espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-09-01 23:09:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

[crypto] move context to platforms (#7008)

Browse Source
This commit is contained in:
Jiacheng Guo
2021-09-26 21:38:23 -07:00
committed by GitHub
parent 5564ea0530
commit 9d7067f5a7
16 changed files with 481 additions and 208 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/openthread/instance.h
+1 -1
View File
@@ -53,7 +53,7 @@ extern "C" {
* @note This number versions both OpenThread platform and user APIs.
*
*/
#define OPENTHREAD_API_VERSION (168)
#define OPENTHREAD_API_VERSION (169)
/**
* @addtogroup api-instance
include/openthread/platform/crypto.h
+68 -73
View File
@@ -118,6 +118,18 @@ typedef struct otCryptoKey
uint32_t mKeyRef; ///< The PSA key ref (requires `mKey` to be NULL).
} otCryptoKey;
/**
* @struct otCryptoContext
*
* This structure stores the context object for platform APIs.
*
*/
typedef struct otCryptoContext
{
void * mContext; ///< Pointer to the context.
uint16_t mContextSize; ///< The length of the context in bytes.
} otCryptoContext;
/**
* Initialize the Crypto module.
*
@@ -206,57 +218,46 @@ bool otPlatCryptoHasKey(otCryptoKeyRef aKeyRef);
* Initialize the HMAC operation.
*
* @param[in] aContext Context for HMAC operation.
* @param[in] aContextSize Context size HMAC operation.
*
* @retval OT_ERROR_NONE Successfully initialized HMAC operation.
* @retval OT_ERROR_FAILED Failed to initialize HMAC operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
*
* @note In case PSA is supported pointer to psa_mac_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_md_context_t will be provided.
* @note The platform driver shall point the context to the correct object such as psa_mac_operation_t or
* mbedtls_md_context_t.
*
*/
otError otPlatCryptoHmacSha256Init(void *aContext, size_t aContextSize);
otError otPlatCryptoHmacSha256Init(otCryptoContext *aContext);
/**
* Uninitialize the HMAC operation.
*
* @param[in] aContext Context for HMAC operation.
* @param[in] aContextSize Context size HMAC operation.
*
*
* @retval OT_ERROR_NONE Successfully uninitialized HMAC operation.
* @retval OT_ERROR_FAILED Failed to uninitialized HMAC operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
*
* @note In case PSA is supported pointer to psa_mac_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_md_context_t will be provided.
*
*/
otError otPlatCryptoHmacSha256Deinit(void *aContext, size_t aContextSize);
otError otPlatCryptoHmacSha256Deinit(otCryptoContext *aContext);
/**
* Start HMAC operation.
*
* @param[in] aContext Context for HMAC operation.
* @param[in] aContextSize Context size HMAC operation.
* @param[in] aKey Key material to be used for for HMAC operation.
*
* @retval OT_ERROR_NONE Successfully started HMAC operation.
* @retval OT_ERROR_FAILED Failed to start HMAC operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aKey was NULL
*
* @note In case PSA is supported pointer to psa_mac_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_md_context_t will be provided.
*
*/
otError otPlatCryptoHmacSha256Start(void *aContext, size_t aContextSize, const otCryptoKey *aKey);
otError otPlatCryptoHmacSha256Start(otCryptoContext *aContext, const otCryptoKey *aKey);
/**
* Update the HMAC operation with new input.
*
* @param[in] aContext Context for HMAC operation.
* @param[in] aContextSize Context size HMAC operation.
* @param[in] aBuf A pointer to the input buffer.
* @param[in] aBufLength The length of @p aBuf in bytes.
*
@@ -264,17 +265,13 @@ otError otPlatCryptoHmacSha256Start(void *aContext, size_t aContextSize, const o
* @retval OT_ERROR_FAILED Failed to update HMAC operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aBuf was NULL
*
* @note In case PSA is supported pointer to psa_mac_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_md_context_t will be provided.
*
*/
otError otPlatCryptoHmacSha256Update(void *aContext, size_t aContextSize, const void *aBuf, uint16_t aBufLength);
otError otPlatCryptoHmacSha256Update(otCryptoContext *aContext, const void *aBuf, uint16_t aBufLength);
/**
* Complete the HMAC operation.
*
* @param[in] aContext Context for HMAC operation.
* @param[in] aContextSize Context size HMAC operation.
* @param[out] aBuf A pointer to the output buffer.
* @param[in] aBufLength The length of @p aBuf in bytes.
*
@@ -282,50 +279,42 @@ otError otPlatCryptoHmacSha256Update(void *aContext, size_t aContextSize, const
* @retval OT_ERROR_FAILED Failed to complete HMAC operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aBuf was NULL
*
* @note In case PSA is supported pointer to psa_mac_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_md_context_t will be provided.
*
*/
otError otPlatCryptoHmacSha256Finish(void *aContext, size_t aContextSize, uint8_t *aBuf, size_t aBufLength);
otError otPlatCryptoHmacSha256Finish(otCryptoContext *aContext, uint8_t *aBuf, size_t aBufLength);
/**
* Initialise the AES operation.
*
* @param[in] aContext Context for AES operation.
* @param[in] aContextSize Context size AES operation.
*
* @retval OT_ERROR_NONE Successfully Initialised AES operation.
* @retval OT_ERROR_FAILED Failed to Initialise AES operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
* @retval OT_ERROR_NO_BUFS Cannot allocate the context.
*
* @note In case PSA is supported pointer to psa_key_id will be passed as input.
* In case of mbedTLS, pointer to mbedtls_aes_context_t will be provided.
* @note The platform driver shall point the context to the correct object such as psa_key_id
* or mbedtls_aes_context_t.
*
*/
otError otPlatCryptoAesInit(void *aContext, size_t aContextSize);
otError otPlatCryptoAesInit(otCryptoContext *aContext);
/**
* Set the key for AES operation.
*
* @param[in] aContext Context for AES operation.
* @param[in] aContextSize Context size AES operation.
* @param[out] aKey Key to use for AES operation.
*
* @retval OT_ERROR_NONE Successfully set the key for AES operation.
* @retval OT_ERROR_FAILED Failed to set the key for AES operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aKey was NULL
*
* @note In case PSA is supported pointer to psa_key_id will be passed as input.
* In case of mbedTLS, pointer to mbedtls_aes_context_t will be provided.
*
*/
otError otPlatCryptoAesSetKey(void *aContext, size_t aContextSize, const otCryptoKey *aKey);
otError otPlatCryptoAesSetKey(otCryptoContext *aContext, const otCryptoKey *aKey);
/**
* Encrypt the given data.
*
* @param[in] aContext Context for AES operation.
* @param[in] aContextSize Context size AES operation.
* @param[in] aInput Pointer to the input buffer.
* @param[in] aOutput Pointer to the output buffer.
*
@@ -333,33 +322,40 @@ otError otPlatCryptoAesSetKey(void *aContext, size_t aContextSize, const otCrypt
* @retval OT_ERROR_FAILED Failed to encrypt @p aInput.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aKey or @p aOutput were NULL
*
* @note In case PSA is supported pointer to psa_key_id will be passed as input.
* In case of mbedTLS, pointer to mbedtls_aes_context_t will be provided.
*
*/
otError otPlatCryptoAesEncrypt(void *aContext, size_t aContextSize, const uint8_t *aInput, uint8_t *aOutput);
otError otPlatCryptoAesEncrypt(otCryptoContext *aContext, const uint8_t *aInput, uint8_t *aOutput);
/**
* Free the AES context.
*
* @param[in] aContext Context for AES operation.
* @param[in] aContextSize Context size AES operation.
*
* @retval OT_ERROR_NONE Successfully freed AES context.
* @retval OT_ERROR_FAILED Failed to free AES context.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
*
* @note In case PSA is supported pointer to psa_key_id will be passed as input.
* In case of mbedTLS, pointer to mbedtls_aes_context_t will be provided.
*/
otError otPlatCryptoAesFree(otCryptoContext *aContext);
/**
* Initialise the HKDF context.
*
* @param[in] aContext Context for HKDF operation.
*
* @retval OT_ERROR_NONE Successfully Initialised AES operation.
* @retval OT_ERROR_FAILED Failed to Initialise AES operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
*
* @note The platform driver shall point the context to the correct object such as psa_key_derivation_operation_t
* or HmacSha256::Hash
*
*/
otError otPlatCryptoAesFree(void *aContext, size_t aContextSize);
otError otPlatCryptoHkdfInit(otCryptoContext *aContext);
/**
* Perform HKDF Expand step.
*
* @param[in] aContext Operation context for HKDF operation.
* @param[in] aContextSize Context size HKDF operation.
* @param[in] aInfo Pointer to the Info sequence.
* @param[in] aInfoLength Length of the Info sequence.
* @param[out] aOutputKey Pointer to the output Key.
@@ -367,20 +363,19 @@ otError otPlatCryptoAesFree(void *aContext, size_t aContextSize);
*
* @retval OT_ERROR_NONE HKDF Expand was successful.
* @retval OT_ERROR_FAILED HKDF Expand failed.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
*
*/
otError otPlatCryptoHkdfExpand(void * aContext,
size_t aContextSize,
const uint8_t *aInfo,
uint16_t aInfoLength,
uint8_t * aOutputKey,
uint16_t aOutputKeyLength);
otError otPlatCryptoHkdfExpand(otCryptoContext *aContext,
const uint8_t * aInfo,
uint16_t aInfoLength,
uint8_t * aOutputKey,
uint16_t aOutputKeyLength);
/**
* Perform HKDF Extract step.
*
* @param[in] aContext Operation context for HKDF operation.
* @param[in] aContextSize Context size HKDF operation.
* @param[in] aSalt Pointer to the Salt for HKDF.
* @param[in] aInfoLength length of Salt.
* @param[in] aInputKey Pointer to the input key.
@@ -389,62 +384,66 @@ otError otPlatCryptoHkdfExpand(void * aContext,
* @retval OT_ERROR_FAILED HKDF Extract failed.
*
*/
otError otPlatCryptoHkdfExtract(void * aContext,
size_t aContextSize,
otError otPlatCryptoHkdfExtract(otCryptoContext * aContext,
const uint8_t * aSalt,
uint16_t aSaltLength,
const otCryptoKey *aInputKey);
/**
* Uninitialize the HKDF context.
*
* @param[in] aContext Context for HKDF operation.
*
* @retval OT_ERROR_NONE Successfully un-initialised HKDF operation.
* @retval OT_ERROR_FAILED Failed to un-initialised HKDF operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
*
*/
otError otPlatCryptoHkdfDeinit(otCryptoContext *aContext);
/**
* Initialise the SHA-256 operation.
*
* @param[in] aContext Context for SHA-256 operation.
* @param[in] aContextSize Context size SHA-256 operation.
*
* @retval OT_ERROR_NONE Successfully initialised SHA-256 operation.
* @retval OT_ERROR_FAILED Failed to initialise SHA-256 operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
*
* @note In case PSA is supported pointer to psa_hash_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_sha256_context will be provided.
*
* @note The platform driver shall point the context to the correct object such as psa_hash_operation_t
* or mbedtls_sha256_context.
*/
otError otPlatCryptoSha256Init(void *aContext, size_t aContextSize);
otError otPlatCryptoSha256Init(otCryptoContext *aContext);
/**
* UnInitialise the SHA-256 operation.
* Uninitialize the SHA-256 operation.
*
* @param[in] aContext Context for SHA-256 operation.
* @param[in] aContextSize Context size SHA-256 operation.
*
* @retval OT_ERROR_NONE Successfully un-initialised SHA-256 operation.
* @retval OT_ERROR_FAILED Failed to un-initialised SHA-256 operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
*
* @note In case PSA is supported pointer to psa_hash_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_sha256_context will be provided.
*/
otError otPlatCryptoSha256Deinit(void *aContext, size_t aContextSize);
otError otPlatCryptoSha256Deinit(otCryptoContext *aContext);
/**
* Start SHA-256 operation.
*
* @param[in] aContext Context for SHA-256 operation.
* @param[in] aContextSize Context size SHA-256 operation.
*
* @retval OT_ERROR_NONE Successfully started SHA-256 operation.
* @retval OT_ERROR_FAILED Failed to start SHA-256 operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
*
* @note In case PSA is supported pointer to psa_hash_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_sha256_context will be provided.
*/
otError otPlatCryptoSha256Start(void *aContext, size_t aContextSize);
otError otPlatCryptoSha256Start(otCryptoContext *aContext);
/**
* Update SHA-256 operation with new input.
*
* @param[in] aContext Context for SHA-256 operation.
* @param[in] aContextSize Context size SHA-256 operation.
* @param[in] aBuf A pointer to the input buffer.
* @param[in] aBufLength The length of @p aBuf in bytes.
*
@@ -452,10 +451,8 @@ otError otPlatCryptoSha256Start(void *aContext, size_t aContextSize);
* @retval OT_ERROR_FAILED Failed to update SHA-256 operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aBuf was NULL
*
* @note In case PSA is supported pointer to psa_hash_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_sha256_context will be provided.
*/
otError otPlatCryptoSha256Update(void *aContext, size_t aContextSize, const void *aBuf, uint16_t aBufLength);
otError otPlatCryptoSha256Update(otCryptoContext *aContext, const void *aBuf, uint16_t aBufLength);
/**
* Finish SHA-256 operation.
@@ -469,10 +466,8 @@ otError otPlatCryptoSha256Update(void *aContext, size_t aContextSize, const void
* @retval OT_ERROR_FAILED Failed to complete SHA-256 operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aHash was NULL
*
* @note In case PSA is supported pointer to psa_hash_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_sha256_context will be provided.
*/
otError otPlatCryptoSha256Finish(void *aContext, size_t aContextSize, uint8_t *aHash, uint16_t aHashSize);
otError otPlatCryptoSha256Finish(otCryptoContext *aContext, uint8_t *aHash, uint16_t aHashSize);
/**
* @}
src/core/BUILD.gn
+2
View File
@@ -431,6 +431,7 @@ openthread_core_files = [
"crypto/aes_ccm.hpp",
"crypto/aes_ecb.cpp",
"crypto/aes_ecb.hpp",
"crypto/context_size.hpp",
"crypto/crypto_platform.cpp",
"crypto/ecdsa.cpp",
"crypto/ecdsa.hpp",
@@ -723,6 +724,7 @@ source_set("libopenthread_core_config") {
"config/child_supervision.h",
"config/coap.h",
"config/commissioner.h",
"config/crypto.h",
"config/dataset_updater.h",
"config/dhcp6_client.h",
"config/dhcp6_server.h",
src/core/Makefile.am
+2
View File
@@ -460,6 +460,7 @@ HEADERS_COMMON = \
config/child_supervision.h \
config/coap.h \
config/commissioner.h \
config/crypto.h \
config/dataset_updater.h \
config/dhcp6_client.h \
config/dhcp6_server.h \
@@ -489,6 +490,7 @@ HEADERS_COMMON = \
config/tmf.h \
crypto/aes_ccm.hpp \
crypto/aes_ecb.hpp \
crypto/context_size.hpp \
crypto/ecdsa.hpp \
crypto/hkdf_sha256.hpp \
crypto/hmac_sha256.hpp \
src/core/config/crypto.h
+98
View File
@@ -0,0 +1,98 @@
/*
* Copyright (c) 2021, The OpenThread Authors.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the copyright holder nor the
* names of its contributors may be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef CONFIG_CRYPTO_H_
#define CONFIG_CRYPTO_H_
/**
* @def OPENTHREAD_CONFIG_CRYPTO_LIB
*
* Selects the crypto backend library for OpenThread.
*
* There are several options available
* - @sa OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
* - @sa OPENTHREAD_CONFIG_CRYPTO_LIB_PSA
* - @sa OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM
*
*/
#ifndef OPENTHREAD_CONFIG_CRYPTO_LIB
#define OPENTHREAD_CONFIG_CRYPTO_LIB OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
#endif
/** Use mbedtls as crypto library */
#define OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS 0
/** Use ARM Platform Security Library as crypto library */
#define OPENTHREAD_CONFIG_CRYPTO_LIB_PSA 1
/** Use platform provided crypto library */
#define OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM 2
#if OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM
/**
* @def OPENTHREAD_CONFIG_AES_CONTEXT_SIZE
*
* The size of the AES context byte array. Only applicable with OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM.
*
*/
#ifndef OPENTHREAD_CONFIG_AES_CONTEXT_SIZE
#error "OPENTHREAD_CONFIG_AES_CONTEXT_SIZE is missing"
#endif
/**
* @def OPENTHREAD_CONFIG_HMAC_SHA256_CONTEXT_SIZE
*
* The size of the HMAC_SHA256 context byte array. Only applicable with OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM.
*
*/
#ifndef OPENTHREAD_CONFIG_HMAC_SHA256_CONTEXT_SIZE
#error "OPENTHREAD_CONFIG_HMAC_SHA256_CONTEXT_SIZE is missing"
#endif
/**
* @def OPENTHREAD_CONFIG_HKDF_CONTEXT_SIZE
*
* The size of the HKDF context byte array. Only applicable with OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM.
*
*/
#ifndef OPENTHREAD_CONFIG_HKDF_CONTEXT_SIZE
#error "OPENTHREAD_CONFIG_HKDF_CONTEXT_SIZE is missing"
#endif
/**
* @def OPENTHREAD_CONFIG_SHA256_CONTEXT_SIZE
*
* The size of the SHA256 context byte array. Only applicable with OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM.
*
*/
#ifndef OPENTHREAD_CONFIG_SHA256_CONTEXT_SIZE
#error "OPENTHREAD_CONFIG_SHA256_CONTEXT_SIZE is missing"
#endif
#endif // OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM
#endif // CONFIG_CRYPTO_H_
src/core/crypto/aes_ecb.cpp
+9 -4
View File
@@ -40,28 +40,33 @@ namespace Crypto {
AesEcb::AesEcb(void)
{
Error err = otPlatCryptoAesInit(&mContext, sizeof(mContext));
Error err = kErrorNone;
mContext.mContext = mContextStorage;
mContext.mContextSize = sizeof(mContextStorage);
err = otPlatCryptoAesInit(&mContext);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
void AesEcb::SetKey(const Key &aKey)
{
Error err = otPlatCryptoAesSetKey(&mContext, sizeof(mContext), &aKey);
Error err = otPlatCryptoAesSetKey(&mContext, &aKey);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
void AesEcb::Encrypt(const uint8_t aInput[kBlockSize], uint8_t aOutput[kBlockSize])
{
Error err = otPlatCryptoAesEncrypt(&mContext, sizeof(mContext), aInput, aOutput);
Error err = otPlatCryptoAesEncrypt(&mContext, aInput, aOutput);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
AesEcb::~AesEcb(void)
{
Error err = otPlatCryptoAesFree(&mContext, sizeof(mContext));
Error err = otPlatCryptoAesFree(&mContext);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
src/core/crypto/aes_ecb.hpp
+5 -8
View File
@@ -35,9 +35,11 @@
#define AES_ECB_HPP_
#include "openthread-core-config.h"
#include <mbedtls/aes.h>
#include <openthread/platform/crypto.h>
#include "common/code_utils.hpp"
#include "crypto/context_size.hpp"
#include "crypto/storage.hpp"
namespace ot {
@@ -89,13 +91,8 @@ public:
void Encrypt(const uint8_t aInput[kBlockSize], uint8_t aOutput[kBlockSize]);
private:
union AesEcbContext
{
uint32_t mKeyRef;
mbedtls_aes_context mContext;
};
AesEcbContext mContext;
otCryptoContext mContext;
OT_DEFINE_ALIGNED_VAR(mContextStorage, kAesContextSize, uint64_t);
};
/**
src/core/crypto/context_size.hpp
+72
View File
@@ -0,0 +1,72 @@
/*
* Copyright (c) 2021, The OpenThread Authors.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the copyright holder nor the
* names of its contributors may be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef CRYPTO_CONTEXT_HPP_
#define CRYPTO_CONTEXT_HPP_
#include "openthread-core-config.h"
#include "openthread/crypto.h"
#if OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
#include <mbedtls/aes.h>
#include <mbedtls/md.h>
#include <mbedtls/sha256.h>
#elif OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PSA
#include <psa/crypto.h>
#endif // OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
namespace ot {
namespace Crypto {
#if OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
constexpr uint16_t kAesContextSize = sizeof(mbedtls_aes_context);
constexpr uint16_t kHmacSha256ContextSize = sizeof(mbedtls_md_context_t);
constexpr uint16_t kHkdfContextSize = sizeof(otCryptoSha256Hash);
constexpr uint16_t kSha256ContextSize = sizeof(mbedtls_sha256_context);
#elif OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PSA
constexpr uint16_t kAesContextSize = sizeof(psa_key_id_t);
constexpr uint16_t kHmacSha256ContextSize = sizeof(psa_mac_operation_t);
constexpr uint16_t kHkdfContextSize = sizeof(psa_key_derivation_operation_t);
constexpr uint16_t kSha256ContextSize = sizeof(psa_hash_operation_t);
#else
constexpr uint16_t kAesContextSize = OPENTHREAD_CONFIG_AES_CONTEXT_SIZE;
constexpr uint16_t kHmacSha256ContextSize = OPENTHREAD_CONFIG_HMAC_SHA256_CONTEXT_SIZE;
constexpr uint16_t kHkdfContextSize = OPENTHREAD_CONFIG_HKDF_CONTEXT_SIZE;
constexpr uint16_t kSha256ContextSize = OPENTHREAD_CONFIG_SHA256_CONTEXT_SIZE;
#endif // OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
} // namespace Crypto
} // namespace ot
#endif // CRYPTO_CONTEXT_HPP_
src/core/crypto/crypto_platform.cpp
+153 -81
View File
@@ -34,6 +34,7 @@
#include <mbedtls/aes.h>
#include <mbedtls/md.h>
#include <mbedtls/sha256.h>
#include <openthread/instance.h>
#include <openthread/platform/crypto.h>
@@ -42,7 +43,8 @@
#include "common/code_utils.hpp"
#include "common/debug.hpp"
#include "common/instance.hpp"
#include "common/message.hpp"
#include "common/new.hpp"
#include "config/crypto.h"
#include "crypto/hmac_sha256.hpp"
#include "crypto/storage.hpp"
@@ -58,25 +60,31 @@ OT_TOOL_WEAK otError otPlatCryptoInit(void)
}
// AES Implementation
OT_TOOL_WEAK otError otPlatCryptoAesInit(void *aContext, size_t aContextSize)
OT_TOOL_WEAK otError otPlatCryptoAesInit(otCryptoContext *aContext)
{
Error error = kErrorNone;
mbedtls_aes_context *context = static_cast<mbedtls_aes_context *>(aContext);
Error error = kErrorNone;
mbedtls_aes_context *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed);
context = static_cast<mbedtls_aes_context *>(aContext->mContext);
mbedtls_aes_init(context);
exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoAesSetKey(void *aContext, size_t aContextSize, const otCryptoKey *aKey)
OT_TOOL_WEAK otError otPlatCryptoAesSetKey(otCryptoContext *aContext, const otCryptoKey *aKey)
{
Error error = kErrorNone;
mbedtls_aes_context *context = static_cast<mbedtls_aes_context *>(aContext);
Error error = kErrorNone;
mbedtls_aes_context *context;
const LiteralKey key(*static_cast<const Key *>(aKey));
VerifyOrExit(aContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed);
context = static_cast<mbedtls_aes_context *>(aContext->mContext);
VerifyOrExit((mbedtls_aes_setkey_enc(context, key.GetBytes(), (key.GetLength() * CHAR_BIT)) == 0),
error = kErrorFailed);
@@ -84,27 +92,30 @@ exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoAesEncrypt(void * aContext,
size_t aContextSize,
const uint8_t *aInput,
uint8_t * aOutput)
OT_TOOL_WEAK otError otPlatCryptoAesEncrypt(otCryptoContext *aContext, const uint8_t *aInput, uint8_t *aOutput)
{
Error error = kErrorNone;
mbedtls_aes_context *context = static_cast<mbedtls_aes_context *>(aContext);
Error error = kErrorNone;
mbedtls_aes_context *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed);
context = static_cast<mbedtls_aes_context *>(aContext->mContext);
VerifyOrExit((mbedtls_aes_crypt_ecb(context, MBEDTLS_AES_ENCRYPT, aInput, aOutput) == 0), error = kErrorFailed);
exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoAesFree(void *aContext, size_t aContextSize)
OT_TOOL_WEAK otError otPlatCryptoAesFree(otCryptoContext *aContext)
{
Error error = kErrorNone;
mbedtls_aes_context *context = static_cast<mbedtls_aes_context *>(aContext);
Error error = kErrorNone;
mbedtls_aes_context *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed);
context = static_cast<mbedtls_aes_context *>(aContext->mContext);
mbedtls_aes_free(context);
exit:
@@ -114,13 +125,16 @@ exit:
#if !OPENTHREAD_RADIO
// HMAC implementations
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Init(void *aContext, size_t aContextSize)
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Init(otCryptoContext *aContext)
{
Error error = kErrorNone;
const mbedtls_md_info_t *mdInfo = nullptr;
mbedtls_md_context_t * context = static_cast<mbedtls_md_context_t *>(aContext);
Error error = kErrorNone;
const mbedtls_md_info_t *mdInfo = nullptr;
mbedtls_md_context_t * context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
context = static_cast<mbedtls_md_context_t *>(aContext->mContext);
mbedtls_md_init(context);
mdInfo = mbedtls_md_info_from_type(MBEDTLS_MD_SHA256);
VerifyOrExit((mbedtls_md_setup(context, mdInfo, 1) == 0), error = kErrorFailed);
@@ -129,40 +143,46 @@ exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Deinit(void *aContext, size_t aContextSize)
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Deinit(otCryptoContext *aContext)
{
Error error = kErrorNone;
mbedtls_md_context_t *context = static_cast<mbedtls_md_context_t *>(aContext);
Error error = kErrorNone;
mbedtls_md_context_t *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
context = static_cast<mbedtls_md_context_t *>(aContext->mContext);
mbedtls_md_free(context);
exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Start(void *aContext, size_t aContextSize, const otCryptoKey *aKey)
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Start(otCryptoContext *aContext, const otCryptoKey *aKey)
{
Error error = kErrorNone;
mbedtls_md_context_t *context = static_cast<mbedtls_md_context_t *>(aContext);
Error error = kErrorNone;
const LiteralKey key(*static_cast<const Key *>(aKey));
mbedtls_md_context_t *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
context = static_cast<mbedtls_md_context_t *>(aContext->mContext);
VerifyOrExit((mbedtls_md_hmac_starts(context, key.GetBytes(), key.GetLength()) == 0), error = kErrorFailed);
exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Update(void * aContext,
size_t aContextSize,
const void *aBuf,
uint16_t aBufLength)
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Update(otCryptoContext *aContext, const void *aBuf, uint16_t aBufLength)
{
Error error = kErrorNone;
mbedtls_md_context_t *context = static_cast<mbedtls_md_context_t *>(aContext);
Error error = kErrorNone;
mbedtls_md_context_t *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
context = static_cast<mbedtls_md_context_t *>(aContext->mContext);
VerifyOrExit((mbedtls_md_hmac_update(context, reinterpret_cast<const uint8_t *>(aBuf), aBufLength) == 0),
error = kErrorFailed);
@@ -170,35 +190,53 @@ exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Finish(void *aContext, size_t aContextSize, uint8_t *aBuf, size_t aBufLength)
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Finish(otCryptoContext *aContext, uint8_t *aBuf, size_t aBufLength)
{
OT_UNUSED_VARIABLE(aBufLength);
Error error = kErrorNone;
mbedtls_md_context_t *context = static_cast<mbedtls_md_context_t *>(aContext);
Error error = kErrorNone;
mbedtls_md_context_t *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
context = static_cast<mbedtls_md_context_t *>(aContext->mContext);
VerifyOrExit((mbedtls_md_hmac_finish(context, aBuf) == 0), error = kErrorFailed);
exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoHkdfExpand(void * aContext,
size_t aContextSize,
const uint8_t *aInfo,
uint16_t aInfoLength,
uint8_t * aOutputKey,
uint16_t aOutputKeyLength)
otError otPlatCryptoHkdfInit(otCryptoContext *aContext)
{
Error error = kErrorNone;
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(HmacSha256::Hash), error = kErrorFailed);
new (aContext->mContext) HmacSha256::Hash();
exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoHkdfExpand(otCryptoContext *aContext,
const uint8_t * aInfo,
uint16_t aInfoLength,
uint8_t * aOutputKey,
uint16_t aOutputKeyLength)
{
Error error = kErrorNone;
HmacSha256 hmac;
HmacSha256::Hash hash;
uint8_t iter = 0;
uint16_t copyLength;
HmacSha256::Hash *prk = static_cast<HmacSha256::Hash *>(aContext);
HmacSha256::Hash *prk;
VerifyOrExit(aContextSize >= sizeof(HmacSha256::Hash), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(HmacSha256::Hash), error = kErrorFailed);
prk = static_cast<HmacSha256::Hash *>(aContext->mContext);
// The aOutputKey is calculated as follows [RFC5889]:
//
@@ -242,8 +280,7 @@ exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoHkdfExtract(void * aContext,
size_t aContextSize,
OT_TOOL_WEAK otError otPlatCryptoHkdfExtract(otCryptoContext * aContext,
const uint8_t * aSalt,
uint16_t aSaltLength,
const otCryptoKey *aInputKey)
@@ -251,13 +288,15 @@ OT_TOOL_WEAK otError otPlatCryptoHkdfExtract(void * aContext,
Error error = kErrorNone;
HmacSha256 hmac;
Key cryptoKey;
HmacSha256::Hash *prk = static_cast<HmacSha256::Hash *>(aContext);
HmacSha256::Hash *prk;
const LiteralKey inputKey(*static_cast<const Key *>(aInputKey));
VerifyOrExit(aContextSize >= sizeof(HmacSha256::Hash), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(HmacSha256::Hash), error = kErrorFailed);
prk = static_cast<HmacSha256::Hash *>(aContext->mContext);
cryptoKey.Set(aSalt, aSaltLength);
// PRK is calculated as HMAC-Hash(aSalt, aInputKey)
hmac.Start(cryptoKey);
hmac.Update(inputKey.GetBytes(), inputKey.GetLength());
@@ -267,37 +306,65 @@ exit:
return error;
}
// SHA256 platform implementations
OT_TOOL_WEAK otError otPlatCryptoSha256Init(void *aContext, size_t aContextSize)
otError otPlatCryptoHkdfDeinit(otCryptoContext *aContext)
{
Error error = kErrorNone;
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext);
Error error = kErrorNone;
HmacSha256::Hash *prk;
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(HmacSha256::Hash), error = kErrorFailed);
prk = static_cast<HmacSha256::Hash *>(aContext->mContext);
prk->~Hash();
aContext->mContext = nullptr;
aContext->mContextSize = 0;
exit:
return error;
}
// SHA256 platform implementations
OT_TOOL_WEAK otError otPlatCryptoSha256Init(otCryptoContext *aContext)
{
Error error = kErrorNone;
mbedtls_sha256_context *context;
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
context = static_cast<mbedtls_sha256_context *>(aContext->mContext);
mbedtls_sha256_init(context);
exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoSha256Deinit(void *aContext, size_t aContextSize)
OT_TOOL_WEAK otError otPlatCryptoSha256Deinit(otCryptoContext *aContext)
{
Error error = kErrorNone;
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext);
Error error = kErrorNone;
mbedtls_sha256_context *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
context = static_cast<mbedtls_sha256_context *>(aContext->mContext);
mbedtls_sha256_free(context);
aContext->mContext = nullptr;
aContext->mContextSize = 0;
exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoSha256Start(void *aContext, size_t aContextSize)
OT_TOOL_WEAK otError otPlatCryptoSha256Start(otCryptoContext *aContext)
{
Error error = kErrorNone;
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext);
Error error = kErrorNone;
mbedtls_sha256_context *context;
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
context = static_cast<mbedtls_sha256_context *>(aContext->mContext);
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
VerifyOrExit((mbedtls_sha256_starts(context, 0) == 0), error = kErrorFailed);
#else
@@ -308,15 +375,16 @@ exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoSha256Update(void * aContext,
size_t aContextSize,
const void *aBuf,
uint16_t aBufLength)
OT_TOOL_WEAK otError otPlatCryptoSha256Update(otCryptoContext *aContext, const void *aBuf, uint16_t aBufLength)
{
Error error = kErrorNone;
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext);
Error error = kErrorNone;
mbedtls_sha256_context *context;
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
context = static_cast<mbedtls_sha256_context *>(aContext->mContext);
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
VerifyOrExit((mbedtls_sha256_update(context, reinterpret_cast<const uint8_t *>(aBuf), aBufLength) == 0),
error = kErrorFailed);
@@ -329,14 +397,18 @@ exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoSha256Finish(void *aContext, size_t aContextSize, uint8_t *aHash, uint16_t aHashSize)
OT_TOOL_WEAK otError otPlatCryptoSha256Finish(otCryptoContext *aContext, uint8_t *aHash, uint16_t aHashSize)
{
OT_UNUSED_VARIABLE(aHashSize);
Error error = kErrorNone;
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext);
Error error = kErrorNone;
mbedtls_sha256_context *context;
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
context = static_cast<mbedtls_sha256_context *>(aContext->mContext);
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
VerifyOrExit((mbedtls_sha256_finish(context, aHash) == 0), error = kErrorFailed);
#else
src/core/crypto/hkdf_sha256.cpp
+24 -2
View File
@@ -37,20 +37,42 @@
#include "common/code_utils.hpp"
#include "common/debug.hpp"
#include "common/error.hpp"
#include "openthread/platform/crypto.h"
namespace ot {
namespace Crypto {
HkdfSha256::HkdfSha256(void)
{
Error err = kErrorNone;
mContext.mContext = mContextStorage;
mContext.mContextSize = sizeof(mContextStorage);
err = otPlatCryptoHkdfInit(&mContext);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
HkdfSha256::~HkdfSha256(void)
{
Error err = otPlatCryptoHkdfDeinit(&mContext);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
void HkdfSha256::Extract(const uint8_t *aSalt, uint16_t aSaltLength, const Key &aInputKey)
{
Error err = otPlatCryptoHkdfExtract(&mContext, sizeof(mContext), aSalt, aSaltLength, &aInputKey);
Error err = otPlatCryptoHkdfExtract(&mContext, aSalt, aSaltLength, &aInputKey);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
void HkdfSha256::Expand(const uint8_t *aInfo, uint16_t aInfoLength, uint8_t *aOutputKey, uint16_t aOutputKeyLength)
{
Error err = otPlatCryptoHkdfExpand(&mContext, sizeof(mContext), aInfo, aInfoLength, aOutputKey, aOutputKeyLength);
Error err = otPlatCryptoHkdfExpand(&mContext, aInfo, aInfoLength, aOutputKey, aOutputKeyLength);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
src/core/crypto/hkdf_sha256.hpp
+17 -9
View File
@@ -37,9 +37,10 @@
#include "openthread-core-config.h"
#include <psa/crypto.h>
#include "common/code_utils.hpp"
#include "crypto/context_size.hpp"
#include "crypto/hmac_sha256.hpp"
#include "openthread/platform/crypto.h"
namespace ot {
namespace Crypto {
@@ -58,6 +59,18 @@ namespace Crypto {
class HkdfSha256
{
public:
/**
* Constructor to initialize the context.
*
*/
HkdfSha256(void);
/**
* Destructor to free the context.
*
*/
~HkdfSha256(void);
/**
* This method performs the HKDF Extract step.
*
@@ -85,13 +98,8 @@ public:
void Expand(const uint8_t *aInfo, uint16_t aInfoLength, uint8_t *aOutputKey, uint16_t aOutputKeyLength);
private:
union HkdfContext
{
HmacSha256::Hash mPrk; // Pseudo-Random Key (derived from Extract step).
psa_key_derivation_operation_t mOperation;
};
HkdfContext mContext;
otCryptoContext mContext;
OT_DEFINE_ALIGNED_VAR(mContextStorage, kHkdfContextSize, uint64_t);
};
/**
src/core/crypto/hmac_sha256.cpp
+11 -5
View File
@@ -33,6 +33,7 @@
#include "hmac_sha256.hpp"
#include "common/debug.hpp"
#include "common/error.hpp"
#include "common/message.hpp"
namespace ot {
@@ -40,35 +41,40 @@ namespace Crypto {
HmacSha256::HmacSha256(void)
{
Error err = otPlatCryptoHmacSha256Init(&mContext, sizeof(mContext));
Error err = kErrorNone;
mContext.mContext = mContextStorage;
mContext.mContextSize = sizeof(mContextStorage);
err = otPlatCryptoHmacSha256Init(&mContext);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
HmacSha256::~HmacSha256(void)
{
Error err = otPlatCryptoHmacSha256Deinit(&mContext, sizeof(mContext));
Error err = otPlatCryptoHmacSha256Deinit(&mContext);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
void HmacSha256::Start(const Key &aKey)
{
Error err = otPlatCryptoHmacSha256Start(&mContext, sizeof(mContext), &aKey);
Error err = otPlatCryptoHmacSha256Start(&mContext, &aKey);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
void HmacSha256::Update(const void *aBuf, uint16_t aBufLength)
{
Error err = otPlatCryptoHmacSha256Update(&mContext, sizeof(mContext), aBuf, aBufLength);
Error err = otPlatCryptoHmacSha256Update(&mContext, aBuf, aBufLength);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
void HmacSha256::Finish(Hash &aHash)
{
Error err = otPlatCryptoHmacSha256Finish(&mContext, sizeof(mContext), aHash.m8, Hash::kSize);
Error err = otPlatCryptoHmacSha256Finish(&mContext, aHash.m8, Hash::kSize);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
src/core/crypto/hmac_sha256.hpp
+4 -10
View File
@@ -38,11 +38,10 @@
#include <stdint.h>
#include <mbedtls/md.h>
#include <psa/crypto.h>
#include <openthread/platform/crypto.h>
#include "common/code_utils.hpp"
#include "crypto/context_size.hpp"
#include "crypto/sha256.hpp"
#include "crypto/storage.hpp"
@@ -134,13 +133,8 @@ public:
void Finish(Hash &aHash);
private:
union HmacContext
{
psa_mac_operation_t mOperation;
mbedtls_md_context_t mContext;
};
HmacContext mContext;
otCryptoContext mContext;
OT_DEFINE_ALIGNED_VAR(mContextStorage, kHmacSha256ContextSize, uint64_t);
};
/**
src/core/crypto/sha256.cpp
+10 -5
View File
@@ -42,28 +42,33 @@ namespace Crypto {
Sha256::Sha256(void)
{
Error err = otPlatCryptoSha256Init(&mContext, sizeof(mContext));
Error err = kErrorNone;
mContext.mContext = mContextStorage;
mContext.mContextSize = sizeof(mContextStorage);
err = otPlatCryptoSha256Init(&mContext);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
Sha256::~Sha256(void)
{
Error err = otPlatCryptoSha256Deinit(&mContext, sizeof(mContext));
Error err = otPlatCryptoSha256Deinit(&mContext);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
void Sha256::Start(void)
{
Error err = otPlatCryptoSha256Start(&mContext, sizeof(mContext));
Error err = otPlatCryptoSha256Start(&mContext);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
void Sha256::Update(const void *aBuf, uint16_t aBufLength)
{
Error err = otPlatCryptoSha256Update(&mContext, sizeof(mContext), aBuf, aBufLength);
Error err = otPlatCryptoSha256Update(&mContext, aBuf, aBufLength);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
@@ -83,7 +88,7 @@ void Sha256::Update(const Message &aMessage, uint16_t aOffset, uint16_t aLength)
void Sha256::Finish(Hash &aHash)
{
Error err = otPlatCryptoSha256Finish(&mContext, sizeof(mContext), aHash.m8, Hash::kSize);
Error err = otPlatCryptoSha256Finish(&mContext, aHash.m8, Hash::kSize);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
src/core/crypto/sha256.hpp
+4 -10
View File
@@ -38,15 +38,14 @@
#include <stdint.h>
#include <mbedtls/sha256.h>
#include <psa/crypto.h>
#include <openthread/crypto.h>
#include <openthread/platform/crypto.h>
#include "common/clearable.hpp"
#include "common/code_utils.hpp"
#include "common/equatable.hpp"
#include "common/type_traits.hpp"
#include "crypto/context_size.hpp"
namespace ot {
@@ -146,13 +145,8 @@ public:
void Finish(Hash &aHash);
private:
union Sha256Context
{
psa_hash_operation_t mOperation;
mbedtls_sha256_context mContext;
};
Sha256Context mContext;
otCryptoContext mContext;
OT_DEFINE_ALIGNED_VAR(mContextStorage, kSha256ContextSize, uint64_t);
};
/**
src/core/openthread-core-config.h
+1
View File
@@ -64,6 +64,7 @@
#include "config/child_supervision.h"
#include "config/coap.h"
#include "config/commissioner.h"
#include "config/crypto.h"
#include "config/dataset_updater.h"
#include "config/dhcp6_client.h"
#include "config/dhcp6_server.h"