espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-22 18:39:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

[crypto] add error handling to PBDF2 generate key function (#9655)

Browse Source 
Add error handling to PBKDF2 generate key function.
The PBKDF2 functions may fail and the error should be handled by the
caller of the function.
This commit is contained in:
Joakim Andersson
2023-12-04 13:24:00 -08:00
committed by Jonathan Hui
parent 5cab15840d
commit 93ad604524
4 changed files with 38 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/openthread/instance.h
+1 -1
View File
@@ -53,7 +53,7 @@ extern "C" {
* @note This number versions both OpenThread platform and user APIs.
*
*/
#define OPENTHREAD_API_VERSION (381)
#define OPENTHREAD_API_VERSION (382)
/**
* @addtogroup api-instance
include/openthread/platform/crypto.h
+11 -7
View File
@@ -743,14 +743,18 @@ otError otPlatCryptoEcdsaVerifyUsingKeyRef(otCryptoKeyRef aKe
* @param[in] aKeyLen Length of generated key in bytes.
* @param[out] aKey A pointer to the generated key.
*
* @retval OT_ERROR_NONE A new key-pair was generated successfully.
* @retval OT_ERROR_NO_BUFS Failed to allocate buffer for key generation.
* @retval OT_ERROR_NOT_CAPABLE Feature not supported.
* @retval OT_ERROR_FAILED Failed to generate key.
*/
void otPlatCryptoPbkdf2GenerateKey(const uint8_t *aPassword,
uint16_t aPasswordLen,
const uint8_t *aSalt,
uint16_t aSaltLen,
uint32_t aIterationCounter,
uint16_t aKeyLen,
uint8_t *aKey);
otError otPlatCryptoPbkdf2GenerateKey(const uint8_t *aPassword,
uint16_t aPasswordLen,
const uint8_t *aSalt,
uint16_t aSaltLen,
uint32_t aIterationCounter,
uint16_t aKeyLen,
uint8_t *aKey);
/**
* @}
src/core/crypto/crypto_platform.cpp
+24 -15
View File
@@ -716,13 +716,13 @@ OT_TOOL_WEAK otError otPlatCryptoEcdsaVerify(const otPlatCryptoEcdsaPublicKey *a
#if OPENTHREAD_FTD
OT_TOOL_WEAK void otPlatCryptoPbkdf2GenerateKey(const uint8_t *aPassword,
uint16_t aPasswordLen,
const uint8_t *aSalt,
uint16_t aSaltLen,
uint32_t aIterationCounter,
uint16_t aKeyLen,
uint8_t *aKey)
OT_TOOL_WEAK otError otPlatCryptoPbkdf2GenerateKey(const uint8_t *aPassword,
uint16_t aPasswordLen,
const uint8_t *aSalt,
uint16_t aSaltLen,
uint32_t aIterationCounter,
uint16_t aKeyLen,
uint8_t *aKey)
{
#if (MBEDTLS_VERSION_NUMBER >= 0x03050000)
const size_t kBlockSize = MBEDTLS_CMAC_MAX_BLOCK_SIZE;
@@ -737,6 +737,8 @@ OT_TOOL_WEAK void otPlatCryptoPbkdf2GenerateKey(const uint8_t *aPassword,
uint8_t *key = aKey;
uint16_t keyLen = aKeyLen;
uint16_t useLen = 0;
Error error = kErrorNone;
int ret;
OT_ASSERT(aSaltLen <= sizeof(prfInput));
memcpy(prfInput, aSalt, aSaltLen);
@@ -757,12 +759,14 @@ OT_TOOL_WEAK void otPlatCryptoPbkdf2GenerateKey(const uint8_t *aPassword,
prfInput[aSaltLen + 3] = static_cast<uint8_t>(blockCounter);
// Calculate U_1
mbedtls_aes_cmac_prf_128(aPassword, aPasswordLen, prfInput, aSaltLen + 4,
reinterpret_cast<uint8_t *>(keyBlock));
ret = mbedtls_aes_cmac_prf_128(aPassword, aPasswordLen, prfInput, aSaltLen + 4,
reinterpret_cast<uint8_t *>(keyBlock));
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
// Calculate U_2
mbedtls_aes_cmac_prf_128(aPassword, aPasswordLen, reinterpret_cast<const uint8_t *>(keyBlock), kBlockSize,
reinterpret_cast<uint8_t *>(prfOne));
ret = mbedtls_aes_cmac_prf_128(aPassword, aPasswordLen, reinterpret_cast<const uint8_t *>(keyBlock), kBlockSize,
reinterpret_cast<uint8_t *>(prfOne));
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
for (uint32_t j = 0; j < kBlockSize / sizeof(long); ++j)
{
@@ -772,11 +776,13 @@ OT_TOOL_WEAK void otPlatCryptoPbkdf2GenerateKey(const uint8_t *aPassword,
for (uint32_t i = 1; i < aIterationCounter; ++i)
{
// Calculate U_{2 * i - 1}
mbedtls_aes_cmac_prf_128(aPassword, aPasswordLen, reinterpret_cast<const uint8_t *>(prfOne), kBlockSize,
reinterpret_cast<uint8_t *>(prfTwo));
ret = mbedtls_aes_cmac_prf_128(aPassword, aPasswordLen, reinterpret_cast<const uint8_t *>(prfOne),
kBlockSize, reinterpret_cast<uint8_t *>(prfTwo));
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
// Calculate U_{2 * i}
mbedtls_aes_cmac_prf_128(aPassword, aPasswordLen, reinterpret_cast<const uint8_t *>(prfTwo), kBlockSize,
reinterpret_cast<uint8_t *>(prfOne));
ret = mbedtls_aes_cmac_prf_128(aPassword, aPasswordLen, reinterpret_cast<const uint8_t *>(prfTwo),
kBlockSize, reinterpret_cast<uint8_t *>(prfOne));
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
for (uint32_t j = 0; j < kBlockSize / sizeof(long); ++j)
{
@@ -789,6 +795,9 @@ OT_TOOL_WEAK void otPlatCryptoPbkdf2GenerateKey(const uint8_t *aPassword,
key += useLen;
keyLen -= useLen;
}
exit:
return error;
}
#endif // #if OPENTHREAD_FTD
src/core/meshcop/meshcop.cpp
+2 -2
View File
@@ -334,8 +334,8 @@ Error GeneratePskc(const char *aPassPhrase,
memcpy(salt + saltLen, aNetworkName.GetAsCString(), networkNameLen);
saltLen += networkNameLen;
otPlatCryptoPbkdf2GenerateKey(reinterpret_cast<const uint8_t *>(aPassPhrase), passphraseLen, salt, saltLen, 16384,
OT_PSKC_MAX_SIZE, aPskc.m8);
error = otPlatCryptoPbkdf2GenerateKey(reinterpret_cast<const uint8_t *>(aPassPhrase), passphraseLen, salt, saltLen,
16384, OT_PSKC_MAX_SIZE, aPskc.m8);
exit:
return error;