AuroraMiddleware/mbedtls
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
5653da0201
mbedtls/library/psa_crypto_se.h

203 lines
6.9 KiB
C
Raw Normal View History

Implement the secure element driver registration function
2019-06-24 12:06:43 +00:00
/*
* PSA crypto support for secure element drivers
*/
Add Apache-2.0 headers to all source files Also normalize the first line of the copyright headers. This commit was generated using the following script: # ======================== #!/bin/sh # Find scripts find -path './.git' -prune -o '(' -name '*.c' -o -name '*.cpp' -o -name '*.fmt' -o -name '*.h' ')' -print | xargs sed -i ' # Normalize the first line of the copyright headers (no text on the first line of a block comment) /^\/\*.*Copyright.*Arm/I { i\ /* s/^\// / } /Copyright.*Arm/I { # Print copyright declaration p # Read the two lines immediately following the copyright declaration N N # Insert Apache header if it is missing /SPDX/! i\ * SPDX-License-Identifier: Apache-2.0\ *\ * Licensed under the Apache License, Version 2.0 (the "License"); you may\ * not use this file except in compliance with the License.\ * You may obtain a copy of the License at\ *\ * http://www.apache.org/licenses/LICENSE-2.0\ *\ * Unless required by applicable law or agreed to in writing, software\ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT\ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\ * See the License for the specific language governing permissions and\ * limitations under the License. # Clear copyright declaration from buffer D } ' # ======================== Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-06-15 09:59:37 +00:00
/*
Update copyright notices to use Linux Foundation guidance As a result, the copyright of contributors other than Arm is now acknowledged, and the years of publishing are no longer tracked in the source files. Also remove the now-redundant lines declaring that the files are part of MbedTLS. This commit was generated using the following script: # ======================== #!/bin/sh # Find files find '(' -path './.git' -o -path './3rdparty' ')' -prune -o -type f -print | xargs sed -bi ' # Replace copyright attribution line s/Copyright.*Arm.*/Copyright The Mbed TLS Contributors/I # Remove redundant declaration and the preceding line $!N /This file is part of Mbed TLS/Id P D ' # ======================== Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-08-07 11:07:28 +00:00
* Copyright The Mbed TLS Contributors
Implement the secure element driver registration function
2019-06-24 12:06:43 +00:00
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may
* not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef PSA_CRYPTO_SE_H
#define PSA_CRYPTO_SE_H
#if !defined(MBEDTLS_CONFIG_FILE)
#include "mbedtls/config.h"
#else
#include MBEDTLS_CONFIG_FILE
#endif
#include "psa/crypto.h"
#include "psa/crypto_se_driver.h"
Update SE support to pass a location when registering a driver Now that lifetimes have structures and secure element drivers handle all the lifetimes with a certain location, update driver registration to take a location as argument rather than a lifetime. This commit updates the Mbed TLS implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-09 22:44:04 +00:00
/** The maximum location value that this implementation supports
SE drivers: implement persistent storage Store the persistent data of secure element drivers. This is fully implemented, but not at all tested.
2019-07-23 15:38:08 +00:00
* for a secure element.
*
* This is not a characteristic that each PSA implementation has, but a
* limitation of the current implementation due to the constraints imposed
* by storage. See #PSA_CRYPTO_SE_DRIVER_ITS_UID_BASE.
*
Update SE support to pass a location when registering a driver Now that lifetimes have structures and secure element drivers handle all the lifetimes with a certain location, update driver registration to take a location as argument rather than a lifetime. This commit updates the Mbed TLS implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-09 22:44:04 +00:00
* The minimum location value for a secure element is 1, like on any
* PSA implementation (0 means a transparent key).
SE drivers: implement persistent storage Store the persistent data of secure element drivers. This is fully implemented, but not at all tested.
2019-07-23 15:38:08 +00:00
*/
Update SE support to pass a location when registering a driver Now that lifetimes have structures and secure element drivers handle all the lifetimes with a certain location, update driver registration to take a location as argument rather than a lifetime. This commit updates the Mbed TLS implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-09 22:44:04 +00:00
#define PSA_MAX_SE_LOCATION 255
SE drivers: implement persistent storage Store the persistent data of secure element drivers. This is fully implemented, but not at all tested.
2019-07-23 15:38:08 +00:00
/** The base of the range of ITS file identifiers for secure element
* driver persistent data.
*
psa: Use psa_key_file_id_t as the key id type The purpose of this commit and the following is for psa_key_id_t to always be as defined by the PSA Cryptography API specification. Currently psa_key_id_t departs from its specification definition when MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER configuration flag is set. In that configuration, it is set to be equal to psa_key_file_id_t which in that configuration encodes an owner identifier along the key identifier. Type psa_key_file_id_t was meant to be the key identifier type used throughout the library code. If MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER is set it includes both a key and owner identifier, otherwise it is equal to psa_key_id_t. It has not been the key identifier type throughout the library so far because when the PSA Cryptography specification was developped the library Doxygen documentation was used to generate the PSA Cryptography API specification thus the need to use psa_key_id_t and not psa_key_file_id_t. As this constraint does not hold anymore, move to psa_key_file_id_t as the key identifier type throughout the library code. By the way, this commit updates the key identifier initialization in the tests to be compatible with a composit key identifier. A psa_key_id_make() inline function is introduced to initialize key identifiers (composit ot not) at runtime. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-23 10:30:41 +00:00
* We use a slice of the implementation reserved range 0xffff0000..0xffffffff,
SE drivers: implement persistent storage Store the persistent data of secure element drivers. This is fully implemented, but not at all tested.
2019-07-23 15:38:08 +00:00
* specifically the range 0xfffffe00..0xfffffeff. The length of this range
Update SE support to pass a location when registering a driver Now that lifetimes have structures and secure element drivers handle all the lifetimes with a certain location, update driver registration to take a location as argument rather than a lifetime. This commit updates the Mbed TLS implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-09 22:44:04 +00:00
* drives the value of #PSA_MAX_SE_LOCATION. The identifier 0xfffffe00 is
* actually not used since it corresponds to #PSA_KEY_LOCATION_LOCAL_STORAGE
* which doesn't have a driver.
SE drivers: implement persistent storage Store the persistent data of secure element drivers. This is fully implemented, but not at all tested.
2019-07-23 15:38:08 +00:00
*/
Define always psa_key_id_t as defined in PSA crypto spec Define always psa_key_id_t as defined in the PSA Cryptography API specification independently of whether the MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER configuration file is set or not. As a consequence, get rid of `psa_app_key_id_t` that is not needed anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-23 14:07:42 +00:00
#define PSA_CRYPTO_SE_DRIVER_ITS_UID_BASE ( (psa_key_id_t) 0xfffffe00 )
SE drivers: implement persistent storage Store the persistent data of secure element drivers. This is fully implemented, but not at all tested.
2019-07-23 15:38:08 +00:00
Update SE support to pass a location when registering a driver Now that lifetimes have structures and secure element drivers handle all the lifetimes with a certain location, update driver registration to take a location as argument rather than a lifetime. This commit updates the Mbed TLS implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-09 22:44:04 +00:00
/** The maximum number of registered secure element driver locations. */
Implement the secure element driver registration function
2019-06-24 12:06:43 +00:00
#define PSA_MAX_SE_DRIVERS 4
Unregister drivers on library deinitialization
2019-06-24 12:34:43 +00:00
/** Unregister all secure element drivers.
*
* \warning Do not call this function while the library is in the initialized
* state. This function is only intended to be called at the end
* of mbedtls_psa_crypto_free().
*/
void psa_unregister_all_se_drivers( void );
SE driver: call the p_init method during psa_crypto_init()
2019-10-01 13:22:29 +00:00
/** Initialize all secure element drivers.
*
* Called from psa_crypto_init().
*/
psa_status_t psa_init_all_se_drivers( void );
SE driver lookup functions Expose the type of an entry in the SE driver table as an opaque type to other library modules. Soon, driver table entries will have state, and callers will need to be able to access this state through functions using this opaque type. Provide functions to look up a driver by its lifetime and to retrieve the method table from an entry.
2019-06-26 16:18:12 +00:00
/** A structure that describes a registered secure element driver.
*
* A secure element driver table entry contains a pointer to the
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
* driver's method table as well as the driver context structure.
SE driver lookup functions Expose the type of an entry in the SE driver table as an opaque type to other library modules. Soon, driver table entries will have state, and callers will need to be able to access this state through functions using this opaque type. Provide functions to look up a driver by its lifetime and to retrieve the method table from an entry.
2019-06-26 16:18:12 +00:00
*/
typedef struct psa_se_drv_table_entry_s psa_se_drv_table_entry_t;
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
/** Return the secure element driver information for a lifetime value.
*
* \param lifetime The lifetime value to query.
* \param[out] p_methods On output, if there is a driver,
* \c *methods points to its method table.
* Otherwise \c *methods is \c NULL.
* \param[out] p_drv_context On output, if there is a driver,
* \c *drv_context points to its context
* structure.
* Otherwise \c *drv_context is \c NULL.
*
* \retval 1
* \p lifetime corresponds to a registered driver.
* \retval 0
* \p lifetime does not correspond to a registered driver.
*/
int psa_get_se_driver( psa_key_lifetime_t lifetime,
const psa_drv_se_t **p_methods,
psa_drv_se_context_t **p_drv_context);
SE driver lookup functions Expose the type of an entry in the SE driver table as an opaque type to other library modules. Soon, driver table entries will have state, and callers will need to be able to access this state through functions using this opaque type. Provide functions to look up a driver by its lifetime and to retrieve the method table from an entry.
2019-06-26 16:18:12 +00:00
/** Return the secure element driver table entry for a lifetime value.
*
* \param lifetime The lifetime value to query.
*
* \return The driver table entry for \p lifetime, or
* \p NULL if \p lifetime does not correspond to a registered driver.
*/
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
psa_se_drv_table_entry_t *psa_get_se_driver_entry(
SE driver lookup functions Expose the type of an entry in the SE driver table as an opaque type to other library modules. Soon, driver table entries will have state, and callers will need to be able to access this state through functions using this opaque type. Provide functions to look up a driver by its lifetime and to retrieve the method table from an entry.
2019-06-26 16:18:12 +00:00
psa_key_lifetime_t lifetime );
/** Return the method table for a secure element driver.
*
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
* \param[in] driver The driver table entry to access, or \c NULL.
SE driver lookup functions Expose the type of an entry in the SE driver table as an opaque type to other library modules. Soon, driver table entries will have state, and callers will need to be able to access this state through functions using this opaque type. Provide functions to look up a driver by its lifetime and to retrieve the method table from an entry.
2019-06-26 16:18:12 +00:00
*
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
* \return The driver's method table.
* \c NULL if \p driver is \c NULL.
SE driver lookup functions Expose the type of an entry in the SE driver table as an opaque type to other library modules. Soon, driver table entries will have state, and callers will need to be able to access this state through functions using this opaque type. Provide functions to look up a driver by its lifetime and to retrieve the method table from an entry.
2019-06-26 16:18:12 +00:00
*/
const psa_drv_se_t *psa_get_se_driver_methods(
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
const psa_se_drv_table_entry_t *driver );
SE driver lookup functions Expose the type of an entry in the SE driver table as an opaque type to other library modules. Soon, driver table entries will have state, and callers will need to be able to access this state through functions using this opaque type. Provide functions to look up a driver by its lifetime and to retrieve the method table from an entry.
2019-06-26 16:18:12 +00:00
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
/** Return the context of a secure element driver.
SE driver lookup functions Expose the type of an entry in the SE driver table as an opaque type to other library modules. Soon, driver table entries will have state, and callers will need to be able to access this state through functions using this opaque type. Provide functions to look up a driver by its lifetime and to retrieve the method table from an entry.
2019-06-26 16:18:12 +00:00
*
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
* \param[in] driver The driver table entry to access, or \c NULL.
SE driver lookup functions Expose the type of an entry in the SE driver table as an opaque type to other library modules. Soon, driver table entries will have state, and callers will need to be able to access this state through functions using this opaque type. Provide functions to look up a driver by its lifetime and to retrieve the method table from an entry.
2019-06-26 16:18:12 +00:00
*
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
* \return A pointer to the driver context.
* \c NULL if \p driver is \c NULL.
SE driver lookup functions Expose the type of an entry in the SE driver table as an opaque type to other library modules. Soon, driver table entries will have state, and callers will need to be able to access this state through functions using this opaque type. Provide functions to look up a driver by its lifetime and to retrieve the method table from an entry.
2019-06-26 16:18:12 +00:00
*/
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
psa_drv_se_context_t *psa_get_se_driver_context(
psa_se_drv_table_entry_t *driver );
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
/** Find a free slot for a key that is to be created.
*
* This function calls the relevant method in the driver to find a suitable
* slot for a key with the given attributes.
*
* \param[in] attributes Metadata about the key that is about to be created.
* \param[in] driver The driver table entry to query.
* \param[out] slot_number On success, a slot number that is free in this
* secure element.
*/
psa_status_t psa_find_se_slot_for_key(
const psa_key_attributes_t *attributes,
Pass the key creation method to drivers Pass the key creation method (import/generate/derive/copy) to the driver methods to allocate or validate a slot number. This allows drivers to enforce policies such as "this key slot can only be used for keys generated inside the secure element".
2019-08-05 14:44:14 +00:00
psa_key_creation_method_t method,
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
psa_se_drv_table_entry_t *driver,
psa_key_slot_number_t *slot_number );
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 21:46:38 +00:00
/** Destoy a key in a secure element.
*
* This function calls the relevant driver method to destroy a key
* and updates the driver's persistent data.
*/
psa_status_t psa_destroy_se_key( psa_se_drv_table_entry_t *driver,
psa_key_slot_number_t slot_number );
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
/** Load the persistent data of a secure element driver.
*
* \param driver The driver table entry containing the persistent
* data to load from storage.
Update documentation The return values of the functions are updated in the documetation. All possible return values are added including nested functions' return values. The values which cannot be returned are removed. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-11-09 16:42:55 +00:00
*
* \return #PSA_SUCCESS
* \return #PSA_ERROR_NOT_SUPPORTED
* \return #PSA_ERROR_DOES_NOT_EXIST
* \return #PSA_ERROR_STORAGE_FAILURE
* \return #PSA_ERROR_DATA_CORRUPT
* \return #PSA_ERROR_INVALID_ARGUMENT
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
*/
psa_status_t psa_load_se_persistent_data(
const psa_se_drv_table_entry_t *driver );
/** Save the persistent data of a secure element driver.
*
* \param[in] driver The driver table entry containing the persistent
* data to save to storage.
Update documentation The return values of the functions are updated in the documetation. All possible return values are added including nested functions' return values. The values which cannot be returned are removed. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-11-09 16:42:55 +00:00
*
* \return #PSA_SUCCESS
* \return #PSA_ERROR_NOT_SUPPORTED
* \return #PSA_ERROR_NOT_PERMITTED
* \return #PSA_ERROR_NOT_SUPPORTED
* \return #PSA_ERROR_INSUFFICIENT_STORAGE
* \return #PSA_ERROR_STORAGE_FAILURE
* \return #PSA_ERROR_INVALID_ARGUMENT
Driver context manipulation functions Create the driver context when registering the driver. Implement some helper functions to access driver information.
2019-07-12 21:38:19 +00:00
*/
psa_status_t psa_save_se_persistent_data(
const psa_se_drv_table_entry_t *driver );
SE driver lookup functions Expose the type of an entry in the SE driver table as an opaque type to other library modules. Soon, driver table entries will have state, and callers will need to be able to access this state through functions using this opaque type. Provide functions to look up a driver by its lifetime and to retrieve the method table from an entry.
2019-06-26 16:18:12 +00:00
SE drivers: implement persistent storage Store the persistent data of secure element drivers. This is fully implemented, but not at all tested.
2019-07-23 15:38:08 +00:00
/** Destroy the persistent data of a secure element driver.
*
* This is currently only used for testing.
*
Update SE support to pass a location when registering a driver Now that lifetimes have structures and secure element drivers handle all the lifetimes with a certain location, update driver registration to take a location as argument rather than a lifetime. This commit updates the Mbed TLS implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-09 22:44:04 +00:00
* \param[in] location The location identifier for the driver whose
* persistent data is to be erased.
SE drivers: implement persistent storage Store the persistent data of secure element drivers. This is fully implemented, but not at all tested.
2019-07-23 15:38:08 +00:00
*/
Update SE support to pass a location when registering a driver Now that lifetimes have structures and secure element drivers handle all the lifetimes with a certain location, update driver registration to take a location as argument rather than a lifetime. This commit updates the Mbed TLS implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-09 22:44:04 +00:00
psa_status_t psa_destroy_se_persistent_data( psa_key_location_t location );
SE drivers: implement persistent storage Store the persistent data of secure element drivers. This is fully implemented, but not at all tested.
2019-07-23 15:38:08 +00:00
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
/** The storage representation of a key whose data is in a secure element.
*/
typedef struct
{
uint8_t slot_number[sizeof( psa_key_slot_number_t )];
} psa_se_key_data_storage_t;
Implement the secure element driver registration function
2019-06-24 12:06:43 +00:00
#endif /* PSA_CRYPTO_SE_H */
Reference in New Issue Copy Permalink