1 /*
2 * Copyright (c) 2020-2021 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #ifdef HKS_CONFIG_FILE
17 #include HKS_CONFIG_FILE
18 #else
19 #include "hks_config.h"
20 #endif
21
22 #ifdef HKS_SUPPORT_KDF_C
23
24 #include "hks_mbedtls_kdf.h"
25
26 #include <mbedtls/hkdf.h>
27 #include <mbedtls/md.h>
28 #include <mbedtls/pkcs5.h>
29
30 #include "hks_log.h"
31 #include "hks_mbedtls_common.h"
32 #include "hks_template.h"
33 #include "hks_type_inner.h"
34
35 #ifdef _CUT_AUTHENTICATE
36 #undef HKS_SUPPORT_KDF_PBKDF2
37 #endif
38
39 #ifdef HKS_SUPPORT_KDF_PBKDF2
DeriveKeyPbkdf2(const struct HksBlob * mainKey,const struct HksKeyDerivationParam * derParam,const mbedtls_md_info_t * info,struct HksBlob * derivedKey)40 static int32_t DeriveKeyPbkdf2(const struct HksBlob *mainKey, const struct HksKeyDerivationParam *derParam,
41 const mbedtls_md_info_t *info, struct HksBlob *derivedKey)
42 {
43 mbedtls_md_context_t ctx;
44 (void)memset_s(&ctx, sizeof(mbedtls_md_context_t), 0, sizeof(mbedtls_md_context_t));
45 mbedtls_md_init(&ctx);
46
47 int32_t ret;
48 do {
49 ret = mbedtls_md_setup(&ctx, info, 1); /* 1 for using HMAC */
50 if (ret != HKS_MBEDTLS_SUCCESS) {
51 HKS_LOG_E("Mbedtls md setup failed! mbedtls ret = 0x%" LOG_PUBLIC "X", ret);
52 break;
53 }
54
55 ret = mbedtls_pkcs5_pbkdf2_hmac(&ctx, mainKey->data, mainKey->size, derParam->salt.data,
56 derParam->salt.size, derParam->iterations, derivedKey->size, derivedKey->data);
57 if (ret != HKS_MBEDTLS_SUCCESS) {
58 HKS_LOG_E("Mbedtls pbkdf2 failed! mbedtls ret = 0x%" LOG_PUBLIC "X", ret);
59 (void)memset_s(derivedKey->data, derivedKey->size, 0, derivedKey->size);
60 }
61 } while (0);
62
63 mbedtls_md_free(&ctx);
64 return ret;
65 }
66 #endif /* HKS_SUPPORT_KDF_PBKDF2 */
67
68 #ifdef HKS_SUPPORT_KDF_HKDF
DeriveKeyHkdf(const struct HksBlob * mainKey,const struct HksKeyDerivationParam * derParam,const mbedtls_md_info_t * info,struct HksBlob * derivedKey)69 static int32_t DeriveKeyHkdf(const struct HksBlob *mainKey, const struct HksKeyDerivationParam *derParam,
70 const mbedtls_md_info_t *info, struct HksBlob *derivedKey)
71 {
72 int32_t ret = mbedtls_hkdf(info, derParam->salt.data, derParam->salt.size, mainKey->data, mainKey->size,
73 derParam->info.data, derParam->info.size, derivedKey->data, derivedKey->size);
74 if (ret != HKS_MBEDTLS_SUCCESS) {
75 HKS_LOG_E("Mbedtls hkdf failed! mbedtls ret = 0x%" LOG_PUBLIC "X", ret);
76 (void)memset_s(derivedKey->data, derivedKey->size, 0, derivedKey->size);
77 }
78
79 return ret;
80 }
81 #endif /* HKS_SUPPORT_KDF_HKDF */
82
HksMbedtlsDeriveKey(const struct HksBlob * mainKey,const struct HksKeySpec * derivationSpec,struct HksBlob * derivedKey)83 int32_t HksMbedtlsDeriveKey(const struct HksBlob *mainKey,
84 const struct HksKeySpec *derivationSpec, struct HksBlob *derivedKey)
85 {
86 const struct HksKeyDerivationParam *derParam = (struct HksKeyDerivationParam *)(derivationSpec->algParam);
87
88 uint32_t mbedtlsAlg;
89 int32_t ret = HksToMbedtlsDigestAlg(derParam->digestAlg, &mbedtlsAlg);
90 HKS_IF_NOT_SUCC_RETURN(ret, ret)
91
92 const mbedtls_md_info_t *info = mbedtls_md_info_from_type((mbedtls_md_type_t)mbedtlsAlg);
93 HKS_IF_NULL_LOGE_RETURN(info, HKS_ERROR_CRYPTO_ENGINE_ERROR,
94 "Mbedtls get md info failed! mbedtls ret = 0x%" LOG_PUBLIC "X", ret)
95
96 switch (derivationSpec->algType) {
97 #ifdef HKS_SUPPORT_KDF_PBKDF2
98 case HKS_ALG_PBKDF2:
99 return DeriveKeyPbkdf2(mainKey, derParam, info, derivedKey);
100 #endif
101 #ifdef HKS_SUPPORT_KDF_HKDF
102 case HKS_ALG_HKDF:
103 return DeriveKeyHkdf(mainKey, derParam, info, derivedKey);
104 #endif
105 default:
106 HKS_LOG_E("Unsupport derive key alg! mode = 0x%" LOG_PUBLIC "X", derivationSpec->algType);
107 return HKS_ERROR_INVALID_ARGUMENT;
108 }
109 }
110 #endif /* HKS_SUPPORT_KDF_C */
111