1 /*
2 * Copyright (c) 2015-2021, Arm Limited and Contributors. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <assert.h>
8
9 #include <common/debug.h>
10 #include <drivers/auth/crypto_mod.h>
11
12 /* Variable exported by the crypto library through REGISTER_CRYPTO_LIB() */
13
14 /*
15 * The crypto module is responsible for verifying digital signatures and hashes.
16 * It relies on a crypto library to perform the cryptographic operations.
17 *
18 * The crypto module itself does not impose any specific format on signatures,
19 * signature algorithm, keys or hashes, but most cryptographic libraries will
20 * take the parameters as the following DER encoded ASN.1 structures:
21 *
22 * AlgorithmIdentifier ::= SEQUENCE {
23 * algorithm OBJECT IDENTIFIER,
24 * parameters ANY DEFINED BY algorithm OPTIONAL
25 * }
26 *
27 * DigestInfo ::= SEQUENCE {
28 * digestAlgorithm AlgorithmIdentifier,
29 * digest OCTET STRING
30 * }
31 *
32 * SubjectPublicKeyInfo ::= SEQUENCE {
33 * algorithm AlgorithmIdentifier,
34 * subjectPublicKey BIT STRING
35 * }
36 *
37 * SignatureAlgorithm ::= AlgorithmIdentifier
38 *
39 * SignatureValue ::= BIT STRING
40 */
41
42 /*
43 * Perform some static checking and call the library initialization function
44 */
crypto_mod_init(void)45 void crypto_mod_init(void)
46 {
47 assert(crypto_lib_desc.name != NULL);
48 assert(crypto_lib_desc.init != NULL);
49 #if TRUSTED_BOARD_BOOT
50 assert(crypto_lib_desc.verify_signature != NULL);
51 assert(crypto_lib_desc.verify_hash != NULL);
52 #endif /* TRUSTED_BOARD_BOOT */
53 #if MEASURED_BOOT
54 assert(crypto_lib_desc.calc_hash != NULL);
55 #endif /* MEASURED_BOOT */
56
57 /* Initialize the cryptographic library */
58 crypto_lib_desc.init();
59 INFO("Using crypto library '%s'\n", crypto_lib_desc.name);
60 }
61
62 /*
63 * Function to verify a digital signature
64 *
65 * Parameters:
66 *
67 * data_ptr, data_len: signed data
68 * sig_ptr, sig_len: the digital signature
69 * sig_alg_ptr, sig_alg_len: the digital signature algorithm
70 * pk_ptr, pk_len: the public key
71 */
crypto_mod_verify_signature(void * data_ptr,unsigned int data_len,void * sig_ptr,unsigned int sig_len,void * sig_alg_ptr,unsigned int sig_alg_len,void * pk_ptr,unsigned int pk_len)72 int crypto_mod_verify_signature(void *data_ptr, unsigned int data_len,
73 void *sig_ptr, unsigned int sig_len,
74 void *sig_alg_ptr, unsigned int sig_alg_len,
75 void *pk_ptr, unsigned int pk_len)
76 {
77 assert(data_ptr != NULL);
78 assert(data_len != 0);
79 assert(sig_ptr != NULL);
80 assert(sig_len != 0);
81 assert(sig_alg_ptr != NULL);
82 assert(sig_alg_len != 0);
83 assert(pk_ptr != NULL);
84 assert(pk_len != 0);
85
86 return crypto_lib_desc.verify_signature(data_ptr, data_len,
87 sig_ptr, sig_len,
88 sig_alg_ptr, sig_alg_len,
89 pk_ptr, pk_len);
90 }
91
92 /*
93 * Verify a hash by comparison
94 *
95 * Parameters:
96 *
97 * data_ptr, data_len: data to be hashed
98 * digest_info_ptr, digest_info_len: hash to be compared
99 */
crypto_mod_verify_hash(void * data_ptr,unsigned int data_len,void * digest_info_ptr,unsigned int digest_info_len)100 int crypto_mod_verify_hash(void *data_ptr, unsigned int data_len,
101 void *digest_info_ptr, unsigned int digest_info_len)
102 {
103 assert(data_ptr != NULL);
104 assert(data_len != 0);
105 assert(digest_info_ptr != NULL);
106 assert(digest_info_len != 0);
107
108 return crypto_lib_desc.verify_hash(data_ptr, data_len,
109 digest_info_ptr, digest_info_len);
110 }
111
112 #if MEASURED_BOOT
113 /*
114 * Calculate a hash
115 *
116 * Parameters:
117 *
118 * alg: message digest algorithm
119 * data_ptr, data_len: data to be hashed
120 * output: resulting hash
121 */
crypto_mod_calc_hash(enum crypto_md_algo alg,void * data_ptr,unsigned int data_len,unsigned char output[CRYPTO_MD_MAX_SIZE])122 int crypto_mod_calc_hash(enum crypto_md_algo alg, void *data_ptr,
123 unsigned int data_len,
124 unsigned char output[CRYPTO_MD_MAX_SIZE])
125 {
126 assert(data_ptr != NULL);
127 assert(data_len != 0);
128 assert(output != NULL);
129
130 return crypto_lib_desc.calc_hash(alg, data_ptr, data_len, output);
131 }
132 #endif /* MEASURED_BOOT */
133
134 /*
135 * Authenticated decryption of data
136 *
137 * Parameters:
138 *
139 * dec_algo: authenticated decryption algorithm
140 * data_ptr, len: data to be decrypted (inout param)
141 * key, key_len, key_flags: symmetric decryption key
142 * iv, iv_len: initialization vector
143 * tag, tag_len: authentication tag
144 */
crypto_mod_auth_decrypt(enum crypto_dec_algo dec_algo,void * data_ptr,size_t len,const void * key,unsigned int key_len,unsigned int key_flags,const void * iv,unsigned int iv_len,const void * tag,unsigned int tag_len)145 int crypto_mod_auth_decrypt(enum crypto_dec_algo dec_algo, void *data_ptr,
146 size_t len, const void *key, unsigned int key_len,
147 unsigned int key_flags, const void *iv,
148 unsigned int iv_len, const void *tag,
149 unsigned int tag_len)
150 {
151 assert(crypto_lib_desc.auth_decrypt != NULL);
152 assert(data_ptr != NULL);
153 assert(len != 0U);
154 assert(key != NULL);
155 assert(key_len != 0U);
156 assert(iv != NULL);
157 assert((iv_len != 0U) && (iv_len <= CRYPTO_MAX_IV_SIZE));
158 assert(tag != NULL);
159 assert((tag_len != 0U) && (tag_len <= CRYPTO_MAX_TAG_SIZE));
160
161 return crypto_lib_desc.auth_decrypt(dec_algo, data_ptr, len, key,
162 key_len, key_flags, iv, iv_len, tag,
163 tag_len);
164 }
165
