mirror of
https://gitee.com/mirrors_PX4/PX4-Autopilot.git
synced 2026-10-20 00:23:34 +08:00
Move sw_crypto and stub_keystore under src/drivers
This is more logical place for the "backend" implementation than directly under platform. This also allows making other implementations as "real" drivers, as well as proper configuration via Kconfigs Signed-off-by: Jukka Laitinen <jukkax@ssrc.tii.ae>
This commit is contained in:
Jukka Laitinen
committed by
Daniel Agar
Daniel Agar
parent
9b7c8c8a8b
commit
929820136a
@@ -0,0 +1,69 @@
|
||||
|
||||
############################################################################
|
||||
#
|
||||
# Copyright (c) 2021 Technology Innoavation Institute. All rights reserved.
|
||||
#
|
||||
# Redistribution and use in source and binary forms, with or without
|
||||
# modification, are permitted provided that the following conditions
|
||||
# are met:
|
||||
#
|
||||
# 1. Redistributions of source code must retain the above copyright
|
||||
# notice, this list of conditions and the following disclaimer.
|
||||
# 2. Redistributions in binary form must reproduce the above copyright
|
||||
# notice, this list of conditions and the following disclaimer in
|
||||
# the documentation and/or other materials provided with the
|
||||
# distribution.
|
||||
# 3. Neither the name PX4 nor the names of its contributors may be
|
||||
# used to endorse or promote products derived from this software
|
||||
# without specific prior written permission.
|
||||
#
|
||||
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
# COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
|
||||
# OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
|
||||
# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
# POSSIBILITY OF SUCH DAMAGE.
|
||||
#
|
||||
############################################################################
|
||||
|
||||
px4_add_library(keystore_backend stub_keystore.c)
|
||||
|
||||
target_include_directories(keystore_backend PUBLIC ${CMAKE_CURRENT_SOURCE_DIR})
|
||||
|
||||
if(DEFINED ENV{PUBLIC_KEY0})
|
||||
add_definitions(-DPUBLIC_KEY0=$ENV{PUBLIC_KEY0})
|
||||
endif()
|
||||
|
||||
if(DEFINED ENV{PUBLIC_KEY1})
|
||||
add_definitions(-DPUBLIC_KEY1=$ENV{PUBLIC_KEY1})
|
||||
endif()
|
||||
|
||||
if(DEFINED ENV{PUBLIC_KEY2})
|
||||
add_definitions(-DPUBLIC_KEY2=$ENV{PUBLIC_KEY2})
|
||||
endif()
|
||||
|
||||
if(DEFINED ENV{PUBLIC_KEY3})
|
||||
add_definitions(-DPUBLIC_KEY3=$ENV{PUBLIC_KEY3})
|
||||
endif()
|
||||
|
||||
if(DEFINED ENV{PUBLIC_KEY4})
|
||||
add_definitions(-DPUBLIC_KEY4=$ENV{PUBLIC_KEY4})
|
||||
endif()
|
||||
|
||||
if(DEFINED ENV{PUBLIC_KEY5})
|
||||
add_definitions(-DPUBLIC_KEY5=$ENV{PUBLIC_KEY5})
|
||||
endif()
|
||||
|
||||
if(DEFINED ENV{PUBLIC_KEY6})
|
||||
add_definitions(-DPUBLIC_KEY6=$ENV{PUBLIC_KEY6})
|
||||
endif()
|
||||
|
||||
if(DEFINED ENV{PUBLIC_KEY7})
|
||||
add_definitions(-DPUBLIC_KEY7=$ENV{PUBLIC_KEY7})
|
||||
endif()
|
||||
@@ -0,0 +1,6 @@
|
||||
menuconfig DRIVERS_STUB_KEYSTORE
|
||||
bool "stub_keystore"
|
||||
depends on DRIVERS_SW_CRYPTO
|
||||
default n
|
||||
---help---
|
||||
Enable support for stub_keystore
|
||||
@@ -0,0 +1,41 @@
|
||||
/****************************************************************************
|
||||
*
|
||||
* Copyright (c) 2021 Technology Innovation Institute. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
* 3. Neither the name PX4 nor the names of its contributors may be
|
||||
* used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
|
||||
* OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
|
||||
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
****************************************************************************/
|
||||
|
||||
#pragma once
|
||||
|
||||
typedef struct {
|
||||
int handle;
|
||||
} keystore_session_handle_t;
|
||||
|
||||
static inline void keystore_session_handle_init(keystore_session_handle_t *handle) {handle->handle = 0;}
|
||||
static inline bool keystore_session_handle_valid(keystore_session_handle_t handle) {return handle.handle > 0;}
|
||||
@@ -0,0 +1,113 @@
|
||||
/****************************************************************************
|
||||
*
|
||||
* Copyright (c) 2020 Technology Innovation Institute. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
* 3. Neither the name PX4 nor the names of its contributors may be
|
||||
* used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
|
||||
* OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
|
||||
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
****************************************************************************/
|
||||
|
||||
/**
|
||||
* @file public_key.h
|
||||
*
|
||||
* File holds public keys for signed firmware.
|
||||
*
|
||||
*
|
||||
*/
|
||||
|
||||
#pragma once
|
||||
|
||||
#define XSTR(x) #x
|
||||
#define STR(x) XSTR(x)
|
||||
|
||||
#ifndef PUBLIC_KEY0
|
||||
#error "At least one key (PUBLIC_KEY0) must be defined"
|
||||
#endif
|
||||
|
||||
typedef struct {
|
||||
const size_t key_size;
|
||||
const uint8_t *key;
|
||||
} persistent_key_t;
|
||||
|
||||
/* This constant only exists to calculate size of the
|
||||
key. It will be removed by the linker */
|
||||
static const uint8_t public_key0[] = {
|
||||
#include STR(PUBLIC_KEY0)
|
||||
};
|
||||
|
||||
#ifdef PUBLIC_KEY1
|
||||
|
||||
static const uint8_t public_key1[] = {
|
||||
#include STR(PUBLIC_KEY1)
|
||||
};
|
||||
#endif
|
||||
|
||||
#ifdef PUBLIC_KEY2
|
||||
static const uint8_t public_key2[] = {
|
||||
#include STR(PUBLIC_KEY2)
|
||||
};
|
||||
#endif
|
||||
|
||||
#ifdef PUBLIC_KEY3
|
||||
static const uint8_t public_key3[] = {
|
||||
#include STR(PUBLIC_KEY3)
|
||||
};
|
||||
#endif
|
||||
|
||||
|
||||
static const persistent_key_t public_keys[] = {
|
||||
{
|
||||
.key = public_key0,
|
||||
.key_size = sizeof(public_key0)
|
||||
}
|
||||
|
||||
#ifdef PUBLIC_KEY1
|
||||
,
|
||||
{
|
||||
.key = public_key1,
|
||||
.key_size = sizeof(public_key1)
|
||||
}
|
||||
#endif
|
||||
|
||||
#ifdef PUBLIC_KEY2
|
||||
,
|
||||
{
|
||||
.key = public_key2,
|
||||
.key_size = sizeof(public_key2)
|
||||
}
|
||||
#endif
|
||||
|
||||
#ifdef PUBLIC_KEY3
|
||||
{
|
||||
.key = public_key3,
|
||||
.key_size = sizeof(public_key3)
|
||||
}
|
||||
#endif
|
||||
|
||||
};
|
||||
|
||||
#define NPERSISTENT_KEYS (sizeof(public_keys) / sizeof(persistent_key_t))
|
||||
@@ -0,0 +1,84 @@
|
||||
/****************************************************************************
|
||||
*
|
||||
* Copyright (c) 2021 Technology Innovation Institute. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
* 3. Neither the name PX4 nor the names of its contributors may be
|
||||
* used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
|
||||
* OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
|
||||
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
****************************************************************************/
|
||||
|
||||
#include <px4_platform_common/crypto_algorithms.h>
|
||||
#include <string.h>
|
||||
#include <stdbool.h>
|
||||
#include "public_key.h"
|
||||
#include "keystore_backend_definitions.h"
|
||||
/*
|
||||
* For now, this is just a dummy up/down counter for tracking open/close calls
|
||||
*/
|
||||
static int keystore_open_count = 0;
|
||||
|
||||
void keystore_init(void)
|
||||
{
|
||||
}
|
||||
|
||||
keystore_session_handle_t keystore_open(void)
|
||||
{
|
||||
keystore_session_handle_t ret;
|
||||
ret.handle = ++keystore_open_count;
|
||||
return ret;
|
||||
}
|
||||
|
||||
void keystore_close(keystore_session_handle_t *handle)
|
||||
{
|
||||
keystore_open_count--;
|
||||
handle->handle = 0;
|
||||
}
|
||||
|
||||
size_t keystore_get_key(keystore_session_handle_t handle, uint8_t idx, uint8_t *key_buf, size_t key_buf_size)
|
||||
{
|
||||
size_t ret = 0;
|
||||
|
||||
if (idx < NPERSISTENT_KEYS) {
|
||||
ret = public_keys[idx].key_size;
|
||||
|
||||
if (key_buf) {
|
||||
if (key_buf_size >= ret) {
|
||||
memcpy(key_buf, public_keys[idx].key, ret);
|
||||
|
||||
} else {
|
||||
ret = 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
bool keystore_put_key(keystore_session_handle_t handle, uint8_t idx, uint8_t *key, size_t key_size)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
|
||||
############################################################################
|
||||
#
|
||||
# Copyright (c) 2021 Technology Innoavation Institute. All rights reserved.
|
||||
#
|
||||
# Redistribution and use in source and binary forms, with or without
|
||||
# modification, are permitted provided that the following conditions
|
||||
# are met:
|
||||
#
|
||||
# 1. Redistributions of source code must retain the above copyright
|
||||
# notice, this list of conditions and the following disclaimer.
|
||||
# 2. Redistributions in binary form must reproduce the above copyright
|
||||
# notice, this list of conditions and the following disclaimer in
|
||||
# the documentation and/or other materials provided with the
|
||||
# distribution.
|
||||
# 3. Neither the name PX4 nor the names of its contributors may be
|
||||
# used to endorse or promote products derived from this software
|
||||
# without specific prior written permission.
|
||||
#
|
||||
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
# COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
|
||||
# OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
|
||||
# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
# POSSIBILITY OF SUCH DAMAGE.
|
||||
#
|
||||
############################################################################
|
||||
|
||||
px4_add_library(crypto_backend crypto.c)
|
||||
|
||||
target_link_libraries(crypto_backend
|
||||
PUBLIC
|
||||
keystore_backend
|
||||
)
|
||||
|
||||
target_link_libraries(crypto_backend
|
||||
PRIVATE
|
||||
px4_random
|
||||
monocypher
|
||||
libtomcrypt
|
||||
)
|
||||
|
||||
target_include_directories(crypto_backend PUBLIC ${CMAKE_CURRENT_SOURCE_DIR})
|
||||
@@ -0,0 +1,6 @@
|
||||
menuconfig DRIVERS_SW_CRYPTO
|
||||
bool "sw_crypto"
|
||||
depends on BOARD_CRYPTO
|
||||
default n
|
||||
---help---
|
||||
Enable support for sw_crypto
|
||||
@@ -0,0 +1,432 @@
|
||||
/****************************************************************************
|
||||
*
|
||||
* Copyright (c) 2020 Technology Innovation Institute. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
* 3. Neither the name PX4 nor the names of its contributors may be
|
||||
* used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
|
||||
* OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
|
||||
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
****************************************************************************/
|
||||
|
||||
/**
|
||||
* @file crypto.c
|
||||
*
|
||||
* Wrapper for the monocypher crypto
|
||||
*
|
||||
*/
|
||||
|
||||
#include <inttypes.h>
|
||||
#include <stdbool.h>
|
||||
|
||||
#include <px4_platform_common/crypto_backend.h>
|
||||
#include <px4_random.h>
|
||||
#include <lib/crypto/monocypher/src/optional/monocypher-ed25519.h>
|
||||
#include <tomcrypt.h>
|
||||
|
||||
extern void libtomcrypt_init(void);
|
||||
|
||||
/* room for 16 keys */
|
||||
#define KEY_CACHE_LEN 16
|
||||
|
||||
#ifndef SECMEM_ALLOC
|
||||
#define SECMEM_ALLOC malloc
|
||||
#endif
|
||||
|
||||
#ifndef SECMEM_FREE
|
||||
#define SECMEM_FREE free
|
||||
#endif
|
||||
|
||||
/*
|
||||
* For now, this is just a dummy up/down counter for tracking open/close calls
|
||||
*/
|
||||
static int crypto_open_count = 0;
|
||||
|
||||
typedef struct {
|
||||
size_t key_size;
|
||||
uint8_t *key;
|
||||
} volatile_key_t;
|
||||
|
||||
static volatile_key_t key_cache[KEY_CACHE_LEN];
|
||||
|
||||
typedef struct {
|
||||
uint8_t nonce[24];
|
||||
uint64_t ctr;
|
||||
} chacha20_context_t;
|
||||
|
||||
/* Clear key cache */
|
||||
static void clear_key_cache(void)
|
||||
{
|
||||
for (int i = 0; i < KEY_CACHE_LEN ; i++) {
|
||||
SECMEM_FREE(key_cache[i].key);
|
||||
key_cache[i].key = NULL;
|
||||
key_cache[i].key_size = 0;
|
||||
}
|
||||
}
|
||||
|
||||
/* Retrieve a direct pointer to the cached temporary/public key */
|
||||
static const uint8_t *crypto_get_key_ptr(keystore_session_handle_t handle, uint8_t key_idx,
|
||||
size_t *len)
|
||||
{
|
||||
uint8_t *ret;
|
||||
|
||||
if (key_idx >= KEY_CACHE_LEN) {
|
||||
*len = 0;
|
||||
return NULL;
|
||||
}
|
||||
|
||||
ret = key_cache[key_idx].key;
|
||||
|
||||
/* if the key doesn't exist in the key cache, try to read it in there from keystore */
|
||||
if (ret == NULL) {
|
||||
|
||||
/* First check if the key exists in the keystore and retrieve its length */
|
||||
*len = keystore_get_key(handle, key_idx, NULL, 0);
|
||||
|
||||
if (*len > 0) {
|
||||
|
||||
/* Allocate memory for the key in the cache */
|
||||
ret = SECMEM_ALLOC(*len);
|
||||
|
||||
/* Retrieve the key from the keystore */
|
||||
if (ret) {
|
||||
if (keystore_get_key(handle, key_idx, ret, *len) > 0) {
|
||||
/* Success, store the key in cache */
|
||||
key_cache[key_idx].key_size = *len;
|
||||
key_cache[key_idx].key = ret;
|
||||
|
||||
} else {
|
||||
/* key retrieval failed, free the memory */
|
||||
SECMEM_FREE(ret);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
*len = key_cache[key_idx].key_size;
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
void crypto_init()
|
||||
{
|
||||
keystore_init();
|
||||
clear_key_cache();
|
||||
libtomcrypt_init();
|
||||
}
|
||||
|
||||
crypto_session_handle_t crypto_open(px4_crypto_algorithm_t algorithm)
|
||||
{
|
||||
crypto_session_handle_t ret;
|
||||
ret.keystore_handle = keystore_open();
|
||||
|
||||
if (keystore_session_handle_valid(ret.keystore_handle)) {
|
||||
ret.algorithm = algorithm;
|
||||
ret.handle = ++crypto_open_count;
|
||||
|
||||
} else {
|
||||
ret.handle = 0;
|
||||
ret.context = NULL;
|
||||
ret.algorithm = CRYPTO_NONE;
|
||||
return ret;
|
||||
}
|
||||
|
||||
switch (algorithm) {
|
||||
case CRYPTO_XCHACHA20: {
|
||||
chacha20_context_t *context = malloc(sizeof(chacha20_context_t));
|
||||
|
||||
if (!context) {
|
||||
ret.handle = 0;
|
||||
crypto_open_count--;
|
||||
|
||||
} else {
|
||||
ret.context = context;
|
||||
px4_get_secure_random(context->nonce, sizeof(context->nonce));
|
||||
context->ctr = 0;
|
||||
}
|
||||
}
|
||||
break;
|
||||
|
||||
default:
|
||||
ret.context = NULL;
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
void crypto_close(crypto_session_handle_t *handle)
|
||||
{
|
||||
|
||||
// Not open?
|
||||
if (!crypto_session_handle_valid(*handle)) {
|
||||
return;
|
||||
}
|
||||
|
||||
crypto_open_count--;
|
||||
handle->handle = 0;
|
||||
keystore_close(&handle->keystore_handle);
|
||||
free(handle->context);
|
||||
handle->context = NULL;
|
||||
}
|
||||
|
||||
bool crypto_signature_check(crypto_session_handle_t handle,
|
||||
uint8_t key_index,
|
||||
const uint8_t *signature,
|
||||
const uint8_t *message,
|
||||
size_t message_size)
|
||||
{
|
||||
bool ret = false;
|
||||
size_t keylen = 0;
|
||||
const uint8_t *public_key = NULL;
|
||||
|
||||
if (crypto_session_handle_valid(handle)) {
|
||||
public_key = crypto_get_key_ptr(handle.keystore_handle, key_index, &keylen);
|
||||
}
|
||||
|
||||
if (keylen == 0 || public_key == NULL) {
|
||||
return false;
|
||||
}
|
||||
|
||||
switch (handle.algorithm) {
|
||||
case CRYPTO_ED25519:
|
||||
ret = crypto_ed25519_check(signature, public_key, message, message_size) == 0;
|
||||
break;
|
||||
|
||||
default:
|
||||
ret = false;
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
bool crypto_encrypt_data(crypto_session_handle_t handle,
|
||||
uint8_t key_idx,
|
||||
const uint8_t *message,
|
||||
size_t message_size,
|
||||
uint8_t *cipher,
|
||||
size_t *cipher_size)
|
||||
{
|
||||
|
||||
bool ret = false;
|
||||
|
||||
if (!crypto_session_handle_valid(handle)) {
|
||||
return ret;
|
||||
}
|
||||
|
||||
switch (handle.algorithm) {
|
||||
case CRYPTO_NONE:
|
||||
if (*cipher_size >= message_size) {
|
||||
/* In-place there is no copy needed */
|
||||
if (message != cipher) {
|
||||
memcpy(cipher, message, message_size);
|
||||
}
|
||||
|
||||
*cipher_size = message_size;
|
||||
ret = true;
|
||||
}
|
||||
|
||||
break;
|
||||
|
||||
case CRYPTO_XCHACHA20: {
|
||||
size_t key_sz;
|
||||
uint8_t *key = (uint8_t *)crypto_get_key_ptr(handle.keystore_handle, key_idx, &key_sz);
|
||||
chacha20_context_t *context = handle.context;
|
||||
|
||||
if (key_sz == 32) {
|
||||
context->ctr = crypto_xchacha20_ctr(cipher, message, *cipher_size, key, context->nonce, context->ctr);
|
||||
ret = true;
|
||||
}
|
||||
}
|
||||
break;
|
||||
|
||||
case CRYPTO_RSA_OAEP: {
|
||||
rsa_key key;
|
||||
size_t key_sz;
|
||||
unsigned long outlen = *cipher_size;
|
||||
uint8_t *public_key = (uint8_t *)crypto_get_key_ptr(handle.keystore_handle, key_idx, &key_sz);
|
||||
*cipher_size = 0;
|
||||
|
||||
if (public_key &&
|
||||
rsa_import(public_key, key_sz, &key) == CRYPT_OK) {
|
||||
if (outlen >= ltc_mp.unsigned_size(key.N) &&
|
||||
pkcs_1_oaep_encode(message, message_size,
|
||||
NULL, 0,
|
||||
ltc_mp.count_bits(key.N),
|
||||
NULL,
|
||||
0, 0,
|
||||
cipher, &outlen) == CRYPT_OK &&
|
||||
ltc_mp.rsa_me(cipher, outlen, cipher, &outlen, PK_PUBLIC, &key) == CRYPT_OK) {
|
||||
*cipher_size = outlen;
|
||||
ret = true;
|
||||
|
||||
}
|
||||
|
||||
rsa_free(&key);
|
||||
}
|
||||
}
|
||||
break;
|
||||
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
bool crypto_generate_key(crypto_session_handle_t handle,
|
||||
uint8_t idx, bool persistent)
|
||||
{
|
||||
bool ret = false;
|
||||
|
||||
if (idx >= KEY_CACHE_LEN) {
|
||||
return false;
|
||||
}
|
||||
|
||||
switch (handle.algorithm) {
|
||||
case CRYPTO_XCHACHA20:
|
||||
if (key_cache[idx].key_size < 32) {
|
||||
if (key_cache[idx].key_size > 0) {
|
||||
SECMEM_FREE(key_cache[idx].key);
|
||||
key_cache[idx].key_size = 0;
|
||||
}
|
||||
|
||||
key_cache[idx].key = SECMEM_ALLOC(32);
|
||||
}
|
||||
|
||||
if (key_cache[idx].key) {
|
||||
key_cache[idx].key_size = 32;
|
||||
px4_get_secure_random(key_cache[idx].key, 32);
|
||||
ret = true;
|
||||
|
||||
} else {
|
||||
key_cache[idx].key_size = 0;
|
||||
}
|
||||
|
||||
break;
|
||||
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
if (ret && persistent) {
|
||||
keystore_put_key(handle.keystore_handle, idx, key_cache[idx].key, key_cache[idx].key_size);
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
bool crypto_get_encrypted_key(crypto_session_handle_t handle,
|
||||
uint8_t key_idx,
|
||||
uint8_t *key,
|
||||
size_t *max_len,
|
||||
uint8_t encryption_key_idx)
|
||||
{
|
||||
// Retrieve the plaintext key
|
||||
bool ret = true;
|
||||
size_t key_sz;
|
||||
const uint8_t *plain_key = crypto_get_key_ptr(handle.keystore_handle, key_idx, &key_sz);
|
||||
|
||||
if (key_sz == 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Encrypt it
|
||||
if (key != NULL) {
|
||||
ret = crypto_encrypt_data(handle,
|
||||
encryption_key_idx,
|
||||
plain_key,
|
||||
key_sz,
|
||||
key,
|
||||
max_len);
|
||||
|
||||
} else {
|
||||
// The key size, encrypted, is a multiple of minimum block size for the algorithm+key
|
||||
size_t min_block = crypto_get_min_blocksize(handle, encryption_key_idx);
|
||||
*max_len = key_sz / min_block * min_block;
|
||||
|
||||
if (key_sz % min_block) {
|
||||
*max_len += min_block;
|
||||
}
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
bool crypto_get_nonce(crypto_session_handle_t handle,
|
||||
uint8_t *nonce,
|
||||
size_t *nonce_len)
|
||||
{
|
||||
switch (handle.algorithm) {
|
||||
case CRYPTO_XCHACHA20: {
|
||||
chacha20_context_t *context = handle.context;
|
||||
|
||||
if (nonce != NULL && context != NULL) {
|
||||
memcpy(nonce, context->nonce, sizeof(context->nonce));
|
||||
}
|
||||
|
||||
*nonce_len = sizeof(context->nonce);
|
||||
}
|
||||
break;
|
||||
|
||||
default:
|
||||
*nonce_len = 0;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
size_t crypto_get_min_blocksize(crypto_session_handle_t handle, uint8_t key_idx)
|
||||
{
|
||||
size_t ret;
|
||||
|
||||
switch (handle.algorithm) {
|
||||
case CRYPTO_XCHACHA20:
|
||||
ret = 64;
|
||||
break;
|
||||
|
||||
case CRYPTO_RSA_OAEP: {
|
||||
rsa_key enc_key;
|
||||
unsigned pub_key_sz;
|
||||
uint8_t *pub_key = (uint8_t *)crypto_get_key_ptr(handle.keystore_handle, key_idx, &pub_key_sz);
|
||||
|
||||
if (pub_key &&
|
||||
rsa_import(pub_key, pub_key_sz, &enc_key) == CRYPT_OK) {
|
||||
ret = ltc_mp.unsigned_size(enc_key.N);
|
||||
rsa_free(&enc_key);
|
||||
|
||||
} else {
|
||||
ret = 0;
|
||||
}
|
||||
}
|
||||
break;
|
||||
|
||||
default:
|
||||
ret = 1;
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
/****************************************************************************
|
||||
*
|
||||
* Copyright (c) 2021 Technology Innovation Institute. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
* 3. Neither the name PX4 nor the names of its contributors may be
|
||||
* used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
|
||||
* OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
|
||||
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
****************************************************************************/
|
||||
|
||||
#pragma once
|
||||
|
||||
#include <stdbool.h>
|
||||
#include <keystore_backend_definitions.h>
|
||||
|
||||
typedef struct {
|
||||
int handle;
|
||||
px4_crypto_algorithm_t algorithm;
|
||||
keystore_session_handle_t keystore_handle;
|
||||
void *context;
|
||||
} crypto_session_handle_t;
|
||||
|
||||
static inline void crypto_session_handle_init(crypto_session_handle_t *handle) {handle->handle = 0;}
|
||||
static inline bool crypto_session_handle_valid(crypto_session_handle_t handle) {return handle.handle > 0 && keystore_session_handle_valid(handle.keystore_handle);}
|
||||
Reference in New Issue
Block a user