1 /* 2 * Copyright (c) 2021 Huawei Device Co., Ltd. 3 * Licensed under the Apache License, Version 2.0 (the "License"); 4 * you may not use this file except in compliance with the License. 5 * You may obtain a copy of the License at 6 * 7 * http://www.apache.org/licenses/LICENSE-2.0 8 * 9 * Unless required by applicable law or agreed to in writing, software 10 * distributed under the License is distributed on an "AS IS" BASIS, 11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 * See the License for the specific language governing permissions and 13 * limitations under the License. 14 */ 15 #ifndef STORAGE_DAEMON_CRYPTO_KEY_UTILS_H 16 #define STORAGE_DAEMON_CRYPTO_KEY_UTILS_H 17 18 #include <memory> 19 #include <string> 20 #include <vector> 21 #include <linux/keyctl.h> 22 #include <linux/version.h> 23 24 #include "hks_type.h" 25 #include "securec.h" 26 27 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0) 28 #include <linux/fscrypt.h> 29 #define SUPPORT_FSCRYPT_V2 30 #else 31 #include "libfscrypt/fscrypt_uapi.h" 32 #endif 33 34 namespace OHOS { 35 namespace StorageDaemon { 36 constexpr uint32_t CRYPTO_KEY_SECDISC_SIZE = 16384; 37 constexpr uint32_t CRYPTO_KEY_ALIAS_SIZE = 16; 38 constexpr uint32_t CRYPTO_AES_AAD_LEN = 16; 39 constexpr uint32_t CRYPTO_AES_NONCE_LEN = 64; 40 constexpr uint32_t CRYPTO_AES_256_XTS_KEY_SIZE = 64; 41 constexpr uint32_t CRYPTO_KEY_SHIELD_MAX_SIZE = 2048; 42 constexpr uint32_t CRYPTO_AES_256_KEY_ENCRYPTED_SIZE = 80; 43 constexpr uint32_t CRYPTO_TOKEN_SIZE = TOKEN_CHALLENGE_LEN; // 32 44 45 using key_serial_t = int; 46 constexpr uint32_t CRYPTO_KEY_DESC_SIZE = FSCRYPT_KEY_DESCRIPTOR_SIZE; 47 static const std::string MNT_DATA = "/data"; 48 static const std::string PATH_LATEST = "/latest"; 49 static const std::string PATH_SHIELD = "/shield"; 50 static const std::string PATH_SECDISC = "/sec_discard"; 51 static const std::string PATH_ENCRYPTED = "/encrypted"; 52 static const std::string PATH_KEYID = "/key_id"; 53 static const std::string PATH_KEYDESC = "/key_desc"; 54 55 const std::string DATA_EL0_DIR = std::string() + "/data/service/el0"; 56 const std::string STORAGE_DAEMON_DIR = DATA_EL0_DIR + "/storage_daemon"; 57 const std::string DEVICE_EL1_DIR = STORAGE_DAEMON_DIR + "/sd"; 58 59 class KeyBlob { 60 public: 61 KeyBlob() = default; ~KeyBlob()62 ~KeyBlob() 63 { 64 Clear(); 65 } KeyBlob(uint32_t len)66 KeyBlob(uint32_t len) 67 { 68 Alloc(len); 69 // may fail, need check IsEmpty() if needed 70 } KeyBlob(KeyBlob && right)71 KeyBlob(KeyBlob &&right) 72 { 73 data = std::move(right.data); 74 size = right.size; 75 } KeyBlob(const std::vector<uint8_t> & vec)76 KeyBlob(const std::vector<uint8_t> &vec) 77 { 78 if (Alloc(vec.size())) { 79 auto ret = memcpy_s(data.get(), size, vec.data(), vec.size()); 80 if (ret != EOK) { 81 Clear(); 82 } 83 } 84 } 85 KeyBlob& operator=(KeyBlob &&right) 86 { 87 data = std::move(right.data); 88 size = right.size; 89 return *this; 90 } Alloc(uint32_t len)91 bool Alloc(uint32_t len) 92 { 93 if (len > CRYPTO_KEY_SECDISC_SIZE) { 94 return false; 95 } 96 if (!IsEmpty()) { 97 Clear(); 98 } 99 100 data = std::make_unique<uint8_t[]>(len); 101 size = len; 102 (void)memset_s(data.get(), size, 0, size); 103 return true; 104 } Clear()105 void Clear() 106 { 107 if (data != nullptr && size != 0) { 108 (void)memset_s(data.get(), size, 0, size); 109 } 110 size = 0; 111 data.reset(nullptr); 112 } IsEmpty()113 bool IsEmpty() const 114 { 115 return size == 0 || data.get() == nullptr; 116 } ToString()117 std::string ToString() const 118 { 119 std::string hex; 120 const char *hexMap = "0123456789abcdef"; 121 static_assert(sizeof(data[0]) == sizeof(char)); 122 for (size_t i = 0; i < size; i++) { 123 hex = hex + hexMap[(data[i] & 0xF0) >> 4] + hexMap[data[i] & 0x0F]; // higher 4 bits 124 } 125 return hex; 126 } ToHksBlob()127 HksBlob ToHksBlob() const 128 { 129 return {size, data.get()}; 130 } 131 uint32_t size { 0 }; 132 std::unique_ptr<uint8_t[]> data { nullptr }; 133 }; 134 135 struct KeyInfo { 136 uint8_t version { 0 }; 137 KeyBlob key; 138 // the legacy interface use key_spec.u.descriptor 139 KeyBlob keyDesc; 140 // the v2 interface use the key_spec.u.identifier 141 KeyBlob keyId; 142 }; 143 144 struct KeyContext { 145 // secure discardable keyblob 146 KeyBlob secDiscard; 147 // encrypted huks key for encrypt/decrypt 148 KeyBlob shield; 149 // encrypted blob of rawkey 150 KeyBlob encrypted; 151 // aes_gcm tags 152 KeyBlob nonce; 153 KeyBlob aad; 154 }; 155 156 struct UserAuth { 157 // when secure access enabled, token is needed to authenticate the user 158 KeyBlob token; 159 KeyBlob secret; 160 }; 161 } // namespace StorageDaemon 162 } // namespace OHOS 163 164 #endif // STORAGE_DAEMON_CRYPTO_KEY_UTILS_H 165