1 /*
2 * Copyright (C) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include "wifi_encryption_util.h"
16 #if defined(FEATURE_ENCRYPTION_SUPPORT) || defined(SUPPORT_LOCAL_RANDOM_MAC)
17 #include <iterator>
18 #include <sstream>
19 #include "wifi_logger.h"
20 #include "wifi_global_func.h"
21 DEFINE_WIFILOG_LABEL("WifiConfigEncryption");
22 namespace OHOS {
23 namespace Wifi {
24
25 struct HksParam g_genParam[] = {
26 { .tag = HKS_TAG_KEY_STORAGE_FLAG, .uint32Param = HKS_STORAGE_PERSISTENT },
27 { .tag = HKS_TAG_ALGORITHM, .uint32Param = HKS_ALG_AES },
28 { .tag = HKS_TAG_KEY_SIZE, .uint32Param = HKS_AES_KEY_SIZE_256 },
29 { .tag = HKS_TAG_PURPOSE, .uint32Param = HKS_KEY_PURPOSE_ENCRYPT | HKS_KEY_PURPOSE_DECRYPT },
30 { .tag = HKS_TAG_DIGEST, .uint32Param = HKS_DIGEST_NONE },
31 { .tag = HKS_TAG_PADDING, .uint32Param = HKS_PADDING_NONE },
32 { .tag = HKS_TAG_IS_KEY_ALIAS, .boolParam = true },
33 { .tag = HKS_TAG_KEY_GENERATE_TYPE, .uint32Param = HKS_KEY_GENERATE_TYPE_DEFAULT },
34 { .tag = HKS_TAG_BLOCK_MODE, .uint32Param = HKS_MODE_GCM },
35 { .tag = HKS_TAG_AUTH_STORAGE_LEVEL, .uint32Param = HKS_AUTH_STORAGE_LEVEL_DE },
36 { .tag = HKS_TAG_ASSOCIATED_DATA, .blob = { .size = AAD_SIZE, .data = (uint8_t *)AAD } },
37 };
38
39 struct HksParam g_genAes256Param[] = {
40 { .tag = HKS_TAG_ALGORITHM, .uint32Param = HKS_ALG_AES },
41 { .tag = HKS_TAG_KEY_SIZE, .uint32Param = HKS_AES_KEY_SIZE_256 },
42 { .tag = HKS_TAG_DIGEST, .uint32Param = HKS_DIGEST_NONE },
43 { .tag = HKS_TAG_PADDING, .uint32Param = HKS_PADDING_NONE },
44 { .tag = HKS_TAG_IS_KEY_ALIAS, .boolParam = true },
45 { .tag = HKS_TAG_KEY_GENERATE_TYPE, .uint32Param = HKS_KEY_GENERATE_TYPE_DEFAULT },
46 { .tag = HKS_TAG_BLOCK_MODE, .uint32Param = HKS_MODE_GCM },
47 { .tag = HKS_TAG_AUTH_STORAGE_LEVEL, .uint32Param = HKS_AUTH_STORAGE_LEVEL_DE },
48 };
49
50 static struct HksParam g_genHmacParams[] = {
51 { .tag = HKS_TAG_ALGORITHM, .uint32Param = HKS_ALG_HMAC },
52 { .tag = HKS_TAG_PURPOSE, .uint32Param = HKS_KEY_PURPOSE_MAC },
53 { .tag = HKS_TAG_KEY_SIZE, .uint32Param = HKS_AES_KEY_SIZE_256 },
54 { .tag = HKS_TAG_DIGEST, .uint32Param = HKS_DIGEST_SHA256 },
55 { .tag = HKS_TAG_AUTH_STORAGE_LEVEL, .uint32Param = HKS_AUTH_STORAGE_LEVEL_DE },
56 };
57
SetUpHks()58 int32_t SetUpHks()
59 {
60 int32_t ret = HksInitialize();
61 if (ret != HKS_SUCCESS) {
62 WIFI_LOGE("wifi encryption init failed");
63 }
64 return ret;
65 }
66
GetKeyByAlias(struct HksBlob * keyAlias,const struct HksParamSet * genParamSet)67 int32_t GetKeyByAlias(struct HksBlob *keyAlias, const struct HksParamSet *genParamSet)
68 {
69 if (keyAlias == nullptr || genParamSet == nullptr) {
70 WIFI_LOGE("%{public}s invalid param", __func__);
71 return -1;
72 }
73 int32_t keyExist = HksKeyExist(keyAlias, genParamSet);
74 if (keyExist == HKS_ERROR_NOT_EXIST) {
75 int32_t ret = HksGenerateKey(keyAlias, genParamSet, nullptr);
76 if (ret != HKS_SUCCESS) {
77 WIFI_LOGE("%{public}s generate key failed:%{public}d", __func__, keyExist);
78 return ret;
79 } else {
80 return ret;
81 }
82 } else if (keyExist != HKS_SUCCESS) {
83 WIFI_LOGE("%{public}s search key failed:%{public}d", __func__, keyExist);
84 return keyExist;
85 }
86 return keyExist;
87 }
88
WifiEncryption(const WifiEncryptionInfo & wifiEncryptionInfo,const std::string & inputString,EncryptedData & encryptedData)89 int32_t WifiEncryption(const WifiEncryptionInfo &wifiEncryptionInfo, const std::string &inputString,
90 EncryptedData &encryptedData)
91 {
92 if (inputString.length() == 0) {
93 return HKS_SUCCESS;
94 }
95 struct HksBlob authId = wifiEncryptionInfo.keyAlias;
96 struct HksBlob plainText = { inputString.length(), (uint8_t *)&inputString[0] };
97
98 uint8_t nonce[NONCE_SIZE] = {0};
99 struct HksBlob randomIV = {NONCE_SIZE, nonce};
100 int32_t ret = HksGenerateRandom(NULL, &randomIV);
101 if (ret != HKS_SUCCESS) {
102 WIFI_LOGE("wifi encryption generate IV failed");
103 (void)memset_s(&plainText, sizeof(plainText), 0, sizeof(plainText));
104 return ret;
105 }
106 struct HksParam IVParam[] = {
107 { .tag = HKS_TAG_NONCE, .blob = { .size = NONCE_SIZE, .data = nonce } },
108 };
109
110 struct HksParamSet *encryParamSet = nullptr;
111 HksInitParamSet(&encryParamSet);
112 HksAddParams(encryParamSet, g_genParam, sizeof(g_genParam) / sizeof(HksParam));
113 HksAddParams(encryParamSet, IVParam, sizeof(IVParam) / sizeof(HksParam));
114 HksBuildParamSet(&encryParamSet);
115
116 ret = GetKeyByAlias(&authId, encryParamSet);
117 if (ret != HKS_SUCCESS) {
118 WIFI_LOGE("wifi encryption failed");
119 (void)memset_s(&plainText, sizeof(plainText), 0, sizeof(plainText));
120 HksFreeParamSet(&encryParamSet);
121 return ret;
122 }
123
124 uint8_t cipherBuf[AES_COMMON_SIZE] = {0};
125 HksBlob cipherData = {
126 .size = AES_COMMON_SIZE,
127 .data = cipherBuf
128 };
129
130 ret = HksEncrypt(&authId, encryParamSet, &plainText, &cipherData);
131 if (ret != HKS_SUCCESS) {
132 WIFI_LOGE("Hks encryption failed");
133 (void)memset_s(&plainText, sizeof(plainText), 0, sizeof(plainText));
134 HksFreeParamSet(&encryParamSet);
135 return ret;
136 }
137
138 encryptedData.encryptedPassword = ConvertArrayToHex(cipherBuf, cipherData.size);
139 encryptedData.IV = ConvertArrayToHex(nonce, NONCE_SIZE);
140 (void)memset_s(&plainText, sizeof(plainText), 0, sizeof(plainText));
141 HksFreeParamSet(&encryParamSet);
142 return ret;
143 }
144
WifiDecryption(const WifiEncryptionInfo & wifiEncryptionInfo,const EncryptedData & encryptedData,std::string & decryptedData)145 int32_t WifiDecryption(const WifiEncryptionInfo &wifiEncryptionInfo, const EncryptedData &encryptedData,
146 std::string &decryptedData)
147 {
148 if (encryptedData.encryptedPassword.size() == 0) {
149 return HKS_SUCCESS;
150 }
151 struct HksBlob authId = wifiEncryptionInfo.keyAlias;
152 uint8_t cipherBuf[AES_COMMON_SIZE] = {0};
153 uint32_t length = AES_COMMON_SIZE;
154 int32_t retStrToArrat = HexStringToVec(encryptedData.encryptedPassword, cipherBuf, AES_COMMON_SIZE, length);
155 if (retStrToArrat != 0) {
156 (void)memset_s(cipherBuf, AES_COMMON_SIZE, 0, AES_COMMON_SIZE);
157 return HKS_FAILURE;
158 }
159
160 uint8_t nonce[NONCE_SIZE] = {0};
161 uint32_t lengthIV = NONCE_SIZE;
162 retStrToArrat = HexStringToVec(encryptedData.IV, nonce, NONCE_SIZE, lengthIV);
163 if (retStrToArrat != 0) {
164 (void)memset_s(cipherBuf, AES_COMMON_SIZE, 0, AES_COMMON_SIZE);
165 return HKS_FAILURE;
166 }
167 struct HksParam IVParam[] = {
168 { .tag = HKS_TAG_NONCE, .blob = { .size = NONCE_SIZE, .data = nonce } },
169 };
170
171 struct HksBlob cipherData = { length, cipherBuf };
172 struct HksParamSet *decryParamSet = nullptr;
173
174 HksInitParamSet(&decryParamSet);
175 HksAddParams(decryParamSet, g_genParam, sizeof(g_genParam) / sizeof(HksParam));
176 HksAddParams(decryParamSet, IVParam, sizeof(IVParam) / sizeof(HksParam));
177 HksBuildParamSet(&decryParamSet);
178
179 int32_t ret = HksKeyExist(&authId, decryParamSet);
180 if (ret != HKS_SUCCESS) {
181 WIFI_LOGE("wifi decryption key not exist");
182 (void)memset_s(cipherBuf, AES_COMMON_SIZE, 0, AES_COMMON_SIZE);
183 HksFreeParamSet(&decryParamSet);
184 return ret;
185 }
186 uint8_t plainBuff[AES_COMMON_SIZE] = {0};
187 HksBlob plainText = {
188 .size = AES_COMMON_SIZE,
189 .data = plainBuff
190 };
191
192 ret = HksDecrypt(&authId, decryParamSet, &cipherData, &plainText);
193 if (ret != HKS_SUCCESS) {
194 WIFI_LOGE("Hks decryption failed");
195 (void)memset_s(cipherBuf, AES_COMMON_SIZE, 0, AES_COMMON_SIZE);
196 HksFreeParamSet(&decryParamSet);
197 return ret;
198 }
199
200 std::string temp(plainText.data, plainText.data + plainText.size);
201 decryptedData = temp;
202 std::fill(temp.begin(), temp.end(), 0);
203 (void)memset_s(cipherBuf, AES_COMMON_SIZE, 0, AES_COMMON_SIZE);
204 (void)memset_s(&plainText, sizeof(plainText), 0, sizeof(plainText));
205 HksFreeParamSet(&decryParamSet);
206 return ret;
207 }
208
HksUpdateAndFinish(const struct HksBlob * handle,const struct HksParamSet * paramSet,const struct HksBlob * inData,struct HksBlob * outData)209 int32_t HksUpdateAndFinish(const struct HksBlob *handle, const struct HksParamSet *paramSet,
210 const struct HksBlob *inData, struct HksBlob *outData)
211 {
212 uint32_t handledInDataSize = 0;
213 uint32_t handledOutDataSize = 0;
214 uint8_t *handledOutData = outData->data;
215 struct HksBlob inDataSeg = *inData;
216 struct HksBlob outDataSeg = { MAX_UPDATE_SIZE, nullptr };
217 WIFI_LOGI("HksUpdateAndFinish inData.size: %{public}d.", static_cast<int>(inData->size));
218 while (handledInDataSize < inData->size) {
219 uint32_t aesDataLen = std::min(MAX_UPDATE_SIZE, (inData->size - handledInDataSize));
220 inDataSeg.size = aesDataLen;
221 outDataSeg.size = MAX_UPDATE_SIZE + AEAD_SIZE;
222 outDataSeg.data = (uint8_t *)malloc(outDataSeg.size);
223 if (outDataSeg.data == nullptr) {
224 WIFI_LOGE("HksUpdateAndFinish malloc failed.");
225 (void)memset_s(&inDataSeg, sizeof(inDataSeg), 0, sizeof(inDataSeg));
226 return HKS_FAILURE;
227 }
228 int32_t hksResult = 0;
229 if (handledInDataSize + aesDataLen < inData->size) {
230 hksResult = HksUpdate(handle, paramSet, &inDataSeg, &outDataSeg);
231 } else {
232 hksResult = HksFinish(handle, paramSet, &inDataSeg, &outDataSeg);
233 }
234 if (hksResult != HKS_SUCCESS) {
235 WIFI_LOGE("HksUpdateAndFinish do HksUpdate or HksFinish failed: %{public}d.", hksResult);
236 (void)memset_s(&inDataSeg, sizeof(inDataSeg), 0, sizeof(inDataSeg));
237 free(outDataSeg.data);
238 outDataSeg.data = nullptr;
239 return HKS_FAILURE;
240 }
241 if (handledOutDataSize + outDataSeg.size > outData->size) {
242 WIFI_LOGE("HksUpdateAndFinish outData->size is too small.");
243 (void)memset_s(&inDataSeg, sizeof(inDataSeg), 0, sizeof(inDataSeg));
244 free(outDataSeg.data);
245 outDataSeg.data = nullptr;
246 return HKS_FAILURE;
247 }
248 if (memcpy_s(handledOutData, outDataSeg.size, outDataSeg.data, outDataSeg.size) != EOK) {
249 WIFI_LOGE("HksUpdateAndFinish memcpy_s failed.");
250 (void)memset_s(&inDataSeg, sizeof(inDataSeg), 0, sizeof(inDataSeg));
251 free(outDataSeg.data);
252 outDataSeg.data = nullptr;
253 return HKS_FAILURE;
254 }
255 handledOutData += outDataSeg.size;
256 handledOutDataSize += outDataSeg.size;
257 inDataSeg.data += aesDataLen;
258 handledInDataSize += aesDataLen;
259 free(outDataSeg.data);
260 outDataSeg.data = nullptr;
261 }
262 outData->size = handledOutDataSize;
263 WIFI_LOGI("HksUpdateAndFinish outData.size: %{public}d.", static_cast<int>(outData->size));
264 (void)memset_s(&inDataSeg, sizeof(inDataSeg), 0, sizeof(inDataSeg));
265 return HKS_SUCCESS;
266 }
267
ImportKey(const WifiEncryptionInfo & wifiEncryptionInfo,const std::string & key)268 int32_t ImportKey(const WifiEncryptionInfo &wifiEncryptionInfo, const std::string &key)
269 {
270 WIFI_LOGI("ImportKey enter.");
271 uint8_t aesKey[AES_COMMON_SIZE] = { 0 };
272 uint32_t length = 0;
273 if (HexStringToVec(key, aesKey, AES_COMMON_SIZE, length) != 0) {
274 WIFI_LOGE("ImportKey HexStringToVec failed.");
275 return HKS_FAILURE;
276 }
277
278 struct HksBlob hksKey = { length, aesKey };
279 struct HksBlob authId = wifiEncryptionInfo.keyAlias;
280 struct HksParam purposeParam[] = {
281 { .tag = HKS_TAG_PURPOSE, .uint32Param = HKS_KEY_PURPOSE_ENCRYPT | HKS_KEY_PURPOSE_DECRYPT },
282 };
283 struct HksParamSet *encryParamSet = nullptr;
284 HksInitParamSet(&encryParamSet);
285 HksAddParams(encryParamSet, g_genAes256Param, sizeof(g_genAes256Param) / sizeof(HksParam));
286 HksAddParams(encryParamSet, purposeParam, sizeof(purposeParam) / sizeof(HksParam));
287 HksBuildParamSet(&encryParamSet);
288
289 int32_t keyExist = HksKeyExist(&authId, encryParamSet);
290 if (keyExist == HKS_ERROR_NOT_EXIST) {
291 int32_t ret = HksImportKey(&authId, encryParamSet, &hksKey);
292 (void)memset_s(aesKey, sizeof(aesKey), 0, sizeof(aesKey));
293 if (ret != HKS_SUCCESS) {
294 WIFI_LOGE("ImportKey failed: %{public}d.", ret);
295 }
296 HksFreeParamSet(&encryParamSet);
297 return ret;
298 } else if (keyExist == HKS_SUCCESS) {
299 WIFI_LOGI("ImportKey key is exist, donot need import key.");
300 (void)memset_s(aesKey, sizeof(aesKey), 0, sizeof(aesKey));
301 HksFreeParamSet(&encryParamSet);
302 return HKS_SUCCESS;
303 }
304 WIFI_LOGE("ImportKey HksKeyExist check failed: %{public}d.", keyExist);
305 (void)memset_s(aesKey, sizeof(aesKey), 0, sizeof(aesKey));
306 HksFreeParamSet(&encryParamSet);
307 return keyExist;
308 }
309
DeleteKey(const WifiEncryptionInfo & wifiEncryptionInfo)310 int32_t DeleteKey(const WifiEncryptionInfo &wifiEncryptionInfo)
311 {
312 WIFI_LOGI("DeleteKey enter.");
313 struct HksBlob authId = wifiEncryptionInfo.keyAlias;
314 struct HksParam purposeParam[] = {
315 { .tag = HKS_TAG_PURPOSE, .uint32Param = HKS_KEY_PURPOSE_ENCRYPT | HKS_KEY_PURPOSE_DECRYPT },
316 };
317 struct HksParamSet *encryParamSet = nullptr;
318 HksInitParamSet(&encryParamSet);
319 HksAddParams(encryParamSet, g_genAes256Param, sizeof(g_genAes256Param) / sizeof(HksParam));
320 HksAddParams(encryParamSet, purposeParam, sizeof(purposeParam) / sizeof(HksParam));
321 HksBuildParamSet(&encryParamSet);
322
323 int32_t keyExist = HksKeyExist(&authId, encryParamSet);
324 if (keyExist == HKS_SUCCESS) {
325 int32_t ret = HksDeleteKey(&authId, encryParamSet);
326 if (ret != HKS_SUCCESS) {
327 WIFI_LOGE("DeleteKey failed: %{public}d.", ret);
328 }
329 HksFreeParamSet(&encryParamSet);
330 return ret;
331 } else if (keyExist == HKS_ERROR_NOT_EXIST) {
332 WIFI_LOGI("DeleteKey key is not exist, donot need delete key.");
333 HksFreeParamSet(&encryParamSet);
334 return HKS_SUCCESS;
335 }
336 WIFI_LOGE("DeleteKey HksKeyExist check failed: %{public}d.", keyExist);
337 HksFreeParamSet(&encryParamSet);
338 return keyExist;
339 }
340
EncryptParamSet(struct HksParamSet ** encryParamSet,const WifiEncryptionInfo & wifiEncryptionInfo,const EncryptedData & encryptedData)341 int32_t EncryptParamSet(struct HksParamSet **encryParamSet, const WifiEncryptionInfo &wifiEncryptionInfo,
342 const EncryptedData &encryptedData)
343 {
344 uint8_t nonce[AES_256_NONCE_SIZE] = { 0 };
345 uint32_t nonceLength = 0;
346 if (HexStringToVec(encryptedData.IV, nonce, AES_256_NONCE_SIZE, nonceLength) != 0) {
347 WIFI_LOGE("EncryptParamSet HexStringToVec failed.");
348 return HKS_FAILURE;
349 }
350 struct HksBlob encryptNonce = { nonceLength, nonce };
351 struct HksParam encryptParam[] = {
352 { .tag = HKS_TAG_PURPOSE, .uint32Param = HKS_KEY_PURPOSE_ENCRYPT },
353 { .tag = HKS_TAG_NONCE, .blob = { .size = encryptNonce.size, .data = encryptNonce.data } },
354 };
355
356 HksInitParamSet(encryParamSet);
357 HksAddParams(*encryParamSet, g_genAes256Param, sizeof(g_genAes256Param) / sizeof(HksParam));
358 HksAddParams(*encryParamSet, encryptParam, sizeof(encryptParam) / sizeof(HksParam));
359 HksBuildParamSet(encryParamSet);
360
361 struct HksBlob authId = wifiEncryptionInfo.keyAlias;
362 int32_t ret = HksKeyExist(&authId, *encryParamSet);
363 if (ret != HKS_SUCCESS) {
364 WIFI_LOGE("EncryptParamSet Key is not exist.");
365 HksFreeParamSet(encryParamSet);
366 return ret;
367 }
368 return HKS_SUCCESS;
369 }
370
DecryptParamSet(struct HksParamSet ** decryParamSet,const WifiEncryptionInfo & wifiEncryptionInfo,const EncryptedData & encryptedData)371 int32_t DecryptParamSet(struct HksParamSet **decryParamSet, const WifiEncryptionInfo &wifiEncryptionInfo,
372 const EncryptedData &encryptedData)
373 {
374 uint8_t nonce[AES_256_NONCE_SIZE] = { 0 };
375 uint32_t nonceLength = 0;
376 if (HexStringToVec(encryptedData.IV, nonce, AES_256_NONCE_SIZE, nonceLength) != 0) {
377 WIFI_LOGE("DecryptParamSet HexStringToVec failed.");
378 return HKS_FAILURE;
379 }
380 struct HksBlob decryptNonce = { nonceLength, nonce };
381 uint32_t cipherLength = encryptedData.encryptedPassword.length();
382 uint8_t *cipherBuf = reinterpret_cast<uint8_t*>(const_cast<char*>(encryptedData.encryptedPassword.c_str()));
383 if (cipherLength < AEAD_SIZE) {
384 WIFI_LOGE("DecryptParamSet cipherLength is too small.");
385 return HKS_FAILURE;
386 }
387 struct HksBlob decryptAead = { AEAD_SIZE, cipherBuf + cipherLength - AEAD_SIZE };
388 struct HksParam decryptParam[] = {
389 { .tag = HKS_TAG_PURPOSE, .uint32Param = HKS_KEY_PURPOSE_DECRYPT },
390 { .tag = HKS_TAG_NONCE, .blob = { .size = decryptNonce.size, .data = decryptNonce.data } },
391 { .tag = HKS_TAG_AE_TAG, .blob = { .size = decryptAead.size, .data = decryptAead.data } },
392 };
393
394 HksInitParamSet(decryParamSet);
395 HksAddParams(*decryParamSet, g_genAes256Param, sizeof(g_genAes256Param) / sizeof(HksParam));
396 HksAddParams(*decryParamSet, decryptParam, sizeof(decryptParam) / sizeof(HksParam));
397 HksBuildParamSet(decryParamSet);
398
399 struct HksBlob authId = wifiEncryptionInfo.keyAlias;
400 int32_t ret = HksKeyExist(&authId, *decryParamSet);
401 if (ret != HKS_SUCCESS) {
402 WIFI_LOGE("DecryptParamSet Key is not exist.");
403 HksFreeParamSet(decryParamSet);
404 return ret;
405 }
406 return HKS_SUCCESS;
407 }
408
WifiLoopEncrypt(const WifiEncryptionInfo & wifiEncryptionInfo,const std::string & inputString,EncryptedData & encryptedData)409 int32_t WifiLoopEncrypt(const WifiEncryptionInfo &wifiEncryptionInfo, const std::string &inputString,
410 EncryptedData &encryptedData)
411 {
412 if (inputString.length() == 0) {
413 WIFI_LOGI("WifiLoopEncrypt inputString is nullptr.");
414 return HKS_SUCCESS;
415 }
416
417 struct HksParamSet *encryParamSet = nullptr;
418 int32_t ret = EncryptParamSet(&encryParamSet, wifiEncryptionInfo, encryptedData);
419 if (ret != HKS_SUCCESS) {
420 WIFI_LOGE("WifiLoopEncrypt EncryptParamSet failed: %{public}d.", ret);
421 return ret;
422 }
423
424 uint8_t handle[sizeof(uint64_t)] = { 0 };
425 struct HksBlob handleEncrypt = { sizeof(uint64_t), handle };
426 struct HksBlob authId = wifiEncryptionInfo.keyAlias;
427 ret = HksInit(&authId, encryParamSet, &handleEncrypt, nullptr);
428 if (ret != HKS_SUCCESS) {
429 WIFI_LOGE("WifiLoopEncrypt HksInit failed: %{public}d.", ret);
430 HksFreeParamSet(&encryParamSet);
431 return ret;
432 }
433
434 struct HksBlob inData = { inputString.length(), (uint8_t *)&inputString[0] };
435 uint8_t *cipherBuf = (uint8_t *)malloc(inputString.length() + AEAD_SIZE);
436 if (cipherBuf == nullptr) {
437 WIFI_LOGE("WifiLoopEncrypt malloc failed.");
438 (void)memset_s(&inData, sizeof(inData), 0, sizeof(inData));
439 HksFreeParamSet(&encryParamSet);
440 return HKS_FAILURE;
441 }
442 struct HksBlob outData = { inputString.length() + AEAD_SIZE, cipherBuf };
443 ret = HksUpdateAndFinish(&handleEncrypt, encryParamSet, &inData, &outData);
444 if (ret != HKS_SUCCESS) {
445 WIFI_LOGE("WifiLoopEncrypt HksUpdateAndFinish failed: %{public}d.", ret);
446 (void)memset_s(&inData, sizeof(inData), 0, sizeof(inData));
447 (void)memset_s(&outData, sizeof(outData), 0, sizeof(outData));
448 HksFreeParamSet(&encryParamSet);
449 free(cipherBuf);
450 cipherBuf = nullptr;
451 return ret;
452 }
453
454 std::string temp(outData.data, outData.data + outData.size);
455 encryptedData.encryptedPassword = temp;
456 std::fill(temp.begin(), temp.end(), 0);
457 (void)memset_s(&inData, sizeof(inData), 0, sizeof(inData));
458 (void)memset_s(&outData, sizeof(outData), 0, sizeof(outData));
459 HksFreeParamSet(&encryParamSet);
460 free(cipherBuf);
461 cipherBuf = nullptr;
462 return ret;
463 }
464
WifiLoopDecrypt(const WifiEncryptionInfo & wifiEncryptionInfo,const EncryptedData & encryptedData,std::string & decryptedData)465 int32_t WifiLoopDecrypt(const WifiEncryptionInfo &wifiEncryptionInfo, const EncryptedData &encryptedData,
466 std::string &decryptedData)
467 {
468 if (encryptedData.encryptedPassword.length() == 0) {
469 WIFI_LOGI("WifiLoopDecrypt encryptedData is nullptr.");
470 return HKS_SUCCESS;
471 }
472
473 struct HksParamSet *decryParamSet = nullptr;
474 int32_t ret = DecryptParamSet(&decryParamSet, wifiEncryptionInfo, encryptedData);
475 if (ret != HKS_SUCCESS) {
476 WIFI_LOGE("WifiLoopDecrypt DecryptParamSet failed: %{public}d.", ret);
477 return ret;
478 }
479
480 uint8_t handle[sizeof(uint64_t)] = { 0 };
481 struct HksBlob handleDecrypt = { sizeof(uint64_t), handle };
482 struct HksBlob authId = wifiEncryptionInfo.keyAlias;
483 ret = HksInit(&authId, decryParamSet, &handleDecrypt, nullptr);
484 if (ret != HKS_SUCCESS) {
485 WIFI_LOGE("WifiLoopDecrypt HksInit failed: %{public}d.", ret);
486 HksFreeParamSet(&decryParamSet);
487 return ret;
488 }
489
490 uint32_t cipherLength = encryptedData.encryptedPassword.length();
491 uint8_t *cipherBuf = reinterpret_cast<uint8_t*>(const_cast<char*>(encryptedData.encryptedPassword.c_str()));
492 struct HksBlob inData = { cipherLength - AEAD_SIZE, cipherBuf };
493 uint8_t *plainBuf = (uint8_t *)malloc(cipherLength);
494 if (plainBuf == nullptr) {
495 WIFI_LOGE("WifiLoopDecrypt malloc failed.");
496 (void)memset_s(&inData, sizeof(inData), 0, sizeof(inData));
497 HksFreeParamSet(&decryParamSet);
498 return HKS_FAILURE;
499 }
500 struct HksBlob outData = { cipherLength, plainBuf };
501 ret = HksUpdateAndFinish(&handleDecrypt, decryParamSet, &inData, &outData);
502 if (ret != HKS_SUCCESS) {
503 WIFI_LOGE("WifiLoopDecrypt HksUpdateAndFinish failed: %{public}d.", ret);
504 (void)memset_s(&inData, sizeof(inData), 0, sizeof(inData));
505 (void)memset_s(&outData, sizeof(outData), 0, sizeof(outData));
506 HksFreeParamSet(&decryParamSet);
507 free(plainBuf);
508 plainBuf = nullptr;
509 return ret;
510 }
511 std::string temp(outData.data, outData.data + outData.size);
512 if (memset_s(outData.data, outData.size, 0, outData.size) != EOK ||
513 memset_s(inData.data, inData.size, 0, inData.size) != EOK) {
514 WIFI_LOGE("WifiLoopDecrypt memset_s return error!");
515 HksFreeParamSet(&decryParamSet);
516 free(plainBuf);
517 plainBuf = nullptr;
518 return HKS_FAILURE;
519 }
520 decryptedData = temp;
521 std::fill(temp.begin(), temp.end(), 0);
522 HksFreeParamSet(&decryParamSet);
523 free(plainBuf);
524 plainBuf = nullptr;
525 return ret;
526 }
527
InitParamSet(struct HksParamSet ** paramSet,const struct HksParam * params,uint32_t paramCount)528 static int32_t InitParamSet(struct HksParamSet **paramSet, const struct HksParam *params, uint32_t paramCount)
529 {
530 int32_t ret = HksInitParamSet(paramSet);
531 if (ret != HKS_SUCCESS) {
532 WIFI_LOGE("%{public}s HksInitParamSet failed %{public}d", __func__, ret);
533 return ret;
534 }
535 ret = HksAddParams(*paramSet, params, paramCount);
536 if (ret != HKS_SUCCESS) {
537 WIFI_LOGE("%{public}s HksAddParams failed %{public}d", __func__, ret);
538 HksFreeParamSet(paramSet);
539 return ret;
540 }
541 ret = HksBuildParamSet(paramSet);
542 if (ret != HKS_SUCCESS) {
543 WIFI_LOGE("%{public}s HksBuildParamSet failed %{public}d", __func__, ret);
544 HksFreeParamSet(paramSet);
545 return ret;
546 }
547 return ret;
548 }
549
550 static const uint32_t HMAC_COMMON_SIZE = 1024;
CalculateHksHmac(const struct HksBlob * keyAlias,const struct HksParamSet * hmacParamSet,const struct HksBlob * inData,struct HksBlob * hashText)551 static int32_t CalculateHksHmac(const struct HksBlob *keyAlias, const struct HksParamSet *hmacParamSet,
552 const struct HksBlob *inData, struct HksBlob *hashText)
553 {
554 uint8_t handleE[sizeof(uint64_t)] = {0};
555 struct HksBlob handle = {sizeof(uint64_t), handleE};
556 int32_t ret = HksInit(keyAlias, hmacParamSet, &handle, nullptr);
557 if (ret != HKS_SUCCESS) {
558 WIFI_LOGE("%{public}s HksInit failed %{public}d", __func__, ret);
559 return ret;
560 }
561 ret = HksFinish(&handle, hmacParamSet, inData, hashText);
562 return ret;
563 }
564
WifiGenerateMacRandomizationSecret(const std::string & keyName,const std::string & data,std::vector<uint8_t> & outPlant)565 int32_t WifiGenerateMacRandomizationSecret(const std::string &keyName,
566 const std::string &data, std::vector<uint8_t> &outPlant)
567 {
568 if (keyName.empty() || data.empty()) {
569 WIFI_LOGE("%{public}s failed keyName or data is empty", __func__);
570 return -1;
571 }
572 struct HksBlob keyAlias = {
573 .size = (uint32_t)keyName.length(),
574 .data = (uint8_t *)(&keyName[0])
575 };
576 struct HksParamSet *hmacParamSet = nullptr;
577 int32_t ret = InitParamSet(&hmacParamSet, g_genHmacParams, sizeof(g_genHmacParams) / sizeof(HksParam));
578 if (ret != HKS_SUCCESS) {
579 WIFI_LOGE("%{public}s InitParamSet:[%{public}s] failed:%{public}d", __func__, keyName.c_str(), ret);
580 return ret;
581 }
582
583 ret = GetKeyByAlias(&keyAlias, hmacParamSet);
584 if (ret == HKS_ERROR_NOT_EXIST) {
585 WIFI_LOGE("%{public}s GetKeyByAlias:[%{public}s] failed:%{public}d", __func__, keyName.c_str(), ret);
586 HksFreeParamSet(&hmacParamSet);
587 return ret;
588 }
589
590 struct HksBlob inData = {
591 .size = (uint32_t)data.length(),
592 .data = (uint8_t *)&data[0]
593 };
594 uint8_t cipher[HMAC_COMMON_SIZE] = {0};
595 struct HksBlob hashText = {
596 .size = HMAC_COMMON_SIZE,
597 .data = cipher
598 };
599 ret = CalculateHksHmac(&keyAlias, hmacParamSet, &inData, &hashText);
600 if (ret != HKS_SUCCESS) {
601 WIFI_LOGE("%{public}s HksHmacTest failed :%{public}d", __func__, ret);
602 HksFreeParamSet(&hmacParamSet);
603 return ret;
604 }
605
606 outPlant.clear();
607 for (size_t i = 0; i < hashText.size; i++) {
608 outPlant.emplace_back(hashText.data[i]);
609 }
610 HksFreeParamSet(&hmacParamSet);
611 return 0;
612 }
613
614 } // namespace Wifi
615 } // namespace OHOS
616 #endif