1 /*
2 * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <assert.h>
8 #include <stddef.h>
9 #include <string.h>
10
11 /* mbed TLS headers */
12 #include <mbedtls/gcm.h>
13 #include <mbedtls/md.h>
14 #include <mbedtls/memory_buffer_alloc.h>
15 #include <mbedtls/oid.h>
16 #include <mbedtls/platform.h>
17 #include <mbedtls/version.h>
18 #include <mbedtls/x509.h>
19
20 #include <common/debug.h>
21 #include <drivers/auth/crypto_mod.h>
22 #include <drivers/auth/mbedtls/mbedtls_common.h>
23
24 #include <plat/common/platform.h>
25
26 #define LIB_NAME "mbed TLS"
27
28 #if CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
29 CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
30 /*
31 * CRYPTO_MD_MAX_SIZE value is as per current stronger algorithm available
32 * so make sure that mbed TLS MD maximum size must be lesser than this.
33 */
34 CASSERT(CRYPTO_MD_MAX_SIZE >= MBEDTLS_MD_MAX_SIZE,
35 assert_mbedtls_md_size_overflow);
36
37 #endif /* CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
38 CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
39
40 /*
41 * AlgorithmIdentifier ::= SEQUENCE {
42 * algorithm OBJECT IDENTIFIER,
43 * parameters ANY DEFINED BY algorithm OPTIONAL
44 * }
45 *
46 * SubjectPublicKeyInfo ::= SEQUENCE {
47 * algorithm AlgorithmIdentifier,
48 * subjectPublicKey BIT STRING
49 * }
50 *
51 * DigestInfo ::= SEQUENCE {
52 * digestAlgorithm AlgorithmIdentifier,
53 * digest OCTET STRING
54 * }
55 */
56
57 /*
58 * Initialize the library and export the descriptor
59 */
init(void)60 static void init(void)
61 {
62 /* Initialize mbed TLS */
63 mbedtls_init();
64 }
65
66 #if CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \
67 CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
68 /*
69 * Verify a signature.
70 *
71 * Parameters are passed using the DER encoding format following the ASN.1
72 * structures detailed above.
73 */
verify_signature(void * data_ptr,unsigned int data_len,void * sig_ptr,unsigned int sig_len,void * sig_alg,unsigned int sig_alg_len,void * pk_ptr,unsigned int pk_len)74 static int verify_signature(void *data_ptr, unsigned int data_len,
75 void *sig_ptr, unsigned int sig_len,
76 void *sig_alg, unsigned int sig_alg_len,
77 void *pk_ptr, unsigned int pk_len)
78 {
79 mbedtls_asn1_buf sig_oid, sig_params;
80 mbedtls_asn1_buf signature;
81 mbedtls_md_type_t md_alg;
82 mbedtls_pk_type_t pk_alg;
83 mbedtls_pk_context pk = {0};
84 int rc;
85 void *sig_opts = NULL;
86 const mbedtls_md_info_t *md_info;
87 unsigned char *p, *end;
88 unsigned char hash[MBEDTLS_MD_MAX_SIZE];
89
90 /* Get pointers to signature OID and parameters */
91 p = (unsigned char *)sig_alg;
92 end = (unsigned char *)(p + sig_alg_len);
93 rc = mbedtls_asn1_get_alg(&p, end, &sig_oid, &sig_params);
94 if (rc != 0) {
95 return CRYPTO_ERR_SIGNATURE;
96 }
97
98 /* Get the actual signature algorithm (MD + PK) */
99 rc = mbedtls_x509_get_sig_alg(&sig_oid, &sig_params, &md_alg, &pk_alg, &sig_opts);
100 if (rc != 0) {
101 return CRYPTO_ERR_SIGNATURE;
102 }
103
104 /* Parse the public key */
105 mbedtls_pk_init(&pk);
106 p = (unsigned char *)pk_ptr;
107 end = (unsigned char *)(p + pk_len);
108 rc = mbedtls_pk_parse_subpubkey(&p, end, &pk);
109 if (rc != 0) {
110 rc = CRYPTO_ERR_SIGNATURE;
111 goto end2;
112 }
113
114 /* Get the signature (bitstring) */
115 p = (unsigned char *)sig_ptr;
116 end = (unsigned char *)(p + sig_len);
117 signature.tag = *p;
118 rc = mbedtls_asn1_get_bitstring_null(&p, end, &signature.len);
119 if ((rc != 0) || ((size_t)(end - p) != signature.len)) {
120 rc = CRYPTO_ERR_SIGNATURE;
121 goto end1;
122 }
123 signature.p = p;
124
125 /* Calculate the hash of the data */
126 md_info = mbedtls_md_info_from_type(md_alg);
127 if (md_info == NULL) {
128 rc = CRYPTO_ERR_SIGNATURE;
129 goto end1;
130 }
131 p = (unsigned char *)data_ptr;
132 rc = mbedtls_md(md_info, p, data_len, hash);
133 if (rc != 0) {
134 rc = CRYPTO_ERR_SIGNATURE;
135 goto end1;
136 }
137
138 /* Verify the signature */
139 rc = mbedtls_pk_verify_ext(pk_alg, sig_opts, &pk, md_alg, hash,
140 mbedtls_md_get_size(md_info),
141 signature.p, signature.len);
142 if (rc != 0) {
143 rc = CRYPTO_ERR_SIGNATURE;
144 goto end1;
145 }
146
147 /* Signature verification success */
148 rc = CRYPTO_SUCCESS;
149
150 end1:
151 mbedtls_pk_free(&pk);
152 end2:
153 mbedtls_free(sig_opts);
154 return rc;
155 }
156
157 /*
158 * Match a hash
159 *
160 * Digest info is passed in DER format following the ASN.1 structure detailed
161 * above.
162 */
verify_hash(void * data_ptr,unsigned int data_len,void * digest_info_ptr,unsigned int digest_info_len)163 static int verify_hash(void *data_ptr, unsigned int data_len,
164 void *digest_info_ptr, unsigned int digest_info_len)
165 {
166 mbedtls_asn1_buf hash_oid, params;
167 mbedtls_md_type_t md_alg;
168 const mbedtls_md_info_t *md_info;
169 unsigned char *p, *end, *hash;
170 unsigned char data_hash[MBEDTLS_MD_MAX_SIZE];
171 size_t len;
172 int rc;
173
174 /*
175 * Digest info should be an MBEDTLS_ASN1_SEQUENCE, but padding after
176 * it is allowed. This is necessary to support multiple hash
177 * algorithms.
178 */
179 p = (unsigned char *)digest_info_ptr;
180 end = p + digest_info_len;
181 rc = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
182 MBEDTLS_ASN1_SEQUENCE);
183 if (rc != 0) {
184 return CRYPTO_ERR_HASH;
185 }
186
187 end = p + len;
188
189 /* Get the hash algorithm */
190 rc = mbedtls_asn1_get_alg(&p, end, &hash_oid, ¶ms);
191 if (rc != 0) {
192 return CRYPTO_ERR_HASH;
193 }
194
195 rc = mbedtls_oid_get_md_alg(&hash_oid, &md_alg);
196 if (rc != 0) {
197 return CRYPTO_ERR_HASH;
198 }
199
200 md_info = mbedtls_md_info_from_type(md_alg);
201 if (md_info == NULL) {
202 return CRYPTO_ERR_HASH;
203 }
204
205 /* Hash should be octet string type and consume all bytes */
206 rc = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING);
207 if ((rc != 0) || ((size_t)(end - p) != len)) {
208 return CRYPTO_ERR_HASH;
209 }
210
211 /* Length of hash must match the algorithm's size */
212 if (len != mbedtls_md_get_size(md_info)) {
213 return CRYPTO_ERR_HASH;
214 }
215 hash = p;
216
217 /* Calculate the hash of the data */
218 p = (unsigned char *)data_ptr;
219 rc = mbedtls_md(md_info, p, data_len, data_hash);
220 if (rc != 0) {
221 return CRYPTO_ERR_HASH;
222 }
223
224 /* Compare values */
225 rc = memcmp(data_hash, hash, mbedtls_md_get_size(md_info));
226 if (rc != 0) {
227 return CRYPTO_ERR_HASH;
228 }
229
230 return CRYPTO_SUCCESS;
231 }
232 #endif /* CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \
233 CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
234
235 #if CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
236 CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
237 /*
238 * Map a generic crypto message digest algorithm to the corresponding macro used
239 * by Mbed TLS.
240 */
md_type(enum crypto_md_algo algo)241 static inline mbedtls_md_type_t md_type(enum crypto_md_algo algo)
242 {
243 switch (algo) {
244 case CRYPTO_MD_SHA512:
245 return MBEDTLS_MD_SHA512;
246 case CRYPTO_MD_SHA384:
247 return MBEDTLS_MD_SHA384;
248 case CRYPTO_MD_SHA256:
249 return MBEDTLS_MD_SHA256;
250 default:
251 /* Invalid hash algorithm. */
252 return MBEDTLS_MD_NONE;
253 }
254 }
255
256 /*
257 * Calculate a hash
258 *
259 * output points to the computed hash
260 */
calc_hash(enum crypto_md_algo md_algo,void * data_ptr,unsigned int data_len,unsigned char output[CRYPTO_MD_MAX_SIZE])261 static int calc_hash(enum crypto_md_algo md_algo, void *data_ptr,
262 unsigned int data_len,
263 unsigned char output[CRYPTO_MD_MAX_SIZE])
264 {
265 const mbedtls_md_info_t *md_info;
266
267 md_info = mbedtls_md_info_from_type(md_type(md_algo));
268 if (md_info == NULL) {
269 return CRYPTO_ERR_HASH;
270 }
271
272 /*
273 * Calculate the hash of the data, it is safe to pass the
274 * 'output' hash buffer pointer considering its size is always
275 * bigger than or equal to MBEDTLS_MD_MAX_SIZE.
276 */
277 return mbedtls_md(md_info, data_ptr, data_len, output);
278 }
279 #endif /* CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
280 CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
281
282 #if TF_MBEDTLS_USE_AES_GCM
283 /*
284 * Stack based buffer allocation for decryption operation. It could
285 * be configured to balance stack usage vs execution speed.
286 */
287 #define DEC_OP_BUF_SIZE 128
288
aes_gcm_decrypt(void * data_ptr,size_t len,const void * key,unsigned int key_len,const void * iv,unsigned int iv_len,const void * tag,unsigned int tag_len)289 static int aes_gcm_decrypt(void *data_ptr, size_t len, const void *key,
290 unsigned int key_len, const void *iv,
291 unsigned int iv_len, const void *tag,
292 unsigned int tag_len)
293 {
294 mbedtls_gcm_context ctx;
295 mbedtls_cipher_id_t cipher = MBEDTLS_CIPHER_ID_AES;
296 unsigned char buf[DEC_OP_BUF_SIZE];
297 unsigned char tag_buf[CRYPTO_MAX_TAG_SIZE];
298 unsigned char *pt = data_ptr;
299 size_t dec_len;
300 int diff, i, rc;
301 size_t output_length __unused;
302
303 mbedtls_gcm_init(&ctx);
304
305 rc = mbedtls_gcm_setkey(&ctx, cipher, key, key_len * 8);
306 if (rc != 0) {
307 rc = CRYPTO_ERR_DECRYPTION;
308 goto exit_gcm;
309 }
310
311 #if (MBEDTLS_VERSION_MAJOR < 3)
312 rc = mbedtls_gcm_starts(&ctx, MBEDTLS_GCM_DECRYPT, iv, iv_len, NULL, 0);
313 #else
314 rc = mbedtls_gcm_starts(&ctx, MBEDTLS_GCM_DECRYPT, iv, iv_len);
315 #endif
316 if (rc != 0) {
317 rc = CRYPTO_ERR_DECRYPTION;
318 goto exit_gcm;
319 }
320
321 while (len > 0) {
322 dec_len = MIN(sizeof(buf), len);
323
324 #if (MBEDTLS_VERSION_MAJOR < 3)
325 rc = mbedtls_gcm_update(&ctx, dec_len, pt, buf);
326 #else
327 rc = mbedtls_gcm_update(&ctx, pt, dec_len, buf, sizeof(buf), &output_length);
328 #endif
329
330 if (rc != 0) {
331 rc = CRYPTO_ERR_DECRYPTION;
332 goto exit_gcm;
333 }
334
335 memcpy(pt, buf, dec_len);
336 pt += dec_len;
337 len -= dec_len;
338 }
339
340 #if (MBEDTLS_VERSION_MAJOR < 3)
341 rc = mbedtls_gcm_finish(&ctx, tag_buf, sizeof(tag_buf));
342 #else
343 rc = mbedtls_gcm_finish(&ctx, NULL, 0, &output_length, tag_buf, sizeof(tag_buf));
344 #endif
345
346 if (rc != 0) {
347 rc = CRYPTO_ERR_DECRYPTION;
348 goto exit_gcm;
349 }
350
351 /* Check tag in "constant-time" */
352 for (diff = 0, i = 0; i < tag_len; i++)
353 diff |= ((const unsigned char *)tag)[i] ^ tag_buf[i];
354
355 if (diff != 0) {
356 rc = CRYPTO_ERR_DECRYPTION;
357 goto exit_gcm;
358 }
359
360 /* GCM decryption success */
361 rc = CRYPTO_SUCCESS;
362
363 exit_gcm:
364 mbedtls_gcm_free(&ctx);
365 return rc;
366 }
367
368 /*
369 * Authenticated decryption of an image
370 */
auth_decrypt(enum crypto_dec_algo dec_algo,void * data_ptr,size_t len,const void * key,unsigned int key_len,unsigned int key_flags,const void * iv,unsigned int iv_len,const void * tag,unsigned int tag_len)371 static int auth_decrypt(enum crypto_dec_algo dec_algo, void *data_ptr,
372 size_t len, const void *key, unsigned int key_len,
373 unsigned int key_flags, const void *iv,
374 unsigned int iv_len, const void *tag,
375 unsigned int tag_len)
376 {
377 int rc;
378
379 assert((key_flags & ENC_KEY_IS_IDENTIFIER) == 0);
380
381 switch (dec_algo) {
382 case CRYPTO_GCM_DECRYPT:
383 rc = aes_gcm_decrypt(data_ptr, len, key, key_len, iv, iv_len,
384 tag, tag_len);
385 if (rc != 0)
386 return rc;
387 break;
388 default:
389 return CRYPTO_ERR_DECRYPTION;
390 }
391
392 return CRYPTO_SUCCESS;
393 }
394 #endif /* TF_MBEDTLS_USE_AES_GCM */
395
396 /*
397 * Register crypto library descriptor
398 */
399 #if CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
400 #if TF_MBEDTLS_USE_AES_GCM
401 REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, calc_hash,
402 auth_decrypt, NULL);
403 #else
404 REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, calc_hash,
405 NULL, NULL);
406 #endif
407 #elif CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY
408 #if TF_MBEDTLS_USE_AES_GCM
409 REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, NULL,
410 auth_decrypt, NULL);
411 #else
412 REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, NULL,
413 NULL, NULL);
414 #endif
415 #elif CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY
416 REGISTER_CRYPTO_LIB(LIB_NAME, init, NULL, NULL, calc_hash, NULL, NULL);
417 #endif /* CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
418
