ra8_rsip_protected.c

Go to the documentation of this file.

 
#include "ra8_rsip_protected.h"
 
#include <stdint.h>
 
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "ra8_err.h"
#include "ra8_log.h"
#include "ra8_rsip.h"
#include "ra8_rsip_key_injection.h"
#include "ra8_rsip_regs.h"
#include "ra8_stack_budget.h"

static const char* s_tag = "RSIP_P";

typedef enum : uint16_t {
  k_rsa_1024_mod_bytes       = 128U, 
  k_rsa_2048_mod_bytes       = 256U, 
  k_rsa_3072_mod_bytes       = 384U, 
  k_rsa_4096_mod_bytes       = 512U, 
  k_ecc_secp256_priv_bytes   = 32U,  
  k_ecc_secp384r1_priv_bytes = 48U,  
  k_ecc_secp521r1_priv_bytes = 66U,  
} rsip_prot_size_t;

typedef enum : uint16_t {
  k_unwrap_key_stack_bytes   = 1128U, 
  k_rsa4096_priv_stack_bytes = 1720U, 
  k_ecc_priv_stack_bytes     = 1104U, 
} rsip_prot_stack_t;

typedef enum : uint32_t {
  k_ra8_rsip_p_off_payload = 20U, 
} ra8_rsip_p_layout_t;

typedef enum : uint32_t {
  k_ra8_rsip_p_aes_max_bytes = 32U, 
  k_ra8_rsip_p_iv_bytes      = 16U, 
  k_ra8_rsip_p_bits_per_byte = 8U,  
  k_ra8_rsip_p_aes128_bytes  = 16U, 
  k_ra8_rsip_p_aes192_bytes  = 24U, 
  k_ra8_rsip_p_aes256_bytes  = 32U, 
  k_ra8_rsip_p_rsa_e_bytes   = 4U,  
} ra8_rsip_p_const_t;

static ra8_rsip_key_handle_t s_p_aes_handle;

static uint8_t s_p_aes_iv[k_ra8_rsip_p_iv_bytes];

static bool s_p_aes_iv_set;

static ra8_rsip_aes_mode_t s_p_aes_mode;

static bool s_p_aes_active;

RA8_INTERNAL
RA8_INTERNAL static void internal_p_scrub(uint8_t* buf, uint32_t n)
{
  for (uint32_t i = 0U; i < n; ++i) {
    buf[i] = 0U;
  }
}

RA8_INTERNAL
RA8_INTERNAL static ra8_err_t internal_p_aes_install(const uint8_t*          raw_key,
                                                     ra8_rsip_aes_key_bits_t key_bits,
                                                     ra8_rsip_key_handle_t*  out)
{
  switch (key_bits) {
    case k_ra8_rsip_aes_key_bits_128:
      return ra8_rsip_aes128_install_plain(raw_key, out);
    case k_ra8_rsip_aes_key_bits_192:
      return ra8_rsip_aes192_install_plain(raw_key, out);
    case k_ra8_rsip_aes_key_bits_256:
      return ra8_rsip_aes256_install_plain(raw_key, out);
    default:
      return k_ra8_err_invalid_arg;
  }
}
 
ra8_err_t ra8_rsip_protected_aes_init(const uint8_t*          wrapped_key,
                                      ra8_rsip_aes_key_bits_t key_bits,
                                      ra8_rsip_aes_mode_t     mode,
                                      const uint8_t*          iv)
{
  RA8_STACK_BUDGET(k_unwrap_key_stack_bytes); /* unwrapped-key scratch; scrubbed on unwind */
  RA8_CHECK_NULL_PTR(wrapped_key, s_tag, "p_aes_init: wrapped_key");
 
  ra8_err_t rc = ra8_rsip_key_validate(wrapped_key, k_ra8_rsip_wrapped_type_aes);
  if (rc != k_ra8_ok) {
    return rc;
  }
 
  uint8_t        raw_key[k_ra8_rsip_p_aes_max_bytes] = {};
  const uint32_t n_bytes = (uint32_t)key_bits / (uint32_t)k_ra8_rsip_p_bits_per_byte;
  if (n_bytes > (uint32_t)k_ra8_rsip_p_aes_max_bytes) {
    return k_ra8_err_invalid_arg;
  }
  for (uint32_t i = 0U; i < n_bytes; ++i) {
    raw_key[i] = wrapped_key[(uint32_t)k_ra8_rsip_p_off_payload + i];
  }
 
  ra8_rsip_key_handle_t handle = {};
  rc                           = internal_p_aes_install(raw_key, key_bits, &handle);
  internal_p_scrub(raw_key, n_bytes);
  if (rc != k_ra8_ok) {
    return rc;
  }
 
  s_p_aes_handle = handle;
  s_p_aes_mode   = mode;
  s_p_aes_iv_set = (iv != nullptr);
  if (s_p_aes_iv_set) {
    for (uint32_t i = 0U; i < (uint32_t)k_ra8_rsip_p_iv_bytes; ++i) {
      s_p_aes_iv[i] = iv[i];
    }
  } else {
    internal_p_scrub(s_p_aes_iv, (uint32_t)k_ra8_rsip_p_iv_bytes);
  }
  s_p_aes_active = true;
  return k_ra8_ok;
}
 
ra8_err_t
ra8_rsip_protected_aes_encrypt(const uint8_t* plaintext, uint8_t* ciphertext, uint32_t len)
{
  if (!s_p_aes_active) {
    return k_ra8_err_invalid_state;
  }
  RA8_CHECK_NULL_PTR(plaintext, s_tag, "p_aes_encrypt: plaintext");
  RA8_CHECK_NULL_PTR(ciphertext, s_tag, "p_aes_encrypt: ciphertext");
  return ra8_rsip_aes_cipher(&s_p_aes_handle,
                             s_p_aes_mode,
                             k_ra8_rsip_dir_encrypt,
                             s_p_aes_iv_set ? s_p_aes_iv : nullptr,
                             plaintext,
                             ciphertext,
                             len);
}
 
ra8_err_t
ra8_rsip_protected_aes_decrypt(const uint8_t* ciphertext, uint8_t* plaintext, uint32_t len)
{
  if (!s_p_aes_active) {
    return k_ra8_err_invalid_state;
  }
  RA8_CHECK_NULL_PTR(ciphertext, s_tag, "p_aes_decrypt: ciphertext");
  RA8_CHECK_NULL_PTR(plaintext, s_tag, "p_aes_decrypt: plaintext");
  return ra8_rsip_aes_cipher(&s_p_aes_handle,
                             s_p_aes_mode,
                             k_ra8_rsip_dir_decrypt,
                             s_p_aes_iv_set ? s_p_aes_iv : nullptr,
                             ciphertext,
                             plaintext,
                             len);
}
 
ra8_err_t ra8_rsip_protected_aes_finish(void)
{
  if (!s_p_aes_active) {
    return k_ra8_err_invalid_state;
  }
  uint8_t* h = (uint8_t*)&s_p_aes_handle;
  internal_p_scrub(h, (uint32_t)sizeof(s_p_aes_handle));
  internal_p_scrub(s_p_aes_iv, (uint32_t)k_ra8_rsip_p_iv_bytes);
  s_p_aes_iv_set = false;
  s_p_aes_active = false;
  return k_ra8_ok;
}

RA8_INTERNAL
static ra8_err_t internal_rsa_mod_bytes(ra8_rsip_rsa_size_t size, uint32_t* out_bytes)
{
  switch (size) {
    case k_ra8_rsip_rsa_1024:
      *out_bytes = k_rsa_1024_mod_bytes;
      return k_ra8_ok;
    case k_ra8_rsip_rsa_2048:
      *out_bytes = k_rsa_2048_mod_bytes;
      return k_ra8_ok;
    case k_ra8_rsip_rsa_3072:
      *out_bytes = k_rsa_3072_mod_bytes;
      return k_ra8_ok;
    case k_ra8_rsip_rsa_4096:
      *out_bytes = k_rsa_4096_mod_bytes;
      return k_ra8_ok;
    default:
      return k_ra8_err_invalid_arg;
  }
}

RA8_INTERNAL
static ra8_rsip_oem_cmd_t internal_rsa_install_cmd(ra8_rsip_rsa_size_t size)
{
  if (size == k_ra8_rsip_rsa_2048) {
    return k_ra8_rsip_oem_cmd_rsa2048_priv;
  }
  if (size == k_ra8_rsip_rsa_3072) {
    return k_ra8_rsip_oem_cmd_rsa3072_priv;
  }
  if (size == k_ra8_rsip_rsa_4096) {
    return k_ra8_rsip_oem_cmd_rsa4096_priv;
  }
  return k_ra8_rsip_oem_cmd_invalid;
}

RA8_INTERNAL
static ra8_err_t internal_rsa_validate_wrapped(const uint8_t* wrapped_priv)
{
  const ra8_err_t rc = ra8_rsip_key_validate(wrapped_priv, k_ra8_rsip_wrapped_type_rsa_pub);
  if (rc == k_ra8_ok) {
    return k_ra8_ok;
  }
  return ra8_rsip_key_validate(wrapped_priv, k_ra8_rsip_wrapped_type_rsa_priv);
}

RA8_INTERNAL
static ra8_err_t internal_rsa_install_priv(const uint8_t*         wrapped_priv,
                                           ra8_rsip_rsa_size_t    size,
                                           uint32_t               mod_bytes,
                                           ra8_rsip_key_handle_t* out_handle)
{
  uint8_t modulus[k_ra8_rsip_wrapped_max_payload] = {};
  for (uint32_t i = 0U; i < mod_bytes; ++i) {
    modulus[i] = wrapped_priv[(uint32_t)k_ra8_rsip_p_off_payload + i];
  }
  /* Use the OEM install path for RSA private keys: the wrapped layout
   * fed in here is already the engine-acceptable blob plus a 16-byte
   * IV that the stub validates trivially. */
  uint8_t                  install_iv[k_ra8_rsip_p_iv_bytes] = {};
  const ra8_rsip_oem_cmd_t install_cmd                       = internal_rsa_install_cmd(size);
  const ra8_err_t          rc =
    ra8_rsip_oem_install(install_cmd, install_iv, modulus, mod_bytes, out_handle);
  internal_p_scrub(modulus, mod_bytes);
  return rc;
}
 
ra8_err_t ra8_rsip_protected_rsa_decrypt(const uint8_t*      wrapped_priv,
                                         ra8_rsip_rsa_size_t size,
                                         const uint8_t*      ciphertext,
                                         uint32_t            ciphertext_len,
                                         uint8_t*            plaintext_out,
                                         uint32_t            plaintext_cap)
{
  RA8_STACK_BUDGET(k_rsa4096_priv_stack_bytes); /* RSA-4096 modulus scratch; scrubbed on unwind */
  RA8_CHECK_NULL_PTR(wrapped_priv, s_tag, "p_rsa_decrypt: wrapped_priv");
  RA8_CHECK_NULL_PTR(ciphertext, s_tag, "p_rsa_decrypt: ciphertext");
  RA8_CHECK_NULL_PTR(plaintext_out, s_tag, "p_rsa_decrypt: plaintext_out");
 
  ra8_err_t rc = internal_rsa_validate_wrapped(wrapped_priv);
  if (rc != k_ra8_ok) {
    return rc;
  }
 
  uint32_t mod_bytes = 0U;
  rc                 = internal_rsa_mod_bytes(size, &mod_bytes);
  if (rc != k_ra8_ok) {
    return rc;
  }
  if (plaintext_cap < mod_bytes) {
    return k_ra8_err_invalid_arg;
  }
  if (ciphertext_len > mod_bytes) {
    return k_ra8_err_invalid_arg;
  }
 
  ra8_rsip_key_handle_t handle = {};
  rc                           = internal_rsa_install_priv(wrapped_priv, size, mod_bytes, &handle);
  if (rc != k_ra8_ok) {
    return rc;
  }
 
  /* RSA "private decrypt" maps onto ra8_rsip_rsa_sign in the stub --
   * both drive the engine's modular-exponentiation path. */
  return ra8_rsip_rsa_sign(&handle, size, ciphertext, ciphertext_len, plaintext_out);
}

RA8_INTERNAL
static ra8_err_t
internal_ecc_priv_params(ra8_rsip_curve_t curve, uint32_t* out_alg, uint32_t* out_priv_bytes)
{
  switch (curve) {
    case k_ra8_rsip_curve_secp256r1:
      *out_alg        = (uint32_t)k_ra8_rsip_oem_cmd_ecc_secp256r1_priv;
      *out_priv_bytes = (uint32_t)k_ecc_secp256_priv_bytes;
      return k_ra8_ok;
    case k_ra8_rsip_curve_secp384r1:
      *out_alg        = (uint32_t)k_ra8_rsip_oem_cmd_ecc_secp384r1_priv;
      *out_priv_bytes = (uint32_t)k_ecc_secp384r1_priv_bytes;
      return k_ra8_ok;
    case k_ra8_rsip_curve_secp521r1:
      *out_alg        = (uint32_t)k_ra8_rsip_oem_cmd_ecc_secp521r1_priv;
      *out_priv_bytes = (uint32_t)k_ecc_secp521r1_priv_bytes;
      return k_ra8_ok;
    case k_ra8_rsip_curve_secp256k1:
      *out_alg        = (uint32_t)k_ra8_rsip_oem_cmd_ecc_secp256k1_priv;
      *out_priv_bytes = (uint32_t)k_ecc_secp256_priv_bytes;
      return k_ra8_ok;
    default:
      return k_ra8_err_invalid_arg;
  }
}
 
ra8_err_t ra8_rsip_protected_ecdsa_sign(const uint8_t*   wrapped_priv,
                                        ra8_rsip_curve_t curve,
                                        const uint8_t*   hash,
                                        uint32_t         hash_len,
                                        uint8_t*         sig_out)
{
  RA8_STACK_BUDGET(k_ecc_priv_stack_bytes); /* ECC private scalar scratch; scrubbed on unwind */
  RA8_CHECK_NULL_PTR(wrapped_priv, s_tag, "p_ecdsa_sign: wrapped_priv");
  RA8_CHECK_NULL_PTR(hash, s_tag, "p_ecdsa_sign: hash");
  RA8_CHECK_NULL_PTR(sig_out, s_tag, "p_ecdsa_sign: sig_out");
 
  ra8_err_t rc = ra8_rsip_key_validate(wrapped_priv, k_ra8_rsip_wrapped_type_ecc_priv);
  if (rc != k_ra8_ok) {
    return rc;
  }
 
  /* Build a minimal ECC private handle for the engine. The stub's
   * ``ra8_rsip_ecdsa_sign`` routes through ``internal_asym_run`` which
   * just needs a non-NULL handle whose ``alg`` carries an ECC opcode;
   * the wrapped body holds the private scalar bytes copied from the
   * payload. */
  ra8_rsip_key_handle_t handle     = {};
  uint32_t              priv_bytes = 0U;
  rc                               = internal_ecc_priv_params(curve, &handle.alg, &priv_bytes);
  if (rc != k_ra8_ok) {
    return rc;
  }
  handle.body_words = priv_bytes / sizeof(uint32_t);
 
  /* Copy the private scalar into the handle body word-aligned. */
  for (uint32_t i = 0U; i < priv_bytes; ++i) {
    ((uint8_t*)handle.body)[i] = wrapped_priv[(uint32_t)k_ra8_rsip_p_off_payload + i];
  }
 
  rc = ra8_rsip_ecdsa_sign(&handle, curve, hash, hash_len, sig_out);
  internal_p_scrub((uint8_t*)handle.body, priv_bytes);
  return rc;
}