crypto: se050: core: elliptic curve implementation

Elliptic curve driver.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

1 files changed, 628 insertions, 0 deletions

diff --git a/core/drivers/crypto/se050/core/ecc.c b/core/drivers/crypto/se050/core/ecc.c
new file mode 100644
index 000000000..12f1b3cd8
--- /dev/null
+++ b/core/drivers/crypto/se050/core/ecc.c
@@ -0,0 +1,628 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * Copyright (C) Foundries Ltd. 2020 - All Rights Reserved
+ * Author: Jorge Ramirez <jorge@foundries.io>
+ */
+
+#include <assert.h>
+#include <der.h>
+#include <drvcrypt.h>
+#include <drvcrypt_acipher.h>
+#include <drvcrypt_math.h>
+#include <initcall.h>
+#include <se050.h>
+#include <string.h>
+#include <tee/cache.h>
+#include <tee/tee_cryp_utl.h>
+#include <tee_api_defines_extensions.h>
+#include <utee_defines.h>
+#include <util.h>
+
+static uint32_t algo_tee2se050(uint32_t algo)
+{
+        switch (algo) {
+        case TEE_ALG_ECDSA_P192:
+                return kAlgorithm_SSS_ECDSA_SHA1;
+        case TEE_ALG_ECDSA_P224:
+                return kAlgorithm_SSS_ECDSA_SHA224;
+        case TEE_ALG_ECDSA_P256:
+                return kAlgorithm_SSS_ECDSA_SHA256;
+        case TEE_ALG_ECDSA_P384:
+                return kAlgorithm_SSS_ECDSA_SHA384;
+        case TEE_ALG_ECDSA_P521:
+                return kAlgorithm_SSS_ECDSA_SHA512;
+        default:
+                EMSG("algorithm %#"PRIx32" not enabled", algo);
+                return kAlgorithm_None;
+        }
+}
+
+static uint32_t cipher_tee2se050(uint32_t curve)
+{
+        switch (curve) {
+        case TEE_ECC_CURVE_NIST_P192:
+        case TEE_ECC_CURVE_NIST_P224:
+        case TEE_ECC_CURVE_NIST_P256:
+        case TEE_ECC_CURVE_NIST_P384:
+        case TEE_ECC_CURVE_NIST_P521:
+                return kSSS_CipherType_EC_NIST_P;
+        default:
+                EMSG("cipher %#"PRIx32" not enabled", curve);
+                return kSSS_CipherType_NONE;
+        }
+}
+
+static uint32_t curve_tee2se050(uint32_t curve)
+{
+        switch (curve) {
+        case TEE_ECC_CURVE_NIST_P192:
+                return kSE05x_ECCurve_NIST_P192;
+        case TEE_ECC_CURVE_NIST_P224:
+                return kSE05x_ECCurve_NIST_P224;
+        case TEE_ECC_CURVE_NIST_P256:
+                return kSE05x_ECCurve_NIST_P256;
+        case TEE_ECC_CURVE_NIST_P384:
+                return kSE05x_ECCurve_NIST_P384;
+        case TEE_ECC_CURVE_NIST_P521:
+                return kSE05x_ECCurve_NIST_P521;
+        default:
+                EMSG("curve %#"PRIx32" not enabled", curve);
+                return kSE05x_ECCurve_NA;
+        }
+}
+
+static uint32_t curve_se0502tee(uint32_t curve)
+{
+        switch (curve) {
+        case kSE05x_ECCurve_NIST_P192:
+                return TEE_ECC_CURVE_NIST_P192;
+        case kSE05x_ECCurve_NIST_P224:
+                return TEE_ECC_CURVE_NIST_P224;
+        case kSE05x_ECCurve_NIST_P256:
+                return TEE_ECC_CURVE_NIST_P256;
+        case kSE05x_ECCurve_NIST_P384:
+                return TEE_ECC_CURVE_NIST_P384;
+        case kSE05x_ECCurve_NIST_P521:
+                return TEE_ECC_CURVE_NIST_P521;
+        default:
+                EMSG("curve %#"PRIx32" not enabled", curve);
+                return TEE_CRYPTO_ELEMENT_NONE;
+        }
+}
+
+static bool bn_alloc_max(struct bignum **s)
+{
+        *s = crypto_bignum_allocate(4096);
+
+        return *s;
+}
+
+static TEE_Result ecc_get_key_size(uint32_t curve, uint32_t algo,
+                                   size_t *bytes, size_t *bits)
+{
+        /*
+         * Note GPv1.1 indicates TEE_ALG_ECDH_NIST_P192_DERIVE_SHARED_SECRET
+         * but defines TEE_ALG_ECDH_P192
+         */
+        switch (curve) {
+        case TEE_ECC_CURVE_NIST_P192:
+                *bits = 192;
+                *bytes = 24;
+                if (algo && algo != TEE_ALG_ECDSA_P192 &&
+                    algo != TEE_ALG_ECDH_P192)
+                        return TEE_ERROR_BAD_PARAMETERS;
+                break;
+        case TEE_ECC_CURVE_NIST_P224:
+                *bits = 224;
+                *bytes = 28;
+                if (algo && algo != TEE_ALG_ECDSA_P224 &&
+                    algo != TEE_ALG_ECDH_P224)
+                        return TEE_ERROR_BAD_PARAMETERS;
+                break;
+        case TEE_ECC_CURVE_NIST_P256:
+                *bits = 256;
+                *bytes = 32;
+                if (algo && algo != TEE_ALG_ECDSA_P256 &&
+                    algo != TEE_ALG_ECDH_P256)
+                        return TEE_ERROR_BAD_PARAMETERS;
+                break;
+        case TEE_ECC_CURVE_NIST_P384:
+                *bits = 384;
+                *bytes = 48;
+                if (algo && algo != TEE_ALG_ECDSA_P384 &&
+                    algo != TEE_ALG_ECDH_P384)
+                        return TEE_ERROR_BAD_PARAMETERS;
+                break;
+        case TEE_ECC_CURVE_NIST_P521:
+                *bits = 521;
+                *bytes = 66;
+                if (algo && algo != TEE_ALG_ECDSA_P521 &&
+                    algo != TEE_ALG_ECDH_P521)
+                        return TEE_ERROR_BAD_PARAMETERS;
+                break;
+        default:
+                return TEE_ERROR_NOT_SUPPORTED;
+        }
+
+        return TEE_SUCCESS;
+}
+
+static TEE_Result ecc_get_msg_size(uint32_t algo, size_t *len)
+{
+        switch (algo) {
+        case kAlgorithm_SSS_ECDSA_SHA1:
+                *len = MIN((size_t)TEE_SHA1_HASH_SIZE, *len);
+                break;
+        case kAlgorithm_SSS_ECDSA_SHA224:
+                *len = MIN((size_t)TEE_SHA224_HASH_SIZE, *len);
+                break;
+        case kAlgorithm_SSS_ECDSA_SHA256:
+                *len = MIN((size_t)TEE_SHA256_HASH_SIZE, *len);
+                break;
+        case kAlgorithm_SSS_ECDSA_SHA384:
+                *len = MIN((size_t)TEE_SHA384_HASH_SIZE, *len);
+                break;
+        case kAlgorithm_SSS_ECDSA_SHA512:
+                *len = MIN((size_t)TEE_SHA512_HASH_SIZE, *len);
+                break;
+        default:
+                EMSG("invalid se050 %#"PRIx32" algorithm", algo);
+                return TEE_ERROR_BAD_PARAMETERS;
+        }
+
+        return TEE_SUCCESS;
+}
+
+static TEE_Result set_binary_data(struct bignum *b, size_t key_len, uint8_t **p,
+                                  size_t *len)
+{
+        size_t a = crypto_bignum_num_bytes(b);
+        uint8_t leading_zeros = 0;
+        uint8_t *q = NULL;
+
+        if (!a)
+                return TEE_ERROR_GENERIC;
+
+        if (a != key_len) {
+                leading_zeros = key_len - a;
+                a = key_len;
+        }
+
+        q = calloc(1, a);
+        if (!q)
+                return TEE_ERROR_OUT_OF_MEMORY;
+
+        crypto_bignum_bn2bin(b, q + leading_zeros);
+        *len = a;
+        *p = q;
+
+        return TEE_SUCCESS;
+}
+
+static TEE_Result se050_inject_public_key(sss_se05x_object_t *k_object,
+                                          struct ecc_public_key *key,
+                                          size_t key_len)
+{
+        struct se050_ecc_keypub key_bin = { };
+        TEE_Result ret = TEE_ERROR_GENERIC;
+        sss_status_t st = kStatus_SSS_Fail;
+        uint32_t oid = 0;
+
+        st = sss_se05x_key_object_init(k_object, se050_kstore);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_BAD_PARAMETERS;
+
+        st = se050_get_oid(kKeyObject_Mode_Transient, &oid);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_GENERIC;
+
+        st = sss_se05x_key_object_allocate_handle(k_object, oid,
+                                                  kSSS_KeyPart_Public,
+                                                  cipher_tee2se050(key->curve),
+                                                  0,
+                                                  kKeyObject_Mode_Transient);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_BAD_PARAMETERS;
+
+        ret = set_binary_data(key->x, key_len, &key_bin.x, &key_bin.x_len);
+        if (ret != TEE_SUCCESS)
+                return ret;
+
+        ret = set_binary_data(key->y, key_len, &key_bin.y, &key_bin.y_len);
+        if (ret != TEE_SUCCESS) {
+                free(key_bin.x);
+                return ret;
+        }
+
+        key_bin.curve = curve_tee2se050(key->curve);
+        st = se050_key_store_set_ecc_key_bin(se050_kstore, k_object, NULL,
+                                             &key_bin);
+        free(key_bin.x);
+        free(key_bin.y);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_BAD_PARAMETERS;
+
+        return TEE_SUCCESS;
+}
+
+static TEE_Result se050_inject_keypair(sss_se05x_object_t *k_object,
+                                       struct ecc_keypair *key,
+                                       size_t key_len)
+{
+        struct se050_ecc_keypair key_bin = { };
+        sss_status_t st = kStatus_SSS_Fail;
+        TEE_Result ret = TEE_ERROR_GENERIC;
+        uint32_t key_id = 0;
+        uint32_t oid = 0;
+
+        st = sss_se05x_key_object_init(k_object, se050_kstore);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_BAD_PARAMETERS;
+
+        key_id = se050_ecc_keypair_from_nvm(key);
+        if (key_id) {
+                st = sss_se05x_key_object_get_handle(k_object, key_id);
+                if (st != kStatus_SSS_Success)
+                        return TEE_ERROR_BAD_PARAMETERS;
+
+                return TEE_SUCCESS;
+        }
+
+        st = se050_get_oid(kKeyObject_Mode_Transient, &oid);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_GENERIC;
+
+        st = sss_se05x_key_object_allocate_handle(k_object, oid,
+                                                  kSSS_KeyPart_Pair,
+                                                  cipher_tee2se050(key->curve),
+                                                  0,
+                                                  kKeyObject_Mode_Transient);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_BAD_PARAMETERS;
+
+        ret = set_binary_data(key->d, key_len, &key_bin.d, &key_bin.d_len);
+        if (ret != TEE_SUCCESS)
+                return ret;
+
+        ret = set_binary_data(key->x, key_len,
+                              &key_bin.pub.x, &key_bin.pub.x_len);
+        if (ret != TEE_SUCCESS) {
+                free(key_bin.d);
+                return ret;
+        }
+
+        ret = set_binary_data(key->y, key_len,
+                              &key_bin.pub.y, &key_bin.pub.y_len);
+        if (ret != TEE_SUCCESS) {
+                free(key_bin.d);
+                free(key_bin.pub.x);
+                return ret;
+        }
+
+        key_bin.pub.curve = curve_tee2se050(key->curve);
+        st = se050_key_store_set_ecc_key_bin(se050_kstore, k_object, &key_bin,
+                                             NULL);
+        free(key_bin.d);
+        free(key_bin.pub.x);
+        free(key_bin.pub.y);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_BAD_PARAMETERS;
+
+        return TEE_SUCCESS;
+}
+
+static TEE_Result shared_secret(struct ecc_keypair *private_key,
+                                struct ecc_public_key *public_key,
+                                void *secret, size_t *secret_len)
+{
+        struct se050_ecc_keypub key = { };
+        sss_status_t st = kStatus_SSS_Fail;
+        TEE_Result ret = TEE_SUCCESS;
+        size_t key_bits = 0;
+        size_t key_bytes = 0;
+        size_t x1_len = 0;
+        size_t y1_len = 0;
+        size_t x2_len = 0;
+        uint32_t kid = 0;
+
+        if (private_key->curve != public_key->curve)
+                return TEE_ERROR_BAD_PARAMETERS;
+
+        kid = se050_ecc_keypair_from_nvm(private_key);
+        if (!kid) {
+                EMSG("private key must be stored in SE050 flash");
+                return TEE_ERROR_BAD_PARAMETERS;
+        }
+
+        /* validate input parameters */
+        x1_len = crypto_bignum_num_bytes(private_key->x);
+        y1_len = crypto_bignum_num_bytes(private_key->y);
+        x2_len = crypto_bignum_num_bytes(public_key->x);
+
+        ret = ecc_get_key_size(public_key->curve, 0, &key_bytes, &key_bits);
+        if (ret != TEE_SUCCESS)
+                return ret;
+
+        if (x1_len != y1_len || x1_len != key_bytes || x1_len != x2_len)
+                return TEE_ERROR_BAD_PARAMETERS;
+
+        /* prepare the public key (must be in raw format) */
+        ret = set_binary_data(public_key->x, x1_len, &key.x, &key.x_len);
+        if (ret != TEE_SUCCESS)
+                return ret;
+
+        ret = set_binary_data(public_key->y, y1_len, &key.y, &key.y_len);
+        if (ret != TEE_SUCCESS) {
+                free(key.x);
+                return ret;
+        }
+
+        st = se050_ecc_gen_shared_secret(&se050_session->s_ctx, kid, &key,
+                                         secret, secret_len);
+        free(key.x);
+        free(key.y);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_BAD_PARAMETERS;
+
+        return TEE_SUCCESS;
+}
+
+static TEE_Result sign(uint32_t algo, struct ecc_keypair *key,
+                       const uint8_t *msg, size_t msg_len,
+                       uint8_t *sig, size_t *sig_len)
+{
+        sss_status_t st = kStatus_SSS_Fail;
+        sss_se05x_asymmetric_t ctx = { };
+        sss_se05x_object_t kobject = { };
+        TEE_Result res = TEE_SUCCESS;
+        size_t key_bytes = 0;
+        size_t key_bits = 0;
+
+        res = ecc_get_key_size(key->curve, algo, &key_bytes, &key_bits);
+        if (res != TEE_SUCCESS)
+                goto exit;
+
+        /* se050 exports DER format */
+        if (*sig_len < (2 * key_bytes + DER_SIGNATURE_SZ)) {
+                *sig_len = 2 * key_bytes + DER_SIGNATURE_SZ;
+                res = TEE_ERROR_SHORT_BUFFER;
+                goto exit;
+        }
+
+        res = ecc_get_msg_size(algo_tee2se050(algo), &msg_len);
+        if (res != TEE_SUCCESS)
+                goto exit;
+
+        res = se050_inject_keypair(&kobject, key, key_bytes);
+        if (res != TEE_SUCCESS)
+                goto exit;
+
+        st = sss_se05x_asymmetric_context_init(&ctx, se050_session, &kobject,
+                                               algo_tee2se050(algo),
+                                               kMode_SSS_Sign);
+        if (st != kStatus_SSS_Success) {
+                res = TEE_ERROR_BAD_PARAMETERS;
+                goto exit;
+        }
+
+        st = sss_se05x_asymmetric_sign_digest(&ctx, (uint8_t *)msg, msg_len,
+                                              sig, sig_len);
+        if (st != kStatus_SSS_Success) {
+                EMSG("curve: %#"PRIx32, key->curve);
+                res = TEE_ERROR_BAD_PARAMETERS;
+                goto exit;
+        }
+
+        sss_se05x_signature_der2bin(sig, sig_len);
+exit:
+        if (!se050_ecc_keypair_from_nvm(key))
+                sss_se05x_key_store_erase_key(se050_kstore, &kobject);
+
+        sss_se05x_asymmetric_context_free(&ctx);
+
+        return res;
+}
+
+static TEE_Result verify(uint32_t algo, struct ecc_public_key *key,
+                         const uint8_t *msg, size_t msg_len,
+                         const uint8_t *sig, size_t sig_len)
+{
+        sss_status_t st = kStatus_SSS_Fail;
+        sss_se05x_asymmetric_t ctx = { };
+        sss_se05x_object_t kobject = { };
+        TEE_Result res = TEE_SUCCESS;
+        uint8_t signature[128];
+        size_t signature_len = sizeof(signature);
+        size_t key_bytes = 0;
+        size_t key_bits = 0;
+
+        res = ecc_get_key_size(key->curve, algo, &key_bytes, &key_bits);
+        if (res != TEE_SUCCESS)
+                goto exit;
+
+        res = ecc_get_msg_size(algo_tee2se050(algo), &msg_len);
+        if (res != TEE_SUCCESS)
+                goto exit;
+
+        res = se050_inject_public_key(&kobject, key, key_bytes);
+        if (res != TEE_SUCCESS)
+                goto exit;
+
+        st = sss_se05x_asymmetric_context_init(&ctx, se050_session, &kobject,
+                                               algo_tee2se050(algo),
+                                               kMode_SSS_Verify);
+        if (st != kStatus_SSS_Success) {
+                res = TEE_ERROR_BAD_PARAMETERS;
+                goto exit;
+        }
+
+        st = sss_se05x_signature_bin2der(signature, &signature_len,
+                                         (uint8_t *)sig, sig_len);
+        if (st != kStatus_SSS_Success) {
+                res = TEE_ERROR_BAD_PARAMETERS;
+                goto exit;
+        }
+
+        st = sss_se05x_asymmetric_verify_digest(&ctx, (uint8_t *)msg, msg_len,
+                                                (uint8_t *)signature,
+                                                signature_len);
+        if (st != kStatus_SSS_Success)
+                res = TEE_ERROR_SIGNATURE_INVALID;
+exit:
+        sss_se05x_key_store_erase_key(se050_kstore, &kobject);
+        sss_se05x_asymmetric_context_free(&ctx);
+
+        return res;
+}
+
+static TEE_Result gen_keypair(struct ecc_keypair *key, size_t key_size __unused)
+{
+        sss_status_t st = kStatus_SSS_Fail;
+        sss_se05x_object_t k_object = { };
+        TEE_Result ret = TEE_SUCCESS;
+        uint8_t kf[512] = { };
+        uint32_t oid = 0;
+        uint64_t kid = 0;
+        size_t bytes = 0;
+        size_t bits = 0;
+
+        ret = ecc_get_key_size(key->curve, 0, &bytes, &bits);
+        if (ret)
+                return ret;
+
+        st = sss_se05x_key_object_init(&k_object, se050_kstore);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_BAD_PARAMETERS;
+
+        st = se050_get_oid(kKeyObject_Mode_Persistent, &oid);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_GENERIC;
+
+        st = sss_se05x_key_object_allocate_handle(&k_object, oid,
+                                                  kSSS_KeyPart_Pair,
+                                                  cipher_tee2se050(key->curve),
+                                                  0,
+                                                  kKeyObject_Mode_Persistent);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_BAD_PARAMETERS;
+
+        st = sss_se05x_key_store_generate_key(se050_kstore, &k_object, bits,
+                                              &se050_asym_policy);
+        if (st != kStatus_SSS_Success)
+                return TEE_ERROR_BAD_PARAMETERS;
+
+        bytes = sizeof(kf);
+        st = se050_key_store_get_ecc_key_bin(se050_kstore, &k_object, kf,
+                                             &bytes);
+        if (st != kStatus_SSS_Success) {
+                sss_se05x_key_store_erase_key(se050_kstore, &k_object);
+                return TEE_ERROR_BAD_PARAMETERS;
+        }
+
+        /* skip the DER tag */
+        crypto_bignum_bin2bn(kf + 1, bytes / 2, key->x);
+        crypto_bignum_bin2bn(kf + 1 + bytes / 2, bytes / 2, key->y);
+
+        kid = se050_generate_private_key(oid);
+        crypto_bignum_bin2bn((uint8_t *)&kid, sizeof(kid), key->d);
+        key->curve = curve_se0502tee(k_object.curve_id);
+        if (key->curve != TEE_CRYPTO_ELEMENT_NONE)
+                return TEE_SUCCESS;
+
+        EMSG("ecc key generation failed");
+        sss_se05x_key_store_erase_key(se050_kstore, &k_object);
+
+        return TEE_ERROR_BAD_PARAMETERS;
+}
+
+static TEE_Result do_gen_keypair(struct ecc_keypair *key, size_t size_bytes)
+{
+        return gen_keypair(key, size_bytes);
+}
+
+static TEE_Result do_shared_secret(struct drvcrypt_secret_data *sdata)
+{
+        return shared_secret(sdata->key_priv,
+                             sdata->key_pub,
+                             sdata->secret.data,
+                             &sdata->secret.length);
+}
+
+static TEE_Result do_sign(struct drvcrypt_sign_data *sdata)
+{
+        return sign(sdata->algo,
+                    sdata->key,
+                    sdata->message.data,
+                    sdata->message.length,
+                    sdata->signature.data,
+                    &sdata->signature.length);
+}
+
+static TEE_Result do_verify(struct drvcrypt_sign_data *sdata)
+{
+        return verify(sdata->algo,
+                      sdata->key,
+                      sdata->message.data,
+                      sdata->message.length,
+                      sdata->signature.data,
+                      sdata->signature.length);
+}
+
+static TEE_Result do_alloc_keypair(struct ecc_keypair *s,
+                                   size_t size_bits __unused)
+{
+        memset(s, 0, sizeof(*s));
+        if (!bn_alloc_max(&s->d))
+                goto err;
+        if (!bn_alloc_max(&s->x))
+                goto err;
+        if (!bn_alloc_max(&s->y))
+                goto err;
+        return TEE_SUCCESS;
+err:
+        crypto_bignum_free(s->d);
+        crypto_bignum_free(s->x);
+        crypto_bignum_free(s->y);
+        return TEE_ERROR_OUT_OF_MEMORY;
+}
+
+static TEE_Result do_alloc_publickey(struct ecc_public_key *s,
+                                     size_t size_bits __unused)
+{
+        memset(s, 0, sizeof(*s));
+        if (!bn_alloc_max(&s->x))
+                goto err;
+        if (!bn_alloc_max(&s->y))
+                goto err;
+        return TEE_SUCCESS;
+err:
+        crypto_bignum_free(s->x);
+        crypto_bignum_free(s->y);
+        return TEE_ERROR_OUT_OF_MEMORY;
+}
+
+static void do_free_publickey(struct ecc_public_key *s)
+{
+        if (!s)
+                return;
+
+        crypto_bignum_free(s->x);
+        crypto_bignum_free(s->y);
+}
+
+static struct drvcrypt_ecc driver_ecc = {
+        .alloc_keypair = do_alloc_keypair,
+        .alloc_publickey = do_alloc_publickey,
+        .free_publickey = do_free_publickey,
+        .gen_keypair = do_gen_keypair,
+        .sign = do_sign,
+        .verify = do_verify,
+        .shared_secret = do_shared_secret,
+};
+
+static TEE_Result ecc_init(void)
+{
+        return drvcrypt_register_ecc(&driver_ecc);
+}
+
+driver_init_late(ecc_init);