1 /*
2  *  PSA persistent key storage
3  */
4 /*
5  *  Copyright The Mbed TLS Contributors
6  *  SPDX-License-Identifier: Apache-2.0
7  *
8  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
9  *  not use this file except in compliance with the License.
10  *  You may obtain a copy of the License at
11  *
12  *  http://www.apache.org/licenses/LICENSE-2.0
13  *
14  *  Unless required by applicable law or agreed to in writing, software
15  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17  *  See the License for the specific language governing permissions and
18  *  limitations under the License.
19  */
20 
21 #include "common.h"
22 
23 #if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
24 
25 #include <stdlib.h>
26 #include <string.h>
27 
28 #include "psa/crypto.h"
29 #include "psa_crypto_storage.h"
30 #include "mbedtls/platform_util.h"
31 
32 #if defined(MBEDTLS_PSA_ITS_FILE_C)
33 #include "psa_crypto_its.h"
34 #else /* Native ITS implementation */
35 #include "psa/error.h"
36 #include "psa/internal_trusted_storage.h"
37 #endif
38 
39 #include "mbedtls/platform.h"
40 
41 
42 
43 /****************************************************************/
44 /* Key storage */
45 /****************************************************************/
46 
47 /* Determine a file name (ITS file identifier) for the given key identifier.
48  * The file name must be distinct from any file that is used for a purpose
49  * other than storing a key. Currently, the only such file is the random seed
50  * file whose name is PSA_CRYPTO_ITS_RANDOM_SEED_UID and whose value is
51  * 0xFFFFFF52. */
psa_its_identifier_of_slot(mbedtls_svc_key_id_t key)52 static psa_storage_uid_t psa_its_identifier_of_slot(mbedtls_svc_key_id_t key)
53 {
54 #if defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
55     /* Encode the owner in the upper 32 bits. This means that if
56      * owner values are nonzero (as they are on a PSA platform),
57      * no key file will ever have a value less than 0x100000000, so
58      * the whole range 0..0xffffffff is available for non-key files. */
59     uint32_t unsigned_owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(key);
60     return ((uint64_t) unsigned_owner_id << 32) |
61            MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key);
62 #else
63     /* Use the key id directly as a file name.
64      * psa_is_key_id_valid() in psa_crypto_slot_management.c
65      * is responsible for ensuring that key identifiers do not have a
66      * value that is reserved for non-key files. */
67     return key;
68 #endif
69 }
70 
71 /**
72  * \brief Load persistent data for the given key slot number.
73  *
74  * This function reads data from a storage backend and returns the data in a
75  * buffer.
76  *
77  * \param key               Persistent identifier of the key to be loaded. This
78  *                          should be an occupied storage location.
79  * \param[out] data         Buffer where the data is to be written.
80  * \param data_size         Size of the \c data buffer in bytes.
81  *
82  * \retval #PSA_SUCCESS \emptydescription
83  * \retval #PSA_ERROR_DATA_INVALID \emptydescription
84  * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription
85  * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
86  * \retval #PSA_ERROR_DOES_NOT_EXIST \emptydescription
87  */
psa_crypto_storage_load(const mbedtls_svc_key_id_t key,uint8_t * data,size_t data_size)88 static psa_status_t psa_crypto_storage_load(
89     const mbedtls_svc_key_id_t key, uint8_t *data, size_t data_size)
90 {
91     psa_status_t status;
92     psa_storage_uid_t data_identifier = psa_its_identifier_of_slot(key);
93     struct psa_storage_info_t data_identifier_info;
94     size_t data_length = 0;
95 
96     status = psa_its_get_info(data_identifier, &data_identifier_info);
97     if (status  != PSA_SUCCESS) {
98         return status;
99     }
100 
101     status = psa_its_get(data_identifier, 0, (uint32_t) data_size, data, &data_length);
102     if (data_size  != data_length) {
103         return PSA_ERROR_DATA_INVALID;
104     }
105 
106     return status;
107 }
108 
psa_is_key_present_in_storage(const mbedtls_svc_key_id_t key)109 int psa_is_key_present_in_storage(const mbedtls_svc_key_id_t key)
110 {
111     psa_status_t ret;
112     psa_storage_uid_t data_identifier = psa_its_identifier_of_slot(key);
113     struct psa_storage_info_t data_identifier_info;
114 
115     ret = psa_its_get_info(data_identifier, &data_identifier_info);
116 
117     if (ret == PSA_ERROR_DOES_NOT_EXIST) {
118         return 0;
119     }
120     return 1;
121 }
122 
123 /**
124  * \brief Store persistent data for the given key slot number.
125  *
126  * This function stores the given data buffer to a persistent storage.
127  *
128  * \param key           Persistent identifier of the key to be stored. This
129  *                      should be an unoccupied storage location.
130  * \param[in] data      Buffer containing the data to be stored.
131  * \param data_length   The number of bytes
132  *                      that make up the data.
133  *
134  * \retval #PSA_SUCCESS \emptydescription
135  * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription
136  * \retval #PSA_ERROR_ALREADY_EXISTS \emptydescription
137  * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
138  * \retval #PSA_ERROR_DATA_INVALID \emptydescription
139  */
psa_crypto_storage_store(const mbedtls_svc_key_id_t key,const uint8_t * data,size_t data_length)140 static psa_status_t psa_crypto_storage_store(const mbedtls_svc_key_id_t key,
141                                              const uint8_t *data,
142                                              size_t data_length)
143 {
144     psa_status_t status;
145     psa_storage_uid_t data_identifier = psa_its_identifier_of_slot(key);
146     struct psa_storage_info_t data_identifier_info;
147 
148     if (psa_is_key_present_in_storage(key) == 1) {
149         return PSA_ERROR_ALREADY_EXISTS;
150     }
151 
152     status = psa_its_set(data_identifier, (uint32_t) data_length, data, 0);
153     if (status != PSA_SUCCESS) {
154         return PSA_ERROR_DATA_INVALID;
155     }
156 
157     status = psa_its_get_info(data_identifier, &data_identifier_info);
158     if (status != PSA_SUCCESS) {
159         goto exit;
160     }
161 
162     if (data_identifier_info.size != data_length) {
163         status = PSA_ERROR_DATA_INVALID;
164         goto exit;
165     }
166 
167 exit:
168     if (status != PSA_SUCCESS) {
169         /* Remove the file in case we managed to create it but something
170          * went wrong. It's ok if the file doesn't exist. If the file exists
171          * but the removal fails, we're already reporting an error so there's
172          * nothing else we can do. */
173         (void) psa_its_remove(data_identifier);
174     }
175     return status;
176 }
177 
psa_destroy_persistent_key(const mbedtls_svc_key_id_t key)178 psa_status_t psa_destroy_persistent_key(const mbedtls_svc_key_id_t key)
179 {
180     psa_status_t ret;
181     psa_storage_uid_t data_identifier = psa_its_identifier_of_slot(key);
182     struct psa_storage_info_t data_identifier_info;
183 
184     ret = psa_its_get_info(data_identifier, &data_identifier_info);
185     if (ret == PSA_ERROR_DOES_NOT_EXIST) {
186         return PSA_SUCCESS;
187     }
188 
189     if (psa_its_remove(data_identifier) != PSA_SUCCESS) {
190         return PSA_ERROR_DATA_INVALID;
191     }
192 
193     ret = psa_its_get_info(data_identifier, &data_identifier_info);
194     if (ret != PSA_ERROR_DOES_NOT_EXIST) {
195         return PSA_ERROR_DATA_INVALID;
196     }
197 
198     return PSA_SUCCESS;
199 }
200 
201 /**
202  * \brief Get data length for given key slot number.
203  *
204  * \param key               Persistent identifier whose stored data length
205  *                          is to be obtained.
206  * \param[out] data_length  The number of bytes that make up the data.
207  *
208  * \retval #PSA_SUCCESS \emptydescription
209  * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
210  * \retval #PSA_ERROR_DOES_NOT_EXIST \emptydescription
211  * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription
212  */
psa_crypto_storage_get_data_length(const mbedtls_svc_key_id_t key,size_t * data_length)213 static psa_status_t psa_crypto_storage_get_data_length(
214     const mbedtls_svc_key_id_t key,
215     size_t *data_length)
216 {
217     psa_status_t status;
218     psa_storage_uid_t data_identifier = psa_its_identifier_of_slot(key);
219     struct psa_storage_info_t data_identifier_info;
220 
221     status = psa_its_get_info(data_identifier, &data_identifier_info);
222     if (status != PSA_SUCCESS) {
223         return status;
224     }
225 
226     *data_length = (size_t) data_identifier_info.size;
227 
228     return PSA_SUCCESS;
229 }
230 
231 /**
232  * Persistent key storage magic header.
233  */
234 #define PSA_KEY_STORAGE_MAGIC_HEADER "PSA\0KEY"
235 #define PSA_KEY_STORAGE_MAGIC_HEADER_LENGTH (sizeof(PSA_KEY_STORAGE_MAGIC_HEADER))
236 
237 typedef struct {
238     uint8_t magic[PSA_KEY_STORAGE_MAGIC_HEADER_LENGTH];
239     uint8_t version[4];
240     uint8_t lifetime[sizeof(psa_key_lifetime_t)];
241     uint8_t type[2];
242     uint8_t bits[2];
243     uint8_t policy[sizeof(psa_key_policy_t)];
244     uint8_t data_len[4];
245     uint8_t key_data[];
246 } psa_persistent_key_storage_format;
247 
psa_format_key_data_for_storage(const uint8_t * data,const size_t data_length,const psa_core_key_attributes_t * attr,uint8_t * storage_data)248 void psa_format_key_data_for_storage(const uint8_t *data,
249                                      const size_t data_length,
250                                      const psa_core_key_attributes_t *attr,
251                                      uint8_t *storage_data)
252 {
253     psa_persistent_key_storage_format *storage_format =
254         (psa_persistent_key_storage_format *) storage_data;
255 
256     memcpy(storage_format->magic, PSA_KEY_STORAGE_MAGIC_HEADER,
257            PSA_KEY_STORAGE_MAGIC_HEADER_LENGTH);
258     MBEDTLS_PUT_UINT32_LE(0, storage_format->version, 0);
259     MBEDTLS_PUT_UINT32_LE(attr->lifetime, storage_format->lifetime, 0);
260     MBEDTLS_PUT_UINT16_LE((uint16_t) attr->type, storage_format->type, 0);
261     MBEDTLS_PUT_UINT16_LE((uint16_t) attr->bits, storage_format->bits, 0);
262     MBEDTLS_PUT_UINT32_LE(attr->policy.usage, storage_format->policy, 0);
263     MBEDTLS_PUT_UINT32_LE(attr->policy.alg, storage_format->policy, sizeof(uint32_t));
264     MBEDTLS_PUT_UINT32_LE(attr->policy.alg2, storage_format->policy, 2 * sizeof(uint32_t));
265     MBEDTLS_PUT_UINT32_LE(data_length, storage_format->data_len, 0);
266     memcpy(storage_format->key_data, data, data_length);
267 }
268 
check_magic_header(const uint8_t * data)269 static psa_status_t check_magic_header(const uint8_t *data)
270 {
271     if (memcmp(data, PSA_KEY_STORAGE_MAGIC_HEADER,
272                PSA_KEY_STORAGE_MAGIC_HEADER_LENGTH) != 0) {
273         return PSA_ERROR_DATA_INVALID;
274     }
275     return PSA_SUCCESS;
276 }
277 
psa_parse_key_data_from_storage(const uint8_t * storage_data,size_t storage_data_length,uint8_t ** key_data,size_t * key_data_length,psa_core_key_attributes_t * attr)278 psa_status_t psa_parse_key_data_from_storage(const uint8_t *storage_data,
279                                              size_t storage_data_length,
280                                              uint8_t **key_data,
281                                              size_t *key_data_length,
282                                              psa_core_key_attributes_t *attr)
283 {
284     psa_status_t status;
285     const psa_persistent_key_storage_format *storage_format =
286         (const psa_persistent_key_storage_format *) storage_data;
287     uint32_t version;
288 
289     if (storage_data_length < sizeof(*storage_format)) {
290         return PSA_ERROR_DATA_INVALID;
291     }
292 
293     status = check_magic_header(storage_data);
294     if (status != PSA_SUCCESS) {
295         return status;
296     }
297 
298     version = MBEDTLS_GET_UINT32_LE(storage_format->version, 0);
299     if (version != 0) {
300         return PSA_ERROR_DATA_INVALID;
301     }
302 
303     *key_data_length = MBEDTLS_GET_UINT32_LE(storage_format->data_len, 0);
304     if (*key_data_length > (storage_data_length - sizeof(*storage_format)) ||
305         *key_data_length > PSA_CRYPTO_MAX_STORAGE_SIZE) {
306         return PSA_ERROR_DATA_INVALID;
307     }
308 
309     if (*key_data_length == 0) {
310         *key_data = NULL;
311     } else {
312         *key_data = mbedtls_calloc(1, *key_data_length);
313         if (*key_data == NULL) {
314             return PSA_ERROR_INSUFFICIENT_MEMORY;
315         }
316         memcpy(*key_data, storage_format->key_data, *key_data_length);
317     }
318 
319     attr->lifetime = MBEDTLS_GET_UINT32_LE(storage_format->lifetime, 0);
320     attr->type = MBEDTLS_GET_UINT16_LE(storage_format->type, 0);
321     attr->bits = MBEDTLS_GET_UINT16_LE(storage_format->bits, 0);
322     attr->policy.usage = MBEDTLS_GET_UINT32_LE(storage_format->policy, 0);
323     attr->policy.alg = MBEDTLS_GET_UINT32_LE(storage_format->policy, sizeof(uint32_t));
324     attr->policy.alg2 = MBEDTLS_GET_UINT32_LE(storage_format->policy, 2 * sizeof(uint32_t));
325 
326     return PSA_SUCCESS;
327 }
328 
psa_save_persistent_key(const psa_core_key_attributes_t * attr,const uint8_t * data,const size_t data_length)329 psa_status_t psa_save_persistent_key(const psa_core_key_attributes_t *attr,
330                                      const uint8_t *data,
331                                      const size_t data_length)
332 {
333     size_t storage_data_length;
334     uint8_t *storage_data;
335     psa_status_t status;
336 
337     /* All keys saved to persistent storage always have a key context */
338     if (data == NULL || data_length == 0) {
339         return PSA_ERROR_INVALID_ARGUMENT;
340     }
341 
342     if (data_length > PSA_CRYPTO_MAX_STORAGE_SIZE) {
343         return PSA_ERROR_INSUFFICIENT_STORAGE;
344     }
345     storage_data_length = data_length + sizeof(psa_persistent_key_storage_format);
346 
347     storage_data = mbedtls_calloc(1, storage_data_length);
348     if (storage_data == NULL) {
349         return PSA_ERROR_INSUFFICIENT_MEMORY;
350     }
351 
352     psa_format_key_data_for_storage(data, data_length, attr, storage_data);
353 
354     status = psa_crypto_storage_store(attr->id,
355                                       storage_data, storage_data_length);
356 
357     mbedtls_platform_zeroize(storage_data, storage_data_length);
358     mbedtls_free(storage_data);
359 
360     return status;
361 }
362 
psa_free_persistent_key_data(uint8_t * key_data,size_t key_data_length)363 void psa_free_persistent_key_data(uint8_t *key_data, size_t key_data_length)
364 {
365     if (key_data != NULL) {
366         mbedtls_platform_zeroize(key_data, key_data_length);
367     }
368     mbedtls_free(key_data);
369 }
370 
psa_load_persistent_key(psa_core_key_attributes_t * attr,uint8_t ** data,size_t * data_length)371 psa_status_t psa_load_persistent_key(psa_core_key_attributes_t *attr,
372                                      uint8_t **data,
373                                      size_t *data_length)
374 {
375     psa_status_t status = PSA_SUCCESS;
376     uint8_t *loaded_data;
377     size_t storage_data_length = 0;
378     mbedtls_svc_key_id_t key = attr->id;
379 
380     status = psa_crypto_storage_get_data_length(key, &storage_data_length);
381     if (status != PSA_SUCCESS) {
382         return status;
383     }
384 
385     loaded_data = mbedtls_calloc(1, storage_data_length);
386 
387     if (loaded_data == NULL) {
388         return PSA_ERROR_INSUFFICIENT_MEMORY;
389     }
390 
391     status = psa_crypto_storage_load(key, loaded_data, storage_data_length);
392     if (status != PSA_SUCCESS) {
393         goto exit;
394     }
395 
396     status = psa_parse_key_data_from_storage(loaded_data, storage_data_length,
397                                              data, data_length, attr);
398 
399     /* All keys saved to persistent storage always have a key context */
400     if (status == PSA_SUCCESS &&
401         (*data == NULL || *data_length == 0)) {
402         status = PSA_ERROR_STORAGE_FAILURE;
403     }
404 
405 exit:
406     mbedtls_platform_zeroize(loaded_data, storage_data_length);
407     mbedtls_free(loaded_data);
408     return status;
409 }
410 
411 
412 
413 /****************************************************************/
414 /* Transactions */
415 /****************************************************************/
416 
417 #if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
418 
419 psa_crypto_transaction_t psa_crypto_transaction;
420 
psa_crypto_save_transaction(void)421 psa_status_t psa_crypto_save_transaction(void)
422 {
423     struct psa_storage_info_t p_info;
424     psa_status_t status;
425     status = psa_its_get_info(PSA_CRYPTO_ITS_TRANSACTION_UID, &p_info);
426     if (status == PSA_SUCCESS) {
427         /* This shouldn't happen: we're trying to start a transaction while
428          * there is still a transaction that hasn't been replayed. */
429         return PSA_ERROR_CORRUPTION_DETECTED;
430     } else if (status != PSA_ERROR_DOES_NOT_EXIST) {
431         return status;
432     }
433     return psa_its_set(PSA_CRYPTO_ITS_TRANSACTION_UID,
434                        sizeof(psa_crypto_transaction),
435                        &psa_crypto_transaction,
436                        0);
437 }
438 
psa_crypto_load_transaction(void)439 psa_status_t psa_crypto_load_transaction(void)
440 {
441     psa_status_t status;
442     size_t length;
443     status = psa_its_get(PSA_CRYPTO_ITS_TRANSACTION_UID, 0,
444                          sizeof(psa_crypto_transaction),
445                          &psa_crypto_transaction, &length);
446     if (status != PSA_SUCCESS) {
447         return status;
448     }
449     if (length != sizeof(psa_crypto_transaction)) {
450         return PSA_ERROR_DATA_INVALID;
451     }
452     return PSA_SUCCESS;
453 }
454 
psa_crypto_stop_transaction(void)455 psa_status_t psa_crypto_stop_transaction(void)
456 {
457     psa_status_t status = psa_its_remove(PSA_CRYPTO_ITS_TRANSACTION_UID);
458     /* Whether or not updating the storage succeeded, the transaction is
459      * finished now. It's too late to go back, so zero out the in-memory
460      * data. */
461     memset(&psa_crypto_transaction, 0, sizeof(psa_crypto_transaction));
462     return status;
463 }
464 
465 #endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
466 
467 
468 
469 /****************************************************************/
470 /* Random generator state */
471 /****************************************************************/
472 
473 #if defined(MBEDTLS_PSA_INJECT_ENTROPY)
mbedtls_psa_storage_inject_entropy(const unsigned char * seed,size_t seed_size)474 psa_status_t mbedtls_psa_storage_inject_entropy(const unsigned char *seed,
475                                                 size_t seed_size)
476 {
477     psa_status_t status;
478     struct psa_storage_info_t p_info;
479 
480     status = psa_its_get_info(PSA_CRYPTO_ITS_RANDOM_SEED_UID, &p_info);
481 
482     if (PSA_ERROR_DOES_NOT_EXIST == status) { /* No seed exists */
483         status = psa_its_set(PSA_CRYPTO_ITS_RANDOM_SEED_UID, seed_size, seed, 0);
484     } else if (PSA_SUCCESS == status) {
485         /* You should not be here. Seed needs to be injected only once */
486         status = PSA_ERROR_NOT_PERMITTED;
487     }
488     return status;
489 }
490 #endif /* MBEDTLS_PSA_INJECT_ENTROPY */
491 
492 
493 
494 /****************************************************************/
495 /* The end */
496 /****************************************************************/
497 
498 #endif /* MBEDTLS_PSA_CRYPTO_STORAGE_C */
499