1 /*
2 * Copyright 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <keymaster/km_openssl/ecdh_operation.h>
18
19 #include <keymaster/km_openssl/ec_key.h>
20 #include <keymaster/km_openssl/openssl_err.h>
21 #include <keymaster/km_openssl/openssl_utils.h>
22 #include <keymaster/logger.h>
23 #include <openssl/err.h>
24 #include <vector>
25
26 namespace keymaster {
27
Begin(const AuthorizationSet &,AuthorizationSet *)28 keymaster_error_t EcdhOperation::Begin(const AuthorizationSet& /*input_params*/,
29 AuthorizationSet* /*output_params*/) {
30 auto rc = GenerateRandom(reinterpret_cast<uint8_t*>(&operation_handle_),
31 (size_t)sizeof(operation_handle_));
32 if (rc != KM_ERROR_OK) {
33 return rc;
34 }
35 return KM_ERROR_OK;
36 }
37
Update(const AuthorizationSet &,const Buffer &,AuthorizationSet *,Buffer *,size_t *)38 keymaster_error_t EcdhOperation::Update(const AuthorizationSet& /*additional_params*/,
39 const Buffer& /*input*/,
40 AuthorizationSet* /*output_params*/, Buffer* /*output*/,
41 size_t* /*input_consumed*/) {
42 return KM_ERROR_OK;
43 }
44
Finish(const AuthorizationSet &,const Buffer & input,const Buffer &,AuthorizationSet *,Buffer * output)45 keymaster_error_t EcdhOperation::Finish(const AuthorizationSet& /*additional_params*/,
46 const Buffer& input, const Buffer& /*signature*/,
47 AuthorizationSet* /*output_params*/, Buffer* output) {
48 const unsigned char* encodedPublicKey = input.begin();
49 EVP_PKEY* pkeyRaw = d2i_PUBKEY(nullptr, &encodedPublicKey, input.available_read());
50 if (pkeyRaw == nullptr) {
51 LOG_E("Error decoding key", 0);
52 return TranslateLastOpenSslError();
53 }
54 auto pkey = EVP_PKEY_Ptr(pkeyRaw);
55
56 auto ctx = EVP_PKEY_CTX_Ptr(EVP_PKEY_CTX_new(ecdh_key_.get(), nullptr));
57 if (ctx.get() == nullptr) {
58 LOG_E("Memory allocation failed", 0);
59 return TranslateLastOpenSslError();
60 }
61 if (EVP_PKEY_derive_init(ctx.get()) != 1) {
62 LOG_E("Context initialization failed", 0);
63 return TranslateLastOpenSslError();
64 }
65 if (EVP_PKEY_derive_set_peer(ctx.get(), pkey.get()) != 1) {
66 LOG_E("Error setting peer key", 0);
67 return TranslateLastOpenSslError();
68 }
69 size_t sharedSecretLen = 0;
70 if (EVP_PKEY_derive(ctx.get(), nullptr, &sharedSecretLen) != 1) {
71 LOG_E("Error deriving key", 0);
72 return TranslateLastOpenSslError();
73 }
74 if (!output->reserve(sharedSecretLen)) {
75 LOG_E("Error reserving data in output buffer", 0);
76 return KM_ERROR_MEMORY_ALLOCATION_FAILED;
77 }
78 if (EVP_PKEY_derive(ctx.get(), output->peek_write(), &sharedSecretLen) != 1) {
79 LOG_E("Error deriving key", 0);
80 return TranslateLastOpenSslError();
81 }
82 output->advance_write(sharedSecretLen);
83
84 return KM_ERROR_OK;
85 }
86
CreateOperation(Key && key,const AuthorizationSet &,keymaster_error_t * error)87 OperationPtr EcdhOperationFactory::CreateOperation(Key&& key,
88 const AuthorizationSet& /*begin_params*/,
89 keymaster_error_t* error) {
90 const EcKey& ecdh_key = static_cast<EcKey&>(key);
91
92 EVP_PKEY_Ptr pkey(EVP_PKEY_new());
93 if (pkey.get() == nullptr) {
94 *error = KM_ERROR_MEMORY_ALLOCATION_FAILED;
95 return nullptr;
96 }
97 if (!ecdh_key.InternalToEvp(pkey.get())) {
98 *error = KM_ERROR_UNKNOWN_ERROR;
99 return nullptr;
100 }
101
102 *error = KM_ERROR_OK;
103 auto op = new (std::nothrow)
104 EcdhOperation(move(key.hw_enforced_move()), move(key.sw_enforced_move()), pkey.release());
105 if (!op) {
106 *error = KM_ERROR_MEMORY_ALLOCATION_FAILED;
107 return nullptr;
108 }
109 return OperationPtr(op);
110 }
111
112 } // namespace keymaster
113