• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (c) 2021-2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *    http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #define HUKS_DISABLE_LOG_AT_FILE_TO_REDUCE_ROM_SIZE
16 
17 #ifdef HKS_CONFIG_FILE
18 #include HKS_CONFIG_FILE
19 #else
20 #include "hks_config.h"
21 #endif
22 
23 #include "hks_check_paramset.h"
24 
25 #ifdef L2_STANDARD
26 #include "hks_openssl_dh.h"
27 #include "hks_openssl_rsa.h"
28 #endif
29 
30 #include <stddef.h>
31 
32 #include "hks_base_check.h"
33 #include "hks_common_check.h"
34 #include "hks_crypto_hal.h"
35 #include "hks_log.h"
36 #include "hks_param.h"
37 #include "hks_template.h"
38 #include "securec.h"
39 
40 #ifdef _CUT_AUTHENTICATE_
41 #undef HKS_SUPPORT_HASH_C
42 #undef HKS_SUPPORT_RSA_C
43 #undef HKS_SUPPORT_ECC_C
44 #undef HKS_SUPPORT_X25519_C
45 #undef HKS_SUPPORT_ED25519_C
46 #undef HKS_SUPPORT_KDF_PBKDF2
47 #endif /* _CUT_AUTHENTICATE_ */
48 
49 #define HKS_DEFAULT_PBKDF2_ITERATION 1000
50 #define HKS_MAX_PBKDF2_ITERATION 0x80000U
51 #define HKS_DEFAULT_PBKDF2_SALT_SIZE 16
52 
53 #ifndef _CUT_AUTHENTICATE_
54 static uint32_t g_genKeyAlg[] = {
55 #ifdef HKS_SUPPORT_RSA_C
56     HKS_ALG_RSA,
57 #endif
58 #ifdef HKS_SUPPORT_AES_C
59     HKS_ALG_AES,
60 #endif
61 #ifdef HKS_SUPPORT_DES_C
62     HKS_ALG_DES,
63 #endif
64 #ifdef HKS_SUPPORT_3DES_C
65     HKS_ALG_3DES,
66 #endif
67 #ifdef HKS_SUPPORT_ECC_C
68     HKS_ALG_ECC,
69 #endif
70 #ifdef HKS_SUPPORT_HMAC_C
71     HKS_ALG_HMAC,
72 #endif
73 #ifdef HKS_SUPPORT_CMAC_C
74     HKS_ALG_CMAC,
75 #endif
76 #ifdef HKS_SUPPORT_ED25519_C
77     HKS_ALG_ED25519,
78 #endif
79 #ifdef HKS_SUPPORT_X25519_C
80     HKS_ALG_X25519,
81 #endif
82 #ifdef HKS_SUPPORT_DSA_C
83     HKS_ALG_DSA,
84 #endif
85 #ifdef HKS_SUPPORT_DH_C
86     HKS_ALG_DH,
87 #endif
88 #ifdef HKS_SUPPORT_ECDH_C
89     HKS_ALG_ECDH,
90 #endif
91 #ifdef HKS_SUPPORT_SM3_C
92     HKS_ALG_SM3,
93 #endif
94 #ifdef HKS_SUPPORT_SM2_C
95     HKS_ALG_SM2,
96 #endif
97 #ifdef HKS_SUPPORT_SM4_C
98     HKS_ALG_SM4,
99 #endif
100 };
101 
102 static uint32_t g_importKeyAlg[] = {
103 #ifdef HKS_SUPPORT_RSA_C
104     HKS_ALG_RSA,
105 #endif
106 #ifdef HKS_SUPPORT_AES_C
107     HKS_ALG_AES,
108 #endif
109 #ifdef HKS_SUPPORT_DES_C
110     HKS_ALG_DES,
111 #endif
112 #ifdef HKS_SUPPORT_3DES_C
113     HKS_ALG_3DES,
114 #endif
115 #ifdef HKS_SUPPORT_ECC_C
116     HKS_ALG_ECC,
117 #endif
118 #ifdef HKS_SUPPORT_X25519_C
119     HKS_ALG_X25519,
120 #endif
121 #ifdef HKS_SUPPORT_ED25519_C
122     HKS_ALG_ED25519,
123 #endif
124 #ifdef HKS_SUPPORT_DSA_C
125     HKS_ALG_DSA,
126 #endif
127 #ifdef HKS_SUPPORT_DH_C
128     HKS_ALG_DH,
129 #endif
130 #ifdef HKS_SUPPORT_HMAC_C
131     HKS_ALG_HMAC,
132 #endif
133 #ifdef HKS_SUPPORT_CMAC_C
134     HKS_ALG_CMAC,
135 #endif
136 #ifdef HKS_SUPPORT_SM2_C
137     HKS_ALG_SM2,
138 #endif
139 #ifdef HKS_SUPPORT_SM3_C
140     HKS_ALG_SM3,
141 #endif
142 #ifdef HKS_SUPPORT_SM4_C
143     HKS_ALG_SM4,
144 #endif
145 };
146 
147 static uint32_t g_cipherAlg[] = {
148 #ifdef HKS_SUPPORT_RSA_C
149     HKS_ALG_RSA,
150 #endif
151 #ifdef HKS_SUPPORT_AES_C
152     HKS_ALG_AES,
153 #endif
154 #ifdef HKS_SUPPORT_DES_C
155     HKS_ALG_DES,
156 #endif
157 #ifdef HKS_SUPPORT_3DES_C
158     HKS_ALG_3DES,
159 #endif
160 #ifdef HKS_SUPPORT_SM2_C
161     HKS_ALG_SM2,
162 #endif
163 #ifdef HKS_SUPPORT_SM4_C
164     HKS_ALG_SM4,
165 #endif
166 };
167 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
168 static uint32_t g_signAlg[] = {
169 #ifdef HKS_SUPPORT_RSA_C
170     HKS_ALG_RSA,
171 #endif
172 #ifdef HKS_SUPPORT_DSA_C
173     HKS_ALG_DSA,
174 #endif
175 #ifdef HKS_SUPPORT_ECC_C
176     HKS_ALG_ECC,
177 #endif
178 #ifdef HKS_SUPPORT_ED25519_C
179     HKS_ALG_ED25519,
180 #endif
181 #ifdef HKS_SUPPORT_SM2_C
182     HKS_ALG_SM2,
183 #endif
184 };
185 #endif
186 
187 static uint32_t g_agreeAlg[] = {
188 #ifdef HKS_SUPPORT_X25519_C
189     HKS_ALG_X25519,
190 #endif
191 #ifdef HKS_SUPPORT_ECDH_C
192     HKS_ALG_ECDH,
193 #endif
194 #ifdef HKS_SUPPORT_DH_C
195     HKS_ALG_DH,
196 #endif
197 };
198 
199 static uint32_t g_agreeAlgLocal[] = {
200 #ifdef HKS_SUPPORT_ECDH_C
201     HKS_ALG_ECDH,
202 #endif
203 #ifdef HKS_SUPPORT_X25519_C
204     HKS_ALG_X25519,
205 #endif
206 #ifdef HKS_SUPPORT_DH_C
207     HKS_ALG_DH,
208 #endif
209 };
210 
211 static uint32_t g_unwrapSuite[] = {
212 #if defined(HKS_SUPPORT_X25519_C) && defined(HKS_SUPPORT_AES_GCM)
213     HKS_UNWRAP_SUITE_X25519_AES_256_GCM_NOPADDING,
214 #endif
215 #if defined(HKS_SUPPORT_ECDH_C) && defined(HKS_SUPPORT_AES_GCM)
216     HKS_UNWRAP_SUITE_ECDH_AES_256_GCM_NOPADDING,
217 #endif
218 #if defined(HKS_SUPPORT_SM2_C) && defined(HKS_SUPPORT_SM4_C)
219     HKS_UNWRAP_SUITE_SM2_SM4_128_CBC_PKCS7_WITH_VERIFY_DIG_SM3,
220     HKS_UNWRAP_SUITE_SM2_SM4_128_CBC_PKCS7
221 #endif
222 };
223 #endif /* _CUT_AUTHENTICATE_ */
224 
225 static uint32_t g_deriveAlg[] = {
226 #ifdef HKS_SUPPORT_KDF_HKDF
227     HKS_ALG_HKDF,
228 #endif
229 #ifdef HKS_SUPPORT_KDF_PBKDF2
230     HKS_ALG_PBKDF2,
231 #endif
232 #ifdef HKS_SUPPORT_KDF_SM3
233     HKS_ALG_GMKDF,
234 #endif
235 };
236 
237 static uint32_t g_deriveAlgLocal[] = {
238 #ifdef HKS_SUPPORT_KDF_HKDF
239     HKS_ALG_HKDF,
240 #endif
241 };
242 
243 static uint32_t g_digest[] = {
244     HKS_DIGEST_SHA1,
245     HKS_DIGEST_SHA224,
246     HKS_DIGEST_SHA256,
247     HKS_DIGEST_SHA384,
248     HKS_DIGEST_SHA512,
249     HKS_DIGEST_SM3
250 };
251 static uint32_t g_macDigest[] = {
252     HKS_DIGEST_SHA1,
253     HKS_DIGEST_SHA224,
254     HKS_DIGEST_SHA256,
255     HKS_DIGEST_SHA384,
256     HKS_DIGEST_SHA512,
257     HKS_DIGEST_SM3
258 };
259 #ifdef HKS_SUPPORT_AES_C
260 static uint32_t g_aesKeySizeLocal[] = {
261     HKS_AES_KEY_SIZE_128,
262     HKS_AES_KEY_SIZE_192,
263     HKS_AES_KEY_SIZE_256,
264 };
265 #endif
266 #ifdef HKS_SUPPORT_DES_C
267 static uint32_t g_desKeySizeLocal[] = {
268     HKS_DES_KEY_SIZE_64
269 };
270 #endif
271 #ifdef HKS_SUPPORT_3DES_C
272 static uint32_t g_3desKeySizeLocal[] = {
273     HKS_3DES_KEY_SIZE_128,
274     HKS_3DES_KEY_SIZE_192
275 };
276 #endif
277 #ifdef HKS_SUPPORT_RSA_C
278 static uint32_t g_rsaKeySizeLocal[] = {
279     HKS_RSA_KEY_SIZE_512,
280     HKS_RSA_KEY_SIZE_768,
281     HKS_RSA_KEY_SIZE_1024,
282     HKS_RSA_KEY_SIZE_2048,
283     HKS_RSA_KEY_SIZE_3072,
284     HKS_RSA_KEY_SIZE_4096,
285 };
286 #endif
287 
288 static uint32_t g_cipherAlgLocal[] = {
289 #ifdef HKS_SUPPORT_AES_C
290     HKS_ALG_AES,
291 #endif
292 #ifdef HKS_SUPPORT_DES_C
293     HKS_ALG_DES,
294 #endif
295 #ifdef HKS_SUPPORT_3DES_C
296     HKS_ALG_3DES,
297 #endif
298 #ifdef HKS_SUPPORT_RSA_C
299     HKS_ALG_RSA,
300 #endif
301 };
302 
303 static uint32_t g_symmetricAlgorithm[] = {
304 #ifdef HKS_SUPPORT_AES_C
305     HKS_ALG_AES,
306 #endif
307 #ifdef HKS_SUPPORT_DES_C
308     HKS_ALG_DES,
309 #endif
310 #ifdef HKS_SUPPORT_3DES_C
311     HKS_ALG_3DES,
312 #endif
313 #ifdef HKS_SUPPORT_HMAC_C
314     HKS_ALG_HMAC,
315 #endif
316 #ifdef HKS_SUPPORT_CMAC_C
317     HKS_ALG_CMAC,
318 #endif
319 #ifdef HKS_SUPPORT_SM3_C
320     HKS_ALG_SM3,
321 #endif
322 #ifdef HKS_SUPPORT_SM4_C
323     HKS_ALG_SM4,
324 #endif
325 };
326 
CheckAndGetAlgorithm(const struct HksParamSet * paramSet,const uint32_t * expectAlg,uint32_t expectCnt,uint32_t * alg)327 static int32_t CheckAndGetAlgorithm(
328     const struct HksParamSet *paramSet, const uint32_t *expectAlg, uint32_t expectCnt, uint32_t *alg)
329 {
330     struct HksParam *algParam = NULL;
331     int32_t ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &algParam);
332     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_ALG_FAIL,
333         "get param 0x%" LOG_PUBLIC "x failed!", HKS_TAG_ALGORITHM)
334 
335     ret = HksCheckValue(algParam->uint32Param, expectAlg, expectCnt);
336     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_ALGORITHM,
337         "alg value %" LOG_PUBLIC "u not expected", algParam->uint32Param)
338 
339     *alg = algParam->uint32Param;
340     return ret;
341 }
342 
CheckAndGetDigest(const struct HksParamSet * paramSet,const uint32_t * expectDigest,uint32_t expectCnt,uint32_t * digest)343 static int32_t CheckAndGetDigest(
344     const struct HksParamSet *paramSet, const uint32_t *expectDigest, uint32_t expectCnt, uint32_t *digest)
345 {
346     struct HksParam *digestParam = NULL;
347     int32_t ret = HksGetParam(paramSet, HKS_TAG_DIGEST, &digestParam);
348     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_DIGEST_FAIL,
349         "get param get 0x%" LOG_PUBLIC "x failed!", HKS_TAG_DIGEST)
350 
351     ret = HksCheckValue(digestParam->uint32Param, expectDigest, expectCnt);
352     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_DIGEST,
353         "digest value %" LOG_PUBLIC "u not expected", digestParam->uint32Param)
354 
355     *digest = digestParam->uint32Param;
356     return ret;
357 }
358 
HksGetInputParmasByAlg(uint32_t alg,enum CheckKeyType checkType,const struct HksParamSet * paramSet,struct ParamsValues * inputParams)359 int32_t HksGetInputParmasByAlg(uint32_t alg, enum CheckKeyType checkType, const struct HksParamSet *paramSet,
360     struct ParamsValues *inputParams)
361 {
362     int32_t ret = InitInputParamsByAlg(alg, checkType, inputParams);
363     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "init input params failed!")
364 
365     ret = GetInputParams(paramSet, inputParams);
366     HKS_IF_NOT_SUCC_LOGE(ret, "get input params failed!")
367 
368     return ret;
369 }
CheckOptionalParams(bool needCheck,bool isAbsent,uint32_t inputValue,const uint32_t * expectValue,uint32_t expectCnt)370 static int32_t CheckOptionalParams(bool needCheck, bool isAbsent, uint32_t inputValue, const uint32_t* expectValue,
371     uint32_t expectCnt)
372 {
373     if (needCheck) {
374         if (!isAbsent) {
375             if (HksCheckValue(inputValue, expectValue, expectCnt) != HKS_SUCCESS) {
376                 HKS_LOG_E("CheckOptionalParams invalid argument, %" LOG_PUBLIC "u", inputValue);
377                 return HKS_ERROR_INVALID_ARGUMENT;
378             }
379         }
380     }
381     return HKS_SUCCESS;
382 }
383 
InitCheckOptionalParams(bool needCheck,bool isAbsent,struct HksParam * param,const uint32_t * expectValue,uint32_t expectCnt)384 static int32_t InitCheckOptionalParams(bool needCheck, bool isAbsent, struct HksParam *param,
385     const uint32_t* expectValue, uint32_t expectCnt)
386 {
387     if (needCheck) {
388         if (!isAbsent) {
389             if (HksCheckValue(param->uint32Param, expectValue, expectCnt) != HKS_SUCCESS) {
390                 return HKS_ERROR_INVALID_ARGUMENT;
391             }
392         } else {
393             HKS_LOG_E("This param is absent, but it is necessary.");
394             return HKS_ERROR_NOT_EXIST;
395         }
396     }
397     return HKS_SUCCESS;
398 }
399 
HksCheckOptionalParam(uint32_t tag,uint32_t alg,uint32_t purpose,bool isAbsent,struct HksParam * param)400 int32_t HksCheckOptionalParam(uint32_t tag, uint32_t alg, uint32_t purpose, bool isAbsent, struct HksParam *param)
401 {
402     enum CheckKeyType checkType = HKS_CHECK_TYPE_GEN_KEY;
403     if (((purpose & HKS_KEY_PURPOSE_DERIVE) != 0) || ((purpose & HKS_KEY_PURPOSE_MAC) != 0)) {
404         if ((alg != HKS_ALG_AES) && (alg != HKS_ALG_DES) && (alg != HKS_ALG_3DES) &&
405             (alg != HKS_ALG_HMAC) && (alg != HKS_ALG_CMAC) && (alg != HKS_ALG_SM3)) {
406             HKS_LOG_E("check mac or derive, not aes alg, alg: %" LOG_PUBLIC "u", alg);
407             return HKS_ERROR_INVALID_PURPOSE;
408         }
409         if (purpose == HKS_KEY_PURPOSE_DERIVE) {
410             checkType = HKS_CHECK_TYPE_GEN_DERIVE_KEY;
411         } else {
412             checkType = HKS_CHECK_TYPE_GEN_MAC_KEY;
413         }
414     }
415     struct ExpectParamsValues expectValues = EXPECT_PARAMS_VALUES_INIT;
416     int32_t ret = GetExpectParams(alg, checkType, &expectValues);
417     HKS_IF_NOT_SUCC_RETURN(ret, ret)
418     switch (tag) {
419         case HKS_TAG_BLOCK_MODE:
420             ret = InitCheckOptionalParams(expectValues.mode.needCheck, isAbsent, param,
421                 expectValues.mode.values, expectValues.mode.valueCnt);
422             HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_MODE_FAIL,
423                 "check param fail:0x%" LOG_PUBLIC "x failed", HKS_TAG_BLOCK_MODE);
424             break;
425         case HKS_TAG_DIGEST:
426             ret = InitCheckOptionalParams(expectValues.digest.needCheck, isAbsent, param,
427                 expectValues.digest.values, expectValues.digest.valueCnt);
428             HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_DIGEST_FAIL,
429                 "check param fail:0x%" LOG_PUBLIC "x failed", HKS_TAG_DIGEST);
430             break;
431         case HKS_TAG_PADDING:
432             ret = InitCheckOptionalParams(expectValues.padding.needCheck, isAbsent, param,
433                 expectValues.padding.values, expectValues.padding.valueCnt);
434             HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_PADDING_FAIL,
435                 "check param fail:0x%" LOG_PUBLIC "x failed", HKS_TAG_PADDING);
436             break;
437         default:
438             HKS_LOG_E("invalid tag: %" LOG_PUBLIC "u", tag);
439             ret = HKS_FAILURE;
440     }
441     return ret;
442 }
443 
HksCheckFixedParams(uint32_t alg,enum CheckKeyType checkType,const struct ParamsValues * inputParams)444 int32_t HksCheckFixedParams(uint32_t alg, enum CheckKeyType checkType, const struct ParamsValues *inputParams)
445 {
446     struct ExpectParamsValues expectValues = EXPECT_PARAMS_VALUES_INIT;
447     int32_t ret = GetExpectParams(alg, checkType, &expectValues);
448     HKS_IF_NOT_SUCC_RETURN(ret, ret)
449 
450     ret = CheckOptionalParams(expectValues.keyLen.needCheck, inputParams->keyLen.isAbsent, inputParams->keyLen.value,
451         expectValues.keyLen.values, expectValues.keyLen.valueCnt);
452 #ifdef HKS_SUPPORT_RSA_C_FLEX_KEYSIZE
453     if ((ret != HKS_SUCCESS) && (alg == HKS_ALG_RSA)) {
454         ret = CheckRsaKeySize(inputParams->keyLen.value);
455     }
456 #endif
457     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_KEY_SIZE,
458         "check keyLen not expected, len = %" LOG_PUBLIC "u", inputParams->keyLen.value);
459     ret = CheckOptionalParams(expectValues.padding.needCheck, inputParams->padding.isAbsent, inputParams->padding.value,
460         expectValues.padding.values, expectValues.padding.valueCnt);
461     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_PADDING,
462         "check padding not expected, padding = %" LOG_PUBLIC "u", inputParams->padding.value);
463     ret = CheckOptionalParams(expectValues.purpose.needCheck, inputParams->purpose.isAbsent, inputParams->purpose.value,
464         expectValues.purpose.values, expectValues.purpose.valueCnt);
465     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_PURPOSE,
466         "check purpose not expected, purpose = %" LOG_PUBLIC "u", inputParams->purpose.value);
467     ret = CheckOptionalParams(expectValues.digest.needCheck, inputParams->digest.isAbsent, inputParams->digest.value,
468         expectValues.digest.values, expectValues.digest.valueCnt);
469     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_DIGEST,
470         "check digest not expected, digest = %" LOG_PUBLIC "u", inputParams->digest.value);
471     ret = CheckOptionalParams(expectValues.mode.needCheck, inputParams->mode.isAbsent, inputParams->mode.value,
472         expectValues.mode.values, expectValues.mode.valueCnt);
473     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_MODE,
474         "check mode not expected, mode = %" LOG_PUBLIC "u", inputParams->mode.value);
475     return ret;
476 }
477 
478 #ifndef _CUT_AUTHENTICATE_
CheckGenKeyParamsByAlg(uint32_t alg,const struct HksParamSet * paramSet,struct ParamsValues * params,uint32_t keyFlag)479 static int32_t CheckGenKeyParamsByAlg(uint32_t alg, const struct HksParamSet *paramSet,
480     struct ParamsValues *params, uint32_t keyFlag)
481 {
482     int32_t ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_GEN_KEY, paramSet, params);
483     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret,
484         "get input params by algorithm failed, ret = %" LOG_PUBLIC "d", ret)
485 
486     ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_GEN_KEY, params);
487     HKS_IF_NOT_SUCC_RETURN(ret, ret)
488 
489     ret = HksCheckGenKeyPurpose(alg, params->purpose.value, keyFlag);
490     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret,
491         "check purpose not expected, purpose =  %" LOG_PUBLIC "d", params->purpose.value);
492     return HksCheckGenKeyMutableParams(alg, params);
493 }
494 
CheckGenKeyMacDeriveParams(uint32_t alg,uint32_t inputPurpose,const struct HksParamSet * paramSet,struct ParamsValues * params,uint32_t keyFlag)495 static int32_t CheckGenKeyMacDeriveParams(
496     uint32_t alg, uint32_t inputPurpose, const struct HksParamSet *paramSet, struct ParamsValues *params,
497     uint32_t keyFlag)
498 {
499     if (alg != HKS_ALG_AES && alg != HKS_ALG_DES && alg != HKS_ALG_3DES && alg != HKS_ALG_HMAC &&
500         alg != HKS_ALG_CMAC && alg != HKS_ALG_SM3 && alg != HKS_ALG_SM4) {
501         HKS_LOG_E("check mac or derive, not valid alg, alg: %" LOG_PUBLIC "u", alg);
502         return HKS_ERROR_INVALID_PURPOSE;
503     }
504 
505     int32_t ret = HksCheckGenKeyPurpose(alg, inputPurpose, keyFlag);
506     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check purpose invalid, purpose 0x%" LOG_PUBLIC "x", inputPurpose)
507 
508     if (inputPurpose == HKS_KEY_PURPOSE_MAC) {
509         ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_GEN_MAC_KEY, paramSet, params);
510     } else {
511         ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_GEN_DERIVE_KEY, paramSet, params);
512     }
513     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get input params by algorithm failed, ret = %" LOG_PUBLIC "d", ret)
514 
515     if (inputPurpose == HKS_KEY_PURPOSE_MAC) {
516         ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_GEN_MAC_KEY, params);
517     } else {
518         ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_GEN_DERIVE_KEY, params);
519     }
520     HKS_IF_NOT_SUCC_LOGE(ret, "get input params by algorithm failed, ret = %" LOG_PUBLIC "d", ret)
521 
522     return ret;
523 }
524 
CoreCheckGenKeyParams(const struct HksParamSet * paramSet,struct ParamsValues * params,uint32_t keyFlag)525 static int32_t CoreCheckGenKeyParams(const struct HksParamSet *paramSet, struct ParamsValues *params, uint32_t keyFlag)
526 {
527     uint32_t alg;
528     int32_t ret = HksCheckParamSetTag(paramSet);
529     HKS_IF_NOT_SUCC_RETURN(ret, ret)
530 
531     ret = CheckAndGetAlgorithm(paramSet, g_genKeyAlg, HKS_ARRAY_SIZE(g_genKeyAlg), &alg);
532     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check and get alg failed")
533 
534     struct HksParam *purposeParam = NULL;
535     struct HksParam *batchPurposeParam = NULL;
536     ret = HksGetParam(paramSet, HKS_TAG_PURPOSE, &purposeParam);
537     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_PURPOSE_FAIL,
538         "get param get 0x%" LOG_PUBLIC "x failed", HKS_TAG_PURPOSE)
539     ret = HksGetParam(paramSet, HKS_TAG_BATCH_PURPOSE, &batchPurposeParam);
540     if (ret == HKS_SUCCESS) {
541         if ((purposeParam->uint32Param | batchPurposeParam->uint32Param) != purposeParam->uint32Param) {
542             HKS_LOG_E("batchPurposeParam should fall within the scope of purposeParam.");
543             return HKS_ERROR_INVALID_PURPOSE;
544         }
545     }
546 
547     struct HksParam *authTypeParam = NULL;
548     int32_t result = HksGetParam(paramSet, HKS_TAG_USER_AUTH_TYPE, &authTypeParam);
549     if (result == HKS_SUCCESS && authTypeParam->uint32Param == HKS_USER_AUTH_TYPE_TUI_PIN) {
550         HKS_LOG_E("TUI PIN user auth type not supported");
551         return HKS_ERROR_USER_AUTH_TYPE_NOT_SUPPORT;
552     }
553 
554     if (((purposeParam->uint32Param & HKS_KEY_PURPOSE_DERIVE) != 0) ||
555         ((purposeParam->uint32Param & HKS_KEY_PURPOSE_MAC) != 0)) {
556         return CheckGenKeyMacDeriveParams(alg, purposeParam->uint32Param, paramSet, params, keyFlag);
557     }
558 
559     return CheckGenKeyParamsByAlg(alg, paramSet, params, keyFlag);
560 }
561 
CheckImportKeySize(uint32_t alg,const struct ParamsValues * params,const struct HksBlob * key)562 static int32_t CheckImportKeySize(uint32_t alg, const struct ParamsValues *params, const struct HksBlob *key)
563 {
564     int32_t ret = HKS_SUCCESS;
565     switch (alg) {
566         case HKS_ALG_ED25519:
567         case HKS_ALG_X25519:
568         case HKS_ALG_RSA:
569         case HKS_ALG_ECC:
570         case HKS_ALG_SM2:
571         case HKS_ALG_DH: {
572             if (key->size < sizeof(struct HksPubKeyInfo)) {
573                 ret = HKS_ERROR_INVALID_KEY_INFO;
574                 break;
575             }
576             struct HksPubKeyInfo *keyMaterial = (struct HksPubKeyInfo *)(key->data);
577             if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
578                 ret = HKS_ERROR_INVALID_KEY_INFO;
579             }
580             break;
581         }
582 #ifdef HKS_SUPPORT_DSA_C
583         case HKS_ALG_DSA:
584             break;
585 #endif
586         default:
587             return HKS_ERROR_INVALID_ALGORITHM;
588     }
589     return ret;
590 }
591 
CheckAndGetWrappedKeyUnwrapAlgSuite(const struct HksParamSet * paramSet,uint32_t * algSuite)592 static int32_t CheckAndGetWrappedKeyUnwrapAlgSuite(const struct HksParamSet *paramSet, uint32_t *algSuite)
593 {
594     struct HksParam *algorithmSuite = NULL;
595     int32_t ret = HksGetParam(paramSet, HKS_TAG_UNWRAP_ALGORITHM_SUITE, &algorithmSuite);
596     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_ALG_FAIL, "get unwrap algorithm suite fail")
597 
598     ret = HksCheckValue(algorithmSuite->uint32Param, g_unwrapSuite, HKS_ARRAY_SIZE(g_unwrapSuite));
599     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_ALGORITHM,
600         "unwrap algorithm suite value %" LOG_PUBLIC "u not expected", algorithmSuite->uint32Param)
601 
602     *algSuite = algorithmSuite->uint32Param;
603     return HKS_SUCCESS;
604 }
605 
606 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
CheckSignVerifyParamsByAlg(uint32_t cmdId,uint32_t alg,const struct ParamsValues * inputParams)607 static int32_t CheckSignVerifyParamsByAlg(uint32_t cmdId, uint32_t alg, const struct ParamsValues *inputParams)
608 {
609     int32_t ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_USE_KEY, inputParams);
610     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check sign or verify fixed params failed, ret = %" LOG_PUBLIC "d", ret)
611 
612     ret = HksCheckSignVerifyMutableParams(cmdId, alg, inputParams);
613     HKS_IF_NOT_SUCC_LOGE(ret, "check sign or verify mutable params failed, ret = %" LOG_PUBLIC "d", ret)
614 
615     return ret;
616 }
617 #endif
618 #endif /* _CUT_AUTHENTICATE_ */
619 
CheckCipherParamsByAlg(uint32_t cmdId,uint32_t alg,const struct HksParamSet * paramSet,const struct ParamsValues * inputParams)620 static int32_t CheckCipherParamsByAlg(
621     uint32_t cmdId, uint32_t alg, const struct HksParamSet *paramSet, const struct ParamsValues *inputParams)
622 {
623     int32_t ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_USE_KEY, inputParams);
624     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher check fixed params failed, ret = %" LOG_PUBLIC "d", ret)
625 
626     ret = HksCheckCipherMutableParams(cmdId, alg, inputParams);
627     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher check mutable params failed, ret = %" LOG_PUBLIC "d", ret)
628 
629     ret = HksCheckCipherMaterialParams(alg, inputParams, paramSet);
630     HKS_IF_NOT_SUCC_LOGE(ret, "cipher check material params failed, ret = %" LOG_PUBLIC "d", ret)
631 
632     return ret;
633 }
634 
635 #ifndef _CUT_AUTHENTICATE_
636 #ifdef HKS_SUPPORT_KDF_PBKDF2
CheckPbkdf2DeriveKeyParams(const struct HksParamSet * paramSet)637 static int32_t CheckPbkdf2DeriveKeyParams(const struct HksParamSet *paramSet)
638 {
639     struct HksParam *iterationParam = NULL;
640     int32_t ret = HksGetParam(paramSet, HKS_TAG_ITERATION, &iterationParam);
641     HKS_IF_NOT_SUCC_RETURN(ret, HKS_ERROR_CHECK_GET_ITERATION_FAIL)
642 
643     if (iterationParam->uint32Param < HKS_DEFAULT_PBKDF2_ITERATION ||
644         iterationParam->uint32Param > HKS_MAX_PBKDF2_ITERATION) {
645         HKS_LOG_E("invalid iteration param %" LOG_PUBLIC "u", iterationParam->uint32Param);
646         return HKS_ERROR_INVALID_ITERATION;
647     }
648 
649     struct HksParam *saltParam = NULL;
650     ret = HksGetParam(paramSet, HKS_TAG_SALT, &saltParam);
651     HKS_IF_NOT_SUCC_RETURN(ret, HKS_ERROR_CHECK_GET_SALT_FAIL)
652 
653     if ((CheckBlob(&saltParam->blob) != HKS_SUCCESS) || (saltParam->blob.size < HKS_DEFAULT_PBKDF2_SALT_SIZE)) {
654         return HKS_ERROR_INVALID_SALT;
655     }
656 
657     return HKS_SUCCESS;
658 }
659 #endif
660 
HksCoreCheckGenKeyParams(const struct HksBlob * keyAlias,const struct HksParamSet * paramSet,const struct HksBlob * keyIn,const struct HksBlob * keyOut,uint32_t keyFlag)661 int32_t HksCoreCheckGenKeyParams(const struct HksBlob *keyAlias, const struct HksParamSet *paramSet,
662     const struct HksBlob *keyIn, const struct HksBlob *keyOut, uint32_t keyFlag)
663 {
664     (void)keyAlias;
665     (void)keyIn;
666     (void)keyOut;
667     struct ParamsValues params;
668     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
669     return CoreCheckGenKeyParams(paramSet, &params, keyFlag);
670 }
671 
CheckRsaKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)672 static int32_t CheckRsaKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
673     const struct HksBlob *key)
674 {
675     (void)keyType;
676     if (key->size < sizeof(struct HksKeyMaterialRsa)) {
677         HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
678         return HKS_ERROR_INVALID_KEY_INFO;
679     }
680 
681     struct HksKeyMaterialRsa *keyMaterial = (struct HksKeyMaterialRsa *)(key->data);
682     if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
683         HKS_LOG_E("invalid import key material");
684         return HKS_ERROR_INVALID_KEY_INFO;
685     }
686 
687     if ((keyMaterial->nSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->nSize == 0) ||
688         (keyMaterial->dSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->dSize == 0) ||
689         (keyMaterial->eSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->eSize == 0)) {
690         HKS_LOG_E("invalid import key material n/d/e size");
691         return HKS_ERROR_INVALID_KEY_INFO;
692     }
693 
694     uint32_t keySize = sizeof(struct HksKeyMaterialRsa) + keyMaterial->nSize + keyMaterial->dSize + keyMaterial->eSize;
695     if (key->size < keySize) {
696         HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
697         return HKS_ERROR_INVALID_KEY_INFO;
698     }
699 
700     return HKS_SUCCESS;
701 }
702 
CheckEccKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)703 static int32_t CheckEccKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
704     const struct HksBlob *key)
705 {
706     if (key->size < sizeof(struct HksKeyMaterialEcc)) {
707         HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
708         return HKS_ERROR_INVALID_KEY_INFO;
709     }
710 
711     struct HksKeyMaterialEcc *keyMaterial = (struct HksKeyMaterialEcc *)(key->data);
712     if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
713         HKS_LOG_E("invalid import key material");
714         return HKS_ERROR_INVALID_KEY_INFO;
715     }
716 
717     if ((keyMaterial->xSize > HKS_ECC_KEY_SIZE_521) || (keyMaterial->ySize > HKS_ECC_KEY_SIZE_521) ||
718         (keyMaterial->zSize > HKS_ECC_KEY_SIZE_521)) {
719         HKS_LOG_E("invalid import key material x/y/z size, bigger than 521");
720         return HKS_ERROR_INVALID_KEY_INFO;
721     }
722 
723     if (keyMaterial->zSize == 0) {
724         HKS_LOG_E("invalid import key material z size: 0");
725         return HKS_ERROR_INVALID_KEY_INFO;
726     }
727     if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && ((keyMaterial->xSize == 0) || (keyMaterial->ySize == 0))) {
728         HKS_LOG_E("invalid import key material x/y size: 0");
729         return HKS_ERROR_INVALID_KEY_INFO;
730     }
731 
732     uint32_t keySize = sizeof(struct HksKeyMaterialEcc) + keyMaterial->xSize + keyMaterial->ySize + keyMaterial->zSize;
733     if (key->size < keySize) {
734         HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
735         return HKS_ERROR_INVALID_KEY_INFO;
736     }
737 
738     return HKS_SUCCESS;
739 }
740 
CheckDsaKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)741 static int32_t CheckDsaKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
742     const struct HksBlob *key)
743 {
744     if (key->size < sizeof(struct HksKeyMaterialDsa)) {
745         HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
746         return HKS_ERROR_INVALID_KEY_INFO;
747     }
748 
749     struct HksKeyMaterialDsa *keyMaterial = (struct HksKeyMaterialDsa *)(key->data);
750     if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
751         HKS_LOG_E("invalid import key material");
752         return HKS_ERROR_INVALID_KEY_INFO;
753     }
754 
755     if ((keyMaterial->xSize > MAX_KEY_SIZE) || (keyMaterial->ySize > MAX_KEY_SIZE) ||
756         (keyMaterial->pSize > MAX_KEY_SIZE) || (keyMaterial->qSize > MAX_KEY_SIZE) ||
757         (keyMaterial->gSize > MAX_KEY_SIZE)) {
758         HKS_LOG_E("invalid import key material x/y/p/q/g size, bigger than 2048");
759         return HKS_ERROR_INVALID_KEY_INFO;
760     }
761 
762     if ((keyMaterial->xSize == 0) ||
763         (keyMaterial->pSize == 0) || (keyMaterial->qSize == 0) || (keyMaterial->gSize == 0)) {
764         HKS_LOG_E("invalid import key material x/p/q/g size: 0");
765         return HKS_ERROR_INVALID_KEY_INFO;
766     }
767 
768     if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->ySize == 0)) {
769         HKS_LOG_E("invalid import key material y size: 0");
770         return HKS_ERROR_INVALID_KEY_INFO;
771     }
772 
773     uint32_t keySize = sizeof(struct HksKeyMaterialDsa) + keyMaterial->xSize + keyMaterial->ySize +
774         keyMaterial->pSize + keyMaterial->qSize + keyMaterial->gSize;
775     if (key->size < keySize) {
776         HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
777         return HKS_ERROR_INVALID_KEY_INFO;
778     }
779 
780     return HKS_SUCCESS;
781 }
782 
CheckCurve25519KeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)783 static int32_t CheckCurve25519KeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
784     const struct HksBlob *key)
785 {
786     if (key->size < sizeof(struct HksKeyMaterial25519)) {
787         HKS_LOG_E("invalid import Curve25519 key size: %" LOG_PUBLIC "u", key->size);
788         return HKS_ERROR_INVALID_KEY_INFO;
789     }
790 
791     struct HksKeyMaterial25519 *keyMaterial = (struct HksKeyMaterial25519 *)(key->data);
792     if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
793         HKS_LOG_E("invalid import Curve25519 key material");
794         return HKS_ERROR_INVALID_KEY_INFO;
795     }
796 
797     if ((keyMaterial->pubKeySize > HKS_CURVE25519_KEY_SIZE_256) ||
798         (keyMaterial->priKeySize > HKS_CURVE25519_KEY_SIZE_256)) {
799         HKS_LOG_E("invalid import Curve25519 key material pubKey/priKey size, bigger than 256");
800         return HKS_ERROR_INVALID_KEY_INFO;
801     }
802 
803     if (keyMaterial->priKeySize == 0) {
804         HKS_LOG_E("invalid import Curve25519 key material priKey size: 0");
805         return HKS_ERROR_INVALID_KEY_INFO;
806     }
807 
808     if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->pubKeySize == 0)) {
809         HKS_LOG_E("invalid import Curve25519 key material pubKey size: 0");
810         return HKS_ERROR_INVALID_KEY_INFO;
811     }
812 
813     uint32_t keySize = sizeof(struct HksKeyMaterial25519) + keyMaterial->pubKeySize + keyMaterial->priKeySize;
814     if (key->size < keySize) {
815         HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
816         return HKS_ERROR_INVALID_KEY_INFO;
817     }
818 
819     return HKS_SUCCESS;
820 }
821 
CheckDHKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)822 static int32_t CheckDHKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
823     const struct HksBlob *key)
824 {
825     if (key->size < sizeof(struct HksKeyMaterialDh)) {
826         HKS_LOG_E("invalid import DH key size: %" LOG_PUBLIC "u", key->size);
827         return HKS_ERROR_INVALID_KEY_INFO;
828     }
829 
830     struct HksKeyMaterialDh *keyMaterial = (struct HksKeyMaterialDh *)(key->data);
831     if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
832         HKS_LOG_E("invalid import DH key material");
833         return HKS_ERROR_INVALID_KEY_INFO;
834     }
835 
836     if ((keyMaterial->pubKeySize > HKS_DH_KEY_SIZE_4096) || (keyMaterial->priKeySize > HKS_DH_KEY_SIZE_4096)) {
837         HKS_LOG_E("invalid import DH key material pubKey/priKey size, bigger than 4096");
838         return HKS_ERROR_INVALID_KEY_INFO;
839     }
840 
841     if (keyMaterial->priKeySize == 0) {
842         HKS_LOG_E("invalid import DH key material priKey size: 0");
843         return HKS_ERROR_INVALID_KEY_INFO;
844     }
845 
846     if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->pubKeySize == 0)) {
847         HKS_LOG_E("invalid import DH key material pubKey size: 0");
848         return HKS_ERROR_INVALID_KEY_INFO;
849     }
850 
851     uint32_t keySize = sizeof(struct HksKeyMaterialDh) + keyMaterial->pubKeySize + keyMaterial->priKeySize;
852     if (key->size < keySize) {
853         HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
854         return HKS_ERROR_INVALID_KEY_INFO;
855     }
856 
857     return HKS_SUCCESS;
858 }
859 
CheckKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)860 static int32_t CheckKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
861     const struct HksBlob *key)
862 {
863     switch (alg) {
864         case HKS_ALG_RSA:
865             return CheckRsaKeyLen(alg, keyType, params, key);
866         case HKS_ALG_ECC:
867         case HKS_ALG_SM2:
868             return CheckEccKeyLen(alg, keyType, params, key);
869         case HKS_ALG_DSA:
870             return CheckDsaKeyLen(alg, keyType, params, key);
871         case HKS_ALG_X25519:
872         case HKS_ALG_ED25519:
873             return CheckCurve25519KeyLen(alg, keyType, params, key);
874         case HKS_ALG_DH:
875             return CheckDHKeyLen(alg, keyType, params, key);
876         default:
877             return HKS_ERROR_INVALID_ALGORITHM;
878     }
879 }
880 
CheckMutableParams(uint32_t alg,uint32_t keyType,const struct ParamsValues * params)881 static int32_t CheckMutableParams(uint32_t alg, uint32_t keyType, const struct ParamsValues *params)
882 {
883     if (keyType == HKS_KEY_TYPE_KEY_PAIR) {
884         return HKS_SUCCESS;
885     }
886 
887     switch (alg) {
888         case HKS_ALG_RSA:
889             if ((params->purpose.value != HKS_KEY_PURPOSE_SIGN) &&
890                 (params->purpose.value != HKS_KEY_PURPOSE_DECRYPT)) {
891                 HKS_LOG_E("Import rsa private key check purpose failed.");
892                 return HKS_ERROR_INVALID_PURPOSE;
893             }
894             return HKS_SUCCESS;
895         case HKS_ALG_ECC:
896             if ((params->purpose.value != HKS_KEY_PURPOSE_SIGN) && (params->purpose.value != HKS_KEY_PURPOSE_AGREE) &&
897                 (params->purpose.value != HKS_KEY_PURPOSE_UNWRAP)) {
898                 HKS_LOG_E("Import ecc private key check purpose failed.");
899                 return HKS_ERROR_INVALID_PURPOSE;
900             }
901             return HKS_SUCCESS;
902         case HKS_ALG_SM2:
903         case HKS_ALG_DSA:
904         case HKS_ALG_ED25519:
905             if (params->purpose.value != HKS_KEY_PURPOSE_SIGN) {
906                 HKS_LOG_E("Import sm2 or dsa or ed25519 private key check purpose failed.");
907                 return HKS_ERROR_INVALID_PURPOSE;
908             }
909             return HKS_SUCCESS;
910         case HKS_ALG_X25519:
911         case HKS_ALG_DH:
912             return HKS_SUCCESS;
913         default:
914             return HKS_ERROR_INVALID_ALGORITHM;
915     }
916 }
917 
CheckImportKey(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)918 static int32_t CheckImportKey(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
919     const struct HksBlob *key)
920 {
921     int32_t ret = CheckKeyLen(alg, keyType, params, key);
922     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check key len failed, ret = %" LOG_PUBLIC "d", ret)
923 
924     ret = CheckMutableParams(alg, keyType, params);
925     HKS_IF_NOT_SUCC_LOGE(ret, "check mutable params faile, ret = %" LOG_PUBLIC "d", ret)
926     return ret;
927 }
928 
CheckImportSymmetricKeySize(const struct ParamsValues * params,const struct HksBlob * key)929 static int32_t CheckImportSymmetricKeySize(const struct ParamsValues *params, const struct HksBlob *key)
930 {
931     if (key->size != HKS_KEY_BYTES(params->keyLen.value)) {
932         return HKS_ERROR_INVALID_KEY_INFO;
933     }
934     return HKS_SUCCESS;
935 }
936 
HksCoreCheckImportKeyParams(const struct HksBlob * keyAlias,const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * keyOut)937 int32_t HksCoreCheckImportKeyParams(const struct HksBlob *keyAlias, const struct HksBlob *key,
938     const struct HksParamSet *paramSet, const struct HksBlob *keyOut)
939 {
940     (void)keyAlias;
941     (void)keyOut;
942     /* import key paramset is subset of generate key paramset */
943     struct ParamsValues params;
944     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
945     int32_t ret = CoreCheckGenKeyParams(paramSet, &params, HKS_KEY_FLAG_IMPORT_KEY);
946     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "CheckImportKeyParams failed")
947 
948     uint32_t alg;
949     ret = CheckAndGetAlgorithm(paramSet, g_importKeyAlg, HKS_ARRAY_SIZE(g_importKeyAlg), &alg);
950     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "import key check and get alg failed")
951 
952     if ((alg == HKS_ALG_AES) || (alg == HKS_ALG_DES) || (alg == HKS_ALG_3DES) || (alg == HKS_ALG_SM3) ||
953         (alg == HKS_ALG_SM4) || (alg == HKS_ALG_HMAC) || (alg == HKS_ALG_CMAC)) {
954         return CheckImportSymmetricKeySize(&params, key);
955     }
956 
957     struct HksParam *importKeyTypeParam = NULL;
958     ret = HksGetParam(paramSet, HKS_TAG_IMPORT_KEY_TYPE, &importKeyTypeParam);
959     bool needCheckLater = true;
960     if (ret == HKS_SUCCESS && importKeyTypeParam->uint32Param != HKS_KEY_TYPE_PUBLIC_KEY) {
961         needCheckLater = false;
962         ret = CheckImportKey(alg, importKeyTypeParam->uint32Param, &params, key);
963         HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check import key invalid")
964     }
965 #ifdef L2_STANDARD
966     if (ret == HKS_SUCCESS) {
967         if (importKeyTypeParam->uint32Param != HKS_KEY_TYPE_PRIVATE_KEY) {
968             if (alg == HKS_ALG_DH) {
969                 ret = HksOpensslCheckDhKey(key, (enum HksImportKeyType)importKeyTypeParam->uint32Param);
970             } else if (alg == HKS_ALG_RSA) {
971                 ret = HksOpensslCheckRsaKey(key);
972             }
973             HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "openssl check import key invalid")
974         }
975     }
976 #endif
977     HKS_IF_NOT_TRUE_RETURN(needCheckLater, ret);
978 
979     /* check public key params: 1. check keySize */
980     ret = CheckImportKeySize(alg, &params, key);
981     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "import key check key size invalid")
982 
983     /* check public key params: 2. check mutable params */
984     return CheckImportMutableParams(alg, &params);
985 }
986 
HksCoreCheckImportWrappedKeyParams(const struct HksBlob * key,const struct HksBlob * wrappedKeyData,const struct HksParamSet * paramSet,struct HksBlob * keyOut,uint32_t * outUnwrapSuite)987 int32_t HksCoreCheckImportWrappedKeyParams(const struct HksBlob *key, const struct HksBlob *wrappedKeyData,
988     const struct HksParamSet *paramSet, struct HksBlob *keyOut, uint32_t *outUnwrapSuite)
989 {
990     (void)keyOut;
991 
992     HKS_IF_NOT_SUCC_LOGE_RETURN(CheckBlob(key), HKS_ERROR_INVALID_ARGUMENT, "wrapping key is invalid")
993 
994     /* first check wrapping-related params and wrapped key data */
995     uint32_t unwrapSuite = 0;
996     int32_t ret = CheckAndGetWrappedKeyUnwrapAlgSuite(paramSet, &unwrapSuite);
997     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check import wrapped params set failed")
998 
999     ret = HksCheckWrappedDataFormatValidity(wrappedKeyData, HKS_IMPORT_WRAPPED_KEY_TOTAL_BLOBS, NULL);
1000     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check import wrapped key data format failed")
1001 
1002     /* then check the origin key paramset which is the same as import key */
1003     struct ParamsValues params;
1004     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
1005     ret = CoreCheckGenKeyParams(paramSet, &params, HKS_KEY_FLAG_IMPORT_KEY);
1006     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check origin key param set failed")
1007 
1008     uint32_t alg;
1009     ret = CheckAndGetAlgorithm(paramSet, g_importKeyAlg, HKS_ARRAY_SIZE(g_importKeyAlg), &alg);
1010     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "CheckImportKeyParams get alg failed")
1011     *outUnwrapSuite = unwrapSuite;
1012     return HKS_SUCCESS;
1013 }
1014 
HksCoreCheckSignVerifyParams(uint32_t cmdId,const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * srcData,const struct HksBlob * signature)1015 int32_t HksCoreCheckSignVerifyParams(uint32_t cmdId, const struct HksBlob *key, const struct HksParamSet *paramSet,
1016     const struct HksBlob *srcData, const struct HksBlob *signature)
1017 {
1018 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
1019     (void)srcData;
1020     uint32_t alg;
1021     int32_t ret = CheckAndGetAlgorithm(paramSet, g_signAlg, HKS_ARRAY_SIZE(g_signAlg), &alg);
1022     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check and get alg failed")
1023 
1024     struct ParamsValues params;
1025     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
1026 
1027     ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, &params);
1028     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify get input params failed, ret = %" LOG_PUBLIC "d", ret)
1029 
1030     ret = CheckSignVerifyParamsByAlg(cmdId, alg, &params);
1031     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify check params failed, ret = %" LOG_PUBLIC "d", ret)
1032 
1033     uint32_t keySize = 0;
1034     ret = HksGetKeySize(alg, key, &keySize);
1035     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get keySize failed!")
1036 
1037     ret = HksCheckSignature(cmdId, alg, keySize, signature);
1038     HKS_IF_NOT_SUCC_LOGE(ret, "check signature failed, ret = %" LOG_PUBLIC "d", ret)
1039 
1040     return ret;
1041 #else
1042     (void)cmdId;
1043     (void)key;
1044     (void)paramSet;
1045     (void)srcData;
1046     (void)signature;
1047     return HKS_ERROR_NOT_SUPPORTED;
1048 #endif
1049 }
1050 
HksLocalCheckSignVerifyParams(uint32_t cmdId,uint32_t keySize,const struct HksParamSet * paramSet,const struct HksBlob * srcData,const struct HksBlob * signature)1051 int32_t HksLocalCheckSignVerifyParams(uint32_t cmdId, uint32_t keySize, const struct HksParamSet *paramSet,
1052     const struct HksBlob *srcData, const struct HksBlob *signature)
1053 {
1054 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
1055     (void)srcData;
1056     uint32_t alg;
1057     int32_t ret = CheckAndGetAlgorithm(paramSet, g_signAlg, HKS_ARRAY_SIZE(g_signAlg), &alg);
1058     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "local check and get alg failed")
1059 
1060     struct ParamsValues params;
1061     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
1062 
1063     ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, &params);
1064     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify get input params failed, ret = %" LOG_PUBLIC "d", ret)
1065 
1066     ret = CheckSignVerifyParamsByAlg(cmdId, alg, &params);
1067     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify local check params failed, ret = %" LOG_PUBLIC "d", ret)
1068 
1069     ret = HksCheckSignature(cmdId, alg, keySize, signature);
1070     HKS_IF_NOT_SUCC_LOGE(ret, "check signature failed, ret = %" LOG_PUBLIC "d", ret)
1071 
1072     return ret;
1073 #else
1074     (void)cmdId;
1075     (void)keySize;
1076     (void)paramSet;
1077     (void)srcData;
1078     (void)signature;
1079     return HKS_ERROR_NOT_SUPPORTED;
1080 #endif
1081 }
1082 
HksCoreCheckAgreeKeyParams(const struct HksParamSet * paramSet,const struct HksBlob * privateKey,const struct HksBlob * peerPublicKey,const struct HksBlob * agreedKey,bool isLocalCheck)1083 int32_t HksCoreCheckAgreeKeyParams(const struct HksParamSet *paramSet, const struct HksBlob *privateKey,
1084     const struct HksBlob *peerPublicKey, const struct HksBlob *agreedKey, bool isLocalCheck)
1085 {
1086     uint32_t alg;
1087     int32_t ret;
1088 
1089     if (isLocalCheck) {
1090         ret = CheckAndGetAlgorithm(paramSet, g_agreeAlgLocal, HKS_ARRAY_SIZE(g_agreeAlgLocal), &alg);
1091     } else {
1092         ret = CheckAndGetAlgorithm(paramSet, g_agreeAlg, HKS_ARRAY_SIZE(g_agreeAlg), &alg);
1093     }
1094     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
1095 
1096     uint32_t keySize = 0;
1097     if (isLocalCheck) {
1098         if (alg == HKS_ALG_ED25519) {
1099             HKS_IF_TRUE_RETURN((privateKey->size != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256)) ||
1100                 (peerPublicKey->size != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256)),
1101                 HKS_ERROR_INVALID_KEY_SIZE);
1102         }
1103 
1104         if (alg == HKS_ALG_DH || alg == HKS_ALG_ECC || alg == HKS_ALG_ECDH) {
1105             if (privateKey->size < sizeof(struct HksKeyMaterialHeader)) {
1106                 return HKS_ERROR_INVALID_ARGUMENT;
1107             }
1108             keySize = ((struct HksKeyMaterialHeader *)privateKey->data)->keySize;
1109         } else if (alg == HKS_ALG_ED25519) {
1110             keySize = privateKey->size * HKS_BITS_PER_BYTE;
1111         }
1112     } else {
1113         ret = HksGetKeySize(alg, privateKey, &keySize);
1114         HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get key size failed")
1115     }
1116 
1117     uint32_t size = keySize / HKS_BITS_PER_BYTE + keySize % HKS_BITS_PER_BYTE;
1118     if (agreedKey->size < size) {
1119         HKS_LOG_E("agreeKey buffer too small, size %" LOG_PUBLIC "u", agreedKey->size);
1120         return HKS_ERROR_BUFFER_TOO_SMALL;
1121     }
1122 
1123     return HKS_SUCCESS;
1124 }
1125 
HksCoreCheckCipherParams(uint32_t cmdId,const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * inData,const struct HksBlob * outData)1126 int32_t HksCoreCheckCipherParams(uint32_t cmdId, const struct HksBlob *key, const struct HksParamSet *paramSet,
1127     const struct HksBlob *inData, const struct HksBlob *outData)
1128 {
1129     uint32_t alg;
1130     int32_t ret = CheckAndGetAlgorithm(paramSet, g_cipherAlg, HKS_ARRAY_SIZE(g_cipherAlg), &alg);
1131     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
1132 
1133     struct ParamsValues params;
1134     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
1135 
1136     ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, &params);
1137     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher get input params failed, ret = %" LOG_PUBLIC "d", ret)
1138 
1139     if ((alg == HKS_ALG_RSA) || (alg == HKS_ALG_SM4) || (alg == HKS_ALG_SM2)) {
1140         ret = HksGetKeySize(alg, key, &params.keyLen.value);
1141         HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "rsa/SM4/SM2 cipher get key size failed")
1142     }
1143 
1144     ret = CheckCipherParamsByAlg(cmdId, alg, paramSet, &params);
1145     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher check params failed, ret = %" LOG_PUBLIC "d", ret)
1146 
1147     ret = HksCheckCipherData(cmdId, alg, &params, inData, outData);
1148     HKS_IF_NOT_SUCC_LOGE(ret, "cipher check input or output data failed, ret = %" LOG_PUBLIC "d", ret)
1149 
1150     return ret;
1151 }
1152 #endif /* _CUT_AUTHENTICATE_ */
1153 
HksLocalCheckCipherParams(uint32_t cmdId,uint32_t keySize,const struct HksParamSet * paramSet,const struct HksBlob * inData,const struct HksBlob * outData)1154 int32_t HksLocalCheckCipherParams(uint32_t cmdId, uint32_t keySize, const struct HksParamSet *paramSet,
1155     const struct HksBlob *inData, const struct HksBlob *outData)
1156 {
1157     uint32_t alg;
1158     int32_t ret = CheckAndGetAlgorithm(paramSet, g_cipherAlgLocal, HKS_ARRAY_SIZE(g_cipherAlgLocal), &alg);
1159     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
1160 
1161     if (alg == HKS_ALG_AES) {
1162 #ifdef HKS_SUPPORT_AES_C
1163         ret = HksCheckValue(keySize, g_aesKeySizeLocal, HKS_ARRAY_SIZE(g_aesKeySizeLocal));
1164 #else
1165         ret = HKS_ERROR_NOT_SUPPORTED;
1166 #endif
1167     } else if (alg == HKS_ALG_DES) {
1168 #ifdef HKS_SUPPORT_DES_C
1169         ret = HksCheckValue(keySize, g_desKeySizeLocal, HKS_ARRAY_SIZE(g_desKeySizeLocal));
1170 #else
1171         ret = HKS_ERROR_NOT_SUPPORTED;
1172 #endif
1173     } else if (alg == HKS_ALG_3DES) {
1174 #ifdef HKS_SUPPORT_3DES_C
1175         ret = HksCheckValue(keySize, g_3desKeySizeLocal, HKS_ARRAY_SIZE(g_3desKeySizeLocal));
1176 #else
1177         ret = HKS_ERROR_NOT_SUPPORTED;
1178 #endif
1179     } else if (alg == HKS_ALG_RSA) {
1180 #ifdef HKS_SUPPORT_RSA_C
1181         ret = HksCheckValue(keySize, g_rsaKeySizeLocal, HKS_ARRAY_SIZE(g_rsaKeySizeLocal));
1182 #else
1183         ret = HKS_ERROR_NOT_SUPPORTED;
1184 #endif
1185     }
1186     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_KEY_SIZE,
1187         "keySize value %" LOG_PUBLIC "u not expected", keySize)
1188 
1189     struct ParamsValues params;
1190     (void)memset_s(&params, sizeof(params), 0, sizeof(params));
1191 
1192     ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, &params);
1193     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "local cipher get input params failed, ret = %" LOG_PUBLIC "d", ret)
1194 
1195     ret = CheckCipherParamsByAlg(cmdId, alg, paramSet, &params);
1196     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "local cipher check params failed, ret = %" LOG_PUBLIC "d", ret)
1197 
1198     ret = HksCheckCipherData(cmdId, alg, &params, inData, outData);
1199     HKS_IF_NOT_SUCC_LOGE(ret, "local cipher check input or output data failed, ret = %" LOG_PUBLIC "d", ret)
1200 
1201     return ret;
1202 }
1203 
HksCoreCheckDeriveKeyParams(const struct HksParamSet * paramSet,const struct HksBlob * mainKey,const struct HksBlob * derivedKey,bool isLocalCheck)1204 int32_t HksCoreCheckDeriveKeyParams(const struct HksParamSet *paramSet, const struct HksBlob *mainKey,
1205     const struct HksBlob *derivedKey, bool isLocalCheck)
1206 {
1207     (void)mainKey;
1208     (void)derivedKey;
1209     uint32_t alg;
1210     int32_t ret;
1211     if (isLocalCheck) {
1212         ret = CheckAndGetAlgorithm(paramSet, g_deriveAlgLocal, HKS_ARRAY_SIZE(g_deriveAlgLocal), &alg);
1213     } else {
1214         ret = CheckAndGetAlgorithm(paramSet, g_deriveAlg, HKS_ARRAY_SIZE(g_deriveAlg), &alg);
1215     }
1216     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
1217 
1218     struct HksParam *purposeParam = NULL;
1219     ret = HksGetParam(paramSet, HKS_TAG_PURPOSE, &purposeParam);
1220     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_PURPOSE_FAIL,
1221         "get param get 0x%" LOG_PUBLIC "x failed", HKS_TAG_PURPOSE)
1222 
1223     if (purposeParam->uint32Param != HKS_KEY_PURPOSE_DERIVE) {
1224         return HKS_ERROR_INVALID_PURPOSE;
1225     }
1226 
1227     /* according to RFC5869, HKDF no need check salt and info */
1228     uint32_t digest;
1229     ret = CheckAndGetDigest(paramSet, g_digest, HKS_ARRAY_SIZE(g_digest), &digest);
1230     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check digest failed")
1231 
1232 #ifdef HKS_SUPPORT_KDF_PBKDF2
1233     if (alg == HKS_ALG_PBKDF2) {
1234         return CheckPbkdf2DeriveKeyParams(paramSet);
1235     }
1236 #endif
1237 
1238     return HKS_SUCCESS;
1239 }
1240 
CheckMacPurpose(const struct HksParamSet * paramSet)1241 static int32_t CheckMacPurpose(const struct HksParamSet *paramSet)
1242 {
1243     struct HksParam *purposeParam = NULL;
1244     int32_t ret = HksGetParam(paramSet, HKS_TAG_PURPOSE, &purposeParam);
1245     HKS_IF_NOT_SUCC_RETURN(ret, HKS_ERROR_CHECK_GET_PURPOSE_FAIL)
1246 
1247     if (purposeParam->uint32Param != HKS_KEY_PURPOSE_MAC) {
1248         return HKS_ERROR_INVALID_PURPOSE;
1249     }
1250 
1251     return HKS_SUCCESS;
1252 }
1253 
CheckMacOutput(const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * mac,bool isLocalCheck)1254 static int32_t CheckMacOutput(
1255     const struct HksBlob *key, const struct HksParamSet *paramSet, const struct HksBlob *mac, bool isLocalCheck)
1256 {
1257     uint32_t digest;
1258     int32_t ret;
1259     if (isLocalCheck) {
1260         ret = CheckAndGetDigest(paramSet, g_digest, HKS_ARRAY_SIZE(g_digest), &digest);
1261     } else {
1262         ret = CheckAndGetDigest(paramSet, g_macDigest, HKS_ARRAY_SIZE(g_macDigest), &digest);
1263     }
1264     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check digest failed")
1265 
1266     uint32_t digestLen;
1267     ret = HksGetDigestLen(digest, &digestLen);
1268     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get digest length failed, ret = %" LOG_PUBLIC "d", ret)
1269 
1270     if (mac->size < digestLen) {
1271         HKS_LOG_E("mac buffer too small, size %" LOG_PUBLIC "u", mac->size);
1272         return HKS_ERROR_BUFFER_TOO_SMALL;
1273     }
1274 
1275     if ((isLocalCheck) && (key->size < digestLen)) { /* the unit of local engine input key size is byte */
1276         HKS_LOG_E("key size too small, size = %" LOG_PUBLIC "u", key->size);
1277         return HKS_ERROR_INVALID_KEY_SIZE;
1278     }
1279 
1280     return HKS_SUCCESS;
1281 }
1282 
HksCoreCheckMacParams(const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * srcData,const struct HksBlob * mac,bool isLocalCheck)1283 int32_t HksCoreCheckMacParams(const struct HksBlob *key, const struct HksParamSet *paramSet,
1284     const struct HksBlob *srcData, const struct HksBlob *mac, bool isLocalCheck)
1285 {
1286     (void)srcData;
1287     int32_t ret = CheckMacPurpose(paramSet);
1288     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check Mac purpose failed")
1289 
1290     return CheckMacOutput(key, paramSet, mac, isLocalCheck);
1291 }
1292 
CheckIsSymmetricAlgorithm(uint32_t alg)1293 static bool CheckIsSymmetricAlgorithm(uint32_t alg)
1294 {
1295     for (uint32_t i = 0; i < HKS_ARRAY_SIZE(g_symmetricAlgorithm); ++i) {
1296         HKS_IF_TRUE_RETURN(alg == g_symmetricAlgorithm[i], true);
1297     }
1298     return false;
1299 }
1300 
HksCoreCheckAgreeDeriveFinishParams(const struct HksBlob * key,const struct HksParamSet * paramSet)1301 int32_t HksCoreCheckAgreeDeriveFinishParams(const struct HksBlob *key, const struct HksParamSet *paramSet)
1302 {
1303     // check the key paramset is consistent with key real attributes, including key size and valid key algorithm
1304     struct HksParam *keySize = NULL;
1305     int32_t ret = HksGetParam(paramSet, HKS_TAG_KEY_SIZE, &keySize);
1306     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get key size from agree paramset failed!")
1307     HKS_IF_TRUE_LOGE_RETURN(HKS_KEY_BYTES(keySize->uint32Param) != key->size, HKS_ERROR_INVALID_ARGUMENT,
1308         "key size param from paramSet is not consistent with real key size, param size %" LOG_PUBLIC
1309         "u not equals to real key size %" LOG_PUBLIC "u", HKS_KEY_BYTES(keySize->uint32Param), key->size);
1310 
1311     struct HksParam *algorithm = NULL;
1312     ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &algorithm);
1313     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get key algorithm from agree paramset failed!")
1314     if (!CheckIsSymmetricAlgorithm(algorithm->uint32Param)) {
1315         HKS_LOG_E("Agreed or derived key algorithm param can only be symmetric! Algorithm is %" LOG_PUBLIC "u",
1316             algorithm->uint32Param);
1317         return HKS_ERROR_INVALID_ARGUMENT;
1318     }
1319 
1320     return HKS_SUCCESS;
1321 }
1322