1 /*
2 * Copyright (c) 2020-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #define HUKS_DISABLE_LOG_AT_FILE_TO_REDUCE_ROM_SIZE
16
17 #ifndef _CUT_AUTHENTICATE_
18 #include "hks_rkc_rw.h"
19
20 #include "hks_crypto_hal.h"
21 #include "hks_get_process_info.h"
22 #include "hks_log.h"
23 #include "hks_mem.h"
24 #include "hks_param.h"
25 #include "hks_rkc.h"
26 #include "hks_storage_manager.h"
27 #include "hks_template.h"
28
29 #include <securec.h>
30
31 #define HKS_RKC_HASH_LEN 32 /* the hash value length of root key component */
32 #define HKS_KSF_BUF_LEN 258 /* the length of rkc or mk keystore buffer */
33 #define USER_ID_ROOT_DEFAULT "0"
34
35 /* the flag of keystore file, used to identify files as HKS keystore file, don't modify. */
36 const uint8_t g_hksRkcKsfFlag[HKS_RKC_KSF_FLAG_LEN] = { 0x5F, 0x64, 0x97, 0x8D, 0x19, 0x4F, 0x89, 0xCF };
37
GetProcessInfo(struct HksProcessInfo * processInfo)38 int32_t GetProcessInfo(struct HksProcessInfo *processInfo)
39 {
40 char *userId = NULL;
41 char *processName = NULL;
42
43 HKS_IF_NOT_SUCC_LOGE_RETURN(HksGetUserId(&userId), HKS_ERROR_INTERNAL_ERROR, "get user id failed")
44 HKS_IF_NOT_SUCC_LOGE_RETURN(HksGetProcessName(&processName), HKS_ERROR_INTERNAL_ERROR, "get process name failed")
45
46 processInfo->userId.size = strlen(userId);
47 processInfo->userId.data = (uint8_t *)userId;
48 processInfo->processName.size = strlen(processName);
49 processInfo->processName.data = (uint8_t *)processName;
50 processInfo->userIdInt = 0;
51 processInfo->accessTokenId = 0;
52
53 return HKS_SUCCESS;
54 }
55
GetKeyBlobKsf(const char * ksfName,struct HksBlob * tmpKsf)56 int32_t GetKeyBlobKsf(const char *ksfName, struct HksBlob *tmpKsf)
57 {
58 if (ksfName == NULL || tmpKsf == NULL) {
59 HKS_LOG_E("Input argument ksfName or tmpKsf is null");
60 return HKS_ERROR_NULL_POINTER;
61 }
62
63 tmpKsf->data = (uint8_t *)HksMalloc(HKS_KSF_BUF_LEN);
64 HKS_IF_NULL_RETURN(tmpKsf->data, HKS_ERROR_MALLOC_FAIL)
65
66 tmpKsf->size = HKS_KSF_BUF_LEN;
67 (void)memset_s(tmpKsf->data, tmpKsf->size, 0, tmpKsf->size);
68
69 int32_t ret;
70 struct HksParamSet *paramSet = NULL;
71 do {
72 struct HksProcessInfo processInfo = HKS_PROCESS_INFO_INIT_VALUE;
73 ret = GetProcessInfo(&processInfo);
74 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "get process info failed")
75
76 const struct HksBlob fileNameBlob = { strlen(ksfName), (uint8_t *)ksfName };
77
78 ret = HksRkcBuildParamSet(¶mSet);
79 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "rkc build paramset failed")
80
81 ret = HksManageStoreGetKeyBlob(&processInfo, paramSet, &fileNameBlob, tmpKsf, HKS_STORAGE_TYPE_ROOT_KEY);
82 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "Get ksf file failed! ret = 0x%" LOG_PUBLIC "X", ret)
83
84 HksFreeParamSet(¶mSet);
85 return HKS_SUCCESS;
86 } while (0);
87
88 /* the data of root or main key should be cleared after use */
89 (void)memset_s(tmpKsf->data, tmpKsf->size, 0, tmpKsf->size);
90 HKS_FREE_BLOB(*tmpKsf);
91 HksFreeParamSet(¶mSet);
92 return ret;
93 }
94
ExtractFieldFromBuffer(const struct HksBlob * srcBlob,uint32_t * srcOffset,void * dest,uint32_t destSize)95 int32_t ExtractFieldFromBuffer(const struct HksBlob *srcBlob, uint32_t *srcOffset, void *dest, uint32_t destSize)
96 {
97 if (CheckBlob(srcBlob) != HKS_SUCCESS || srcOffset == NULL || dest == NULL || destSize == 0) {
98 return HKS_ERROR_INVALID_ARGUMENT;
99 }
100
101 if (srcBlob->size < *srcOffset) {
102 HKS_LOG_E("Offset is greater than size of source buffer");
103 return HKS_ERROR_BUFFER_TOO_SMALL;
104 }
105
106 if (srcBlob->size - *srcOffset < destSize) {
107 HKS_LOG_E("Source buffer is too small");
108 return HKS_ERROR_BUFFER_TOO_SMALL;
109 }
110
111 if (memcpy_s(dest, destSize, srcBlob->data + *srcOffset, destSize) != EOK) {
112 HKS_LOG_E("copy dest failed!");
113 return HKS_ERROR_INSUFFICIENT_MEMORY;
114 }
115 *srcOffset += destSize;
116 return HKS_SUCCESS;
117 }
118
FillFieldToBuffer(const void * src,uint32_t srcSize,struct HksBlob * destBlob,uint32_t * destOffset)119 int32_t FillFieldToBuffer(const void *src, uint32_t srcSize, struct HksBlob *destBlob, uint32_t *destOffset)
120 {
121 if (src == NULL || srcSize == 0 || CheckBlob(destBlob) != HKS_SUCCESS || destOffset == NULL) {
122 return HKS_ERROR_INVALID_ARGUMENT;
123 }
124
125 if (destBlob->size < *destOffset) {
126 HKS_LOG_E("Offset is greater than size of destination buffer");
127 return HKS_ERROR_BUFFER_TOO_SMALL;
128 }
129
130 if (destBlob->size - *destOffset < srcSize) {
131 HKS_LOG_E("Destination buffer is too small");
132 return HKS_ERROR_BUFFER_TOO_SMALL;
133 }
134
135 if (memcpy_s(destBlob->data + *destOffset, destBlob->size - *destOffset, src, srcSize) != EOK) {
136 HKS_LOG_E("Memcpy failed");
137 return HKS_ERROR_BUFFER_TOO_SMALL;
138 }
139 *destOffset += srcSize;
140 return HKS_SUCCESS;
141 }
142
RkcExtractKsfFileFlag(const struct HksBlob * ksfFromFile,uint32_t * ksfBufOffset)143 int32_t RkcExtractKsfFileFlag(const struct HksBlob *ksfFromFile, uint32_t *ksfBufOffset)
144 {
145 /* Extract file flag. */
146 uint8_t fileFlag[HKS_RKC_KSF_FLAG_LEN] = {0};
147 int32_t ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, fileFlag, HKS_RKC_KSF_FLAG_LEN);
148 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy file flag failed!")
149
150 /* Check file flag. */
151 if (HksMemCmp(fileFlag, g_hksRkcKsfFlag, HKS_RKC_KSF_FLAG_LEN) != 0) {
152 HKS_LOG_E("Ksf file flag is invalid!");
153 return HKS_ERROR_READ_FILE_FAIL;
154 }
155
156 return HKS_SUCCESS;
157 }
158
RkcExtractTime(const struct HksBlob * ksfFromFile,uint32_t * ksfBufOffset,struct HksTime * time)159 static int32_t RkcExtractTime(const struct HksBlob *ksfFromFile, uint32_t *ksfBufOffset, struct HksTime *time)
160 {
161 int32_t ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(time->hksYear), sizeof(time->hksYear));
162 HKS_IF_NOT_SUCC_RETURN(ret, ret)
163
164 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(time->hksMon), sizeof(time->hksMon));
165 HKS_IF_NOT_SUCC_RETURN(ret, ret)
166
167 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(time->hksDay), sizeof(time->hksDay));
168 HKS_IF_NOT_SUCC_RETURN(ret, ret)
169
170 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(time->hksHour), sizeof(time->hksHour));
171 HKS_IF_NOT_SUCC_RETURN(ret, ret)
172
173 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(time->hksMin), sizeof(time->hksMin));
174 HKS_IF_NOT_SUCC_RETURN(ret, ret)
175
176 return ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(time->hksSec), sizeof(time->hksSec));
177 }
178
ExtractKsfDataRkc(const struct HksBlob * ksfFromFile,uint32_t * ksfBufOffset,struct HksKsfDataRkc * ksfDataRkc)179 int32_t ExtractKsfDataRkc(const struct HksBlob *ksfFromFile, uint32_t *ksfBufOffset, struct HksKsfDataRkc *ksfDataRkc)
180 {
181 if (ksfDataRkc == NULL) {
182 return HKS_ERROR_NULL_POINTER;
183 }
184
185 /* Extract rkCreatedTime */
186 int32_t ret = RkcExtractTime(ksfFromFile, ksfBufOffset, &(ksfDataRkc->rkCreatedTime));
187 HKS_IF_NOT_SUCC_RETURN(ret, ret)
188
189 /* Extract rkExpiredTime */
190 ret = RkcExtractTime(ksfFromFile, ksfBufOffset, &(ksfDataRkc->rkExpiredTime));
191 HKS_IF_NOT_SUCC_RETURN(ret, ret)
192
193 /* Extract the first material */
194 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataRkc->rkMaterial1,
195 sizeof(ksfDataRkc->rkMaterial1));
196 HKS_IF_NOT_SUCC_RETURN(ret, ret)
197
198 /* Extract the second material */
199 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataRkc->rkMaterial2,
200 sizeof(ksfDataRkc->rkMaterial2));
201 HKS_IF_NOT_SUCC_RETURN(ret, ret)
202
203 /* Extract iterator number */
204 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(ksfDataRkc->rmkIter), sizeof(ksfDataRkc->rmkIter));
205 HKS_IF_NOT_SUCC_RETURN(ret, ret)
206
207 /* Extract salt */
208 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataRkc->rmkSalt, sizeof(ksfDataRkc->rmkSalt));
209 HKS_IF_NOT_SUCC_RETURN(ret, ret)
210
211 /* Extract hash algorithm */
212 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(ksfDataRkc->rmkHashAlg), sizeof(ksfDataRkc->rmkHashAlg));
213 HKS_IF_NOT_SUCC_RETURN(ret, ret)
214
215 /* Extract reserve field */
216 return ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataRkc->rkRsv, sizeof(ksfDataRkc->rkRsv));
217 }
218
ExtractKsfDataMk(const struct HksBlob * ksfFromFile,uint32_t * ksfBufOffset,struct HksKsfDataMk * ksfDataMk)219 int32_t ExtractKsfDataMk(const struct HksBlob *ksfFromFile, uint32_t *ksfBufOffset, struct HksKsfDataMk *ksfDataMk)
220 {
221 if (ksfDataMk == NULL) {
222 return HKS_ERROR_NULL_POINTER;
223 }
224
225 /* Extract mkCreatedTime */
226 int32_t ret = RkcExtractTime(ksfFromFile, ksfBufOffset, &(ksfDataMk->mkCreatedTime));
227 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Extract mkCreatedTime failed!")
228
229 /* Extract mkExpiredTime */
230 ret = RkcExtractTime(ksfFromFile, ksfBufOffset, &(ksfDataMk->mkExpiredTime));
231 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Extract mkExpiredTime failed!")
232
233 /* Fill encryption algorithm */
234 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(ksfDataMk->mkEncryptAlg),
235 sizeof(ksfDataMk->mkEncryptAlg));
236 HKS_IF_NOT_SUCC_RETURN(ret, ret)
237
238 /* Fill IV */
239 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataMk->mkIv, sizeof(ksfDataMk->mkIv));
240 HKS_IF_NOT_SUCC_RETURN(ret, ret)
241
242 /* Fill ciphertext */
243 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataMk->mkCiphertext,
244 sizeof(ksfDataMk->mkCiphertext));
245 HKS_IF_NOT_SUCC_RETURN(ret, ret)
246
247 /* Fill reserve field */
248 return ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataMk->mkRsv, sizeof(ksfDataMk->mkRsv));
249 }
250
RkcExtractKsfHash(const struct HksBlob * ksfFromFile,uint32_t * ksfBufOffset)251 int32_t RkcExtractKsfHash(const struct HksBlob *ksfFromFile, uint32_t *ksfBufOffset)
252 {
253 if (ksfFromFile == NULL || ksfBufOffset == NULL) {
254 return HKS_ERROR_NULL_POINTER;
255 }
256
257 if (*ksfBufOffset < HKS_RKC_KSF_FLAG_LEN || ksfFromFile->size < HKS_RKC_KSF_FLAG_LEN ||
258 (ksfFromFile->size - HKS_RKC_KSF_FLAG_LEN) < (*ksfBufOffset - HKS_RKC_KSF_FLAG_LEN)) {
259 return HKS_ERROR_INVALID_KEY_FILE;
260 }
261
262 /* calculate sha256, skip file flag, begin with version, end with reserve field. */
263 uint8_t hashResult[HKS_RKC_HASH_LEN] = {0};
264 struct HksBlob hashResultBlob = { HKS_RKC_HASH_LEN, hashResult };
265 /* the upper layer ensures no overflow */
266 const struct HksBlob hashSrc = { *ksfBufOffset - HKS_RKC_KSF_FLAG_LEN, ksfFromFile->data + HKS_RKC_KSF_FLAG_LEN };
267 int32_t ret = HksCryptoHalHash(HKS_DIGEST_SHA256, &hashSrc, &hashResultBlob);
268 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Hks hash failed! ret = 0x%" LOG_PUBLIC "X", ret)
269
270 /* Extract hash from ksf buffer */
271 uint8_t ksfHash[HKS_RKC_HASH_LEN] = {0};
272 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfHash, HKS_RKC_HASH_LEN);
273 HKS_IF_NOT_SUCC_RETURN(ret, ret)
274
275 /* Check hash result. */
276 if (HksMemCmp(hashResult, ksfHash, HKS_RKC_HASH_LEN) != 0) {
277 HKS_LOG_E("Ksf hash result is Invalid!");
278 return HKS_ERROR_INVALID_KEY_FILE;
279 }
280
281 return HKS_SUCCESS;
282 }
283
ExtractKsfBufRkc(const struct HksBlob * ksfFromFile,struct HksKsfDataRkcWithVer * ksfDataRkcWithVer)284 static int32_t ExtractKsfBufRkc(const struct HksBlob *ksfFromFile, struct HksKsfDataRkcWithVer *ksfDataRkcWithVer)
285 {
286 uint32_t ksfBufOffset = 0;
287
288 /* Extract file flag. */
289 int32_t ret = RkcExtractKsfFileFlag(ksfFromFile, &ksfBufOffset);
290 HKS_IF_NOT_SUCC_RETURN(ret, ret)
291
292 /* Extract version */
293 ret = ExtractFieldFromBuffer(ksfFromFile, &ksfBufOffset, &(ksfDataRkcWithVer->rkVersion),
294 sizeof(ksfDataRkcWithVer->rkVersion));
295 HKS_IF_NOT_SUCC_RETURN(ret, ret)
296
297 /* Extract fields of root key component */
298 ret = ExtractKsfDataRkc(ksfFromFile, &ksfBufOffset, &(ksfDataRkcWithVer->ksfDataRkc));
299 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Extract ksf rkc failed! ret = 0x%" LOG_PUBLIC "X", ret)
300
301 /* Extract hash */
302 return RkcExtractKsfHash(ksfFromFile, &ksfBufOffset);
303 }
304
ExtractKsfBufMk(const struct HksBlob * ksfFromFile,struct HksKsfDataMkWithVer * ksfDataMkWithVer)305 static int32_t ExtractKsfBufMk(const struct HksBlob *ksfFromFile, struct HksKsfDataMkWithVer *ksfDataMkWithVer)
306 {
307 uint32_t ksfBufOffset = 0;
308
309 /* Extract file flag. */
310 int32_t ret = RkcExtractKsfFileFlag(ksfFromFile, &ksfBufOffset);
311 HKS_IF_NOT_SUCC_RETURN(ret, ret)
312
313 /* Extract version */
314 ret = ExtractFieldFromBuffer(ksfFromFile, &ksfBufOffset, &(ksfDataMkWithVer->mkVersion),
315 sizeof(ksfDataMkWithVer->mkVersion));
316 HKS_IF_NOT_SUCC_RETURN(ret, ret)
317
318 /* Extract fields of main key */
319 ret = ExtractKsfDataMk(ksfFromFile, &ksfBufOffset, &(ksfDataMkWithVer->ksfDataMk));
320 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Extract ksf mk failed! ret = 0x%" LOG_PUBLIC "X", ret)
321
322 /* Extract hash */
323 return RkcExtractKsfHash(ksfFromFile, &ksfBufOffset);
324 }
325
HksReadKsfRkc(const char * ksfName,struct HksKsfDataRkcWithVer * ksfDataRkc)326 int32_t HksReadKsfRkc(const char *ksfName, struct HksKsfDataRkcWithVer *ksfDataRkc)
327 {
328 struct HksBlob tmpKsf;
329 int32_t ret = GetKeyBlobKsf(ksfName, &tmpKsf);
330 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Get rkc ksf file failed! ret = 0x%" LOG_PUBLIC "X", ret)
331
332 ret = ExtractKsfBufRkc(&tmpKsf, ksfDataRkc);
333
334 /* the data of root key should be cleared after use */
335 (void)memset_s(tmpKsf.data, tmpKsf.size, 0, tmpKsf.size);
336 HKS_FREE_BLOB(tmpKsf);
337 return ret;
338 }
339
HksReadKsfMk(const char * ksfName,struct HksKsfDataMkWithVer * ksfDataMk)340 int32_t HksReadKsfMk(const char *ksfName, struct HksKsfDataMkWithVer *ksfDataMk)
341 {
342 struct HksBlob tmpKsf;
343 int32_t ret = GetKeyBlobKsf(ksfName, &tmpKsf);
344 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Get mk ksf file failed! ret = 0x%" LOG_PUBLIC "X", ret)
345
346 ret = ExtractKsfBufMk(&tmpKsf, ksfDataMk);
347
348 /* the data of main key should be cleared after use */
349 (void)memset_s(tmpKsf.data, tmpKsf.size, 0, tmpKsf.size);
350 HKS_FREE_BLOB(tmpKsf);
351 return ret;
352 }
353
RkcFillKsfTime(const struct HksTime * time,struct HksBlob * ksfBuf,uint32_t * ksfBufOffset)354 static int32_t RkcFillKsfTime(const struct HksTime *time, struct HksBlob *ksfBuf, uint32_t *ksfBufOffset)
355 {
356 int32_t ret = FillFieldToBuffer(&(time->hksYear), sizeof(time->hksYear), ksfBuf, ksfBufOffset);
357 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hksYear failed!")
358
359 ret = FillFieldToBuffer(&(time->hksMon), sizeof(time->hksMon), ksfBuf, ksfBufOffset);
360 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hksMon failed!")
361
362 ret = FillFieldToBuffer(&(time->hksDay), sizeof(time->hksDay), ksfBuf, ksfBufOffset);
363 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hksDay failed!")
364
365 ret = FillFieldToBuffer(&(time->hksHour), sizeof(time->hksHour), ksfBuf, ksfBufOffset);
366 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hksHour failed!")
367
368 ret = FillFieldToBuffer(&(time->hksMin), sizeof(time->hksMin), ksfBuf, ksfBufOffset);
369 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hksMin failed!")
370
371 ret = FillFieldToBuffer(&(time->hksSec), sizeof(time->hksSec), ksfBuf, ksfBufOffset);
372 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hksSec failed!")
373
374 return HKS_SUCCESS;
375 }
376
FillKsfDataRkc(const struct HksKsfDataRkc * ksfDataRkc,struct HksBlob * ksfBuf,uint32_t * ksfBufOffset)377 static int32_t FillKsfDataRkc(const struct HksKsfDataRkc *ksfDataRkc, struct HksBlob *ksfBuf, uint32_t *ksfBufOffset)
378 {
379 /* Fill rkCreatedTime */
380 int32_t ret = RkcFillKsfTime(&(ksfDataRkc->rkCreatedTime), ksfBuf, ksfBufOffset);
381 HKS_IF_NOT_SUCC_RETURN(ret, ret)
382
383 /* Fill rkExpiredTime */
384 ret = RkcFillKsfTime(&(ksfDataRkc->rkExpiredTime), ksfBuf, ksfBufOffset);
385 HKS_IF_NOT_SUCC_RETURN(ret, ret)
386
387 /* Fill the first material */
388 ret = FillFieldToBuffer(ksfDataRkc->rkMaterial1, sizeof(ksfDataRkc->rkMaterial1), ksfBuf, ksfBufOffset);
389 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy first material to ksf buf failed!")
390
391 /* Fill the second material */
392 ret = FillFieldToBuffer(ksfDataRkc->rkMaterial2, sizeof(ksfDataRkc->rkMaterial2), ksfBuf, ksfBufOffset);
393 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy second material to ksf buf failed!")
394
395 /* Fill iterator number */
396 ret = FillFieldToBuffer(&(ksfDataRkc->rmkIter), sizeof(ksfDataRkc->rmkIter), ksfBuf, ksfBufOffset);
397 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy iterator number to ksf buf failed!")
398
399 /* Fill salt */
400 ret = FillFieldToBuffer(ksfDataRkc->rmkSalt, sizeof(ksfDataRkc->rmkSalt), ksfBuf, ksfBufOffset);
401 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy salt to ksf buf failed!")
402
403 /* Fill hash algorithm */
404 ret = FillFieldToBuffer(&(ksfDataRkc->rmkHashAlg), sizeof(ksfDataRkc->rmkHashAlg), ksfBuf, ksfBufOffset);
405 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hash algorithm to ksf buf failed!")
406
407 /* Fill reserve field */
408 ret = FillFieldToBuffer(ksfDataRkc->rkRsv, sizeof(ksfDataRkc->rkRsv), ksfBuf, ksfBufOffset);
409 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy reserve field to ksf buf failed!")
410
411 return HKS_SUCCESS;
412 }
413
FillKsfDataMk(const struct HksKsfDataMk * ksfDataMk,struct HksBlob * ksfBuf,uint32_t * ksfBufOffset)414 static int32_t FillKsfDataMk(const struct HksKsfDataMk *ksfDataMk, struct HksBlob *ksfBuf, uint32_t *ksfBufOffset)
415 {
416 /* Fill mkCreatedTime */
417 int32_t ret = RkcFillKsfTime(&(ksfDataMk->mkCreatedTime), ksfBuf, ksfBufOffset);
418 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Fill mk created time to ksf buf failed!")
419
420 /* Fill mkExpiredTime */
421 ret = RkcFillKsfTime(&(ksfDataMk->mkExpiredTime), ksfBuf, ksfBufOffset);
422 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Fill mk expired time to ksf buf failed!")
423
424 /* Fill encryption algorithm */
425 ret = FillFieldToBuffer(&(ksfDataMk->mkEncryptAlg), sizeof(ksfDataMk->mkEncryptAlg), ksfBuf, ksfBufOffset);
426 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy encrption algorithm to ksf buf failed!")
427
428 /* Fill IV */
429 ret = FillFieldToBuffer(ksfDataMk->mkIv, sizeof(ksfDataMk->mkIv), ksfBuf, ksfBufOffset);
430 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy iv to ksf buf failed!")
431
432 /* Fill ciphertext */
433 ret = FillFieldToBuffer(ksfDataMk->mkCiphertext, sizeof(ksfDataMk->mkCiphertext), ksfBuf, ksfBufOffset);
434 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy ciphertext to ksf buf failed!")
435
436 /* Fill reserve field */
437 ret = FillFieldToBuffer(ksfDataMk->mkRsv, sizeof(ksfDataMk->mkRsv), ksfBuf, ksfBufOffset);
438 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy reserve field to ksf buf failed!")
439
440 return HKS_SUCCESS;
441 }
442
FillKsfVerRkc(const struct HksKsfDataRkcWithVer * ksfDataRkcWithVer,struct HksBlob * ksfBuf,uint32_t * ksfBufOffset)443 static int32_t FillKsfVerRkc(const struct HksKsfDataRkcWithVer *ksfDataRkcWithVer,
444 struct HksBlob *ksfBuf, uint32_t *ksfBufOffset)
445 {
446 /* Fill version */
447 int32_t ret = FillFieldToBuffer(&(ksfDataRkcWithVer->rkVersion), sizeof(ksfDataRkcWithVer->rkVersion),
448 ksfBuf, ksfBufOffset);
449 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy rkc version to ksf buf failed!")
450
451 ret = FillKsfDataRkc(&(ksfDataRkcWithVer->ksfDataRkc), ksfBuf, ksfBufOffset);
452 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy rkc data to ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
453
454 return HKS_SUCCESS;
455 }
456
FillKsfVerMk(const struct HksKsfDataMkWithVer * ksfDataMkWithVer,struct HksBlob * ksfBuf,uint32_t * ksfBufOffset)457 static int32_t FillKsfVerMk(const struct HksKsfDataMkWithVer *ksfDataMkWithVer,
458 struct HksBlob *ksfBuf, uint32_t *ksfBufOffset)
459 {
460 /* Fill version */
461 int32_t ret = FillFieldToBuffer(&(ksfDataMkWithVer->mkVersion), sizeof(ksfDataMkWithVer->mkVersion),
462 ksfBuf, ksfBufOffset);
463 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy mk version to ksf buf failed!")
464
465 ret = FillKsfDataMk(&(ksfDataMkWithVer->ksfDataMk), ksfBuf, ksfBufOffset);
466 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy mk data to ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
467
468 return HKS_SUCCESS;
469 }
470
RkcFillKsfHash(struct HksBlob * ksfBuf,uint32_t * ksfBufOffset)471 static int32_t RkcFillKsfHash(struct HksBlob *ksfBuf, uint32_t *ksfBufOffset)
472 {
473 if ((ksfBuf->size < HKS_RKC_KSF_FLAG_LEN) || (*ksfBufOffset < HKS_RKC_KSF_FLAG_LEN) ||
474 (ksfBuf->size - HKS_RKC_KSF_FLAG_LEN) < (*ksfBufOffset - HKS_RKC_KSF_FLAG_LEN)) {
475 return HKS_ERROR_INVALID_KEY_FILE;
476 }
477
478 /* calculate sha256, skip file flag, begin with version, end with reserve field. */
479 const struct HksBlob msgBlob = { *ksfBufOffset - HKS_RKC_KSF_FLAG_LEN, ksfBuf->data + HKS_RKC_KSF_FLAG_LEN };
480 uint8_t digest[HKS_RKC_HASH_LEN] = { 0 };
481 struct HksBlob digestBlob = { HKS_RKC_HASH_LEN, digest };
482 int32_t ret = HksCryptoHalHash(HKS_DIGEST_SHA256, &msgBlob, &digestBlob);
483 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Hash failed! ret = 0x%" LOG_PUBLIC "X", ret)
484
485 return FillFieldToBuffer(digestBlob.data, digestBlob.size, ksfBuf, ksfBufOffset);
486 }
487
FillKsfBufRkc(const struct HksKsfDataRkcWithVer * ksfDataRkcWithVer,struct HksBlob * ksfBuf)488 static int32_t FillKsfBufRkc(const struct HksKsfDataRkcWithVer *ksfDataRkcWithVer, struct HksBlob *ksfBuf)
489 {
490 uint32_t ksfBufOffset = 0;
491
492 /* Fill file flag */
493 int32_t ret = FillFieldToBuffer(g_hksRkcKsfFlag, sizeof(g_hksRkcKsfFlag), ksfBuf, &ksfBufOffset);
494 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy file flag to ksf buf failed!")
495
496 /* Fill root key */
497 ret = FillKsfVerRkc(ksfDataRkcWithVer, ksfBuf, &ksfBufOffset);
498 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Fill root key info to ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
499
500 /* calculate and fill SHA256 result, skip file flag, begin with version, end with reserve field. */
501 ret = RkcFillKsfHash(ksfBuf, &ksfBufOffset);
502 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Fill hash to ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
503
504 return HKS_SUCCESS;
505 }
506
FillKsfBufMk(const struct HksKsfDataMkWithVer * ksfDataMkWithVer,struct HksBlob * ksfBuf)507 static int32_t FillKsfBufMk(const struct HksKsfDataMkWithVer *ksfDataMkWithVer, struct HksBlob *ksfBuf)
508 {
509 uint32_t ksfBufOffset = 0;
510
511 /* Fill file flag */
512 int32_t ret = FillFieldToBuffer(g_hksRkcKsfFlag, sizeof(g_hksRkcKsfFlag), ksfBuf, &ksfBufOffset);
513 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy file flag to ksf buf failed!")
514
515 /* Fill main key */
516 ret = FillKsfVerMk(ksfDataMkWithVer, ksfBuf, &ksfBufOffset);
517 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Fill main key info to ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
518
519 /* calculate and fill SHA256 result, skip file flag, begin with version, end with reserve field. */
520 ret = RkcFillKsfHash(ksfBuf, &ksfBufOffset);
521 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Fill hash to ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
522
523 return HKS_SUCCESS;
524 }
525
HksWriteKsfRkc(const char * ksfName,const struct HksKsfDataRkcWithVer * ksfDataRkc)526 int32_t HksWriteKsfRkc(const char *ksfName, const struct HksKsfDataRkcWithVer *ksfDataRkc)
527 {
528 struct HksBlob ksfBuf;
529 ksfBuf.data = (uint8_t *)HksMalloc(HKS_KSF_BUF_LEN);
530 HKS_IF_NULL_LOGE_RETURN(ksfBuf.data, HKS_ERROR_MALLOC_FAIL, "Malloc rkc ksf buffer failed!")
531
532 ksfBuf.size = HKS_KSF_BUF_LEN;
533 (void)memset_s(ksfBuf.data, ksfBuf.size, 0, ksfBuf.size);
534
535 int32_t ret;
536 struct HksParamSet *paramSet = NULL;
537 do {
538 /* Fill data into buffer */
539 ret = FillKsfBufRkc(ksfDataRkc, &ksfBuf);
540 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "Fill rkc ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
541
542 struct HksProcessInfo processInfo = HKS_PROCESS_INFO_INIT_VALUE;
543 ret = GetProcessInfo(&processInfo);
544 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "get process info failed")
545
546 /* write buffer data into keystore file */
547 const struct HksBlob fileNameBlob = { strlen(ksfName), (uint8_t *)ksfName };
548
549 ret = HksRkcBuildParamSet(¶mSet);
550 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "rkc build paramset failed")
551
552 ret = HksManageStoreKeyBlob(&processInfo, paramSet, &fileNameBlob, &ksfBuf, HKS_STORAGE_TYPE_ROOT_KEY);
553 HKS_IF_NOT_SUCC_LOGE(ret, "Store rkc ksf failed! ret = 0x%" LOG_PUBLIC "X", ret)
554 } while (0);
555
556 (void)memset_s(ksfBuf.data, ksfBuf.size, 0, ksfBuf.size);
557 HKS_FREE_BLOB(ksfBuf);
558 HksFreeParamSet(¶mSet);
559 return ret;
560 }
561
HksWriteKsfMk(const char * ksfName,const struct HksKsfDataMkWithVer * ksfDataMk)562 int32_t HksWriteKsfMk(const char *ksfName, const struct HksKsfDataMkWithVer *ksfDataMk)
563 {
564 struct HksBlob ksfBuf;
565 ksfBuf.data = (uint8_t *)HksMalloc(HKS_KSF_BUF_LEN);
566 HKS_IF_NULL_LOGE_RETURN(ksfBuf.data, HKS_ERROR_MALLOC_FAIL, "Malloc mk ksf buffer failed!")
567
568 ksfBuf.size = HKS_KSF_BUF_LEN;
569 (void)memset_s(ksfBuf.data, ksfBuf.size, 0, ksfBuf.size);
570
571 int32_t ret;
572 struct HksParamSet *paramSet = NULL;
573 do {
574 /* Fill data into buffer */
575 ret = FillKsfBufMk(ksfDataMk, &ksfBuf);
576 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "Fill mk ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
577
578 struct HksProcessInfo processInfo = HKS_PROCESS_INFO_INIT_VALUE;
579 ret = GetProcessInfo(&processInfo);
580 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "get process info failed")
581
582 /* write buffer data into keystore file */
583 const struct HksBlob fileNameBlob = { strlen(ksfName), (uint8_t *)ksfName };
584
585 ret = HksRkcBuildParamSet(¶mSet);
586 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "rkc build paramset failed")
587
588 ret = HksManageStoreKeyBlob(&processInfo, paramSet, &fileNameBlob, &ksfBuf, HKS_STORAGE_TYPE_ROOT_KEY);
589 HKS_IF_NOT_SUCC_LOGE(ret, "Store mk ksf failed! ret = 0x%" LOG_PUBLIC "X", ret)
590 } while (0);
591
592 (void)memset_s(ksfBuf.data, ksfBuf.size, 0, ksfBuf.size);
593 HKS_FREE_BLOB(ksfBuf);
594 HksFreeParamSet(¶mSet);
595 return ret;
596 }
597
KsfExist(uint8_t ksfType)598 bool KsfExist(uint8_t ksfType)
599 {
600 struct HksProcessInfo processInfo = HKS_PROCESS_INFO_INIT_VALUE;
601 int32_t ret = GetProcessInfo(&processInfo);
602 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INTERNAL_ERROR, "get process info failed")
603
604 const struct HksKsfAttr *ksfFileName = NULL;
605 if (ksfType == HKS_KSF_TYPE_RKC) {
606 ksfFileName = GetGlobalKsfAttrRkc();
607 } else {
608 ksfFileName = GetGlobalKsfAttrMk();
609 }
610
611 struct HksParamSet *paramSet = NULL;
612 ret = HksRkcBuildParamSet(¶mSet);
613 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "rkc build paramset failed")
614
615 for (uint32_t i = 0; i < HKS_KSF_NUM; ++i) {
616 if (ksfFileName->name[i] == NULL) {
617 continue;
618 }
619 struct HksBlob fileNameBlob = { strlen(ksfFileName->name[i]), (uint8_t *)(ksfFileName->name[i]) };
620 if (HksManageStoreIsKeyBlobExist(&processInfo, paramSet, &fileNameBlob,
621 HKS_STORAGE_TYPE_ROOT_KEY) == HKS_SUCCESS) {
622 HksFreeParamSet(¶mSet);
623 return true;
624 }
625 }
626 HksFreeParamSet(¶mSet);
627 return false;
628 }
629 #endif /* _CUT_AUTHENTICATE_ */
630