1 /*
2  * Copyright 2015 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <keymaster/km_openssl/ec_key_factory.h>
18 
19 #include <openssl/evp.h>
20 
21 #include <keymaster/keymaster_context.h>
22 #include <keymaster/km_openssl/ec_key.h>
23 #include <keymaster/km_openssl/ecdh_operation.h>
24 #include <keymaster/km_openssl/ecdsa_operation.h>
25 #include <keymaster/km_openssl/openssl_err.h>
26 
27 #include <keymaster/operation.h>
28 
29 namespace keymaster {
30 
31 static EcdsaSignOperationFactory sign_factory;
32 static EcdsaVerifyOperationFactory verify_factory;
33 static EcdhOperationFactory agree_key_factory;
34 
GetOperationFactory(keymaster_purpose_t purpose) const35 OperationFactory* EcKeyFactory::GetOperationFactory(keymaster_purpose_t purpose) const {
36     switch (purpose) {
37     case KM_PURPOSE_SIGN:
38         return &sign_factory;
39     case KM_PURPOSE_VERIFY:
40         return &verify_factory;
41     case KM_PURPOSE_AGREE_KEY:
42         return &agree_key_factory;
43     default:
44         return nullptr;
45     }
46 }
47 
48 /* static */
GetCurveAndSize(const AuthorizationSet & key_description,keymaster_ec_curve_t * curve,uint32_t * key_size_bits)49 keymaster_error_t EcKeyFactory::GetCurveAndSize(const AuthorizationSet& key_description,
50                                                 keymaster_ec_curve_t* curve,
51                                                 uint32_t* key_size_bits) {
52     if (!key_description.GetTagValue(TAG_EC_CURVE, curve)) {
53         // Curve not specified. Fall back to deducing curve from key size.
54         if (!key_description.GetTagValue(TAG_KEY_SIZE, key_size_bits)) {
55             LOG_E("%s", "No curve or key size specified for EC key generation");
56             return KM_ERROR_UNSUPPORTED_KEY_SIZE;
57         }
58         keymaster_error_t error = EcKeySizeToCurve(*key_size_bits, curve);
59         if (error != KM_ERROR_OK) {
60             return KM_ERROR_UNSUPPORTED_KEY_SIZE;
61         }
62     } else {
63         keymaster_error_t error = EcCurveToKeySize(*curve, key_size_bits);
64         if (error != KM_ERROR_OK) {
65             return error;
66         }
67         uint32_t tag_key_size_bits;
68         if (key_description.GetTagValue(TAG_KEY_SIZE, &tag_key_size_bits) &&
69             *key_size_bits != tag_key_size_bits) {
70             LOG_E("Curve key size %d and specified key size %d don't match", key_size_bits,
71                   tag_key_size_bits);
72             return KM_ERROR_INVALID_ARGUMENT;
73         }
74     }
75 
76     return KM_ERROR_OK;
77 }
78 
GenerateKey(const AuthorizationSet & key_description,UniquePtr<Key> attest_key,const KeymasterBlob & issuer_subject,KeymasterKeyBlob * key_blob,AuthorizationSet * hw_enforced,AuthorizationSet * sw_enforced,CertificateChain * cert_chain) const79 keymaster_error_t EcKeyFactory::GenerateKey(const AuthorizationSet& key_description,
80                                             UniquePtr<Key> attest_key,  //
81                                             const KeymasterBlob& issuer_subject,
82                                             KeymasterKeyBlob* key_blob,
83                                             AuthorizationSet* hw_enforced,
84                                             AuthorizationSet* sw_enforced,
85                                             CertificateChain* cert_chain) const {
86     if (!key_blob || !hw_enforced || !sw_enforced) return KM_ERROR_OUTPUT_PARAMETER_NULL;
87 
88     AuthorizationSet authorizations(key_description);
89 
90     keymaster_ec_curve_t ec_curve;
91     uint32_t key_size;
92     keymaster_error_t error = GetCurveAndSize(authorizations, &ec_curve, &key_size);
93     if (error != KM_ERROR_OK) {
94         return error;
95     } else if (!authorizations.Contains(TAG_KEY_SIZE, key_size)) {
96         authorizations.push_back(TAG_KEY_SIZE, key_size);
97     } else if (!authorizations.Contains(TAG_EC_CURVE, ec_curve)) {
98         authorizations.push_back(TAG_EC_CURVE, ec_curve);
99     }
100 
101     UniquePtr<EC_KEY, EC_KEY_Delete> ec_key(EC_KEY_new());
102     UniquePtr<EVP_PKEY, EVP_PKEY_Delete> pkey(EVP_PKEY_new());
103     if (ec_key.get() == nullptr || pkey.get() == nullptr) return KM_ERROR_MEMORY_ALLOCATION_FAILED;
104 
105     UniquePtr<EC_GROUP, EC_GROUP_Delete> group(ChooseGroup(ec_curve));
106     if (group.get() == nullptr) {
107         LOG_E("Unable to get EC group for curve %d", ec_curve);
108         return KM_ERROR_UNSUPPORTED_KEY_SIZE;
109     }
110 
111 #if !defined(OPENSSL_IS_BORINGSSL)
112     EC_GROUP_set_point_conversion_form(group.get(), POINT_CONVERSION_UNCOMPRESSED);
113     EC_GROUP_set_asn1_flag(group.get(), OPENSSL_EC_NAMED_CURVE);
114 #endif
115 
116     if (EC_KEY_set_group(ec_key.get(), group.get()) != 1 ||
117         EC_KEY_generate_key(ec_key.get()) != 1 || EC_KEY_check_key(ec_key.get()) < 0) {
118         return TranslateLastOpenSslError();
119     }
120 
121     if (EVP_PKEY_set1_EC_KEY(pkey.get(), ec_key.get()) != 1) return TranslateLastOpenSslError();
122 
123     KeymasterKeyBlob key_material;
124     error = EvpKeyToKeyMaterial(pkey.get(), &key_material);
125     if (error != KM_ERROR_OK) return error;
126 
127     error = blob_maker_.CreateKeyBlob(authorizations, KM_ORIGIN_GENERATED, key_material, key_blob,
128                                       hw_enforced, sw_enforced);
129     if (error != KM_ERROR_OK) return error;
130 
131     if (context_.GetKmVersion() < KmVersion::KEYMINT_1) return KM_ERROR_OK;
132     if (!cert_chain) return KM_ERROR_UNEXPECTED_NULL_POINTER;
133 
134     EcKey key(*hw_enforced, *sw_enforced, this, move(ec_key));
135     if (key_description.Contains(TAG_ATTESTATION_CHALLENGE)) {
136         *cert_chain = context_.GenerateAttestation(key, key_description, move(attest_key),
137                                                    issuer_subject, &error);
138     } else if (attest_key.get() != nullptr) {
139         return KM_ERROR_ATTESTATION_CHALLENGE_MISSING;
140     } else {
141         *cert_chain = context_.GenerateSelfSignedCertificate(
142             key, key_description,
143             !key_description.Contains(TAG_PURPOSE, KM_PURPOSE_SIGN) /* fake_signature */, &error);
144     }
145 
146     return error;
147 }
148 
ImportKey(const AuthorizationSet & key_description,keymaster_key_format_t input_key_material_format,const KeymasterKeyBlob & input_key_material,UniquePtr<Key> attest_key,const KeymasterBlob & issuer_subject,KeymasterKeyBlob * output_key_blob,AuthorizationSet * hw_enforced,AuthorizationSet * sw_enforced,CertificateChain * cert_chain) const149 keymaster_error_t EcKeyFactory::ImportKey(const AuthorizationSet& key_description,  //
150                                           keymaster_key_format_t input_key_material_format,
151                                           const KeymasterKeyBlob& input_key_material,
152                                           UniquePtr<Key> attest_key,  //
153                                           const KeymasterBlob& issuer_subject,
154                                           KeymasterKeyBlob* output_key_blob,
155                                           AuthorizationSet* hw_enforced,
156                                           AuthorizationSet* sw_enforced,
157                                           CertificateChain* cert_chain) const {
158     if (!output_key_blob || !hw_enforced || !sw_enforced) return KM_ERROR_OUTPUT_PARAMETER_NULL;
159 
160     AuthorizationSet authorizations;
161     uint32_t key_size;
162     keymaster_error_t error = UpdateImportKeyDescription(
163         key_description, input_key_material_format, input_key_material, &authorizations, &key_size);
164     if (error != KM_ERROR_OK) return error;
165 
166     error = blob_maker_.CreateKeyBlob(authorizations, KM_ORIGIN_IMPORTED, input_key_material,
167                                       output_key_blob, hw_enforced, sw_enforced);
168     if (error != KM_ERROR_OK) return error;
169 
170     if (context_.GetKmVersion() < KmVersion::KEYMINT_1) return KM_ERROR_OK;
171     if (!cert_chain) return KM_ERROR_UNEXPECTED_NULL_POINTER;
172 
173     EVP_PKEY_Ptr pkey;
174     error = KeyMaterialToEvpKey(KM_KEY_FORMAT_PKCS8, input_key_material, KM_ALGORITHM_EC, &pkey);
175     if (error != KM_ERROR_OK) return error;
176 
177     EC_KEY_Ptr ec_key(EVP_PKEY_get1_EC_KEY(pkey.get()));
178     if (!ec_key.get()) return KM_ERROR_INVALID_ARGUMENT;
179 
180     EcKey key(*hw_enforced, *sw_enforced, this, move(ec_key));
181     if (key_description.Contains(KM_TAG_ATTESTATION_CHALLENGE)) {
182         *cert_chain = context_.GenerateAttestation(key, key_description, move(attest_key),
183                                                    issuer_subject, &error);
184     } else if (attest_key.get() != nullptr) {
185         return KM_ERROR_ATTESTATION_CHALLENGE_MISSING;
186     } else {
187         *cert_chain = context_.GenerateSelfSignedCertificate(
188             key, key_description,
189             !key_description.Contains(TAG_PURPOSE, KM_PURPOSE_SIGN) /* fake_signature */, &error);
190     }
191 
192     return error;
193 }
194 
UpdateImportKeyDescription(const AuthorizationSet & key_description,keymaster_key_format_t key_format,const KeymasterKeyBlob & key_material,AuthorizationSet * updated_description,uint32_t * key_size_bits) const195 keymaster_error_t EcKeyFactory::UpdateImportKeyDescription(const AuthorizationSet& key_description,
196                                                            keymaster_key_format_t key_format,
197                                                            const KeymasterKeyBlob& key_material,
198                                                            AuthorizationSet* updated_description,
199                                                            uint32_t* key_size_bits) const {
200     if (!updated_description || !key_size_bits) return KM_ERROR_OUTPUT_PARAMETER_NULL;
201 
202     UniquePtr<EVP_PKEY, EVP_PKEY_Delete> pkey;
203     keymaster_error_t error =
204         KeyMaterialToEvpKey(key_format, key_material, keymaster_key_type(), &pkey);
205     if (error != KM_ERROR_OK) return error;
206 
207     UniquePtr<EC_KEY, EC_KEY_Delete> ec_key(EVP_PKEY_get1_EC_KEY(pkey.get()));
208     if (!ec_key.get()) return TranslateLastOpenSslError();
209 
210     updated_description->Reinitialize(key_description);
211 
212     size_t extracted_key_size_bits;
213     error = ec_get_group_size(EC_KEY_get0_group(ec_key.get()), &extracted_key_size_bits);
214     if (error != KM_ERROR_OK) return error;
215 
216     *key_size_bits = extracted_key_size_bits;
217     if (!updated_description->GetTagValue(TAG_KEY_SIZE, key_size_bits)) {
218         updated_description->push_back(TAG_KEY_SIZE, extracted_key_size_bits);
219     } else if (*key_size_bits != extracted_key_size_bits) {
220         return KM_ERROR_IMPORT_PARAMETER_MISMATCH;
221     }
222 
223     keymaster_ec_curve_t curve_from_size;
224     error = EcKeySizeToCurve(*key_size_bits, &curve_from_size);
225     if (error != KM_ERROR_OK) return error;
226     keymaster_ec_curve_t curve;
227     if (!updated_description->GetTagValue(TAG_EC_CURVE, &curve)) {
228         updated_description->push_back(TAG_EC_CURVE, curve_from_size);
229     } else if (curve_from_size != curve) {
230         return KM_ERROR_IMPORT_PARAMETER_MISMATCH;
231     }
232 
233     keymaster_algorithm_t algorithm = KM_ALGORITHM_EC;
234     if (!updated_description->GetTagValue(TAG_ALGORITHM, &algorithm)) {
235         updated_description->push_back(TAG_ALGORITHM, KM_ALGORITHM_EC);
236     } else if (algorithm != KM_ALGORITHM_EC) {
237         return KM_ERROR_IMPORT_PARAMETER_MISMATCH;
238     }
239 
240     return KM_ERROR_OK;
241 }
242 
243 /* static */
ChooseGroup(size_t key_size_bits)244 EC_GROUP* EcKeyFactory::ChooseGroup(size_t key_size_bits) {
245     switch (key_size_bits) {
246     case 224:
247         return EC_GROUP_new_by_curve_name(NID_secp224r1);
248         break;
249     case 256:
250         return EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1);
251         break;
252     case 384:
253         return EC_GROUP_new_by_curve_name(NID_secp384r1);
254         break;
255     case 521:
256         return EC_GROUP_new_by_curve_name(NID_secp521r1);
257         break;
258     default:
259         return nullptr;
260         break;
261     }
262 }
263 
264 /* static */
ChooseGroup(keymaster_ec_curve_t ec_curve)265 EC_GROUP* EcKeyFactory::ChooseGroup(keymaster_ec_curve_t ec_curve) {
266     switch (ec_curve) {
267     case KM_EC_CURVE_P_224:
268         return EC_GROUP_new_by_curve_name(NID_secp224r1);
269         break;
270     case KM_EC_CURVE_P_256:
271         return EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1);
272         break;
273     case KM_EC_CURVE_P_384:
274         return EC_GROUP_new_by_curve_name(NID_secp384r1);
275         break;
276     case KM_EC_CURVE_P_521:
277         return EC_GROUP_new_by_curve_name(NID_secp521r1);
278         break;
279     default:
280         return nullptr;
281         break;
282     }
283 }
284 
CreateEmptyKey(AuthorizationSet && hw_enforced,AuthorizationSet && sw_enforced,UniquePtr<AsymmetricKey> * key) const285 keymaster_error_t EcKeyFactory::CreateEmptyKey(AuthorizationSet&& hw_enforced,
286                                                AuthorizationSet&& sw_enforced,
287                                                UniquePtr<AsymmetricKey>* key) const {
288     key->reset(new (std::nothrow) EcKey(move(hw_enforced), move(sw_enforced), this));
289     if (!(*key)) return KM_ERROR_MEMORY_ALLOCATION_FAILED;
290     return KM_ERROR_OK;
291 }
292 
293 }  // namespace keymaster
294