1 /* 2 * Copyright (c) 2021 Huawei Device Co., Ltd. 3 * Licensed under the Apache License, Version 2.0 (the "License"); 4 * you may not use this file except in compliance with the License. 5 * You may obtain a copy of the License at 6 * 7 * http://www.apache.org/licenses/LICENSE-2.0 8 * 9 * Unless required by applicable law or agreed to in writing, software 10 * distributed under the License is distributed on an "AS IS" BASIS, 11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 * See the License for the specific language governing permissions and 13 * limitations under the License. 14 */ 15 #ifndef STORAGE_DAEMON_CRYPTO_KEY_UTILS_H 16 #define STORAGE_DAEMON_CRYPTO_KEY_UTILS_H 17 18 #include <memory> 19 #include <string> 20 #include <vector> 21 #include <linux/keyctl.h> 22 #include <linux/version.h> 23 24 #include "hks_type.h" 25 #include "securec.h" 26 27 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0) 28 #include <linux/fscrypt.h> 29 #define SUPPORT_FSCRYPT_V2 30 #else 31 #include "libfscrypt/fscrypt_uapi.h" 32 #endif 33 34 namespace OHOS { 35 namespace StorageDaemon { 36 constexpr uint32_t CRYPTO_KEY_SECDISC_SIZE = 16384; 37 constexpr uint32_t CRYPTO_KEY_ALIAS_SIZE = 16; 38 constexpr uint32_t CRYPTO_AES_AAD_LEN = 16; 39 constexpr uint32_t CRYPTO_AES_NONCE_LEN = 64; 40 constexpr uint32_t CRYPTO_AES_256_XTS_KEY_SIZE = 64; 41 constexpr uint32_t CRYPTO_KEY_SHIELD_MAX_SIZE = 2048; 42 constexpr uint32_t CRYPTO_AES_256_KEY_ENCRYPTED_SIZE = 80; 43 constexpr uint32_t CRYPTO_TOKEN_SIZE = TOKEN_CHALLENGE_LEN; // 32 44 45 using key_serial_t = int; 46 constexpr uint32_t CRYPTO_KEY_DESC_SIZE = FSCRYPT_KEY_DESCRIPTOR_SIZE; 47 static const std::string MNT_DATA = "/data"; 48 static const std::string PATH_LATEST = "/latest"; 49 static const std::string PATH_SHIELD = "/shield"; 50 static const std::string PATH_SECDISC = "/sec_discard"; 51 static const std::string PATH_ENCRYPTED = "/encrypted"; 52 static const std::string PATH_KEYID = "/key_id"; 53 static const std::string PATH_KEYDESC = "/key_desc"; 54 55 const std::string DATA_EL0_DIR = std::string() + "/data/service/el0"; 56 const std::string STORAGE_DAEMON_DIR = DATA_EL0_DIR + "/storage_daemon"; 57 const std::string DEVICE_EL1_DIR = STORAGE_DAEMON_DIR + "/sd"; 58 59 class KeyBlob { 60 public: 61 KeyBlob() = default; KeyBlob(KeyBlob const & blob)62 KeyBlob(KeyBlob const &blob) 63 { 64 Alloc(blob.size); 65 auto ret = memcpy_s(data.get(), size, blob.data.get(), blob.size); 66 if (ret != EOK) { 67 Clear(); 68 } 69 } ~KeyBlob()70 ~KeyBlob() 71 { 72 Clear(); 73 } KeyBlob(uint32_t len)74 KeyBlob(uint32_t len) 75 { 76 Alloc(len); 77 // may fail, need check IsEmpty() if needed 78 } KeyBlob(KeyBlob && right)79 KeyBlob(KeyBlob &&right) 80 { 81 data = std::move(right.data); 82 size = right.size; 83 } KeyBlob(const std::vector<uint8_t> & vec)84 KeyBlob(const std::vector<uint8_t> &vec) 85 { 86 if (Alloc(vec.size())) { 87 auto ret = memcpy_s(data.get(), size, vec.data(), vec.size()); 88 if (ret != EOK) { 89 Clear(); 90 } 91 } 92 } 93 KeyBlob& operator=(KeyBlob &&right) 94 { 95 data = std::move(right.data); 96 size = right.size; 97 return *this; 98 } Alloc(uint32_t len)99 bool Alloc(uint32_t len) 100 { 101 if (len > CRYPTO_KEY_SECDISC_SIZE) { 102 return false; 103 } 104 if (!IsEmpty()) { 105 Clear(); 106 } 107 108 data = std::make_unique<uint8_t[]>(len); 109 size = len; 110 (void)memset_s(data.get(), size, 0, size); 111 return true; 112 } Clear()113 void Clear() 114 { 115 if (data != nullptr && size != 0) { 116 (void)memset_s(data.get(), size, 0, size); 117 } 118 size = 0; 119 data.reset(nullptr); 120 } IsEmpty()121 bool IsEmpty() const 122 { 123 return size == 0 || data.get() == nullptr; 124 } ToString()125 std::string ToString() const 126 { 127 std::string hex; 128 const char *hexMap = "0123456789abcdef"; 129 static_assert(sizeof(data[0]) == sizeof(char)); 130 for (size_t i = 0; i < size; i++) { 131 hex = hex + hexMap[(data[i] & 0xF0) >> 4] + hexMap[data[i] & 0x0F]; // higher 4 bits 132 } 133 return hex; 134 } ToHksBlob()135 HksBlob ToHksBlob() const 136 { 137 return {size, data.get()}; 138 } 139 uint32_t size { 0 }; 140 std::unique_ptr<uint8_t[]> data { nullptr }; 141 }; 142 143 struct KeyInfo { 144 uint8_t version { 0 }; 145 KeyBlob key; 146 // the legacy interface use key_spec.u.descriptor 147 KeyBlob keyDesc; 148 // the v2 interface use the key_spec.u.identifier 149 KeyBlob keyId; 150 }; 151 152 struct KeyContext { 153 // secure discardable keyblob 154 KeyBlob secDiscard; 155 // encrypted huks key for encrypt/decrypt 156 KeyBlob shield; 157 // encrypted blob of rawkey 158 KeyBlob encrypted; 159 // aes_gcm tags 160 KeyBlob nonce; 161 KeyBlob aad; 162 }; 163 164 struct UserAuth { 165 // when secure access enabled, token is needed to authenticate the user 166 KeyBlob token; 167 KeyBlob secret; 168 uint64_t secureUid { 0 }; 169 }; 170 } // namespace StorageDaemon 171 } // namespace OHOS 172 173 #endif // STORAGE_DAEMON_CRYPTO_KEY_UTILS_H 174