1 /*
2 * Copyright (c) 2020-2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16
17 #ifndef _CUT_AUTHENTICATE_
18 #ifdef _STORAGE_LITE_
19
20 #include "hks_keyblob.h"
21 #include "hks_crypto_hal.h"
22 #include "hks_log.h"
23 #include "hks_mem.h"
24 #include "hks_param.h"
25 #include "hks_storage_adapter.h"
26 #include "hks_template.h"
27
28 #include <securec.h>
29
30 static const char g_deriveKekTag[] = "derive_key";
31 static const char g_deriveNonceTag[] = "derive_nonce";
32
33 enum DeriveType {
34 DERIVE_KEK = 0,
35 DERIVE_NONCE = 1,
36 };
37
HksBlobInit(struct HksBlob * blob,uint32_t size)38 static int32_t HksBlobInit(struct HksBlob *blob, uint32_t size)
39 {
40 blob->data = (uint8_t *)HksMalloc(size);
41 HKS_IF_NULL_LOGE_RETURN(blob->data, HKS_ERROR_MALLOC_FAIL, "malloc failed")
42
43 blob->size = size;
44 return HKS_SUCCESS;
45 }
46
GetSalt(enum DeriveType type,const struct HksBlob * random,struct HksBlob * salt)47 static int32_t GetSalt(enum DeriveType type, const struct HksBlob *random, struct HksBlob *salt)
48 {
49 struct HksBlob tag = { 0, NULL };
50 if (type == DERIVE_KEK) {
51 tag.size = strlen(g_deriveKekTag);
52 tag.data = (uint8_t *)g_deriveKekTag;
53 } else if (type == DERIVE_NONCE) {
54 tag.size = strlen(g_deriveNonceTag);
55 tag.data = (uint8_t *)g_deriveNonceTag;
56 }
57
58 int32_t ret = HksBlobInit(salt, random->size + tag.size);
59 HKS_IF_NOT_SUCC_RETURN(ret, ret)
60
61 if ((memcpy_s(salt->data, salt->size, random->data, random->size) != EOK) ||
62 (memcpy_s(salt->data + random->size, salt->size - random->size, tag.data, tag.size) != EOK)) {
63 HKS_FREE(salt->data);
64 return HKS_ERROR_INSUFFICIENT_MEMORY;
65 }
66 return ret;
67 }
68
GetDeriveMaterial(enum DeriveType type,const struct HksBlob * random,struct HksBlob * derivedMaterial)69 static int32_t GetDeriveMaterial(enum DeriveType type, const struct HksBlob *random, struct HksBlob *derivedMaterial)
70 {
71 uint8_t keyBuf[HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256)] = {0};
72 struct HksBlob mk = { HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256), keyBuf };
73
74 int32_t ret = HksCryptoHalGetMainKey(NULL, &mk);
75 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get kek failed, ret = %" LOG_PUBLIC "d", ret)
76
77 struct HksBlob salt = { 0, NULL };
78 ret = GetSalt(type, random, &salt);
79 if (ret != HKS_SUCCESS) {
80 HKS_LOG_E("get salt failed, ret = %" LOG_PUBLIC "d", ret);
81 (void)memset_s(mk.data, mk.size, 0, mk.size);
82 return ret;
83 }
84
85 struct HksKeyDerivationParam derParam = {
86 .salt = salt,
87 .iterations = HKS_KEY_BLOB_DERIVE_CNT,
88 .digestAlg = HKS_DIGEST_SHA256,
89 };
90 struct HksKeySpec derivationSpec = { HKS_ALG_PBKDF2, HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256), &derParam };
91 ret = HksCryptoHalDeriveKey(&mk, &derivationSpec, derivedMaterial);
92 HKS_IF_NOT_SUCC_LOGE(ret, "get keyblob derive material failed, type = %" LOG_PUBLIC "u", type)
93
94 HKS_FREE_BLOB(salt);
95 (void)memset_s(mk.data, mk.size, 0, mk.size);
96 return ret;
97 }
98
BuildKeyBlobUsageSpec(const struct HksBlob * cipherKey,const struct HksBlob * random,bool isEncrypt,struct HksUsageSpec * usageSpec)99 static int32_t BuildKeyBlobUsageSpec(const struct HksBlob *cipherKey, const struct HksBlob *random,
100 bool isEncrypt, struct HksUsageSpec *usageSpec)
101 {
102 usageSpec->mode = HKS_MODE_GCM;
103 usageSpec->padding = HKS_PADDING_NONE;
104 usageSpec->digest = HKS_DIGEST_NONE;
105 usageSpec->algType = HKS_ALG_AES;
106
107 struct HksStoreKeyInfo *keyInfo = (struct HksStoreKeyInfo *)cipherKey->data;
108
109 /* get nonce, derive from random + tag("derive_nonce") */
110 struct HksBlob nonce = { 0, NULL };
111 int32_t ret = HksBlobInit(&nonce, HKS_KEY_BLOB_NONCE_SIZE); /* need free by caller function */
112 HKS_IF_NOT_SUCC_RETURN(ret, ret)
113
114 ret = GetDeriveMaterial(DERIVE_NONCE, random, &nonce);
115 if (ret != HKS_SUCCESS) {
116 HKS_LOG_E("get derive material nonce failed, ret = %" LOG_PUBLIC "d", ret);
117 HKS_FREE(nonce.data);
118 return ret;
119 }
120
121 /* aad: from keyInfo->keySize to authId */
122 struct HksBlob aad = {
123 .size = sizeof(*keyInfo) - sizeof(keyInfo->keyInfoLen) + keyInfo->aliasSize + keyInfo->authIdSize,
124 .data = cipherKey->data + sizeof(keyInfo->keyInfoLen)
125 };
126
127 struct HksAeadParam *aeadParam = (struct HksAeadParam *)usageSpec->algParam;
128 aeadParam->nonce = nonce;
129 aeadParam->aad = aad;
130 aeadParam->payloadLen = keyInfo->keySize - HKS_AE_TAG_LEN;
131
132 if (isEncrypt) {
133 aeadParam->tagLenEnc = HKS_AE_TAG_LEN;
134 } else {
135 aeadParam->tagDec.data = cipherKey->data + keyInfo->keyInfoLen - HKS_AE_TAG_LEN; /* the last 16 bytes */
136 aeadParam->tagDec.size = HKS_AE_TAG_LEN;
137 }
138 return HKS_SUCCESS;
139 }
140
EncryptAndDecryptKeyBlob(struct HksBlob * rawKey,struct HksBlob * cipherKey,bool isEncrypt)141 static int32_t EncryptAndDecryptKeyBlob(struct HksBlob *rawKey, struct HksBlob *cipherKey, bool isEncrypt)
142 {
143 struct HksStoreKeyInfo *keyInfo = (struct HksStoreKeyInfo *)cipherKey->data;
144 int32_t ret;
145
146 /* 1. generate random */
147 struct HksBlob random = { HKS_DEFAULT_RANDOM_LEN, keyInfo->random };
148 if (isEncrypt) {
149 ret = HksCryptoHalFillRandom(&random);
150 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get random failed")
151 }
152
153 /* 2. get kek, derive from random + tag("derive_kek") */
154 uint8_t kekBuf[HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256)] = {0};
155 struct HksBlob kek = { HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256), kekBuf };
156 ret = GetDeriveMaterial(DERIVE_KEK, &random, &kek);
157 HKS_IF_NOT_SUCC_RETURN(ret, ret)
158
159 /* 3. get usage spec */
160 struct HksAeadParam aeadParam = {0};
161 struct HksUsageSpec usageSpec = { .algParam = (void *)&aeadParam };
162 ret = BuildKeyBlobUsageSpec(cipherKey, &random, isEncrypt, &usageSpec);
163 if (ret != HKS_SUCCESS) {
164 (void)memset_s(kekBuf, HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256), 0, HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256));
165 return ret;
166 }
167
168 /* 4. get encrypted/decrypted key */
169 struct HksBlob encKey = { keyInfo->keySize, cipherKey->data + keyInfo->keyInfoLen - keyInfo->keySize };
170 if (isEncrypt) {
171 struct HksBlob tag = { HKS_AE_TAG_LEN, cipherKey->data + keyInfo->keyInfoLen - HKS_AE_TAG_LEN };
172 ret = HksCryptoHalEncrypt(&kek, &usageSpec, rawKey, &encKey, &tag);
173 } else {
174 encKey.size -= HKS_AE_TAG_LEN; /* the decrypt len should remove the tag len */
175 ret = HksCryptoHalDecrypt(&kek, &usageSpec, &encKey, rawKey);
176 }
177 HKS_IF_NOT_SUCC_LOGE(ret, "cipher key[0x%" LOG_PUBLIC "x] failed, ret = %" LOG_PUBLIC "d", isEncrypt, ret)
178
179 /* need clean kek buf */
180 (void)memset_s(kekBuf, HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256), 0, HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256));
181 HKS_FREE_BLOB(aeadParam.nonce);
182 return ret;
183 }
184
EncryptKeyBlob(const struct HksBlob * rawKey,struct HksBlob * cipherKey)185 static int32_t EncryptKeyBlob(const struct HksBlob *rawKey, struct HksBlob *cipherKey)
186 {
187 return EncryptAndDecryptKeyBlob((struct HksBlob *)rawKey, cipherKey, true);
188 }
189
DecryptKeyBlob(const struct HksBlob * cipherKey,struct HksBlob * rawKey)190 static int32_t DecryptKeyBlob(const struct HksBlob *cipherKey, struct HksBlob *rawKey)
191 {
192 return EncryptAndDecryptKeyBlob(rawKey, (struct HksBlob *)cipherKey, false);
193 }
194
CopyKey(const struct HksBlob * key,struct HksBlob * adjustedKey)195 static int32_t CopyKey(const struct HksBlob *key, struct HksBlob *adjustedKey)
196 {
197 int32_t ret = HksBlobInit(adjustedKey, key->size);
198 HKS_IF_NOT_SUCC_RETURN(ret, ret)
199
200 if (memcpy_s(adjustedKey->data, adjustedKey->size, key->data, key->size) != EOK) {
201 HKS_FREE(adjustedKey->data);
202 return HKS_ERROR_INSUFFICIENT_MEMORY;
203 }
204 return ret;
205 }
206
Ed25519BlobToKeyMaterial(const struct HksBlob * key,struct HksBlob * adjustedKey)207 static int32_t Ed25519BlobToKeyMaterial(const struct HksBlob *key, struct HksBlob *adjustedKey)
208 {
209 if (key->size != (HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256) << 1)) {
210 HKS_LOG_E("invalid keySize %" LOG_PUBLIC "u", key->size);
211 return HKS_ERROR_INVALID_KEY_FILE;
212 }
213
214 int32_t ret = HksBlobInit(adjustedKey, sizeof(struct KeyMaterial25519) +
215 (HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256) << 1));
216 HKS_IF_NOT_SUCC_RETURN(ret, ret)
217
218 (void)memset_s(adjustedKey->data, adjustedKey->size, 0, adjustedKey->size);
219
220 struct KeyMaterial25519 *keyMaterial = (struct KeyMaterial25519 *)adjustedKey->data;
221 keyMaterial->keyAlg = HKS_ALG_ED25519;
222 keyMaterial->keySize = HKS_CURVE25519_KEY_SIZE_256;
223 keyMaterial->pubKeySize = HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256);
224 keyMaterial->priKeySize = HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256);
225
226 uint32_t offset = sizeof(*keyMaterial);
227 /* copy public key: the first 32 bytes of input key value; then private key: next 32 bytes */
228 if (memcpy_s(adjustedKey->data + offset, adjustedKey->size - offset,
229 key->data, (HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256) << 1)) != EOK) {
230 HKS_LOG_E("copy ed25519 public and private value failed");
231 (void)memset_s(adjustedKey->data, adjustedKey->size, 0, adjustedKey->size);
232 HKS_FREE(adjustedKey->data);
233 return HKS_ERROR_INSUFFICIENT_MEMORY;
234 }
235 return ret;
236 }
237
Ed25519KeyMaterialToBlob(const struct HksBlob * key,struct HksBlob * adjustedKey)238 static int32_t Ed25519KeyMaterialToBlob(const struct HksBlob *key, struct HksBlob *adjustedKey)
239 {
240 if (key->size < sizeof(struct KeyMaterial25519)) {
241 HKS_LOG_E("key size invalid, size = %" LOG_PUBLIC "u smaller than struct size", key->size);
242 return HKS_ERROR_INVALID_KEY_INFO;
243 }
244
245 struct KeyMaterial25519 *keyMaterial = (struct KeyMaterial25519 *)key->data;
246 if ((keyMaterial->pubKeySize != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256)) ||
247 (keyMaterial->priKeySize != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256)) ||
248 (key->size < (sizeof(*keyMaterial) + keyMaterial->pubKeySize + keyMaterial->priKeySize))) {
249 HKS_LOG_E("key size invalid, keySize = %" LOG_PUBLIC "u, pubSize %" LOG_PUBLIC "u, priSize %" LOG_PUBLIC "u",
250 key->size, keyMaterial->pubKeySize, keyMaterial->priKeySize);
251 return HKS_ERROR_INVALID_KEY_INFO;
252 }
253
254 int32_t ret = HksBlobInit(adjustedKey, keyMaterial->priKeySize + keyMaterial->pubKeySize);
255 HKS_IF_NOT_SUCC_RETURN(ret, ret)
256
257 /* 32 bytes pubkey first, then 32 bytes private key */
258 if (memcpy_s(adjustedKey->data, adjustedKey->size, key->data + sizeof(*keyMaterial),
259 keyMaterial->pubKeySize + keyMaterial->priKeySize) != EOK) {
260 HKS_LOG_E("copy pubKey and private key failed.");
261 HKS_FREE(adjustedKey->data);
262 return HKS_ERROR_INSUFFICIENT_MEMORY;
263 }
264 return ret;
265 }
266
GetRawKeyMaterial(const struct HksBlob * key,struct HksBlob * rawKey)267 static int32_t GetRawKeyMaterial(const struct HksBlob *key, struct HksBlob *rawKey)
268 {
269 if (key->size < sizeof(struct HksStoreKeyInfo)) {
270 HKS_LOG_E("invalid key, size too small, size = %" LOG_PUBLIC "u", key->size);
271 return HKS_ERROR_INVALID_KEY_INFO;
272 }
273
274 struct HksStoreKeyInfo *keyInfo = (struct HksStoreKeyInfo *)key->data;
275 if (HksIsKeyInfoLenInvalid(keyInfo)) {
276 HKS_LOG_E("invalid keyInfoBlob len");
277 return HKS_ERROR_INVALID_KEY_INFO;
278 }
279
280 struct HksBlob tmpKey = { 0, NULL };
281 int32_t ret = HksBlobInit(&tmpKey, keyInfo->keySize);
282 HKS_IF_NOT_SUCC_RETURN(ret, ret)
283
284 ret = DecryptKeyBlob(key, &tmpKey);
285 if (ret != HKS_SUCCESS) {
286 HKS_LOG_E("decrypt key blob failed, ret = %" LOG_PUBLIC "d", ret);
287 HKS_FREE_BLOB(tmpKey);
288 return ret;
289 }
290
291 if ((keyInfo->keyAlg == HKS_ALG_ED25519) && (keyInfo->flag == HKS_KEY_FLAG_GENERATE_KEY)) {
292 ret = Ed25519BlobToKeyMaterial(&tmpKey, rawKey);
293 } else {
294 ret = CopyKey(&tmpKey, rawKey);
295 }
296 HKS_IF_NOT_SUCC_LOGE(ret, "operate failed, alg:%" LOG_PUBLIC "u, ret = %" LOG_PUBLIC "d", keyInfo->keyAlg, ret)
297
298 (void)memset_s(tmpKey.data, tmpKey.size, 0, tmpKey.size);
299 HKS_FREE_BLOB(tmpKey);
300 return HKS_SUCCESS;
301 }
302
HksGenerateKeyNode(const struct HksBlob * key)303 struct HksKeyNode *HksGenerateKeyNode(const struct HksBlob *key)
304 {
305 if (key->size > MAX_KEY_SIZE) {
306 HKS_LOG_E("invalid key blob size %" LOG_PUBLIC "x", key->size);
307 return NULL;
308 }
309 struct HksKeyNode *keyNode = (struct HksKeyNode *)HksMalloc(sizeof(struct HksKeyNode));
310 HKS_IF_NULL_LOGE_RETURN(keyNode, NULL, "malloc keynode failed")
311
312 keyNode->refCnt = 1;
313 keyNode->status = HKS_KEYNODE_INACTIVE;
314 keyNode->handle = 0;
315
316 int32_t ret;
317 do {
318 struct HksBlob rawKey = { 0, NULL };
319 ret = GetRawKeyMaterial(key, &rawKey);
320 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "get raw key material failed, ret = %" LOG_PUBLIC "d", ret)
321
322 struct HksParamSet *keyBlobParamSet = NULL;
323 ret = TranslateKeyInfoBlobToParamSet(&rawKey, key, &keyBlobParamSet);
324 (void)memset_s(rawKey.data, rawKey.size, 0, rawKey.size);
325 HKS_FREE_BLOB(rawKey);
326
327 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "translate key info to paramset failed, ret = %" LOG_PUBLIC "d", ret)
328
329 keyNode->paramSet = keyBlobParamSet;
330 } while (0);
331
332 if (ret != HKS_SUCCESS) {
333 HKS_FREE(keyNode);
334 return NULL;
335 }
336
337 return keyNode;
338 }
339
FillBaseInfo(const struct HksParamSet * paramSet,struct HksBlob * keyOut)340 static int32_t FillBaseInfo(const struct HksParamSet *paramSet, struct HksBlob *keyOut)
341 {
342 struct HksStoreKeyInfo *keyInfo = (struct HksStoreKeyInfo *)keyOut->data;
343 for (uint32_t i = 0; i < paramSet->paramsCnt; i++) {
344 switch (paramSet->params[i].tag) {
345 case HKS_TAG_ALGORITHM:
346 keyInfo->keyAlg = paramSet->params[i].uint32Param;
347 break;
348 case HKS_TAG_PADDING:
349 keyInfo->padding = paramSet->params[i].uint32Param;
350 break;
351 case HKS_TAG_DIGEST:
352 keyInfo->digest = paramSet->params[i].uint32Param;
353 break;
354 case HKS_TAG_BLOCK_MODE:
355 keyInfo->keyMode = paramSet->params[i].uint32Param;
356 break;
357 case HKS_TAG_PURPOSE:
358 keyInfo->purpose = paramSet->params[i].uint32Param;
359 break;
360 case HKS_TAG_KEY_SIZE:
361 keyInfo->keyLen = paramSet->params[i].uint32Param;
362 break;
363 case HKS_TAG_KEY_ROLE:
364 keyInfo->role = paramSet->params[i].uint32Param;
365 break;
366 case HKS_TAG_KEY_DOMAIN:
367 keyInfo->domain = paramSet->params[i].uint32Param;
368 break;
369 case HKS_TAG_KEY_AUTH_ID:
370 if (paramSet->params[i].blob.size > HKS_MAX_KEY_AUTH_ID_LEN) {
371 HKS_LOG_E("invlaid authId size %" LOG_PUBLIC "u", paramSet->params[i].blob.size);
372 return HKS_ERROR_INVALID_ARGUMENT;
373 }
374 if (memcpy_s(keyOut->data + sizeof(*keyInfo) + keyInfo->aliasSize, HKS_MAX_KEY_AUTH_ID_LEN,
375 paramSet->params[i].blob.data, paramSet->params[i].blob.size) != EOK) {
376 HKS_LOG_E("memcpy key auth id failed");
377 return HKS_ERROR_INSUFFICIENT_MEMORY;
378 }
379 keyInfo->authIdSize = paramSet->params[i].blob.size;
380 break;
381 default:
382 break;
383 }
384 }
385 return HKS_SUCCESS;
386 }
387
FillStoreKeyInfo(const struct HksBlob * keyAlias,uint8_t keyFlag,const struct HksBlob * key,const struct HksParamSet * paramSet,struct HksBlob * keyOut)388 static int32_t FillStoreKeyInfo(const struct HksBlob *keyAlias, uint8_t keyFlag, const struct HksBlob *key,
389 const struct HksParamSet *paramSet, struct HksBlob *keyOut)
390 {
391 if ((keyAlias->size > HKS_MAX_KEY_ALIAS_LEN) || (key->size > HKS_MAX_KEY_LEN)) {
392 HKS_LOG_E("invalid keyAlias size %" LOG_PUBLIC "u, or key size %" LOG_PUBLIC "u", keyAlias->size, key->size);
393 return HKS_ERROR_INVALID_ARGUMENT;
394 }
395
396 struct HksStoreKeyInfo *keyInfo = (struct HksStoreKeyInfo *)keyOut->data;
397 keyInfo->flag = keyFlag;
398 keyInfo->keySize = key->size + HKS_AE_TAG_LEN;
399
400 /* 1. copy keyAlias */
401 if (memcpy_s(keyOut->data + sizeof(*keyInfo), HKS_MAX_KEY_ALIAS_LEN, keyAlias->data, keyAlias->size) != EOK) {
402 HKS_LOG_E("memcpy keyAlias failed");
403 return HKS_ERROR_INSUFFICIENT_MEMORY;
404 }
405 keyInfo->aliasSize = keyAlias->size;
406
407 /* 2. copy keyAuthId, keyAlg, purpose ect. */
408 int32_t ret = FillBaseInfo(paramSet, keyOut);
409 HKS_IF_NOT_SUCC_RETURN(ret, ret)
410
411 keyInfo->keyInfoLen = sizeof(*keyInfo) + keyInfo->aliasSize + keyInfo->authIdSize + keyInfo->keySize;
412
413 /* 3. encrypt key */
414 ret = EncryptKeyBlob(key, keyOut);
415 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "encrypt key blob failed, ret = %" LOG_PUBLIC "d", ret)
416
417 keyOut->size = keyInfo->keyInfoLen;
418
419 return ret;
420 }
421
AdjustKey(uint8_t keyFlag,const struct HksParamSet * paramSet,const struct HksBlob * key,struct HksBlob * adjustedKey)422 static int32_t AdjustKey(uint8_t keyFlag, const struct HksParamSet *paramSet,
423 const struct HksBlob *key, struct HksBlob *adjustedKey)
424 {
425 struct HksParam *algParam = NULL;
426 int32_t ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &algParam);
427 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get alg param failed")
428
429 /* for storage-restricted products, when generate ed25519 key, only 64-byte private key can be stored */
430 if ((algParam->uint32Param == HKS_ALG_ED25519) && (keyFlag == HKS_KEY_FLAG_GENERATE_KEY)) {
431 ret = Ed25519KeyMaterialToBlob(key, adjustedKey);
432 } else {
433 ret = CopyKey(key, adjustedKey);
434 }
435 HKS_IF_NOT_SUCC_LOGE(ret,
436 "operate failed, alg = %" LOG_PUBLIC "u, ret = %" LOG_PUBLIC "d", algParam->uint32Param, ret)
437
438 return ret;
439 }
440
HksGetRawKey(const struct HksParamSet * paramSet,struct HksBlob * rawKey)441 int32_t HksGetRawKey(const struct HksParamSet *paramSet, struct HksBlob *rawKey)
442 {
443 struct HksParam *keyParam = NULL;
444 int32_t ret = HksGetParam(paramSet, HKS_TAG_KEY, &keyParam);
445 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get key param failed!")
446
447 uint8_t *data = HksMalloc(keyParam->blob.size);
448 HKS_IF_NULL_LOGE_RETURN(data, HKS_ERROR_MALLOC_FAIL, "fail to malloc raw key")
449
450 (void)memcpy_s(data, keyParam->blob.size, keyParam->blob.data, keyParam->blob.size);
451
452 rawKey->size = keyParam->blob.size;
453 rawKey->data = data;
454 return HKS_SUCCESS;
455 }
456
HksBuildKeyBlob(const struct HksBlob * keyAlias,uint8_t keyFlag,const struct HksBlob * key,const struct HksParamSet * paramSet,struct HksBlob * keyOut)457 int32_t HksBuildKeyBlob(const struct HksBlob *keyAlias, uint8_t keyFlag, const struct HksBlob *key,
458 const struct HksParamSet *paramSet, struct HksBlob *keyOut)
459 {
460 struct HksBlob adjustedKey = { 0, NULL };
461 int32_t ret = AdjustKey(keyFlag, paramSet, key, &adjustedKey);
462 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "adjust key failed, ret = %" LOG_PUBLIC "d", ret)
463
464 struct HksBlob tmpOut = { 0, NULL };
465 do {
466 uint32_t totalLen = sizeof(struct HksStoreKeyInfo) + HKS_MAX_KEY_ALIAS_LEN + HKS_MAX_KEY_AUTH_ID_LEN +
467 HKS_MAX_KEY_MATERIAL_LEN;
468 ret = HksBlobInit(&tmpOut, totalLen);
469 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "hks blob init failed, ret = %" LOG_PUBLIC "d", ret)
470
471 (void)memset_s(tmpOut.data, tmpOut.size, 0, tmpOut.size); /* need init 0 */
472
473 ret = FillStoreKeyInfo(keyAlias, keyFlag, &adjustedKey, paramSet, &tmpOut);
474 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "fill storage key info failed, ret = %" LOG_PUBLIC "d", ret)
475
476 if (memcpy_s(keyOut->data, keyOut->size, tmpOut.data, tmpOut.size) != EOK) {
477 HKS_LOG_E("copy keyblob out failed!");
478 ret = HKS_ERROR_INSUFFICIENT_MEMORY;
479 break;
480 }
481 keyOut->size = tmpOut.size;
482 } while (0);
483
484 (void)memset_s(adjustedKey.data, adjustedKey.size, 0, adjustedKey.size); /* need clean key */
485 HKS_FREE_BLOB(adjustedKey);
486 HKS_FREE_BLOB(tmpOut);
487 return ret;
488 }
489
HksGetRawKeyMaterial(const struct HksBlob * key,struct HksBlob * rawKey)490 int32_t HksGetRawKeyMaterial(const struct HksBlob *key, struct HksBlob *rawKey)
491 {
492 return GetRawKeyMaterial(key, rawKey);
493 }
494
HksTranslateKeyInfoBlobToParamSet(const struct HksBlob * key,const struct HksBlob * keyInfoBlob,struct HksParamSet ** paramSet)495 int32_t HksTranslateKeyInfoBlobToParamSet(const struct HksBlob *key, const struct HksBlob *keyInfoBlob,
496 struct HksParamSet **paramSet)
497 {
498 return TranslateKeyInfoBlobToParamSet(key, keyInfoBlob, paramSet);
499 }
500
501 #endif /* _STORAGE_LITE_ */
502 #endif /* _CUT_AUTHENTICATE_ */
503