Skip to content

Commit fd4ab14

Browse files
AlexLanzanoAlexLanzano
committed
Implement inital client/server API for handling wrapped keys
This provides a client and server API to request/handle requests to wrap a plaintext key, unwrap a wrapped key, and cache a wrapped key.
1 parent 19e88be commit fd4ab14

18 files changed

+1570
-19
lines changed

‎examples/demo/client/wh_demo_client_all.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
#include "wh_demo_client_keystore.h"
55
#include "wh_demo_client_crypto.h"
66
#include "wh_demo_client_secboot.h"
7+
#include "wh_demo_client_wrapkey.h"
78
#include "wh_demo_client_all.h"
89

910
int wh_DemoClient_All(whClientContext* clientContext)
@@ -45,6 +46,14 @@ int wh_DemoClient_All(whClientContext* clientContext)
4546
}
4647
#endif
4748

49+
/* Wrap key demos */
50+
#ifdef WOLFHSM_CFG_WRAPKEY
51+
rc = wh_DemoClient_WrapKeyBasic(clientContext);
52+
if (rc != 0) {
53+
return rc;
54+
}
55+
#endif
56+
4857
/**Crypto demos */
4958
#ifndef NO_RSA
5059
rc = wh_DemoClient_CryptoRsa(clientContext);

‎examples/demo/client/wh_demo_client_wrapkey.c‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
/*
2+
* Copyright (C) 2025 wolfSSL Inc.
3+
*
4+
* This file is part of wolfHSM.
5+
*
6+
* wolfHSM is free software; you can redistribute it and/or modify
7+
* it under the terms of the GNU General Public License as published by
8+
* the Free Software Foundation; either version 3 of the License, or
9+
* (at your option) any later version.
10+
*
11+
* wolfHSM is distributed in the hope that it will be useful,
12+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
13+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14+
* GNU General Public License for more details.
15+
*
16+
* You should have received a copy of the GNU General Public License
17+
* along with wolfHSM. If not, see <http://www.gnu.org/licenses/>.
18+
*/
19+
20+
#include "wolfhsm/wh_settings.h"
21+
#ifdef WOLFHSM_CFG_WRAPKEY
22+
#include <stdint.h>
23+
#include <stdio.h>
24+
#include <string.h>
25+
26+
#include "wolfhsm/wh_common.h"
27+
#include "wolfhsm/wh_error.h"
28+
#include "wolfhsm/wh_client.h"
29+
#include "wolfhsm/wh_client_crypto.h"
30+
#include "wolfhsm/wh_client_wrapkey.h"
31+
32+
#include "wolfssl/wolfcrypt/settings.h"
33+
#include "wolfssl/wolfcrypt/aes.h"
34+
#include "wolfssl/wolfcrypt/random.h"
35+
36+
#include "wh_demo_client_wrapkey.h"
37+
38+
#ifndef NO_AES
39+
#define HAVE_AESGCM
40+
#ifdef HAVE_AESGCM
41+
int wh_DemoClient_AesGcmWrapKeyBasic(whClientContext* ctx, WC_RNG* rng)
42+
{
43+
44+
#define WH_TEST_AES_KEYSIZE 16
45+
#define WH_TEST_AES_TEXTSIZE 16
46+
#define WH_TEST_AES_AUTHSIZE 16
47+
#define WH_TEST_AES_TAGSIZE 16
48+
#define WH_TEST_AES_WRAPPED_KEYSIZE \
49+
(WH_TEST_AES_AUTHSIZE + WH_TEST_AES_TAGSIZE + WH_TEST_AES_KEYSIZE + \
50+
sizeof(whNvmMetadata))
51+
52+
int ret = 0;
53+
uint8_t iv[AES_BLOCK_SIZE];
54+
uint8_t key[WH_TEST_AES_KEYSIZE];
55+
uint8_t plainKey[WH_TEST_AES_KEYSIZE];
56+
uint8_t tmpPlainKey[WH_TEST_AES_KEYSIZE];
57+
uint8_t wrappedKey[WH_TEST_AES_WRAPPED_KEYSIZE];
58+
uint8_t label[WH_NVM_LABEL_LEN] = "Server AES Key Label";
59+
whKeyId serverKeyId;
60+
whKeyId wrappedKeyId;
61+
whNvmMetadata metadata = {.label = "AES Key Label",
62+
.access = WH_NVM_ACCESS_ANY,
63+
.len = WH_TEST_AES_KEYSIZE};
64+
whNvmMetadata tmpMetadata;
65+
66+
/* Randomize inputs */
67+
ret = wc_RNG_GenerateBlock(rng, key, sizeof(key));
68+
if (ret != 0) {
69+
printf("Failed to wc_RNG_GenerateBlock for key %d\n", ret);
70+
return ret;
71+
}
72+
73+
ret = wc_RNG_GenerateBlock(rng, plainKey, sizeof(plainKey));
74+
if (ret != 0) {
75+
printf("Failed to wc_RNG_GenerateBlock for key data %d\n", ret);
76+
return ret;
77+
}
78+
79+
ret = wc_RNG_GenerateBlock(rng, iv, sizeof(iv));
80+
if (ret != 0) {
81+
printf("Failed to wc_RNG_GenerateBlock for IV %d\n", ret);
82+
return ret;
83+
}
84+
85+
/* Initialize the AES GCM Server key */
86+
ret = wh_Client_KeyCache(ctx, 0, label, sizeof(label), key, sizeof(key),
87+
&serverKeyId);
88+
if (ret != 0) {
89+
printf("Failed to wh_Client_KeyCache %d\n", ret);
90+
return ret;
91+
}
92+
93+
ret = wh_Client_AesGcmWrapKey(ctx, serverKeyId, plainKey, sizeof(plainKey),
94+
&metadata, wrappedKey, sizeof(wrappedKey));
95+
if (ret != 0) {
96+
printf("Failed to wh_Client_AesGcmWrapKey %d\n", ret);
97+
return ret;
98+
}
99+
100+
ret = wh_Client_AesGcmWrapKeyCache(ctx, serverKeyId, wrappedKey,
101+
sizeof(wrappedKey), &wrappedKeyId);
102+
if (ret != 0) {
103+
printf("Failed to wh_Client_AesGcmWrapKeyCache %d\n", ret);
104+
return ret;
105+
}
106+
107+
ret = wh_Client_AesGcmUnwrapKey(ctx, serverKeyId, wrappedKey,
108+
sizeof(wrappedKey), &tmpMetadata,
109+
tmpPlainKey, sizeof(tmpPlainKey));
110+
if (ret != 0) {
111+
printf("Failed to wh_Client_AesGcmUnwrapKeyCache %d\n", ret);
112+
return ret;
113+
}
114+
115+
116+
if (memcmp(plainKey, tmpPlainKey, sizeof(plainKey)) != 0) {
117+
printf("AES GCM wrap/unwrap key failed to match\n");
118+
return ret;
119+
}
120+
121+
if (memcmp(&metadata, &tmpMetadata, sizeof(metadata)) != 0) {
122+
printf("AES GCM wrap/unwrap metadata failed to match\n");
123+
return ret;
124+
}
125+
126+
return ret;
127+
}
128+
129+
#endif /* HAVE_AESGCM */
130+
131+
int wh_DemoClient_AesWrapKeyBasic(whClientContext* clientContext, WC_RNG* rng)
132+
{
133+
int ret = WH_ERROR_OK;
134+
135+
#ifdef HAVE_AESGCM
136+
ret = wh_DemoClient_AesGcmWrapKeyBasic(clientContext, rng);
137+
#endif
138+
139+
return ret;
140+
}
141+
142+
#endif /* !NO_AES */
143+
int wh_DemoClient_WrapKeyBasic(whClientContext* clientContext)
144+
{
145+
146+
int ret;
147+
WC_RNG rng[1];
148+
149+
ret = wc_InitRng_ex(rng, NULL, WH_DEV_ID);
150+
if (ret != 0) {
151+
printf("Failed to wc_InitRng_ex %d\n", ret);
152+
return ret;
153+
}
154+
155+
#ifndef NO_AES
156+
ret = wh_DemoClient_AesWrapKeyBasic(clientContext, rng);
157+
#endif
158+
159+
wc_FreeRng(rng);
160+
return ret;
161+
}
162+
163+
#endif /* WOLFHSM_CFG_WRAPKEY */

‎examples/demo/client/wh_demo_client_wrapkey.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#ifndef DEMO_CLIENT_WRAPKEY_H_
2+
#define DEMO_CLIENT_WRAPKEY_H_
3+
4+
#include "wolfhsm/wh_client.h"
5+
6+
int wh_DemoClient_WrapKeyBasic(whClientContext* clientContext);
7+
8+
#endif /* !DEMO_CLIENT_WRAPKEY_H_ */

‎examples/posix/tcp/wh_client_tcp/wolfhsm_cfg.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
#define WOLFHSM_CFG_ENABLE_CLIENT
3030
#define WOLFHSM_CFG_HEXDUMP
3131
#define WOLFHSM_CFG_COMM_DATA_LEN 1280
32+
#define WOLFHSM_CFG_WRAPKEY
3233

3334

3435
#endif /* WOLFHSM_CFG_H_ */

‎examples/posix/tcp/wh_server_tcp/wolfhsm_cfg.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,8 @@
4444
#define WOLFHSM_CFG_CERTIFICATE_MANAGER
4545
#define WOLFHSM_CFG_CERTIFICATE_MANAGER_ACERT
4646

47+
#define WOLFHSM_CFG_WRAPKEY
48+
4749
#define XMEMFENCE() __atomic_thread_fence(__ATOMIC_SEQ_CST)
4850

4951
#endif /* WOLFHSM_CFG_H_ */

0 commit comments

Comments
 (0)