1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #ifdef HKS_CONFIG_FILE
17 #include HKS_CONFIG_FILE
18 #else
19 #include "hks_config.h"
20 #endif
21
22 #include "hks_core_service_key_generate.h"
23
24 #include <stdbool.h>
25 #include <stddef.h>
26
27 #include "hks_ability.h"
28 #include "dcm_attest.h"
29 #include "hks_auth.h"
30 #include "hks_base_check.h"
31 #include "hks_check_paramset.h"
32 #include "hks_client_service_adapter_common.h"
33 #include "hks_cmd_id.h"
34 #include "hks_common_check.h"
35 #include "hks_core_service_three_stage.h"
36 #include "hks_crypto_adapter.h"
37 #include "hks_crypto_hal.h"
38 #include "hks_log.h"
39 #include "hks_mem.h"
40 #include "hks_param.h"
41 #include "hks_secure_access.h"
42 #include "hks_sm_import_wrap_key.h"
43 #include "hks_template.h"
44 #include "hks_type_inner.h"
45 #include "hks_util.h"
46 #include "hks_core_service_key_operate_one_stage.h"
47
48 #include "securec.h"
49
50 #ifndef _HARDWARE_ROOT_KEY_
51 #include "hks_rkc.h"
52 #endif
53
54 #ifndef _CUT_AUTHENTICATE_
55
56 static const uint8_t g_defaultRsaPubExponent[] = { 0x01, 0x00, 0x01 }; /* default 65537 */
57
GetGenType(const struct HksParamSet * paramSet,uint32_t * genType)58 static int32_t GetGenType(const struct HksParamSet *paramSet, uint32_t *genType)
59 {
60 struct HksParam *keyGenTypeParam = NULL;
61 int32_t ret = HksGetParam(paramSet, HKS_TAG_KEY_GENERATE_TYPE, &keyGenTypeParam);
62 /* if not set KEY_GENERATE_TYPE, gen key by default type */
63 HKS_IF_NOT_SUCC_RETURN(ret, HKS_SUCCESS)
64
65 struct HksParam *keyAlgParam = NULL;
66 ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &keyAlgParam);
67 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_ALG_FAIL, "get alg tag fail")
68
69 ret = HKS_ERROR_INVALID_ARGUMENT;
70 switch (keyGenTypeParam->uint32Param) {
71 case HKS_KEY_GENERATE_TYPE_DEFAULT:
72 *genType = HKS_KEY_GENERATE_TYPE_DEFAULT;
73 ret = HKS_SUCCESS;
74 break;
75 case HKS_KEY_GENERATE_TYPE_AGREE:
76 if (keyAlgParam->uint32Param == HKS_ALG_AES) { /* only aes key can be generated by agree */
77 *genType = HKS_KEY_GENERATE_TYPE_AGREE;
78 ret = HKS_SUCCESS;
79 } else {
80 *genType = HKS_KEY_GENERATE_TYPE_DEFAULT;
81 ret = HKS_SUCCESS;
82 }
83 break;
84 default:
85 HKS_LOG_E("invalid generated key type");
86 }
87
88 return ret;
89 }
90
91 #ifdef HKS_SUPPORT_ED25519_TO_X25519
CheckAgreeKeyIn(const struct HksBlob * key)92 static int32_t CheckAgreeKeyIn(const struct HksBlob *key)
93 {
94 HKS_IF_NOT_SUCC_RETURN(CheckBlob(key), HKS_ERROR_INVALID_ARGUMENT)
95
96 if (key->size < sizeof(struct Hks25519KeyPair)) {
97 HKS_LOG_E("invlaid agree key size");
98 return HKS_ERROR_INVALID_ARGUMENT;
99 }
100
101 struct Hks25519KeyPair *keyPair = (struct Hks25519KeyPair *)(key->data);
102 if ((keyPair->privateBufferSize > (key->size - sizeof(*keyPair))) ||
103 (keyPair->publicBufferSize > (key->size - sizeof(*keyPair) - keyPair->privateBufferSize))) {
104 HKS_LOG_E("invlaid agree key size, small than keyPair");
105 return HKS_ERROR_INVALID_ARGUMENT;
106 }
107 return HKS_SUCCESS;
108 }
109
GetAgreeBaseKey(const bool isPubKey,const bool isPlainPubKey,const struct HksBlob * keyIn,struct HksBlob * keyOut)110 static int32_t GetAgreeBaseKey(const bool isPubKey, const bool isPlainPubKey, const struct HksBlob *keyIn,
111 struct HksBlob *keyOut)
112 {
113 struct Hks25519KeyPair *keyPair = (struct Hks25519KeyPair *)(keyIn->data);
114 uint32_t size = isPubKey ? keyPair->publicBufferSize : keyPair->privateBufferSize;
115 uint8_t *buffer = (uint8_t *)HksMalloc(size);
116 HKS_IF_NULL_LOGE_RETURN(buffer, HKS_ERROR_MALLOC_FAIL, "malloc failed")
117
118 uint8_t *tmp = isPubKey ? (keyIn->data + sizeof(*keyPair)) :
119 (keyIn->data + sizeof(*keyPair) + keyPair->publicBufferSize);
120 (void)memcpy_s(buffer, size, tmp, size);
121
122 if (isPlainPubKey) { /* public key is plain key, only copy */
123 keyOut->data = buffer;
124 keyOut->size = size;
125 return HKS_SUCCESS;
126 }
127
128 struct HksBlob tempKey = { size, buffer };
129 struct HksKeyNode *keyNode = HksGenerateKeyNode(&tempKey);
130 (void)memset_s(buffer, size, 0, size);
131 HKS_FREE(buffer);
132 HKS_IF_NULL_LOGE_RETURN(keyNode, HKS_ERROR_CORRUPT_FILE, "generating keynode with agree key failed")
133
134 bool isSupportUserAuth = false;
135 int32_t ret = HksCheckKeybBlobIsSupportUserAuth(keyNode->paramSet, &isSupportUserAuth);
136 if (ret != HKS_SUCCESS) {
137 HKS_LOG_E("HksCheckKeybBlobIsSupportUserAuth failed");
138 HksFreeKeyNode(&keyNode);
139 return ret;
140 }
141
142 if (isSupportUserAuth) {
143 HKS_LOG_E("key should do user auth, but one stage api do not support user auth operation");
144 HksFreeKeyNode(&keyNode);
145 return HKS_ERROR_NOT_SUPPORTED;
146 }
147
148 ret = HksGetRawKey(keyNode->paramSet, keyOut);
149 HKS_IF_NOT_SUCC_LOGE(ret, "get raw key during key agreement failed!")
150
151 HksFreeKeyNode(&keyNode);
152 return ret;
153 }
154
GetAgreePriKey(const struct HksBlob * keyIn,struct HksBlob * keyOut)155 static int32_t GetAgreePriKey(const struct HksBlob *keyIn, struct HksBlob *keyOut)
156 {
157 return GetAgreeBaseKey(false, false, keyIn, keyOut);
158 }
159
GetAgreePubKey(const struct HksBlob * keyIn,const struct HksParamSet * paramSet,struct HksBlob * keyOut)160 static int32_t GetAgreePubKey(const struct HksBlob *keyIn, const struct HksParamSet *paramSet, struct HksBlob *keyOut)
161 {
162 struct HksParam *isKeyAliasParam = NULL;
163 int32_t ret = HksGetParam(paramSet, HKS_TAG_AGREE_PUBLIC_KEY_IS_KEY_ALIAS, &isKeyAliasParam);
164 if ((ret == HKS_SUCCESS) && (!(isKeyAliasParam->boolParam))) {
165 return GetAgreeBaseKey(true, true, keyIn, keyOut);
166 }
167
168 return GetAgreeBaseKey(true, false, keyIn, keyOut);
169 }
170
GenAgreeKey(const struct HksParamSet * paramSet,const struct HksBlob * privateKey,const struct HksBlob * peerPublicKey,struct HksBlob * agreedKey)171 static int32_t GenAgreeKey(const struct HksParamSet *paramSet, const struct HksBlob *privateKey,
172 const struct HksBlob *peerPublicKey, struct HksBlob *agreedKey)
173 {
174 struct HksParam *agreeAlgParam = NULL;
175 int32_t ret = HksGetParam(paramSet, HKS_TAG_AGREE_ALG, &agreeAlgParam);
176 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "generate key not set agree alg")
177
178 agreedKey->size = HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256);
179 agreedKey->data = (uint8_t *)HksMalloc(agreedKey->size);
180 HKS_IF_NULL_LOGE_RETURN(agreedKey->data, HKS_ERROR_MALLOC_FAIL, "malloc failed")
181
182 struct HksKeySpec agreeSpec = { 0, HKS_CURVE25519_KEY_SIZE_256, NULL };
183 if (agreeAlgParam->uint32Param == HKS_ALG_X25519) {
184 agreeSpec.algType = HKS_ALG_X25519;
185 } else if (agreeAlgParam->uint32Param == HKS_ALG_ED25519) {
186 agreeSpec.algType = HKS_ALG_ED25519;
187 } else {
188 HKS_FREE(agreedKey->data);
189 return HKS_ERROR_INVALID_ARGUMENT;
190 }
191
192 ret = HksCryptoHalAgreeKey(privateKey, peerPublicKey, &agreeSpec, agreedKey);
193 if (ret != HKS_SUCCESS) {
194 HKS_LOG_E("agree key failed, ret = %" LOG_PUBLIC "d", ret);
195 HKS_FREE(agreedKey->data); /* X25519AgreeKey will memset sharedKey if fail */
196 }
197 return ret;
198 }
199
GenKeyByAgree(const struct HksBlob * keyIn,const struct HksParamSet * paramSet,struct HksBlob * sharedKey)200 static int32_t GenKeyByAgree(const struct HksBlob *keyIn, const struct HksParamSet *paramSet,
201 struct HksBlob *sharedKey)
202 {
203 int32_t ret = CheckAgreeKeyIn(keyIn);
204 HKS_IF_NOT_SUCC_RETURN(ret, ret)
205
206 struct HksBlob priKey = { 0, NULL };
207 struct HksBlob pubKey = { 0, NULL };
208 do {
209 ret = GetAgreePriKey(keyIn, &priKey);
210 HKS_IF_NOT_SUCC_BREAK(ret)
211
212 ret = GetAgreePubKey(keyIn, paramSet, &pubKey);
213 HKS_IF_NOT_SUCC_BREAK(ret)
214
215 ret = GenAgreeKey(paramSet, &priKey, &pubKey, sharedKey);
216 } while (0);
217
218 if (priKey.data != NULL) {
219 (void)memset_s(priKey.data, priKey.size, 0, priKey.size);
220 HKS_FREE_BLOB(priKey);
221 }
222 if (pubKey.data != NULL) {
223 (void)memset_s(pubKey.data, pubKey.size, 0, pubKey.size);
224 HKS_FREE_BLOB(pubKey);
225 }
226 return ret;
227 }
228 #endif
229
HksCoreGenerateKey(const struct HksBlob * keyAlias,const struct HksParamSet * paramSet,const struct HksBlob * keyIn,struct HksBlob * keyOut)230 int32_t HksCoreGenerateKey(const struct HksBlob *keyAlias, const struct HksParamSet *paramSet,
231 const struct HksBlob *keyIn, struct HksBlob *keyOut)
232 {
233 int32_t ret = HksCoreCheckGenKeyParams(keyAlias, paramSet, keyIn, keyOut, HKS_KEY_FLAG_GENERATE_KEY);
234 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "hks core check generate key params failed, ret:%" LOG_PUBLIC "x!", ret)
235
236 uint32_t genType = HKS_KEY_GENERATE_TYPE_DEFAULT;
237 ret = GetGenType(paramSet, &genType);
238 HKS_IF_NOT_SUCC_RETURN(ret, ret)
239
240 HKS_IF_NOT_SUCC_LOGE_RETURN(CheckIfNeedIsDevicePasswordSet(paramSet), HKS_ERROR_DEVICE_PASSWORD_UNSET,
241 "a device password is required but not set yet!")
242
243 struct HksBlob key = { 0, NULL };
244 switch (genType) {
245 case HKS_KEY_GENERATE_TYPE_DEFAULT: {
246 struct HksKeySpec spec = {0};
247 HksFillKeySpec(paramSet, &spec);
248 ret = HksCryptoHalGenerateKey(&spec, &key);
249 break;
250 }
251 case HKS_KEY_GENERATE_TYPE_AGREE:
252 #ifdef HKS_SUPPORT_ED25519_TO_X25519
253 ret = GenKeyByAgree(keyIn, paramSet, &key);
254 #else
255 ret = HKS_ERROR_INVALID_ARGUMENT;
256 #endif
257 break;
258 default:
259 ret = HKS_ERROR_INVALID_ARGUMENT;
260 }
261 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "GenerateKey failed, ret:%" LOG_PUBLIC "x!", ret)
262
263 ret = HksBuildKeyBlob(keyAlias, HKS_KEY_FLAG_GENERATE_KEY, &key, paramSet, keyOut);
264 (void)memset_s(key.data, key.size, 0, key.size);
265 HKS_FREE_BLOB(key);
266 return ret;
267 }
268
AddProcessIdentityInfoToParamSet(const struct HksParamSet * inParamSet,struct HksParamSet * paramSet)269 static int32_t AddProcessIdentityInfoToParamSet(const struct HksParamSet *inParamSet, struct HksParamSet *paramSet)
270 {
271 uint32_t transferTagList[] = { HKS_TAG_ACCESS_TOKEN_ID, HKS_TAG_USER_ID, HKS_TAG_PROCESS_NAME };
272 int32_t ret;
273 for (uint32_t i = 0; i < HKS_ARRAY_SIZE(transferTagList); ++i) {
274 struct HksParam *tmpParam = NULL;
275 ret = HksGetParam(inParamSet, transferTagList[i], &tmpParam);
276 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_BAD_STATE, "get param %" LOG_PUBLIC "u failed.", i)
277
278 ret = HksAddParams(paramSet, tmpParam, 1);
279 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_BAD_STATE, "add param %" LOG_PUBLIC "u failed.", i)
280 }
281 return ret;
282 }
283
AddAgreeKeyParamSetFromUnwrapSuite(uint32_t suite,const struct HksParamSet * inParamSet,struct HksParamSet * paramSet)284 static int32_t AddAgreeKeyParamSetFromUnwrapSuite(uint32_t suite, const struct HksParamSet *inParamSet,
285 struct HksParamSet *paramSet)
286 {
287 uint32_t alg = HKS_ALG_X25519;
288 uint32_t keySize = HKS_CURVE25519_KEY_SIZE_256;
289 switch (suite) {
290 case HKS_UNWRAP_SUITE_X25519_AES_256_GCM_NOPADDING:
291 alg = HKS_ALG_X25519;
292 keySize = HKS_CURVE25519_KEY_SIZE_256;
293 break;
294 case HKS_UNWRAP_SUITE_ECDH_AES_256_GCM_NOPADDING:
295 alg = HKS_ALG_ECDH;
296 keySize = HKS_ECC_KEY_SIZE_256;
297 break;
298 case HKS_UNWRAP_SUITE_SM2_SM4_128_CBC_PKCS7:
299 case HKS_UNWRAP_SUITE_SM2_SM4_128_CBC_PKCS7_WITH_VERIFY_DIG_SM3:
300 alg = HKS_ALG_SM2;
301 keySize = HKS_SM2_KEY_SIZE_256;
302 break;
303 default:
304 HKS_LOG_E("invalid suite type use x25519 default");
305 break;
306 }
307
308 struct HksParam agreeParams[] = {
309 { .tag = HKS_TAG_ALGORITHM, .uint32Param = alg },
310 { .tag = HKS_TAG_PURPOSE, .uint32Param = HKS_KEY_PURPOSE_AGREE },
311 { .tag = HKS_TAG_KEY_SIZE, .uint32Param = keySize }
312 };
313
314 int32_t ret = HksAddParams(paramSet, agreeParams, sizeof(agreeParams) / sizeof(struct HksParam));
315 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "unwrap suite add params failed.")
316
317 return AddProcessIdentityInfoToParamSet(inParamSet, paramSet);
318 }
319
GenAgreeKeyParamSetFromUnwrapSuite(uint32_t suite,const struct HksParamSet * inParamSet,struct HksParamSet ** outParamSet)320 static int32_t GenAgreeKeyParamSetFromUnwrapSuite(uint32_t suite, const struct HksParamSet *inParamSet,
321 struct HksParamSet **outParamSet)
322 {
323 struct HksParamSet *paramSet = NULL;
324 int32_t ret = HksInitParamSet(¶mSet);
325 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "init agree_key param set fail")
326
327 ret = AddAgreeKeyParamSetFromUnwrapSuite(suite, inParamSet, paramSet);
328 if (ret != HKS_SUCCESS) {
329 HKS_LOG_E("unwrap suite add params failed.");
330 HksFreeParamSet(¶mSet);
331 return ret;
332 }
333
334 ret = HksBuildParamSet(¶mSet);
335 if (ret != HKS_SUCCESS) {
336 HKS_LOG_E("unwrap suite build params failed.");
337 HksFreeParamSet(¶mSet);
338 return ret;
339 }
340
341 *outParamSet = paramSet;
342 return HKS_SUCCESS;
343 }
344
BuildDecryptUsageSpecOfUnwrap(const struct HksBlob * aad,const struct HksBlob * nonce,const struct HksBlob * aeadTag,uint32_t payloadLen,struct HksUsageSpec * usageSpec)345 static int32_t BuildDecryptUsageSpecOfUnwrap(const struct HksBlob *aad, const struct HksBlob *nonce,
346 const struct HksBlob *aeadTag, uint32_t payloadLen, struct HksUsageSpec *usageSpec)
347 {
348 usageSpec->mode = HKS_MODE_GCM;
349 usageSpec->padding = HKS_PADDING_NONE;
350 usageSpec->digest = HKS_DIGEST_NONE;
351 usageSpec->algType = HKS_ALG_AES;
352
353 struct HksAeadParam *aeadParam = (struct HksAeadParam *)HksMalloc(sizeof(struct HksAeadParam));
354 HKS_IF_NULL_LOGE_RETURN(aeadParam, HKS_ERROR_MALLOC_FAIL, "build dec wrapped usage: aeadParam malloc failed!")
355
356 aeadParam->aad = *aad;
357 aeadParam->nonce = *nonce;
358 aeadParam->payloadLen = payloadLen;
359 aeadParam->tagDec = *aeadTag;
360
361 usageSpec->algParam = aeadParam;
362 return HKS_SUCCESS;
363 }
364
CheckWrappingKeyIsUsedForUnwrap(const struct HksBlob * wrappingKey)365 static int32_t CheckWrappingKeyIsUsedForUnwrap(const struct HksBlob *wrappingKey)
366 {
367 struct HksKeyNode *wrappingKeyNode = HksGenerateKeyNode(wrappingKey);
368 HKS_IF_NULL_LOGE_RETURN(wrappingKeyNode, HKS_ERROR_CORRUPT_FILE,
369 "check agree params: generate wrapping keynode failed!")
370
371 struct HksParam *purposeParamWrappingKey = NULL;
372 int32_t ret = HksGetParam(wrappingKeyNode->paramSet, HKS_TAG_PURPOSE, &purposeParamWrappingKey);
373 if (ret != HKS_SUCCESS) {
374 HKS_LOG_E("get wrapping key param 0x%" LOG_PUBLIC "x failed!", HKS_TAG_PURPOSE);
375 HksFreeKeyNode(&wrappingKeyNode);
376 return HKS_ERROR_CHECK_GET_PURPOSE_FAIL;
377 }
378
379 if (purposeParamWrappingKey->uint32Param != HKS_KEY_PURPOSE_UNWRAP) {
380 HKS_LOG_E("wrapping key is not used for unwrap!");
381 HksFreeKeyNode(&wrappingKeyNode);
382 return HKS_ERROR_INVALID_USAGE_OF_KEY;
383 }
384 HksFreeKeyNode(&wrappingKeyNode);
385 return HKS_SUCCESS;
386 }
387
GetPublicKeyInnerFormat(const struct HksBlob * wrappingKey,const struct HksBlob * wrappedKeyData,struct HksBlob * outPublicKey,uint32_t * partOffset)388 static int32_t GetPublicKeyInnerFormat(const struct HksBlob *wrappingKey, const struct HksBlob *wrappedKeyData,
389 struct HksBlob *outPublicKey, uint32_t *partOffset)
390 {
391 struct HksBlob peerPubKeyPart = { 0, NULL };
392 uint32_t offset = *partOffset;
393 int32_t ret = HksGetBlobFromWrappedData(wrappedKeyData, offset++, HKS_IMPORT_WRAPPED_KEY_TOTAL_BLOBS,
394 &peerPubKeyPart);
395 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get peer pub key failed!")
396
397 /* peer public key format should be same as wrapping key */
398 struct HksKeyNode *wrappingKeyNode = HksGenerateKeyNode(wrappingKey);
399 HKS_IF_NULL_LOGE_RETURN(wrappingKeyNode, HKS_ERROR_CORRUPT_FILE, "generate wrapping key keynode failed")
400
401 ret = GetHksPubKeyInnerFormat(wrappingKeyNode->paramSet, &peerPubKeyPart, outPublicKey);
402 HksFreeKeyNode(&wrappingKeyNode);
403 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get peer pub key inner format failed!")
404
405 *partOffset = offset;
406 return HKS_SUCCESS;
407 }
408
AgreeSharedSecretWithPeerPublicKey(const struct HksBlob * wrappingKey,const struct HksBlob * publicKey,uint32_t unwrapSuite,struct HksBlob * agreeSharedSecret,const struct HksParamSet * inParamSet)409 static int32_t AgreeSharedSecretWithPeerPublicKey(const struct HksBlob *wrappingKey, const struct HksBlob *publicKey,
410 uint32_t unwrapSuite, struct HksBlob *agreeSharedSecret, const struct HksParamSet *inParamSet)
411 {
412 int32_t ret = CheckWrappingKeyIsUsedForUnwrap(wrappingKey);
413 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check agree params failed!")
414
415 struct HksParamSet *agreeKeyParamSet = NULL;
416 ret = GenAgreeKeyParamSetFromUnwrapSuite(unwrapSuite, inParamSet, &agreeKeyParamSet);
417 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "gen agree key paramSet failed!")
418
419 struct HksBlob sharedSecret = { 0, NULL };
420 sharedSecret.size = HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256);
421 uint8_t *shareSecretBuffer = (uint8_t *) HksMalloc(sharedSecret.size);
422 if (shareSecretBuffer == NULL) {
423 HksFreeParamSet(&agreeKeyParamSet);
424 HKS_LOG_E("malloc shared key failed!");
425 return HKS_ERROR_MALLOC_FAIL;
426 }
427 sharedSecret.data = shareSecretBuffer;
428
429 ret = HksCoreAgreeKey(agreeKeyParamSet, wrappingKey, publicKey, &sharedSecret);
430 HksFreeParamSet(&agreeKeyParamSet);
431 if (ret != HKS_SUCCESS) {
432 HKS_LOG_E("agree with peer public key failed! ret = %" LOG_PUBLIC "d", ret);
433 HKS_FREE(sharedSecret.data);
434 return ret;
435 }
436
437 agreeSharedSecret->size = sharedSecret.size;
438 agreeSharedSecret->data = sharedSecret.data;
439 return HKS_SUCCESS;
440 }
441
ParseKekDecryptParams(const struct HksBlob * wrappedKeyData,uint32_t * partOffset,uint32_t totalBlobs,struct HksBlob ** blobArray)442 static int32_t ParseKekDecryptParams(const struct HksBlob *wrappedKeyData, uint32_t *partOffset,
443 uint32_t totalBlobs, struct HksBlob **blobArray)
444 {
445 uint32_t offset = *partOffset;
446 uint32_t blobIndex = 0;
447 int32_t ret = HksGetBlobFromWrappedData(wrappedKeyData, offset++, totalBlobs, blobArray[blobIndex++]);
448 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get agree-key aad data failed!")
449
450 ret = HksGetBlobFromWrappedData(wrappedKeyData, offset++, totalBlobs, blobArray[blobIndex++]);
451 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get agree-key nonce data failed!")
452
453 ret = HksGetBlobFromWrappedData(wrappedKeyData, offset++, totalBlobs, blobArray[blobIndex++]);
454 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get agree-key aead tag data failed!")
455
456 ret = HksGetBlobFromWrappedData(wrappedKeyData, offset++, totalBlobs, blobArray[blobIndex++]);
457 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get kek enc data failed!")
458
459 *partOffset = offset;
460 return HKS_SUCCESS;
461 }
462
DecryptKekWithAgreeSharedSecret(const struct HksBlob * wrappedKeyData,const struct HksBlob * agreeSharedSecret,uint32_t * partOffset,struct HksBlob * outKekBlob)463 static int32_t DecryptKekWithAgreeSharedSecret(const struct HksBlob *wrappedKeyData,
464 const struct HksBlob *agreeSharedSecret, uint32_t *partOffset, struct HksBlob *outKekBlob)
465 {
466 struct HksBlob agreeKeyAadPart = { 0, NULL };
467 struct HksBlob agreeKeyNoncePart = { 0, NULL };
468 struct HksBlob agreeKeyTagPart = { 0, NULL };
469 struct HksBlob kekEncDataPart = { 0, NULL };
470 struct HksBlob *blobArray[] = { &agreeKeyAadPart, &agreeKeyNoncePart, &agreeKeyTagPart, &kekEncDataPart };
471
472 uint32_t offset = *partOffset;
473 int32_t ret = ParseKekDecryptParams(wrappedKeyData, &offset, HKS_IMPORT_WRAPPED_KEY_TOTAL_BLOBS, blobArray);
474 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "parse agree-key decrypt kek params failed!")
475
476 /* build decrypt kek usagespec */
477 struct HksUsageSpec *decKekUsageSpec = (struct HksUsageSpec *)HksMalloc(sizeof(struct HksUsageSpec));
478 HKS_IF_NULL_LOGE_RETURN(decKekUsageSpec, HKS_ERROR_MALLOC_FAIL, "malloc decrypt kek usage spec failed!")
479
480 (void)memset_s(decKekUsageSpec, sizeof(struct HksUsageSpec), 0, sizeof(struct HksUsageSpec));
481 ret = BuildDecryptUsageSpecOfUnwrap(&agreeKeyAadPart, &agreeKeyNoncePart, &agreeKeyTagPart, kekEncDataPart.size,
482 decKekUsageSpec);
483 if (ret != HKS_SUCCESS) {
484 HKS_LOG_E("build decrypt wrapped data kek usageSpec failed!");
485 HksFreeUsageSpec(&decKekUsageSpec);
486 return ret;
487 }
488 struct HksBlob kek = { 0, NULL };
489 kek.size = HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256);
490 uint8_t *kekBuffer = (uint8_t *) HksMalloc(kek.size);
491 if (kekBuffer == NULL) {
492 HKS_LOG_E("malloc kek memory failed!");
493 HksFreeUsageSpec(&decKekUsageSpec);
494 return HKS_ERROR_MALLOC_FAIL;
495 }
496 kek.data = kekBuffer;
497 ret = HksCryptoHalDecrypt(agreeSharedSecret, decKekUsageSpec, &kekEncDataPart, &kek);
498 HksFreeUsageSpec(&decKekUsageSpec);
499 if (ret != HKS_SUCCESS) {
500 HKS_LOG_E("decrypt kek data failed!");
501 HKS_FREE(kek.data);
502 return ret;
503 }
504
505 outKekBlob->size = kek.size;
506 outKekBlob->data = kek.data;
507 *partOffset = offset;
508 return HKS_SUCCESS;
509 }
510
ParseImportedKeyDecryptParams(const struct HksBlob * wrappedKeyData,uint32_t * partOffset,uint32_t totalBlobs,uint32_t * outKeyMaterialSize,struct HksBlob ** blobArray)511 static int32_t ParseImportedKeyDecryptParams(const struct HksBlob *wrappedKeyData, uint32_t *partOffset,
512 uint32_t totalBlobs, uint32_t *outKeyMaterialSize, struct HksBlob **blobArray)
513 {
514 uint32_t offset = *partOffset;
515 uint32_t blobIndex = 0;
516 int32_t ret = HksGetBlobFromWrappedData(wrappedKeyData, offset++, totalBlobs, blobArray[blobIndex++]);
517 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get kek aad data failed!")
518
519 ret = HksGetBlobFromWrappedData(wrappedKeyData, offset++, totalBlobs, blobArray[blobIndex++]);
520 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get kek nonce data failed!")
521
522 ret = HksGetBlobFromWrappedData(wrappedKeyData, offset++, totalBlobs, blobArray[blobIndex++]);
523 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get kek aead tag data failed!")
524
525 struct HksBlob keyMatLenBlobPart = { 0, NULL };
526 ret = HksGetBlobFromWrappedData(wrappedKeyData, offset++, totalBlobs, &keyMatLenBlobPart);
527 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get key material len failed!")
528
529 if (keyMatLenBlobPart.size != sizeof(uint32_t)) {
530 HKS_LOG_E("key material len part is invalid!");
531 return HKS_ERROR_INVALID_WRAPPED_FORMAT;
532 }
533
534 uint32_t keyMaterialSize = 0;
535 (void)memcpy_s((uint8_t *)&keyMaterialSize, sizeof(uint32_t), keyMatLenBlobPart.data, keyMatLenBlobPart.size);
536 if ((keyMaterialSize == 0) || (keyMaterialSize > MAX_KEY_SIZE)) {
537 HKS_LOG_E("key material size is invalid!");
538 return HKS_ERROR_INVALID_WRAPPED_FORMAT;
539 }
540
541 ret = HksGetBlobFromWrappedData(wrappedKeyData, offset++, totalBlobs, blobArray[blobIndex++]);
542 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get imported key encryption data failed!")
543
544 *partOffset = offset;
545 *outKeyMaterialSize = keyMaterialSize;
546 return HKS_SUCCESS;
547 }
548
DecryptImportedKeyWithKek(const struct HksBlob * wrappedKeyData,const struct HksBlob * kek,uint32_t * partOffset,struct HksBlob * outImportedKey)549 static int32_t DecryptImportedKeyWithKek(const struct HksBlob *wrappedKeyData, const struct HksBlob *kek,
550 uint32_t *partOffset, struct HksBlob *outImportedKey)
551 {
552 struct HksBlob kekAadPart = { 0, NULL };
553 struct HksBlob kekNoncePart = { 0, NULL };
554 struct HksBlob kekTagPart = { 0, NULL };
555 struct HksBlob originKeyEncDataPart = { 0, NULL };
556 struct HksBlob *blobArray[] = { &kekAadPart, &kekNoncePart, &kekTagPart, &originKeyEncDataPart };
557
558 uint32_t offset = *partOffset;
559 uint32_t keyMaterialSize = 0;
560 int32_t ret = ParseImportedKeyDecryptParams(wrappedKeyData, &offset, HKS_IMPORT_WRAPPED_KEY_TOTAL_BLOBS,
561 &keyMaterialSize, blobArray);
562 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "parse kek decrypt imported-key params failed!")
563
564 struct HksBlob originKey = { 0, NULL };
565 originKey.size = keyMaterialSize;
566 uint8_t *originKeyBuffer = (uint8_t *) HksMalloc(originKey.size);
567 HKS_IF_NULL_LOGE_RETURN(originKeyBuffer, HKS_ERROR_MALLOC_FAIL, "malloc originKeyBuffer memory failed!")
568
569 originKey.data = originKeyBuffer;
570
571 struct HksUsageSpec *decOriginKeyUsageSpec = (struct HksUsageSpec *)HksMalloc(sizeof(struct HksUsageSpec));
572 if (decOriginKeyUsageSpec == NULL) {
573 HKS_LOG_E("malloc originKeyBuffer memory failed!");
574 HKS_FREE(originKey.data);
575 return HKS_ERROR_MALLOC_FAIL;
576 }
577 (void)memset_s(decOriginKeyUsageSpec, sizeof(struct HksUsageSpec), 0, sizeof(struct HksUsageSpec));
578 uint32_t payloadSize = originKeyEncDataPart.size;
579 ret = BuildDecryptUsageSpecOfUnwrap(&kekAadPart, &kekNoncePart, &kekTagPart, payloadSize, decOriginKeyUsageSpec);
580 if (ret != HKS_SUCCESS) {
581 HKS_LOG_E("build decrypt wrapped data origin key usageSpec failed!");
582 HKS_FREE(originKey.data);
583 HksFreeUsageSpec(&decOriginKeyUsageSpec);
584 return ret;
585 }
586
587 ret = HksCryptoHalDecrypt(kek, decOriginKeyUsageSpec, &originKeyEncDataPart, &originKey);
588 HksFreeUsageSpec(&decOriginKeyUsageSpec);
589 if (ret != HKS_SUCCESS) {
590 HKS_LOG_E("decrypt importKey failed!");
591 HKS_FREE(originKey.data);
592 return ret;
593 }
594
595 outImportedKey->size = originKey.size;
596 outImportedKey->data = originKey.data;
597 *partOffset = offset;
598 return HKS_SUCCESS;
599 }
600
ClearAndFreeKeyBlobsIfNeed(struct HksBlob * peerPublicKey,struct HksBlob * agreeSharedSecret,struct HksBlob * originKey,struct HksBlob * kek)601 static void ClearAndFreeKeyBlobsIfNeed(struct HksBlob *peerPublicKey, struct HksBlob *agreeSharedSecret,
602 struct HksBlob *originKey, struct HksBlob *kek)
603 {
604 if (originKey->data != NULL) {
605 (void)memset_s(originKey->data, originKey->size, 0, originKey->size);
606 HKS_FREE(originKey->data);
607 }
608
609 if (kek->data != NULL) {
610 (void)memset_s(kek->data, kek->size, 0, kek->size);
611 HKS_FREE(kek->data);
612 }
613
614 if (agreeSharedSecret->data != NULL) {
615 (void)memset_s(agreeSharedSecret->data, agreeSharedSecret->size, 0, agreeSharedSecret->size);
616 HKS_FREE(agreeSharedSecret->data);
617 }
618
619 if (peerPublicKey->data != NULL) {
620 (void)memset_s(peerPublicKey->data, peerPublicKey->size, 0, peerPublicKey->size);
621 HKS_FREE(peerPublicKey->data);
622 }
623 }
624
CheckRsaKeyMaterialLen(uint32_t keyType,const struct HksBlob * key)625 static int32_t CheckRsaKeyMaterialLen(uint32_t keyType, const struct HksBlob *key)
626 {
627 if (key->size < sizeof(struct HksKeyMaterialRsa)) {
628 HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
629 return HKS_ERROR_INVALID_KEY_INFO;
630 }
631
632 struct HksKeyMaterialRsa *keyMaterial = (struct HksKeyMaterialRsa *)(key->data);
633
634 if ((keyMaterial->nSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->nSize == 0) ||
635 (keyMaterial->dSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->dSize == 0) ||
636 (keyMaterial->eSize > HKS_RSA_KEY_SIZE_4096)) {
637 HKS_LOG_E("invalid import key material n/d/e size");
638 return HKS_ERROR_INVALID_KEY_INFO;
639 }
640
641 if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->eSize == 0)) {
642 HKS_LOG_E("invalid import key material e size while import key pair");
643 return HKS_ERROR_INVALID_KEY_INFO;
644 }
645
646 uint32_t keySize = sizeof(struct HksKeyMaterialRsa) + keyMaterial->nSize + keyMaterial->dSize + keyMaterial->eSize;
647 if (key->size < keySize) {
648 HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
649 return HKS_ERROR_INVALID_KEY_INFO;
650 }
651
652 return HKS_SUCCESS;
653 }
654
AppendRsaPublicExponent(const struct HksBlob * key,struct HksBlob * outKey)655 static int32_t AppendRsaPublicExponent(const struct HksBlob *key, struct HksBlob *outKey)
656 {
657 /* key len has been checked by caller */
658 struct HksKeyMaterialRsa *keyMaterial = (struct HksKeyMaterialRsa *)(key->data);
659 uint32_t size = sizeof(struct HksKeyMaterialRsa) + keyMaterial->nSize + keyMaterial->dSize +
660 sizeof(g_defaultRsaPubExponent);
661
662 uint8_t *out = (uint8_t *)HksMalloc(size);
663 HKS_IF_NULL_LOGE_RETURN(out, HKS_ERROR_MALLOC_FAIL, "malloc failed")
664
665 uint32_t offset = 0;
666 do {
667 (void)memcpy_s(out + offset, size - offset, key->data, sizeof(struct HksKeyMaterialRsa));
668 offset += sizeof(struct HksKeyMaterialRsa);
669
670 struct HksKeyMaterialRsa *newkeyMaterial = (struct HksKeyMaterialRsa *)out;
671 newkeyMaterial->eSize = sizeof(g_defaultRsaPubExponent);
672
673 (void)memcpy_s(out + offset, size - offset, key->data + offset, keyMaterial->nSize);
674 offset += keyMaterial->nSize;
675
676 (void)memcpy_s(out + offset, size - offset, g_defaultRsaPubExponent, sizeof(g_defaultRsaPubExponent));
677
678 (void)memcpy_s(out + offset + sizeof(g_defaultRsaPubExponent), size - offset - sizeof(g_defaultRsaPubExponent),
679 key->data + offset, keyMaterial->dSize);
680 } while (0);
681
682 outKey->data = out;
683 outKey->size = size;
684 return HKS_SUCCESS;
685 }
686
GetRsaPrivateOrPairInnerFormat(uint32_t keyType,const struct HksBlob * key,struct HksBlob * outKey)687 static int32_t GetRsaPrivateOrPairInnerFormat(uint32_t keyType, const struct HksBlob *key, struct HksBlob *outKey)
688 {
689 int32_t ret = CheckRsaKeyMaterialLen(keyType, key);
690 HKS_IF_NOT_SUCC_RETURN(ret, ret)
691
692 struct HksKeyMaterialRsa *keyMaterial = (struct HksKeyMaterialRsa *)(key->data);
693 if ((keyType == HKS_KEY_TYPE_PRIVATE_KEY) && (keyMaterial->eSize == 0)) {
694 return AppendRsaPublicExponent(key, outKey);
695 }
696
697 return CopyToInnerKey(key, outKey);
698 }
699
GetCurve25519PrivateOrPairInnerFormat(uint8_t alg,uint32_t keyType,const struct HksBlob * key,struct HksBlob * outKey)700 static int32_t GetCurve25519PrivateOrPairInnerFormat(uint8_t alg, uint32_t keyType,
701 const struct HksBlob *key, struct HksBlob *outKey)
702 {
703 if (keyType == HKS_KEY_TYPE_KEY_PAIR) {
704 return CopyToInnerKey(key, outKey);
705 }
706
707 if (key->size != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256)) {
708 HKS_LOG_E("Invalid curve25519 private key size! key size = 0x%" LOG_PUBLIC "X", key->size);
709 return HKS_ERROR_INVALID_KEY_INFO;
710 }
711
712 uint32_t totalSize = sizeof(struct HksKeyMaterial25519) + key->size;
713 uint8_t *buffer = (uint8_t *)HksMalloc(totalSize);
714 HKS_IF_NULL_LOGE_RETURN(buffer, HKS_ERROR_MALLOC_FAIL, "malloc failed! %" LOG_PUBLIC "u", totalSize)
715
716 (void)memset_s(buffer, totalSize, 0, totalSize);
717
718 struct HksKeyMaterial25519 *curve25519Key = (struct HksKeyMaterial25519 *)buffer;
719 curve25519Key->keyAlg = (enum HksKeyAlg)alg;
720 curve25519Key->keySize = HKS_CURVE25519_KEY_SIZE_256;
721 curve25519Key->priKeySize = key->size; /* curve25519 private key */
722
723 uint32_t offset = sizeof(struct HksKeyMaterial25519);
724 (void)memcpy_s(buffer + offset, totalSize - offset, key->data, key->size);
725 outKey->data = buffer;
726 outKey->size = totalSize;
727 return HKS_SUCCESS;
728 }
729
GetPrivateOrPairInnerFormat(uint32_t keyType,const struct HksBlob * key,const struct HksParamSet * paramSet,struct HksBlob * outKey)730 static int32_t GetPrivateOrPairInnerFormat(uint32_t keyType, const struct HksBlob *key,
731 const struct HksParamSet *paramSet, struct HksBlob *outKey)
732 {
733 HKS_IF_NOT_SUCC_LOGE_RETURN(CheckBlob(key), HKS_ERROR_INVALID_ARGUMENT, "invalid key or outKey")
734
735 struct HksParam *algParam = NULL;
736 int32_t ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &algParam);
737 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_ALG_FAIL, "get alg param failed")
738
739 switch (algParam->uint32Param) {
740 case HKS_ALG_RSA:
741 return GetRsaPrivateOrPairInnerFormat(keyType, key, outKey);
742 case HKS_ALG_ECC:
743 case HKS_ALG_DSA:
744 case HKS_ALG_DH:
745 case HKS_ALG_SM2:
746 case HKS_ALG_HMAC:
747 case HKS_ALG_SM3:
748 case HKS_ALG_SM4:
749 case HKS_ALG_AES:
750 return CopyToInnerKey(key, outKey);
751 case HKS_ALG_ED25519:
752 case HKS_ALG_X25519:
753 return GetCurve25519PrivateOrPairInnerFormat(algParam->uint32Param, keyType, key, outKey);
754 default:
755 return HKS_ERROR_INVALID_ALGORITHM;
756 }
757 }
758
HksCoreImportKey(const struct HksBlob * keyAlias,const struct HksBlob * key,const struct HksParamSet * paramSet,struct HksBlob * keyOut)759 int32_t HksCoreImportKey(const struct HksBlob *keyAlias, const struct HksBlob *key,
760 const struct HksParamSet *paramSet, struct HksBlob *keyOut)
761 {
762 struct HksBlob innerKey = { 0, NULL };
763 struct HksParam *importKeyTypeParam = NULL;
764 int32_t ret = HksGetParam(paramSet, HKS_TAG_IMPORT_KEY_TYPE, &importKeyTypeParam);
765 if ((ret == HKS_SUCCESS) &&
766 ((importKeyTypeParam->uint32Param == HKS_KEY_TYPE_PRIVATE_KEY) ||
767 (importKeyTypeParam->uint32Param == HKS_KEY_TYPE_KEY_PAIR))) {
768 ret = GetPrivateOrPairInnerFormat(importKeyTypeParam->uint32Param, key, paramSet, &innerKey);
769 } else {
770 ret = CopyToInnerKey(key, &innerKey);
771 }
772 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "translate key to inner format failed, ret = %" LOG_PUBLIC "d", ret)
773
774 do {
775 ret = HksCoreCheckImportKeyParams(keyAlias, &innerKey, paramSet, keyOut);
776 HKS_IF_NOT_SUCC_BREAK(ret)
777
778 ret = HksBuildKeyBlob(keyAlias, HKS_KEY_FLAG_IMPORT_KEY, &innerKey, paramSet, keyOut);
779 } while (0);
780
781 (void)memset_s(innerKey.data, innerKey.size, 0, innerKey.size);
782 HKS_FREE_BLOB(innerKey);
783 return ret;
784 }
785
HksCoreImportWrappedKey(const struct HksBlob * keyAlias,const struct HksBlob * wrappingKey,const struct HksBlob * wrappedKeyData,const struct HksParamSet * paramSet,struct HksBlob * keyOut)786 int32_t HksCoreImportWrappedKey(const struct HksBlob *keyAlias, const struct HksBlob *wrappingKey,
787 const struct HksBlob *wrappedKeyData, const struct HksParamSet *paramSet, struct HksBlob *keyOut)
788 {
789 uint32_t unwrapSuite = 0;
790 int32_t ret = HksCoreCheckImportWrappedKeyParams(wrappingKey, wrappedKeyData, paramSet, keyOut, &unwrapSuite);
791 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check import wrapped key params failed!")
792
793 if ((unwrapSuite == HKS_UNWRAP_SUITE_SM2_SM4_128_CBC_PKCS7_WITH_VERIFY_DIG_SM3) ||
794 (unwrapSuite == HKS_UNWRAP_SUITE_SM2_SM4_128_CBC_PKCS7)) {
795 return HksSmImportWrappedKey(keyAlias, paramSet, wrappingKey, wrappedKeyData, keyOut);
796 }
797
798 struct HksBlob peerPublicKey = { 0, NULL };
799 struct HksBlob agreeSharedSecret = { 0, NULL };
800 struct HksBlob originKey = { 0, NULL };
801 struct HksBlob kek = { 0, NULL };
802 uint32_t partOffset = 0;
803
804 do {
805 /* 1. get peer public key and translate to inner format */
806 ret = GetPublicKeyInnerFormat(wrappingKey, wrappedKeyData, &peerPublicKey, &partOffset);
807 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "get peer public key of inner format failed!")
808
809 /* 2. agree shared key with wrappingAlias's private key and peer public key */
810 ret = AgreeSharedSecretWithPeerPublicKey(wrappingKey, &peerPublicKey, unwrapSuite, &agreeSharedSecret,
811 paramSet);
812 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "agree share secret failed!")
813
814 /* 4. decrypt kek data with agreed secret */
815 ret = DecryptKekWithAgreeSharedSecret(wrappedKeyData, &agreeSharedSecret, &partOffset, &kek);
816 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "decrypt kek with agreed secret failed!")
817
818 /* 5. decrypt imported key data with kek */
819 ret = DecryptImportedKeyWithKek(wrappedKeyData, &kek, &partOffset, &originKey);
820 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "decrypt origin key failed!")
821
822 /* 6. call HksCoreImportKey to build key blob */
823 ret = HksCoreImportKey(keyAlias, &originKey, paramSet, keyOut);
824 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "import origin key failed!")
825 } while (0);
826
827 ClearAndFreeKeyBlobsIfNeed(&peerPublicKey, &agreeSharedSecret, &originKey, &kek);
828 return ret;
829 }
830
831 #endif /* _CUT_AUTHENTICATE_ */
832
HksCoreGenerateRandom(const struct HksParamSet * paramSet,struct HksBlob * random)833 int32_t HksCoreGenerateRandom(const struct HksParamSet *paramSet, struct HksBlob *random)
834 {
835 (void)paramSet;
836 return HksCryptoHalFillRandom(random);
837 }