1 /*
2 * Copyright (c) 2022, Arm Limited. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 *
6 */
7
8 #include "pq_crypto.h"
9 #include "crypto.h"
10 #include "mbedtls/lms.h"
11 #include "otp.h"
12 #include "mbedtls/md.h"
13 #include <string.h>
14
15 struct mbedtls_md_info_t {
16 const char *name;
17 mbedtls_md_type_t type;
18 unsigned char size;
19 unsigned char block_size;
20 };
21
22 const mbedtls_md_info_t mbedtls_sha256_info = {
23 "SHA256",
24 MBEDTLS_MD_SHA256,
25 32,
26 64,
27 };
28
mbedtls_md_info_from_type(mbedtls_md_type_t md_type)29 const mbedtls_md_info_t *mbedtls_md_info_from_type(mbedtls_md_type_t md_type)
30 {
31 return &mbedtls_sha256_info;
32 }
33
mbedtls_md_init(mbedtls_md_context_t * ctx)34 void mbedtls_md_init(mbedtls_md_context_t *ctx)
35 {
36 (void)ctx;
37
38 return;
39 }
40
mbedtls_md_setup(mbedtls_md_context_t * ctx,const mbedtls_md_info_t * md_info,int hmac)41 int mbedtls_md_setup(mbedtls_md_context_t *ctx,
42 const mbedtls_md_info_t *md_info, int hmac)
43 {
44 (void)ctx;
45 (void)md_info;
46 (void)hmac;
47
48 return 0;
49 }
50
mbedtls_md_starts(mbedtls_md_context_t * ctx)51 int mbedtls_md_starts(mbedtls_md_context_t *ctx)
52 {
53 (void)ctx;
54
55 return fih_int_decode(bl1_sha256_init());
56 }
57
mbedtls_md_update(mbedtls_md_context_t * ctx,const unsigned char * input,size_t ilen)58 int mbedtls_md_update(mbedtls_md_context_t *ctx, const unsigned char *input,
59 size_t ilen)
60 {
61 (void)ctx;
62
63 return fih_int_decode(bl1_sha256_update((unsigned char *)input, ilen));
64 }
65
mbedtls_md_finish(mbedtls_md_context_t * ctx,unsigned char * output)66 int mbedtls_md_finish(mbedtls_md_context_t *ctx, unsigned char *output)
67 {
68 (void)ctx;
69
70 return fih_int_decode(bl1_sha256_finish(output));
71 }
72
mbedtls_md_free(mbedtls_md_context_t * ctx)73 void mbedtls_md_free(mbedtls_md_context_t *ctx)
74 {
75 return;
76 }
77
pq_crypto_verify(enum tfm_bl1_key_id_t key,const uint8_t * data,size_t data_length,const uint8_t * signature,size_t signature_length)78 fih_int pq_crypto_verify(enum tfm_bl1_key_id_t key,
79 const uint8_t *data,
80 size_t data_length,
81 const uint8_t *signature,
82 size_t signature_length)
83 {
84 int rc;
85 fih_int fih_rc;
86 mbedtls_lms_context ctx;
87 uint8_t key_buf[MBEDTLS_LMS_PUBKEY_LEN];
88
89 FIH_CALL(bl1_otp_read_key, fih_rc, key, key_buf);
90 if (fih_not_eq(fih_rc, FIH_SUCCESS)) {
91 FIH_RET(FIH_FAILURE);
92 }
93
94 mbedtls_lms_init(&ctx);
95
96 rc = mbedtls_lms_set_algorithm_type(&ctx, MBEDTLS_LMS_SHA256_M32_H10,
97 MBEDTLS_LMOTS_SHA256_N32_W8);
98 fih_rc = fih_int_encode_zero_equality(rc);
99 if (fih_not_eq(fih_rc, FIH_SUCCESS)) {
100 fih_rc = FIH_FAILURE;
101 goto out;
102 }
103
104 rc = mbedtls_lms_import_pubkey(&ctx, key_buf);
105 fih_rc = fih_int_encode_zero_equality(rc);
106 if (fih_not_eq(fih_rc, FIH_SUCCESS)) {
107 fih_rc = FIH_FAILURE;
108 goto out;
109 }
110
111 rc = mbedtls_lms_verify(&ctx, data, data_length, signature);
112 fih_rc = fih_int_encode_zero_equality(rc);
113
114 out:
115 mbedtls_lms_free(&ctx);
116 FIH_RET(fih_rc);
117 }
118
