Skip to content

Commit 42f1e21

Browse files
jack0cjack0c
committed
Merge branch 'feature/add_dpp_crypto_layer' into 'master'
feature(esp_wifi):Restructure dpp crypto layer See merge request espressif/esp-idf!30225
2 parents 8ed0508 + beda284 commit 42f1e21

File tree

8 files changed

+1503
-1453
lines changed

8 files changed

+1503
-1453
lines changed

‎components/wpa_supplicant/CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,7 @@ endif()
202202

203203
if(CONFIG_ESP_WIFI_DPP_SUPPORT)
204204
set(dpp_src "src/common/dpp.c"
205+
"src/common/dpp_crypto.c"
205206
"esp_supplicant/src/esp_dpp.c")
206207
else()
207208
set(dpp_src "")

‎components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-ec.c‎

Lines changed: 62 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -453,7 +453,7 @@ int crypto_ec_point_cmp(const struct crypto_ec *e,
453453
(const mbedtls_ecp_point *) b);
454454
}
455455

456-
int crypto_key_compare(struct crypto_key *key1, struct crypto_key *key2)
456+
int crypto_ec_key_compare(struct crypto_ec_key *key1, struct crypto_ec_key *key2)
457457
{
458458
int ret = 0;
459459
mbedtls_entropy_context entropy;
@@ -488,7 +488,7 @@ void crypto_debug_print_point(const char *title, struct crypto_ec *e,
488488
wpa_hexdump(MSG_ERROR, "y:", y, 32);
489489
}
490490

491-
static struct crypto_key *crypto_alloc_key(void)
491+
static struct crypto_ec_key *crypto_alloc_key(void)
492492
{
493493
mbedtls_pk_context *key = os_malloc(sizeof(*key));
494494

@@ -498,14 +498,14 @@ static struct crypto_key *crypto_alloc_key(void)
498498
}
499499
mbedtls_pk_init(key);
500500

501-
return (struct crypto_key *)key;
501+
return (struct crypto_ec_key *)key;
502502
}
503503

504-
struct crypto_key * crypto_ec_set_pubkey_point(const struct crypto_ec_group *group,
505-
const u8 *buf, size_t len)
504+
struct crypto_ec_key * crypto_ec_key_set_pub(const struct crypto_ec_group *group,
505+
const u8 *buf, size_t len)
506506
{
507507
mbedtls_ecp_point *point = NULL;
508-
struct crypto_key *pkey = NULL;
508+
struct crypto_ec_key *pkey = NULL;
509509
int ret;
510510
mbedtls_pk_context *key = (mbedtls_pk_context *)crypto_alloc_key();
511511
mbedtls_ecp_group *ecp_grp = (mbedtls_ecp_group *)group;
@@ -543,7 +543,7 @@ struct crypto_key * crypto_ec_set_pubkey_point(const struct crypto_ec_group *gro
543543
mbedtls_ecp_copy(&mbedtls_pk_ec(*key)->MBEDTLS_PRIVATE(Q), point);
544544
mbedtls_ecp_group_load(&mbedtls_pk_ec(*key)->MBEDTLS_PRIVATE(grp), ecp_grp->id);
545545

546-
pkey = (struct crypto_key *)key;
546+
pkey = (struct crypto_ec_key *)key;
547547
crypto_ec_point_deinit((struct crypto_ec_point *)point, 0);
548548
return pkey;
549549
fail:
@@ -557,21 +557,14 @@ struct crypto_key * crypto_ec_set_pubkey_point(const struct crypto_ec_group *gro
557557
return pkey;
558558
}
559559

560-
void crypto_ec_free_key(struct crypto_key *key)
561-
{
562-
mbedtls_pk_context *pkey = (mbedtls_pk_context *)key;
563-
mbedtls_pk_free(pkey);
564-
os_free(key);
565-
}
566-
567-
struct crypto_ec_point *crypto_ec_get_public_key(struct crypto_key *key)
560+
struct crypto_ec_point *crypto_ec_key_get_public_key(struct crypto_ec_key *key)
568561
{
569562
mbedtls_pk_context *pkey = (mbedtls_pk_context *)key;
570563

571564
return (struct crypto_ec_point *)&mbedtls_pk_ec(*pkey)->MBEDTLS_PRIVATE(Q);
572565
}
573566

574-
int crypto_ec_get_priv_key_der(struct crypto_key *key, unsigned char **key_data, int *key_len)
567+
int crypto_ec_get_priv_key_der(struct crypto_ec_key *key, unsigned char **key_data, int *key_len)
575568
{
576569
mbedtls_pk_context *pkey = (mbedtls_pk_context *)key;
577570
char *der_data = os_malloc(ECP_PRV_DER_MAX_BYTES);
@@ -599,7 +592,7 @@ int crypto_ec_get_priv_key_der(struct crypto_key *key, unsigned char **key_data,
599592
return 0;
600593
}
601594

602-
struct crypto_ec_group *crypto_ec_get_group_from_key(struct crypto_key *key)
595+
struct crypto_ec_group *crypto_ec_get_group_from_key(struct crypto_ec_key *key)
603596
{
604597
mbedtls_pk_context *pkey = (mbedtls_pk_context *)key;
605598

@@ -614,14 +607,14 @@ int crypto_ec_key_group(struct crypto_ec_key *key)
614607
return iana_group;
615608
}
616609

617-
struct crypto_bignum *crypto_ec_get_private_key(struct crypto_key *key)
610+
struct crypto_bignum *crypto_ec_key_get_private_key(struct crypto_ec_key *key)
618611
{
619612
mbedtls_pk_context *pkey = (mbedtls_pk_context *)key;
620613

621614
return ((struct crypto_bignum *) & (mbedtls_pk_ec(*pkey)->MBEDTLS_PRIVATE(d)));
622615
}
623616

624-
int crypto_ec_get_publickey_buf(struct crypto_key *key, u8 *key_buf, int len)
617+
int crypto_ec_get_publickey_buf(struct crypto_ec_key *key, u8 *key_buf, int len)
625618
{
626619
mbedtls_pk_context *pkey = (mbedtls_pk_context *)key;
627620
unsigned char buf[MBEDTLS_MPI_MAX_SIZE + 10]; /* tag, length + MPI */
@@ -644,7 +637,7 @@ int crypto_ec_get_publickey_buf(struct crypto_key *key, u8 *key_buf, int len)
644637
return pk_len;
645638
}
646639

647-
int crypto_write_pubkey_der(struct crypto_key *key, unsigned char **key_buf)
640+
int crypto_write_pubkey_der(struct crypto_ec_key *key, unsigned char **key_buf)
648641
{
649642
unsigned char *buf = os_malloc(ECP_PUB_DER_MAX_BYTES);
650643

@@ -669,7 +662,7 @@ int crypto_write_pubkey_der(struct crypto_key *key, unsigned char **key_buf)
669662
return len;
670663
}
671664

672-
struct crypto_key *crypto_ec_get_key(const u8 *privkey, size_t privkey_len)
665+
struct crypto_ec_key *crypto_ec_key_parse_priv(const u8 *privkey, size_t privkey_len)
673666
{
674667
int ret;
675668
mbedtls_pk_context *kctx = (mbedtls_pk_context *)crypto_alloc_key();
@@ -685,7 +678,7 @@ struct crypto_key *crypto_ec_get_key(const u8 *privkey, size_t privkey_len)
685678
goto fail;
686679
}
687680

688-
return (struct crypto_key *)kctx;
681+
return (struct crypto_ec_key *)kctx;
689682

690683
fail:
691684
mbedtls_pk_free(kctx);
@@ -728,7 +721,7 @@ int crypto_ec_get_curve_id(const struct crypto_ec_group *group)
728721
return (crypto_ec_get_mbedtls_to_nist_group_id(grp->id));
729722
}
730723

731-
int crypto_ecdh(struct crypto_key *key_own, struct crypto_key *key_peer,
724+
int crypto_ecdh(struct crypto_ec_key *key_own, struct crypto_ec_key *key_peer,
732725
u8 *secret, size_t *secret_len)
733726
{
734727
mbedtls_ecdh_context *ctx = NULL;
@@ -795,7 +788,7 @@ int crypto_ecdh(struct crypto_key *key_own, struct crypto_key *key_peer,
795788
}
796789

797790
int crypto_ecdsa_get_sign(unsigned char *hash,
798-
const struct crypto_bignum *r, const struct crypto_bignum *s, struct crypto_key *csign, int hash_len)
791+
const struct crypto_bignum *r, const struct crypto_bignum *s, struct crypto_ec_key *csign, int hash_len)
799792
{
800793
int ret = -1;
801794
mbedtls_pk_context *pkey = (mbedtls_pk_context *)csign;
@@ -820,48 +813,56 @@ int crypto_ecdsa_get_sign(unsigned char *hash,
820813
return ret;
821814
}
822815

823-
int crypto_edcsa_sign_verify(const unsigned char *hash,
824-
const struct crypto_bignum *r, const struct crypto_bignum *s, struct crypto_key *csign, int hlen)
816+
int crypto_ec_key_verify_signature_r_s(struct crypto_ec_key *csign,
817+
const unsigned char *hash, int hlen,
818+
const u8 *r, size_t r_len,
819+
const u8 *s, size_t s_len)
825820
{
826821
/* (mbedtls_ecdsa_context *) */
827822
mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)csign);
828823
if (!ecp_kp) {
829824
return -1;
830825
}
831826

827+
struct crypto_bignum *rb = NULL, *sb = NULL;
828+
rb = crypto_bignum_init_set(r, r_len);
829+
sb = crypto_bignum_init_set(s, s_len);
830+
832831
mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
833832
mbedtls_ecp_point *ecp_kp_q = &ecp_kp->MBEDTLS_PRIVATE(Q);
834833
int ret = mbedtls_ecdsa_verify(ecp_kp_grp, hash, hlen,
835-
ecp_kp_q, (mbedtls_mpi *)r, (mbedtls_mpi *)s);
834+
ecp_kp_q, (mbedtls_mpi *)rb, (mbedtls_mpi *)sb);
836835
if (ret != 0) {
837836
wpa_printf(MSG_ERROR, "ecdsa verification failed");
837+
crypto_bignum_deinit(rb, 0);
838+
crypto_bignum_deinit(sb, 0);
838839
return ret;
839840
}
840841

841842
return ret;
842843
}
843844

844-
void crypto_debug_print_ec_key(const char *title, struct crypto_key *key)
845+
void crypto_ec_key_debug_print(struct crypto_ec_key *key, const char *title)
845846
{
846847
#ifdef DEBUG_PRINT
847848
mbedtls_pk_context *pkey = (mbedtls_pk_context *)key;
848849
mbedtls_ecp_keypair *ecp = mbedtls_pk_ec(*pkey);
849850
u8 x[32], y[32], d[32];
850-
wpa_printf(MSG_ERROR, "curve: %s",
851+
wpa_printf(MSG_INFO, "curve: %s",
851852
mbedtls_ecp_curve_info_from_grp_id(ecp->MBEDTLS_PRIVATE(grp).id)->name);
852853
int len = mbedtls_mpi_size((mbedtls_mpi *)crypto_ec_get_prime((struct crypto_ec *)crypto_ec_get_group_from_key(key)));
853854

854-
wpa_printf(MSG_ERROR, "prime len is %d", len);
855-
crypto_ec_point_to_bin((struct crypto_ec *)crypto_ec_get_group_from_key(key), crypto_ec_get_public_key(key), x, y);
856-
crypto_bignum_to_bin(crypto_ec_get_private_key(key),
855+
wpa_printf(MSG_INFO, "prime len is %d", len);
856+
crypto_ec_point_to_bin((struct crypto_ec *)crypto_ec_get_group_from_key(key), crypto_ec_key_get_public_key(key), x, y);
857+
crypto_bignum_to_bin(crypto_ec_key_get_private_key(key),
857858
d, len, len);
858-
wpa_hexdump(MSG_ERROR, "Q_x:", x, 32);
859-
wpa_hexdump(MSG_ERROR, "Q_y:", y, 32);
860-
wpa_hexdump(MSG_ERROR, "d: ", d, 32);
859+
wpa_hexdump(MSG_INFO, "Q_x:", x, 32);
860+
wpa_hexdump(MSG_INFO, "Q_y:", y, 32);
861+
wpa_hexdump(MSG_INFO, "d: ", d, 32);
861862
#endif
862863
}
863864

864-
struct crypto_key *crypto_ec_parse_subpub_key(const unsigned char *p, size_t len)
865+
struct crypto_ec_key *crypto_ec_parse_subpub_key(const unsigned char *p, size_t len)
865866
{
866867
int ret;
867868
mbedtls_pk_context *pkey = (mbedtls_pk_context *)crypto_alloc_key();
@@ -871,21 +872,21 @@ struct crypto_key *crypto_ec_parse_subpub_key(const unsigned char *p, size_t len
871872
}
872873
ret = mbedtls_pk_parse_subpubkey((unsigned char **)&p, p + len, pkey);
873874
if (ret == 0) {
874-
return (struct crypto_key *)pkey;
875+
return (struct crypto_ec_key *)pkey;
875876
}
876877

877878
mbedtls_pk_free(pkey);
878879
os_free(pkey);
879880
return NULL;
880881
}
881882

882-
int crypto_is_ec_key(struct crypto_key *key)
883+
int crypto_is_ec_key(struct crypto_ec_key *key)
883884
{
884885
int ret = mbedtls_pk_can_do((mbedtls_pk_context *)key, MBEDTLS_PK_ECKEY);
885886
return ret;
886887
}
887888

888-
struct crypto_key * crypto_ec_gen_keypair(u16 ike_group)
889+
struct crypto_ec_key * crypto_ec_key_gen(u16 ike_group)
889890
{
890891
mbedtls_pk_context *kctx = (mbedtls_pk_context *)crypto_alloc_key();
891892

@@ -902,7 +903,7 @@ struct crypto_key * crypto_ec_gen_keypair(u16 ike_group)
902903
mbedtls_ecp_gen_key(MBEDTLS_ECP_DP_SECP256R1, mbedtls_pk_ec(*kctx), //get this from argument
903904
crypto_rng_wrapper, NULL);
904905

905-
return (struct crypto_key *)kctx;
906+
return (struct crypto_ec_key *)kctx;
906907
fail:
907908
mbedtls_pk_free(kctx);
908909
os_free(kctx);
@@ -1018,7 +1019,7 @@ int crypto_pk_write_formatted_pubkey_der(mbedtls_pk_context *key, unsigned char
10181019
return ((int) len);
10191020
}
10201021

1021-
int crypto_ec_write_pub_key(struct crypto_key *key, unsigned char **key_buf)
1022+
int crypto_ec_write_pub_key(struct crypto_ec_key *key, unsigned char **key_buf)
10221023
{
10231024
unsigned char output_buf[1600] = {0};
10241025
int len = crypto_pk_write_formatted_pubkey_der((mbedtls_pk_context *)key, output_buf, 1600, 1);
@@ -1036,6 +1037,23 @@ int crypto_ec_write_pub_key(struct crypto_key *key, unsigned char **key_buf)
10361037
return len;
10371038
}
10381039

1040+
struct wpabuf * crypto_ec_key_get_subject_public_key(struct crypto_ec_key *key)
1041+
{
1042+
unsigned char *der = NULL;
1043+
struct wpabuf *ret = NULL;
1044+
int der_len;
1045+
1046+
der_len = crypto_ec_write_pub_key(key, &der);
1047+
if (!der) {
1048+
wpa_printf(MSG_ERROR, "failed to get der for bootstrapping key\n");
1049+
return NULL;
1050+
}
1051+
ret = wpabuf_alloc_copy(der, der_len);
1052+
1053+
os_free(der);
1054+
return ret;
1055+
}
1056+
10391057
int crypto_mbedtls_get_grp_id(int group)
10401058
{
10411059
switch (group) {
@@ -1140,7 +1158,7 @@ struct wpabuf * crypto_ecdh_set_peerkey(struct crypto_ecdh *ecdh, int inc_y,
11401158
struct crypto_bignum *bn_x = NULL;
11411159
struct crypto_ec_point *ec_pt = NULL;
11421160
uint8_t *px = NULL, *py = NULL, *buf = NULL;
1143-
struct crypto_key *pkey = NULL;
1161+
struct crypto_ec_key *pkey = NULL;
11441162
struct wpabuf *sh_secret = NULL;
11451163
int secret_key = 0;
11461164

@@ -1188,7 +1206,7 @@ struct wpabuf * crypto_ecdh_set_peerkey(struct crypto_ecdh *ecdh, int inc_y,
11881206
os_memcpy(buf, px, len);
11891207
os_memcpy(buf + len, py, len);
11901208

1191-
pkey = crypto_ec_set_pubkey_point((struct crypto_ec_group*)ACCESS_ECDH(&ctx, grp), buf, len);
1209+
pkey = crypto_ec_key_set_pub((struct crypto_ec_group*)ACCESS_ECDH(&ctx, grp), buf, len);
11921210
if (!pkey) {
11931211
wpa_printf(MSG_ERROR, "Failed to set point for peer's public key");
11941212
goto cleanup;
@@ -1228,7 +1246,7 @@ struct wpabuf * crypto_ecdh_set_peerkey(struct crypto_ecdh *ecdh, int inc_y,
12281246
os_free(py);
12291247
os_free(buf);
12301248
os_free(secret);
1231-
crypto_ec_free_key(pkey);
1249+
crypto_ec_key_deinit(pkey);
12321250
crypto_bignum_deinit(bn_x, 1);
12331251
crypto_ec_point_deinit(ec_pt, 1);
12341252
mbedtls_ctr_drbg_free(&ctr_drbg);

‎components/wpa_supplicant/esp_supplicant/src/esp_dpp_i.h‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2020-2023 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -10,7 +10,6 @@
1010
#include "esp_err.h"
1111
#include "utils/includes.h"
1212
#include "utils/common.h"
13-
1413
#include "common/dpp.h"
1514
#include "esp_dpp.h"
1615
#include "esp_wifi_driver.h"
@@ -59,6 +58,11 @@ struct esp_dpp_context_t {
5958
int esp_supp_rx_action(uint8_t *hdr, uint8_t *payload, size_t len, uint8_t channel);
6059
esp_err_t esp_dpp_post_evt(uint32_t evt_id, uint32_t data);
6160

61+
#ifdef CONFIG_TESTING_OPTIONS
62+
int dpp_test_gen_invalid_key(struct wpabuf *msg, const struct dpp_curve_params *curve);
63+
char * dpp_corrupt_connector_signature(const char *connector);
64+
#endif /* CONFIG_TESTING_OPTIONS */
65+
6266
#ifdef CONFIG_ESP_WIFI_DPP_SUPPORT
6367
bool is_dpp_enabled(void);
6468
#else

0 commit comments

Comments
 (0)