Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Curve25519 fixes #83

Merged
merged 8 commits into from
Nov 4, 2024
Merged

Curve25519 fixes #83

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
bd13216
passing unit tests with new Curve25519 unified funcitons
bigbrett Oct 29, 2024
74d47ba
cleanups
bigbrett Oct 29, 2024
122d76d
remove unused functions
bigbrett Nov 1, 2024
affda77
added more debug printfs in verbose mode
bigbrett Nov 4, 2024
b634bc4
fixed CURVE25519 public key only serialization
bigbrett Nov 4, 2024
e42ddcd
removed unused definitions
bigbrett Nov 4, 2024
d237a02
removed erroneous comment out of test
bigbrett Nov 4, 2024
9a87978
cleanup CI config
bigbrett Nov 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions src/wh_client_crypto.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1185,8 +1185,8 @@ int wh_Client_Curve25519ImportKey(whClientContext* ctx, curve25519_key* key,
key_id = *inout_keyId;
}

ret = wh_Crypto_Curve25519SerializeKey(key, sizeof(buffer),buffer,
&buffer_len);
buffer_len = sizeof(buffer);
ret = wh_Crypto_Curve25519SerializeKey(key, buffer, &buffer_len);
if (ret == 0) {
/* Cache the key and get the keyID */
ret = wh_Client_KeyCache(ctx,
Expand Down Expand Up @@ -1220,8 +1220,7 @@ int wh_Client_Curve25519ExportKey(whClientContext* ctx, whKeyId keyId,
buffer, &buffer_len);
if (ret == 0) {
/* Update the key structure */
ret = wh_Crypto_Curve25519DeserializeKey(
buffer_len, buffer, key);
ret = wh_Crypto_Curve25519DeserializeKey(buffer, buffer_len, key);
}

return ret;
Expand Down Expand Up @@ -1311,8 +1310,7 @@ static int _Curve25519MakeKey(whClientContext* ctx,

if (flags & WH_NVM_FLAGS_EPHEMERAL) {
/* Response has the exported key */
ret = wh_Crypto_Curve25519DeserializeKey(
der_size, key_der, key);
ret = wh_Crypto_Curve25519DeserializeKey(key_der, der_size, key);
#ifdef DEBUG_CRYPTOCB_VERBOSE
wh_Utils_Hexdump("[client] KeyGen export:", key_der, der_size);
#endif
Expand Down
62 changes: 34 additions & 28 deletions src/wh_crypto.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
#include "wolfssl/wolfcrypt/types.h"
#include "wolfssl/wolfcrypt/error-crypt.h"
#include "wolfssl/wolfcrypt/asn.h"
#include "wolfssl/wolfcrypt/asn_public.h"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

asn.h include asn_public.h. Were you getting a compile warning/error without asn_public.h explicitly included?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm dumb, removed

#include "wolfssl/wolfcrypt/rsa.h"
#include "wolfssl/wolfcrypt/curve25519.h"
#include "wolfssl/wolfcrypt/ecc.h"
Expand Down Expand Up @@ -207,49 +208,54 @@ int wh_Crypto_EccUpdatePrivateOnlyKeyDer(ecc_key* key, uint16_t pub_size,
#endif /* HAVE_ECC */

#ifdef HAVE_CURVE25519
int wh_Crypto_Curve25519SerializeKey(curve25519_key* key,
uint16_t max_size, uint8_t* buffer, uint16_t *out_size)

#ifdef HAVE_CURVE25519
#ifdef HAVE_CURVE25519_KEY_IMPORT
WOLFSSL_API int wc_Curve25519PrivateKeyDecode(
const byte* input, word32* inOutIdx, curve25519_key* key, word32 inSz);
WOLFSSL_API int wc_Curve25519PublicKeyDecode(
const byte* input, word32* inOutIdx, curve25519_key* key, word32 inSz);
#endif
#ifdef HAVE_CURVE25519_KEY_EXPORT
WOLFSSL_API int wc_Curve25519PrivateKeyToDer(
curve25519_key* key, byte* output, word32 inLen);
WOLFSSL_API int wc_Curve25519PublicKeyToDer(
curve25519_key* key, byte* output, word32 inLen, int withAlg);
#endif
#endif /* HAVE_CURVE25519 */
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Aren't these already declared in asn_public.h?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yep, this should have been removed. fixed



/* Store a curve25519_key to a byte sequence in DER format */
int wh_Crypto_Curve25519SerializeKey(curve25519_key* key, uint8_t* buffer,
uint16_t* derSize)
{
int ret = 0;
word32 privSz = CURVE25519_KEYSIZE;
word32 pubSz = CURVE25519_KEYSIZE;

if ( (key == NULL) ||
(buffer == NULL)) {
if ((key == NULL) || (buffer == NULL) || (derSize == NULL)) {
return WH_ERROR_BADARGS;
}

ret = wc_curve25519_export_key_raw(key,
buffer + CURVE25519_KEYSIZE, &privSz,
buffer, &pubSz);
if ( (ret == 0) &&
(out_size != NULL)) {
*out_size = CURVE25519_KEYSIZE * 2;
ret = wc_Curve25519KeyToDer(key, buffer, *derSize, 0);

/* ASN.1 functions return the size of the DER encoded key on success */
if (ret > 0) {
*derSize = ret;
ret = WH_ERROR_OK;
}
return ret;
}

int wh_Crypto_Curve25519DeserializeKey(uint16_t size,
const uint8_t* buffer, curve25519_key* key)
/* Restore a curve25519_key from a byte sequence in DER format */
int wh_Crypto_Curve25519DeserializeKey(const uint8_t* derBuffer,
uint16_t derSize, curve25519_key* key)
{
int ret = 0;
word32 privSz = CURVE25519_KEYSIZE;
word32 pubSz = CURVE25519_KEYSIZE;
word32 idx = 0;

if ( (size < (CURVE25519_KEYSIZE * 2)) ||
(buffer == NULL) ||
(key == NULL)) {
if ((derBuffer == NULL) || (key == NULL)) {
return WH_ERROR_BADARGS;
}

/* decode the key */
if (ret == 0) {
ret = wc_curve25519_import_private_raw(
buffer + CURVE25519_KEYSIZE, privSz,
buffer, pubSz,
key);
}
return ret;
return wc_Curve25519KeyDecode(derBuffer, &idx, key, derSize);
}
#endif /* HAVE_CURVE25519 */

Expand Down
67 changes: 35 additions & 32 deletions src/wh_server_crypto.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -430,38 +430,42 @@ int wh_Server_EccKeyCacheExport(whServerContext* ctx, whKeyId keyId,

#ifdef HAVE_CURVE25519
int wh_Server_CacheImportCurve25519Key(whServerContext* server,
curve25519_key* key,
whKeyId keyId, whNvmFlags flags, uint16_t label_len, uint8_t* label)
curve25519_key* key, whKeyId keyId,
whNvmFlags flags, uint16_t label_len,
uint8_t* label)
{
uint8_t* cacheBuf;
uint8_t* cacheBuf;
whNvmMetadata* cacheMeta;
int ret;
const uint16_t keySz = CURVE25519_KEYSIZE * 2;
uint16_t size = 0;
int ret;
/* Max size of a DER encoded curve25519 keypair with SubjectPublicKeyInfo
* included. Determined by experiment */
const uint16_t MAX_DER_SIZE = 128;
uint16_t keySz = keySz;

if ( (server == NULL) ||
(key == NULL) ||
(WH_KEYID_ISERASED(keyId)) ||
((label != NULL) && (label_len > sizeof(cacheMeta->label)))) {
uint8_t der_buf[MAX_DER_SIZE];


if ((server == NULL) || (key == NULL) || (WH_KEYID_ISERASED(keyId)) ||
((label != NULL) && (label_len > sizeof(cacheMeta->label)))) {
return WH_ERROR_BADARGS;
}

/* get a free slot */
ret = hsmCacheFindSlotAndZero(server, keySz, &cacheBuf, &cacheMeta);
if (ret == 0) {
ret = wh_Crypto_Curve25519SerializeKey(key, keySz, cacheBuf, &size);
}
/* Serialize the key into the temporary buffer so we can get the size */
ret = wh_Crypto_Curve25519SerializeKey(key, der_buf, &keySz);

/* if successful, find a free cache slot and copy in the key data */
if (ret == 0) {
/* set meta */
cacheMeta->id = keyId;
cacheMeta->len = size;
cacheMeta->flags = flags;
cacheMeta->access = WH_NVM_ACCESS_ANY;

if ( (label != NULL) &&
(label_len > 0) ) {
memcpy(cacheMeta->label, label, label_len);
ret = hsmCacheFindSlotAndZero(server, keySz, &cacheBuf, &cacheMeta);
if (ret == 0) {
memcpy(cacheBuf, der_buf, keySz);
/* Update metadata to cache the key */
cacheMeta->id = keyId;
cacheMeta->len = keySz;
cacheMeta->flags = flags;
cacheMeta->access = WH_NVM_ACCESS_ANY;
if ((label != NULL) && (label_len > 0)) {
memcpy(cacheMeta->label, label, label_len);
}
}
}
return ret;
Expand All @@ -483,7 +487,7 @@ int wh_Server_CacheExportCurve25519Key(whServerContext* server, whKeyId keyId,
ret = hsmFreshenKey(server, keyId, &cacheBuf, &cacheMeta);

if (ret == 0) {
ret = wh_Crypto_Curve25519DeserializeKey(cacheMeta->len, cacheBuf, key);
ret = wh_Crypto_Curve25519DeserializeKey(cacheBuf, cacheMeta->len, key);
#ifdef DEBUG_CRYPTOCB_VERBOSE
printf("[server] Export25519Key id:%u ret:%d\n", keyId, ret);
wh_Utils_Hexdump("[server] export key:", cacheBuf, cacheMeta->len);
Expand Down Expand Up @@ -795,9 +799,9 @@ static int _HandleCurve25519KeyGen(whServerContext* server, whPacket* packet,

/* Response Message */
uint8_t* out = (uint8_t*)(res + 1);
uint16_t max_size = (word32)(WOLFHSM_CFG_COMM_DATA_LEN -
/* Initialize the key size to the max size of the buffer */
uint16_t ser_size = (word32)(WOLFHSM_CFG_COMM_DATA_LEN -
(out - (uint8_t*)packet));
uint16_t res_size = 0;

/* init key */
ret = wc_curve25519_init_ex(key, NULL, server->crypto->devId);
Expand All @@ -809,11 +813,10 @@ static int _HandleCurve25519KeyGen(whServerContext* server, whPacket* packet,
if (flags & WH_NVM_FLAGS_EPHEMERAL) {
/* Must serialize the key into the response packet */
key_id = WH_KEYID_ERASED;
ret = wh_Crypto_Curve25519SerializeKey(key, max_size,
out, &res_size);
ret = wh_Crypto_Curve25519SerializeKey(key, out, &ser_size);
} else {
ser_size = 0;
/* Must import the key into the cache and return keyid */
res_size = 0;
if (WH_KEYID_ISERASED(key_id)) {
/* Generate a new id */
ret = hsmGetUniqueId(server, &key_id);
Expand All @@ -836,8 +839,8 @@ static int _HandleCurve25519KeyGen(whServerContext* server, whPacket* packet,

if (ret == 0) {
res->keyId = WH_KEYID_ID(key_id);
res->len = res_size;
*out_size = WH_PACKET_STUB_SIZE + sizeof(*res) + res_size;
res->len = ser_size;
*out_size = WH_PACKET_STUB_SIZE + sizeof(*res) + ser_size;
}
return ret;
}
Expand Down
8 changes: 4 additions & 4 deletions wolfhsm/wh_crypto.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,11 +77,11 @@ int wh_Crypto_EccUpdatePrivateOnlyKeyDer(ecc_key* key, uint16_t pub_size,

#ifdef HAVE_CURVE25519
/* Store a curve25519_key to a byte sequence */
int wh_Crypto_Curve25519SerializeKey(curve25519_key* key,
uint16_t max_size, uint8_t* buffer, uint16_t *out_size);
int wh_Crypto_Curve25519SerializeKey(curve25519_key* key, uint8_t* buffer,
uint16_t* out_size);
/* Restore a curve25519_key from a byte sequence */
int wh_Crypto_Curve25519DeserializeKey(uint16_t size,
const uint8_t* buffer, curve25519_key* key);
int wh_Crypto_Curve25519DeserializeKey(const uint8_t* derBuffer,
uint16_t derSize, curve25519_key* key);
#endif /* HAVE_CURVE25519 */

#endif /* !WOLFHSM_CFG_NO_CRYPTO */
Expand Down
Loading