oberon_backend_ecc.c 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464
  1. /**
  2. * Copyright (c) 2018 - 2020, Nordic Semiconductor ASA
  3. *
  4. * All rights reserved.
  5. *
  6. * Redistribution and use in source and binary forms, with or without modification,
  7. * are permitted provided that the following conditions are met:
  8. *
  9. * 1. Redistributions of source code must retain the above copyright notice, this
  10. * list of conditions and the following disclaimer.
  11. *
  12. * 2. Redistributions in binary form, except as embedded into a Nordic
  13. * Semiconductor ASA integrated circuit in a product or a software update for
  14. * such product, must reproduce the above copyright notice, this list of
  15. * conditions and the following disclaimer in the documentation and/or other
  16. * materials provided with the distribution.
  17. *
  18. * 3. Neither the name of Nordic Semiconductor ASA nor the names of its
  19. * contributors may be used to endorse or promote products derived from this
  20. * software without specific prior written permission.
  21. *
  22. * 4. This software, with or without modification, must only be used with a
  23. * Nordic Semiconductor ASA integrated circuit.
  24. *
  25. * 5. Any software provided in binary form under this license must not be reverse
  26. * engineered, decompiled, modified and/or disassembled.
  27. *
  28. * THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
  29. * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  30. * OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
  31. * DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
  32. * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  33. * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
  34. * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  35. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  36. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  37. * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  38. *
  39. */
  40. #include "sdk_config.h"
  41. #include "nordic_common.h"
  42. #if NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON)
  43. #include <stdbool.h>
  44. #include <string.h>
  45. #include <stddef.h>
  46. #include "app_util.h"
  47. #include "nrf_crypto_ecc.h"
  48. #include "nrf_crypto_mem.h"
  49. #include "nrf_crypto_rng.h"
  50. #include "nrf_crypto_shared.h"
  51. #include "oberon_backend_ecc.h"
  52. #if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_SECP256R1)
  53. #include "ocrypto_ecdh_p256.h"
  54. #endif
  55. #if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_CURVE25519)
  56. #include "ocrypto_curve25519.h"
  57. #endif
  58. #if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_ED25519)
  59. #include "ocrypto_ed25519.h"
  60. #endif
  61. /** @internal @brief Structure holding private key common to all curves implemented by the Oberon.
  62. */
  63. typedef struct
  64. {
  65. nrf_crypto_internal_ecc_key_header_t header; /**< @internal @brief Common ECC key header. */
  66. uint8_t key[32]; /**< @internal @brief Raw key. */
  67. } nrf_crypto_backend_oberon_private_key_t;
  68. /** @internal @brief Structure holding public key common to all curves implemented by the Oberon.
  69. */
  70. typedef struct
  71. {
  72. nrf_crypto_internal_ecc_key_header_t header; /**< @internal @brief Common ECC key header. */
  73. uint8_t key[64]; /**< @internal @brief Raw key. */
  74. } nrf_crypto_backend_oberon_public_key_t;
  75. /** @internal @brief Function to hold copy function (can be simple mem copy or copy with endian swap).
  76. */
  77. typedef void (*copy_fn_t)(void * p_dest, void const * p_src, size_t size);
  78. ret_code_t nrf_crypto_backend_oberon_private_key_to_raw(
  79. void const * p_private_key,
  80. uint8_t * p_raw_data)
  81. {
  82. nrf_crypto_backend_oberon_private_key_t const * p_prv =
  83. (nrf_crypto_backend_oberon_private_key_t const *)p_private_key;
  84. //lint -save -e611 (Suspicious cast)
  85. copy_fn_t copy_fn = (copy_fn_t)p_prv->header.p_info->p_backend_data;
  86. //lint -restore
  87. copy_fn(p_raw_data, p_prv->key, p_prv->header.p_info->raw_private_key_size);
  88. return NRF_SUCCESS;
  89. }
  90. ret_code_t nrf_crypto_backend_oberon_public_key_from_raw(
  91. void * p_public_key,
  92. uint8_t const * p_raw_data)
  93. {
  94. nrf_crypto_backend_oberon_public_key_t * p_pub =
  95. (nrf_crypto_backend_oberon_public_key_t *)p_public_key;
  96. //lint -save -e611 (Suspicious cast)
  97. copy_fn_t copy_fn = (copy_fn_t)p_pub->header.p_info->p_backend_data;
  98. //lint -restore
  99. copy_fn(p_pub->key, p_raw_data, p_pub->header.p_info->raw_public_key_size);
  100. return NRF_SUCCESS;
  101. }
  102. ret_code_t nrf_crypto_backend_oberon_public_key_to_raw(
  103. void const * p_public_key,
  104. uint8_t * p_raw_data)
  105. {
  106. nrf_crypto_backend_oberon_public_key_t const * p_pub =
  107. (nrf_crypto_backend_oberon_public_key_t const *)p_public_key;
  108. //lint -save -e611 (Suspicious cast)
  109. copy_fn_t copy_fn = (copy_fn_t)p_pub->header.p_info->p_backend_data;
  110. //lint -restore
  111. copy_fn(p_raw_data, p_pub->key, p_pub->header.p_info->raw_public_key_size);
  112. return NRF_SUCCESS;
  113. }
  114. #if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_SECP256R1) \
  115. || NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_CURVE25519)
  116. ret_code_t nrf_crypto_backend_oberon_private_key_from_raw(
  117. void * p_private_key,
  118. uint8_t const * p_raw_data)
  119. {
  120. nrf_crypto_backend_oberon_private_key_t * p_prv =
  121. (nrf_crypto_backend_oberon_private_key_t *)p_private_key;
  122. //lint -save -e611 (Suspicious cast)
  123. copy_fn_t copy_fn = (copy_fn_t)p_prv->header.p_info->p_backend_data;
  124. //lint -restore
  125. copy_fn(p_prv->key, p_raw_data, p_prv->header.p_info->raw_private_key_size);
  126. return NRF_SUCCESS;
  127. }
  128. #endif //NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_SECP256R1) || NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_CURVE25519)
  129. #if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_CURVE25519) \
  130. || NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_ED25519)
  131. static ret_code_t oberon_vector_generate(uint8_t * p_data, size_t size)
  132. {
  133. #if defined(NRF_CRYPTO_RNG_ENABLED) && (NRF_CRYPTO_RNG_ENABLED == 1)
  134. return nrf_crypto_rng_vector_generate(p_data, size);
  135. #elif defined(NRF_CRYPTO_RNG_ENABLED) && (NRF_CRYPTO_RNG_ENABLED == 0)
  136. return NRF_ERROR_CRYPTO_FEATURE_UNAVAILABLE;
  137. #else
  138. #warning NRF_CRYPTO_RNG_ENABLED define not found in sdk_config.h (Is the sdk_config.h valid?).
  139. #endif
  140. }
  141. #endif //NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_CURVE25519) || NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_ED25519)
  142. #if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_SECP256R1)
  143. // Make sure that common key structure match secp256r1 key structure to safely cast types.
  144. STATIC_ASSERT(offsetof(nrf_crypto_backend_oberon_private_key_t, key) ==
  145. offsetof(nrf_crypto_backend_secp256r1_private_key_t, key),
  146. "Common Oberon private key structure does not match secp256r1 one.");
  147. STATIC_ASSERT(offsetof(nrf_crypto_backend_oberon_public_key_t, key) ==
  148. offsetof(nrf_crypto_backend_secp256r1_public_key_t, key),
  149. "Common Oberon public key structure does not match secp256r1 one.");
  150. ret_code_t nrf_crypto_backend_oberon_ecc_secp256r1_rng(uint8_t data[32])
  151. {
  152. #if NRF_MODULE_ENABLED(NRF_CRYPTO_RNG)
  153. static const uint8_t min_value[32] =
  154. {
  155. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  156. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
  157. };
  158. static const uint8_t max_value[32] =
  159. {
  160. 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
  161. 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84, 0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x50,
  162. };
  163. return nrf_crypto_rng_vector_generate_in_range(data, min_value, max_value, 32);
  164. #else
  165. return NRF_ERROR_CRYPTO_FEATURE_UNAVAILABLE;
  166. #endif
  167. }
  168. ret_code_t nrf_crypto_backend_secp256r1_key_pair_generate(
  169. void * p_context,
  170. void * p_private_key,
  171. void * p_public_key)
  172. {
  173. int result;
  174. nrf_crypto_backend_secp256r1_private_key_t * p_prv =
  175. (nrf_crypto_backend_secp256r1_private_key_t *)p_private_key;
  176. nrf_crypto_backend_secp256r1_public_key_t * p_pub =
  177. (nrf_crypto_backend_secp256r1_public_key_t *)p_public_key;
  178. result = nrf_crypto_backend_oberon_ecc_secp256r1_rng(p_prv->key);
  179. if (result != NRF_SUCCESS)
  180. {
  181. return result;
  182. }
  183. result = ocrypto_ecdh_p256_public_key(p_pub->key, p_prv->key);
  184. if (result != 0)
  185. {
  186. return NRF_ERROR_CRYPTO_INTERNAL;
  187. }
  188. return NRF_SUCCESS;
  189. }
  190. ret_code_t nrf_crypto_backend_secp256r1_public_key_calculate(
  191. void * p_context,
  192. void const * p_private_key,
  193. void * p_public_key)
  194. {
  195. int result;
  196. nrf_crypto_backend_secp256r1_private_key_t const * p_prv =
  197. (nrf_crypto_backend_secp256r1_private_key_t const *)p_private_key;
  198. nrf_crypto_backend_secp256r1_public_key_t * p_pub =
  199. (nrf_crypto_backend_secp256r1_public_key_t *)p_public_key;
  200. result = ocrypto_ecdh_p256_public_key(p_pub->key, p_prv->key);
  201. if (result != 0)
  202. {
  203. return NRF_ERROR_CRYPTO_INTERNAL;
  204. }
  205. return NRF_SUCCESS;
  206. }
  207. const nrf_crypto_ecc_curve_info_t g_nrf_crypto_ecc_secp256r1_curve_info =
  208. {
  209. .public_key_size = sizeof(nrf_crypto_backend_secp256r1_public_key_t),
  210. .private_key_size = sizeof(nrf_crypto_backend_secp256r1_private_key_t),
  211. .curve_type = NRF_CRYPTO_ECC_SECP256R1_CURVE_TYPE,
  212. .raw_private_key_size = NRF_CRYPTO_ECC_SECP256R1_RAW_PRIVATE_KEY_SIZE,
  213. .raw_public_key_size = NRF_CRYPTO_ECC_SECP256R1_RAW_PUBLIC_KEY_SIZE,
  214. //lint -save -e611 -e546 (Suspicious cast, Suspicious use of &)
  215. .p_backend_data = (void *)&memcpy,
  216. //lint -restore
  217. };
  218. #endif // NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_SECP256R1)
  219. #if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_CURVE25519)
  220. // Make sure that common key structure match Curve25519 key structure to safely cast types.
  221. STATIC_ASSERT(offsetof(nrf_crypto_backend_oberon_private_key_t, key) ==
  222. offsetof(nrf_crypto_backend_curve25519_private_key_t, key),
  223. "Common Oberon private key structure does not match Curve25519 one.");
  224. STATIC_ASSERT(offsetof(nrf_crypto_backend_oberon_public_key_t, key) ==
  225. offsetof(nrf_crypto_backend_curve25519_public_key_t, key),
  226. "Common Oberon public key structure does not match Curve25519 one.");
  227. ret_code_t nrf_crypto_backend_curve25519_key_pair_generate(
  228. void * p_context,
  229. void * p_private_key,
  230. void * p_public_key)
  231. {
  232. ret_code_t result;
  233. nrf_crypto_backend_curve25519_private_key_t * p_prv =
  234. (nrf_crypto_backend_curve25519_private_key_t *)p_private_key;
  235. nrf_crypto_backend_curve25519_public_key_t * p_pub =
  236. (nrf_crypto_backend_curve25519_public_key_t *)p_public_key;
  237. result = oberon_vector_generate(p_prv->key, sizeof(p_prv->key));
  238. if (result != NRF_SUCCESS)
  239. {
  240. return result;
  241. }
  242. p_prv->key[0] &= 0xF8; // Private key is multiply of 8 (by definition), so lower 3 bits are 0.
  243. p_prv->key[31] &= 0x7F; // Highest bit has to be 0, because private key is 255-bit long.
  244. p_prv->key[31] |= 0x40; // Bit 254 has to be 1 (by definition)
  245. ocrypto_curve25519_scalarmult_base(p_pub->key, p_prv->key);
  246. return NRF_SUCCESS;
  247. }
  248. ret_code_t nrf_crypto_backend_curve25519_public_key_calculate(
  249. void * p_context,
  250. void const * p_private_key,
  251. void * p_public_key)
  252. {
  253. nrf_crypto_backend_curve25519_private_key_t * p_prv =
  254. (nrf_crypto_backend_curve25519_private_key_t *)p_private_key;
  255. nrf_crypto_backend_curve25519_public_key_t * p_pub =
  256. (nrf_crypto_backend_curve25519_public_key_t *)p_public_key;
  257. // Private key bit fixing is done inside Oberon library.
  258. ocrypto_curve25519_scalarmult_base(p_pub->key, p_prv->key);
  259. return NRF_SUCCESS;
  260. }
  261. const nrf_crypto_ecc_curve_info_t g_nrf_crypto_ecc_curve25519_curve_info =
  262. {
  263. .public_key_size = sizeof(nrf_crypto_backend_curve25519_public_key_t),
  264. .private_key_size = sizeof(nrf_crypto_backend_curve25519_private_key_t),
  265. .curve_type = NRF_CRYPTO_ECC_CURVE25519_CURVE_TYPE,
  266. .raw_private_key_size = NRF_CRYPTO_ECC_CURVE25519_RAW_PRIVATE_KEY_SIZE,
  267. .raw_public_key_size = NRF_CRYPTO_ECC_CURVE25519_RAW_PUBLIC_KEY_SIZE,
  268. #if NRF_MODULE_ENABLED(NRF_CRYPTO_CURVE25519_BIG_ENDIAN)
  269. //lint -save -e611 -e546 (Suspicious cast, Suspicious use of &)
  270. .p_backend_data = (void *)&nrf_crypto_internal_swap_endian,
  271. //lint -restore
  272. #else
  273. //lint -save -e611 -e546 (Suspicious cast, Suspicious use of &)
  274. .p_backend_data = (void *)&memcpy,
  275. //lint -restore
  276. #endif
  277. };
  278. #endif // NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_CURVE25519)
  279. #if NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_ED25519)
  280. // Make sure that common key structure match Ed25519 key structure to safely cast types.
  281. STATIC_ASSERT(offsetof(nrf_crypto_backend_oberon_private_key_t, key) ==
  282. offsetof(nrf_crypto_backend_ed25519_private_key_t, private_part),
  283. "Common Oberon private key structure does not match Ed25519 one.");
  284. STATIC_ASSERT(offsetof(nrf_crypto_backend_oberon_public_key_t, key) ==
  285. offsetof(nrf_crypto_backend_ed25519_public_key_t, key),
  286. "Common Oberon public key structure does not match Ed25519 one.");
  287. ret_code_t nrf_crypto_backend_ed25519_private_key_from_raw(
  288. void * p_private_key,
  289. uint8_t const * p_raw_data)
  290. {
  291. nrf_crypto_backend_ed25519_private_key_t * p_prv =
  292. (nrf_crypto_backend_ed25519_private_key_t *)p_private_key;
  293. memcpy(p_prv->private_part, p_raw_data, sizeof(p_prv->private_part));
  294. ocrypto_ed25519_public_key(p_prv->public_part, p_prv->private_part);
  295. return NRF_SUCCESS;
  296. }
  297. ret_code_t nrf_crypto_backend_ed25519_key_pair_generate(
  298. void * p_context,
  299. void * p_private_key,
  300. void * p_public_key)
  301. {
  302. ret_code_t result;
  303. nrf_crypto_backend_ed25519_private_key_t * p_prv =
  304. (nrf_crypto_backend_ed25519_private_key_t *)p_private_key;
  305. nrf_crypto_backend_ed25519_public_key_t * p_pub =
  306. (nrf_crypto_backend_ed25519_public_key_t *)p_public_key;
  307. result = oberon_vector_generate(p_prv->private_part, sizeof(p_prv->private_part));
  308. if (result != NRF_SUCCESS)
  309. {
  310. return result;
  311. }
  312. ocrypto_ed25519_public_key(p_prv->public_part, p_prv->private_part);
  313. memcpy(p_pub->key, p_prv->public_part, sizeof(p_pub->key));
  314. return NRF_SUCCESS;
  315. }
  316. ret_code_t nrf_crypto_backend_ed25519_public_key_calculate(
  317. void * p_context,
  318. void const * p_private_key,
  319. void * p_public_key)
  320. {
  321. nrf_crypto_backend_ed25519_private_key_t * p_prv =
  322. (nrf_crypto_backend_ed25519_private_key_t *)p_private_key;
  323. nrf_crypto_backend_ed25519_public_key_t * p_pub =
  324. (nrf_crypto_backend_ed25519_public_key_t *)p_public_key;
  325. memcpy(p_pub->key, p_prv->public_part, sizeof(p_pub->key));
  326. return NRF_SUCCESS;
  327. }
  328. const nrf_crypto_ecc_curve_info_t g_nrf_crypto_ecc_ed25519_curve_info =
  329. {
  330. .public_key_size = sizeof(nrf_crypto_backend_ed25519_public_key_t),
  331. .private_key_size = sizeof(nrf_crypto_backend_ed25519_private_key_t),
  332. .curve_type = NRF_CRYPTO_ECC_ED25519_CURVE_TYPE,
  333. .raw_private_key_size = NRF_CRYPTO_ECC_ED25519_RAW_PRIVATE_KEY_SIZE,
  334. .raw_public_key_size = NRF_CRYPTO_ECC_ED25519_RAW_PUBLIC_KEY_SIZE,
  335. //lint -save -e611 -e546 (Suspicious cast, Suspicious use of &)
  336. .p_backend_data = (void *)&memcpy,
  337. //lint -restore
  338. };
  339. #endif // NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON_ECC_ED25519)
  340. #endif // NRF_MODULE_ENABLED(NRF_CRYPTO) && NRF_MODULE_ENABLED(NRF_CRYPTO_BACKEND_OBERON)