1 /*
2 * Copyright (c) 2020-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #ifndef _CUT_AUTHENTICATE_
17 #include "hks_rkc_rw.h"
18
19 #include "hks_crypto_hal.h"
20 #include "hks_get_process_info.h"
21 #include "hks_log.h"
22 #include "hks_mem.h"
23 #include "hks_param.h"
24 #include "hks_rkc.h"
25 #include "hks_storage_manager.h"
26 #include "hks_template.h"
27
28 #define HKS_RKC_HASH_LEN 32 /* the hash value length of root key component */
29 #define HKS_KSF_BUF_LEN 258 /* the length of rkc or mk keystore buffer */
30 #define USER_ID_ROOT_DEFAULT "0"
31
32 /* the flag of keystore file, used to identify files as HKS keystore file, don't modify. */
33 const uint8_t g_hksRkcKsfFlag[HKS_RKC_KSF_FLAG_LEN] = { 0x5F, 0x64, 0x97, 0x8D, 0x19, 0x4F, 0x89, 0xCF };
34
GetProcessInfo(struct HksProcessInfo * processInfo)35 int32_t GetProcessInfo(struct HksProcessInfo *processInfo)
36 {
37 char *userId = NULL;
38 char *processName = NULL;
39
40 HKS_IF_NOT_SUCC_LOGE_RETURN(HksGetUserId(&userId), HKS_ERROR_INTERNAL_ERROR, "get user id failed")
41 HKS_IF_NOT_SUCC_LOGE_RETURN(HksGetProcessName(&processName), HKS_ERROR_INTERNAL_ERROR, "get process name failed")
42
43 processInfo->userId.size = strlen(userId);
44 processInfo->userId.data = (uint8_t *)userId;
45 processInfo->processName.size = strlen(processName);
46 processInfo->processName.data = (uint8_t *)processName;
47 processInfo->userIdInt = 0;
48 processInfo->accessTokenId = 0;
49
50 return HKS_SUCCESS;
51 }
52
GetKeyBlobKsf(const char * ksfName,struct HksBlob * tmpKsf)53 int32_t GetKeyBlobKsf(const char *ksfName, struct HksBlob *tmpKsf)
54 {
55 if (ksfName == NULL || tmpKsf == NULL) {
56 HKS_LOG_E("Input argument ksfName or tmpKsf is null");
57 return HKS_ERROR_NULL_POINTER;
58 }
59
60 tmpKsf->data = (uint8_t *)HksMalloc(HKS_KSF_BUF_LEN);
61 HKS_IF_NULL_RETURN(tmpKsf->data, HKS_ERROR_MALLOC_FAIL)
62
63 tmpKsf->size = HKS_KSF_BUF_LEN;
64 (void)memset_s(tmpKsf->data, tmpKsf->size, 0, tmpKsf->size);
65
66 int32_t ret;
67 struct HksParamSet *paramSet = NULL;
68 do {
69 struct HksProcessInfo processInfo = { {0, NULL}, {0, NULL}, 0, 0, 0 };
70 ret = GetProcessInfo(&processInfo);
71 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "get process info failed")
72
73 const struct HksBlob fileNameBlob = { strlen(ksfName), (uint8_t *)ksfName };
74
75 ret = HksRkcBuildParamSet(¶mSet);
76 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "rkc build paramset failed")
77
78 ret = HksManageStoreGetKeyBlob(&processInfo, paramSet, &fileNameBlob, tmpKsf, HKS_STORAGE_TYPE_ROOT_KEY);
79 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "Get ksf file failed! ret = 0x%" LOG_PUBLIC "X", ret)
80
81 HksFreeParamSet(¶mSet);
82 return HKS_SUCCESS;
83 } while (0);
84
85 /* the data of root or main key should be cleared after use */
86 (void)memset_s(tmpKsf->data, tmpKsf->size, 0, tmpKsf->size);
87 HKS_FREE_BLOB(*tmpKsf);
88 HksFreeParamSet(¶mSet);
89 return ret;
90 }
91
ExtractFieldFromBuffer(const struct HksBlob * srcBlob,uint32_t * srcOffset,void * dest,uint32_t destSize)92 int32_t ExtractFieldFromBuffer(const struct HksBlob *srcBlob, uint32_t *srcOffset, void *dest, uint32_t destSize)
93 {
94 if (CheckBlob(srcBlob) != HKS_SUCCESS || srcOffset == NULL || dest == NULL || destSize == 0) {
95 return HKS_ERROR_INVALID_ARGUMENT;
96 }
97
98 if (srcBlob->size < *srcOffset) {
99 HKS_LOG_E("Offset is greater than size of source buffer");
100 return HKS_ERROR_BUFFER_TOO_SMALL;
101 }
102
103 if (srcBlob->size - *srcOffset < destSize) {
104 HKS_LOG_E("Source buffer is too small");
105 return HKS_ERROR_BUFFER_TOO_SMALL;
106 }
107
108 (void)memcpy_s(dest, destSize, srcBlob->data + *srcOffset, destSize);
109 *srcOffset += destSize;
110 return HKS_SUCCESS;
111 }
112
FillFieldToBuffer(const void * src,uint32_t srcSize,struct HksBlob * destBlob,uint32_t * destOffset)113 int32_t FillFieldToBuffer(const void *src, uint32_t srcSize, struct HksBlob *destBlob, uint32_t *destOffset)
114 {
115 if (src == NULL || srcSize == 0 || CheckBlob(destBlob) != HKS_SUCCESS || destOffset == NULL) {
116 return HKS_ERROR_INVALID_ARGUMENT;
117 }
118
119 if (destBlob->size < *destOffset) {
120 HKS_LOG_E("Offset is greater than size of destination buffer");
121 return HKS_ERROR_BUFFER_TOO_SMALL;
122 }
123
124 if (destBlob->size - *destOffset < srcSize) {
125 HKS_LOG_E("Destination buffer is too small");
126 return HKS_ERROR_BUFFER_TOO_SMALL;
127 }
128
129 if (memcpy_s(destBlob->data + *destOffset, destBlob->size - *destOffset, src, srcSize) != EOK) {
130 HKS_LOG_E("Memcpy failed");
131 return HKS_ERROR_BUFFER_TOO_SMALL;
132 }
133 *destOffset += srcSize;
134 return HKS_SUCCESS;
135 }
136
RkcExtractKsfFileFlag(const struct HksBlob * ksfFromFile,uint32_t * ksfBufOffset)137 int32_t RkcExtractKsfFileFlag(const struct HksBlob *ksfFromFile, uint32_t *ksfBufOffset)
138 {
139 /* Extract file flag. */
140 uint8_t fileFlag[HKS_RKC_KSF_FLAG_LEN] = {0};
141 int32_t ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, fileFlag, HKS_RKC_KSF_FLAG_LEN);
142 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy file flag failed!")
143
144 /* Check file flag. */
145 if (HksMemCmp(fileFlag, g_hksRkcKsfFlag, HKS_RKC_KSF_FLAG_LEN) != 0) {
146 HKS_LOG_E("Ksf file flag is invalid!");
147 return HKS_ERROR_READ_FILE_FAIL;
148 }
149
150 return HKS_SUCCESS;
151 }
152
RkcExtractTime(const struct HksBlob * ksfFromFile,uint32_t * ksfBufOffset,struct HksTime * time)153 static int32_t RkcExtractTime(const struct HksBlob *ksfFromFile, uint32_t *ksfBufOffset, struct HksTime *time)
154 {
155 int32_t ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(time->hksYear), sizeof(time->hksYear));
156 HKS_IF_NOT_SUCC_RETURN(ret, ret)
157
158 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(time->hksMon), sizeof(time->hksMon));
159 HKS_IF_NOT_SUCC_RETURN(ret, ret)
160
161 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(time->hksDay), sizeof(time->hksDay));
162 HKS_IF_NOT_SUCC_RETURN(ret, ret)
163
164 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(time->hksHour), sizeof(time->hksHour));
165 HKS_IF_NOT_SUCC_RETURN(ret, ret)
166
167 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(time->hksMin), sizeof(time->hksMin));
168 HKS_IF_NOT_SUCC_RETURN(ret, ret)
169
170 return ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(time->hksSec), sizeof(time->hksSec));
171 }
172
ExtractKsfDataRkc(const struct HksBlob * ksfFromFile,uint32_t * ksfBufOffset,struct HksKsfDataRkc * ksfDataRkc)173 int32_t ExtractKsfDataRkc(const struct HksBlob *ksfFromFile, uint32_t *ksfBufOffset, struct HksKsfDataRkc *ksfDataRkc)
174 {
175 if (ksfDataRkc == NULL) {
176 return HKS_ERROR_NULL_POINTER;
177 }
178
179 /* Extract rkCreatedTime */
180 int32_t ret = RkcExtractTime(ksfFromFile, ksfBufOffset, &(ksfDataRkc->rkCreatedTime));
181 HKS_IF_NOT_SUCC_RETURN(ret, ret)
182
183 /* Extract rkExpiredTime */
184 ret = RkcExtractTime(ksfFromFile, ksfBufOffset, &(ksfDataRkc->rkExpiredTime));
185 HKS_IF_NOT_SUCC_RETURN(ret, ret)
186
187 /* Extract the first material */
188 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataRkc->rkMaterial1,
189 sizeof(ksfDataRkc->rkMaterial1));
190 HKS_IF_NOT_SUCC_RETURN(ret, ret)
191
192 /* Extract the second material */
193 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataRkc->rkMaterial2,
194 sizeof(ksfDataRkc->rkMaterial2));
195 HKS_IF_NOT_SUCC_RETURN(ret, ret)
196
197 /* Extract iterator number */
198 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(ksfDataRkc->rmkIter), sizeof(ksfDataRkc->rmkIter));
199 HKS_IF_NOT_SUCC_RETURN(ret, ret)
200
201 /* Extract salt */
202 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataRkc->rmkSalt, sizeof(ksfDataRkc->rmkSalt));
203 HKS_IF_NOT_SUCC_RETURN(ret, ret)
204
205 /* Extract hash algorithm */
206 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(ksfDataRkc->rmkHashAlg), sizeof(ksfDataRkc->rmkHashAlg));
207 HKS_IF_NOT_SUCC_RETURN(ret, ret)
208
209 /* Extract reserve field */
210 return ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataRkc->rkRsv, sizeof(ksfDataRkc->rkRsv));
211 }
212
ExtractKsfDataMk(const struct HksBlob * ksfFromFile,uint32_t * ksfBufOffset,struct HksKsfDataMk * ksfDataMk)213 int32_t ExtractKsfDataMk(const struct HksBlob *ksfFromFile, uint32_t *ksfBufOffset, struct HksKsfDataMk *ksfDataMk)
214 {
215 if (ksfDataMk == NULL) {
216 return HKS_ERROR_NULL_POINTER;
217 }
218
219 /* Extract mkCreatedTime */
220 int32_t ret = RkcExtractTime(ksfFromFile, ksfBufOffset, &(ksfDataMk->mkCreatedTime));
221 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Extract mkCreatedTime failed!")
222
223 /* Extract mkExpiredTime */
224 ret = RkcExtractTime(ksfFromFile, ksfBufOffset, &(ksfDataMk->mkExpiredTime));
225 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Extract mkExpiredTime failed!")
226
227 /* Fill encryption algorithm */
228 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, &(ksfDataMk->mkEncryptAlg),
229 sizeof(ksfDataMk->mkEncryptAlg));
230 HKS_IF_NOT_SUCC_RETURN(ret, ret)
231
232 /* Fill IV */
233 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataMk->mkIv, sizeof(ksfDataMk->mkIv));
234 HKS_IF_NOT_SUCC_RETURN(ret, ret)
235
236 /* Fill ciphertext */
237 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataMk->mkCiphertext,
238 sizeof(ksfDataMk->mkCiphertext));
239 HKS_IF_NOT_SUCC_RETURN(ret, ret)
240
241 /* Fill reserve field */
242 return ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfDataMk->mkRsv, sizeof(ksfDataMk->mkRsv));
243 }
244
RkcExtractKsfHash(const struct HksBlob * ksfFromFile,uint32_t * ksfBufOffset)245 int32_t RkcExtractKsfHash(const struct HksBlob *ksfFromFile, uint32_t *ksfBufOffset)
246 {
247 if (ksfFromFile == NULL || ksfBufOffset == NULL) {
248 return HKS_ERROR_NULL_POINTER;
249 }
250
251 if (*ksfBufOffset < HKS_RKC_KSF_FLAG_LEN || ksfFromFile->size < HKS_RKC_KSF_FLAG_LEN ||
252 (ksfFromFile->size - HKS_RKC_KSF_FLAG_LEN) < (*ksfBufOffset - HKS_RKC_KSF_FLAG_LEN)) {
253 return HKS_ERROR_INVALID_KEY_FILE;
254 }
255
256 /* calculate sha256, skip file flag, begin with version, end with reserve field. */
257 uint8_t hashResult[HKS_RKC_HASH_LEN] = {0};
258 struct HksBlob hashResultBlob = { HKS_RKC_HASH_LEN, hashResult };
259 /* the upper layer ensures no overflow */
260 const struct HksBlob hashSrc = { *ksfBufOffset - HKS_RKC_KSF_FLAG_LEN, ksfFromFile->data + HKS_RKC_KSF_FLAG_LEN };
261 int32_t ret = HksCryptoHalHash(HKS_DIGEST_SHA256, &hashSrc, &hashResultBlob);
262 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Hks hash failed! ret = 0x%" LOG_PUBLIC "X", ret)
263
264 /* Extract hash from ksf buffer */
265 uint8_t ksfHash[HKS_RKC_HASH_LEN] = {0};
266 ret = ExtractFieldFromBuffer(ksfFromFile, ksfBufOffset, ksfHash, HKS_RKC_HASH_LEN);
267 HKS_IF_NOT_SUCC_RETURN(ret, ret)
268
269 /* Check hash result. */
270 if (HksMemCmp(hashResult, ksfHash, HKS_RKC_HASH_LEN) != 0) {
271 HKS_LOG_E("Ksf hash result is Invalid!");
272 return HKS_ERROR_INVALID_KEY_FILE;
273 }
274
275 return HKS_SUCCESS;
276 }
277
ExtractKsfBufRkc(const struct HksBlob * ksfFromFile,struct HksKsfDataRkcWithVer * ksfDataRkcWithVer)278 static int32_t ExtractKsfBufRkc(const struct HksBlob *ksfFromFile, struct HksKsfDataRkcWithVer *ksfDataRkcWithVer)
279 {
280 uint32_t ksfBufOffset = 0;
281
282 /* Extract file flag. */
283 int32_t ret = RkcExtractKsfFileFlag(ksfFromFile, &ksfBufOffset);
284 HKS_IF_NOT_SUCC_RETURN(ret, ret)
285
286 /* Extract version */
287 ret = ExtractFieldFromBuffer(ksfFromFile, &ksfBufOffset, &(ksfDataRkcWithVer->rkVersion),
288 sizeof(ksfDataRkcWithVer->rkVersion));
289 HKS_IF_NOT_SUCC_RETURN(ret, ret)
290
291 /* Extract fields of root key component */
292 ret = ExtractKsfDataRkc(ksfFromFile, &ksfBufOffset, &(ksfDataRkcWithVer->ksfDataRkc));
293 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Extract ksf rkc failed! ret = 0x%" LOG_PUBLIC "X", ret)
294
295 /* Extract hash */
296 return RkcExtractKsfHash(ksfFromFile, &ksfBufOffset);
297 }
298
ExtractKsfBufMk(const struct HksBlob * ksfFromFile,struct HksKsfDataMkWithVer * ksfDataMkWithVer)299 static int32_t ExtractKsfBufMk(const struct HksBlob *ksfFromFile, struct HksKsfDataMkWithVer *ksfDataMkWithVer)
300 {
301 uint32_t ksfBufOffset = 0;
302
303 /* Extract file flag. */
304 int32_t ret = RkcExtractKsfFileFlag(ksfFromFile, &ksfBufOffset);
305 HKS_IF_NOT_SUCC_RETURN(ret, ret)
306
307 /* Extract version */
308 ret = ExtractFieldFromBuffer(ksfFromFile, &ksfBufOffset, &(ksfDataMkWithVer->mkVersion),
309 sizeof(ksfDataMkWithVer->mkVersion));
310 HKS_IF_NOT_SUCC_RETURN(ret, ret)
311
312 /* Extract fields of main key */
313 ret = ExtractKsfDataMk(ksfFromFile, &ksfBufOffset, &(ksfDataMkWithVer->ksfDataMk));
314 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Extract ksf mk failed! ret = 0x%" LOG_PUBLIC "X", ret)
315
316 /* Extract hash */
317 return RkcExtractKsfHash(ksfFromFile, &ksfBufOffset);
318 }
319
HksReadKsfRkc(const char * ksfName,struct HksKsfDataRkcWithVer * ksfDataRkc)320 int32_t HksReadKsfRkc(const char *ksfName, struct HksKsfDataRkcWithVer *ksfDataRkc)
321 {
322 struct HksBlob tmpKsf;
323 int32_t ret = GetKeyBlobKsf(ksfName, &tmpKsf);
324 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Get rkc ksf file failed! ret = 0x%" LOG_PUBLIC "X", ret)
325
326 ret = ExtractKsfBufRkc(&tmpKsf, ksfDataRkc);
327
328 /* the data of root key should be cleared after use */
329 (void)memset_s(tmpKsf.data, tmpKsf.size, 0, tmpKsf.size);
330 HKS_FREE_BLOB(tmpKsf);
331 return ret;
332 }
333
HksReadKsfMk(const char * ksfName,struct HksKsfDataMkWithVer * ksfDataMk)334 int32_t HksReadKsfMk(const char *ksfName, struct HksKsfDataMkWithVer *ksfDataMk)
335 {
336 struct HksBlob tmpKsf;
337 int32_t ret = GetKeyBlobKsf(ksfName, &tmpKsf);
338 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Get mk ksf file failed! ret = 0x%" LOG_PUBLIC "X", ret)
339
340 ret = ExtractKsfBufMk(&tmpKsf, ksfDataMk);
341
342 /* the data of main key should be cleared after use */
343 (void)memset_s(tmpKsf.data, tmpKsf.size, 0, tmpKsf.size);
344 HKS_FREE_BLOB(tmpKsf);
345 return ret;
346 }
347
RkcFillKsfTime(const struct HksTime * time,struct HksBlob * ksfBuf,uint32_t * ksfBufOffset)348 static int32_t RkcFillKsfTime(const struct HksTime *time, struct HksBlob *ksfBuf, uint32_t *ksfBufOffset)
349 {
350 int32_t ret = FillFieldToBuffer(&(time->hksYear), sizeof(time->hksYear), ksfBuf, ksfBufOffset);
351 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hksYear failed!")
352
353 ret = FillFieldToBuffer(&(time->hksMon), sizeof(time->hksMon), ksfBuf, ksfBufOffset);
354 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hksMon failed!")
355
356 ret = FillFieldToBuffer(&(time->hksDay), sizeof(time->hksDay), ksfBuf, ksfBufOffset);
357 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hksDay failed!")
358
359 ret = FillFieldToBuffer(&(time->hksHour), sizeof(time->hksHour), ksfBuf, ksfBufOffset);
360 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hksHour failed!")
361
362 ret = FillFieldToBuffer(&(time->hksMin), sizeof(time->hksMin), ksfBuf, ksfBufOffset);
363 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hksMin failed!")
364
365 ret = FillFieldToBuffer(&(time->hksSec), sizeof(time->hksSec), ksfBuf, ksfBufOffset);
366 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hksSec failed!")
367
368 return HKS_SUCCESS;
369 }
370
FillKsfDataRkc(const struct HksKsfDataRkc * ksfDataRkc,struct HksBlob * ksfBuf,uint32_t * ksfBufOffset)371 static int32_t FillKsfDataRkc(const struct HksKsfDataRkc *ksfDataRkc, struct HksBlob *ksfBuf, uint32_t *ksfBufOffset)
372 {
373 /* Fill rkCreatedTime */
374 int32_t ret = RkcFillKsfTime(&(ksfDataRkc->rkCreatedTime), ksfBuf, ksfBufOffset);
375 HKS_IF_NOT_SUCC_RETURN(ret, ret)
376
377 /* Fill rkExpiredTime */
378 ret = RkcFillKsfTime(&(ksfDataRkc->rkExpiredTime), ksfBuf, ksfBufOffset);
379 HKS_IF_NOT_SUCC_RETURN(ret, ret)
380
381 /* Fill the first material */
382 ret = FillFieldToBuffer(ksfDataRkc->rkMaterial1, sizeof(ksfDataRkc->rkMaterial1), ksfBuf, ksfBufOffset);
383 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy first material to ksf buf failed!")
384
385 /* Fill the second material */
386 ret = FillFieldToBuffer(ksfDataRkc->rkMaterial2, sizeof(ksfDataRkc->rkMaterial2), ksfBuf, ksfBufOffset);
387 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy second material to ksf buf failed!")
388
389 /* Fill iterator number */
390 ret = FillFieldToBuffer(&(ksfDataRkc->rmkIter), sizeof(ksfDataRkc->rmkIter), ksfBuf, ksfBufOffset);
391 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy iterator number to ksf buf failed!")
392
393 /* Fill salt */
394 ret = FillFieldToBuffer(ksfDataRkc->rmkSalt, sizeof(ksfDataRkc->rmkSalt), ksfBuf, ksfBufOffset);
395 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy salt to ksf buf failed!")
396
397 /* Fill hash algorithm */
398 ret = FillFieldToBuffer(&(ksfDataRkc->rmkHashAlg), sizeof(ksfDataRkc->rmkHashAlg), ksfBuf, ksfBufOffset);
399 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy hash algorithm to ksf buf failed!")
400
401 /* Fill reserve field */
402 ret = FillFieldToBuffer(ksfDataRkc->rkRsv, sizeof(ksfDataRkc->rkRsv), ksfBuf, ksfBufOffset);
403 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy reserve field to ksf buf failed!")
404
405 return HKS_SUCCESS;
406 }
407
FillKsfDataMk(const struct HksKsfDataMk * ksfDataMk,struct HksBlob * ksfBuf,uint32_t * ksfBufOffset)408 static int32_t FillKsfDataMk(const struct HksKsfDataMk *ksfDataMk, struct HksBlob *ksfBuf, uint32_t *ksfBufOffset)
409 {
410 /* Fill mkCreatedTime */
411 int32_t ret = RkcFillKsfTime(&(ksfDataMk->mkCreatedTime), ksfBuf, ksfBufOffset);
412 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Fill mk created time to ksf buf failed!")
413
414 /* Fill mkExpiredTime */
415 ret = RkcFillKsfTime(&(ksfDataMk->mkExpiredTime), ksfBuf, ksfBufOffset);
416 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Fill mk expired time to ksf buf failed!")
417
418 /* Fill encryption algorithm */
419 ret = FillFieldToBuffer(&(ksfDataMk->mkEncryptAlg), sizeof(ksfDataMk->mkEncryptAlg), ksfBuf, ksfBufOffset);
420 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy encrption algorithm to ksf buf failed!")
421
422 /* Fill IV */
423 ret = FillFieldToBuffer(ksfDataMk->mkIv, sizeof(ksfDataMk->mkIv), ksfBuf, ksfBufOffset);
424 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy iv to ksf buf failed!")
425
426 /* Fill ciphertext */
427 ret = FillFieldToBuffer(ksfDataMk->mkCiphertext, sizeof(ksfDataMk->mkCiphertext), ksfBuf, ksfBufOffset);
428 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy ciphertext to ksf buf failed!")
429
430 /* Fill reserve field */
431 ret = FillFieldToBuffer(ksfDataMk->mkRsv, sizeof(ksfDataMk->mkRsv), ksfBuf, ksfBufOffset);
432 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy reserve field to ksf buf failed!")
433
434 return HKS_SUCCESS;
435 }
436
FillKsfVerRkc(const struct HksKsfDataRkcWithVer * ksfDataRkcWithVer,struct HksBlob * ksfBuf,uint32_t * ksfBufOffset)437 static int32_t FillKsfVerRkc(const struct HksKsfDataRkcWithVer *ksfDataRkcWithVer,
438 struct HksBlob *ksfBuf, uint32_t *ksfBufOffset)
439 {
440 /* Fill version */
441 int32_t ret = FillFieldToBuffer(&(ksfDataRkcWithVer->rkVersion), sizeof(ksfDataRkcWithVer->rkVersion),
442 ksfBuf, ksfBufOffset);
443 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy rkc version to ksf buf failed!")
444
445 ret = FillKsfDataRkc(&(ksfDataRkcWithVer->ksfDataRkc), ksfBuf, ksfBufOffset);
446 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy rkc data to ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
447
448 return HKS_SUCCESS;
449 }
450
FillKsfVerMk(const struct HksKsfDataMkWithVer * ksfDataMkWithVer,struct HksBlob * ksfBuf,uint32_t * ksfBufOffset)451 static int32_t FillKsfVerMk(const struct HksKsfDataMkWithVer *ksfDataMkWithVer,
452 struct HksBlob *ksfBuf, uint32_t *ksfBufOffset)
453 {
454 /* Fill version */
455 int32_t ret = FillFieldToBuffer(&(ksfDataMkWithVer->mkVersion), sizeof(ksfDataMkWithVer->mkVersion),
456 ksfBuf, ksfBufOffset);
457 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy mk version to ksf buf failed!")
458
459 ret = FillKsfDataMk(&(ksfDataMkWithVer->ksfDataMk), ksfBuf, ksfBufOffset);
460 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy mk data to ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
461
462 return HKS_SUCCESS;
463 }
464
RkcFillKsfHash(struct HksBlob * ksfBuf,uint32_t * ksfBufOffset)465 static int32_t RkcFillKsfHash(struct HksBlob *ksfBuf, uint32_t *ksfBufOffset)
466 {
467 if ((ksfBuf->size < HKS_RKC_KSF_FLAG_LEN) || (*ksfBufOffset < HKS_RKC_KSF_FLAG_LEN) ||
468 (ksfBuf->size - HKS_RKC_KSF_FLAG_LEN) < (*ksfBufOffset - HKS_RKC_KSF_FLAG_LEN)) {
469 return HKS_ERROR_INVALID_KEY_FILE;
470 }
471
472 /* calculate sha256, skip file flag, begin with version, end with reserve field. */
473 const struct HksBlob msgBlob = { *ksfBufOffset - HKS_RKC_KSF_FLAG_LEN, ksfBuf->data + HKS_RKC_KSF_FLAG_LEN };
474 uint8_t digest[HKS_RKC_HASH_LEN] = { 0 };
475 struct HksBlob digestBlob = { HKS_RKC_HASH_LEN, digest };
476 int32_t ret = HksCryptoHalHash(HKS_DIGEST_SHA256, &msgBlob, &digestBlob);
477 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Hash failed! ret = 0x%" LOG_PUBLIC "X", ret)
478
479 return FillFieldToBuffer(digestBlob.data, digestBlob.size, ksfBuf, ksfBufOffset);
480 }
481
FillKsfBufRkc(const struct HksKsfDataRkcWithVer * ksfDataRkcWithVer,struct HksBlob * ksfBuf)482 static int32_t FillKsfBufRkc(const struct HksKsfDataRkcWithVer *ksfDataRkcWithVer, struct HksBlob *ksfBuf)
483 {
484 uint32_t ksfBufOffset = 0;
485
486 /* Fill file flag */
487 int32_t ret = FillFieldToBuffer(g_hksRkcKsfFlag, sizeof(g_hksRkcKsfFlag), ksfBuf, &ksfBufOffset);
488 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy file flag to ksf buf failed!")
489
490 /* Fill root key */
491 ret = FillKsfVerRkc(ksfDataRkcWithVer, ksfBuf, &ksfBufOffset);
492 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Fill root key info to ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
493
494 /* calculate and fill SHA256 result, skip file flag, begin with version, end with reserve field. */
495 ret = RkcFillKsfHash(ksfBuf, &ksfBufOffset);
496 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Fill hash to ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
497
498 return HKS_SUCCESS;
499 }
500
FillKsfBufMk(const struct HksKsfDataMkWithVer * ksfDataMkWithVer,struct HksBlob * ksfBuf)501 static int32_t FillKsfBufMk(const struct HksKsfDataMkWithVer *ksfDataMkWithVer, struct HksBlob *ksfBuf)
502 {
503 uint32_t ksfBufOffset = 0;
504
505 /* Fill file flag */
506 int32_t ret = FillFieldToBuffer(g_hksRkcKsfFlag, sizeof(g_hksRkcKsfFlag), ksfBuf, &ksfBufOffset);
507 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Memcpy file flag to ksf buf failed!")
508
509 /* Fill main key */
510 ret = FillKsfVerMk(ksfDataMkWithVer, ksfBuf, &ksfBufOffset);
511 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Fill main key info to ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
512
513 /* calculate and fill SHA256 result, skip file flag, begin with version, end with reserve field. */
514 ret = RkcFillKsfHash(ksfBuf, &ksfBufOffset);
515 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "Fill hash to ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
516
517 return HKS_SUCCESS;
518 }
519
HksWriteKsfRkc(const char * ksfName,const struct HksKsfDataRkcWithVer * ksfDataRkc)520 int32_t HksWriteKsfRkc(const char *ksfName, const struct HksKsfDataRkcWithVer *ksfDataRkc)
521 {
522 struct HksBlob ksfBuf;
523 ksfBuf.data = (uint8_t *)HksMalloc(HKS_KSF_BUF_LEN);
524 HKS_IF_NULL_LOGE_RETURN(ksfBuf.data, HKS_ERROR_MALLOC_FAIL, "Malloc rkc ksf buffer failed!")
525
526 ksfBuf.size = HKS_KSF_BUF_LEN;
527 (void)memset_s(ksfBuf.data, ksfBuf.size, 0, ksfBuf.size);
528
529 int32_t ret;
530 struct HksParamSet *paramSet = NULL;
531 do {
532 /* Fill data into buffer */
533 ret = FillKsfBufRkc(ksfDataRkc, &ksfBuf);
534 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "Fill rkc ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
535
536 struct HksProcessInfo processInfo = { {0, NULL}, {0, NULL}, 0, 0, 0 };
537 ret = GetProcessInfo(&processInfo);
538 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "get process info failed")
539
540 /* write buffer data into keystore file */
541 const struct HksBlob fileNameBlob = { strlen(ksfName), (uint8_t *)ksfName };
542
543 ret = HksRkcBuildParamSet(¶mSet);
544 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "rkc build paramset failed")
545
546 ret = HksManageStoreKeyBlob(&processInfo, paramSet, &fileNameBlob, &ksfBuf, HKS_STORAGE_TYPE_ROOT_KEY);
547 HKS_IF_NOT_SUCC_LOGE(ret, "Store rkc ksf failed! ret = 0x%" LOG_PUBLIC "X", ret)
548 } while (0);
549
550 (void)memset_s(ksfBuf.data, ksfBuf.size, 0, ksfBuf.size);
551 HKS_FREE_BLOB(ksfBuf);
552 HksFreeParamSet(¶mSet);
553 return ret;
554 }
555
HksWriteKsfMk(const char * ksfName,const struct HksKsfDataMkWithVer * ksfDataMk)556 int32_t HksWriteKsfMk(const char *ksfName, const struct HksKsfDataMkWithVer *ksfDataMk)
557 {
558 struct HksBlob ksfBuf;
559 ksfBuf.data = (uint8_t *)HksMalloc(HKS_KSF_BUF_LEN);
560 HKS_IF_NULL_LOGE_RETURN(ksfBuf.data, HKS_ERROR_MALLOC_FAIL, "Malloc mk ksf buffer failed!")
561
562 ksfBuf.size = HKS_KSF_BUF_LEN;
563 (void)memset_s(ksfBuf.data, ksfBuf.size, 0, ksfBuf.size);
564
565 int32_t ret;
566 struct HksParamSet *paramSet = NULL;
567 do {
568 /* Fill data into buffer */
569 ret = FillKsfBufMk(ksfDataMk, &ksfBuf);
570 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "Fill mk ksf buf failed! ret = 0x%" LOG_PUBLIC "X", ret)
571
572 struct HksProcessInfo processInfo = { {0, NULL}, {0, NULL}, 0, 0, 0 };
573 ret = GetProcessInfo(&processInfo);
574 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "get process info failed")
575
576 /* write buffer data into keystore file */
577 const struct HksBlob fileNameBlob = { strlen(ksfName), (uint8_t *)ksfName };
578
579 ret = HksRkcBuildParamSet(¶mSet);
580 HKS_IF_NOT_SUCC_LOGE_BREAK(ret, "rkc build paramset failed")
581
582 ret = HksManageStoreKeyBlob(&processInfo, paramSet, &fileNameBlob, &ksfBuf, HKS_STORAGE_TYPE_ROOT_KEY);
583 HKS_IF_NOT_SUCC_LOGE(ret, "Store mk ksf failed! ret = 0x%" LOG_PUBLIC "X", ret)
584 } while (0);
585
586 (void)memset_s(ksfBuf.data, ksfBuf.size, 0, ksfBuf.size);
587 HKS_FREE_BLOB(ksfBuf);
588 HksFreeParamSet(¶mSet);
589 return ret;
590 }
591
KsfExist(uint8_t ksfType)592 bool KsfExist(uint8_t ksfType)
593 {
594 struct HksProcessInfo processInfo = { {0, NULL}, {0, NULL}, 0, 0, 0 };
595 int32_t ret = GetProcessInfo(&processInfo);
596 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, HKS_ERROR_INTERNAL_ERROR, "get process info failed")
597
598 const struct HksKsfAttr *ksfFileName = NULL;
599 if (ksfType == HKS_KSF_TYPE_RKC) {
600 ksfFileName = GetGlobalKsfAttrRkc();
601 } else {
602 ksfFileName = GetGlobalKsfAttrMk();
603 }
604
605 struct HksParamSet *paramSet = NULL;
606 ret = HksRkcBuildParamSet(¶mSet);
607 HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "rkc build paramset failed")
608
609 for (uint32_t i = 0; i < HKS_KSF_NUM; ++i) {
610 if (ksfFileName->name[i] == NULL) {
611 continue;
612 }
613 struct HksBlob fileNameBlob = { strlen(ksfFileName->name[i]), (uint8_t *)(ksfFileName->name[i]) };
614 if (HksManageStoreIsKeyBlobExist(&processInfo, paramSet, &fileNameBlob,
615 HKS_STORAGE_TYPE_ROOT_KEY) == HKS_SUCCESS) {
616 HksFreeParamSet(¶mSet);
617 return true;
618 }
619 }
620 HksFreeParamSet(¶mSet);
621 return false;
622 }
623 #endif /* _CUT_AUTHENTICATE_ */
624