response.rs

// Copyright 2025
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
use crate::cert_store::MAX_CERT_SLOTS_SUPPORTED;
use crate::codec::{Codec, MessageBuf};
use crate::commands::algorithms::selected_measurement_specification;
use crate::commands::challenge::{ChallengeAuthRspBase, ChallengeReq, MeasurementSummaryHashType};
use crate::commands::digests::compute_cert_chain_hash;
use crate::commands::error::ErrorCode;
use crate::context::SpdmContext;
use crate::error::{CommandError, CommandResult, PlatformError};
use crate::platform::hash::SpdmHashAlgoType;
use crate::protocol::*;
use crate::state::ConnectionState;
use crate::transcript::TranscriptContext;

fn process_challenge<'a>(
    ctx: &mut SpdmContext<'a>,
    spdm_hdr: SpdmMsgHdr,
    req_payload: &mut MessageBuf<'a>,
) -> CommandResult<(u8, MeasurementSummaryHashType, Option<RequesterContext>)> {
    // Validate the version
    let connection_version = ctx.state.connection_info.version_number();
    if spdm_hdr.version().ok() != Some(connection_version) {
        Err(ctx.generate_error_response(req_payload, ErrorCode::VersionMismatch, 0, None))?;
    }

    // Make sure the selected hash algorithm is SHA384
    ctx.verify_selected_hash_algo()
        .map_err(|_| ctx.generate_error_response(req_payload, ErrorCode::Unspecified, 0, None))?;

    // Decode the CHALLENGE request payload
    let challenge_req = ChallengeReq::decode(req_payload).map_err(|_| {
        ctx.generate_error_response(req_payload, ErrorCode::InvalidRequest, 0, None)
    })?;

    let mut requester_context = None;

    if connection_version >= SpdmVersion::V13 {
        // Decode the RequesterContext if present
        requester_context = Some(RequesterContext::decode(req_payload).map_err(|_| {
            ctx.generate_error_response(req_payload, ErrorCode::InvalidRequest, 0, None)
        })?);
    }

    if challenge_req.slot_id > 0 && selected_measurement_specification(ctx).0 == 0 {
        Err(ctx.generate_error_response(req_payload, ErrorCode::InvalidRequest, 0, None))?;
    }

    // Note: Pubkey of the responder will not be pre-provisioned to Requester. So slot ID 0xFF is invalid.
    if challenge_req.slot_id >= MAX_CERT_SLOTS_SUPPORTED
        || !ctx.device_certs_store.is_provisioned(challenge_req.slot_id)
    {
        Err(ctx.generate_error_response(req_payload, ErrorCode::InvalidRequest, 0, None))?;
    }

    // If multi-key connection response is supported, validate the key supports challenge usage
    if connection_version >= SpdmVersion::V13 && ctx.state.connection_info.multi_key_conn_rsp() {
        match ctx.device_certs_store.key_usage_mask(challenge_req.slot_id) {
            Some(key_usage_mask) if key_usage_mask.challenge_usage() != 0 => {}
            _ => Err(ctx.generate_error_response(req_payload, ErrorCode::InvalidRequest, 0, None))?,
        }
    }

    // Append the CHALLENGE request to the M1 transcript
    ctx.append_message_to_transcript(req_payload, TranscriptContext::M1)?;

    let meas_hash_type = MeasurementSummaryHashType::try_from(challenge_req.measurement_hash_type)
        .map_err(|_| {
            ctx.generate_error_response(req_payload, ErrorCode::InvalidRequest, 0, None)
        })?;

    Ok((challenge_req.slot_id, meas_hash_type, requester_context))
}

fn encode_m1_signature<'a>(
    ctx: &mut SpdmContext<'a>,
    slot_id: u8,
    asym_algo: AsymAlgo,
    rsp: &mut MessageBuf<'a>,
) -> CommandResult<usize> {
    let spdm_version = ctx.state.connection_info.version_number();

    // Get the M1 transcript hash
    let mut m1_transcript_hash = [0u8; SHA384_HASH_SIZE];
    ctx.transcript_mgr
        .hash(TranscriptContext::M1, &mut m1_transcript_hash)
        .map_err(|e| (false, CommandError::Transcript(e)))?;

    let signing_context = if spdm_version >= SpdmVersion::V12 {
        Some(
            create_responder_signing_context(spdm_version, ReqRespCode::ChallengeAuth)
                .map_err(|e| (false, CommandError::SignCtx(e)))?,
        )
    } else {
        None
    };

    let context = signing_context.as_ref().map(|x| &x[..]);

    let tbs = if let Some(context) = context {
        // If the signing context is present, use it to compute the TBS hash
        let mut tbs = [0u8; SHA384_HASH_SIZE];
        let mut message = [0u8; SPDM_SIGNING_CONTEXT_LEN + SHA384_HASH_SIZE];
        message[..SPDM_SIGNING_CONTEXT_LEN].copy_from_slice(context);
        message[SPDM_SIGNING_CONTEXT_LEN..]
            .copy_from_slice(&m1_transcript_hash[..SHA384_HASH_SIZE]);
        ctx.hash
            .init(SpdmHashAlgoType::SHA384, Some(&message[..]))
            .map_err(|e| (false, CommandError::Platform(PlatformError::HashError(e))))?;
        ctx.hash
            .finalize(&mut tbs)
            .map_err(|e| (false, CommandError::Platform(PlatformError::HashError(e))))?;
        tbs
    } else {
        m1_transcript_hash
    };

    let mut signature = [0u8; ECC_P384_SIGNATURE_SIZE];

    ctx.device_certs_store
        .sign_hash(slot_id, &tbs, &mut signature)
        .map_err(|e| (false, CommandError::CertStore(e)))?;

    // Encode the signature
    let sig_len = asym_algo.signature_size();
    rsp.put_data(sig_len)
        .map_err(|e| (false, CommandError::Codec(e)))?;
    let sig_buf = rsp
        .data_mut(sig_len)
        .map_err(|e| (false, CommandError::Codec(e)))?;
    sig_buf.copy_from_slice(&signature[..sig_len]);
    rsp.pull_data(sig_len)
        .map_err(|e| (false, CommandError::Codec(e)))?;

    Ok(sig_len)
}

fn encode_challenge_auth_rsp_base<'a>(
    ctx: &mut SpdmContext<'a>,
    slot_id: u8,
    asym_algo: AsymAlgo,
    rsp: &mut MessageBuf<'a>,
) -> CommandResult<usize> {
    let mut challenge_auth_rsp = ChallengeAuthRspBase::new(slot_id);

    // Get the certificate chain hash
    compute_cert_chain_hash(
        ctx.hash,
        slot_id,
        ctx.device_certs_store,
        asym_algo,
        &mut challenge_auth_rsp.cert_chain_hash,
    )?;

    // Get the nonce
    ctx.rng
        .generate_random_number(&mut challenge_auth_rsp.nonce)
        .map_err(|e| (false, CommandError::Platform(PlatformError::RngError(e))))?;

    // Encode the response
    challenge_auth_rsp
        .encode(rsp)
        .map_err(|e| (false, CommandError::Codec(e)))
}

fn encode_measurement_summary_hash<'a>(
    ctx: &mut SpdmContext<'a>,
    asym_algo: AsymAlgo,
    meas_summary_hash_type: MeasurementSummaryHashType,
    rsp: &mut MessageBuf<'a>,
) -> CommandResult<usize> {
    let mut meas_summary_hash = [0u8; SHA384_HASH_SIZE];
    ctx.measurements
        .measurement_summary_hash(
            ctx.evidence,
            ctx.hash,
            asym_algo,
            meas_summary_hash_type,
            &mut meas_summary_hash,
        )
        .map_err(|e| (false, CommandError::Measurement(e)))?;

    let hash_len = meas_summary_hash.len();
    rsp.put_data(hash_len)
        .map_err(|e| (false, CommandError::Codec(e)))?;
    let hash_buf = rsp
        .data_mut(hash_len)
        .map_err(|e| (false, CommandError::Codec(e)))?;
    hash_buf.copy_from_slice(&meas_summary_hash[..hash_len]);
    rsp.pull_data(hash_len)
        .map_err(|e| (false, CommandError::Codec(e)))?;

    Ok(hash_len)
}

fn encode_opaque_data(rsp: &mut MessageBuf<'_>) -> CommandResult<usize> {
    let len = size_of::<u16>();
    rsp.put_data(len)
        .map_err(|e| (false, CommandError::Codec(e)))?;
    rsp.pull_data(len)
        .map_err(|e| (false, CommandError::Codec(e)))?;

    Ok(len)
}

fn generate_challenge_auth_response<'a>(
    ctx: &mut SpdmContext<'a>,
    slot_id: u8,
    meas_summary_hash_type: MeasurementSummaryHashType,
    requester_context: Option<RequesterContext>,
    rsp: &mut MessageBuf<'a>,
) -> CommandResult<()> {
    // Get the selected asymmetric algorithm
    let asym_algo = ctx
        .selected_base_asym_algo()
        .map_err(|_| ctx.generate_error_response(rsp, ErrorCode::Unspecified, 0, None))?;

    // Prepare the response buffer
    // Spdm Header first
    let connection_version = ctx.state.connection_info.version_number();
    let spdm_hdr = SpdmMsgHdr::new(connection_version, ReqRespCode::ChallengeAuth);
    let mut payload_len = spdm_hdr
        .encode(rsp)
        .map_err(|e| (false, CommandError::Codec(e)))?;

    // Encode the CHALLENGE_AUTH response fixed fields
    payload_len += encode_challenge_auth_rsp_base(ctx, slot_id, asym_algo, rsp)?;

    // Get the measurement summary hash
    if meas_summary_hash_type != MeasurementSummaryHashType::None {
        payload_len +=
            encode_measurement_summary_hash(ctx, asym_algo, meas_summary_hash_type, rsp)?;
    }

    // Encode the Opaque data length = 0
    payload_len += encode_opaque_data(rsp)?;

    // if requester context is present, encode it
    if let Some(context) = requester_context {
        payload_len += context
            .encode(rsp)
            .map_err(|e| (false, CommandError::Codec(e)))?;
    }

    // Append CHALLENGE_AUTH to the M1 transcript
    ctx.append_message_to_transcript(rsp, TranscriptContext::M1)?;

    // Generate the signature and encode it in the response
    payload_len += encode_m1_signature(ctx, slot_id, asym_algo, rsp)?;

    rsp.push_data(payload_len)
        .map_err(|e| (false, CommandError::Codec(e)))
}

pub(crate) fn handle_challenge<'a>(
    ctx: &mut SpdmContext<'a>,
    spdm_hdr: SpdmMsgHdr,
    req_payload: &mut MessageBuf<'a>,
) -> CommandResult<()> {
    // Check if the connection state is valid
    if ctx.state.connection_info.state() < ConnectionState::AlgorithmsNegotiated {
        Err(ctx.generate_error_response(req_payload, ErrorCode::UnexpectedRequest, 0, None))?;
    }

    // Check if challenge is supported
    if ctx.local_capabilities.flags.chal_cap() == 0 {
        Err(ctx.generate_error_response(req_payload, ErrorCode::UnsupportedRequest, 0, None))?;
    }

    // Process CHALLENGE request
    let (slot_id, meas_summary_hash_type, req_context) =
        process_challenge(ctx, spdm_hdr, req_payload)?;

    // Generate CHALLENGE_AUTH response
    ctx.prepare_response_buffer(req_payload)?;
    generate_challenge_auth_response(
        ctx,
        slot_id,
        meas_summary_hash_type,
        req_context,
        req_payload,
    )?;

    // Change the connection state to Authenticated
    ctx.state
        .connection_info
        .set_state(ConnectionState::Authenticated);

    Ok(())
}