espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-10-02 13:57:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

[crypto] move context to platforms (#7008)

Browse Source
This commit is contained in:
Jiacheng Guo
2021-09-26 21:38:23 -07:00
committed by GitHub
parent 5564ea0530
commit 9d7067f5a7
16 changed files with 481 additions and 208 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/openthread/instance.h
+1 -1
View File
@@ -53,7 +53,7 @@ extern "C" {
* @note This number versions both OpenThread platform and user APIs. * @note This number versions both OpenThread platform and user APIs.
* *
*/ */
#define OPENTHREAD_API_VERSION (168) #define OPENTHREAD_API_VERSION (169)
/** /**
* @addtogroup api-instance * @addtogroup api-instance
include/openthread/platform/crypto.h
+68 -73
View File
@@ -118,6 +118,18 @@ typedef struct otCryptoKey
uint32_t mKeyRef; ///< The PSA key ref (requires `mKey` to be NULL). uint32_t mKeyRef; ///< The PSA key ref (requires `mKey` to be NULL).
} otCryptoKey; } otCryptoKey;
/**
* @struct otCryptoContext
*
* This structure stores the context object for platform APIs.
*
*/
typedef struct otCryptoContext
{
void * mContext; ///< Pointer to the context.
uint16_t mContextSize; ///< The length of the context in bytes.
} otCryptoContext;
/** /**
* Initialize the Crypto module. * Initialize the Crypto module.
* *
@@ -206,57 +218,46 @@ bool otPlatCryptoHasKey(otCryptoKeyRef aKeyRef);
* Initialize the HMAC operation. * Initialize the HMAC operation.
* *
* @param[in] aContext Context for HMAC operation. * @param[in] aContext Context for HMAC operation.
* @param[in] aContextSize Context size HMAC operation.
* *
* @retval OT_ERROR_NONE Successfully initialized HMAC operation. * @retval OT_ERROR_NONE Successfully initialized HMAC operation.
* @retval OT_ERROR_FAILED Failed to initialize HMAC operation. * @retval OT_ERROR_FAILED Failed to initialize HMAC operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
* *
* @note In case PSA is supported pointer to psa_mac_operation_t will be passed as input. * @note The platform driver shall point the context to the correct object such as psa_mac_operation_t or
* In case of mbedTLS, pointer to mbedtls_md_context_t will be provided. * mbedtls_md_context_t.
* *
*/ */
otError otPlatCryptoHmacSha256Init(void *aContext, size_t aContextSize); otError otPlatCryptoHmacSha256Init(otCryptoContext *aContext);
/** /**
* Uninitialize the HMAC operation. * Uninitialize the HMAC operation.
* *
* @param[in] aContext Context for HMAC operation. * @param[in] aContext Context for HMAC operation.
* @param[in] aContextSize Context size HMAC operation.
*
* *
* @retval OT_ERROR_NONE Successfully uninitialized HMAC operation. * @retval OT_ERROR_NONE Successfully uninitialized HMAC operation.
* @retval OT_ERROR_FAILED Failed to uninitialized HMAC operation. * @retval OT_ERROR_FAILED Failed to uninitialized HMAC operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
* *
* @note In case PSA is supported pointer to psa_mac_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_md_context_t will be provided.
*
*/ */
otError otPlatCryptoHmacSha256Deinit(void *aContext, size_t aContextSize); otError otPlatCryptoHmacSha256Deinit(otCryptoContext *aContext);
/** /**
* Start HMAC operation. * Start HMAC operation.
* *
* @param[in] aContext Context for HMAC operation. * @param[in] aContext Context for HMAC operation.
* @param[in] aContextSize Context size HMAC operation.
* @param[in] aKey Key material to be used for for HMAC operation. * @param[in] aKey Key material to be used for for HMAC operation.
* *
* @retval OT_ERROR_NONE Successfully started HMAC operation. * @retval OT_ERROR_NONE Successfully started HMAC operation.
* @retval OT_ERROR_FAILED Failed to start HMAC operation. * @retval OT_ERROR_FAILED Failed to start HMAC operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aKey was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext or @p aKey was NULL
* *
* @note In case PSA is supported pointer to psa_mac_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_md_context_t will be provided.
*
*/ */
otError otPlatCryptoHmacSha256Start(void *aContext, size_t aContextSize, const otCryptoKey *aKey); otError otPlatCryptoHmacSha256Start(otCryptoContext *aContext, const otCryptoKey *aKey);
/** /**
* Update the HMAC operation with new input. * Update the HMAC operation with new input.
* *
* @param[in] aContext Context for HMAC operation. * @param[in] aContext Context for HMAC operation.
* @param[in] aContextSize Context size HMAC operation.
* @param[in] aBuf A pointer to the input buffer. * @param[in] aBuf A pointer to the input buffer.
* @param[in] aBufLength The length of @p aBuf in bytes. * @param[in] aBufLength The length of @p aBuf in bytes.
* *
@@ -264,17 +265,13 @@ otError otPlatCryptoHmacSha256Start(void *aContext, size_t aContextSize, const o
* @retval OT_ERROR_FAILED Failed to update HMAC operation. * @retval OT_ERROR_FAILED Failed to update HMAC operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aBuf was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext or @p aBuf was NULL
* *
* @note In case PSA is supported pointer to psa_mac_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_md_context_t will be provided.
*
*/ */
otError otPlatCryptoHmacSha256Update(void *aContext, size_t aContextSize, const void *aBuf, uint16_t aBufLength); otError otPlatCryptoHmacSha256Update(otCryptoContext *aContext, const void *aBuf, uint16_t aBufLength);
/** /**
* Complete the HMAC operation. * Complete the HMAC operation.
* *
* @param[in] aContext Context for HMAC operation. * @param[in] aContext Context for HMAC operation.
* @param[in] aContextSize Context size HMAC operation.
* @param[out] aBuf A pointer to the output buffer. * @param[out] aBuf A pointer to the output buffer.
* @param[in] aBufLength The length of @p aBuf in bytes. * @param[in] aBufLength The length of @p aBuf in bytes.
* *
@@ -282,50 +279,42 @@ otError otPlatCryptoHmacSha256Update(void *aContext, size_t aContextSize, const
* @retval OT_ERROR_FAILED Failed to complete HMAC operation. * @retval OT_ERROR_FAILED Failed to complete HMAC operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aBuf was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext or @p aBuf was NULL
* *
* @note In case PSA is supported pointer to psa_mac_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_md_context_t will be provided.
*
*/ */
otError otPlatCryptoHmacSha256Finish(void *aContext, size_t aContextSize, uint8_t *aBuf, size_t aBufLength); otError otPlatCryptoHmacSha256Finish(otCryptoContext *aContext, uint8_t *aBuf, size_t aBufLength);
/** /**
* Initialise the AES operation. * Initialise the AES operation.
* *
* @param[in] aContext Context for AES operation. * @param[in] aContext Context for AES operation.
* @param[in] aContextSize Context size AES operation.
* *
* @retval OT_ERROR_NONE Successfully Initialised AES operation. * @retval OT_ERROR_NONE Successfully Initialised AES operation.
* @retval OT_ERROR_FAILED Failed to Initialise AES operation. * @retval OT_ERROR_FAILED Failed to Initialise AES operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
* @retval OT_ERROR_NO_BUFS Cannot allocate the context.
* *
* @note In case PSA is supported pointer to psa_key_id will be passed as input. * @note The platform driver shall point the context to the correct object such as psa_key_id
* In case of mbedTLS, pointer to mbedtls_aes_context_t will be provided. * or mbedtls_aes_context_t.
* *
*/ */
otError otPlatCryptoAesInit(void *aContext, size_t aContextSize); otError otPlatCryptoAesInit(otCryptoContext *aContext);
/** /**
* Set the key for AES operation. * Set the key for AES operation.
* *
* @param[in] aContext Context for AES operation. * @param[in] aContext Context for AES operation.
* @param[in] aContextSize Context size AES operation.
* @param[out] aKey Key to use for AES operation. * @param[out] aKey Key to use for AES operation.
* *
* @retval OT_ERROR_NONE Successfully set the key for AES operation. * @retval OT_ERROR_NONE Successfully set the key for AES operation.
* @retval OT_ERROR_FAILED Failed to set the key for AES operation. * @retval OT_ERROR_FAILED Failed to set the key for AES operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aKey was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext or @p aKey was NULL
* *
* @note In case PSA is supported pointer to psa_key_id will be passed as input.
* In case of mbedTLS, pointer to mbedtls_aes_context_t will be provided.
*
*/ */
otError otPlatCryptoAesSetKey(void *aContext, size_t aContextSize, const otCryptoKey *aKey); otError otPlatCryptoAesSetKey(otCryptoContext *aContext, const otCryptoKey *aKey);
/** /**
* Encrypt the given data. * Encrypt the given data.
* *
* @param[in] aContext Context for AES operation. * @param[in] aContext Context for AES operation.
* @param[in] aContextSize Context size AES operation.
* @param[in] aInput Pointer to the input buffer. * @param[in] aInput Pointer to the input buffer.
* @param[in] aOutput Pointer to the output buffer. * @param[in] aOutput Pointer to the output buffer.
* *
@@ -333,33 +322,40 @@ otError otPlatCryptoAesSetKey(void *aContext, size_t aContextSize, const otCrypt
* @retval OT_ERROR_FAILED Failed to encrypt @p aInput. * @retval OT_ERROR_FAILED Failed to encrypt @p aInput.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aKey or @p aOutput were NULL * @retval OT_ERROR_INVALID_ARGS @p aContext or @p aKey or @p aOutput were NULL
* *
* @note In case PSA is supported pointer to psa_key_id will be passed as input.
* In case of mbedTLS, pointer to mbedtls_aes_context_t will be provided.
*
*/ */
otError otPlatCryptoAesEncrypt(void *aContext, size_t aContextSize, const uint8_t *aInput, uint8_t *aOutput); otError otPlatCryptoAesEncrypt(otCryptoContext *aContext, const uint8_t *aInput, uint8_t *aOutput);
/** /**
* Free the AES context. * Free the AES context.
* *
* @param[in] aContext Context for AES operation. * @param[in] aContext Context for AES operation.
* @param[in] aContextSize Context size AES operation.
* *
* @retval OT_ERROR_NONE Successfully freed AES context. * @retval OT_ERROR_NONE Successfully freed AES context.
* @retval OT_ERROR_FAILED Failed to free AES context. * @retval OT_ERROR_FAILED Failed to free AES context.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
* *
* @note In case PSA is supported pointer to psa_key_id will be passed as input. */
* In case of mbedTLS, pointer to mbedtls_aes_context_t will be provided. otError otPlatCryptoAesFree(otCryptoContext *aContext);
/**
* Initialise the HKDF context.
*
* @param[in] aContext Context for HKDF operation.
*
* @retval OT_ERROR_NONE Successfully Initialised AES operation.
* @retval OT_ERROR_FAILED Failed to Initialise AES operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
*
* @note The platform driver shall point the context to the correct object such as psa_key_derivation_operation_t
* or HmacSha256::Hash
* *
*/ */
otError otPlatCryptoAesFree(void *aContext, size_t aContextSize); otError otPlatCryptoHkdfInit(otCryptoContext *aContext);
/** /**
* Perform HKDF Expand step. * Perform HKDF Expand step.
* *
* @param[in] aContext Operation context for HKDF operation. * @param[in] aContext Operation context for HKDF operation.
* @param[in] aContextSize Context size HKDF operation.
* @param[in] aInfo Pointer to the Info sequence. * @param[in] aInfo Pointer to the Info sequence.
* @param[in] aInfoLength Length of the Info sequence. * @param[in] aInfoLength Length of the Info sequence.
* @param[out] aOutputKey Pointer to the output Key. * @param[out] aOutputKey Pointer to the output Key.
@@ -367,20 +363,19 @@ otError otPlatCryptoAesFree(void *aContext, size_t aContextSize);
* *
* @retval OT_ERROR_NONE HKDF Expand was successful. * @retval OT_ERROR_NONE HKDF Expand was successful.
* @retval OT_ERROR_FAILED HKDF Expand failed. * @retval OT_ERROR_FAILED HKDF Expand failed.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
* *
*/ */
otError otPlatCryptoHkdfExpand(void * aContext, otError otPlatCryptoHkdfExpand(otCryptoContext *aContext,
size_t aContextSize, const uint8_t * aInfo,
const uint8_t *aInfo, uint16_t aInfoLength,
uint16_t aInfoLength, uint8_t * aOutputKey,
uint8_t * aOutputKey, uint16_t aOutputKeyLength);
uint16_t aOutputKeyLength);
/** /**
* Perform HKDF Extract step. * Perform HKDF Extract step.
* *
* @param[in] aContext Operation context for HKDF operation. * @param[in] aContext Operation context for HKDF operation.
* @param[in] aContextSize Context size HKDF operation.
* @param[in] aSalt Pointer to the Salt for HKDF. * @param[in] aSalt Pointer to the Salt for HKDF.
* @param[in] aInfoLength length of Salt. * @param[in] aInfoLength length of Salt.
* @param[in] aInputKey Pointer to the input key. * @param[in] aInputKey Pointer to the input key.
@@ -389,62 +384,66 @@ otError otPlatCryptoHkdfExpand(void * aContext,
* @retval OT_ERROR_FAILED HKDF Extract failed. * @retval OT_ERROR_FAILED HKDF Extract failed.
* *
*/ */
otError otPlatCryptoHkdfExtract(void * aContext, otError otPlatCryptoHkdfExtract(otCryptoContext * aContext,
size_t aContextSize,
const uint8_t * aSalt, const uint8_t * aSalt,
uint16_t aSaltLength, uint16_t aSaltLength,
const otCryptoKey *aInputKey); const otCryptoKey *aInputKey);
/**
* Uninitialize the HKDF context.
*
* @param[in] aContext Context for HKDF operation.
*
* @retval OT_ERROR_NONE Successfully un-initialised HKDF operation.
* @retval OT_ERROR_FAILED Failed to un-initialised HKDF operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
*
*/
otError otPlatCryptoHkdfDeinit(otCryptoContext *aContext);
/** /**
* Initialise the SHA-256 operation. * Initialise the SHA-256 operation.
* *
* @param[in] aContext Context for SHA-256 operation. * @param[in] aContext Context for SHA-256 operation.
* @param[in] aContextSize Context size SHA-256 operation.
* *
* @retval OT_ERROR_NONE Successfully initialised SHA-256 operation. * @retval OT_ERROR_NONE Successfully initialised SHA-256 operation.
* @retval OT_ERROR_FAILED Failed to initialise SHA-256 operation. * @retval OT_ERROR_FAILED Failed to initialise SHA-256 operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
* *
* @note In case PSA is supported pointer to psa_hash_operation_t will be passed as input. *
* In case of mbedTLS, pointer to mbedtls_sha256_context will be provided. * @note The platform driver shall point the context to the correct object such as psa_hash_operation_t
* or mbedtls_sha256_context.
*/ */
otError otPlatCryptoSha256Init(void *aContext, size_t aContextSize); otError otPlatCryptoSha256Init(otCryptoContext *aContext);
/** /**
* UnInitialise the SHA-256 operation. * Uninitialize the SHA-256 operation.
* *
* @param[in] aContext Context for SHA-256 operation. * @param[in] aContext Context for SHA-256 operation.
* @param[in] aContextSize Context size SHA-256 operation.
* *
* @retval OT_ERROR_NONE Successfully un-initialised SHA-256 operation. * @retval OT_ERROR_NONE Successfully un-initialised SHA-256 operation.
* @retval OT_ERROR_FAILED Failed to un-initialised SHA-256 operation. * @retval OT_ERROR_FAILED Failed to un-initialised SHA-256 operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
* *
* @note In case PSA is supported pointer to psa_hash_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_sha256_context will be provided.
*/ */
otError otPlatCryptoSha256Deinit(void *aContext, size_t aContextSize); otError otPlatCryptoSha256Deinit(otCryptoContext *aContext);
/** /**
* Start SHA-256 operation. * Start SHA-256 operation.
* *
* @param[in] aContext Context for SHA-256 operation. * @param[in] aContext Context for SHA-256 operation.
* @param[in] aContextSize Context size SHA-256 operation.
* *
* @retval OT_ERROR_NONE Successfully started SHA-256 operation. * @retval OT_ERROR_NONE Successfully started SHA-256 operation.
* @retval OT_ERROR_FAILED Failed to start SHA-256 operation. * @retval OT_ERROR_FAILED Failed to start SHA-256 operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext was NULL
* *
* @note In case PSA is supported pointer to psa_hash_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_sha256_context will be provided.
*/ */
otError otPlatCryptoSha256Start(void *aContext, size_t aContextSize); otError otPlatCryptoSha256Start(otCryptoContext *aContext);
/** /**
* Update SHA-256 operation with new input. * Update SHA-256 operation with new input.
* *
* @param[in] aContext Context for SHA-256 operation. * @param[in] aContext Context for SHA-256 operation.
* @param[in] aContextSize Context size SHA-256 operation.
* @param[in] aBuf A pointer to the input buffer. * @param[in] aBuf A pointer to the input buffer.
* @param[in] aBufLength The length of @p aBuf in bytes. * @param[in] aBufLength The length of @p aBuf in bytes.
* *
@@ -452,10 +451,8 @@ otError otPlatCryptoSha256Start(void *aContext, size_t aContextSize);
* @retval OT_ERROR_FAILED Failed to update SHA-256 operation. * @retval OT_ERROR_FAILED Failed to update SHA-256 operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aBuf was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext or @p aBuf was NULL
* *
* @note In case PSA is supported pointer to psa_hash_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_sha256_context will be provided.
*/ */
otError otPlatCryptoSha256Update(void *aContext, size_t aContextSize, const void *aBuf, uint16_t aBufLength); otError otPlatCryptoSha256Update(otCryptoContext *aContext, const void *aBuf, uint16_t aBufLength);
/** /**
* Finish SHA-256 operation. * Finish SHA-256 operation.
@@ -469,10 +466,8 @@ otError otPlatCryptoSha256Update(void *aContext, size_t aContextSize, const void
* @retval OT_ERROR_FAILED Failed to complete SHA-256 operation. * @retval OT_ERROR_FAILED Failed to complete SHA-256 operation.
* @retval OT_ERROR_INVALID_ARGS @p aContext or @p aHash was NULL * @retval OT_ERROR_INVALID_ARGS @p aContext or @p aHash was NULL
* *
* @note In case PSA is supported pointer to psa_hash_operation_t will be passed as input.
* In case of mbedTLS, pointer to mbedtls_sha256_context will be provided.
*/ */
otError otPlatCryptoSha256Finish(void *aContext, size_t aContextSize, uint8_t *aHash, uint16_t aHashSize); otError otPlatCryptoSha256Finish(otCryptoContext *aContext, uint8_t *aHash, uint16_t aHashSize);
/** /**
* @} * @}
src/core/BUILD.gn
+2
View File
@@ -431,6 +431,7 @@ openthread_core_files = [
"crypto/aes_ccm.hpp", "crypto/aes_ccm.hpp",
"crypto/aes_ecb.cpp", "crypto/aes_ecb.cpp",
"crypto/aes_ecb.hpp", "crypto/aes_ecb.hpp",
"crypto/context_size.hpp",
"crypto/crypto_platform.cpp", "crypto/crypto_platform.cpp",
"crypto/ecdsa.cpp", "crypto/ecdsa.cpp",
"crypto/ecdsa.hpp", "crypto/ecdsa.hpp",
@@ -723,6 +724,7 @@ source_set("libopenthread_core_config") {
"config/child_supervision.h", "config/child_supervision.h",
"config/coap.h", "config/coap.h",
"config/commissioner.h", "config/commissioner.h",
"config/crypto.h",
"config/dataset_updater.h", "config/dataset_updater.h",
"config/dhcp6_client.h", "config/dhcp6_client.h",
"config/dhcp6_server.h", "config/dhcp6_server.h",
src/core/Makefile.am
+2
View File
@@ -460,6 +460,7 @@ HEADERS_COMMON = \
config/child_supervision.h \ config/child_supervision.h \
config/coap.h \ config/coap.h \
config/commissioner.h \ config/commissioner.h \
config/crypto.h \
config/dataset_updater.h \ config/dataset_updater.h \
config/dhcp6_client.h \ config/dhcp6_client.h \
config/dhcp6_server.h \ config/dhcp6_server.h \
@@ -489,6 +490,7 @@ HEADERS_COMMON = \
config/tmf.h \ config/tmf.h \
crypto/aes_ccm.hpp \ crypto/aes_ccm.hpp \
crypto/aes_ecb.hpp \ crypto/aes_ecb.hpp \
crypto/context_size.hpp \
crypto/ecdsa.hpp \ crypto/ecdsa.hpp \
crypto/hkdf_sha256.hpp \ crypto/hkdf_sha256.hpp \
crypto/hmac_sha256.hpp \ crypto/hmac_sha256.hpp \
src/core/config/crypto.h
+98
View File
@@ -0,0 +1,98 @@
/*
* Copyright (c) 2021, The OpenThread Authors.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the copyright holder nor the
* names of its contributors may be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef CONFIG_CRYPTO_H_
#define CONFIG_CRYPTO_H_
/**
* @def OPENTHREAD_CONFIG_CRYPTO_LIB
*
* Selects the crypto backend library for OpenThread.
*
* There are several options available
* - @sa OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
* - @sa OPENTHREAD_CONFIG_CRYPTO_LIB_PSA
* - @sa OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM
*
*/
#ifndef OPENTHREAD_CONFIG_CRYPTO_LIB
#define OPENTHREAD_CONFIG_CRYPTO_LIB OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
#endif
/** Use mbedtls as crypto library */
#define OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS 0
/** Use ARM Platform Security Library as crypto library */
#define OPENTHREAD_CONFIG_CRYPTO_LIB_PSA 1
/** Use platform provided crypto library */
#define OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM 2
#if OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM
/**
* @def OPENTHREAD_CONFIG_AES_CONTEXT_SIZE
*
* The size of the AES context byte array. Only applicable with OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM.
*
*/
#ifndef OPENTHREAD_CONFIG_AES_CONTEXT_SIZE
#error "OPENTHREAD_CONFIG_AES_CONTEXT_SIZE is missing"
#endif
/**
* @def OPENTHREAD_CONFIG_HMAC_SHA256_CONTEXT_SIZE
*
* The size of the HMAC_SHA256 context byte array. Only applicable with OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM.
*
*/
#ifndef OPENTHREAD_CONFIG_HMAC_SHA256_CONTEXT_SIZE
#error "OPENTHREAD_CONFIG_HMAC_SHA256_CONTEXT_SIZE is missing"
#endif
/**
* @def OPENTHREAD_CONFIG_HKDF_CONTEXT_SIZE
*
* The size of the HKDF context byte array. Only applicable with OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM.
*
*/
#ifndef OPENTHREAD_CONFIG_HKDF_CONTEXT_SIZE
#error "OPENTHREAD_CONFIG_HKDF_CONTEXT_SIZE is missing"
#endif
/**
* @def OPENTHREAD_CONFIG_SHA256_CONTEXT_SIZE
*
* The size of the SHA256 context byte array. Only applicable with OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM.
*
*/
#ifndef OPENTHREAD_CONFIG_SHA256_CONTEXT_SIZE
#error "OPENTHREAD_CONFIG_SHA256_CONTEXT_SIZE is missing"
#endif
#endif // OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM
#endif // CONFIG_CRYPTO_H_
src/core/crypto/aes_ecb.cpp
+9 -4
View File
@@ -40,28 +40,33 @@ namespace Crypto {
AesEcb::AesEcb(void) AesEcb::AesEcb(void)
{ {
Error err = otPlatCryptoAesInit(&mContext, sizeof(mContext)); Error err = kErrorNone;
mContext.mContext = mContextStorage;
mContext.mContextSize = sizeof(mContextStorage);
err = otPlatCryptoAesInit(&mContext);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
void AesEcb::SetKey(const Key &aKey) void AesEcb::SetKey(const Key &aKey)
{ {
Error err = otPlatCryptoAesSetKey(&mContext, sizeof(mContext), &aKey); Error err = otPlatCryptoAesSetKey(&mContext, &aKey);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
void AesEcb::Encrypt(const uint8_t aInput[kBlockSize], uint8_t aOutput[kBlockSize]) void AesEcb::Encrypt(const uint8_t aInput[kBlockSize], uint8_t aOutput[kBlockSize])
{ {
Error err = otPlatCryptoAesEncrypt(&mContext, sizeof(mContext), aInput, aOutput); Error err = otPlatCryptoAesEncrypt(&mContext, aInput, aOutput);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
AesEcb::~AesEcb(void) AesEcb::~AesEcb(void)
{ {
Error err = otPlatCryptoAesFree(&mContext, sizeof(mContext)); Error err = otPlatCryptoAesFree(&mContext);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
src/core/crypto/aes_ecb.hpp
+5 -8
View File
@@ -35,9 +35,11 @@
#define AES_ECB_HPP_ #define AES_ECB_HPP_
#include "openthread-core-config.h" #include "openthread-core-config.h"
#include <mbedtls/aes.h>
#include <openthread/platform/crypto.h> #include <openthread/platform/crypto.h>
#include "common/code_utils.hpp"
#include "crypto/context_size.hpp"
#include "crypto/storage.hpp" #include "crypto/storage.hpp"
namespace ot { namespace ot {
@@ -89,13 +91,8 @@ public:
void Encrypt(const uint8_t aInput[kBlockSize], uint8_t aOutput[kBlockSize]); void Encrypt(const uint8_t aInput[kBlockSize], uint8_t aOutput[kBlockSize]);
private: private:
union AesEcbContext otCryptoContext mContext;
{ OT_DEFINE_ALIGNED_VAR(mContextStorage, kAesContextSize, uint64_t);
uint32_t mKeyRef;
mbedtls_aes_context mContext;
};
AesEcbContext mContext;
}; };
/** /**
src/core/crypto/context_size.hpp
+72
View File
@@ -0,0 +1,72 @@
/*
* Copyright (c) 2021, The OpenThread Authors.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the copyright holder nor the
* names of its contributors may be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef CRYPTO_CONTEXT_HPP_
#define CRYPTO_CONTEXT_HPP_
#include "openthread-core-config.h"
#include "openthread/crypto.h"
#if OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
#include <mbedtls/aes.h>
#include <mbedtls/md.h>
#include <mbedtls/sha256.h>
#elif OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PSA
#include <psa/crypto.h>
#endif // OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
namespace ot {
namespace Crypto {
#if OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
constexpr uint16_t kAesContextSize = sizeof(mbedtls_aes_context);
constexpr uint16_t kHmacSha256ContextSize = sizeof(mbedtls_md_context_t);
constexpr uint16_t kHkdfContextSize = sizeof(otCryptoSha256Hash);
constexpr uint16_t kSha256ContextSize = sizeof(mbedtls_sha256_context);
#elif OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PSA
constexpr uint16_t kAesContextSize = sizeof(psa_key_id_t);
constexpr uint16_t kHmacSha256ContextSize = sizeof(psa_mac_operation_t);
constexpr uint16_t kHkdfContextSize = sizeof(psa_key_derivation_operation_t);
constexpr uint16_t kSha256ContextSize = sizeof(psa_hash_operation_t);
#else
constexpr uint16_t kAesContextSize = OPENTHREAD_CONFIG_AES_CONTEXT_SIZE;
constexpr uint16_t kHmacSha256ContextSize = OPENTHREAD_CONFIG_HMAC_SHA256_CONTEXT_SIZE;
constexpr uint16_t kHkdfContextSize = OPENTHREAD_CONFIG_HKDF_CONTEXT_SIZE;
constexpr uint16_t kSha256ContextSize = OPENTHREAD_CONFIG_SHA256_CONTEXT_SIZE;
#endif // OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
} // namespace Crypto
} // namespace ot
#endif // CRYPTO_CONTEXT_HPP_
src/core/crypto/crypto_platform.cpp
+153 -81
View File
@@ -34,6 +34,7 @@
#include <mbedtls/aes.h> #include <mbedtls/aes.h>
#include <mbedtls/md.h> #include <mbedtls/md.h>
#include <mbedtls/sha256.h>
#include <openthread/instance.h> #include <openthread/instance.h>
#include <openthread/platform/crypto.h> #include <openthread/platform/crypto.h>
@@ -42,7 +43,8 @@
#include "common/code_utils.hpp" #include "common/code_utils.hpp"
#include "common/debug.hpp" #include "common/debug.hpp"
#include "common/instance.hpp" #include "common/instance.hpp"
#include "common/message.hpp" #include "common/new.hpp"
#include "config/crypto.h"
#include "crypto/hmac_sha256.hpp" #include "crypto/hmac_sha256.hpp"
#include "crypto/storage.hpp" #include "crypto/storage.hpp"
@@ -58,25 +60,31 @@ OT_TOOL_WEAK otError otPlatCryptoInit(void)
} }
// AES Implementation // AES Implementation
OT_TOOL_WEAK otError otPlatCryptoAesInit(void *aContext, size_t aContextSize) OT_TOOL_WEAK otError otPlatCryptoAesInit(otCryptoContext *aContext)
{ {
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_aes_context *context = static_cast<mbedtls_aes_context *>(aContext); mbedtls_aes_context *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed);
context = static_cast<mbedtls_aes_context *>(aContext->mContext);
mbedtls_aes_init(context); mbedtls_aes_init(context);
exit: exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoAesSetKey(void *aContext, size_t aContextSize, const otCryptoKey *aKey) OT_TOOL_WEAK otError otPlatCryptoAesSetKey(otCryptoContext *aContext, const otCryptoKey *aKey)
{ {
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_aes_context *context = static_cast<mbedtls_aes_context *>(aContext); mbedtls_aes_context *context;
const LiteralKey key(*static_cast<const Key *>(aKey)); const LiteralKey key(*static_cast<const Key *>(aKey));
VerifyOrExit(aContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed);
context = static_cast<mbedtls_aes_context *>(aContext->mContext);
VerifyOrExit((mbedtls_aes_setkey_enc(context, key.GetBytes(), (key.GetLength() * CHAR_BIT)) == 0), VerifyOrExit((mbedtls_aes_setkey_enc(context, key.GetBytes(), (key.GetLength() * CHAR_BIT)) == 0),
error = kErrorFailed); error = kErrorFailed);
@@ -84,27 +92,30 @@ exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoAesEncrypt(void * aContext, OT_TOOL_WEAK otError otPlatCryptoAesEncrypt(otCryptoContext *aContext, const uint8_t *aInput, uint8_t *aOutput)
size_t aContextSize,
const uint8_t *aInput,
uint8_t * aOutput)
{ {
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_aes_context *context = static_cast<mbedtls_aes_context *>(aContext); mbedtls_aes_context *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed);
context = static_cast<mbedtls_aes_context *>(aContext->mContext);
VerifyOrExit((mbedtls_aes_crypt_ecb(context, MBEDTLS_AES_ENCRYPT, aInput, aOutput) == 0), error = kErrorFailed); VerifyOrExit((mbedtls_aes_crypt_ecb(context, MBEDTLS_AES_ENCRYPT, aInput, aOutput) == 0), error = kErrorFailed);
exit: exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoAesFree(void *aContext, size_t aContextSize) OT_TOOL_WEAK otError otPlatCryptoAesFree(otCryptoContext *aContext)
{ {
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_aes_context *context = static_cast<mbedtls_aes_context *>(aContext); mbedtls_aes_context *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_aes_context), error = kErrorFailed);
context = static_cast<mbedtls_aes_context *>(aContext->mContext);
mbedtls_aes_free(context); mbedtls_aes_free(context);
exit: exit:
@@ -114,13 +125,16 @@ exit:
#if !OPENTHREAD_RADIO #if !OPENTHREAD_RADIO
// HMAC implementations // HMAC implementations
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Init(void *aContext, size_t aContextSize) OT_TOOL_WEAK otError otPlatCryptoHmacSha256Init(otCryptoContext *aContext)
{ {
Error error = kErrorNone; Error error = kErrorNone;
const mbedtls_md_info_t *mdInfo = nullptr; const mbedtls_md_info_t *mdInfo = nullptr;
mbedtls_md_context_t * context = static_cast<mbedtls_md_context_t *>(aContext); mbedtls_md_context_t * context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
context = static_cast<mbedtls_md_context_t *>(aContext->mContext);
mbedtls_md_init(context); mbedtls_md_init(context);
mdInfo = mbedtls_md_info_from_type(MBEDTLS_MD_SHA256); mdInfo = mbedtls_md_info_from_type(MBEDTLS_MD_SHA256);
VerifyOrExit((mbedtls_md_setup(context, mdInfo, 1) == 0), error = kErrorFailed); VerifyOrExit((mbedtls_md_setup(context, mdInfo, 1) == 0), error = kErrorFailed);
@@ -129,40 +143,46 @@ exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Deinit(void *aContext, size_t aContextSize) OT_TOOL_WEAK otError otPlatCryptoHmacSha256Deinit(otCryptoContext *aContext)
{ {
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_md_context_t *context = static_cast<mbedtls_md_context_t *>(aContext); mbedtls_md_context_t *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
context = static_cast<mbedtls_md_context_t *>(aContext->mContext);
mbedtls_md_free(context); mbedtls_md_free(context);
exit: exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Start(void *aContext, size_t aContextSize, const otCryptoKey *aKey) OT_TOOL_WEAK otError otPlatCryptoHmacSha256Start(otCryptoContext *aContext, const otCryptoKey *aKey)
{ {
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_md_context_t *context = static_cast<mbedtls_md_context_t *>(aContext);
const LiteralKey key(*static_cast<const Key *>(aKey)); const LiteralKey key(*static_cast<const Key *>(aKey));
mbedtls_md_context_t *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
context = static_cast<mbedtls_md_context_t *>(aContext->mContext);
VerifyOrExit((mbedtls_md_hmac_starts(context, key.GetBytes(), key.GetLength()) == 0), error = kErrorFailed); VerifyOrExit((mbedtls_md_hmac_starts(context, key.GetBytes(), key.GetLength()) == 0), error = kErrorFailed);
exit: exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Update(void * aContext, OT_TOOL_WEAK otError otPlatCryptoHmacSha256Update(otCryptoContext *aContext, const void *aBuf, uint16_t aBufLength)
size_t aContextSize,
const void *aBuf,
uint16_t aBufLength)
{ {
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_md_context_t *context = static_cast<mbedtls_md_context_t *>(aContext); mbedtls_md_context_t *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
context = static_cast<mbedtls_md_context_t *>(aContext->mContext);
VerifyOrExit((mbedtls_md_hmac_update(context, reinterpret_cast<const uint8_t *>(aBuf), aBufLength) == 0), VerifyOrExit((mbedtls_md_hmac_update(context, reinterpret_cast<const uint8_t *>(aBuf), aBufLength) == 0),
error = kErrorFailed); error = kErrorFailed);
@@ -170,35 +190,53 @@ exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoHmacSha256Finish(void *aContext, size_t aContextSize, uint8_t *aBuf, size_t aBufLength) OT_TOOL_WEAK otError otPlatCryptoHmacSha256Finish(otCryptoContext *aContext, uint8_t *aBuf, size_t aBufLength)
{ {
OT_UNUSED_VARIABLE(aBufLength); OT_UNUSED_VARIABLE(aBufLength);
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_md_context_t *context = static_cast<mbedtls_md_context_t *>(aContext); mbedtls_md_context_t *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_md_context_t), error = kErrorFailed);
context = static_cast<mbedtls_md_context_t *>(aContext->mContext);
VerifyOrExit((mbedtls_md_hmac_finish(context, aBuf) == 0), error = kErrorFailed); VerifyOrExit((mbedtls_md_hmac_finish(context, aBuf) == 0), error = kErrorFailed);
exit: exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoHkdfExpand(void * aContext, otError otPlatCryptoHkdfInit(otCryptoContext *aContext)
size_t aContextSize, {
const uint8_t *aInfo, Error error = kErrorNone;
uint16_t aInfoLength,
uint8_t * aOutputKey, VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
uint16_t aOutputKeyLength) VerifyOrExit(aContext->mContextSize >= sizeof(HmacSha256::Hash), error = kErrorFailed);
new (aContext->mContext) HmacSha256::Hash();
exit:
return error;
}
OT_TOOL_WEAK otError otPlatCryptoHkdfExpand(otCryptoContext *aContext,
const uint8_t * aInfo,
uint16_t aInfoLength,
uint8_t * aOutputKey,
uint16_t aOutputKeyLength)
{ {
Error error = kErrorNone; Error error = kErrorNone;
HmacSha256 hmac; HmacSha256 hmac;
HmacSha256::Hash hash; HmacSha256::Hash hash;
uint8_t iter = 0; uint8_t iter = 0;
uint16_t copyLength; uint16_t copyLength;
HmacSha256::Hash *prk = static_cast<HmacSha256::Hash *>(aContext); HmacSha256::Hash *prk;
VerifyOrExit(aContextSize >= sizeof(HmacSha256::Hash), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(HmacSha256::Hash), error = kErrorFailed);
prk = static_cast<HmacSha256::Hash *>(aContext->mContext);
// The aOutputKey is calculated as follows [RFC5889]: // The aOutputKey is calculated as follows [RFC5889]:
// //
@@ -242,8 +280,7 @@ exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoHkdfExtract(void * aContext, OT_TOOL_WEAK otError otPlatCryptoHkdfExtract(otCryptoContext * aContext,
size_t aContextSize,
const uint8_t * aSalt, const uint8_t * aSalt,
uint16_t aSaltLength, uint16_t aSaltLength,
const otCryptoKey *aInputKey) const otCryptoKey *aInputKey)
@@ -251,13 +288,15 @@ OT_TOOL_WEAK otError otPlatCryptoHkdfExtract(void * aContext,
Error error = kErrorNone; Error error = kErrorNone;
HmacSha256 hmac; HmacSha256 hmac;
Key cryptoKey; Key cryptoKey;
HmacSha256::Hash *prk = static_cast<HmacSha256::Hash *>(aContext); HmacSha256::Hash *prk;
const LiteralKey inputKey(*static_cast<const Key *>(aInputKey)); const LiteralKey inputKey(*static_cast<const Key *>(aInputKey));
VerifyOrExit(aContextSize >= sizeof(HmacSha256::Hash), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(HmacSha256::Hash), error = kErrorFailed);
prk = static_cast<HmacSha256::Hash *>(aContext->mContext);
cryptoKey.Set(aSalt, aSaltLength); cryptoKey.Set(aSalt, aSaltLength);
// PRK is calculated as HMAC-Hash(aSalt, aInputKey) // PRK is calculated as HMAC-Hash(aSalt, aInputKey)
hmac.Start(cryptoKey); hmac.Start(cryptoKey);
hmac.Update(inputKey.GetBytes(), inputKey.GetLength()); hmac.Update(inputKey.GetBytes(), inputKey.GetLength());
@@ -267,37 +306,65 @@ exit:
return error; return error;
} }
// SHA256 platform implementations otError otPlatCryptoHkdfDeinit(otCryptoContext *aContext)
OT_TOOL_WEAK otError otPlatCryptoSha256Init(void *aContext, size_t aContextSize)
{ {
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext); HmacSha256::Hash *prk;
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(HmacSha256::Hash), error = kErrorFailed);
prk = static_cast<HmacSha256::Hash *>(aContext->mContext);
prk->~Hash();
aContext->mContext = nullptr;
aContext->mContextSize = 0;
exit:
return error;
}
// SHA256 platform implementations
OT_TOOL_WEAK otError otPlatCryptoSha256Init(otCryptoContext *aContext)
{
Error error = kErrorNone;
mbedtls_sha256_context *context;
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
context = static_cast<mbedtls_sha256_context *>(aContext->mContext);
mbedtls_sha256_init(context); mbedtls_sha256_init(context);
exit: exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoSha256Deinit(void *aContext, size_t aContextSize) OT_TOOL_WEAK otError otPlatCryptoSha256Deinit(otCryptoContext *aContext)
{ {
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext); mbedtls_sha256_context *context;
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed); VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
context = static_cast<mbedtls_sha256_context *>(aContext->mContext);
mbedtls_sha256_free(context); mbedtls_sha256_free(context);
aContext->mContext = nullptr;
aContext->mContextSize = 0;
exit: exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoSha256Start(void *aContext, size_t aContextSize) OT_TOOL_WEAK otError otPlatCryptoSha256Start(otCryptoContext *aContext)
{ {
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext); mbedtls_sha256_context *context;
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
context = static_cast<mbedtls_sha256_context *>(aContext->mContext);
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000) #if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
VerifyOrExit((mbedtls_sha256_starts(context, 0) == 0), error = kErrorFailed); VerifyOrExit((mbedtls_sha256_starts(context, 0) == 0), error = kErrorFailed);
#else #else
@@ -308,15 +375,16 @@ exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoSha256Update(void * aContext, OT_TOOL_WEAK otError otPlatCryptoSha256Update(otCryptoContext *aContext, const void *aBuf, uint16_t aBufLength)
size_t aContextSize,
const void *aBuf,
uint16_t aBufLength)
{ {
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext); mbedtls_sha256_context *context;
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
context = static_cast<mbedtls_sha256_context *>(aContext->mContext);
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000) #if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
VerifyOrExit((mbedtls_sha256_update(context, reinterpret_cast<const uint8_t *>(aBuf), aBufLength) == 0), VerifyOrExit((mbedtls_sha256_update(context, reinterpret_cast<const uint8_t *>(aBuf), aBufLength) == 0),
error = kErrorFailed); error = kErrorFailed);
@@ -329,14 +397,18 @@ exit:
return error; return error;
} }
OT_TOOL_WEAK otError otPlatCryptoSha256Finish(void *aContext, size_t aContextSize, uint8_t *aHash, uint16_t aHashSize) OT_TOOL_WEAK otError otPlatCryptoSha256Finish(otCryptoContext *aContext, uint8_t *aHash, uint16_t aHashSize)
{ {
OT_UNUSED_VARIABLE(aHashSize); OT_UNUSED_VARIABLE(aHashSize);
Error error = kErrorNone; Error error = kErrorNone;
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext); mbedtls_sha256_context *context;
VerifyOrExit(aContext != nullptr, error = kErrorInvalidArgs);
VerifyOrExit(aContext->mContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
context = static_cast<mbedtls_sha256_context *>(aContext->mContext);
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000) #if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
VerifyOrExit((mbedtls_sha256_finish(context, aHash) == 0), error = kErrorFailed); VerifyOrExit((mbedtls_sha256_finish(context, aHash) == 0), error = kErrorFailed);
#else #else
src/core/crypto/hkdf_sha256.cpp
+24 -2
View File
@@ -37,20 +37,42 @@
#include "common/code_utils.hpp" #include "common/code_utils.hpp"
#include "common/debug.hpp" #include "common/debug.hpp"
#include "common/error.hpp"
#include "openthread/platform/crypto.h"
namespace ot { namespace ot {
namespace Crypto { namespace Crypto {
HkdfSha256::HkdfSha256(void)
{
Error err = kErrorNone;
mContext.mContext = mContextStorage;
mContext.mContextSize = sizeof(mContextStorage);
err = otPlatCryptoHkdfInit(&mContext);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
HkdfSha256::~HkdfSha256(void)
{
Error err = otPlatCryptoHkdfDeinit(&mContext);
OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err);
}
void HkdfSha256::Extract(const uint8_t *aSalt, uint16_t aSaltLength, const Key &aInputKey) void HkdfSha256::Extract(const uint8_t *aSalt, uint16_t aSaltLength, const Key &aInputKey)
{ {
Error err = otPlatCryptoHkdfExtract(&mContext, sizeof(mContext), aSalt, aSaltLength, &aInputKey); Error err = otPlatCryptoHkdfExtract(&mContext, aSalt, aSaltLength, &aInputKey);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
void HkdfSha256::Expand(const uint8_t *aInfo, uint16_t aInfoLength, uint8_t *aOutputKey, uint16_t aOutputKeyLength) void HkdfSha256::Expand(const uint8_t *aInfo, uint16_t aInfoLength, uint8_t *aOutputKey, uint16_t aOutputKeyLength)
{ {
Error err = otPlatCryptoHkdfExpand(&mContext, sizeof(mContext), aInfo, aInfoLength, aOutputKey, aOutputKeyLength); Error err = otPlatCryptoHkdfExpand(&mContext, aInfo, aInfoLength, aOutputKey, aOutputKeyLength);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
src/core/crypto/hkdf_sha256.hpp
+17 -9
View File
@@ -37,9 +37,10 @@
#include "openthread-core-config.h" #include "openthread-core-config.h"
#include <psa/crypto.h> #include "common/code_utils.hpp"
#include "crypto/context_size.hpp"
#include "crypto/hmac_sha256.hpp" #include "crypto/hmac_sha256.hpp"
#include "openthread/platform/crypto.h"
namespace ot { namespace ot {
namespace Crypto { namespace Crypto {
@@ -58,6 +59,18 @@ namespace Crypto {
class HkdfSha256 class HkdfSha256
{ {
public: public:
/**
* Constructor to initialize the context.
*
*/
HkdfSha256(void);
/**
* Destructor to free the context.
*
*/
~HkdfSha256(void);
/** /**
* This method performs the HKDF Extract step. * This method performs the HKDF Extract step.
* *
@@ -85,13 +98,8 @@ public:
void Expand(const uint8_t *aInfo, uint16_t aInfoLength, uint8_t *aOutputKey, uint16_t aOutputKeyLength); void Expand(const uint8_t *aInfo, uint16_t aInfoLength, uint8_t *aOutputKey, uint16_t aOutputKeyLength);
private: private:
union HkdfContext otCryptoContext mContext;
{ OT_DEFINE_ALIGNED_VAR(mContextStorage, kHkdfContextSize, uint64_t);
HmacSha256::Hash mPrk; // Pseudo-Random Key (derived from Extract step).
psa_key_derivation_operation_t mOperation;
};
HkdfContext mContext;
}; };
/** /**
src/core/crypto/hmac_sha256.cpp
+11 -5
View File
@@ -33,6 +33,7 @@
#include "hmac_sha256.hpp" #include "hmac_sha256.hpp"
#include "common/debug.hpp" #include "common/debug.hpp"
#include "common/error.hpp"
#include "common/message.hpp" #include "common/message.hpp"
namespace ot { namespace ot {
@@ -40,35 +41,40 @@ namespace Crypto {
HmacSha256::HmacSha256(void) HmacSha256::HmacSha256(void)
{ {
Error err = otPlatCryptoHmacSha256Init(&mContext, sizeof(mContext)); Error err = kErrorNone;
mContext.mContext = mContextStorage;
mContext.mContextSize = sizeof(mContextStorage);
err = otPlatCryptoHmacSha256Init(&mContext);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
HmacSha256::~HmacSha256(void) HmacSha256::~HmacSha256(void)
{ {
Error err = otPlatCryptoHmacSha256Deinit(&mContext, sizeof(mContext)); Error err = otPlatCryptoHmacSha256Deinit(&mContext);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
void HmacSha256::Start(const Key &aKey) void HmacSha256::Start(const Key &aKey)
{ {
Error err = otPlatCryptoHmacSha256Start(&mContext, sizeof(mContext), &aKey); Error err = otPlatCryptoHmacSha256Start(&mContext, &aKey);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
void HmacSha256::Update(const void *aBuf, uint16_t aBufLength) void HmacSha256::Update(const void *aBuf, uint16_t aBufLength)
{ {
Error err = otPlatCryptoHmacSha256Update(&mContext, sizeof(mContext), aBuf, aBufLength); Error err = otPlatCryptoHmacSha256Update(&mContext, aBuf, aBufLength);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
void HmacSha256::Finish(Hash &aHash) void HmacSha256::Finish(Hash &aHash)
{ {
Error err = otPlatCryptoHmacSha256Finish(&mContext, sizeof(mContext), aHash.m8, Hash::kSize); Error err = otPlatCryptoHmacSha256Finish(&mContext, aHash.m8, Hash::kSize);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
src/core/crypto/hmac_sha256.hpp
+4 -10
View File
@@ -38,11 +38,10 @@
#include <stdint.h> #include <stdint.h>
#include <mbedtls/md.h>
#include <psa/crypto.h>
#include <openthread/platform/crypto.h> #include <openthread/platform/crypto.h>
#include "common/code_utils.hpp"
#include "crypto/context_size.hpp"
#include "crypto/sha256.hpp" #include "crypto/sha256.hpp"
#include "crypto/storage.hpp" #include "crypto/storage.hpp"
@@ -134,13 +133,8 @@ public:
void Finish(Hash &aHash); void Finish(Hash &aHash);
private: private:
union HmacContext otCryptoContext mContext;
{ OT_DEFINE_ALIGNED_VAR(mContextStorage, kHmacSha256ContextSize, uint64_t);
psa_mac_operation_t mOperation;
mbedtls_md_context_t mContext;
};
HmacContext mContext;
}; };
/** /**
src/core/crypto/sha256.cpp
+10 -5
View File
@@ -42,28 +42,33 @@ namespace Crypto {
Sha256::Sha256(void) Sha256::Sha256(void)
{ {
Error err = otPlatCryptoSha256Init(&mContext, sizeof(mContext)); Error err = kErrorNone;
mContext.mContext = mContextStorage;
mContext.mContextSize = sizeof(mContextStorage);
err = otPlatCryptoSha256Init(&mContext);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
Sha256::~Sha256(void) Sha256::~Sha256(void)
{ {
Error err = otPlatCryptoSha256Deinit(&mContext, sizeof(mContext)); Error err = otPlatCryptoSha256Deinit(&mContext);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
void Sha256::Start(void) void Sha256::Start(void)
{ {
Error err = otPlatCryptoSha256Start(&mContext, sizeof(mContext)); Error err = otPlatCryptoSha256Start(&mContext);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
void Sha256::Update(const void *aBuf, uint16_t aBufLength) void Sha256::Update(const void *aBuf, uint16_t aBufLength)
{ {
Error err = otPlatCryptoSha256Update(&mContext, sizeof(mContext), aBuf, aBufLength); Error err = otPlatCryptoSha256Update(&mContext, aBuf, aBufLength);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
@@ -83,7 +88,7 @@ void Sha256::Update(const Message &aMessage, uint16_t aOffset, uint16_t aLength)
void Sha256::Finish(Hash &aHash) void Sha256::Finish(Hash &aHash)
{ {
Error err = otPlatCryptoSha256Finish(&mContext, sizeof(mContext), aHash.m8, Hash::kSize); Error err = otPlatCryptoSha256Finish(&mContext, aHash.m8, Hash::kSize);
OT_ASSERT(err == kErrorNone); OT_ASSERT(err == kErrorNone);
OT_UNUSED_VARIABLE(err); OT_UNUSED_VARIABLE(err);
} }
src/core/crypto/sha256.hpp
+4 -10
View File
@@ -38,15 +38,14 @@
#include <stdint.h> #include <stdint.h>
#include <mbedtls/sha256.h>
#include <psa/crypto.h>
#include <openthread/crypto.h> #include <openthread/crypto.h>
#include <openthread/platform/crypto.h> #include <openthread/platform/crypto.h>
#include "common/clearable.hpp" #include "common/clearable.hpp"
#include "common/code_utils.hpp"
#include "common/equatable.hpp" #include "common/equatable.hpp"
#include "common/type_traits.hpp" #include "common/type_traits.hpp"
#include "crypto/context_size.hpp"
namespace ot { namespace ot {
@@ -146,13 +145,8 @@ public:
void Finish(Hash &aHash); void Finish(Hash &aHash);
private: private:
union Sha256Context otCryptoContext mContext;
{ OT_DEFINE_ALIGNED_VAR(mContextStorage, kSha256ContextSize, uint64_t);
psa_hash_operation_t mOperation;
mbedtls_sha256_context mContext;
};
Sha256Context mContext;
}; };
/** /**
src/core/openthread-core-config.h
+1
View File
@@ -64,6 +64,7 @@
#include "config/child_supervision.h" #include "config/child_supervision.h"
#include "config/coap.h" #include "config/coap.h"
#include "config/commissioner.h" #include "config/commissioner.h"
#include "config/crypto.h"
#include "config/dataset_updater.h" #include "config/dataset_updater.h"
#include "config/dhcp6_client.h" #include "config/dhcp6_client.h"
#include "config/dhcp6_server.h" #include "config/dhcp6_server.h"