Merge pull request #198 from ARMmbed/psa_crypto_its
PSA Crypto Storage backend implementation over PSA ITS APIs (#198)
This commit is contained in:
commit
3d5d8372a5
9 changed files with 261 additions and 4 deletions
|
@ -710,6 +710,16 @@
|
|||
*/
|
||||
//#define MBEDTLS_PSA_CRYPTO_SPM
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PSA_HAS_ITS_IO
|
||||
*
|
||||
* Enable the non-volatile secure storage usage.
|
||||
*
|
||||
* This is crucial on systems that do not have a HW TRNG support.
|
||||
*
|
||||
*/
|
||||
//#define MBEDTLS_PSA_HAS_ITS_IO
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_RSA_NO_CRT
|
||||
*
|
||||
|
@ -1529,7 +1539,9 @@
|
|||
*
|
||||
* Module: library/psa_crypto_storage.c
|
||||
*
|
||||
* Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C
|
||||
* Requires: MBEDTLS_PSA_CRYPTO_C and one of either
|
||||
* MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C or MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
|
||||
* (but not both)
|
||||
*
|
||||
*/
|
||||
#define MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
|
@ -1547,6 +1559,19 @@
|
|||
*/
|
||||
#define MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
|
||||
*
|
||||
* Enable persistent key storage over PSA ITS for the
|
||||
* Platform Security Architecture cryptography API.
|
||||
*
|
||||
* Module: library/psa_crypto_storage_its.c
|
||||
*
|
||||
* Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_HAS_ITS_IO
|
||||
*
|
||||
*/
|
||||
//#define MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_RIPEMD160_C
|
||||
*
|
||||
|
|
|
@ -506,9 +506,14 @@
|
|||
#error "MBEDTLS_PSA_CRYPTO_SPM defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) && defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C)
|
||||
#error "Only one of MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C or MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C can be defined"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \
|
||||
!( defined(MBEDTLS_PSA_CRYPTO_C) && \
|
||||
defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) )
|
||||
!( defined(MBEDTLS_PSA_CRYPTO_C) && \
|
||||
( defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) || \
|
||||
defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C) ) )
|
||||
#error "MBEDTLS_PSA_CRYPTO_STORAGE_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
|
@ -518,6 +523,11 @@
|
|||
#error "MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C) && \
|
||||
! defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
|
||||
#error "MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_RSA_C) && ( !defined(MBEDTLS_BIGNUM_C) || \
|
||||
!defined(MBEDTLS_OID_C) )
|
||||
#error "MBEDTLS_RSA_C defined, but not all prerequisites"
|
||||
|
|
|
@ -1173,6 +1173,16 @@
|
|||
*/
|
||||
//#define MBEDTLS_PSA_CRYPTO_SPM
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PSA_HAS_ITS_IO
|
||||
*
|
||||
* Enable the non-volatile secure storage usage.
|
||||
*
|
||||
* This is crucial on systems that do not have a HW TRNG support.
|
||||
*
|
||||
*/
|
||||
//#define MBEDTLS_PSA_HAS_ITS_IO
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_RSA_NO_CRT
|
||||
*
|
||||
|
@ -2623,7 +2633,9 @@
|
|||
*
|
||||
* Module: library/psa_crypto_storage.c
|
||||
*
|
||||
* Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C
|
||||
* Requires: MBEDTLS_PSA_CRYPTO_C and one of either
|
||||
* MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C or MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
|
||||
* (but not both)
|
||||
*
|
||||
*/
|
||||
#define MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
|
@ -2641,6 +2653,19 @@
|
|||
*/
|
||||
#define MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
|
||||
*
|
||||
* Enable persistent key storage over PSA ITS for the
|
||||
* Platform Security Architecture cryptography API.
|
||||
*
|
||||
* Module: library/psa_crypto_storage_its.c
|
||||
*
|
||||
* Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_HAS_ITS_IO
|
||||
*
|
||||
*/
|
||||
//#define MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_RIPEMD160_C
|
||||
*
|
||||
|
|
|
@ -56,6 +56,7 @@ set(src_crypto
|
|||
psa_crypto.c
|
||||
psa_crypto_storage.c
|
||||
psa_crypto_storage_file.c
|
||||
psa_crypto_storage_its.c
|
||||
ripemd160.c
|
||||
rsa.c
|
||||
rsa_internal.c
|
||||
|
|
|
@ -85,6 +85,7 @@ OBJS_CRYPTO= aes.o aesni.o arc4.o \
|
|||
psa_crypto.o \
|
||||
psa_crypto_storage.o \
|
||||
psa_crypto_storage_file.o \
|
||||
psa_crypto_storage_its.o \
|
||||
ripemd160.o rsa_internal.o rsa.o \
|
||||
sha1.o sha256.o sha512.o \
|
||||
threading.o timing.o version.o \
|
||||
|
|
184
library/psa_crypto_storage_its.c
Normal file
184
library/psa_crypto_storage_its.c
Normal file
|
@ -0,0 +1,184 @@
|
|||
/*
|
||||
* PSA storage backend for persistent keys using psa_its APIs.
|
||||
*/
|
||||
/* Copyright (C) 2018, ARM Limited, All Rights Reserved
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#if defined(MBEDTLS_CONFIG_FILE)
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#else
|
||||
#include "mbedtls/config.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C)
|
||||
|
||||
#include "psa/crypto.h"
|
||||
#include "psa_crypto_storage_backend.h"
|
||||
#include "psa_prot_internal_storage.h"
|
||||
|
||||
#if defined(MBEDTLS_PLATFORM_C)
|
||||
#include "mbedtls/platform.h"
|
||||
#endif
|
||||
|
||||
static psa_status_t its_to_psa_error( psa_its_status_t ret )
|
||||
{
|
||||
switch( ret )
|
||||
{
|
||||
case PSA_ITS_SUCCESS:
|
||||
return( PSA_SUCCESS );
|
||||
|
||||
case PSA_ITS_ERROR_KEY_NOT_FOUND:
|
||||
return( PSA_ERROR_EMPTY_SLOT );
|
||||
|
||||
case PSA_ITS_ERROR_STORAGE_FAILURE:
|
||||
return( PSA_ERROR_STORAGE_FAILURE );
|
||||
|
||||
case PSA_ITS_ERROR_INSUFFICIENT_SPACE:
|
||||
return( PSA_ERROR_INSUFFICIENT_STORAGE );
|
||||
|
||||
case PSA_ITS_ERROR_INVALID_KEY:
|
||||
case PSA_PS_ERROR_OFFSET_INVALID:
|
||||
case PSA_ITS_ERROR_INCORRECT_SIZE:
|
||||
case PSA_ITS_ERROR_BAD_POINTER:
|
||||
return( PSA_ERROR_INVALID_ARGUMENT );
|
||||
|
||||
case PSA_ITS_ERROR_FLAGS_NOT_SUPPORTED:
|
||||
return( PSA_ERROR_NOT_SUPPORTED );
|
||||
|
||||
case PSA_ITS_ERROR_WRITE_ONCE:
|
||||
return( PSA_ERROR_OCCUPIED_SLOT );
|
||||
|
||||
default:
|
||||
return( PSA_ERROR_UNKNOWN_ERROR );
|
||||
}
|
||||
}
|
||||
|
||||
static uint32_t psa_its_identifier_of_slot( psa_key_slot_t key )
|
||||
{
|
||||
return( key );
|
||||
}
|
||||
|
||||
psa_status_t psa_crypto_storage_load( const psa_key_slot_t key, uint8_t *data,
|
||||
size_t data_size )
|
||||
{
|
||||
psa_its_status_t ret;
|
||||
psa_status_t status;
|
||||
uint32_t data_identifier = psa_its_identifier_of_slot( key );
|
||||
struct psa_its_info_t data_identifier_info;
|
||||
|
||||
ret = psa_its_get_info( data_identifier, &data_identifier_info );
|
||||
status = its_to_psa_error( ret );
|
||||
if( status != PSA_SUCCESS )
|
||||
return( status );
|
||||
|
||||
ret = psa_its_get( data_identifier, 0, data_size, data );
|
||||
status = its_to_psa_error( ret );
|
||||
|
||||
return( status );
|
||||
}
|
||||
|
||||
int psa_is_key_present_in_storage( const psa_key_slot_t key )
|
||||
{
|
||||
psa_its_status_t ret;
|
||||
uint32_t data_identifier = psa_its_identifier_of_slot( key );
|
||||
struct psa_its_info_t data_identifier_info;
|
||||
|
||||
ret = psa_its_get_info( data_identifier, &data_identifier_info );
|
||||
|
||||
if( ret == PSA_ITS_ERROR_KEY_NOT_FOUND )
|
||||
return( 0 );
|
||||
return( 1 );
|
||||
}
|
||||
|
||||
psa_status_t psa_crypto_storage_store( const psa_key_slot_t key,
|
||||
const uint8_t *data,
|
||||
size_t data_length )
|
||||
{
|
||||
psa_its_status_t ret;
|
||||
psa_status_t status;
|
||||
uint32_t data_identifier = psa_its_identifier_of_slot( key );
|
||||
struct psa_its_info_t data_identifier_info;
|
||||
|
||||
if( psa_is_key_present_in_storage( key ) == 1 )
|
||||
return( PSA_ERROR_OCCUPIED_SLOT );
|
||||
|
||||
ret = psa_its_set( data_identifier, data_length, data, 0 );
|
||||
status = its_to_psa_error( ret );
|
||||
if( status != PSA_SUCCESS )
|
||||
{
|
||||
return( PSA_ERROR_STORAGE_FAILURE );
|
||||
}
|
||||
|
||||
ret = psa_its_get_info( data_identifier, &data_identifier_info );
|
||||
status = its_to_psa_error( ret );
|
||||
if( status != PSA_SUCCESS )
|
||||
{
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if( data_identifier_info.size != data_length )
|
||||
{
|
||||
status = PSA_ERROR_STORAGE_FAILURE;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
exit:
|
||||
if( status != PSA_SUCCESS )
|
||||
psa_its_remove( data_identifier );
|
||||
return( status );
|
||||
}
|
||||
|
||||
psa_status_t psa_destroy_persistent_key( const psa_key_slot_t key )
|
||||
{
|
||||
psa_its_status_t ret;
|
||||
uint32_t data_identifier = psa_its_identifier_of_slot( key );
|
||||
struct psa_its_info_t data_identifier_info;
|
||||
|
||||
ret = psa_its_get_info( data_identifier, &data_identifier_info );
|
||||
if( ret == PSA_ITS_ERROR_KEY_NOT_FOUND )
|
||||
return( PSA_SUCCESS );
|
||||
|
||||
if( psa_its_remove( data_identifier ) != PSA_ITS_SUCCESS )
|
||||
return( PSA_ERROR_STORAGE_FAILURE );
|
||||
|
||||
ret = psa_its_get_info( data_identifier, &data_identifier_info );
|
||||
if( ret != PSA_ITS_ERROR_KEY_NOT_FOUND )
|
||||
return( PSA_ERROR_STORAGE_FAILURE );
|
||||
|
||||
return( PSA_SUCCESS );
|
||||
}
|
||||
|
||||
psa_status_t psa_crypto_storage_get_data_length( const psa_key_slot_t key,
|
||||
size_t *data_length )
|
||||
{
|
||||
psa_its_status_t ret;
|
||||
psa_status_t status;
|
||||
uint32_t data_identifier = psa_its_identifier_of_slot( key );
|
||||
struct psa_its_info_t data_identifier_info;
|
||||
|
||||
ret = psa_its_get_info( data_identifier, &data_identifier_info );
|
||||
status = its_to_psa_error( ret );
|
||||
if( status != PSA_SUCCESS )
|
||||
return( status );
|
||||
|
||||
*data_length = (size_t) data_identifier_info.size;
|
||||
|
||||
return( PSA_SUCCESS );
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C */
|
|
@ -420,6 +420,9 @@ static const char *features[] = {
|
|||
#if defined(MBEDTLS_PSA_CRYPTO_SPM)
|
||||
"MBEDTLS_PSA_CRYPTO_SPM",
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_SPM */
|
||||
#if defined(MBEDTLS_PSA_HAS_ITS_IO)
|
||||
"MBEDTLS_PSA_HAS_ITS_IO",
|
||||
#endif /* MBEDTLS_PSA_HAS_ITS_IO */
|
||||
#if defined(MBEDTLS_RSA_NO_CRT)
|
||||
"MBEDTLS_RSA_NO_CRT",
|
||||
#endif /* MBEDTLS_RSA_NO_CRT */
|
||||
|
@ -693,6 +696,9 @@ static const char *features[] = {
|
|||
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C)
|
||||
"MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C",
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C */
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C)
|
||||
"MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C",
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C */
|
||||
#if defined(MBEDTLS_RIPEMD160_C)
|
||||
"MBEDTLS_RIPEMD160_C",
|
||||
#endif /* MBEDTLS_RIPEMD160_C */
|
||||
|
|
|
@ -97,6 +97,8 @@ MBEDTLS_PKCS11_C
|
|||
MBEDTLS_NO_UDBL_DIVISION
|
||||
MBEDTLS_NO_64BIT_MULTIPLICATION
|
||||
MBEDTLS_PSA_CRYPTO_SPM
|
||||
MBEDTLS_PSA_HAS_ITS_IO
|
||||
MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
|
||||
_ALT\s*$
|
||||
);
|
||||
|
||||
|
@ -118,6 +120,8 @@ MBEDTLS_PLATFORM_TIME_ALT
|
|||
MBEDTLS_PLATFORM_FPRINTF_ALT
|
||||
MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C
|
||||
MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
|
||||
MBEDTLS_PSA_HAS_ITS_IO
|
||||
);
|
||||
|
||||
# Things that should be enabled in "full" even if they match @excluded
|
||||
|
|
|
@ -291,6 +291,7 @@
|
|||
<ClCompile Include="..\..\library\psa_crypto.c" />
|
||||
<ClCompile Include="..\..\library\psa_crypto_storage.c" />
|
||||
<ClCompile Include="..\..\library\psa_crypto_storage_file.c" />
|
||||
<ClCompile Include="..\..\library\psa_crypto_storage_its.c" />
|
||||
<ClCompile Include="..\..\library\ripemd160.c" />
|
||||
<ClCompile Include="..\..\library\rsa.c" />
|
||||
<ClCompile Include="..\..\library\rsa_internal.c" />
|
||||
|
|
Loading…
Reference in a new issue