From 4b2df7aeedd3fec1f46766afb39a36f5e2b6be59 Mon Sep 17 00:00:00 2001 From: Antonio de Angelis Date: Thu, 21 Mar 2024 11:44:56 +0000 Subject: [PATCH 1/6] Add TF-M Builtin Key Loader driver entry points TF-M requires a mechanism to leverage the drivers and builtin keys at the same time to allow for "transparent builtin keys". More details are in the TF-M design doc. Provide directly the wrappers instead of modifying the autogen scripts, for the time being. Signed-off-by: Raef Coles Co-authored-by: Antonio de Angelis --- library/psa_crypto.c | 10 +- library/psa_crypto_driver_wrappers.h | 102 +++++++++++++++++- .../psa_crypto_driver_wrappers_no_static.c | 40 ++++++- 3 files changed, 143 insertions(+), 9 deletions(-) diff --git a/library/psa_crypto.c b/library/psa_crypto.c index c4f41db10..5180435de 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -73,6 +73,10 @@ #include "mbedtls/psa_util.h" #include "mbedtls/threading.h" +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) +#include "tfm_builtin_key_loader.h" +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ + #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \ defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \ defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) @@ -1166,7 +1170,11 @@ static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy( return status; } - if (psa_key_lifetime_is_external((*p_slot)->attr.lifetime)) { + if (psa_key_lifetime_is_external((*p_slot)->attr.lifetime) +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + && PSA_KEY_LIFETIME_GET_LOCATION((*p_slot)->attr.lifetime) != TFM_BUILTIN_KEY_LOADER_KEY_LOCATION +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ + ) { psa_unregister_read_under_mutex(*p_slot); *p_slot = NULL; return PSA_ERROR_NOT_SUPPORTED; diff --git a/library/psa_crypto_driver_wrappers.h b/library/psa_crypto_driver_wrappers.h index b90155720..2e828115f 100644 --- a/library/psa_crypto_driver_wrappers.h +++ b/library/psa_crypto_driver_wrappers.h @@ -42,16 +42,32 @@ #endif +/* Include TF-M builtin key driver */ +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) +#ifndef PSA_CRYPTO_DRIVER_PRESENT +#define PSA_CRYPTO_DRIVER_PRESENT +#endif +#ifndef PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT +#define PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT +#endif +#include "tfm_builtin_key_loader.h" +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ + /* END-driver headers */ /* Auto-generated values depending on which drivers are registered. * ID 0 is reserved for unallocated operations. * ID 1 is reserved for the Mbed TLS software driver. */ /* BEGIN-driver id definition */ -#define PSA_CRYPTO_MBED_TLS_DRIVER_ID (1) -#define MBEDTLS_TEST_OPAQUE_DRIVER_ID (2) -#define MBEDTLS_TEST_TRANSPARENT_DRIVER_ID (3) -#define P256_TRANSPARENT_DRIVER_ID (4) +enum { + PSA_CRYPTO_MBED_TLS_DRIVER_ID = 1, + MBEDTLS_TEST_OPAQUE_DRIVER_ID, + MBEDTLS_TEST_TRANSPARENT_DRIVER_ID, + P256_TRANSPARENT_DRIVER_ID, +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + PSA_CRYPTO_TFM_BUILTIN_KEY_LOADER_DRIVER_ID, +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ +}; /* END-driver id */ @@ -73,6 +89,12 @@ static inline psa_status_t psa_driver_wrapper_init( void ) { psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + status = tfm_builtin_key_loader_init(); + if (status != PSA_SUCCESS) + return ( status ); +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ + #if defined(MBEDTLS_PSA_CRYPTO_SE_C) status = psa_init_all_se_drivers( ); if( status != PSA_SUCCESS ) @@ -126,6 +148,9 @@ static inline psa_status_t psa_driver_wrapper_sign_message( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -200,6 +225,9 @@ static inline psa_status_t psa_driver_wrapper_verify_message( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -287,6 +315,9 @@ static inline psa_status_t psa_driver_wrapper_sign_hash( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -391,6 +422,9 @@ static inline psa_status_t psa_driver_wrapper_verify_hash( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -521,6 +555,9 @@ static inline psa_status_t psa_driver_wrapper_sign_hash_start( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ @@ -613,6 +650,9 @@ static inline psa_status_t psa_driver_wrapper_verify_hash_start( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ @@ -776,6 +816,9 @@ static inline psa_status_t psa_driver_wrapper_generate_key( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) /* Transparent drivers are limited to generating asymmetric keys. */ /* We don't support passing custom production parameters @@ -880,6 +923,9 @@ static inline psa_status_t psa_driver_wrapper_import_key( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -981,6 +1027,9 @@ static inline psa_status_t psa_driver_wrapper_export_key( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ return( psa_export_key_internal( attributes, key_buffer, key_buffer_size, @@ -1087,6 +1136,9 @@ static inline psa_status_t psa_driver_wrapper_cipher_encrypt( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -1177,6 +1229,9 @@ static inline psa_status_t psa_driver_wrapper_cipher_decrypt( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -1254,6 +1309,9 @@ static inline psa_status_t psa_driver_wrapper_cipher_encrypt_setup( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -1327,6 +1385,9 @@ static inline psa_status_t psa_driver_wrapper_cipher_decrypt_setup( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -1727,6 +1788,9 @@ static inline psa_status_t psa_driver_wrapper_aead_encrypt( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ @@ -1779,6 +1843,9 @@ static inline psa_status_t psa_driver_wrapper_aead_decrypt( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ @@ -1828,6 +1895,9 @@ static inline psa_status_t psa_driver_wrapper_aead_encrypt_setup( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ @@ -1876,6 +1946,9 @@ static inline psa_status_t psa_driver_wrapper_aead_decrypt_setup( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ @@ -2212,6 +2285,9 @@ static inline psa_status_t psa_driver_wrapper_mac_compute( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -2276,6 +2352,9 @@ static inline psa_status_t psa_driver_wrapper_mac_sign_setup( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -2348,6 +2427,9 @@ static inline psa_status_t psa_driver_wrapper_mac_verify_setup( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -2548,6 +2630,9 @@ static inline psa_status_t psa_driver_wrapper_asymmetric_encrypt( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -2606,6 +2691,9 @@ static inline psa_status_t psa_driver_wrapper_asymmetric_decrypt( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -2670,6 +2758,9 @@ static inline psa_status_t psa_driver_wrapper_key_agreement( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -2750,6 +2841,9 @@ static inline psa_status_t psa_driver_wrapper_pake_setup( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ status = PSA_ERROR_NOT_SUPPORTED; diff --git a/library/psa_crypto_driver_wrappers_no_static.c b/library/psa_crypto_driver_wrappers_no_static.c index de8a5269b..436a650fc 100644 --- a/library/psa_crypto_driver_wrappers_no_static.c +++ b/library/psa_crypto_driver_wrappers_no_static.c @@ -41,16 +41,32 @@ #endif +/* Include TF-M builtin key driver */ +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) +#ifndef PSA_CRYPTO_DRIVER_PRESENT +#define PSA_CRYPTO_DRIVER_PRESENT +#endif +#ifndef PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT +#define PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT +#endif +#include "tfm_builtin_key_loader.h" +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ + /* END-driver headers */ /* Auto-generated values depending on which drivers are registered. * ID 0 is reserved for unallocated operations. * ID 1 is reserved for the Mbed TLS software driver. */ /* BEGIN-driver id definition */ -#define PSA_CRYPTO_MBED_TLS_DRIVER_ID (1) -#define MBEDTLS_TEST_OPAQUE_DRIVER_ID (2) -#define MBEDTLS_TEST_TRANSPARENT_DRIVER_ID (3) -#define P256_TRANSPARENT_DRIVER_ID (4) +enum { + PSA_CRYPTO_MBED_TLS_DRIVER_ID = 1, + MBEDTLS_TEST_OPAQUE_DRIVER_ID, + MBEDTLS_TEST_TRANSPARENT_DRIVER_ID, + P256_TRANSPARENT_DRIVER_ID, +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + PSA_CRYPTO_TFM_BUILTIN_KEY_LOADER_DRIVER_ID, +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ +}; /* END-driver id */ @@ -112,6 +128,12 @@ psa_status_t psa_driver_wrapper_get_key_buffer_size( PSA_SUCCESS : PSA_ERROR_NOT_SUPPORTED ); #endif /* PSA_CRYPTO_DRIVER_TEST */ +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: + return tfm_builtin_key_loader_get_key_buffer_size(psa_get_key_id(attributes), + key_buffer_size); +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ + default: (void)key_type; (void)key_bits; @@ -153,6 +175,9 @@ psa_status_t psa_driver_wrapper_export_public_key( switch( location ) { case PSA_KEY_LOCATION_LOCAL_STORAGE: +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: +#endif /* defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) */ /* Key is stored in the slot in export representation, so * cycle through all known transparent accelerators */ #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) @@ -241,6 +266,13 @@ psa_status_t psa_driver_wrapper_get_builtin_key( )); #endif +#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER) + case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION: + return( tfm_builtin_key_loader_get_builtin_key( + slot_number, + attributes, + key_buffer, key_buffer_size, key_buffer_length ) ); +#endif /* PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER */ #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ default: -- 2.34.1