struct HksBlob *signature)
774 {
775 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
776 (void)srcData;
777 uint32_t alg;
778 int32_t ret = CheckAndGetAlgorithm(paramSet, g_signAlg, HKS_ARRAY_SIZE(g_signAlg), &alg);
779 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check and get alg failed")
780
781 struct ParamsValues params;
782 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
783
784 ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, ¶ms);
785 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify get input params failed, ret = %" LOG_PUBLIC "d", ret)
786
787 ret = CheckSignVerifyParamsByAlg(cmdId, alg, ¶ms);
788 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify check params failed, ret = %" LOG_PUBLIC "d", ret)
789
790 uint32_t keySize = 0;
791 ret = HksGetKeySize(alg, key, &keySize);
792 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get keySize failed!")
793
794 ret = HksCheckSignature(cmdId, alg, keySize, signature);
795 HKS_IF_NOT_SUCC_LOGE(ret, "check signature failed, ret = %" LOG_PUBLIC "d", ret)
796
797 return ret;
798 #else
799 (void)cmdId;
800 (void)key;
801 (void)paramSet;
802 (void)srcData;
803 (void)signature;
804 return HKS_ERROR_NOT_SUPPORTED;
805 #endif
806 }
807
HksLocalCheckSignVerifyParams(uint32_t cmdId,uint32_t keySize,const struct HksParamSet * paramSet,const struct HksBlob * srcData,const struct HksBlob * signature)808 int32_t HksLocalCheckSignVerifyParams(uint32_t cmdId, uint32_t keySize, const struct HksParamSet *paramSet,
809 const struct HksBlob *srcData, const struct HksBlob *signature)
810 {
811 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
812 (void)srcData;
813 uint32_t alg;
814 int32_t ret = CheckAndGetAlgorithm(paramSet, g_signAlg, HKS_ARRAY_SIZE(g_signAlg), &alg);
815 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check and get alg failed")
816
817 struct ParamsValues params;
818 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
819
820 ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, ¶ms);
821 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify get input params failed, ret = %" LOG_PUBLIC "d", ret)
822
823 ret = CheckSignVerifyParamsByAlg(cmdId, alg, ¶ms);
824 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify check params failed, ret = %" LOG_PUBLIC "d", ret)
825
826 ret = HksCheckSignature(cmdId, alg, keySize, signature);
827 HKS_IF_NOT_SUCC_LOGE(ret, "check signature failed, ret = %" LOG_PUBLIC "d", ret)
828
829 return ret;
830 #else
831 (void)cmdId;
832 (void)keySize;
833 (void)paramSet;
834 (void)srcData;
835 (void)signature;
836 return HKS_ERROR_NOT_SUPPORTED;
837 #endif
838 }
839
HksCoreCheckAgreeKeyParams(const struct HksParamSet * paramSet,const struct HksBlob * privateKey,const struct HksBlob * peerPublicKey,const struct HksBlob * agreedKey,bool isLocalCheck)840 int32_t HksCoreCheckAgreeKeyParams(const struct HksParamSet *paramSet, const struct HksBlob *privateKey,
841 const struct HksBlob *peerPublicKey, const struct HksBlob *agreedKey, bool isLocalCheck)
842 {
843 uint32_t alg;
844 int32_t ret;
845
846 if (isLocalCheck) {
847 ret = CheckAndGetAlgorithm(paramSet, g_agreeAlgLocal, HKS_ARRAY_SIZE(g_agreeAlgLocal), &alg);
848 } else {
849 ret = CheckAndGetAlgorithm(paramSet, g_agreeAlg, HKS_ARRAY_SIZE(g_agreeAlg), &alg);
850 }
851 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
852
853 uint32_t keySize = 0;
854 if (isLocalCheck) {
855 if (alg == HKS_ALG_ED25519) {
856 if ((privateKey->size != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256)) ||
857 (peerPublicKey->size != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256))) {
858 return HKS_ERROR_INVALID_KEY_SIZE;
859 }
860 }
861
862 if (alg == HKS_ALG_DH || alg == HKS_ALG_ECC || alg == HKS_ALG_ECDH) {
863 if (privateKey->size < sizeof(struct HksKeyMaterialHeader)) {
864 return HKS_ERROR_INVALID_ARGUMENT;
865 }
866 keySize = ((struct HksKeyMaterialHeader *)privateKey->data)->keySize;
867 } else if (alg == HKS_ALG_ED25519) {
868 keySize = privateKey->size * HKS_BITS_PER_BYTE;
869 }
870 } else {
871 ret = HksGetKeySize(alg, privateKey, &keySize);
872 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get key size failed")
873 }
874
875 uint32_t size = keySize / HKS_BITS_PER_BYTE + keySize % HKS_BITS_PER_BYTE;
876 if (agreedKey->size < size) {
877 HKS_LOG_E("agreeKey buffer too small, size %" LOG_PUBLIC "u", agreedKey->size);
878 return HKS_ERROR_BUFFER_TOO_SMALL;
879 }
880
881 return HKS_SUCCESS;
882 }
883
HksCoreCheckCipherParams(uint32_t cmdId,const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * inData,const struct HksBlob * outData)884 int32_t HksCoreCheckCipherParams(uint32_t cmdId, const struct HksBlob *key, const struct HksParamSet *paramSet,
885 const struct HksBlob *inData, const struct HksBlob *outData)
886 {
887 uint32_t alg;
888 int32_t ret = CheckAndGetAlgorithm(paramSet, g_cipherAlg, HKS_ARRAY_SIZE(g_cipherAlg), &alg);
889 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
890
891 struct ParamsValues params;
892 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
893
894 ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, ¶ms);
895 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher get input params failed, ret = %" LOG_PUBLIC "d", ret)
896
897 if ((alg == HKS_ALG_RSA) || (alg == HKS_ALG_SM4)) {
898 ret = HksGetKeySize(alg, key, ¶ms.keyLen.value);
899 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "rsa cipher get key size failed")
900 }
901
902 ret = CheckCipherParamsByAlg(cmdId, alg, paramSet, ¶ms);
903 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher check params failed, ret = %" LOG_PUBLIC "d", ret)
904
905 ret = HksCheckCihperData(cmdId, alg, ¶ms, inData, outData);
906 HKS_IF_NOT_SUCC_LOGE(ret, "cipher check input or output data failed, ret = %" LOG_PUBLIC "d", ret)
907
908 return ret;
909 }
910 #endif /* _CUT_AUTHENTICATE_ */
911
HksLocalCheckCipherParams(uint32_t cmdId,uint32_t keySize,const struct HksParamSet * paramSet,const struct HksBlob * inData,const struct HksBlob * outData)912 int32_t HksLocalCheckCipherParams(uint32_t cmdId, uint32_t keySize, const struct HksParamSet *paramSet,
913 const struct HksBlob *inData, const struct HksBlob *outData)
914 {
915 uint32_t alg;
916 int32_t ret = CheckAndGetAlgorithm(paramSet, g_cipherAlgLocal, HKS_ARRAY_SIZE(g_cipherAlgLocal), &alg);
917 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
918
919 if (alg == HKS_ALG_AES) {
920 #ifdef HKS_SUPPORT_AES_C
921 ret = HksCheckValue(keySize, g_aesKeySizeLocal, HKS_ARRAY_SIZE(g_aesKeySizeLocal));
922 #else
923 ret = HKS_ERROR_NOT_SUPPORTED;
924 #endif
925 } else if (alg == HKS_ALG_RSA) {
926 #ifdef HKS_SUPPORT_RSA_C
927 ret = HksCheckValue(keySize, g_rsaKeySizeLocal, HKS_ARRAY_SIZE(g_rsaKeySizeLocal));
928 #else
929 ret = HKS_ERROR_NOT_SUPPORTED;
930 #endif
931 }
932 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_KEY_SIZE,
933 "keySize value %" LOG_PUBLIC "u not expected", keySize)
934
935 struct ParamsValues params;
936 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
937
938 ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, ¶ms);
939 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "local cipher get input params failed, ret = %" LOG_PUBLIC "d", ret)
940
941 ret = CheckCipherParamsByAlg(cmdId, alg, paramSet, ¶ms);
942 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "local cipher check params failed, ret = %" LOG_PUBLIC "d", ret)
943
944 ret = HksCheckCihperData(cmdId, alg, ¶ms, inData, outData);
945 HKS_IF_NOT_SUCC_LOGE(ret, "local cipher check input or output data failed, ret = %" LOG_PUBLIC "d", ret)
946
947 return ret;
948 }
949
HksCoreCheckDeriveKeyParams(const struct HksParamSet * paramSet,const struct HksBlob * mainKey,const struct HksBlob * derivedKey,bool isLocalCheck)950 int32_t HksCoreCheckDeriveKeyParams(const struct HksParamSet *paramSet, const struct HksBlob *mainKey,
951 const struct HksBlob *derivedKey, bool isLocalCheck)
952 {
953 (void)mainKey;
954 (void)derivedKey;
955 uint32_t alg;
956 int32_t ret;
957 if (isLocalCheck) {
958 ret = CheckAndGetAlgorithm(paramSet, g_deriveAlgLocal, HKS_ARRAY_SIZE(g_deriveAlgLocal), &alg);
959 } else {
960 ret = CheckAndGetAlgorithm(paramSet, g_deriveAlg, HKS_ARRAY_SIZE(g_deriveAlg), &alg);
961 }
962 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
963
964 struct HksParam *purposeParam = NULL;
965 ret = HksGetParam(paramSet, HKS_TAG_PURPOSE, &purposeParam);
966 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_PURPOSE_FAIL,
967 "get param get 0x%" LOG_PUBLIC "x failed", HKS_TAG_PURPOSE)
968
969 if (purposeParam->uint32Param != HKS_KEY_PURPOSE_DERIVE) {
970 return HKS_ERROR_INVALID_PURPOSE;
971 }
972
973 /* according to RFC5869, HKDF no need check salt and info */
974 uint32_t digest;
975 ret = CheckAndGetDigest(paramSet, g_digest, HKS_ARRAY_SIZE(g_digest), &digest);
976 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check digest failed")
977
978 #ifdef HKS_SUPPORT_KDF_PBKDF2
979 if (alg == HKS_ALG_PBKDF2) {
980 return CheckPbkdf2DeriveKeyParams(paramSet);
981 }
982 #endif
983
984 return HKS_SUCCESS;
985 }
986
CheckMacPurpose(const struct HksParamSet * paramSet)987 static int32_t CheckMacPurpose(const struct HksParamSet *paramSet)
988 {
989 struct HksParam *purposeParam = NULL;
990 int32_t ret = HksGetParam(paramSet, HKS_TAG_PURPOSE, &purposeParam);
991 HKS_IF_NOT_SUCC_RETURN(ret, HKS_ERROR_CHECK_GET_PURPOSE_FAIL)
992
993 if (purposeParam->uint32Param != HKS_KEY_PURPOSE_MAC) {
994 return HKS_ERROR_INVALID_PURPOSE;
995 }
996
997 return HKS_SUCCESS;
998 }
999
CheckMacOutput(const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * mac,bool isLocalCheck)1000 static int32_t CheckMacOutput(
1001 const struct HksBlob *key, const struct HksParamSet *paramSet, const struct HksBlob *mac, bool isLocalCheck)
1002 {
1003 uint32_t digest;
1004 int32_t ret;
1005 if (isLocalCheck) {
1006 ret = CheckAndGetDigest(paramSet, g_digest, HKS_ARRAY_SIZE(g_digest), &digest);
1007 } else {
1008 ret = CheckAndGetDigest(paramSet, g_macDigest, HKS_ARRAY_SIZE(g_macDigest), &digest);
1009 }
1010 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check digest failed")
1011
1012 uint32_t digestLen;
1013 ret = HksGetDigestLen(digest, &digestLen);
1014 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get digest length failed, ret = %" LOG_PUBLIC "d", ret)
1015
1016 if (mac->size < digestLen) {
1017 HKS_LOG_E("mac buffer too small, size %" LOG_PUBLIC "u", mac->size);
1018 return HKS_ERROR_BUFFER_TOO_SMALL;
1019 }
1020
1021 if ((isLocalCheck) && (key->size < digestLen)) { /* the unit of local engine input key size is byte */
1022 HKS_LOG_E("key size too small, size = %" LOG_PUBLIC "u", key->size);
1023 return HKS_ERROR_INVALID_KEY_SIZE;
1024 }
1025
1026 return HKS_SUCCESS;
1027 }
1028
HksCoreCheckMacParams(const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * srcData,const struct HksBlob * mac,bool isLocalCheck)1029 int32_t HksCoreCheckMacParams(const struct HksBlob *key, const struct HksParamSet *paramSet,
1030 const struct HksBlob *srcData, const struct HksBlob *mac, bool isLocalCheck)
1031 {
1032 (void)srcData;
1033 int32_t ret = CheckMacPurpose(paramSet);
1034 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check Mac purpose failed")
1035
1036 return CheckMacOutput(key, paramSet, mac, isLocalCheck);
1037 }
1038