1 /*
2 * Copyright (c) 2021-2022, Arm Limited. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 *
6 */
7
8 #include "crypto.h"
9
10 #include <string.h>
11 #include "mbedtls/sha256.h"
12 #include "mbedtls/aes.h"
13 #include "mbedtls/memory_buffer_alloc.h"
14 #include "otp.h"
15
16 static int mbedtls_is_initialised = 0;
17 static uint8_t mbedtls_memory_buf[256];
18
mbedtls_init(uint8_t mbedtls_memory_buf[],size_t size)19 static void mbedtls_init(uint8_t mbedtls_memory_buf[], size_t size)
20 {
21 mbedtls_memory_buffer_alloc_init(mbedtls_memory_buf,
22 size);
23 }
24
bl1_sha256_compute(const uint8_t * data,size_t data_length,uint8_t * hash)25 int32_t bl1_sha256_compute(const uint8_t *data,
26 size_t data_length,
27 uint8_t *hash)
28 {
29 int rc = 0;
30 fih_int fih_rc;
31 mbedtls_sha256_context ctx;
32
33 if (!mbedtls_is_initialised) {
34 mbedtls_init(mbedtls_memory_buf, sizeof(mbedtls_memory_buf));
35 mbedtls_is_initialised = 1;
36 }
37
38 mbedtls_sha256_init(&ctx);
39
40 rc = mbedtls_sha256_starts(&ctx, 0);
41 fih_rc = fih_int_encode_zero_equality(rc);
42 if (fih_not_eq(fih_rc, FIH_SUCCESS)) {
43 goto out;
44 }
45
46 rc = mbedtls_sha256_update(&ctx, data, data_length);
47 fih_rc = fih_int_encode_zero_equality(rc);
48 if (fih_not_eq(fih_rc, FIH_SUCCESS)) {
49 goto out;
50 }
51
52 rc = mbedtls_sha256_finish(&ctx, hash);
53 fih_rc = fih_int_encode_zero_equality(rc);
54 if (fih_not_eq(fih_rc, FIH_SUCCESS)) {
55 goto out;
56 }
57
58 out:
59 mbedtls_sha256_free(&ctx);
60 FIH_RET(fih_rc);
61 }
62
bl1_aes_256_ctr_decrypt(enum tfm_bl1_key_id_t key_id,uint8_t * counter,const uint8_t * ciphertext,size_t ciphertext_length,uint8_t * plaintext)63 int32_t bl1_aes_256_ctr_decrypt(enum tfm_bl1_key_id_t key_id,
64 uint8_t *counter,
65 const uint8_t *ciphertext,
66 size_t ciphertext_length,
67 uint8_t *plaintext)
68 {
69 int rc = 0;
70 uint8_t stream_block[16];
71 uint8_t key_buf[32];
72 mbedtls_aes_context ctx;
73 size_t nc_off = 0;
74
75 if (ciphertext_length == 0) {
76 return 0;
77 }
78
79 if (ciphertext == NULL || plaintext == NULL || counter == NULL) {
80 return -2;
81 }
82
83 if (!mbedtls_is_initialised) {
84 mbedtls_init(mbedtls_memory_buf, sizeof(mbedtls_memory_buf));
85 mbedtls_is_initialised = 1;
86 }
87
88 mbedtls_aes_init(&ctx);
89 rc = otp_read_key(key_id, key_buf);
90 if (rc) {
91 goto out;
92 }
93
94 rc = mbedtls_aes_setkey_enc(&ctx, key_buf, 256);
95 if (rc) {
96 goto out;
97 }
98
99 rc = mbedtls_aes_crypt_ctr(&ctx, ciphertext_length, &nc_off, counter,
100 stream_block, ciphertext, plaintext);
101 if (rc) {
102 goto out;
103 }
104
105 out:
106 mbedtls_aes_free(&ctx);
107
108 memset(key_buf, 0, 32);
109 memset(stream_block, 0, 16);
110
111 return rc;
112 }
113
