1 /**
2 * @file hci_ecc.c
3 * HCI ECC emulation
4 */
5
6 /*
7 * Copyright (c) 2016 Intel Corporation
8 *
9 * SPDX-License-Identifier: Apache-2.0
10 */
11
12 #include <zephyr/kernel.h>
13 #include <zephyr/sys/atomic.h>
14 #include <zephyr/debug/stack.h>
15 #include <zephyr/sys/byteorder.h>
16 #include <tinycrypt/constants.h>
17 #include <tinycrypt/utils.h>
18 #include <tinycrypt/ecc.h>
19 #include <tinycrypt/ecc_dh.h>
20
21 #include <zephyr/bluetooth/bluetooth.h>
22 #include <zephyr/bluetooth/conn.h>
23 #include <zephyr/bluetooth/hci.h>
24 #include <zephyr/drivers/bluetooth/hci_driver.h>
25
26 #include "common/bt_str.h"
27
28 #include "hci_ecc.h"
29 #include "ecc.h"
30
31 #ifdef CONFIG_BT_HCI_RAW
32 #include <zephyr/bluetooth/hci_raw.h>
33 #include "hci_raw_internal.h"
34 #else
35 #include "hci_core.h"
36 #endif
37 #include "long_wq.h"
38
39 #define LOG_LEVEL CONFIG_BT_HCI_CORE_LOG_LEVEL
40 #include <zephyr/logging/log.h>
41 LOG_MODULE_REGISTER(bt_hci_ecc);
42
43 static void ecc_process(struct k_work *work);
44 K_WORK_DEFINE(ecc_work, ecc_process);
45
46 /* based on Core Specification 4.2 Vol 3. Part H 2.3.5.6.1 */
47 static const uint8_t debug_private_key_be[BT_PRIV_KEY_LEN] = {
48 0x3f, 0x49, 0xf6, 0xd4, 0xa3, 0xc5, 0x5f, 0x38,
49 0x74, 0xc9, 0xb3, 0xe3, 0xd2, 0x10, 0x3f, 0x50,
50 0x4a, 0xff, 0x60, 0x7b, 0xeb, 0x40, 0xb7, 0x99,
51 0x58, 0x99, 0xb8, 0xa6, 0xcd, 0x3c, 0x1a, 0xbd,
52 };
53
54 enum {
55 PENDING_PUB_KEY,
56 PENDING_DHKEY,
57
58 USE_DEBUG_KEY,
59
60 /* Total number of flags - must be at the end of the enum */
61 NUM_FLAGS,
62 };
63
64 static ATOMIC_DEFINE(flags, NUM_FLAGS);
65
66 static struct {
67 uint8_t private_key_be[BT_PRIV_KEY_LEN];
68
69 union {
70 uint8_t public_key_be[BT_PUB_KEY_LEN];
71 uint8_t dhkey_be[BT_DH_KEY_LEN];
72 };
73 } ecc;
74
send_cmd_status(uint16_t opcode,uint8_t status)75 static void send_cmd_status(uint16_t opcode, uint8_t status)
76 {
77 struct bt_hci_evt_cmd_status *evt;
78 struct bt_hci_evt_hdr *hdr;
79 struct net_buf *buf;
80
81 LOG_DBG("opcode %x status %x", opcode, status);
82
83 buf = bt_buf_get_evt(BT_HCI_EVT_CMD_STATUS, false, K_FOREVER);
84 bt_buf_set_type(buf, BT_BUF_EVT);
85
86 hdr = net_buf_add(buf, sizeof(*hdr));
87 hdr->evt = BT_HCI_EVT_CMD_STATUS;
88 hdr->len = sizeof(*evt);
89
90 evt = net_buf_add(buf, sizeof(*evt));
91 evt->ncmd = 1U;
92 evt->opcode = sys_cpu_to_le16(opcode);
93 evt->status = status;
94
95 if (IS_ENABLED(CONFIG_BT_RECV_BLOCKING)) {
96 bt_recv_prio(buf);
97 } else {
98 bt_recv(buf);
99 }
100 }
101
generate_keys(void)102 static uint8_t generate_keys(void)
103 {
104 do {
105 int rc;
106
107 rc = uECC_make_key(ecc.public_key_be, ecc.private_key_be,
108 &curve_secp256r1);
109 if (rc == TC_CRYPTO_FAIL) {
110 LOG_ERR("Failed to create ECC public/private pair");
111 return BT_HCI_ERR_UNSPECIFIED;
112 }
113
114 /* make sure generated key isn't debug key */
115 } while (memcmp(ecc.private_key_be, debug_private_key_be, BT_PRIV_KEY_LEN) == 0);
116
117 if (IS_ENABLED(CONFIG_BT_LOG_SNIFFER_INFO)) {
118 LOG_INF("SC private key 0x%s", bt_hex(ecc.private_key_be, BT_PRIV_KEY_LEN));
119 }
120
121 return 0;
122 }
123
emulate_le_p256_public_key_cmd(void)124 static void emulate_le_p256_public_key_cmd(void)
125 {
126 struct bt_hci_evt_le_p256_public_key_complete *evt;
127 struct bt_hci_evt_le_meta_event *meta;
128 struct bt_hci_evt_hdr *hdr;
129 struct net_buf *buf;
130 uint8_t status;
131
132 LOG_DBG("");
133
134 status = generate_keys();
135
136 buf = bt_buf_get_rx(BT_BUF_EVT, K_FOREVER);
137
138 hdr = net_buf_add(buf, sizeof(*hdr));
139 hdr->evt = BT_HCI_EVT_LE_META_EVENT;
140 hdr->len = sizeof(*meta) + sizeof(*evt);
141
142 meta = net_buf_add(buf, sizeof(*meta));
143 meta->subevent = BT_HCI_EVT_LE_P256_PUBLIC_KEY_COMPLETE;
144
145 evt = net_buf_add(buf, sizeof(*evt));
146 evt->status = status;
147
148 if (status) {
149 (void)memset(evt->key, 0, sizeof(evt->key));
150 } else {
151 /* Convert X and Y coordinates from big-endian (provided
152 * by crypto API) to little endian HCI.
153 */
154 sys_memcpy_swap(evt->key, ecc.public_key_be, BT_PUB_KEY_COORD_LEN);
155 sys_memcpy_swap(&evt->key[BT_PUB_KEY_COORD_LEN],
156 &ecc.public_key_be[BT_PUB_KEY_COORD_LEN], BT_PUB_KEY_COORD_LEN);
157 }
158
159 atomic_clear_bit(flags, PENDING_PUB_KEY);
160
161 bt_recv(buf);
162 }
163
emulate_le_generate_dhkey(void)164 static void emulate_le_generate_dhkey(void)
165 {
166 struct bt_hci_evt_le_generate_dhkey_complete *evt;
167 struct bt_hci_evt_le_meta_event *meta;
168 struct bt_hci_evt_hdr *hdr;
169 struct net_buf *buf;
170 int ret;
171
172 ret = uECC_valid_public_key(ecc.public_key_be, &curve_secp256r1);
173 if (ret < 0) {
174 LOG_ERR("public key is not valid (ret %d)", ret);
175 ret = TC_CRYPTO_FAIL;
176 } else {
177 bool use_debug = atomic_test_bit(flags, USE_DEBUG_KEY);
178
179 ret = uECC_shared_secret(ecc.public_key_be,
180 use_debug ? debug_private_key_be :
181 ecc.private_key_be,
182 ecc.dhkey_be, &curve_secp256r1);
183 }
184
185 buf = bt_buf_get_rx(BT_BUF_EVT, K_FOREVER);
186
187 hdr = net_buf_add(buf, sizeof(*hdr));
188 hdr->evt = BT_HCI_EVT_LE_META_EVENT;
189 hdr->len = sizeof(*meta) + sizeof(*evt);
190
191 meta = net_buf_add(buf, sizeof(*meta));
192 meta->subevent = BT_HCI_EVT_LE_GENERATE_DHKEY_COMPLETE;
193
194 evt = net_buf_add(buf, sizeof(*evt));
195
196 if (ret == TC_CRYPTO_FAIL) {
197 evt->status = BT_HCI_ERR_UNSPECIFIED;
198 (void)memset(evt->dhkey, 0xff, sizeof(evt->dhkey));
199 } else {
200 evt->status = 0U;
201 /* Convert from big-endian (provided by crypto API) to
202 * little-endian HCI.
203 */
204 sys_memcpy_swap(evt->dhkey, ecc.dhkey_be, sizeof(ecc.dhkey_be));
205 }
206
207 atomic_clear_bit(flags, PENDING_DHKEY);
208
209 bt_recv(buf);
210 }
211
ecc_process(struct k_work * work)212 static void ecc_process(struct k_work *work)
213 {
214 if (atomic_test_bit(flags, PENDING_PUB_KEY)) {
215 emulate_le_p256_public_key_cmd();
216 } else if (atomic_test_bit(flags, PENDING_DHKEY)) {
217 emulate_le_generate_dhkey();
218 } else {
219 __ASSERT(0, "Unhandled ECC command");
220 }
221 }
222
clear_ecc_events(struct net_buf * buf)223 static void clear_ecc_events(struct net_buf *buf)
224 {
225 struct bt_hci_cp_le_set_event_mask *cmd;
226
227 cmd = (void *)(buf->data + sizeof(struct bt_hci_cmd_hdr));
228
229 /*
230 * don't enable controller ECC events as those will be generated from
231 * emulation code
232 */
233 cmd->events[0] &= ~0x80; /* LE Read Local P-256 PKey Compl */
234 cmd->events[1] &= ~0x01; /* LE Generate DHKey Compl Event */
235 }
236
le_gen_dhkey(uint8_t * key,uint8_t key_type)237 static uint8_t le_gen_dhkey(uint8_t *key, uint8_t key_type)
238 {
239 if (atomic_test_bit(flags, PENDING_PUB_KEY)) {
240 return BT_HCI_ERR_CMD_DISALLOWED;
241 }
242
243 if (key_type > BT_HCI_LE_KEY_TYPE_DEBUG) {
244 return BT_HCI_ERR_INVALID_PARAM;
245 }
246
247 if (atomic_test_and_set_bit(flags, PENDING_DHKEY)) {
248 return BT_HCI_ERR_CMD_DISALLOWED;
249 }
250
251 /* Convert X and Y coordinates from little-endian HCI to
252 * big-endian (expected by the crypto API).
253 */
254 sys_memcpy_swap(ecc.public_key_be, key, BT_PUB_KEY_COORD_LEN);
255 sys_memcpy_swap(&ecc.public_key_be[BT_PUB_KEY_COORD_LEN], &key[BT_PUB_KEY_COORD_LEN],
256 BT_PUB_KEY_COORD_LEN);
257
258 atomic_set_bit_to(flags, USE_DEBUG_KEY,
259 key_type == BT_HCI_LE_KEY_TYPE_DEBUG);
260
261 bt_long_wq_submit(&ecc_work);
262
263 return BT_HCI_ERR_SUCCESS;
264 }
265
le_gen_dhkey_v1(struct net_buf * buf)266 static void le_gen_dhkey_v1(struct net_buf *buf)
267 {
268 struct bt_hci_cp_le_generate_dhkey *cmd;
269 uint8_t status;
270
271 cmd = (void *)buf->data;
272 status = le_gen_dhkey(cmd->key, BT_HCI_LE_KEY_TYPE_GENERATED);
273
274 net_buf_unref(buf);
275 send_cmd_status(BT_HCI_OP_LE_GENERATE_DHKEY, status);
276 }
277
le_gen_dhkey_v2(struct net_buf * buf)278 static void le_gen_dhkey_v2(struct net_buf *buf)
279 {
280 struct bt_hci_cp_le_generate_dhkey_v2 *cmd;
281 uint8_t status;
282
283 cmd = (void *)buf->data;
284 status = le_gen_dhkey(cmd->key, cmd->key_type);
285
286 net_buf_unref(buf);
287 send_cmd_status(BT_HCI_OP_LE_GENERATE_DHKEY_V2, status);
288 }
289
le_p256_pub_key(struct net_buf * buf)290 static void le_p256_pub_key(struct net_buf *buf)
291 {
292 uint8_t status;
293
294 net_buf_unref(buf);
295
296 if (atomic_test_bit(flags, PENDING_DHKEY)) {
297 status = BT_HCI_ERR_CMD_DISALLOWED;
298 } else if (atomic_test_and_set_bit(flags, PENDING_PUB_KEY)) {
299 status = BT_HCI_ERR_CMD_DISALLOWED;
300 } else {
301 bt_long_wq_submit(&ecc_work);
302 status = BT_HCI_ERR_SUCCESS;
303 }
304
305 send_cmd_status(BT_HCI_OP_LE_P256_PUBLIC_KEY, status);
306 }
307
bt_hci_ecc_send(struct net_buf * buf)308 int bt_hci_ecc_send(struct net_buf *buf)
309 {
310 if (bt_buf_get_type(buf) == BT_BUF_CMD) {
311 struct bt_hci_cmd_hdr *chdr = (void *)buf->data;
312
313 switch (sys_le16_to_cpu(chdr->opcode)) {
314 case BT_HCI_OP_LE_P256_PUBLIC_KEY:
315 net_buf_pull(buf, sizeof(*chdr));
316 le_p256_pub_key(buf);
317 return 0;
318 case BT_HCI_OP_LE_GENERATE_DHKEY:
319 net_buf_pull(buf, sizeof(*chdr));
320 le_gen_dhkey_v1(buf);
321 return 0;
322 case BT_HCI_OP_LE_GENERATE_DHKEY_V2:
323 net_buf_pull(buf, sizeof(*chdr));
324 le_gen_dhkey_v2(buf);
325 return 0;
326 case BT_HCI_OP_LE_SET_EVENT_MASK:
327 clear_ecc_events(buf);
328 break;
329 default:
330 break;
331 }
332 }
333
334 return bt_dev.drv->send(buf);
335 }
336
bt_hci_ecc_supported_commands(uint8_t * supported_commands)337 void bt_hci_ecc_supported_commands(uint8_t *supported_commands)
338 {
339 /* LE Read Local P-256 Public Key */
340 supported_commands[34] |= BIT(1);
341 /* LE Generate DH Key v1 */
342 supported_commands[34] |= BIT(2);
343 /* LE Generate DH Key v2 */
344 supported_commands[41] |= BIT(2);
345 }
346
default_CSPRNG(uint8_t * dst,unsigned int len)347 int default_CSPRNG(uint8_t *dst, unsigned int len)
348 {
349 return !bt_rand(dst, len);
350 }
351
