Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

use key type and key user as part of the internal keyId #22

Merged
merged 5 commits into from
Apr 24, 2024
Merged

use key type and key user as part of the internal keyId #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d288352
use key type and key user as part of the internal keyId
jpbland1 Apr 12, 2024
c97f70a
update based on PR comments
jpbland1 Apr 12, 2024
133aa3c
rebase and update mutual exclusion between multiple
jpbland1 Apr 19, 2024
a547c03
fix instance of user with client_id
jpbland1 Apr 22, 2024
0936dea
add set key function for rsa
jpbland1 Apr 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 13 additions & 9 deletions src/wh_client.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,10 +84,8 @@ int wh_Client_SendRequest(whClientContext* c,
if (c == NULL) {
return WH_ERROR_BADARGS;
}

rc = wh_CommClient_SendRequest(c->comm,
WH_COMM_MAGIC_NATIVE, kind, &req_id,
data_size, data);
rc = wh_CommClient_SendRequest(c->comm, WH_COMM_MAGIC_NATIVE, kind, &req_id,
data_size, data);
if (rc == 0) {
c->last_req_kind = kind;
c->last_req_id = req_id;
Expand Down Expand Up @@ -465,6 +463,7 @@ int wh_Client_KeyCacheRequest_ex(whClientContext* c, uint32_t flags,
uint8_t* packIn = (uint8_t*)(&packet->keyCacheReq + 1);
if (c == NULL || in == NULL || inSz == 0)
return WH_ERROR_BADARGS;
packet->keyCacheReq.id = keyId;
packet->keyCacheReq.flags = flags;
packet->keyCacheReq.sz = inSz;
if (label == NULL)
Expand All @@ -489,7 +488,7 @@ int wh_Client_KeyCacheRequest(whClientContext* c, uint32_t flags,
uint8_t* label, uint32_t labelSz, uint8_t* in, uint32_t inSz)
{
return wh_Client_KeyCacheRequest_ex(c, flags, label, labelSz, in, inSz,
WOLFHSM_ID_ERASED);
WOLFHSM_KEYID_ERASED);
}

int wh_Client_KeyCacheResponse(whClientContext* c, uint16_t* keyId)
Expand All @@ -514,7 +513,7 @@ int wh_Client_KeyCacheResponse(whClientContext* c, uint16_t* keyId)
int wh_Client_KeyEvictRequest(whClientContext* c, uint16_t keyId)
{
whPacket packet[1] = {0};
if (c == NULL || keyId == WOLFHSM_ID_ERASED)
if (c == NULL || keyId == WOLFHSM_KEYID_ERASED)
return WH_ERROR_BADARGS;
/* set the keyId */
packet->keyEvictReq.id = keyId;
Expand Down Expand Up @@ -544,7 +543,7 @@ int wh_Client_KeyEvictResponse(whClientContext* c)
int wh_Client_KeyExportRequest(whClientContext* c, uint16_t keyId)
{
whPacket packet[1] = {0};
if (c == NULL || keyId == WOLFHSM_ID_ERASED)
if (c == NULL || keyId == WOLFHSM_KEYID_ERASED)
return WH_ERROR_BADARGS;
/* set keyId */
packet->keyExportReq.id = keyId;
Expand Down Expand Up @@ -597,7 +596,7 @@ int wh_Client_KeyExportResponse(whClientContext* c, uint8_t* label,
int wh_Client_KeyCommitRequest(whClientContext* c, whNvmId keyId)
{
whPacket packet[1] = {0};
if (c == NULL || keyId == WOLFHSM_ID_ERASED)
if (c == NULL || keyId == WOLFHSM_KEYID_ERASED)
return WH_ERROR_BADARGS;
/* set keyId */
packet->keyCommitReq.id = keyId;
Expand Down Expand Up @@ -627,7 +626,7 @@ int wh_Client_KeyCommitResponse(whClientContext* c)
int wh_Client_KeyEraseRequest(whClientContext* c, whNvmId keyId)
{
whPacket packet[1] = {0};
if (c == NULL || keyId == WOLFHSM_ID_ERASED)
if (c == NULL || keyId == WOLFHSM_KEYID_ERASED)
return WH_ERROR_BADARGS;
/* set keyId */
packet->keyEraseReq.id = keyId;
Expand Down Expand Up @@ -658,4 +657,9 @@ void wh_Client_SetKeyCurve25519(curve25519_key* key, whNvmId keyId)
{
XMEMCPY(key->devCtx, (void*)&keyId, sizeof(keyId));
}

void wh_Client_SetKeyRsa(RsaKey* key, whNvmId keyId)
{
XMEMCPY(key->devCtx, (void*)&keyId, sizeof(keyId));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will likely not set the entire devCtx value since whNvmId is probably a smaller size than void*. Recommend to use uintptr_t to let the compiler promote the unsigned integer up to the proper size.

Like: key->devCtx = (void*) ((uintptr_t)keyId);

}
#endif /* WOLFHSM_NO_CRYPTO */
5 changes: 2 additions & 3 deletions src/wh_comm.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,9 +78,8 @@ int wh_CommClient_Init(whCommClient* context, const whCommClientConfig* config)
/* If a request buffer is available, send a new request to the server. The
* sequence number will be incremented on transport success.
*/
int wh_CommClient_SendRequest(whCommClient* context,
uint16_t magic, uint16_t kind, uint16_t *out_seq,
uint16_t data_size, const void* data)
int wh_CommClient_SendRequest(whCommClient* context, uint16_t magic,
uint16_t kind, uint16_t *out_seq, uint16_t data_size, const void* data)
{
int rc = WH_ERROR_NOTREADY;

Expand Down
3 changes: 2 additions & 1 deletion src/wh_server.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,7 +263,8 @@ int wh_Server_HandleRequestMessage(whServerContext* server)
break;

case WH_MESSAGE_GROUP_CRYPTO:
rc = wh_Server_HandleCryptoRequest(server, action, data, &size);
rc = wh_Server_HandleCryptoRequest(server, action, data,
&size);
break;
#endif /* WOLFHSM_NO_CRYPTO */

Expand Down
50 changes: 31 additions & 19 deletions src/wh_server_crypto.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,17 +22,17 @@
#include "wolfhsm/wh_server_crypto.h"

#ifndef NO_RSA
static int hsmCacheKeyRsa(whServerContext* server, RsaKey* key)
static int hsmCacheKeyRsa(whServerContext* server, RsaKey* key, whKeyId* outId)
{
int ret = 0;
int slotIdx = 0;
whKeyId keyId = 0;
whKeyId keyId = WOLFHSM_KEYTYPE_CRYPTO;
/* get a free slot */
ret = slotIdx = hsmCacheFindSlot(server);
if (ret >= 0) {
ret = keyId = hsmGetUniqueId(server);
ret = hsmGetUniqueId(server, &keyId);
}
if (ret > 0 ) {
if (ret == 0) {
/* export key */
/* TODO: Fix wolfCrypto to allow KeyToDer when KEY_GEN is NOT set */
ret = wc_RsaKeyToDer(key, server->cache[slotIdx].buffer,
Expand All @@ -45,7 +45,8 @@ static int hsmCacheKeyRsa(whServerContext* server, RsaKey* key)
server->cache[slotIdx].meta->id = keyId;
server->cache[slotIdx].meta->len = ret;
/* export keyId */
ret = keyId;
*outId = keyId;
ret = 0;
}
return ret;
}
Expand All @@ -56,6 +57,7 @@ static int hsmLoadKeyRsa(whServerContext* server, RsaKey* key, whKeyId keyId)
int slotIdx = 0;
uint32_t idx = 0;
uint32_t size;
keyId |= (WOLFHSM_KEYTYPE_CRYPTO | (server->comm->client_id << 8));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably should be a macro or function as I suspect we'll need this a lot.

/* freshen the key */
ret = slotIdx = hsmFreshenKey(server, keyId);
/* decode the key */
Expand All @@ -69,19 +71,20 @@ static int hsmLoadKeyRsa(whServerContext* server, RsaKey* key, whKeyId keyId)
#endif /* !NO_RSA */

#ifdef HAVE_CURVE25519
static int hsmCacheKeyCurve25519(whServerContext* server, curve25519_key* key)
static int hsmCacheKeyCurve25519(whServerContext* server, curve25519_key* key,
whKeyId* outId)
{
int ret;
int slotIdx = 0;
word32 privSz = CURVE25519_KEYSIZE;
word32 pubSz = CURVE25519_KEYSIZE;
whKeyId keyId = 0;
whKeyId keyId = WOLFHSM_KEYTYPE_CRYPTO;
/* get a free slot */
ret = slotIdx = hsmCacheFindSlot(server);
if (ret >= 0) {
ret = keyId = hsmGetUniqueId(server);
ret = hsmGetUniqueId(server, &keyId);
}
if (ret > 0) {
if (ret == 0) {
/* export key */
ret = wc_curve25519_export_key_raw(key,
server->cache[slotIdx].buffer + CURVE25519_KEYSIZE, &privSz,
Expand All @@ -94,7 +97,8 @@ static int hsmCacheKeyCurve25519(whServerContext* server, curve25519_key* key)
server->cache[slotIdx].meta->id = keyId;
server->cache[slotIdx].meta->len = CURVE25519_KEYSIZE * 2;
/* export keyId */
ret = keyId;
*outId = keyId;
ret = 0;
}
return ret;
}
Expand All @@ -106,6 +110,7 @@ static int hsmLoadKeyCurve25519(whServerContext* server, curve25519_key* key,
int slotIdx = 0;
uint32_t privSz = CURVE25519_KEYSIZE;
uint32_t pubSz = CURVE25519_KEYSIZE;
keyId |= WOLFHSM_KEYTYPE_CRYPTO;
/* freshen the key */
ret = slotIdx = hsmFreshenKey(server, keyId);
/* decode the key */
Expand All @@ -128,6 +133,7 @@ int wh_Server_HandleCryptoRequest(whServerContext* server,
int ret = 0;
uint32_t field;
uint8_t* in;
whKeyId keyId;
uint8_t* out;
whPacket* packet = (whPacket*)data;
#ifdef WOLFHSM_SYMMETRIC_INTERNAL
Expand Down Expand Up @@ -156,12 +162,13 @@ int wh_Server_HandleCryptoRequest(whServerContext* server,
}
/* cache the generated key, data will be blown away */
if (ret == 0) {
ret = hsmCacheKeyRsa(server, server->crypto->rsa);
ret = hsmCacheKeyRsa(server, server->crypto->rsa, &keyId);
}
wc_FreeRsaKey(server->crypto->rsa);
if (ret > 0) {
if (ret == 0) {
/* set the assigned id */
packet->pkRsakgRes.keyId = ret;
packet->pkRsakgRes.keyId =
(keyId & ~WOLFHSM_KEYUSER_MASK);
*size = WOLFHSM_PACKET_STUB_SIZE +
sizeof(packet->pkRsakgRes);
ret = 0;
Expand Down Expand Up @@ -241,15 +248,16 @@ int wh_Server_HandleCryptoRequest(whServerContext* server,
/* cache the generated key */
if (ret == 0) {
ret = hsmCacheKeyCurve25519(server,
server->crypto->curve25519Private);
server->crypto->curve25519Private, &keyId);
}
/* set the assigned id */
wc_curve25519_free(server->crypto->curve25519Private);
if (ret > 0) {
packet->pkCurve25519kgRes.keyId = ret;
if (ret == 0) {
/* strip client_id */
packet->pkCurve25519kgRes.keyId =
(keyId & ~WOLFHSM_KEYUSER_MASK);
*size = WOLFHSM_PACKET_STUB_SIZE +
sizeof(packet->pkCurve25519kgRes);
ret = 0;
}
else
ret = BAD_FUNC_ARG;
Expand All @@ -268,13 +276,17 @@ int wh_Server_HandleCryptoRequest(whServerContext* server,
if (ret == 0) {
ret = hsmLoadKeyCurve25519(server,
server->crypto->curve25519Private,
packet->pkCurve25519Req.privateKeyId);
MAKE_WOLFHSM_KEYID(WOLFHSM_KEYTYPE_CRYPTO,
server->comm->client_id,
packet->pkCurve25519Req.privateKeyId));
}
/* load the public key */
if (ret == 0) {
ret = hsmLoadKeyCurve25519(server,
server->crypto->curve25519Public,
packet->pkEcdhReq.publicKeyId);
MAKE_WOLFHSM_KEYID(WOLFHSM_KEYTYPE_CRYPTO,
server->comm->client_id,
packet->pkCurve25519Req.publicKeyId));
}
/* make shared secret */
if (ret == 0) {
Expand Down
Loading