1 /*
2  * Copyright 2015 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "rsa_keymaster1_operation.h"
18 
19 #include <memory>
20 
21 #include <keymaster/android_keymaster_utils.h>
22 #include <keymaster/km_openssl/openssl_err.h>
23 #include <keymaster/km_openssl/openssl_utils.h>
24 #include <keymaster/legacy_support/rsa_keymaster1_key.h>
25 
26 using std::unique_ptr;
27 
28 namespace keymaster {
29 
Begin(EVP_PKEY * rsa_key,const AuthorizationSet & input_params)30 keymaster_error_t RsaKeymaster1WrappedOperation::Begin(EVP_PKEY* rsa_key,
31                                                        const AuthorizationSet& input_params) {
32     Keymaster1Engine::KeyData* key_data = engine_->GetData(rsa_key);
33     if (!key_data) return KM_ERROR_UNKNOWN_ERROR;
34 
35     // Copy the input params and substitute KM_DIGEST_NONE for whatever was specified.  Also change
36     // KM_PAD_RSA_PSS and KM_PAD_OAEP to KM_PAD_NONE, if necessary. These are the params we'll pass
37     // to the hardware module.  The regular Rsa*Operation classes will do software digesting and
38     // padding where we've told the HW not to.
39     //
40     // The reason we don't change KM_PAD_RSA_PKCS1_1_5_SIGN or KM_PAD_RSA_PKCS1_1_5_ENCRYPT to
41     // KM_PAD_NONE is because the hardware can perform those padding modes, since they don't involve
42     // digesting.
43     //
44     // We also cache in the key the padding value that we expect to be passed to the engine crypto
45     // operation.  This just allows us to double-check that the correct padding value is reaching
46     // that layer.
47     AuthorizationSet begin_params(input_params);
48     int pos = begin_params.find(TAG_DIGEST);
49     if (pos == -1) {
50         // If we reach this point with no digest given. It was verified that KM_DIGEST_NONE was
51         // authorized by OperationFactory::GetAndValidateDigest. So no DIGEST given may imply
52         // KM_DIGEST_NONE.
53         begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
54     } else {
55         begin_params[pos].enumerated = KM_DIGEST_NONE;
56     }
57 
58     pos = begin_params.find(TAG_PADDING);
59     if (pos == -1) return KM_ERROR_UNSUPPORTED_PADDING_MODE;
60     switch (begin_params[pos].enumerated) {
61     case KM_PAD_NONE:
62     case KM_PAD_RSA_PSS:
63     case KM_PAD_RSA_OAEP:
64         key_data->expected_openssl_padding = RSA_NO_PADDING;
65         begin_params[pos].enumerated = KM_PAD_NONE;
66         break;
67 
68     case KM_PAD_RSA_PKCS1_1_5_ENCRYPT:
69     case KM_PAD_RSA_PKCS1_1_5_SIGN:
70         key_data->expected_openssl_padding = RSA_PKCS1_PADDING;
71         break;
72     }
73 
74     return engine_->device()->begin(engine_->device(), purpose_, &key_data->key_material,
75                                     &begin_params, nullptr /* out_params */, &operation_handle_);
76 }
77 
78 keymaster_error_t
PrepareFinish(EVP_PKEY * rsa_key,const AuthorizationSet & input_params)79 RsaKeymaster1WrappedOperation::PrepareFinish(EVP_PKEY* rsa_key,
80                                              const AuthorizationSet& input_params) {
81     Keymaster1Engine::KeyData* key_data = engine_->GetData(rsa_key);
82     if (!key_data) {
83         LOG_E("Could not get extended key data... not a Keymaster1Engine key?", 0);
84         return KM_ERROR_UNKNOWN_ERROR;
85     }
86     key_data->op_handle = operation_handle_;
87     key_data->finish_params.Reinitialize(input_params);
88 
89     return KM_ERROR_OK;
90 }
91 
Abort()92 keymaster_error_t RsaKeymaster1WrappedOperation::Abort() {
93     return engine_->device()->abort(engine_->device(), operation_handle_);
94 }
95 
GetError(EVP_PKEY * rsa_key)96 keymaster_error_t RsaKeymaster1WrappedOperation::GetError(EVP_PKEY* rsa_key) {
97     Keymaster1Engine::KeyData* key_data = engine_->GetData(rsa_key);  // key_data is owned by rsa
98     if (!key_data) return KM_ERROR_UNKNOWN_ERROR;
99     return key_data->error;
100 }
101 
GetEvpKey(const RsaKeymaster1Key & key,keymaster_error_t * error)102 static EVP_PKEY* GetEvpKey(const RsaKeymaster1Key& key, keymaster_error_t* error) {
103     if (!key.key()) {
104         *error = KM_ERROR_UNKNOWN_ERROR;
105         return nullptr;
106     }
107 
108     UniquePtr<EVP_PKEY, EVP_PKEY_Delete> pkey(EVP_PKEY_new());
109     if (!key.InternalToEvp(pkey.get())) {
110         *error = KM_ERROR_UNKNOWN_ERROR;
111         return nullptr;
112     }
113     return pkey.release();
114 }
115 
CreateOperation(Key && key,const AuthorizationSet & begin_params,keymaster_error_t * error)116 OperationPtr RsaKeymaster1OperationFactory::CreateOperation(Key&& key,
117                                                             const AuthorizationSet& begin_params,
118                                                             keymaster_error_t* error) {
119     keymaster_digest_t digest;
120     if (!GetAndValidateDigest(begin_params, key, &digest, error)) return nullptr;
121 
122     keymaster_padding_t padding;
123     if (!GetAndValidatePadding(begin_params, key, &padding, error)) return nullptr;
124 
125     const RsaKeymaster1Key& rsa_km1_key = static_cast<RsaKeymaster1Key&>(key);
126     unique_ptr<EVP_PKEY, EVP_PKEY_Delete> rsa(GetEvpKey(rsa_km1_key, error));
127     if (!rsa) return nullptr;
128 
129     switch (purpose_) {
130     case KM_PURPOSE_SIGN:
131         return OperationPtr(new RsaKeymaster1Operation<RsaSignOperation>(
132             key.hw_enforced_move(), key.sw_enforced_move(), digest, padding, rsa.release(),
133             engine_));
134     case KM_PURPOSE_DECRYPT:
135         return OperationPtr(new RsaKeymaster1Operation<RsaDecryptOperation>(
136             key.hw_enforced_move(), key.sw_enforced_move(), digest, padding, rsa.release(),
137             engine_));
138     default:
139         LOG_E("Bug: Pubkey operation requested.  Those should be handled by normal RSA operations.",
140               0);
141         *error = KM_ERROR_UNSUPPORTED_PURPOSE;
142         return nullptr;
143     }
144 }
145 
146 static const keymaster_digest_t supported_digests[] = {
147     KM_DIGEST_NONE,      KM_DIGEST_MD5,       KM_DIGEST_SHA1,     KM_DIGEST_SHA_2_224,
148     KM_DIGEST_SHA_2_256, KM_DIGEST_SHA_2_384, KM_DIGEST_SHA_2_512};
149 
150 const keymaster_digest_t*
SupportedDigests(size_t * digest_count) const151 RsaKeymaster1OperationFactory::SupportedDigests(size_t* digest_count) const {
152     *digest_count = array_length(supported_digests);
153     return supported_digests;
154 }
155 
156 static const keymaster_padding_t supported_sig_padding[] = {
157     KM_PAD_NONE,
158     KM_PAD_RSA_PKCS1_1_5_SIGN,
159     KM_PAD_RSA_PSS,
160 };
161 static const keymaster_padding_t supported_crypt_padding[] = {
162     KM_PAD_NONE,
163     KM_PAD_RSA_PKCS1_1_5_ENCRYPT,
164     KM_PAD_RSA_OAEP,
165 };
166 
167 const keymaster_padding_t*
SupportedPaddingModes(size_t * padding_mode_count) const168 RsaKeymaster1OperationFactory::SupportedPaddingModes(size_t* padding_mode_count) const {
169     switch (purpose_) {
170     case KM_PURPOSE_SIGN:
171     case KM_PURPOSE_VERIFY:
172         *padding_mode_count = array_length(supported_sig_padding);
173         return supported_sig_padding;
174     case KM_PURPOSE_ENCRYPT:
175     case KM_PURPOSE_DECRYPT:
176         *padding_mode_count = array_length(supported_crypt_padding);
177         return supported_crypt_padding;
178     default:
179         *padding_mode_count = 0;
180         return nullptr;
181     }
182 }
183 
184 }  // namespace keymaster
185