1 /*
2 * Copyright (c) 2021-2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #ifdef HKS_CONFIG_FILE
17 #include HKS_CONFIG_FILE
18 #else
19 #include "hks_config.h"
20 #endif
21
22 #include "hks_check_paramset.h"
23
24 #include <stddef.h>
25
26 #include "hks_base_check.h"
27 #include "hks_common_check.h"
28 #include "hks_crypto_hal.h"
29 #include "hks_log.h"
30 #include "hks_param.h"
31 #include "hks_template.h"
32 #include "securec.h"
33
34 #ifdef _CUT_AUTHENTICATE_
35 #undef HKS_SUPPORT_HASH_C
36 #undef HKS_SUPPORT_RSA_C
37 #undef HKS_SUPPORT_ECC_C
38 #undef HKS_SUPPORT_X25519_C
39 #undef HKS_SUPPORT_ED25519_C
40 #undef HKS_SUPPORT_KDF_PBKDF2
41 #endif /* _CUT_AUTHENTICATE_ */
42
43 #define HKS_DEFAULT_PBKDF2_ITERATION 1000
44 #define HKS_DEFAULT_PBKDF2_SALT_SIZE 16
45
46 #ifndef _CUT_AUTHENTICATE_
47 static uint32_t g_genKeyAlg[] = {
48 #ifdef HKS_SUPPORT_RSA_C
49 HKS_ALG_RSA,
50 #endif
51 #ifdef HKS_SUPPORT_AES_C
52 HKS_ALG_AES,
53 #endif
54 #ifdef HKS_SUPPORT_ECC_C
55 HKS_ALG_ECC,
56 #endif
57 #ifdef HKS_SUPPORT_HMAC_C
58 HKS_ALG_HMAC,
59 #endif
60 #ifdef HKS_SUPPORT_ED25519_C
61 HKS_ALG_ED25519,
62 #endif
63 #ifdef HKS_SUPPORT_X25519_C
64 HKS_ALG_X25519,
65 #endif
66 #ifdef HKS_SUPPORT_DSA_C
67 HKS_ALG_DSA,
68 #endif
69 #ifdef HKS_SUPPORT_DH_C
70 HKS_ALG_DH,
71 #endif
72 #ifdef HKS_SUPPORT_ECDH_C
73 HKS_ALG_ECDH,
74 #endif
75 #ifdef HKS_SUPPORT_SM3_C
76 HKS_ALG_SM3,
77 #endif
78 #ifdef HKS_SUPPORT_SM2_C
79 HKS_ALG_SM2,
80 #endif
81 #ifdef HKS_SUPPORT_SM4_C
82 HKS_ALG_SM4,
83 #endif
84 };
85
86 static uint32_t g_importKeyAlg[] = {
87 #ifdef HKS_SUPPORT_RSA_C
88 HKS_ALG_RSA,
89 #endif
90 #ifdef HKS_SUPPORT_AES_C
91 HKS_ALG_AES,
92 #endif
93 #ifdef HKS_SUPPORT_ECC_C
94 HKS_ALG_ECC,
95 #endif
96 #ifdef HKS_SUPPORT_X25519_C
97 HKS_ALG_X25519,
98 #endif
99 #ifdef HKS_SUPPORT_ED25519_C
100 HKS_ALG_ED25519,
101 #endif
102 #ifdef HKS_SUPPORT_DSA_C
103 HKS_ALG_DSA,
104 #endif
105 #ifdef HKS_SUPPORT_DH_C
106 HKS_ALG_DH,
107 #endif
108 #ifdef HKS_SUPPORT_HMAC_C
109 HKS_ALG_HMAC,
110 #endif
111 #ifdef HKS_SUPPORT_SM2_C
112 HKS_ALG_SM2,
113 #endif
114 #ifdef HKS_SUPPORT_SM3_C
115 HKS_ALG_SM3,
116 #endif
117 #ifdef HKS_SUPPORT_SM4_C
118 HKS_ALG_SM4,
119 #endif
120 };
121
122 static uint32_t g_cipherAlg[] = {
123 #ifdef HKS_SUPPORT_RSA_C
124 HKS_ALG_RSA,
125 #endif
126 #ifdef HKS_SUPPORT_AES_C
127 HKS_ALG_AES,
128 #endif
129 #ifdef HKS_SUPPORT_SM2_C
130 HKS_ALG_SM2,
131 #endif
132 #ifdef HKS_SUPPORT_SM4_C
133 HKS_ALG_SM4,
134 #endif
135 };
136 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
137 static uint32_t g_signAlg[] = {
138 #ifdef HKS_SUPPORT_RSA_C
139 HKS_ALG_RSA,
140 #endif
141 #ifdef HKS_SUPPORT_DSA_C
142 HKS_ALG_DSA,
143 #endif
144 #ifdef HKS_SUPPORT_ECC_C
145 HKS_ALG_ECC,
146 #endif
147 #ifdef HKS_SUPPORT_ED25519_C
148 HKS_ALG_ED25519,
149 #endif
150 #ifdef HKS_SUPPORT_SM2_C
151 HKS_ALG_SM2,
152 #endif
153 };
154 #endif
155
156 static uint32_t g_agreeAlg[] = {
157 #ifdef HKS_SUPPORT_X25519_C
158 HKS_ALG_X25519,
159 #endif
160 #ifdef HKS_SUPPORT_ECDH_C
161 HKS_ALG_ECDH,
162 #endif
163 #ifdef HKS_SUPPORT_DH_C
164 HKS_ALG_DH,
165 #endif
166 };
167
168 static uint32_t g_agreeAlgLocal[] = {
169 #ifdef HKS_SUPPORT_ECDH_C
170 HKS_ALG_ECDH,
171 #endif
172 #ifdef HKS_SUPPORT_X25519_C
173 HKS_ALG_X25519,
174 #endif
175 #ifdef HKS_SUPPORT_DH_C
176 HKS_ALG_DH,
177 #endif
178 };
179
180 static uint32_t g_unwrapSuite[] = {
181 #if defined(HKS_SUPPORT_X25519_C) && defined(HKS_SUPPORT_AES_GCM)
182 HKS_UNWRAP_SUITE_X25519_AES_256_GCM_NOPADDING,
183 #endif
184 #if defined(HKS_SUPPORT_ECDH_C) && defined(HKS_SUPPORT_AES_GCM)
185 HKS_UNWRAP_SUITE_ECDH_AES_256_GCM_NOPADDING,
186 #endif
187 #if defined(HKS_SUPPORT_SM2_C) && defined(HKS_SUPPORT_SM4_C)
188 HKS_UNWRAP_SUITE_SM2_SM4_128_CBC_PKCS7_WITH_VERIFY_DIG_SM3,
189 HKS_UNWRAP_SUITE_SM2_SM4_128_CBC_PKCS7
190 #endif
191 };
192 #endif /* _CUT_AUTHENTICATE_ */
193
194 static uint32_t g_deriveAlg[] = {
195 #ifdef HKS_SUPPORT_KDF_HKDF
196 HKS_ALG_HKDF,
197 #endif
198 #ifdef HKS_SUPPORT_KDF_PBKDF2
199 HKS_ALG_PBKDF2,
200 #endif
201 #ifdef HKS_SUPPORT_KDF_SM3
202 HKS_ALG_GMKDF,
203 #endif
204 };
205
206 static uint32_t g_deriveAlgLocal[] = {
207 #ifdef HKS_SUPPORT_KDF_HKDF
208 HKS_ALG_HKDF,
209 #endif
210 };
211
212 static uint32_t g_digest[] = {
213 HKS_DIGEST_SHA1,
214 HKS_DIGEST_SHA224,
215 HKS_DIGEST_SHA256,
216 HKS_DIGEST_SHA384,
217 HKS_DIGEST_SHA512,
218 HKS_DIGEST_SM3
219 };
220 static uint32_t g_macDigest[] = {
221 HKS_DIGEST_SHA1,
222 HKS_DIGEST_SHA224,
223 HKS_DIGEST_SHA256,
224 HKS_DIGEST_SHA384,
225 HKS_DIGEST_SHA512,
226 HKS_DIGEST_SM3
227 };
228 #ifdef HKS_SUPPORT_AES_C
229 static uint32_t g_aesKeySizeLocal[] = {
230 HKS_AES_KEY_SIZE_128,
231 HKS_AES_KEY_SIZE_192,
232 HKS_AES_KEY_SIZE_256,
233 };
234 #endif
235 #ifdef HKS_SUPPORT_RSA_C
236 static uint32_t g_rsaKeySizeLocal[] = {
237 HKS_RSA_KEY_SIZE_512,
238 HKS_RSA_KEY_SIZE_768,
239 HKS_RSA_KEY_SIZE_1024,
240 HKS_RSA_KEY_SIZE_2048,
241 HKS_RSA_KEY_SIZE_3072,
242 HKS_RSA_KEY_SIZE_4096,
243 };
244 #endif
245
246 static uint32_t g_cipherAlgLocal[] = {
247 #ifdef HKS_SUPPORT_AES_C
248 HKS_ALG_AES,
249 #endif
250 #ifdef HKS_SUPPORT_RSA_C
251 HKS_ALG_RSA,
252 #endif
253 };
254
CheckAndGetAlgorithm(const struct HksParamSet * paramSet,const uint32_t * expectAlg,uint32_t expectCnt,uint32_t * alg)255 static int32_t CheckAndGetAlgorithm(
256 const struct HksParamSet *paramSet, const uint32_t *expectAlg, uint32_t expectCnt, uint32_t *alg)
257 {
258 struct HksParam *algParam = NULL;
259 int32_t ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &algParam);
260 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_ALG_FAIL,
261 "get param 0x%" LOG_PUBLIC "x failed!", HKS_TAG_ALGORITHM)
262
263 ret = HksCheckValue(algParam->uint32Param, expectAlg, expectCnt);
264 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_ALGORITHM,
265 "alg value %" LOG_PUBLIC "u not expected", algParam->uint32Param)
266
267 *alg = algParam->uint32Param;
268 return ret;
269 }
270
CheckAndGetDigest(const struct HksParamSet * paramSet,const uint32_t * expectDigest,uint32_t expectCnt,uint32_t * digest)271 static int32_t CheckAndGetDigest(
272 const struct HksParamSet *paramSet, const uint32_t *expectDigest, uint32_t expectCnt, uint32_t *digest)
273 {
274 struct HksParam *digestParam = NULL;
275 int32_t ret = HksGetParam(paramSet, HKS_TAG_DIGEST, &digestParam);
276 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_DIGEST_FAIL,
277 "get param get 0x%" LOG_PUBLIC "x failed!", HKS_TAG_DIGEST)
278
279 ret = HksCheckValue(digestParam->uint32Param, expectDigest, expectCnt);
280 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_DIGEST,
281 "digest value %" LOG_PUBLIC "u not expected", digestParam->uint32Param)
282
283 *digest = digestParam->uint32Param;
284 return ret;
285 }
286
287 #ifndef _CUT_AUTHENTICATE_
CheckGenKeyParamsByAlg(uint32_t alg,const struct HksParamSet * paramSet,struct ParamsValues * params,uint32_t keyFlag)288 static int32_t CheckGenKeyParamsByAlg(uint32_t alg, const struct HksParamSet *paramSet,
289 struct ParamsValues *params, uint32_t keyFlag)
290 {
291 int32_t ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_GEN_KEY, paramSet, params);
292 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret,
293 "get input params by algorithm failed, ret = %" LOG_PUBLIC "d", ret)
294
295 ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_GEN_KEY, params);
296 HKS_IF_NOT_SUCC_RETURN(ret, ret)
297
298 ret = HksCheckGenKeyPurpose(alg, params->purpose.value, keyFlag);
299 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret,
300 "check purpose not expected, purpose = %" LOG_PUBLIC "d", params->purpose.value);
301 return HksCheckGenKeyMutableParams(alg, params);
302 }
303
CheckGenKeyMacDeriveParams(uint32_t alg,uint32_t inputPurpose,const struct HksParamSet * paramSet,struct ParamsValues * params,uint32_t keyFlag)304 static int32_t CheckGenKeyMacDeriveParams(
305 uint32_t alg, uint32_t inputPurpose, const struct HksParamSet *paramSet, struct ParamsValues *params,
306 uint32_t keyFlag)
307 {
308 if (alg != HKS_ALG_AES && alg != HKS_ALG_HMAC && alg != HKS_ALG_SM3 && alg != HKS_ALG_SM4) {
309 HKS_LOG_E("check mac or derive, not valid alg, alg: %" LOG_PUBLIC "u", alg);
310 return HKS_ERROR_INVALID_PURPOSE;
311 }
312
313 int32_t ret = HksCheckGenKeyPurpose(alg, inputPurpose, keyFlag);
314 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check purpose invalid, purpose 0x%" LOG_PUBLIC "x", inputPurpose)
315
316 if (inputPurpose == HKS_KEY_PURPOSE_MAC) {
317 ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_GEN_MAC_KEY, paramSet, params);
318 } else {
319 ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_GEN_DERIVE_KEY, paramSet, params);
320 }
321 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get input params by algorithm failed, ret = %" LOG_PUBLIC "d", ret)
322
323 if (inputPurpose == HKS_KEY_PURPOSE_MAC) {
324 ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_GEN_MAC_KEY, params);
325 } else {
326 ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_GEN_DERIVE_KEY, params);
327 }
328 HKS_IF_NOT_SUCC_LOGE(ret, "get input params by algorithm failed, ret = %" LOG_PUBLIC "d", ret)
329
330 return ret;
331 }
332
CoreCheckGenKeyParams(const struct HksParamSet * paramSet,struct ParamsValues * params,uint32_t keyFlag)333 static int32_t CoreCheckGenKeyParams(const struct HksParamSet *paramSet, struct ParamsValues *params, uint32_t keyFlag)
334 {
335 uint32_t alg;
336 int32_t ret = HksCheckParamSetTag(paramSet);
337 HKS_IF_NOT_SUCC_RETURN(ret, ret)
338
339 ret = CheckAndGetAlgorithm(paramSet, g_genKeyAlg, HKS_ARRAY_SIZE(g_genKeyAlg), &alg);
340 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check and get alg failed")
341
342 struct HksParam *purposeParam = NULL;
343 ret = HksGetParam(paramSet, HKS_TAG_PURPOSE, &purposeParam);
344 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_PURPOSE_FAIL,
345 "get param get 0x%" LOG_PUBLIC "x failed", HKS_TAG_PURPOSE)
346
347 if (((purposeParam->uint32Param & HKS_KEY_PURPOSE_DERIVE) != 0) ||
348 ((purposeParam->uint32Param & HKS_KEY_PURPOSE_MAC) != 0)) {
349 return CheckGenKeyMacDeriveParams(alg, purposeParam->uint32Param, paramSet, params, keyFlag);
350 }
351
352 return CheckGenKeyParamsByAlg(alg, paramSet, params, keyFlag);
353 }
354
CheckImportKeySize(uint32_t alg,const struct ParamsValues * params,const struct HksBlob * key)355 static int32_t CheckImportKeySize(uint32_t alg, const struct ParamsValues *params, const struct HksBlob *key)
356 {
357 int32_t ret = HKS_SUCCESS;
358 switch (alg) {
359 case HKS_ALG_ED25519:
360 case HKS_ALG_X25519:
361 case HKS_ALG_RSA:
362 case HKS_ALG_ECC:
363 case HKS_ALG_SM2:
364 case HKS_ALG_DH: {
365 if (key->size < sizeof(struct HksPubKeyInfo)) {
366 ret = HKS_ERROR_INVALID_KEY_INFO;
367 break;
368 }
369 struct HksPubKeyInfo *keyMaterial = (struct HksPubKeyInfo *)(key->data);
370 if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
371 ret = HKS_ERROR_INVALID_KEY_INFO;
372 }
373 break;
374 }
375 #ifdef HKS_SUPPORT_DSA_C
376 case HKS_ALG_DSA:
377 break;
378 #endif
379 default:
380 return HKS_ERROR_INVALID_ALGORITHM;
381 }
382 return ret;
383 }
384
CheckAndGetWrappedKeyUnwrapAlgSuite(const struct HksParamSet * paramSet,uint32_t * algSuite)385 static int32_t CheckAndGetWrappedKeyUnwrapAlgSuite(const struct HksParamSet *paramSet, uint32_t *algSuite)
386 {
387 struct HksParam *algorithmSuite = NULL;
388 int32_t ret = HksGetParam(paramSet, HKS_TAG_UNWRAP_ALGORITHM_SUITE, &algorithmSuite);
389 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_ALG_FAIL, "get unwrap algorithm suite fail")
390
391 ret = HksCheckValue(algorithmSuite->uint32Param, g_unwrapSuite, HKS_ARRAY_SIZE(g_unwrapSuite));
392 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_ALGORITHM,
393 "unwrap algorithm suite value %" LOG_PUBLIC "u not expected", algorithmSuite->uint32Param)
394
395 *algSuite = algorithmSuite->uint32Param;
396 return HKS_SUCCESS;
397 }
398
399 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
CheckSignVerifyParamsByAlg(uint32_t cmdId,uint32_t alg,const struct ParamsValues * inputParams)400 static int32_t CheckSignVerifyParamsByAlg(uint32_t cmdId, uint32_t alg, const struct ParamsValues *inputParams)
401 {
402 int32_t ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_USE_KEY, inputParams);
403 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check sign or verify fixed params failed, ret = %" LOG_PUBLIC "d", ret)
404
405 ret = HksCheckSignVerifyMutableParams(cmdId, alg, inputParams);
406 HKS_IF_NOT_SUCC_LOGE(ret, "check sign or verify mutable params failed, ret = %" LOG_PUBLIC "d", ret)
407
408 return ret;
409 }
410 #endif
411 #endif /* _CUT_AUTHENTICATE_ */
412
CheckCipherParamsByAlg(uint32_t cmdId,uint32_t alg,const struct HksParamSet * paramSet,const struct ParamsValues * inputParams)413 static int32_t CheckCipherParamsByAlg(
414 uint32_t cmdId, uint32_t alg, const struct HksParamSet *paramSet, const struct ParamsValues *inputParams)
415 {
416 int32_t ret = HksCheckFixedParams(alg, HKS_CHECK_TYPE_USE_KEY, inputParams);
417 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher check fixed params failed, ret = %" LOG_PUBLIC "d", ret)
418
419 ret = HksCheckCipherMutableParams(cmdId, alg, inputParams);
420 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher check mutable params failed, ret = %" LOG_PUBLIC "d", ret)
421
422 ret = HksCheckCipherMaterialParams(alg, inputParams, paramSet);
423 HKS_IF_NOT_SUCC_LOGE(ret, "cipher check material params failed, ret = %" LOG_PUBLIC "d", ret)
424
425 return ret;
426 }
427
428 #ifndef _CUT_AUTHENTICATE_
429 #ifdef HKS_SUPPORT_KDF_PBKDF2
CheckPbkdf2DeriveKeyParams(const struct HksParamSet * paramSet)430 static int32_t CheckPbkdf2DeriveKeyParams(const struct HksParamSet *paramSet)
431 {
432 struct HksParam *iterationParam = NULL;
433 int32_t ret = HksGetParam(paramSet, HKS_TAG_ITERATION, &iterationParam);
434 HKS_IF_NOT_SUCC_RETURN(ret, HKS_ERROR_CHECK_GET_ITERATION_FAIL)
435
436 if (iterationParam->uint32Param < HKS_DEFAULT_PBKDF2_ITERATION) {
437 return HKS_ERROR_INVALID_ITERATION;
438 }
439
440 struct HksParam *saltParam = NULL;
441 ret = HksGetParam(paramSet, HKS_TAG_SALT, &saltParam);
442 HKS_IF_NOT_SUCC_RETURN(ret, HKS_ERROR_CHECK_GET_SALT_FAIL)
443
444 if ((CheckBlob(&saltParam->blob) != HKS_SUCCESS) || (saltParam->blob.size < HKS_DEFAULT_PBKDF2_SALT_SIZE)) {
445 return HKS_ERROR_INVALID_SALT;
446 }
447
448 return HKS_SUCCESS;
449 }
450 #endif
451
HksCoreCheckGenKeyParams(const struct HksBlob * keyAlias,const struct HksParamSet * paramSet,const struct HksBlob * keyIn,const struct HksBlob * keyOut,uint32_t keyFlag)452 int32_t HksCoreCheckGenKeyParams(const struct HksBlob *keyAlias, const struct HksParamSet *paramSet,
453 const struct HksBlob *keyIn, const struct HksBlob *keyOut, uint32_t keyFlag)
454 {
455 (void)keyAlias;
456 (void)keyIn;
457 (void)keyOut;
458 struct ParamsValues params;
459 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
460 return CoreCheckGenKeyParams(paramSet, ¶ms, keyFlag);
461 }
462
CheckRsaKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)463 static int32_t CheckRsaKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
464 const struct HksBlob *key)
465 {
466 (void)keyType;
467 if (key->size < sizeof(struct HksKeyMaterialRsa)) {
468 HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
469 return HKS_ERROR_INVALID_KEY_INFO;
470 }
471
472 struct HksKeyMaterialRsa *keyMaterial = (struct HksKeyMaterialRsa *)(key->data);
473 if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
474 HKS_LOG_E("invalid import key material");
475 return HKS_ERROR_INVALID_KEY_INFO;
476 }
477
478 if ((keyMaterial->nSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->nSize == 0) ||
479 (keyMaterial->dSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->dSize == 0) ||
480 (keyMaterial->eSize > HKS_RSA_KEY_SIZE_4096) || (keyMaterial->eSize == 0)) {
481 HKS_LOG_E("invalid import key material n/d/e size");
482 return HKS_ERROR_INVALID_KEY_INFO;
483 }
484
485 uint32_t keySize = sizeof(struct HksKeyMaterialRsa) + keyMaterial->nSize + keyMaterial->dSize + keyMaterial->eSize;
486 if (key->size < keySize) {
487 HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
488 return HKS_ERROR_INVALID_KEY_INFO;
489 }
490
491 return HKS_SUCCESS;
492 }
493
CheckEccKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)494 static int32_t CheckEccKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
495 const struct HksBlob *key)
496 {
497 if (key->size < sizeof(struct HksKeyMaterialEcc)) {
498 HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
499 return HKS_ERROR_INVALID_KEY_INFO;
500 }
501
502 struct HksKeyMaterialEcc *keyMaterial = (struct HksKeyMaterialEcc *)(key->data);
503 if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
504 HKS_LOG_E("invalid import key material");
505 return HKS_ERROR_INVALID_KEY_INFO;
506 }
507
508 if ((keyMaterial->xSize > HKS_ECC_KEY_SIZE_521) || (keyMaterial->ySize > HKS_ECC_KEY_SIZE_521) ||
509 (keyMaterial->zSize > HKS_ECC_KEY_SIZE_521)) {
510 HKS_LOG_E("invalid import key material x/y/z size, bigger than 521");
511 return HKS_ERROR_INVALID_KEY_INFO;
512 }
513
514 if (keyMaterial->zSize == 0) {
515 HKS_LOG_E("invalid import key material z size: 0");
516 return HKS_ERROR_INVALID_KEY_INFO;
517 }
518 if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && ((keyMaterial->xSize == 0) || (keyMaterial->ySize == 0))) {
519 HKS_LOG_E("invalid import key material x/y size: 0");
520 return HKS_ERROR_INVALID_KEY_INFO;
521 }
522
523 uint32_t keySize = sizeof(struct HksKeyMaterialEcc) + keyMaterial->xSize + keyMaterial->ySize + keyMaterial->zSize;
524 if (key->size < keySize) {
525 HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
526 return HKS_ERROR_INVALID_KEY_INFO;
527 }
528
529 return HKS_SUCCESS;
530 }
531
CheckDsaKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)532 static int32_t CheckDsaKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
533 const struct HksBlob *key)
534 {
535 if (key->size < sizeof(struct HksKeyMaterialDsa)) {
536 HKS_LOG_E("invalid import key size: %" LOG_PUBLIC "u", key->size);
537 return HKS_ERROR_INVALID_KEY_INFO;
538 }
539
540 struct HksKeyMaterialDsa *keyMaterial = (struct HksKeyMaterialDsa *)(key->data);
541 if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
542 HKS_LOG_E("invalid import key material");
543 return HKS_ERROR_INVALID_KEY_INFO;
544 }
545
546 if ((keyMaterial->xSize > MAX_KEY_SIZE) || (keyMaterial->ySize > MAX_KEY_SIZE) ||
547 (keyMaterial->pSize > MAX_KEY_SIZE) || (keyMaterial->qSize > MAX_KEY_SIZE) ||
548 (keyMaterial->gSize > MAX_KEY_SIZE)) {
549 HKS_LOG_E("invalid import key material x/y/p/q/g size, bigger than 2048");
550 return HKS_ERROR_INVALID_KEY_INFO;
551 }
552
553 if ((keyMaterial->xSize == 0) ||
554 (keyMaterial->pSize == 0) || (keyMaterial->qSize == 0) || (keyMaterial->gSize == 0)) {
555 HKS_LOG_E("invalid import key material x/p/q/g size: 0");
556 return HKS_ERROR_INVALID_KEY_INFO;
557 }
558
559 if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->ySize == 0)) {
560 HKS_LOG_E("invalid import key material y size: 0");
561 return HKS_ERROR_INVALID_KEY_INFO;
562 }
563
564 uint32_t keySize = sizeof(struct HksKeyMaterialDsa) + keyMaterial->xSize + keyMaterial->ySize +
565 keyMaterial->pSize + keyMaterial->qSize + keyMaterial->gSize;
566 if (key->size < keySize) {
567 HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
568 return HKS_ERROR_INVALID_KEY_INFO;
569 }
570
571 return HKS_SUCCESS;
572 }
573
CheckCurve25519KeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)574 static int32_t CheckCurve25519KeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
575 const struct HksBlob *key)
576 {
577 if (key->size < sizeof(struct HksKeyMaterial25519)) {
578 HKS_LOG_E("invalid import Curve25519 key size: %" LOG_PUBLIC "u", key->size);
579 return HKS_ERROR_INVALID_KEY_INFO;
580 }
581
582 struct HksKeyMaterial25519 *keyMaterial = (struct HksKeyMaterial25519 *)(key->data);
583 if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
584 HKS_LOG_E("invalid import Curve25519 key material");
585 return HKS_ERROR_INVALID_KEY_INFO;
586 }
587
588 if ((keyMaterial->pubKeySize > HKS_CURVE25519_KEY_SIZE_256) ||
589 (keyMaterial->priKeySize > HKS_CURVE25519_KEY_SIZE_256)) {
590 HKS_LOG_E("invalid import Curve25519 key material pubKey/priKey size, bigger than 256");
591 return HKS_ERROR_INVALID_KEY_INFO;
592 }
593
594 if (keyMaterial->priKeySize == 0) {
595 HKS_LOG_E("invalid import Curve25519 key material priKey size: 0");
596 return HKS_ERROR_INVALID_KEY_INFO;
597 }
598
599 if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->pubKeySize == 0)) {
600 HKS_LOG_E("invalid import Curve25519 key material pubKey size: 0");
601 return HKS_ERROR_INVALID_KEY_INFO;
602 }
603
604 uint32_t keySize = sizeof(struct HksKeyMaterial25519) + keyMaterial->pubKeySize + keyMaterial->priKeySize;
605 if (key->size < keySize) {
606 HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
607 return HKS_ERROR_INVALID_KEY_INFO;
608 }
609
610 return HKS_SUCCESS;
611 }
612
CheckDHKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)613 static int32_t CheckDHKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
614 const struct HksBlob *key)
615 {
616 if (key->size < sizeof(struct HksKeyMaterialDh)) {
617 HKS_LOG_E("invalid import DH key size: %" LOG_PUBLIC "u", key->size);
618 return HKS_ERROR_INVALID_KEY_INFO;
619 }
620
621 struct HksKeyMaterialDh *keyMaterial = (struct HksKeyMaterialDh *)(key->data);
622 if ((keyMaterial->keyAlg != alg) || (keyMaterial->keySize != params->keyLen.value)) {
623 HKS_LOG_E("invalid import DH key material");
624 return HKS_ERROR_INVALID_KEY_INFO;
625 }
626
627 if ((keyMaterial->pubKeySize > HKS_DH_KEY_SIZE_4096) || (keyMaterial->priKeySize > HKS_DH_KEY_SIZE_4096)) {
628 HKS_LOG_E("invalid import DH key material pubKey/priKey size, bigger than 4096");
629 return HKS_ERROR_INVALID_KEY_INFO;
630 }
631
632 if (keyMaterial->priKeySize == 0) {
633 HKS_LOG_E("invalid import DH key material priKey size: 0");
634 return HKS_ERROR_INVALID_KEY_INFO;
635 }
636
637 if ((keyType == HKS_KEY_TYPE_KEY_PAIR) && (keyMaterial->pubKeySize == 0)) {
638 HKS_LOG_E("invalid import DH key material pubKey size: 0");
639 return HKS_ERROR_INVALID_KEY_INFO;
640 }
641
642 uint32_t keySize = sizeof(struct HksKeyMaterialDh) + keyMaterial->pubKeySize + keyMaterial->priKeySize;
643 if (key->size < keySize) {
644 HKS_LOG_E("import key size[%" LOG_PUBLIC "u] smaller than keySize[%" LOG_PUBLIC "u]", key->size, keySize);
645 return HKS_ERROR_INVALID_KEY_INFO;
646 }
647
648 return HKS_SUCCESS;
649 }
650
CheckKeyLen(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)651 static int32_t CheckKeyLen(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
652 const struct HksBlob *key)
653 {
654 switch (alg) {
655 case HKS_ALG_RSA:
656 return CheckRsaKeyLen(alg, keyType, params, key);
657 case HKS_ALG_ECC:
658 case HKS_ALG_SM2:
659 return CheckEccKeyLen(alg, keyType, params, key);
660 case HKS_ALG_DSA:
661 return CheckDsaKeyLen(alg, keyType, params, key);
662 case HKS_ALG_X25519:
663 case HKS_ALG_ED25519:
664 return CheckCurve25519KeyLen(alg, keyType, params, key);
665 case HKS_ALG_DH:
666 return CheckDHKeyLen(alg, keyType, params, key);
667 default:
668 return HKS_ERROR_INVALID_ALGORITHM;
669 }
670 }
671
CheckMutableParams(uint32_t alg,uint32_t keyType,const struct ParamsValues * params)672 static int32_t CheckMutableParams(uint32_t alg, uint32_t keyType, const struct ParamsValues *params)
673 {
674 if (keyType == HKS_KEY_TYPE_KEY_PAIR) {
675 return HKS_SUCCESS;
676 }
677
678 switch (alg) {
679 case HKS_ALG_RSA:
680 if ((params->purpose.value != HKS_KEY_PURPOSE_SIGN) &&
681 (params->purpose.value != HKS_KEY_PURPOSE_DECRYPT)) {
682 HKS_LOG_E("Import rsa private key check purpose failed.");
683 return HKS_ERROR_INVALID_PURPOSE;
684 }
685 return HKS_SUCCESS;
686 case HKS_ALG_ECC:
687 if ((params->purpose.value != HKS_KEY_PURPOSE_SIGN) && (params->purpose.value != HKS_KEY_PURPOSE_AGREE) &&
688 (params->purpose.value != HKS_KEY_PURPOSE_UNWRAP)) {
689 HKS_LOG_E("Import ecc private key check purpose failed.");
690 return HKS_ERROR_INVALID_PURPOSE;
691 }
692 return HKS_SUCCESS;
693 case HKS_ALG_SM2:
694 case HKS_ALG_DSA:
695 case HKS_ALG_ED25519:
696 if (params->purpose.value != HKS_KEY_PURPOSE_SIGN) {
697 HKS_LOG_E("Import sm2 or dsa or ed25519 private key check purpose failed.");
698 return HKS_ERROR_INVALID_PURPOSE;
699 }
700 return HKS_SUCCESS;
701 case HKS_ALG_X25519:
702 case HKS_ALG_DH:
703 return HKS_SUCCESS;
704 default:
705 return HKS_ERROR_INVALID_ALGORITHM;
706 }
707 }
708
CheckImportKey(uint32_t alg,uint32_t keyType,const struct ParamsValues * params,const struct HksBlob * key)709 static int32_t CheckImportKey(uint32_t alg, uint32_t keyType, const struct ParamsValues *params,
710 const struct HksBlob *key)
711 {
712 int32_t ret = CheckKeyLen(alg, keyType, params, key);
713 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check key len failed, ret = %" LOG_PUBLIC "d", ret)
714
715 ret = CheckMutableParams(alg, keyType, params);
716 HKS_IF_NOT_SUCC_LOGE(ret, "check mutable params faile, ret = %" LOG_PUBLIC "d", ret)
717 return ret;
718 }
719
CheckImportSymmetricKeySize(const struct ParamsValues * params,const struct HksBlob * key)720 static int32_t CheckImportSymmetricKeySize(const struct ParamsValues *params, const struct HksBlob *key)
721 {
722 if (key->size != HKS_KEY_BYTES(params->keyLen.value)) {
723 return HKS_ERROR_INVALID_KEY_INFO;
724 }
725 return HKS_SUCCESS;
726 }
727
HksCoreCheckImportKeyParams(const struct HksBlob * keyAlias,const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * keyOut)728 int32_t HksCoreCheckImportKeyParams(const struct HksBlob *keyAlias, const struct HksBlob *key,
729 const struct HksParamSet *paramSet, const struct HksBlob *keyOut)
730 {
731 (void)keyAlias;
732 (void)keyOut;
733 /* import key paramset is subset of generate key paramset */
734 struct ParamsValues params;
735 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
736 int32_t ret = CoreCheckGenKeyParams(paramSet, ¶ms, HKS_KEY_FLAG_IMPORT_KEY);
737 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "CheckImportKeyParams failed")
738
739 uint32_t alg;
740 ret = CheckAndGetAlgorithm(paramSet, g_importKeyAlg, HKS_ARRAY_SIZE(g_importKeyAlg), &alg);
741 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "import key check and get alg failed")
742
743 if ((alg == HKS_ALG_AES) || (alg == HKS_ALG_SM3) || (alg == HKS_ALG_SM4) || (alg == HKS_ALG_HMAC)) {
744 return CheckImportSymmetricKeySize(¶ms, key);
745 }
746
747 struct HksParam *importKeyTypeParam = NULL;
748 ret = HksGetParam(paramSet, HKS_TAG_IMPORT_KEY_TYPE, &importKeyTypeParam);
749 if ((ret == HKS_SUCCESS) &&
750 ((importKeyTypeParam->uint32Param == HKS_KEY_TYPE_PRIVATE_KEY) ||
751 (importKeyTypeParam->uint32Param == HKS_KEY_TYPE_KEY_PAIR))) {
752 /* check private key or keypair key params */
753 return CheckImportKey(alg, importKeyTypeParam->uint32Param, ¶ms, key);
754 }
755
756 /* check public key params: 1. check keySize */
757 ret = CheckImportKeySize(alg, ¶ms, key);
758 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "import key check key size invalid")
759
760 /* check public key params: 2. check mutable params */
761 return CheckImportMutableParams(alg, ¶ms);
762 }
763
HksCoreCheckImportWrappedKeyParams(const struct HksBlob * key,const struct HksBlob * wrappedKeyData,const struct HksParamSet * paramSet,struct HksBlob * keyOut,uint32_t * outUnwrapSuite)764 int32_t HksCoreCheckImportWrappedKeyParams(const struct HksBlob *key, const struct HksBlob *wrappedKeyData,
765 const struct HksParamSet *paramSet, struct HksBlob *keyOut, uint32_t *outUnwrapSuite)
766 {
767 (void)keyOut;
768
769 HKS_IF_NOT_SUCC_LOGE_RETURN(CheckBlob(key), HKS_ERROR_INVALID_ARGUMENT, "wrapping key is invalid")
770
771 /* first check wrapping-related params and wrapped key data */
772 uint32_t unwrapSuite = 0;
773 int32_t ret = CheckAndGetWrappedKeyUnwrapAlgSuite(paramSet, &unwrapSuite);
774 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check import wrapped params set failed")
775
776 ret = HksCheckWrappedDataFormatValidity(wrappedKeyData, HKS_IMPORT_WRAPPED_KEY_TOTAL_BLOBS, NULL);
777 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check import wrapped key data format failed")
778
779 /* then check the origin key paramset which is the same as import key */
780 struct ParamsValues params;
781 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
782 ret = CoreCheckGenKeyParams(paramSet, ¶ms, HKS_KEY_FLAG_IMPORT_KEY);
783 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check origin key param set failed")
784
785 uint32_t alg;
786 ret = CheckAndGetAlgorithm(paramSet, g_importKeyAlg, HKS_ARRAY_SIZE(g_importKeyAlg), &alg);
787 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "CheckImportKeyParams get alg failed")
788 *outUnwrapSuite = unwrapSuite;
789 return HKS_SUCCESS;
790 }
791
HksCoreCheckSignVerifyParams(uint32_t cmdId,const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * srcData,const struct HksBlob * signature)792 int32_t HksCoreCheckSignVerifyParams(uint32_t cmdId, const struct HksBlob *key, const struct HksParamSet *paramSet,
793 const struct HksBlob *srcData, const struct HksBlob *signature)
794 {
795 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
796 (void)srcData;
797 uint32_t alg;
798 int32_t ret = CheckAndGetAlgorithm(paramSet, g_signAlg, HKS_ARRAY_SIZE(g_signAlg), &alg);
799 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check and get alg failed")
800
801 struct ParamsValues params;
802 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
803
804 ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, ¶ms);
805 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify get input params failed, ret = %" LOG_PUBLIC "d", ret)
806
807 ret = CheckSignVerifyParamsByAlg(cmdId, alg, ¶ms);
808 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify check params failed, ret = %" LOG_PUBLIC "d", ret)
809
810 uint32_t keySize = 0;
811 ret = HksGetKeySize(alg, key, &keySize);
812 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get keySize failed!")
813
814 ret = HksCheckSignature(cmdId, alg, keySize, signature);
815 HKS_IF_NOT_SUCC_LOGE(ret, "check signature failed, ret = %" LOG_PUBLIC "d", ret)
816
817 return ret;
818 #else
819 (void)cmdId;
820 (void)key;
821 (void)paramSet;
822 (void)srcData;
823 (void)signature;
824 return HKS_ERROR_NOT_SUPPORTED;
825 #endif
826 }
827
HksLocalCheckSignVerifyParams(uint32_t cmdId,uint32_t keySize,const struct HksParamSet * paramSet,const struct HksBlob * srcData,const struct HksBlob * signature)828 int32_t HksLocalCheckSignVerifyParams(uint32_t cmdId, uint32_t keySize, const struct HksParamSet *paramSet,
829 const struct HksBlob *srcData, const struct HksBlob *signature)
830 {
831 #ifdef HKS_SUPPORT_API_SIGN_VERIFY
832 (void)srcData;
833 uint32_t alg;
834 int32_t ret = CheckAndGetAlgorithm(paramSet, g_signAlg, HKS_ARRAY_SIZE(g_signAlg), &alg);
835 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "local check and get alg failed")
836
837 struct ParamsValues params;
838 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
839
840 ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, ¶ms);
841 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify get input params failed, ret = %" LOG_PUBLIC "d", ret)
842
843 ret = CheckSignVerifyParamsByAlg(cmdId, alg, ¶ms);
844 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "sign or verify local check params failed, ret = %" LOG_PUBLIC "d", ret)
845
846 ret = HksCheckSignature(cmdId, alg, keySize, signature);
847 HKS_IF_NOT_SUCC_LOGE(ret, "check signature failed, ret = %" LOG_PUBLIC "d", ret)
848
849 return ret;
850 #else
851 (void)cmdId;
852 (void)keySize;
853 (void)paramSet;
854 (void)srcData;
855 (void)signature;
856 return HKS_ERROR_NOT_SUPPORTED;
857 #endif
858 }
859
HksCoreCheckAgreeKeyParams(const struct HksParamSet * paramSet,const struct HksBlob * privateKey,const struct HksBlob * peerPublicKey,const struct HksBlob * agreedKey,bool isLocalCheck)860 int32_t HksCoreCheckAgreeKeyParams(const struct HksParamSet *paramSet, const struct HksBlob *privateKey,
861 const struct HksBlob *peerPublicKey, const struct HksBlob *agreedKey, bool isLocalCheck)
862 {
863 uint32_t alg;
864 int32_t ret;
865
866 if (isLocalCheck) {
867 ret = CheckAndGetAlgorithm(paramSet, g_agreeAlgLocal, HKS_ARRAY_SIZE(g_agreeAlgLocal), &alg);
868 } else {
869 ret = CheckAndGetAlgorithm(paramSet, g_agreeAlg, HKS_ARRAY_SIZE(g_agreeAlg), &alg);
870 }
871 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
872
873 uint32_t keySize = 0;
874 if (isLocalCheck) {
875 if (alg == HKS_ALG_ED25519) {
876 if ((privateKey->size != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256)) ||
877 (peerPublicKey->size != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256))) {
878 return HKS_ERROR_INVALID_KEY_SIZE;
879 }
880 }
881
882 if (alg == HKS_ALG_DH || alg == HKS_ALG_ECC || alg == HKS_ALG_ECDH) {
883 if (privateKey->size < sizeof(struct HksKeyMaterialHeader)) {
884 return HKS_ERROR_INVALID_ARGUMENT;
885 }
886 keySize = ((struct HksKeyMaterialHeader *)privateKey->data)->keySize;
887 } else if (alg == HKS_ALG_ED25519) {
888 keySize = privateKey->size * HKS_BITS_PER_BYTE;
889 }
890 } else {
891 ret = HksGetKeySize(alg, privateKey, &keySize);
892 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get key size failed")
893 }
894
895 uint32_t size = keySize / HKS_BITS_PER_BYTE + keySize % HKS_BITS_PER_BYTE;
896 if (agreedKey->size < size) {
897 HKS_LOG_E("agreeKey buffer too small, size %" LOG_PUBLIC "u", agreedKey->size);
898 return HKS_ERROR_BUFFER_TOO_SMALL;
899 }
900
901 return HKS_SUCCESS;
902 }
903
HksCoreCheckCipherParams(uint32_t cmdId,const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * inData,const struct HksBlob * outData)904 int32_t HksCoreCheckCipherParams(uint32_t cmdId, const struct HksBlob *key, const struct HksParamSet *paramSet,
905 const struct HksBlob *inData, const struct HksBlob *outData)
906 {
907 uint32_t alg;
908 int32_t ret = CheckAndGetAlgorithm(paramSet, g_cipherAlg, HKS_ARRAY_SIZE(g_cipherAlg), &alg);
909 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
910
911 struct ParamsValues params;
912 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
913
914 ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, ¶ms);
915 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher get input params failed, ret = %" LOG_PUBLIC "d", ret)
916
917 if ((alg == HKS_ALG_RSA) || (alg == HKS_ALG_SM4)) {
918 ret = HksGetKeySize(alg, key, ¶ms.keyLen.value);
919 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "rsa cipher get key size failed")
920 }
921
922 ret = CheckCipherParamsByAlg(cmdId, alg, paramSet, ¶ms);
923 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "cipher check params failed, ret = %" LOG_PUBLIC "d", ret)
924
925 ret = HksCheckCihperData(cmdId, alg, ¶ms, inData, outData);
926 HKS_IF_NOT_SUCC_LOGE(ret, "cipher check input or output data failed, ret = %" LOG_PUBLIC "d", ret)
927
928 return ret;
929 }
930 #endif /* _CUT_AUTHENTICATE_ */
931
HksLocalCheckCipherParams(uint32_t cmdId,uint32_t keySize,const struct HksParamSet * paramSet,const struct HksBlob * inData,const struct HksBlob * outData)932 int32_t HksLocalCheckCipherParams(uint32_t cmdId, uint32_t keySize, const struct HksParamSet *paramSet,
933 const struct HksBlob *inData, const struct HksBlob *outData)
934 {
935 uint32_t alg;
936 int32_t ret = CheckAndGetAlgorithm(paramSet, g_cipherAlgLocal, HKS_ARRAY_SIZE(g_cipherAlgLocal), &alg);
937 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
938
939 if (alg == HKS_ALG_AES) {
940 #ifdef HKS_SUPPORT_AES_C
941 ret = HksCheckValue(keySize, g_aesKeySizeLocal, HKS_ARRAY_SIZE(g_aesKeySizeLocal));
942 #else
943 ret = HKS_ERROR_NOT_SUPPORTED;
944 #endif
945 } else if (alg == HKS_ALG_RSA) {
946 #ifdef HKS_SUPPORT_RSA_C
947 ret = HksCheckValue(keySize, g_rsaKeySizeLocal, HKS_ARRAY_SIZE(g_rsaKeySizeLocal));
948 #else
949 ret = HKS_ERROR_NOT_SUPPORTED;
950 #endif
951 }
952 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INVALID_KEY_SIZE,
953 "keySize value %" LOG_PUBLIC "u not expected", keySize)
954
955 struct ParamsValues params;
956 (void)memset_s(¶ms, sizeof(params), 0, sizeof(params));
957
958 ret = HksGetInputParmasByAlg(alg, HKS_CHECK_TYPE_USE_KEY, paramSet, ¶ms);
959 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "local cipher get input params failed, ret = %" LOG_PUBLIC "d", ret)
960
961 ret = CheckCipherParamsByAlg(cmdId, alg, paramSet, ¶ms);
962 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "local cipher check params failed, ret = %" LOG_PUBLIC "d", ret)
963
964 ret = HksCheckCihperData(cmdId, alg, ¶ms, inData, outData);
965 HKS_IF_NOT_SUCC_LOGE(ret, "local cipher check input or output data failed, ret = %" LOG_PUBLIC "d", ret)
966
967 return ret;
968 }
969
HksCoreCheckDeriveKeyParams(const struct HksParamSet * paramSet,const struct HksBlob * mainKey,const struct HksBlob * derivedKey,bool isLocalCheck)970 int32_t HksCoreCheckDeriveKeyParams(const struct HksParamSet *paramSet, const struct HksBlob *mainKey,
971 const struct HksBlob *derivedKey, bool isLocalCheck)
972 {
973 (void)mainKey;
974 (void)derivedKey;
975 uint32_t alg;
976 int32_t ret;
977 if (isLocalCheck) {
978 ret = CheckAndGetAlgorithm(paramSet, g_deriveAlgLocal, HKS_ARRAY_SIZE(g_deriveAlgLocal), &alg);
979 } else {
980 ret = CheckAndGetAlgorithm(paramSet, g_deriveAlg, HKS_ARRAY_SIZE(g_deriveAlg), &alg);
981 }
982 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check alg failed")
983
984 struct HksParam *purposeParam = NULL;
985 ret = HksGetParam(paramSet, HKS_TAG_PURPOSE, &purposeParam);
986 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_CHECK_GET_PURPOSE_FAIL,
987 "get param get 0x%" LOG_PUBLIC "x failed", HKS_TAG_PURPOSE)
988
989 if (purposeParam->uint32Param != HKS_KEY_PURPOSE_DERIVE) {
990 return HKS_ERROR_INVALID_PURPOSE;
991 }
992
993 /* according to RFC5869, HKDF no need check salt and info */
994 uint32_t digest;
995 ret = CheckAndGetDigest(paramSet, g_digest, HKS_ARRAY_SIZE(g_digest), &digest);
996 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check digest failed")
997
998 #ifdef HKS_SUPPORT_KDF_PBKDF2
999 if (alg == HKS_ALG_PBKDF2) {
1000 return CheckPbkdf2DeriveKeyParams(paramSet);
1001 }
1002 #endif
1003
1004 return HKS_SUCCESS;
1005 }
1006
CheckMacPurpose(const struct HksParamSet * paramSet)1007 static int32_t CheckMacPurpose(const struct HksParamSet *paramSet)
1008 {
1009 struct HksParam *purposeParam = NULL;
1010 int32_t ret = HksGetParam(paramSet, HKS_TAG_PURPOSE, &purposeParam);
1011 HKS_IF_NOT_SUCC_RETURN(ret, HKS_ERROR_CHECK_GET_PURPOSE_FAIL)
1012
1013 if (purposeParam->uint32Param != HKS_KEY_PURPOSE_MAC) {
1014 return HKS_ERROR_INVALID_PURPOSE;
1015 }
1016
1017 return HKS_SUCCESS;
1018 }
1019
CheckMacOutput(const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * mac,bool isLocalCheck)1020 static int32_t CheckMacOutput(
1021 const struct HksBlob *key, const struct HksParamSet *paramSet, const struct HksBlob *mac, bool isLocalCheck)
1022 {
1023 uint32_t digest;
1024 int32_t ret;
1025 if (isLocalCheck) {
1026 ret = CheckAndGetDigest(paramSet, g_digest, HKS_ARRAY_SIZE(g_digest), &digest);
1027 } else {
1028 ret = CheckAndGetDigest(paramSet, g_macDigest, HKS_ARRAY_SIZE(g_macDigest), &digest);
1029 }
1030 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check digest failed")
1031
1032 uint32_t digestLen;
1033 ret = HksGetDigestLen(digest, &digestLen);
1034 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get digest length failed, ret = %" LOG_PUBLIC "d", ret)
1035
1036 if (mac->size < digestLen) {
1037 HKS_LOG_E("mac buffer too small, size %" LOG_PUBLIC "u", mac->size);
1038 return HKS_ERROR_BUFFER_TOO_SMALL;
1039 }
1040
1041 if ((isLocalCheck) && (key->size < digestLen)) { /* the unit of local engine input key size is byte */
1042 HKS_LOG_E("key size too small, size = %" LOG_PUBLIC "u", key->size);
1043 return HKS_ERROR_INVALID_KEY_SIZE;
1044 }
1045
1046 return HKS_SUCCESS;
1047 }
1048
HksCoreCheckMacParams(const struct HksBlob * key,const struct HksParamSet * paramSet,const struct HksBlob * srcData,const struct HksBlob * mac,bool isLocalCheck)1049 int32_t HksCoreCheckMacParams(const struct HksBlob *key, const struct HksParamSet *paramSet,
1050 const struct HksBlob *srcData, const struct HksBlob *mac, bool isLocalCheck)
1051 {
1052 (void)srcData;
1053 int32_t ret = CheckMacPurpose(paramSet);
1054 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "check Mac purpose failed")
1055
1056 return CheckMacOutput(key, paramSet, mac, isLocalCheck);
1057 }
1058