Skip to content

Commit 17adaaa

Browse files
dgarskedgarske
authored
Merge pull request #140 from JacobBarthelmeh/dhuk
Add option to use IV with DHUK wrapping, add user pin argument
2 parents f8ed30d + 272eb71 commit 17adaaa

File tree

4 files changed

+114
-21
lines changed

4 files changed

+114
-21
lines changed

‎examples/stm32_dhuk_aes_key.c‎

Lines changed: 65 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -65,11 +65,12 @@ extern int uart_printf(const char* format, ...);
6565
static CK_FUNCTION_LIST* funcList;
6666
static CK_SLOT_ID slot = WOLFPKCS11_DLL_SLOT;
6767

68-
static byte* userPin = (byte*)"wolfpkcs11-test";
68+
static byte* userDefaultPin = (byte*)"wolfpkcs11-test";
6969
static CK_ULONG userPinLen;
7070

7171

72-
static CK_RV pkcs11_init(CK_SESSION_HANDLE* session)
72+
static CK_RV pkcs11_init(CK_SESSION_HANDLE* session, char* userPin,
73+
int userPinLen)
7374
{
7475
CK_RV ret = CKR_OK;
7576

@@ -126,7 +127,7 @@ CK_RV pkcs11_add_aes_dhuk_key(CK_SESSION_HANDLE session)
126127
{
127128
CK_RV ret;
128129
CK_ULONG devId = WOLFSSL_STM32U5_DHUK_DEVID;/* signal use of hardware key */
129-
CK_ATTRIBUTE aes_dhuk_secret_key[] = {
130+
CK_ATTRIBUTE aesDhukSecretKey[] = {
130131
{ CKA_CLASS, &secretKeyClass, sizeof(secretKeyClass) },
131132
#ifndef NO_AES
132133
{ CKA_KEY_TYPE, &aesKeyType, sizeof(aesKeyType) },
@@ -135,14 +136,13 @@ CK_RV pkcs11_add_aes_dhuk_key(CK_SESSION_HANDLE session)
135136
#endif
136137
{ CKA_WRAP, &ckTrue, sizeof(ckTrue) },
137138
{ CKA_UNWRAP, &ckTrue, sizeof(ckTrue) },
138-
{ CKA_TOKEN, &ckTrue, sizeof(ckTrue) },
139139
{ CKA_VALUE, aes256Key, sizeof(aes256Key) },
140140
{ CKA_WOLFSSL_DEVID, &devId, sizeof(devId) },
141141
};
142-
CK_ULONG cnt = sizeof(aes_dhuk_secret_key)/sizeof(*aes_dhuk_secret_key);
142+
CK_ULONG cnt = sizeof(aesDhukSecretKey)/sizeof(*aesDhukSecretKey);
143143
CK_OBJECT_HANDLE obj;
144144

145-
ret = funcList->C_CreateObject(session, aes_dhuk_secret_key, cnt, &obj);
145+
ret = funcList->C_CreateObject(session, aesDhukSecretKey, cnt, &obj);
146146
CHECK_CKR(ret, "CreateObject AES DHUK key");
147147

148148
return ret;
@@ -162,7 +162,6 @@ CK_RV pkcs11_add_aes_software_key(CK_SESSION_HANDLE session)
162162
#endif
163163
{ CKA_ENCRYPT, &ckTrue, sizeof(ckTrue) },
164164
{ CKA_DECRYPT, &ckTrue, sizeof(ckTrue) },
165-
{ CKA_TOKEN, &ckTrue, sizeof(ckTrue) },
166165
{ CKA_VALUE, aes256Key, sizeof(aes256Key) },
167166
{ CKA_WOLFSSL_DEVID, &devId, sizeof(devId) },
168167
};
@@ -268,21 +267,27 @@ CK_RV pkcs11_wrap_aes_key(CK_SESSION_HANDLE session)
268267
CK_BYTE wrappedKeyBuffer[32];
269268
CK_ULONG wrappedKeyBufferLen = sizeof(wrappedKeyBuffer);
270269
CK_ULONG devId = WOLFSSL_STM32U5_DHUK_WRAPPED_DEVID;
271-
CK_MECHANISM mech = {CKM_AES_ECB, NULL, 0};
270+
byte iv[16];
271+
/* CK_MECHANISM mech = {CKM_AES_ECB, NULL, 0}; */
272+
CK_MECHANISM mech = {CKM_AES_CBC_PAD, iv, 16};
272273
int i;
273274
CK_RV rv;
274275
CK_ATTRIBUTE wrappedKeyTemplate[] = {
275276
{ CKA_CLASS, &secretKeyClass, sizeof(secretKeyClass) },
276277
{ CKA_KEY_TYPE, &aesKeyType, sizeof(aesKeyType) },
277278
{ CKA_VALUE, wrappedKeyBuffer, wrappedKeyBufferLen },
278-
{ CKA_ENCRYPT, &ckTrue, sizeof(ckTrue) },
279-
{ CKA_DECRYPT, &ckTrue, sizeof(ckTrue) },
280-
{ CKA_TOKEN, &ckTrue, sizeof(ckTrue) },
281-
{ CKA_WOLFSSL_DEVID, &devId, sizeof(devId) },
279+
{ CKA_ENCRYPT, &ckTrue, sizeof(ckTrue) },
280+
{ CKA_DECRYPT, &ckTrue, sizeof(ckTrue) },
281+
{ CKA_TOKEN, &ckTrue, sizeof(ckTrue) },
282+
{ CKA_WOLFSSL_DHUK_IV, iv, sizeof(iv) },
283+
{ CKA_WOLFSSL_DEVID, &devId, sizeof(devId) },
282284
};
283285
CK_ULONG wrappedKeyTemplateLen = sizeof(wrappedKeyTemplate) /
284286
sizeof(CK_ATTRIBUTE);
285287

288+
for (i = 0; i < 16; i++) {
289+
iv[i] = i;
290+
}
286291

287292
key = find_software_key(session);
288293
if (key == 0) {
@@ -388,7 +393,6 @@ static CK_RV pkcs11_compare_results(CK_SESSION_HANDLE session)
388393
for (i = 0; i < 16; i++) {
389394
iv[i] = i;
390395
}
391-
392396
/* Encrypt plain text using software only key */
393397
key = find_software_key(session);
394398
memset(cipher, 0, sizeof(cipher));
@@ -435,6 +439,25 @@ static CK_RV pkcs11_compare_results(CK_SESSION_HANDLE session)
435439
return ret;
436440
}
437441

442+
/* Match the command line argument with the string.
443+
*
444+
* arg Command line argument.
445+
* str String to check for.
446+
* return 1 if the command line argument matches the string, 0 otherwise.
447+
*/
448+
static int string_matches(const char* arg, const char* str)
449+
{
450+
int len = (int)XSTRLEN(str) + 1;
451+
return XSTRNCMP(arg, str, len) == 0;
452+
}
453+
454+
/* Display the usage options of the benchmark program. */
455+
static void Usage(void)
456+
{
457+
printf("stm32_dhuk_aes_key\n");
458+
printf("-? Help, print this usage\n");
459+
printf("-userPin <string> User PIN\n");
460+
}
438461

439462
#ifndef NO_MAIN_DRIVER
440463
int main(int argc, char* argv[])
@@ -445,16 +468,39 @@ int stm32_dhuk_aes_key(int argc, char* argv[])
445468
int ret;
446469
CK_RV rv;
447470
CK_SESSION_HANDLE session = CK_INVALID_HANDLE;
471+
char* userPin = userDefaultPin;
448472

449-
#ifndef WOLFPKCS11_NO_ENV
450-
if (!XGETENV("WOLFPKCS11_TOKEN_PATH")) {
451-
XSETENV("WOLFPKCS11_TOKEN_PATH", "./store", 1);
452-
}
453-
#endif
454473
printf("Example PKCS11 DHUK AES use\n\r");
455474

475+
argc--;
476+
argv++;
477+
while (argc > 0) {
478+
if (string_matches(*argv, "-?")) {
479+
Usage();
480+
return 0;
481+
}
482+
else if (string_matches(*argv, "-userPin")) {
483+
argc--;
484+
argv++;
485+
if (argc == 0) {
486+
printf("User PIN not supplied\n");
487+
return 1;
488+
}
489+
userPin = (byte*)*argv;
490+
}
491+
else {
492+
printf("Unrecognized command line argument\n %s\n",
493+
argv[0]);
494+
return 1;
495+
}
496+
497+
argc--;
498+
argv++;
499+
}
500+
userPinLen = (int)XSTRLEN((const char*)userPin);
501+
456502

457-
rv = pkcs11_init(&session);
503+
rv = pkcs11_init(&session, userPin, userPinLen);
458504
if (rv == CKR_OK) {
459505
rv = pkcs11_add_aes_dhuk_key(session);
460506
}

‎src/crypto.c‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,9 @@ static AttributeType attrType[] = {
234234
{ CKA_TRUST_EMAIL_PROTECTION, ATTR_TYPE_ULONG },
235235
{ CKA_TRUST_CODE_SIGNING, ATTR_TYPE_ULONG },
236236
{ CKA_TRUST_STEP_UP_APPROVED, ATTR_TYPE_BOOL },
237+
#endif
238+
#ifdef WOLFSSL_STM32U5_DHUK
239+
{ CKA_WOLFSSL_DHUK_IV, ATTR_TYPE_DATA },
237240
#endif
238241
{ CKA_WOLFSSL_DEVID, ATTR_TYPE_ULONG },
239242
};
@@ -6694,11 +6697,18 @@ CK_RV C_WrapKey(CK_SESSION_HANDLE hSession,
66946697
goto err_out;
66956698
}
66966699

6697-
#ifdef WOLFPKCS11_DHUK
6700+
#ifdef WOLFSSL_STM32U5_DHUK
66986701
if (WP11_Object_GetDevId(wrappingKey) ==
66996702
WOLFSSL_STM32U5_DHUK_DEVID) {
6703+
if (pMechanism->pParameter != NULL &&
6704+
pMechanism->ulParameterLen != AES_IV_SIZE) {
6705+
rv = CKR_ATTRIBUTE_VALUE_INVALID;
6706+
goto err_out;
6707+
}
6708+
67006709
if (wc_Stm32_Aes_Wrap(NULL, serialBuff, serialSize, pWrappedKey,
6701-
(word32*)pulWrappedKeyLen, NULL) != 0) {
6710+
(word32*)pulWrappedKeyLen, pMechanism->pParameter,
6711+
pMechanism->ulParameterLen) != 0) {
67026712
rv = CKR_FUNCTION_FAILED;
67036713
goto err_out;
67046714
}

‎src/internal.c‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,10 @@ struct WP11_Object {
252252
} data;
253253
#ifdef WOLFPKCS11_TPM
254254
WOLFTPM2_KEYBLOB* tpmKey;
255+
#endif
256+
#ifdef WOLFSSL_STM32U5_DHUK
257+
unsigned char* dhukIv; /* IV used with wrapping and unwrapping AES key. */
258+
int dhukIvLen;
255259
#endif
256260
CK_KEY_TYPE type; /* Key type of this object */
257261
word32 size; /* Size of the key in bits or bytes */
@@ -6813,6 +6817,12 @@ int WP11_Session_SetCbcParams(WP11_Session* session, unsigned char* iv,
68136817

68146818
/* AES object on session. */
68156819
ret = wc_AesInit(&cbc->aes, NULL, object->devId);
6820+
#ifdef WOLFSSL_STM32U5_DHUK
6821+
if (ret == 0 && object->dhukIvLen > 0) {
6822+
ret = wc_Stm32_Aes_SetDHUK_IV(&cbc->aes, object->dhukIv,
6823+
object->dhukIvLen);
6824+
}
6825+
#endif
68166826
if (ret == 0) {
68176827
if (object->onToken)
68186828
WP11_Lock_LockRO(object->lock);
@@ -8967,6 +8977,12 @@ int WP11_Object_GetAttr(WP11_Object* object, CK_ATTRIBUTE_TYPE type, byte* data,
89678977
}
89688978
break;
89698979
}
8980+
#ifdef WOLFSSL_STM32U5_DHUK
8981+
case CKA_WOLFSSL_DHUK_IV:
8982+
ret = GetData((byte*)object->dhukIv, object->dhukIvLen,
8983+
data, len);
8984+
break;
8985+
#endif
89708986

89718987
case CKA_WOLFSSL_DEVID:
89728988
ret = GetULong(object->devId, data, len);
@@ -9347,6 +9363,13 @@ int WP11_Object_SetAttr(WP11_Object* object, CK_ATTRIBUTE_TYPE type, byte* data,
93479363
object->devId = (int)(*(CK_ULONG*)data);
93489364
break;
93499365

9366+
#ifdef WOLFSSL_STM32U5_DHUK
9367+
case CKA_WOLFSSL_DHUK_IV:
9368+
ret = WP11_Object_SetData(&object->dhukIv, &object->dhukIvLen,
9369+
data, (int)len);
9370+
break;
9371+
#endif
9372+
93509373
default:
93519374
ret = BAD_FUNC_ARG;
93529375
break;
@@ -12115,6 +12138,11 @@ int WP11_AesEcb_Encrypt(unsigned char* plain, word32 plainSz,
1211512138
WP11_Data* key;
1211612139

1211712140
ret = wc_AesInit(&aes, NULL, secret->devId);
12141+
#ifdef WOLFSSL_STM32U5_DHUK
12142+
if (ret == 0 && secret->dhukIvLen > 0) {
12143+
ret = wc_Stm32_Aes_SetDHUK_IV(&aes, secret->dhukIv, secret->dhukIvLen);
12144+
}
12145+
#endif
1211812146
if (ret == 0) {
1211912147
if (secret->onToken)
1212012148
WP11_Lock_LockRO(secret->lock);
@@ -12157,6 +12185,11 @@ int WP11_AesEcb_Decrypt(unsigned char* enc, word32 encSz, unsigned char* dec,
1215712185
WP11_Data* key;
1215812186

1215912187
ret = wc_AesInit(&aes, NULL, secret->devId);
12188+
#ifdef WOLFSSL_STM32U5_DHUK
12189+
if (ret == 0 && secret->dhukIvLen > 0) {
12190+
ret = wc_Stm32_Aes_SetDHUK_IV(&aes, secret->dhukIv, secret->dhukIvLen);
12191+
}
12192+
#endif
1216012193
if (ret == 0) {
1216112194
if (secret->onToken)
1216212195
WP11_Lock_LockRO(secret->lock);

‎wolfpkcs11/pkcs11.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,10 @@ extern "C" {
6161
/* Set the crypto callback device ID to be used with the object */
6262
#define CKA_WOLFSSL_DEVID (CKA_VENDOR_DEFINED | CK_VENDOR_WOLFSSL_DEVID)
6363

64+
#ifdef WOLFSSL_STM32U5_DHUK
65+
#define CKA_WOLFSSL_DHUK_IV (CKA_VENDOR_DEFINED | (CK_VENDOR_WOLFSSL_DEVID + 1))
66+
#endif
67+
6468
#ifndef NULL_PTR
6569
#define NULL_PTR 0
6670
#endif

0 commit comments

Comments
 (0)