10d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden/* 20d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * Copyright 2014 The Android Open Source Project 30d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * 40d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * Licensed under the Apache License, Version 2.0 (the "License"); 50d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * you may not use this file except in compliance with the License. 60d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * You may obtain a copy of the License at 70d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * 80d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * http://www.apache.org/licenses/LICENSE-2.0 90d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * 100d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * Unless required by applicable law or agreed to in writing, software 110d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * distributed under the License is distributed on an "AS IS" BASIS, 120d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 130d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * See the License for the specific language governing permissions and 140d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden * limitations under the License. 150d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden */ 160d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 170d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden#include "hmac_operation.h" 180d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 190f906ec40f6ade7955c6b967ea522aade54ea2e4Shawn Willden#include <new> 200f906ec40f6ade7955c6b967ea522aade54ea2e4Shawn Willden 210d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden#include <openssl/evp.h> 220d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden#include <openssl/hmac.h> 230d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 2433ab0389e908b98702806c746e7babc0d46eb452Shawn Willden#include "hmac_key.h" 25567a4a04f43d35b785d50508e6459b01f2ab4d14Shawn Willden#include "openssl_err.h" 2663ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden 27d79791b0c7123b3fc5db61a0805d7593f19ca8d9Shawn Willden#if defined(OPENSSL_IS_BORINGSSL) 28c3326552d973ce34f0f3138333a05a4a1865a699Adam Langley#include <openssl/mem.h> 29d79791b0c7123b3fc5db61a0805d7593f19ca8d9Shawn Willdentypedef size_t openssl_size_t; 30d79791b0c7123b3fc5db61a0805d7593f19ca8d9Shawn Willden#else 31d79791b0c7123b3fc5db61a0805d7593f19ca8d9Shawn Willdentypedef int openssl_size_t; 32d79791b0c7123b3fc5db61a0805d7593f19ca8d9Shawn Willden#endif 33d79791b0c7123b3fc5db61a0805d7593f19ca8d9Shawn Willden 340d560bfedd40389387f31f6696660fff6bc3a48aShawn Willdennamespace keymaster { 350d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 363ed6d06a378c29deacb1fb9cc33b599b309c3a52Shawn WilldenOperation* HmacOperationFactory::CreateOperation(const Key& key, 3709f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden const AuthorizationSet& begin_params, 383ed6d06a378c29deacb1fb9cc33b599b309c3a52Shawn Willden keymaster_error_t* error) { 3933ab0389e908b98702806c746e7babc0d46eb452Shawn Willden uint32_t min_mac_length_bits; 4033ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (!key.authorizations().GetTagValue(TAG_MIN_MAC_LENGTH, &min_mac_length_bits)) { 4133ab0389e908b98702806c746e7babc0d46eb452Shawn Willden LOG_E("HMAC key must have KM_TAG_MIN_MAC_LENGTH", 0); 4233ab0389e908b98702806c746e7babc0d46eb452Shawn Willden *error = KM_ERROR_INVALID_KEY_BLOB; 430c60f6f3f9f76819c7004c4c0c1da28b5c02c452Shawn Willden return nullptr; 440c60f6f3f9f76819c7004c4c0c1da28b5c02c452Shawn Willden } 4563ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden 4633ab0389e908b98702806c746e7babc0d46eb452Shawn Willden uint32_t mac_length_bits = UINT32_MAX; 4733ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (begin_params.GetTagValue(TAG_MAC_LENGTH, &mac_length_bits)) { 4833ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (purpose() == KM_PURPOSE_VERIFY) { 4933ab0389e908b98702806c746e7babc0d46eb452Shawn Willden LOG_E("MAC length may not be specified for verify", 0); 5033ab0389e908b98702806c746e7babc0d46eb452Shawn Willden *error = KM_ERROR_INVALID_ARGUMENT; 5133ab0389e908b98702806c746e7babc0d46eb452Shawn Willden return nullptr; 5233ab0389e908b98702806c746e7babc0d46eb452Shawn Willden } 5333ab0389e908b98702806c746e7babc0d46eb452Shawn Willden } else { 5433ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (purpose() == KM_PURPOSE_SIGN) { 5533ab0389e908b98702806c746e7babc0d46eb452Shawn Willden *error = KM_ERROR_MISSING_MAC_LENGTH; 5633ab0389e908b98702806c746e7babc0d46eb452Shawn Willden return nullptr; 5733ab0389e908b98702806c746e7babc0d46eb452Shawn Willden } 5833ab0389e908b98702806c746e7babc0d46eb452Shawn Willden } 5933ab0389e908b98702806c746e7babc0d46eb452Shawn Willden 60226746bfb5f79857145d5f3ebdfd6f49b6c114acShawn Willden keymaster_digest_t digest; 6133ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (!key.authorizations().GetTagValue(TAG_DIGEST, &digest)) { 6233ab0389e908b98702806c746e7babc0d46eb452Shawn Willden LOG_E("%d digests found in HMAC key authorizations; must be exactly 1", 6333ab0389e908b98702806c746e7babc0d46eb452Shawn Willden begin_params.GetTagCount(TAG_DIGEST)); 6433ab0389e908b98702806c746e7babc0d46eb452Shawn Willden *error = KM_ERROR_INVALID_KEY_BLOB; 65226746bfb5f79857145d5f3ebdfd6f49b6c114acShawn Willden return nullptr; 6633ab0389e908b98702806c746e7babc0d46eb452Shawn Willden } 6763ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden 6809f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden const SymmetricKey* symmetric_key = static_cast<const SymmetricKey*>(&key); 6933ab0389e908b98702806c746e7babc0d46eb452Shawn Willden UniquePtr<HmacOperation> op(new (std::nothrow) HmacOperation( 7033ab0389e908b98702806c746e7babc0d46eb452Shawn Willden purpose(), symmetric_key->key_data(), symmetric_key->key_data_size(), digest, 7133ab0389e908b98702806c746e7babc0d46eb452Shawn Willden mac_length_bits / 8, min_mac_length_bits / 8)); 7209f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden if (!op.get()) 7309f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden *error = KM_ERROR_MEMORY_ALLOCATION_FAILED; 7409f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden else 7509f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden *error = op->error(); 7663ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden 7763ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden if (*error != KM_ERROR_OK) 7809f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden return nullptr; 7963ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden 8009f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden return op.release(); 8163ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden} 8263ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden 8363ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willdenstatic keymaster_digest_t supported_digests[] = {KM_DIGEST_SHA1, KM_DIGEST_SHA_2_224, 8463ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden KM_DIGEST_SHA_2_256, KM_DIGEST_SHA_2_384, 8563ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden KM_DIGEST_SHA_2_512}; 8663ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willdenconst keymaster_digest_t* HmacOperationFactory::SupportedDigests(size_t* digest_count) const { 8763ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden *digest_count = array_length(supported_digests); 8863ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden return supported_digests; 8963ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden} 9063ac043f81f8e2a15bbadcb6628b92096295ab6aShawn Willden 91567a4a04f43d35b785d50508e6459b01f2ab4d14Shawn WilldenHmacOperation::HmacOperation(keymaster_purpose_t purpose, const uint8_t* key_data, 9233ab0389e908b98702806c746e7babc0d46eb452Shawn Willden size_t key_data_size, keymaster_digest_t digest, size_t mac_length, 9333ab0389e908b98702806c746e7babc0d46eb452Shawn Willden size_t min_mac_length) 9433ab0389e908b98702806c746e7babc0d46eb452Shawn Willden : Operation(purpose), error_(KM_ERROR_OK), mac_length_(mac_length), 9533ab0389e908b98702806c746e7babc0d46eb452Shawn Willden min_mac_length_(min_mac_length) { 960d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden // Initialize CTX first, so dtor won't crash even if we error out later. 970d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden HMAC_CTX_init(&ctx_); 980d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 9909f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden const EVP_MD* md = nullptr; 1000d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden switch (digest) { 10109f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden case KM_DIGEST_NONE: 10209f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden case KM_DIGEST_MD5: 10309f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden error_ = KM_ERROR_UNSUPPORTED_DIGEST; 10409f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden break; 10551d5e0e6be1d77b06715028abbc42211411cf671Shawn Willden case KM_DIGEST_SHA1: 10651d5e0e6be1d77b06715028abbc42211411cf671Shawn Willden md = EVP_sha1(); 10751d5e0e6be1d77b06715028abbc42211411cf671Shawn Willden break; 10862c2286bcf93bdfebac85bb5318982f054ec6224Shawn Willden case KM_DIGEST_SHA_2_224: 10962c2286bcf93bdfebac85bb5318982f054ec6224Shawn Willden md = EVP_sha224(); 11062c2286bcf93bdfebac85bb5318982f054ec6224Shawn Willden break; 1110d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden case KM_DIGEST_SHA_2_256: 1120d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden md = EVP_sha256(); 1130d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden break; 11462c2286bcf93bdfebac85bb5318982f054ec6224Shawn Willden case KM_DIGEST_SHA_2_384: 11562c2286bcf93bdfebac85bb5318982f054ec6224Shawn Willden md = EVP_sha384(); 11662c2286bcf93bdfebac85bb5318982f054ec6224Shawn Willden break; 11762c2286bcf93bdfebac85bb5318982f054ec6224Shawn Willden case KM_DIGEST_SHA_2_512: 11862c2286bcf93bdfebac85bb5318982f054ec6224Shawn Willden md = EVP_sha512(); 11962c2286bcf93bdfebac85bb5318982f054ec6224Shawn Willden break; 1200d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden } 1210d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 12209f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden if (md == nullptr) { 12309f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden error_ = KM_ERROR_UNSUPPORTED_DIGEST; 1240d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden return; 1250d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden } 1260d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 12733ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (purpose == KM_PURPOSE_SIGN) { 12833ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (mac_length > EVP_MD_size(md) || mac_length < kMinHmacLengthBits / 8) { 12933ab0389e908b98702806c746e7babc0d46eb452Shawn Willden error_ = KM_ERROR_UNSUPPORTED_MAC_LENGTH; 13033ab0389e908b98702806c746e7babc0d46eb452Shawn Willden return; 13133ab0389e908b98702806c746e7babc0d46eb452Shawn Willden } 13233ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (mac_length < min_mac_length) { 13333ab0389e908b98702806c746e7babc0d46eb452Shawn Willden error_ = KM_ERROR_INVALID_MAC_LENGTH; 13433ab0389e908b98702806c746e7babc0d46eb452Shawn Willden return; 13533ab0389e908b98702806c746e7babc0d46eb452Shawn Willden } 13633ab0389e908b98702806c746e7babc0d46eb452Shawn Willden } 13733ab0389e908b98702806c746e7babc0d46eb452Shawn Willden 1380d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden HMAC_Init_ex(&ctx_, key_data, key_data_size, md, NULL /* engine */); 1390d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden} 1400d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 1410d560bfedd40389387f31f6696660fff6bc3a48aShawn WilldenHmacOperation::~HmacOperation() { 1420d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden HMAC_CTX_cleanup(&ctx_); 1430d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden} 1440d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 145111edb3bf8c51be9ffa3bb2454085f0b300c1e7aShawn Willdenkeymaster_error_t HmacOperation::Begin(const AuthorizationSet& /* input_params */, 146111edb3bf8c51be9ffa3bb2454085f0b300c1e7aShawn Willden AuthorizationSet* /* output_params */) { 1470d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden return error_; 1480d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden} 1490d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 1506bfbff0020bb964a736e30d717b338e3e3973a36Shawn Willdenkeymaster_error_t HmacOperation::Update(const AuthorizationSet& /* additional_params */, 151ded8e7d0ad241fc0a930dbebbd9f2e2bf4e929a2Shawn Willden const Buffer& input, AuthorizationSet* /* output_params */, 152ded8e7d0ad241fc0a930dbebbd9f2e2bf4e929a2Shawn Willden Buffer* /* output */, size_t* input_consumed) { 1530d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden if (!HMAC_Update(&ctx_, input.peek_read(), input.available_read())) 154567a4a04f43d35b785d50508e6459b01f2ab4d14Shawn Willden return TranslateLastOpenSslError(); 1550d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden *input_consumed = input.available_read(); 1560d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden return KM_ERROR_OK; 1570d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden} 1580d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 1590d560bfedd40389387f31f6696660fff6bc3a48aShawn Willdenkeymaster_error_t HmacOperation::Abort() { 1600d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden return KM_ERROR_OK; 1610d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden} 1620d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 163cb647fec03f71929fd316d2b8f0750f7b24824f3Shawn Willdenkeymaster_error_t HmacOperation::Finish(const AuthorizationSet& additional_params, 164cb647fec03f71929fd316d2b8f0750f7b24824f3Shawn Willden const Buffer& input, const Buffer& signature, 165ded8e7d0ad241fc0a930dbebbd9f2e2bf4e929a2Shawn Willden AuthorizationSet* /* output_params */, Buffer* output) { 166cb647fec03f71929fd316d2b8f0750f7b24824f3Shawn Willden keymaster_error_t error = UpdateForFinish(additional_params, input); 167cb647fec03f71929fd316d2b8f0750f7b24824f3Shawn Willden if (error != KM_ERROR_OK) 168cb647fec03f71929fd316d2b8f0750f7b24824f3Shawn Willden return error; 169cb647fec03f71929fd316d2b8f0750f7b24824f3Shawn Willden 1700d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden uint8_t digest[EVP_MAX_MD_SIZE]; 1710d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden unsigned int digest_len; 1720d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden if (!HMAC_Final(&ctx_, digest, &digest_len)) 173567a4a04f43d35b785d50508e6459b01f2ab4d14Shawn Willden return TranslateLastOpenSslError(); 1740d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 1750d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden switch (purpose()) { 1760d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden case KM_PURPOSE_SIGN: 17733ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (mac_length_ > digest_len) 17809f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden return KM_ERROR_UNSUPPORTED_MAC_LENGTH; 17933ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (!output->reserve(mac_length_) || !output->write(digest, mac_length_)) 18009f25270e27ed7b04be6a557c8fe6482d882e7d1Shawn Willden return KM_ERROR_MEMORY_ALLOCATION_FAILED; 1810d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden return KM_ERROR_OK; 18233ab0389e908b98702806c746e7babc0d46eb452Shawn Willden case KM_PURPOSE_VERIFY: { 18333ab0389e908b98702806c746e7babc0d46eb452Shawn Willden size_t siglen = signature.available_read(); 18433ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (siglen > digest_len || siglen < kMinHmacLengthBits / 8) 18533ab0389e908b98702806c746e7babc0d46eb452Shawn Willden return KM_ERROR_UNSUPPORTED_MAC_LENGTH; 18633ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (siglen < min_mac_length_) 18733ab0389e908b98702806c746e7babc0d46eb452Shawn Willden return KM_ERROR_INVALID_MAC_LENGTH; 18833ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (CRYPTO_memcmp(signature.peek_read(), digest, siglen) != 0) 1890d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden return KM_ERROR_VERIFICATION_FAILED; 1900d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden return KM_ERROR_OK; 19133ab0389e908b98702806c746e7babc0d46eb452Shawn Willden } 1920d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden default: 1930d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden return KM_ERROR_UNSUPPORTED_PURPOSE; 1940d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden } 1950d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden} 1960d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden 1970d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden} // namespace keymaster 198