• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (c) 2021-2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *    http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #ifdef HKS_CONFIG_FILE
17 #include HKS_CONFIG_FILE
18 #else
19 #include "hks_config.h"
20 #endif
21 
22 #include "hks_check_paramset.h"
23 
24 #ifdef L2_STANDARD
25 #include "hks_openssl_dh.h"
26 #include "hks_openssl_rsa.h"
27 #endif
28 
29 #include <stddef.h>
30 
31 #include "hks_base_check.h"
32 #include "hks_common_check.h"
33 #include "hks_crypto_hal.h"
34 #include "hks_log.h"
35 #include "hks_param.h"
36 #include "hks_template.h"
37 #include "securec.h"
38 
39 #ifdef _CUT_AUTHENTICATE_
40 #undef HKS_SUPPORT_HASH_C
41 #undef HKS_SUPPORT_RSA_C
42 #undef HKS_SUPPORT_ECC_C
43 #undef HKS_SUPPORT_X25519_C
44 #undef HKS_SUPPORT_ED25519_C
45 #undef HKS_SUPPORT_KDF_PBKDF2
46 #endif /* _CUT_AUTHENTICATE_ */
47 
48 #define HKS_DEFAULT_PBKDF2_ITERATION 1000
49 #define HKS_MAX_PBKDF2_ITERATION 0x80000U
50 #define HKS_DEFAULT_PBKDF2_SALT_SIZE 16
51 
52 #ifndef _CUT_AUTHENTICATE_
53 static uint32_t g_genKeyAlg[] = {
54 #ifdef HKS_SUPPORT_RSA_C
55     HKS_ALG_RSA,
56 #endif
57 #ifdef HKS_SUPPORT_AES_C
58     HKS_ALG_AES,
59 #endif
60 #ifdef HKS_SUPPORT_DES_C
61     HKS_ALG_DES,
62 #endif
63 #ifdef HKS_SUPPORT_3DES_C
64     HKS_ALG_3DES,
65 #endif
66 #ifdef HKS_SUPPORT_ECC_C
67     HKS_ALG_ECC,
68 #endif
69 #ifdef HKS_SUPPORT_HMAC_C
70     HKS_ALG_HMAC,
71 #endif
72 #ifdef HKS_SUPPORT_CMAC_C
73     HKS_ALG_CMAC,
74 #endif
75 #ifdef HKS_SUPPORT_ED25519_C
76     HKS_ALG_ED25519,
77 #endif
78 #ifdef HKS_SUPPORT_X25519_C
79     HKS_ALG_X25519,
80 #endif
81 #ifdef HKS_SUPPORT_DSA_C
82     HKS_ALG_DSA,
83 #endif
84 #ifdef HKS_SUPPORT_DH_C
85     HKS_ALG_DH,
86 #endif
87 #ifdef HKS_SUPPORT_ECDH_C
88     HKS_ALG_ECDH,
89 #endif
90 #ifdef HKS_SUPPORT_SM3_C
91     HKS_ALG_SM3,
92 #endif
93 #ifdef HKS_SUPPORT_SM2_C
94     HKS_ALG_SM2,
95 #endif
96 #ifdef HKS_SUPPORT_SM4_C
97     HKS_ALG_SM4,
98 #endif
99 };
100 
101 static uint32_t g_importKeyAlg[] = {
102 #ifdef HKS_SUPPORT_RSA_C
103     HKS_ALG_RSA,
104 #endif
105 #ifdef HKS_SUPPORT_AES_C
106     HKS_ALG_AES,
107 #endif
108 #ifdef HKS_SUPPORT_DES_C
109     HKS_ALG_DES,
110 #endif
111 #ifdef HKS_SUPPORT_3DES_C
112     HKS_ALG_3DES,
113 #endif
114 #ifdef HKS_SUPPORT_ECC_C
115     HKS_ALG_ECC,
116 #endif
117 #ifdef HKS_SUPPORT_X25519_C
118     HKS_ALG_X25519,
119 #endif
120 #ifdef HKS_SUPPORT_ED25519_C
121     HKS_ALG_ED25519,
122 #endif
123 #ifdef HKS_SUPPORT_DSA_C
124     HKS_ALG_DSA,
125 #endif
126 #ifdef HKS_SUPPORT_DH_C
127     HKS_ALG_DH,
128 #endif
129 #ifdef HKS_SUPPORT_HMAC_C
130     HKS_ALG_HMAC,
131 #endif
132 #ifdef HKS_SUPPORT_CMAC_C
133     HKS_ALG_CMAC,
134 #endif
135 #ifdef HKS_SUPPORT_SM2_C
136     HKS_ALG_SM2,
137 #endif
138 #ifdef HKS_SUPPORT_SM3_C
139     HKS_ALG_SM3,
140 #endif
141 #ifdef HKS_SUPPORT_SM4_C
142     HKS_ALG_SM4,
143 #endif
144 };
145 
146 static uint32_t g_cipherAlg[] = {
147 #ifdef HKS_SUPPORT_RSA_C
148     HKS_ALG_RSA,
149 #endif
150 #ifdef HKS_SUPPORT_AES_C
151     HKS_ALG_AES,
152 #endif
153 #ifdef HKS_SUPPORT_DES_C
154     HKS_ALG_DES,
155 #endif
156 #ifdef HKS_SUPPORT_3DES_C
157     HKS_ALG_3DES,
158 #endif
159 #ifdef HKS_SUPPORT_SM2_C
160     HKS_ALG_SM2,
161 #endif
162 #ifdef HKS_SUPPORT_SM4_C
163     HKS_ALG_SM4,
164 #endif
165 };
166 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
167 static uint32_t g_signAlg[] = {
168 #ifdef HKS_SUPPORT_RSA_C
169     HKS_ALG_RSA,
170 #endif
171 #ifdef HKS_SUPPORT_DSA_C
172     HKS_ALG_DSA,
173 #endif
174 #ifdef HKS_SUPPORT_ECC_C
175     HKS_ALG_ECC,
176 #endif
177 #ifdef HKS_SUPPORT_ED25519_C
178     HKS_ALG_ED25519,
179 #endif
180 #ifdef HKS_SUPPORT_SM2_C
181     HKS_ALG_SM2,
182 #endif
183 };
184 #endif
185 
186 static uint32_t g_agreeAlg[] = {
187 #ifdef HKS_SUPPORT_X25519_C
188     HKS_ALG_X25519,
189 #endif
190 #ifdef HKS_SUPPORT_ECDH_C
191     HKS_ALG_ECDH,
192 #endif
193 #ifdef HKS_SUPPORT_DH_C
194     HKS_ALG_DH,
195 #endif
196 };
197 
198 static uint32_t g_agreeAlgLocal[] = {
199 #ifdef HKS_SUPPORT_ECDH_C
200     HKS_ALG_ECDH,
201 #endif
202 #ifdef HKS_SUPPORT_X25519_C
203     HKS_ALG_X25519,
204 #endif
205 #ifdef HKS_SUPPORT_DH_C
206     HKS_ALG_DH,
207 #endif
208 };
209 
210 static uint32_t g_unwrapSuite[] = {
211 #if defined(HKS_SUPPORT_X25519_C) && defined(HKS_SUPPORT_AES_GCM)
212     HKS_UNWRAP_SUITE_X25519_AES_256_GCM_NOPADDING,
213 #endif
214 #if defined(HKS_SUPPORT_ECDH_C) && defined(HKS_SUPPORT_AES_GCM)
215     HKS_UNWRAP_SUITE_ECDH_AES_256_GCM_NOPADDING,
216 #endif
217 #if defined(HKS_SUPPORT_SM2_C) && defined(HKS_SUPPORT_SM4_C)
218     HKS_UNWRAP_SUITE_SM2_SM4_128_CBC_PKCS7_WITH_VERIFY_DIG_SM3,
219     HKS_UNWRAP_SUITE_SM2_SM4_128_CBC_PKCS7
220 #endif
221 };
222 #endif /* _CUT_AUTHENTICATE_ */
223 
224 static uint32_t g_deriveAlg[] = {
225 #ifdef HKS_SUPPORT_KDF_HKDF
226     HKS_ALG_HKDF,
227 #endif
228 #ifdef HKS_SUPPORT_KDF_PBKDF2
229     HKS_ALG_PBKDF2,
230 #endif
231 #ifdef HKS_SUPPORT_KDF_SM3
232     HKS_ALG_GMKDF,
233 #endif
234 };
235 
236 static uint32_t g_deriveAlgLocal[] = {
237 #ifdef HKS_SUPPORT_KDF_HKDF
238     HKS_ALG_HKDF,
239 #endif
240 };
241 
242 static uint32_t g_digest[] = {
243     HKS_DIGEST_SHA1,
244     HKS_DIGEST_SHA224,
245     HKS_DIGEST_SHA256,
246     HKS_DIGEST_SHA384,
247     HKS_DIGEST_SHA512,
248     HKS_DIGEST_SM3
249 };
250 static uint32_t g_macDigest[] = {
251     HKS_DIGEST_SHA1,
252     HKS_DIGEST_SHA224,
253     HKS_DIGEST_SHA256,
254     HKS_DIGEST_SHA384,
255     HKS_DIGEST_SHA512,
256     HKS_DIGEST_SM3
257 };
258 #ifdef HKS_SUPPORT_AES_C
259 static uint32_t g_aesKeySizeLocal[] = {
260     HKS_AES_KEY_SIZE_128,
261     HKS_AES_KEY_SIZE_192,
262     HKS_AES_KEY_SIZE_256,
263 };
264 #endif
265 #ifdef HKS_SUPPORT_DES_C
266 static uint32_t g_desKeySizeLocal[] = {
267     HKS_DES_KEY_SIZE_64
268 };
269 #endif
270 #ifdef HKS_SUPPORT_3DES_C
271 static uint32_t g_3desKeySizeLocal[] = {
272     HKS_3DES_KEY_SIZE_128,
273     HKS_3DES_KEY_SIZE_192
274 };
275 #endif
276 #ifdef HKS_SUPPORT_RSA_C
277 static uint32_t g_rsaKeySizeLocal[] = {
278     HKS_RSA_KEY_SIZE_512,
279     HKS_RSA_KEY_SIZE_768,
280     HKS_RSA_KEY_SIZE_1024,
281     HKS_RSA_KEY_SIZE_2048,
282     HKS_RSA_KEY_SIZE_3072,
283     HKS_RSA_KEY_SIZE_4096,
284 };
285 #endif
286 
287 static uint32_t g_cipherAlgLocal[] = {
288 #ifdef HKS_SUPPORT_AES_C
289     HKS_ALG_AES,
290 #endif
291 #ifdef HKS_SUPPORT_DES_C
292     HKS_ALG_DES,
293 #endif
294 #ifdef HKS_SUPPORT_3DES_C
295     HKS_ALG_3DES,
296 #endif
297 #ifdef HKS_SUPPORT_RSA_C
298     HKS_ALG_RSA,
299 #endif
300 };
301 
302 static uint32_t g_symmetricAlgorithm[] = {
303 #ifdef HKS_SUPPORT_AES_C
304     HKS_ALG_AES,
305 #endif
306 #ifdef HKS_SUPPORT_DES_C
307     HKS_ALG_DES,
308 #endif
309 #ifdef HKS_SUPPORT_3DES_C
310     HKS_ALG_3DES,
311 #endif
312 #ifdef HKS_SUPPORT_HMAC_C
313     HKS_ALG_HMAC,
314 #endif
315 #ifdef HKS_SUPPORT_CMAC_C
316     HKS_ALG_CMAC,
317 #endif
318 #ifdef HKS_SUPPORT_SM3_C
319     HKS_ALG_SM3,
320 #endif
321 #ifdef HKS_SUPPORT_SM4_C
322     HKS_ALG_SM4,
323 #endif
324 };
325 
CheckAndGetAlgorithm(const struct HksParamSet * paramSet,const uint32_t * expectAlg,uint32_t expectCnt,uint32_t * alg)326 static int32_t CheckAndGetAlgorithm(
327     const struct HksParamSet *paramSet, const uint32_t *expectAlg, uint32_t expectCnt, uint32_t *alg)
328 {
329     struct HksParam *algParam = NULL;
330     int32_t ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &algParam);
331     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_ALG_FAIL,
332         "get param 0x%" LOG_PUBLIC "x failed!", HKS_TAG_ALGORITHM)
333 
334     ret = HksCheckValue(algParam->uint32Param, expectAlg, expectCnt);
335     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_ALGORITHM,
336         "alg value %" LOG_PUBLIC "u not expected", algParam->uint32Param)
337 
338     *alg = algParam->uint32Param;
339     return ret;
340 }
341 
CheckAndGetDigest(const struct HksParamSet * paramSet,const uint32_t * expectDigest,uint32_t expectCnt,uint32_t * digest)342 static int32_t CheckAndGetDigest(
343     const struct HksParamSet *paramSet, const uint32_t *expectDigest, uint32_t expectCnt, uint32_t *digest)
344 {
345     struct HksParam *digestParam = NULL;
346     int32_t ret = HksGetParam(paramSet, HKS_TAG_DIGEST, &digestParam);
347     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_DIGEST_FAIL,
348         "get param get 0x%" LOG_PUBLIC "x failed!", HKS_TAG_DIGEST)
349 
350     ret = HksCheckValue(digestParam->uint32Param, expectDigest, expectCnt);
351     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_DIGEST,
352         "digest value %" LOG_PUBLIC "u not expected", digestParam->uint32Param)
353 
354     *digest = digestParam->uint32Param;
355     return ret;
356 }
357 
358 #ifndef _CUT_AUTHENTICATE_
CheckGenKeyParamsByAlg(uint32_t alg,const struct HksParamSet * paramSet,struct ParamsValues * params,uint32_t keyFlag)359 static int32_t CheckGenKeyParamsByAlg(uint32_t alg, const struct HksParamSet *paramSet,
360     struct ParamsValues *params, uint32_t keyFlag)
361 {
362     int32_t ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_GEN_KEY, paramSet, params);
363     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret,
364         "get input params by algorithm failed, ret = %" LOG_PUBLIC "d", ret)
365 
366     ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_GEN_KEY, params);
367     HKS_IF_NOT_SUCC_RETURN(ret, ret)
368 
369     ret = HksCheckGenKeyPurpose(alg, params->purpose.value, keyFlag);
370     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret,
371         "check purpose not expected, purpose =  %" LOG_PUBLIC "d", params->purpose.value);
372     return HksCheckGenKeyMutableParams(alg, params);
373 }
374 
CheckGenKeyMacDeriveParams(uint32_t alg,uint32_t inputPurpose,const struct HksParamSet * paramSet,struct ParamsValues * params,uint32_t keyFlag)375 static int32_t CheckGenKeyMacDeriveParams(
376     uint32_t alg, uint32_t inputPurpose, const struct HksParamSet *paramSet, struct ParamsValues *params,
377     uint32_t keyFlag)
378 {
379     if (alg != HKS_ALG_AES && alg != HKS_ALG_DES && alg != HKS_ALG_3DES && alg != HKS_ALG_HMAC &&
380         alg != HKS_ALG_CMAC && alg != HKS_ALG_SM3 && alg != HKS_ALG_SM4) {
381         HKS_LOG_E("check mac or derive, not valid alg, alg: %" LOG_PUBLIC "u", alg);
382         return HKS_ERROR_INVALID_PURPOSE;
383     }
384 
385     int32_t ret = HksCheckGenKeyPurpose(alg, inputPurpose, keyFlag);
386     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check purpose invalid, purpose 0x%" LOG_PUBLIC "x", inputPurpose)
387 
388     if (inputPurpose == HKS_KEY_PURPOSE_MAC) {
389         ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_GEN_MAC_KEY, paramSet, params);
390     } else {
391         ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_GEN_DERIVE_KEY, paramSet, params);
392     }
393     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get input params by algorithm failed, ret = %" LOG_PUBLIC "d", ret)
394 
395     if (inputPurpose == HKS_KEY_PURPOSE_MAC) {
396         ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_GEN_MAC_KEY, params);
397     } else {
398         ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_GEN_DERIVE_KEY, params);
399     }
400     HKS_IF_NOT_SUCC_LOGE(ret, "get input params by algorithm failed, ret = %" LOG_PUBLIC "d", ret)
401 
402     return ret;
403 }
404 
CoreCheckGenKeyParams(const struct HksParamSet * paramSet,struct ParamsValues * params,uint32_t keyFlag)405 static int32_t CoreCheckGenKeyParams(const struct HksParamSet *paramSet, struct ParamsValues *params, uint32_t keyFlag)
406 {
407     uint32_t alg;
408     int32_t ret = HksCheckParamSetTag(paramSet);
409     HKS_IF_NOT_SUCC_RETURN(ret, ret)
410 
411     ret = CheckAndGetAlgorithm(paramSet, g_genKeyAlg, HKS_ARRAY_SIZE(g_genKeyAlg), &alg);
412     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check and get alg failed")
413 
414     struct HksParam *purposeParam = NULL;
415     struct HksParam *batchPurposeParam = NULL;
416     ret = HksGetParam(paramSet, HKS_TAG_PURPOSE, &purposeParam);
417     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_PURPOSE_FAIL,
418         "get param get 0x%" LOG_PUBLIC "x failed", HKS_TAG_PURPOSE)
419     ret = HksGetParam(paramSet, HKS_TAG_BATCH_PURPOSE, &batchPurposeParam);
420     if (ret == HKS_SUCCESS) {
421         if ((purposeParam->uint32Param | batchPurposeParam->uint32Param) != purposeParam->uint32Param) {
422             HKS_LOG_E("batchPurposeParam should fall within the scope of purposeParam.");
423             return HKS_ERROR_INVALID_PURPOSE;
424         }
425     }
426 
427     if (((purposeParam->uint32Param & HKS_KEY_PURPOSE_DERIVE) != 0) ||
428         ((purposeParam->uint32Param & HKS_KEY_PURPOSE_MAC) != 0)) {
429         return CheckGenKeyMacDeriveParams(alg, purposeParam->uint32Param, paramSet, params, keyFlag);
430     }
431 
432     return CheckGenKeyParamsByAlg(alg, paramSet, params, keyFlag);
433 }
434 
CheckImportKeySize(uint32_t alg,const struct ParamsValues * params,const struct HksBlob * key)435 static int32_t CheckImportKeySize(uint32_t alg, const struct ParamsValues *params, const struct HksBlob *key)
436 {
437     int32_t ret = HKS_SUCCESS;
438     switch (alg) {
439         case HKS_ALG_ED25519:
440         case HKS_ALG_X25519:
441         case HKS_ALG_RSA:
442         case HKS_ALG_ECC:
443         case HKS_ALG_SM2:
444         case HKS_ALG_DH: {
445             if (key->size < sizeof(struct HksPubKeyInfo)) {
446                 ret = HKS_ERROR_INVALID_KEY_INFO;
447                 break;
448             }
449             struct HksPubKeyInfo *keyMaterial = (struct HksPubKeyInfo *)(key->data);
450             if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
451                 ret = HKS_ERROR_INVALID_KEY_INFO;
452             }
453             break;
454         }
455 #ifdef HKS_SUPPORT_DSA_C
456         case HKS_ALG_DSA:
457             break;
458 #endif
459         default:
460             return HKS_ERROR_INVALID_ALGORITHM;
461     }
462     return ret;
463 }
464 
CheckAndGetWrappedKeyUnwrapAlgSuite(const struct HksParamSet * paramSet,uint32_t * algSuite)465 static int32_t CheckAndGetWrappedKeyUnwrapAlgSuite(const struct HksParamSet *paramSet, uint32_t *algSuite)
466 {
467     struct HksParam *algorithmSuite = NULL;
468     int32_t ret = HksGetParam(paramSet, HKS_TAG_UNWRAP_ALGORITHM_SUITE, &algorithmSuite);
469     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_ALG_FAIL, "get unwrap algorithm suite fail")
470 
471     ret = HksCheckValue(algorithmSuite->uint32Param, g_unwrapSuite, HKS_ARRAY_SIZE(g_unwrapSuite));
472     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_ALGORITHM,
473         "unwrap algorithm suite value %" LOG_PUBLIC "u not expected", algorithmSuite->uint32Param)
474 
475     *algSuite = algorithmSuite->uint32Param;
476     return HKS_SUCCESS;
477 }
478 
479 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
CheckSignVerifyParamsByAlg(uint32_t cmdId,uint32_t alg,const struct ParamsValues * inputParams)480 static int32_t CheckSignVerifyParamsByAlg(uint32_t cmdId, uint32_t alg, const struct ParamsValues *inputParams)
481 {
482     int32_t ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_USE_KEY, inputParams);
483     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check sign or verify fixed params failed, ret = %" LOG_PUBLIC "d", ret)
484 
485     ret = HksCheckSignVerifyMutableParams(cmdId, alg, inputParams);
486     HKS_IF_NOT_SUCC_LOGE(ret, "check sign or verify mutable params failed, ret = %" LOG_PUBLIC "d", ret)
487 
488     return ret;
489 }
490 #endif
491 #endif /* _CUT_AUTHENTICATE_ */
492 
CheckCipherParamsByAlg(uint32_t cmdId,uint32_t alg,const struct HksParamSet * paramSet,const struct ParamsValues * inputParams)493 static int32_t CheckCipherParamsByAlg(
494     uint32_t cmdId, uint32_t alg, const struct HksParamSet *paramSet, const struct ParamsValues *inputParams)
495 {
496     int32_t ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_USE_KEY, inputParams);
497     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher check fixed params failed, ret = %" LOG_PUBLIC "d", ret)
498 
499     ret = HksCheckCipherMutableParams(cmdId, alg, inputParams);
500     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher check mutable params failed, ret = %" LOG_PUBLIC "d", ret)
501 
502     ret = HksCheckCipherMaterialParams(alg, inputParams, paramSet);
503     HKS_IF_NOT_SUCC_LOGE(ret, "cipher check material params failed, ret = %" LOG_PUBLIC "d", ret)
504 
505     return ret;
506 }
507 
508 #ifndef _CUT_AUTHENTICATE_
509 #ifdef HKS_SUPPORT_KDF_PBKDF2
CheckPbkdf2DeriveKeyParams(const struct HksParamSet * paramSet)510 static int32_t CheckPbkdf2DeriveKeyParams(const struct HksParamSet *paramSet)
511 {
512     struct HksParam *iterationParam = NULL;
513     int32_t ret = HksGetParam(paramSet, HKS_TAG_ITERATION, &iterationParam);
514     HKS_IF_NOT_SUCC_RETURN(ret, HKS_ERROR_CHECK_GET_ITERATION_FAIL)
515 
516     if (iterationParam->uint32Param < HKS_DEFAULT_PBKDF2_ITERATION ||
517         iterationParam->uint32Param > HKS_MAX_PBKDF2_ITERATION) {
518         HKS_LOG_E("invalid iteration param %" LOG_PUBLIC "u", iterationParam->uint32Param);
519         return HKS_ERROR_INVALID_ITERATION;
520     }
521 
522     struct HksParam *saltParam = NULL;
523     ret = HksGetParam(paramSet, HKS_TAG_SALT, &saltParam);
524     HKS_IF_NOT_SUCC_RETURN(ret, HKS_ERROR_CHECK_GET_SALT_FAIL)
525 
526     if ((CheckBlob(&saltParam->blob) != HKS_SUCCESS) || (saltParam->blob.size < HKS_DEFAULT_PBKDF2_SALT_SIZE)) {
527         return HKS_ERROR_INVALID_SALT;
528     }
529 
530     return HKS_SUCCESS;
531 }
532 #endif
533 
HksCoreCheckGenKeyParams(const struct HksBlob * keyAlias,const struct HksParamSet * paramSet,const struct HksBlob * keyIn,const struct HksBlob * keyOut,uint32_t keyFlag)534 int32_t HksCoreCheckGenKeyParams(const struct HksBlob *keyAlias, const struct HksParamSet *paramSet,
535     const struct HksBlob *keyIn, const struct HksBlob *keyOut, uint32_t keyFlag)
536 {
537     (void)keyAlias;
538     (void)keyIn;
539     (void)keyOut;
540     struct ParamsValues params;
541     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
542     return CoreCheckGenKeyParams(paramSet, &params, keyFlag);
543 }
544 
CheckRsaKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)545 static int32_t CheckRsaKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
546     const struct HksBlob *key)
547 {
548     (void)keyType;
549     if (key->size < sizeof(struct HksKeyMaterialRsa)) {
550         HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
551         return HKS_ERROR_INVALID_KEY_INFO;
552     }
553 
554     struct HksKeyMaterialRsa *keyMaterial = (struct HksKeyMaterialRsa *)(key->data);
555     if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
556         HKS_LOG_E("invalid import key material");
557         return HKS_ERROR_INVALID_KEY_INFO;
558     }
559 
560     if ((keyMaterial->nSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->nSize == 0) ||
561         (keyMaterial->dSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->dSize == 0) ||
562         (keyMaterial->eSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->eSize == 0)) {
563         HKS_LOG_E("invalid import key material n/d/e size");
564         return HKS_ERROR_INVALID_KEY_INFO;
565     }
566 
567     uint32_t keySize = sizeof(struct HksKeyMaterialRsa) + keyMaterial->nSize + keyMaterial->dSize + keyMaterial->eSize;
568     if (key->size < keySize) {
569         HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
570         return HKS_ERROR_INVALID_KEY_INFO;
571     }
572 
573     return HKS_SUCCESS;
574 }
575 
CheckEccKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)576 static int32_t CheckEccKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
577     const struct HksBlob *key)
578 {
579     if (key->size < sizeof(struct HksKeyMaterialEcc)) {
580         HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
581         return HKS_ERROR_INVALID_KEY_INFO;
582     }
583 
584     struct HksKeyMaterialEcc *keyMaterial = (struct HksKeyMaterialEcc *)(key->data);
585     if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
586         HKS_LOG_E("invalid import key material");
587         return HKS_ERROR_INVALID_KEY_INFO;
588     }
589 
590     if ((keyMaterial->xSize > HKS_ECC_KEY_SIZE_521) || (keyMaterial->ySize > HKS_ECC_KEY_SIZE_521) ||
591         (keyMaterial->zSize > HKS_ECC_KEY_SIZE_521)) {
592         HKS_LOG_E("invalid import key material x/y/z size, bigger than 521");
593         return HKS_ERROR_INVALID_KEY_INFO;
594     }
595 
596     if (keyMaterial->zSize == 0) {
597         HKS_LOG_E("invalid import key material z size: 0");
598         return HKS_ERROR_INVALID_KEY_INFO;
599     }
600     if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && ((keyMaterial->xSize == 0) || (keyMaterial->ySize == 0))) {
601         HKS_LOG_E("invalid import key material x/y size: 0");
602         return HKS_ERROR_INVALID_KEY_INFO;
603     }
604 
605     uint32_t keySize = sizeof(struct HksKeyMaterialEcc) + keyMaterial->xSize + keyMaterial->ySize + keyMaterial->zSize;
606     if (key->size < keySize) {
607         HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
608         return HKS_ERROR_INVALID_KEY_INFO;
609     }
610 
611     return HKS_SUCCESS;
612 }
613 
CheckDsaKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)614 static int32_t CheckDsaKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
615     const struct HksBlob *key)
616 {
617     if (key->size < sizeof(struct HksKeyMaterialDsa)) {
618         HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
619         return HKS_ERROR_INVALID_KEY_INFO;
620     }
621 
622     struct HksKeyMaterialDsa *keyMaterial = (struct HksKeyMaterialDsa *)(key->data);
623     if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
624         HKS_LOG_E("invalid import key material");
625         return HKS_ERROR_INVALID_KEY_INFO;
626     }
627 
628     if ((keyMaterial->xSize > MAX_KEY_SIZE) || (keyMaterial->ySize > MAX_KEY_SIZE) ||
629         (keyMaterial->pSize > MAX_KEY_SIZE) || (keyMaterial->qSize > MAX_KEY_SIZE) ||
630         (keyMaterial->gSize > MAX_KEY_SIZE)) {
631         HKS_LOG_E("invalid import key material x/y/p/q/g size, bigger than 2048");
632         return HKS_ERROR_INVALID_KEY_INFO;
633     }
634 
635     if ((keyMaterial->xSize == 0) ||
636         (keyMaterial->pSize == 0) || (keyMaterial->qSize == 0) || (keyMaterial->gSize == 0)) {
637         HKS_LOG_E("invalid import key material x/p/q/g size: 0");
638         return HKS_ERROR_INVALID_KEY_INFO;
639     }
640 
641     if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->ySize == 0)) {
642         HKS_LOG_E("invalid import key material y size: 0");
643         return HKS_ERROR_INVALID_KEY_INFO;
644     }
645 
646     uint32_t keySize = sizeof(struct HksKeyMaterialDsa) + keyMaterial->xSize + keyMaterial->ySize +
647         keyMaterial->pSize + keyMaterial->qSize + keyMaterial->gSize;
648     if (key->size < keySize) {
649         HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
650         return HKS_ERROR_INVALID_KEY_INFO;
651     }
652 
653     return HKS_SUCCESS;
654 }
655 
CheckCurve25519KeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)656 static int32_t CheckCurve25519KeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
657     const struct HksBlob *key)
658 {
659     if (key->size < sizeof(struct HksKeyMaterial25519)) {
660         HKS_LOG_E("invalid import Curve25519 key size: %" LOG_PUBLIC "u", key->size);
661         return HKS_ERROR_INVALID_KEY_INFO;
662     }
663 
664     struct HksKeyMaterial25519 *keyMaterial = (struct HksKeyMaterial25519 *)(key->data);
665     if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
666         HKS_LOG_E("invalid import Curve25519 key material");
667         return HKS_ERROR_INVALID_KEY_INFO;
668     }
669 
670     if ((keyMaterial->pubKeySize > HKS_CURVE25519_KEY_SIZE_256) ||
671         (keyMaterial->priKeySize > HKS_CURVE25519_KEY_SIZE_256)) {
672         HKS_LOG_E("invalid import Curve25519 key material pubKey/priKey size, bigger than 256");
673         return HKS_ERROR_INVALID_KEY_INFO;
674     }
675 
676     if (keyMaterial->priKeySize == 0) {
677         HKS_LOG_E("invalid import Curve25519 key material priKey size: 0");
678         return HKS_ERROR_INVALID_KEY_INFO;
679     }
680 
681     if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->pubKeySize == 0)) {
682         HKS_LOG_E("invalid import Curve25519 key material pubKey size: 0");
683         return HKS_ERROR_INVALID_KEY_INFO;
684     }
685 
686     uint32_t keySize = sizeof(struct HksKeyMaterial25519) + keyMaterial->pubKeySize + keyMaterial->priKeySize;
687     if (key->size < keySize) {
688         HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
689         return HKS_ERROR_INVALID_KEY_INFO;
690     }
691 
692     return HKS_SUCCESS;
693 }
694 
CheckDHKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)695 static int32_t CheckDHKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
696     const struct HksBlob *key)
697 {
698     if (key->size < sizeof(struct HksKeyMaterialDh)) {
699         HKS_LOG_E("invalid import DH key size: %" LOG_PUBLIC "u", key->size);
700         return HKS_ERROR_INVALID_KEY_INFO;
701     }
702 
703     struct HksKeyMaterialDh *keyMaterial = (struct HksKeyMaterialDh *)(key->data);
704     if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
705         HKS_LOG_E("invalid import DH key material");
706         return HKS_ERROR_INVALID_KEY_INFO;
707     }
708 
709     if ((keyMaterial->pubKeySize > HKS_DH_KEY_SIZE_4096) || (keyMaterial->priKeySize > HKS_DH_KEY_SIZE_4096)) {
710         HKS_LOG_E("invalid import DH key material pubKey/priKey size, bigger than 4096");
711         return HKS_ERROR_INVALID_KEY_INFO;
712     }
713 
714     if (keyMaterial->priKeySize == 0) {
715         HKS_LOG_E("invalid import DH key material priKey size: 0");
716         return HKS_ERROR_INVALID_KEY_INFO;
717     }
718 
719     if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->pubKeySize == 0)) {
720         HKS_LOG_E("invalid import DH key material pubKey size: 0");
721         return HKS_ERROR_INVALID_KEY_INFO;
722     }
723 
724     uint32_t keySize = sizeof(struct HksKeyMaterialDh) + keyMaterial->pubKeySize + keyMaterial->priKeySize;
725     if (key->size < keySize) {
726         HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
727         return HKS_ERROR_INVALID_KEY_INFO;
728     }
729 
730     return HKS_SUCCESS;
731 }
732 
CheckKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)733 static int32_t CheckKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
734     const struct HksBlob *key)
735 {
736     switch (alg) {
737         case HKS_ALG_RSA:
738             return CheckRsaKeyLen(alg, keyType, params, key);
739         case HKS_ALG_ECC:
740         case HKS_ALG_SM2:
741             return CheckEccKeyLen(alg, keyType, params, key);
742         case HKS_ALG_DSA:
743             return CheckDsaKeyLen(alg, keyType, params, key);
744         case HKS_ALG_X25519:
745         case HKS_ALG_ED25519:
746             return CheckCurve25519KeyLen(alg, keyType, params, key);
747         case HKS_ALG_DH:
748             return CheckDHKeyLen(alg, keyType, params, key);
749         default:
750             return HKS_ERROR_INVALID_ALGORITHM;
751     }
752 }
753 
CheckMutableParams(uint32_t alg,uint32_t keyType,const struct ParamsValues * params)754 static int32_t CheckMutableParams(uint32_t alg, uint32_t keyType, const struct ParamsValues *params)
755 {
756     if (keyType == HKS_KEY_TYPE_KEY_PAIR) {
757         return HKS_SUCCESS;
758     }
759 
760     switch (alg) {
761         case HKS_ALG_RSA:
762             if ((params->purpose.value != HKS_KEY_PURPOSE_SIGN) &&
763                 (params->purpose.value != HKS_KEY_PURPOSE_DECRYPT)) {
764                 HKS_LOG_E("Import rsa private key check purpose failed.");
765                 return HKS_ERROR_INVALID_PURPOSE;
766             }
767             return HKS_SUCCESS;
768         case HKS_ALG_ECC:
769             if ((params->purpose.value != HKS_KEY_PURPOSE_SIGN) && (params->purpose.value != HKS_KEY_PURPOSE_AGREE) &&
770                 (params->purpose.value != HKS_KEY_PURPOSE_UNWRAP)) {
771                 HKS_LOG_E("Import ecc private key check purpose failed.");
772                 return HKS_ERROR_INVALID_PURPOSE;
773             }
774             return HKS_SUCCESS;
775         case HKS_ALG_SM2:
776         case HKS_ALG_DSA:
777         case HKS_ALG_ED25519:
778             if (params->purpose.value != HKS_KEY_PURPOSE_SIGN) {
779                 HKS_LOG_E("Import sm2 or dsa or ed25519 private key check purpose failed.");
780                 return HKS_ERROR_INVALID_PURPOSE;
781             }
782             return HKS_SUCCESS;
783         case HKS_ALG_X25519:
784         case HKS_ALG_DH:
785             return HKS_SUCCESS;
786         default:
787             return HKS_ERROR_INVALID_ALGORITHM;
788     }
789 }
790 
CheckImportKey(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)791 static int32_t CheckImportKey(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
792     const struct HksBlob *key)
793 {
794     int32_t ret = CheckKeyLen(alg, keyType, params, key);
795     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check key len failed, ret = %" LOG_PUBLIC "d", ret)
796 
797     ret = CheckMutableParams(alg, keyType, params);
798     HKS_IF_NOT_SUCC_LOGE(ret, "check mutable params faile, ret = %" LOG_PUBLIC "d", ret)
799     return ret;
800 }
801 
CheckImportSymmetricKeySize(const struct ParamsValues * params,const struct HksBlob * key)802 static int32_t CheckImportSymmetricKeySize(const struct ParamsValues *params, const struct HksBlob *key)
803 {
804     if (key->size != HKS_KEY_BYTES(params->keyLen.value)) {
805         return HKS_ERROR_INVALID_KEY_INFO;
806     }
807     return HKS_SUCCESS;
808 }
809 
HksCoreCheckImportKeyParams(const struct HksBlob * keyAlias,const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * keyOut)810 int32_t HksCoreCheckImportKeyParams(const struct HksBlob *keyAlias, const struct HksBlob *key,
811     const struct HksParamSet *paramSet, const struct HksBlob *keyOut)
812 {
813     (void)keyAlias;
814     (void)keyOut;
815     /* import key paramset is subset of generate key paramset */
816     struct ParamsValues params;
817     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
818     int32_t ret = CoreCheckGenKeyParams(paramSet, &params, HKS_KEY_FLAG_IMPORT_KEY);
819     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "CheckImportKeyParams failed")
820 
821     uint32_t alg;
822     ret = CheckAndGetAlgorithm(paramSet, g_importKeyAlg, HKS_ARRAY_SIZE(g_importKeyAlg), &alg);
823     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "import key check and get alg failed")
824 
825     if ((alg == HKS_ALG_AES) || (alg == HKS_ALG_DES) || (alg == HKS_ALG_3DES) || (alg == HKS_ALG_SM3) ||
826         (alg == HKS_ALG_SM4) || (alg == HKS_ALG_HMAC) || (alg == HKS_ALG_CMAC)) {
827         return CheckImportSymmetricKeySize(&params, key);
828     }
829 
830     struct HksParam *importKeyTypeParam = NULL;
831     ret = HksGetParam(paramSet, HKS_TAG_IMPORT_KEY_TYPE, &importKeyTypeParam);
832     bool needCheckLater = true;
833     if (ret == HKS_SUCCESS && importKeyTypeParam->uint32Param != HKS_KEY_TYPE_PUBLIC_KEY) {
834         needCheckLater = false;
835         ret = CheckImportKey(alg, importKeyTypeParam->uint32Param, &params, key);
836         HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check import key invalid")
837     }
838 #ifdef L2_STANDARD
839     if (ret == HKS_SUCCESS) {
840         if (importKeyTypeParam->uint32Param != HKS_KEY_TYPE_PRIVATE_KEY) {
841             if (alg == HKS_ALG_DH) {
842                 ret = HksOpensslCheckDhKey(key, (enum HksImportKeyType)importKeyTypeParam->uint32Param);
843             } else if (alg == HKS_ALG_RSA) {
844                 ret = HksOpensslCheckRsaKey(key);
845             }
846             HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "openssl check import key invalid")
847         }
848     }
849 #endif
850     if (!needCheckLater) {
851         return ret;
852     }
853 
854     /* check public key params: 1. check keySize */
855     ret = CheckImportKeySize(alg, &params, key);
856     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "import key check key size invalid")
857 
858     /* check public key params: 2. check mutable params */
859     return CheckImportMutableParams(alg, &params);
860 }
861 
HksCoreCheckImportWrappedKeyParams(const struct HksBlob * key,const struct HksBlob * wrappedKeyData,const struct HksParamSet * paramSet,struct HksBlob * keyOut,uint32_t * outUnwrapSuite)862 int32_t HksCoreCheckImportWrappedKeyParams(const struct HksBlob *key, const struct HksBlob *wrappedKeyData,
863     const struct HksParamSet *paramSet, struct HksBlob *keyOut, uint32_t *outUnwrapSuite)
864 {
865     (void)keyOut;
866 
867     HKS_IF_NOT_SUCC_LOGE_RETURN(CheckBlob(key), HKS_ERROR_INVALID_ARGUMENT, "wrapping key is invalid")
868 
869     /* first check wrapping-related params and wrapped key data */
870     uint32_t unwrapSuite = 0;
871     int32_t ret = CheckAndGetWrappedKeyUnwrapAlgSuite(paramSet, &unwrapSuite);
872     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check import wrapped params set failed")
873 
874     ret = HksCheckWrappedDataFormatValidity(wrappedKeyData, HKS_IMPORT_WRAPPED_KEY_TOTAL_BLOBS, NULL);
875     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check import wrapped key data format failed")
876 
877     /* then check the origin key paramset which is the same as import key */
878     struct ParamsValues params;
879     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
880     ret = CoreCheckGenKeyParams(paramSet, &params, HKS_KEY_FLAG_IMPORT_KEY);
881     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check origin key param set failed")
882 
883     uint32_t alg;
884     ret = CheckAndGetAlgorithm(paramSet, g_importKeyAlg, HKS_ARRAY_SIZE(g_importKeyAlg), &alg);
885     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "CheckImportKeyParams get alg failed")
886     *outUnwrapSuite = unwrapSuite;
887     return HKS_SUCCESS;
888 }
889 
HksCoreCheckSignVerifyParams(uint32_t cmdId,const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * srcData,const struct HksBlob * signature)890 int32_t HksCoreCheckSignVerifyParams(uint32_t cmdId, const struct HksBlob *key, const struct HksParamSet *paramSet,
891     const struct HksBlob *srcData, const struct HksBlob *signature)
892 {
893 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
894     (void)srcData;
895     uint32_t alg;
896     int32_t ret = CheckAndGetAlgorithm(paramSet, g_signAlg, HKS_ARRAY_SIZE(g_signAlg), &alg);
897     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check and get alg failed")
898 
899     struct ParamsValues params;
900     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
901 
902     ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, &params);
903     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify get input params failed, ret = %" LOG_PUBLIC "d", ret)
904 
905     ret = CheckSignVerifyParamsByAlg(cmdId, alg, &params);
906     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify check params failed, ret = %" LOG_PUBLIC "d", ret)
907 
908     uint32_t keySize = 0;
909     ret = HksGetKeySize(alg, key, &keySize);
910     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get keySize failed!")
911 
912     ret = HksCheckSignature(cmdId, alg, keySize, signature);
913     HKS_IF_NOT_SUCC_LOGE(ret, "check signature failed, ret = %" LOG_PUBLIC "d", ret)
914 
915     return ret;
916 #else
917     (void)cmdId;
918     (void)key;
919     (void)paramSet;
920     (void)srcData;
921     (void)signature;
922     return HKS_ERROR_NOT_SUPPORTED;
923 #endif
924 }
925 
HksLocalCheckSignVerifyParams(uint32_t cmdId,uint32_t keySize,const struct HksParamSet * paramSet,const struct HksBlob * srcData,const struct HksBlob * signature)926 int32_t HksLocalCheckSignVerifyParams(uint32_t cmdId, uint32_t keySize, const struct HksParamSet *paramSet,
927     const struct HksBlob *srcData, const struct HksBlob *signature)
928 {
929 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
930     (void)srcData;
931     uint32_t alg;
932     int32_t ret = CheckAndGetAlgorithm(paramSet, g_signAlg, HKS_ARRAY_SIZE(g_signAlg), &alg);
933     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "local check and get alg failed")
934 
935     struct ParamsValues params;
936     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
937 
938     ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, &params);
939     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify get input params failed, ret = %" LOG_PUBLIC "d", ret)
940 
941     ret = CheckSignVerifyParamsByAlg(cmdId, alg, &params);
942     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify local check params failed, ret = %" LOG_PUBLIC "d", ret)
943 
944     ret = HksCheckSignature(cmdId, alg, keySize, signature);
945     HKS_IF_NOT_SUCC_LOGE(ret, "check signature failed, ret = %" LOG_PUBLIC "d", ret)
946 
947     return ret;
948 #else
949     (void)cmdId;
950     (void)keySize;
951     (void)paramSet;
952     (void)srcData;
953     (void)signature;
954     return HKS_ERROR_NOT_SUPPORTED;
955 #endif
956 }
957 
HksCoreCheckAgreeKeyParams(const struct HksParamSet * paramSet,const struct HksBlob * privateKey,const struct HksBlob * peerPublicKey,const struct HksBlob * agreedKey,bool isLocalCheck)958 int32_t HksCoreCheckAgreeKeyParams(const struct HksParamSet *paramSet, const struct HksBlob *privateKey,
959     const struct HksBlob *peerPublicKey, const struct HksBlob *agreedKey, bool isLocalCheck)
960 {
961     uint32_t alg;
962     int32_t ret;
963 
964     if (isLocalCheck) {
965         ret = CheckAndGetAlgorithm(paramSet, g_agreeAlgLocal, HKS_ARRAY_SIZE(g_agreeAlgLocal), &alg);
966     } else {
967         ret = CheckAndGetAlgorithm(paramSet, g_agreeAlg, HKS_ARRAY_SIZE(g_agreeAlg), &alg);
968     }
969     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
970 
971     uint32_t keySize = 0;
972     if (isLocalCheck) {
973         if (alg == HKS_ALG_ED25519) {
974             if ((privateKey->size != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256)) ||
975                 (peerPublicKey->size != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256))) {
976                 return HKS_ERROR_INVALID_KEY_SIZE;
977             }
978         }
979 
980         if (alg == HKS_ALG_DH || alg == HKS_ALG_ECC || alg == HKS_ALG_ECDH) {
981             if (privateKey->size < sizeof(struct HksKeyMaterialHeader)) {
982                 return HKS_ERROR_INVALID_ARGUMENT;
983             }
984             keySize = ((struct HksKeyMaterialHeader *)privateKey->data)->keySize;
985         } else if (alg == HKS_ALG_ED25519) {
986             keySize = privateKey->size * HKS_BITS_PER_BYTE;
987         }
988     } else {
989         ret = HksGetKeySize(alg, privateKey, &keySize);
990         HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get key size failed")
991     }
992 
993     uint32_t size = keySize / HKS_BITS_PER_BYTE + keySize % HKS_BITS_PER_BYTE;
994     if (agreedKey->size < size) {
995         HKS_LOG_E("agreeKey buffer too small, size %" LOG_PUBLIC "u", agreedKey->size);
996         return HKS_ERROR_BUFFER_TOO_SMALL;
997     }
998 
999     return HKS_SUCCESS;
1000 }
1001 
HksCoreCheckCipherParams(uint32_t cmdId,const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * inData,const struct HksBlob * outData)1002 int32_t HksCoreCheckCipherParams(uint32_t cmdId, const struct HksBlob *key, const struct HksParamSet *paramSet,
1003     const struct HksBlob *inData, const struct HksBlob *outData)
1004 {
1005     uint32_t alg;
1006     int32_t ret = CheckAndGetAlgorithm(paramSet, g_cipherAlg, HKS_ARRAY_SIZE(g_cipherAlg), &alg);
1007     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
1008 
1009     struct ParamsValues params;
1010     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
1011 
1012     ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, &params);
1013     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher get input params failed, ret = %" LOG_PUBLIC "d", ret)
1014 
1015     if ((alg == HKS_ALG_RSA) || (alg == HKS_ALG_SM4) || (alg == HKS_ALG_SM2)) {
1016         ret = HksGetKeySize(alg, key, &params.keyLen.value);
1017         HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "rsa/SM4/SM2 cipher get key size failed")
1018     }
1019 
1020     ret = CheckCipherParamsByAlg(cmdId, alg, paramSet, &params);
1021     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher check params failed, ret = %" LOG_PUBLIC "d", ret)
1022 
1023     ret = HksCheckCipherData(cmdId, alg, &params, inData, outData);
1024     HKS_IF_NOT_SUCC_LOGE(ret, "cipher check input or output data failed, ret = %" LOG_PUBLIC "d", ret)
1025 
1026     return ret;
1027 }
1028 #endif /* _CUT_AUTHENTICATE_ */
1029 
HksLocalCheckCipherParams(uint32_t cmdId,uint32_t keySize,const struct HksParamSet * paramSet,const struct HksBlob * inData,const struct HksBlob * outData)1030 int32_t HksLocalCheckCipherParams(uint32_t cmdId, uint32_t keySize, const struct HksParamSet *paramSet,
1031     const struct HksBlob *inData, const struct HksBlob *outData)
1032 {
1033     uint32_t alg;
1034     int32_t ret = CheckAndGetAlgorithm(paramSet, g_cipherAlgLocal, HKS_ARRAY_SIZE(g_cipherAlgLocal), &alg);
1035     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
1036 
1037     if (alg == HKS_ALG_AES) {
1038 #ifdef HKS_SUPPORT_AES_C
1039         ret = HksCheckValue(keySize, g_aesKeySizeLocal, HKS_ARRAY_SIZE(g_aesKeySizeLocal));
1040 #else
1041         ret = HKS_ERROR_NOT_SUPPORTED;
1042 #endif
1043     } else if (alg == HKS_ALG_DES) {
1044 #ifdef HKS_SUPPORT_DES_C
1045         ret = HksCheckValue(keySize, g_desKeySizeLocal, HKS_ARRAY_SIZE(g_desKeySizeLocal));
1046 #else
1047         ret = HKS_ERROR_NOT_SUPPORTED;
1048 #endif
1049     } else if (alg == HKS_ALG_3DES) {
1050 #ifdef HKS_SUPPORT_3DES_C
1051         ret = HksCheckValue(keySize, g_3desKeySizeLocal, HKS_ARRAY_SIZE(g_3desKeySizeLocal));
1052 #else
1053         ret = HKS_ERROR_NOT_SUPPORTED;
1054 #endif
1055     } else if (alg == HKS_ALG_RSA) {
1056 #ifdef HKS_SUPPORT_RSA_C
1057         ret = HksCheckValue(keySize, g_rsaKeySizeLocal, HKS_ARRAY_SIZE(g_rsaKeySizeLocal));
1058 #else
1059         ret = HKS_ERROR_NOT_SUPPORTED;
1060 #endif
1061     }
1062     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_KEY_SIZE,
1063         "keySize value %" LOG_PUBLIC "u not expected", keySize)
1064 
1065     struct ParamsValues params;
1066     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
1067 
1068     ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, &params);
1069     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "local cipher get input params failed, ret = %" LOG_PUBLIC "d", ret)
1070 
1071     ret = CheckCipherParamsByAlg(cmdId, alg, paramSet, &params);
1072     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "local cipher check params failed, ret = %" LOG_PUBLIC "d", ret)
1073 
1074     ret = HksCheckCipherData(cmdId, alg, &params, inData, outData);
1075     HKS_IF_NOT_SUCC_LOGE(ret, "local cipher check input or output data failed, ret = %" LOG_PUBLIC "d", ret)
1076 
1077     return ret;
1078 }
1079 
HksCoreCheckDeriveKeyParams(const struct HksParamSet * paramSet,const struct HksBlob * mainKey,const struct HksBlob * derivedKey,bool isLocalCheck)1080 int32_t HksCoreCheckDeriveKeyParams(const struct HksParamSet *paramSet, const struct HksBlob *mainKey,
1081     const struct HksBlob *derivedKey, bool isLocalCheck)
1082 {
1083     (void)mainKey;
1084     (void)derivedKey;
1085     uint32_t alg;
1086     int32_t ret;
1087     if (isLocalCheck) {
1088         ret = CheckAndGetAlgorithm(paramSet, g_deriveAlgLocal, HKS_ARRAY_SIZE(g_deriveAlgLocal), &alg);
1089     } else {
1090         ret = CheckAndGetAlgorithm(paramSet, g_deriveAlg, HKS_ARRAY_SIZE(g_deriveAlg), &alg);
1091     }
1092     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
1093 
1094     struct HksParam *purposeParam = NULL;
1095     ret = HksGetParam(paramSet, HKS_TAG_PURPOSE, &purposeParam);
1096     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_PURPOSE_FAIL,
1097         "get param get 0x%" LOG_PUBLIC "x failed", HKS_TAG_PURPOSE)
1098 
1099     if (purposeParam->uint32Param != HKS_KEY_PURPOSE_DERIVE) {
1100         return HKS_ERROR_INVALID_PURPOSE;
1101     }
1102 
1103     /* according to RFC5869, HKDF no need check salt and info */
1104     uint32_t digest;
1105     ret = CheckAndGetDigest(paramSet, g_digest, HKS_ARRAY_SIZE(g_digest), &digest);
1106     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check digest failed")
1107 
1108 #ifdef HKS_SUPPORT_KDF_PBKDF2
1109     if (alg == HKS_ALG_PBKDF2) {
1110         return CheckPbkdf2DeriveKeyParams(paramSet);
1111     }
1112 #endif
1113 
1114     return HKS_SUCCESS;
1115 }
1116 
CheckMacPurpose(const struct HksParamSet * paramSet)1117 static int32_t CheckMacPurpose(const struct HksParamSet *paramSet)
1118 {
1119     struct HksParam *purposeParam = NULL;
1120     int32_t ret = HksGetParam(paramSet, HKS_TAG_PURPOSE, &purposeParam);
1121     HKS_IF_NOT_SUCC_RETURN(ret, HKS_ERROR_CHECK_GET_PURPOSE_FAIL)
1122 
1123     if (purposeParam->uint32Param != HKS_KEY_PURPOSE_MAC) {
1124         return HKS_ERROR_INVALID_PURPOSE;
1125     }
1126 
1127     return HKS_SUCCESS;
1128 }
1129 
CheckMacOutput(const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * mac,bool isLocalCheck)1130 static int32_t CheckMacOutput(
1131     const struct HksBlob *key, const struct HksParamSet *paramSet, const struct HksBlob *mac, bool isLocalCheck)
1132 {
1133     uint32_t digest;
1134     int32_t ret;
1135     if (isLocalCheck) {
1136         ret = CheckAndGetDigest(paramSet, g_digest, HKS_ARRAY_SIZE(g_digest), &digest);
1137     } else {
1138         ret = CheckAndGetDigest(paramSet, g_macDigest, HKS_ARRAY_SIZE(g_macDigest), &digest);
1139     }
1140     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check digest failed")
1141 
1142     uint32_t digestLen;
1143     ret = HksGetDigestLen(digest, &digestLen);
1144     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get digest length failed, ret = %" LOG_PUBLIC "d", ret)
1145 
1146     if (mac->size < digestLen) {
1147         HKS_LOG_E("mac buffer too small, size %" LOG_PUBLIC "u", mac->size);
1148         return HKS_ERROR_BUFFER_TOO_SMALL;
1149     }
1150 
1151     if ((isLocalCheck) && (key->size < digestLen)) { /* the unit of local engine input key size is byte */
1152         HKS_LOG_E("key size too small, size = %" LOG_PUBLIC "u", key->size);
1153         return HKS_ERROR_INVALID_KEY_SIZE;
1154     }
1155 
1156     return HKS_SUCCESS;
1157 }
1158 
HksCoreCheckMacParams(const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * srcData,const struct HksBlob * mac,bool isLocalCheck)1159 int32_t HksCoreCheckMacParams(const struct HksBlob *key, const struct HksParamSet *paramSet,
1160     const struct HksBlob *srcData, const struct HksBlob *mac, bool isLocalCheck)
1161 {
1162     (void)srcData;
1163     int32_t ret = CheckMacPurpose(paramSet);
1164     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check Mac purpose failed")
1165 
1166     return CheckMacOutput(key, paramSet, mac, isLocalCheck);
1167 }
1168 
CheckIsSymmetricAlgorithm(uint32_t alg)1169 static bool CheckIsSymmetricAlgorithm(uint32_t alg)
1170 {
1171     for (uint32_t i = 0; i < HKS_ARRAY_SIZE(g_symmetricAlgorithm); ++i) {
1172         if (alg == g_symmetricAlgorithm[i]) {
1173             return true;
1174         }
1175     }
1176     return false;
1177 }
1178 
HksCoreCheckAgreeDeriveFinishParams(const struct HksBlob * key,const struct HksParamSet * paramSet)1179 int32_t HksCoreCheckAgreeDeriveFinishParams(const struct HksBlob *key, const struct HksParamSet *paramSet)
1180 {
1181     // check the key paramset is consistent with key real attributes, including key size and valid key algorithm
1182     struct HksParam *keySize = NULL;
1183     int32_t ret = HksGetParam(paramSet, HKS_TAG_KEY_SIZE, &keySize);
1184     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get key size from agree paramset failed!")
1185     if (HKS_KEY_BYTES(keySize->uint32Param) != key->size) {
1186         HKS_LOG_E("key size param from paramSet is not consistent with real key size, param size %" LOG_PUBLIC
1187             "u not equals to real key size %" LOG_PUBLIC "u", HKS_KEY_BYTES(keySize->uint32Param), key->size);
1188         return HKS_ERROR_INVALID_ARGUMENT;
1189     }
1190     struct HksParam *algorithm = NULL;
1191     ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &algorithm);
1192     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get key algorithm from agree paramset failed!")
1193     if (!CheckIsSymmetricAlgorithm(algorithm->uint32Param)) {
1194         HKS_LOG_E("Agreed or derived key algorithm param can only be symmetric! Algorithm is %" LOG_PUBLIC "u",
1195             algorithm->uint32Param);
1196         return HKS_ERROR_INVALID_ARGUMENT;
1197     }
1198 
1199     return HKS_SUCCESS;
1200 }
1201