ra8_rsip_rsa.c

Go to the documentation of this file.

 
#include <stdint.h>
 
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "ra8_err.h"
#include "ra8_log.h"
#include "ra8_rsip.h"
#include "ra8_rsip_asym_internal.h"
#include "ra8_rsip_internal.h"
#include "ra8_rsip_regs.h"

static const char* s_tag = "RSIP";
 
/*
 * RSIP-E50D RSA (RSASSA sign / verify, RSAES-OAEP / PKCS1 encrypt / decrypt) is
 * NOT backed by a documented register interface on this silicon. HUM Ch 52
 * "Renesas Secure IP (RSIP-E50D)" is a six-page feature overview (p 3302-3307)
 * with no asymmetric command-register map; the vendor engine is driven through
 * an encrypted firmware mailbox, not the MMIO opcodes modelled below. The
 * command-path bodies here only round-trip the host register fake; they do
 * NOT compute a real RSASP1 / RFC 8017 result. They compile only under the
 * insecure-stub / off-target guard so a production image gets the fail-closed
 * #else and can never mistake these bytes for a valid RSA signature or
 * ciphertext. No plain-key RSA backend ships on this part; RSA (if ever needed)
 * is provided by tf-psa-crypto on the M85 (issues #214 + #187). The register
 * pokes below therefore carry NO HUM citation: there is no real register map to
 * cite.
 */
#if defined(RA8_INSECURE_STUB_CRYPTO) || defined(RA8_OFF_TARGET)
 
ra8_err_t ra8_rsip_rsa_sign(const ra8_rsip_key_handle_t* key,
                            ra8_rsip_rsa_size_t          size,
                            const uint8_t*               digest,
                            uint32_t                     digest_len,
                            uint8_t*                     signature)
{
  RA8_CHECK_NULL_PTR(key, s_tag, "key must not be nullptr");
  RA8_CHECK_NULL_PTR(digest, s_tag, "digest must not be nullptr");
  RA8_CHECK_NULL_PTR(signature, s_tag, "signature must not be nullptr");
  if ((size != k_ra8_rsip_rsa_1024) && (size != k_ra8_rsip_rsa_2048) &&
      (size != k_ra8_rsip_rsa_3072) && (size != k_ra8_rsip_rsa_4096)) {
    return k_ra8_err_invalid_arg;
  }
  priv_load_handle(key);
  *ra8_rsip_reg32(k_ra8_rsip_off_asym_rsa_size) = (uint32_t)size;
  internal_asym_push(k_ra8_rsip_off_asym_msg_in, digest, digest_len);
  *ra8_rsip_reg32(k_ra8_rsip_off_asym_ctrl) = k_ra8_rsip_asym_op_rsa_sign;
  *ra8_rsip_reg32(k_ra8_rsip_off_mbox_op)   = k_ra8_rsip_asym_op_rsa_sign;
 
  const ra8_err_t err = priv_complete(k_ra8_rsip_mask_isr_asym_done);
  if (err != k_ra8_ok) {
    return err;
  }
  const uint32_t sig_len = (uint32_t)size / k_ra8_rsip_byte_bits;
  internal_asym_pull(k_ra8_rsip_off_asym_sig_out, signature, sig_len);
  return k_ra8_ok;
}
 
ra8_err_t ra8_rsip_rsa_verify(const ra8_rsip_key_handle_t* key,
                              ra8_rsip_rsa_size_t          size,
                              const uint8_t*               digest,
                              uint32_t                     digest_len,
                              const uint8_t*               signature)
{
  RA8_CHECK_NULL_PTR(key, s_tag, "key must not be nullptr");
  RA8_CHECK_NULL_PTR(digest, s_tag, "digest must not be nullptr");
  RA8_CHECK_NULL_PTR(signature, s_tag, "signature must not be nullptr");
  if ((size != k_ra8_rsip_rsa_1024) && (size != k_ra8_rsip_rsa_2048) &&
      (size != k_ra8_rsip_rsa_3072) && (size != k_ra8_rsip_rsa_4096)) {
    return k_ra8_err_invalid_arg;
  }
  priv_load_handle(key);
  *ra8_rsip_reg32(k_ra8_rsip_off_asym_rsa_size) = (uint32_t)size;
  internal_asym_push(k_ra8_rsip_off_asym_msg_in, digest, digest_len);
  const uint32_t sig_len = (uint32_t)size / k_ra8_rsip_byte_bits;
  internal_asym_push(k_ra8_rsip_off_asym_sig_in, signature, sig_len);
  *ra8_rsip_reg32(k_ra8_rsip_off_asym_ctrl) = k_ra8_rsip_asym_op_rsa_verify;
  *ra8_rsip_reg32(k_ra8_rsip_off_mbox_op)   = k_ra8_rsip_asym_op_rsa_verify;
 
  return priv_complete(k_ra8_rsip_mask_isr_asym_done);
}

RA8_INTERNAL
static uint32_t internal_rsa_modulus_bytes(ra8_rsip_rsa_size_t size)
{
  switch (size) {
    case k_ra8_rsip_rsa_1024:
    case k_ra8_rsip_rsa_2048:
    case k_ra8_rsip_rsa_3072:
    case k_ra8_rsip_rsa_4096:
      return (uint32_t)size / (uint32_t)k_ra8_rsip_byte_bits;
    default:
      return 0U;
  }
}

RA8_INTERNAL
static bool internal_rsa_pad_ok(ra8_rsip_rsa_pad_t pad)
{
  switch (pad) {
    case k_ra8_rsip_rsa_pad_pkcs1:
    case k_ra8_rsip_rsa_pad_oaep:
      return true;
    default:
      return false;
  }
}

RA8_INTERNAL
static ra8_err_t internal_rsa_size_pad_check(ra8_rsip_rsa_size_t size,
                                             ra8_rsip_rsa_pad_t  pad,
                                             uint32_t*           modulus_bytes_out)
{
  const uint32_t modulus_bytes = internal_rsa_modulus_bytes(size);
  if (modulus_bytes == 0U) {
    return k_ra8_err_invalid_arg;
  }
  if (!internal_rsa_pad_ok(pad)) {
    return k_ra8_err_invalid_arg;
  }
  *modulus_bytes_out = modulus_bytes;
  return k_ra8_ok;
}

RA8_INTERNAL
static ra8_err_t internal_rsa_dispatch(const ra8_rsip_key_handle_t* key,
                                       ra8_rsip_rsa_size_t          size,
                                       ra8_rsip_rsa_pad_t           pad,
                                       const uint8_t*               in,
                                       uint32_t                     in_len,
                                       ra8_rsip_asym_op_t           op)
{
  priv_load_handle(key);
  *ra8_rsip_reg32(k_ra8_rsip_off_asym_rsa_size) = (uint32_t)size;
  *ra8_rsip_reg32(k_ra8_rsip_off_asym_arg)      = (uint32_t)pad;
  internal_asym_push(k_ra8_rsip_off_asym_msg_in, in, in_len);
  *ra8_rsip_reg32(k_ra8_rsip_off_asym_ctrl) = (uint32_t)op;
  *ra8_rsip_reg32(k_ra8_rsip_off_mbox_op)   = (uint32_t)op;
  return priv_complete(k_ra8_rsip_mask_isr_asym_done);
}
 
ra8_err_t ra8_rsip_rsa_encrypt(const ra8_rsip_key_handle_t* key,
                               ra8_rsip_rsa_size_t          size,
                               ra8_rsip_rsa_pad_t           pad,
                               const uint8_t*               plaintext,
                               uint32_t                     plaintext_len,
                               uint8_t*                     ciphertext)
{
  RA8_CHECK_NULL_PTR(key, s_tag, "key must not be nullptr");
  RA8_CHECK_NULL_PTR(plaintext, s_tag, "plaintext must not be nullptr");
  RA8_CHECK_NULL_PTR(ciphertext, s_tag, "ciphertext must not be nullptr");
  uint32_t        modulus_bytes = 0U;
  const ra8_err_t v_err         = internal_rsa_size_pad_check(size, pad, &modulus_bytes);
  if (v_err != k_ra8_ok) {
    return v_err;
  }
  if (plaintext_len == 0U) {
    return k_ra8_err_invalid_arg;
  }
  if (plaintext_len > modulus_bytes) {
    return k_ra8_err_invalid_arg;
  }
  const ra8_err_t err =
    internal_rsa_dispatch(key, size, pad, plaintext, plaintext_len, k_ra8_rsip_asym_op_rsa_encrypt);
  if (err != k_ra8_ok) {
    return err;
  }
  internal_asym_pull(k_ra8_rsip_off_asym_sig_out, ciphertext, modulus_bytes);
  return k_ra8_ok;
}
 
ra8_err_t ra8_rsip_rsa_decrypt(const ra8_rsip_key_handle_t* key,
                               ra8_rsip_rsa_size_t          size,
                               ra8_rsip_rsa_pad_t           pad,
                               const uint8_t*               ciphertext,
                               uint8_t*                     plaintext,
                               uint32_t                     plaintext_cap,
                               uint32_t*                    recovered_len)
{
  RA8_CHECK_NULL_PTR(key, s_tag, "key must not be nullptr");
  RA8_CHECK_NULL_PTR(ciphertext, s_tag, "ciphertext must not be nullptr");
  RA8_CHECK_NULL_PTR(plaintext, s_tag, "plaintext must not be nullptr");
  RA8_CHECK_NULL_PTR(recovered_len, s_tag, "recovered_len must not be nullptr");
  uint32_t        modulus_bytes = 0U;
  const ra8_err_t v_err         = internal_rsa_size_pad_check(size, pad, &modulus_bytes);
  if (v_err != k_ra8_ok) {
    return v_err;
  }
  const ra8_err_t err = internal_rsa_dispatch(key,
                                              size,
                                              pad,
                                              ciphertext,
                                              modulus_bytes,
                                              k_ra8_rsip_asym_op_rsa_decrypt);
  if (err != k_ra8_ok) {
    return err;
  }
  /* The engine writes the unpadded message length back into ASYM_ARG. */
  const uint32_t recovered = *ra8_rsip_reg32(k_ra8_rsip_off_asym_arg);
  if (recovered > plaintext_cap) {
    return k_ra8_err_invalid_arg;
  }
  internal_asym_pull(k_ra8_rsip_off_asym_sig_out, plaintext, recovered);
  *recovered_len = recovered;
  return k_ra8_ok;
}
 
#else /* production build: neither RA8_INSECURE_STUB_CRYPTO nor RA8_OFF_TARGET */
 
/*
 * Fail-closed production variant. With no real RSIP RSA backend on this
 * silicon, every RSASSA / RSAES entry point returns a hard error (never
 * k_ra8_ok) so a production image cannot mistake the fake command-path for
 * a valid RSA signature or ciphertext. Callers use tf-psa-crypto on the M85.
 */
 
ra8_err_t ra8_rsip_rsa_sign(const ra8_rsip_key_handle_t* key,
                            ra8_rsip_rsa_size_t          size,
                            const uint8_t*               digest,
                            uint32_t                     digest_len,
                            uint8_t*                     signature)
{
  RA8_CHECK_NULL_PTR(key, s_tag, "rsa_sign: key must not be nullptr");
  RA8_CHECK_NULL_PTR(signature, s_tag, "rsa_sign: signature must not be nullptr");
  (void)size;
  (void)digest;
  (void)digest_len;
  return k_ra8_err_not_supported;
}
 
ra8_err_t ra8_rsip_rsa_verify(const ra8_rsip_key_handle_t* key,
                              ra8_rsip_rsa_size_t          size,
                              const uint8_t*               digest,
                              uint32_t                     digest_len,
                              const uint8_t*               signature)
{
  RA8_CHECK_NULL_PTR(key, s_tag, "rsa_verify: key must not be nullptr");
  RA8_CHECK_NULL_PTR(signature, s_tag, "rsa_verify: signature must not be nullptr");
  (void)size;
  (void)digest;
  (void)digest_len;
  return k_ra8_err_not_supported;
}
 
ra8_err_t ra8_rsip_rsa_encrypt(const ra8_rsip_key_handle_t* key,
                               ra8_rsip_rsa_size_t          size,
                               ra8_rsip_rsa_pad_t           pad,
                               const uint8_t*               plaintext,
                               uint32_t                     plaintext_len,
                               uint8_t*                     ciphertext)
{
  RA8_CHECK_NULL_PTR(key, s_tag, "rsa_encrypt: key must not be nullptr");
  RA8_CHECK_NULL_PTR(ciphertext, s_tag, "rsa_encrypt: ciphertext must not be nullptr");
  (void)size;
  (void)pad;
  (void)plaintext;
  (void)plaintext_len;
  return k_ra8_err_not_supported;
}
 
ra8_err_t ra8_rsip_rsa_decrypt(const ra8_rsip_key_handle_t* key,
                               ra8_rsip_rsa_size_t          size,
                               ra8_rsip_rsa_pad_t           pad,
                               const uint8_t*               ciphertext,
                               uint8_t*                     plaintext,
                               uint32_t                     plaintext_cap,
                               uint32_t*                    recovered_len)
{
  RA8_CHECK_NULL_PTR(key, s_tag, "rsa_decrypt: key must not be nullptr");
  RA8_CHECK_NULL_PTR(plaintext, s_tag, "rsa_decrypt: plaintext must not be nullptr");
  RA8_CHECK_NULL_PTR(recovered_len, s_tag, "rsa_decrypt: recovered_len must not be nullptr");
  (void)size;
  (void)pad;
  (void)ciphertext;
  (void)plaintext_cap;
  return k_ra8_err_not_supported;
}
 
#endif /* RA8_INSECURE_STUB_CRYPTO || RA8_OFF_TARGET */