1 /*
2  * Copyright (c) 2020-2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *    http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 
17 #ifndef _CUT_AUTHENTICATE_
18 #ifdef _STORAGE_LITE_
19 
20 #include "hks_keyblob.h"
21 #include "hks_crypto_hal.h"
22 #include "hks_log.h"
23 #include "hks_mem.h"
24 #include "hks_param.h"
25 #include "hks_storage_adapter.h"
26 #include "hks_template.h"
27 
28 static const char g_deriveKekTag[] = "derive_key";
29 static const char g_deriveNonceTag[] = "derive_nonce";
30 
31 enum DeriveType {
32     DERIVE_KEK = 0,
33     DERIVE_NONCE = 1,
34 };
35 
HksBlobInit(struct HksBlob * blob,uint32_t size)36 static int32_t HksBlobInit(struct HksBlob *blob, uint32_t size)
37 {
38     blob->data = (uint8_t *)HksMalloc(size);
39     HKS_IF_NULL_LOGE_RETURN(blob->data, HKS_ERROR_MALLOC_FAIL, "malloc failed")
40 
41     blob->size = size;
42     return HKS_SUCCESS;
43 }
44 
GetSalt(enum DeriveType type,const struct HksBlob * random,struct HksBlob * salt)45 static int32_t GetSalt(enum DeriveType type, const struct HksBlob *random, struct HksBlob *salt)
46 {
47     struct HksBlob tag = { 0, NULL };
48     if (type == DERIVE_KEK) {
49         tag.size = strlen(g_deriveKekTag);
50         tag.data = (uint8_t *)g_deriveKekTag;
51     } else if (type == DERIVE_NONCE) {
52         tag.size = strlen(g_deriveNonceTag);
53         tag.data = (uint8_t *)g_deriveNonceTag;
54     }
55 
56     int32_t ret = HksBlobInit(salt, random->size + tag.size);
57     HKS_IF_NOT_SUCC_RETURN(ret, ret)
58 
59     if ((memcpy_s(salt->data, salt->size, random->data, random->size) != EOK) ||
60         (memcpy_s(salt->data + random->size, salt->size - random->size, tag.data, tag.size) != EOK)) {
61         HKS_FREE(salt->data);
62         return HKS_ERROR_INSUFFICIENT_MEMORY;
63     }
64     return ret;
65 }
66 
GetDeriveMaterial(enum DeriveType type,const struct HksBlob * random,struct HksBlob * derivedMaterial)67 static int32_t GetDeriveMaterial(enum DeriveType type, const struct HksBlob *random, struct HksBlob *derivedMaterial)
68 {
69     uint8_t keyBuf[HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256)] = {0};
70     struct HksBlob mk = { HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256), keyBuf };
71 
72     int32_t ret = HksCryptoHalGetMainKey(NULL, &mk);
73     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get kek failed, ret = %" LOG_PUBLIC "d", ret)
74 
75     struct HksBlob salt = { 0, NULL };
76     ret = GetSalt(type, random, &salt);
77     if (ret != HKS_SUCCESS) {
78         HKS_LOG_E("get salt failed, ret = %" LOG_PUBLIC "d", ret);
79         (void)memset_s(mk.data, mk.size, 0, mk.size);
80         return ret;
81     }
82 
83     struct HksKeyDerivationParam derParam = {
84         .salt = salt,
85         .iterations = HKS_KEY_BLOB_DERIVE_CNT,
86         .digestAlg = HKS_DIGEST_SHA256,
87     };
88     struct HksKeySpec derivationSpec = { HKS_ALG_PBKDF2, HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256), &derParam };
89     ret = HksCryptoHalDeriveKey(&mk, &derivationSpec, derivedMaterial);
90     HKS_IF_NOT_SUCC_LOGE(ret, "get keyblob derive material failed, type = %" LOG_PUBLIC "u", type)
91 
92     HKS_FREE_BLOB(salt);
93     (void)memset_s(mk.data, mk.size, 0, mk.size);
94     return ret;
95 }
96 
BuildKeyBlobUsageSpec(const struct HksBlob * cipherKey,const struct HksBlob * random,bool isEncrypt,struct HksUsageSpec * usageSpec)97 static int32_t BuildKeyBlobUsageSpec(const struct HksBlob *cipherKey, const struct HksBlob *random,
98     bool isEncrypt, struct HksUsageSpec *usageSpec)
99 {
100     usageSpec->mode = HKS_MODE_GCM;
101     usageSpec->padding = HKS_PADDING_NONE;
102     usageSpec->digest = HKS_DIGEST_NONE;
103     usageSpec->algType = HKS_ALG_AES;
104 
105     struct HksStoreKeyInfo *keyInfo = (struct HksStoreKeyInfo *)cipherKey->data;
106 
107     /* get nonce, derive from random + tag("derive_nonce") */
108     struct HksBlob nonce = { 0, NULL };
109     int32_t ret = HksBlobInit(&nonce, HKS_KEY_BLOB_NONCE_SIZE); /* need free by caller function */
110     HKS_IF_NOT_SUCC_RETURN(ret, ret)
111 
112     ret = GetDeriveMaterial(DERIVE_NONCE, random, &nonce);
113     if (ret != HKS_SUCCESS) {
114         HKS_LOG_E("get derive material nonce failed, ret = %" LOG_PUBLIC "d", ret);
115         HKS_FREE(nonce.data);
116         return ret;
117     }
118 
119     /* aad: from keyInfo->keySize to authId */
120     struct HksBlob aad = {
121         .size = sizeof(*keyInfo) - sizeof(keyInfo->keyInfoLen) + keyInfo->aliasSize + keyInfo->authIdSize,
122         .data = cipherKey->data + sizeof(keyInfo->keyInfoLen)
123     };
124 
125     struct HksAeadParam *aeadParam = (struct HksAeadParam *)usageSpec->algParam;
126     aeadParam->nonce = nonce;
127     aeadParam->aad = aad;
128     aeadParam->payloadLen = keyInfo->keySize - HKS_AE_TAG_LEN;
129 
130     if (isEncrypt) {
131         aeadParam->tagLenEnc = HKS_AE_TAG_LEN;
132     } else {
133         aeadParam->tagDec.data = cipherKey->data + keyInfo->keyInfoLen - HKS_AE_TAG_LEN; /* the last 16 bytes */
134         aeadParam->tagDec.size = HKS_AE_TAG_LEN;
135     }
136     return HKS_SUCCESS;
137 }
138 
EncryptAndDecryptKeyBlob(struct HksBlob * rawKey,struct HksBlob * cipherKey,bool isEncrypt)139 static int32_t EncryptAndDecryptKeyBlob(struct HksBlob *rawKey, struct HksBlob *cipherKey, bool isEncrypt)
140 {
141     struct HksStoreKeyInfo *keyInfo = (struct HksStoreKeyInfo *)cipherKey->data;
142     int32_t ret;
143 
144     /* 1. generate random */
145     struct HksBlob random = { HKS_DEFAULT_RANDOM_LEN, keyInfo->random };
146     if (isEncrypt) {
147         ret = HksCryptoHalFillRandom(&random);
148         HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get random failed")
149     }
150 
151     /* 2. get kek, derive from random + tag("derive_kek") */
152     uint8_t kekBuf[HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256)] = {0};
153     struct HksBlob kek = { HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256), kekBuf };
154     ret = GetDeriveMaterial(DERIVE_KEK, &random, &kek);
155     HKS_IF_NOT_SUCC_RETURN(ret, ret)
156 
157     /* 3. get usage spec */
158     struct HksAeadParam aeadParam = {0};
159     struct HksUsageSpec usageSpec = { .algParam = (void *)&aeadParam };
160     ret = BuildKeyBlobUsageSpec(cipherKey, &random, isEncrypt, &usageSpec);
161     if (ret != HKS_SUCCESS) {
162         (void)memset_s(kekBuf, HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256), 0, HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256));
163         return ret;
164     }
165 
166     /* 4. get encrypted/decrypted key */
167     struct HksBlob encKey = { keyInfo->keySize, cipherKey->data + keyInfo->keyInfoLen - keyInfo->keySize };
168     if (isEncrypt) {
169         struct HksBlob tag = { HKS_AE_TAG_LEN, cipherKey->data + keyInfo->keyInfoLen - HKS_AE_TAG_LEN };
170         ret = HksCryptoHalEncrypt(&kek, &usageSpec, rawKey, &encKey, &tag);
171     } else {
172         encKey.size -= HKS_AE_TAG_LEN; /* the decrypt len should remove the tag len */
173         ret = HksCryptoHalDecrypt(&kek, &usageSpec, &encKey, rawKey);
174     }
175     HKS_IF_NOT_SUCC_LOGE(ret, "cipher key[0x%" LOG_PUBLIC "x] failed, ret = %" LOG_PUBLIC "d", isEncrypt, ret)
176 
177     /* need clean kek buf */
178     (void)memset_s(kekBuf, HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256), 0, HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256));
179     HKS_FREE_BLOB(aeadParam.nonce);
180     return ret;
181 }
182 
EncryptKeyBlob(const struct HksBlob * rawKey,struct HksBlob * cipherKey)183 static int32_t EncryptKeyBlob(const struct HksBlob *rawKey, struct HksBlob *cipherKey)
184 {
185     return EncryptAndDecryptKeyBlob((struct HksBlob *)rawKey, cipherKey, true);
186 }
187 
DecryptKeyBlob(const struct HksBlob * cipherKey,struct HksBlob * rawKey)188 static int32_t DecryptKeyBlob(const struct HksBlob *cipherKey, struct HksBlob *rawKey)
189 {
190     return EncryptAndDecryptKeyBlob(rawKey, (struct HksBlob *)cipherKey, false);
191 }
192 
CopyKey(const struct HksBlob * key,struct HksBlob * adjustedKey)193 static int32_t CopyKey(const struct HksBlob *key, struct HksBlob *adjustedKey)
194 {
195     int32_t ret  = HksBlobInit(adjustedKey, key->size);
196     HKS_IF_NOT_SUCC_RETURN(ret, ret)
197 
198     if (memcpy_s(adjustedKey->data, adjustedKey->size, key->data, key->size) != EOK) {
199         HKS_FREE(adjustedKey->data);
200         return HKS_ERROR_INSUFFICIENT_MEMORY;
201     }
202     return ret;
203 }
204 
Ed25519BlobToKeyMaterial(const struct HksBlob * key,struct HksBlob * adjustedKey)205 static int32_t Ed25519BlobToKeyMaterial(const struct HksBlob *key, struct HksBlob *adjustedKey)
206 {
207     if (key->size != (HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256) << 1)) {
208         HKS_LOG_E("invalid keySize %" LOG_PUBLIC "u", key->size);
209         return HKS_ERROR_INVALID_KEY_FILE;
210     }
211 
212     int32_t ret  = HksBlobInit(adjustedKey, sizeof(struct KeyMaterial25519) +
213         (HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256) << 1));
214     HKS_IF_NOT_SUCC_RETURN(ret, ret)
215 
216     (void)memset_s(adjustedKey->data, adjustedKey->size, 0, adjustedKey->size);
217 
218     struct KeyMaterial25519 *keyMaterial = (struct KeyMaterial25519 *)adjustedKey->data;
219     keyMaterial->keyAlg = HKS_ALG_ED25519;
220     keyMaterial->keySize = HKS_CURVE25519_KEY_SIZE_256;
221     keyMaterial->pubKeySize = HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256);
222     keyMaterial->priKeySize = HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256);
223 
224     uint32_t offset = sizeof(*keyMaterial);
225     /* copy public key: the first 32 bytes of input key value; then private key: next 32 bytes */
226     if (memcpy_s(adjustedKey->data + offset, adjustedKey->size - offset,
227         key->data, (HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256) << 1)) != EOK) {
228         HKS_LOG_E("copy ed25519 public and private value failed");
229         (void)memset_s(adjustedKey->data, adjustedKey->size, 0, adjustedKey->size);
230         HKS_FREE(adjustedKey->data);
231         return HKS_ERROR_INSUFFICIENT_MEMORY;
232     }
233     return ret;
234 }
235 
Ed25519KeyMaterialToBlob(const struct HksBlob * key,struct HksBlob * adjustedKey)236 static int32_t Ed25519KeyMaterialToBlob(const struct HksBlob *key, struct HksBlob *adjustedKey)
237 {
238     if (key->size < sizeof(struct KeyMaterial25519)) {
239         HKS_LOG_E("key size invalid, size = %" LOG_PUBLIC "u smaller than struct size", key->size);
240         return HKS_ERROR_INVALID_KEY_INFO;
241     }
242 
243     struct KeyMaterial25519 *keyMaterial = (struct KeyMaterial25519 *)key->data;
244     if ((keyMaterial->pubKeySize != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256)) ||
245         (keyMaterial->priKeySize != HKS_KEY_BYTES(HKS_CURVE25519_KEY_SIZE_256)) ||
246         (key->size < (sizeof(*keyMaterial) + keyMaterial->pubKeySize + keyMaterial->priKeySize))) {
247         HKS_LOG_E("key size invalid, keySize = %" LOG_PUBLIC "u, pubSize %" LOG_PUBLIC "u, priSize %" LOG_PUBLIC "u",
248             key->size, keyMaterial->pubKeySize, keyMaterial->priKeySize);
249         return HKS_ERROR_INVALID_KEY_INFO;
250     }
251 
252     int32_t ret = HksBlobInit(adjustedKey, keyMaterial->priKeySize + keyMaterial->pubKeySize);
253     HKS_IF_NOT_SUCC_RETURN(ret, ret)
254 
255     /* 32 bytes pubkey first, then 32 bytes private key */
256     if (memcpy_s(adjustedKey->data, adjustedKey->size, key->data + sizeof(*keyMaterial),
257         keyMaterial->pubKeySize + keyMaterial->priKeySize) != EOK) {
258         HKS_LOG_E("copy pubKey and private key failed.");
259         HKS_FREE(adjustedKey->data);
260         return HKS_ERROR_INSUFFICIENT_MEMORY;
261     }
262     return ret;
263 }
264 
GetRawKeyMaterial(const struct HksBlob * key,struct HksBlob * rawKey)265 static int32_t GetRawKeyMaterial(const struct HksBlob *key, struct HksBlob *rawKey)
266 {
267     if (key->size < sizeof(struct HksStoreKeyInfo)) {
268         HKS_LOG_E("invalid key, size too small, size = %" LOG_PUBLIC "u", key->size);
269         return HKS_ERROR_INVALID_KEY_INFO;
270     }
271 
272     struct HksStoreKeyInfo *keyInfo = (struct HksStoreKeyInfo *)key->data;
273     if (HksIsKeyInfoLenInvalid(keyInfo)) {
274         HKS_LOG_E("invalid keyInfoBlob len");
275         return HKS_ERROR_INVALID_KEY_INFO;
276     }
277 
278     struct HksBlob tmpKey = { 0, NULL };
279     int32_t ret = HksBlobInit(&tmpKey, keyInfo->keySize);
280     HKS_IF_NOT_SUCC_RETURN(ret, ret)
281 
282     ret = DecryptKeyBlob(key, &tmpKey);
283     if (ret != HKS_SUCCESS) {
284         HKS_LOG_E("decrypt key blob failed, ret = %" LOG_PUBLIC "d", ret);
285         HKS_FREE_BLOB(tmpKey);
286         return ret;
287     }
288 
289     if ((keyInfo->keyAlg == HKS_ALG_ED25519) && (keyInfo->flag == HKS_KEY_FLAG_GENERATE_KEY)) {
290         ret = Ed25519BlobToKeyMaterial(&tmpKey, rawKey);
291     } else {
292         ret = CopyKey(&tmpKey, rawKey);
293     }
294     HKS_IF_NOT_SUCC_LOGE(ret, "operate failed, alg:%" LOG_PUBLIC "u, ret = %" LOG_PUBLIC "d", keyInfo->keyAlg, ret)
295 
296     (void)memset_s(tmpKey.data, tmpKey.size, 0, tmpKey.size);
297     HKS_FREE_BLOB(tmpKey);
298     return HKS_SUCCESS;
299 }
300 
HksGenerateKeyNode(const struct HksBlob * key)301 struct HksKeyNode *HksGenerateKeyNode(const struct HksBlob *key)
302 {
303     if (key->size > MAX_KEY_SIZE) {
304         HKS_LOG_E("invalid key blob size %" LOG_PUBLIC "x", key->size);
305         return NULL;
306     }
307     struct HksKeyNode *keyNode = (struct HksKeyNode *)HksMalloc(sizeof(struct HksKeyNode));
308     HKS_IF_NULL_LOGE_RETURN(keyNode, NULL, "malloc keynode failed")
309 
310     keyNode->refCnt = 1;
311     keyNode->status = HKS_KEYNODE_INACTIVE;
312     keyNode->handle = 0;
313 
314     int32_t ret;
315     do {
316         struct HksBlob rawKey = { 0, NULL };
317         ret = GetRawKeyMaterial(key, &rawKey);
318         HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "get raw key material failed, ret = %" LOG_PUBLIC "d", ret)
319 
320         struct HksParamSet *keyBlobParamSet = NULL;
321         ret = TranslateKeyInfoBlobToParamSet(&rawKey, key, &keyBlobParamSet);
322         (void)memset_s(rawKey.data, rawKey.size, 0, rawKey.size);
323         HKS_FREE_BLOB(rawKey);
324 
325         HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "translate key info to paramset failed, ret = %" LOG_PUBLIC "d", ret)
326 
327         keyNode->paramSet = keyBlobParamSet;
328     } while (0);
329 
330     if (ret != HKS_SUCCESS) {
331         HKS_FREE(keyNode);
332         return NULL;
333     }
334 
335     return keyNode;
336 }
337 
FillBaseInfo(const struct HksParamSet * paramSet,struct HksBlob * keyOut)338 static int32_t FillBaseInfo(const struct HksParamSet *paramSet, struct HksBlob *keyOut)
339 {
340     struct HksStoreKeyInfo *keyInfo = (struct HksStoreKeyInfo *)keyOut->data;
341     for (uint32_t i = 0; i < paramSet->paramsCnt; i++) {
342         switch (paramSet->params[i].tag) {
343             case HKS_TAG_ALGORITHM:
344                 keyInfo->keyAlg = paramSet->params[i].uint32Param;
345                 break;
346             case HKS_TAG_PADDING:
347                 keyInfo->padding = paramSet->params[i].uint32Param;
348                 break;
349             case HKS_TAG_DIGEST:
350                 keyInfo->digest = paramSet->params[i].uint32Param;
351                 break;
352             case HKS_TAG_BLOCK_MODE:
353                 keyInfo->keyMode = paramSet->params[i].uint32Param;
354                 break;
355             case HKS_TAG_PURPOSE:
356                 keyInfo->purpose = paramSet->params[i].uint32Param;
357                 break;
358             case HKS_TAG_KEY_SIZE:
359                 keyInfo->keyLen = paramSet->params[i].uint32Param;
360                 break;
361             case HKS_TAG_KEY_ROLE:
362                 keyInfo->role = paramSet->params[i].uint32Param;
363                 break;
364             case HKS_TAG_KEY_DOMAIN:
365                 keyInfo->domain = paramSet->params[i].uint32Param;
366                 break;
367             case HKS_TAG_KEY_AUTH_ID:
368                 if (paramSet->params[i].blob.size > HKS_MAX_KEY_AUTH_ID_LEN) {
369                     HKS_LOG_E("invlaid authId size %" LOG_PUBLIC "u", paramSet->params[i].blob.size);
370                     return HKS_ERROR_INVALID_ARGUMENT;
371                 }
372                 if (memcpy_s(keyOut->data + sizeof(*keyInfo) + keyInfo->aliasSize, HKS_MAX_KEY_AUTH_ID_LEN,
373                     paramSet->params[i].blob.data, paramSet->params[i].blob.size) != EOK) {
374                     HKS_LOG_E("memcpy key auth id failed");
375                     return HKS_ERROR_INSUFFICIENT_MEMORY;
376                 }
377                 keyInfo->authIdSize = paramSet->params[i].blob.size;
378                 break;
379             default:
380                 break;
381         }
382     }
383     return HKS_SUCCESS;
384 }
385 
FillStoreKeyInfo(const struct HksBlob * keyAlias,uint8_t keyFlag,const struct HksBlob * key,const struct HksParamSet * paramSet,struct HksBlob * keyOut)386 static int32_t FillStoreKeyInfo(const struct HksBlob *keyAlias, uint8_t keyFlag, const struct HksBlob *key,
387     const struct HksParamSet *paramSet, struct HksBlob *keyOut)
388 {
389     if ((keyAlias->size > HKS_MAX_KEY_ALIAS_LEN) || (key->size > HKS_MAX_KEY_LEN)) {
390         HKS_LOG_E("invalid keyAlias size %" LOG_PUBLIC "u, or key size %" LOG_PUBLIC "u", keyAlias->size, key->size);
391         return HKS_ERROR_INVALID_ARGUMENT;
392     }
393 
394     struct HksStoreKeyInfo *keyInfo = (struct HksStoreKeyInfo *)keyOut->data;
395     keyInfo->flag = keyFlag;
396     keyInfo->keySize = key->size + HKS_AE_TAG_LEN;
397 
398     /* 1. copy keyAlias */
399     if (memcpy_s(keyOut->data + sizeof(*keyInfo), HKS_MAX_KEY_ALIAS_LEN, keyAlias->data, keyAlias->size) != EOK) {
400         HKS_LOG_E("memcpy keyAlias failed");
401         return HKS_ERROR_INSUFFICIENT_MEMORY;
402     }
403     keyInfo->aliasSize = keyAlias->size;
404 
405     /* 2. copy keyAuthId, keyAlg, purpose ect. */
406     int32_t ret = FillBaseInfo(paramSet, keyOut);
407     HKS_IF_NOT_SUCC_RETURN(ret, ret)
408 
409     keyInfo->keyInfoLen = sizeof(*keyInfo) + keyInfo->aliasSize + keyInfo->authIdSize + keyInfo->keySize;
410 
411     /* 3. encrypt key */
412     ret = EncryptKeyBlob(key, keyOut);
413     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "encrypt key blob failed, ret = %" LOG_PUBLIC "d", ret)
414 
415     keyOut->size = keyInfo->keyInfoLen;
416 
417     return ret;
418 }
419 
AdjustKey(uint8_t keyFlag,const struct HksParamSet * paramSet,const struct HksBlob * key,struct HksBlob * adjustedKey)420 static int32_t AdjustKey(uint8_t keyFlag, const struct HksParamSet *paramSet,
421     const struct HksBlob *key, struct HksBlob *adjustedKey)
422 {
423     struct HksParam *algParam = NULL;
424     int32_t ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &algParam);
425     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get alg param failed")
426 
427     /* for storage-restricted products, when generate ed25519 key, only 64-byte private key can be stored */
428     if ((algParam->uint32Param == HKS_ALG_ED25519) && (keyFlag == HKS_KEY_FLAG_GENERATE_KEY)) {
429         ret = Ed25519KeyMaterialToBlob(key, adjustedKey);
430     } else {
431         ret = CopyKey(key, adjustedKey);
432     }
433     HKS_IF_NOT_SUCC_LOGE(ret,
434         "operate failed, alg = %" LOG_PUBLIC "u, ret = %" LOG_PUBLIC "d", algParam->uint32Param, ret)
435 
436     return ret;
437 }
438 
HksGetRawKey(const struct HksParamSet * paramSet,struct HksBlob * rawKey)439 int32_t HksGetRawKey(const struct HksParamSet *paramSet, struct HksBlob *rawKey)
440 {
441     struct HksParam *keyParam = NULL;
442     int32_t ret = HksGetParam(paramSet, HKS_TAG_KEY, &keyParam);
443     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "get key param failed!")
444 
445     uint8_t *data = HksMalloc(keyParam->blob.size);
446     HKS_IF_NULL_LOGE_RETURN(data, HKS_ERROR_MALLOC_FAIL, "fail to malloc raw key")
447 
448     (void)memcpy_s(data, keyParam->blob.size, keyParam->blob.data, keyParam->blob.size);
449 
450     rawKey->size = keyParam->blob.size;
451     rawKey->data = data;
452     return HKS_SUCCESS;
453 }
454 
HksBuildKeyBlob(const struct HksBlob * keyAlias,uint8_t keyFlag,const struct HksBlob * key,const struct HksParamSet * paramSet,struct HksBlob * keyOut)455 int32_t HksBuildKeyBlob(const struct HksBlob *keyAlias, uint8_t keyFlag, const struct HksBlob *key,
456     const struct HksParamSet *paramSet, struct HksBlob *keyOut)
457 {
458     struct HksBlob adjustedKey = { 0, NULL };
459     int32_t ret = AdjustKey(keyFlag, paramSet, key, &adjustedKey);
460     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "adjust key failed, ret = %" LOG_PUBLIC "d", ret)
461 
462     struct HksBlob tmpOut = { 0, NULL };
463     do {
464         uint32_t totalLen = sizeof(struct HksStoreKeyInfo) + HKS_MAX_KEY_ALIAS_LEN + HKS_MAX_KEY_AUTH_ID_LEN +
465             HKS_MAX_KEY_MATERIAL_LEN;
466         ret = HksBlobInit(&tmpOut, totalLen);
467         HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "hks blob init failed, ret = %" LOG_PUBLIC "d", ret)
468 
469         (void)memset_s(tmpOut.data, tmpOut.size, 0, tmpOut.size); /* need init 0 */
470 
471         ret = FillStoreKeyInfo(keyAlias, keyFlag, &adjustedKey, paramSet, &tmpOut);
472         HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "fill storage key info failed, ret = %" LOG_PUBLIC "d", ret)
473 
474         if (memcpy_s(keyOut->data, keyOut->size, tmpOut.data, tmpOut.size) != EOK) {
475             HKS_LOG_E("copy keyblob out failed!");
476             ret = HKS_ERROR_INSUFFICIENT_MEMORY;
477             break;
478         }
479         keyOut->size = tmpOut.size;
480     } while (0);
481 
482     (void)memset_s(adjustedKey.data, adjustedKey.size, 0, adjustedKey.size); /* need clean key */
483     HKS_FREE_BLOB(adjustedKey);
484     HKS_FREE_BLOB(tmpOut);
485     return ret;
486 }
487 
HksGetRawKeyMaterial(const struct HksBlob * key,struct HksBlob * rawKey)488 int32_t HksGetRawKeyMaterial(const struct HksBlob *key, struct HksBlob *rawKey)
489 {
490     return GetRawKeyMaterial(key, rawKey);
491 }
492 
HksTranslateKeyInfoBlobToParamSet(const struct HksBlob * key,const struct HksBlob * keyInfoBlob,struct HksParamSet ** paramSet)493 int32_t HksTranslateKeyInfoBlobToParamSet(const struct HksBlob *key, const struct HksBlob *keyInfoBlob,
494     struct HksParamSet **paramSet)
495 {
496     return TranslateKeyInfoBlobToParamSet(key, keyInfoBlob, paramSet);
497 }
498 
499 #endif /* _STORAGE_LITE_ */
500 #endif /* _CUT_AUTHENTICATE_ */
501