From 51ed2d7171e5423cfec86c36ffa32e8e9e0de01c Mon Sep 17 00:00:00 2001
From: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Tue, 1 Mar 2022 16:55:01 +0100
Subject: [PATCH 27/34] EP11: Add support for encrypt/decrypt and KEM
operations with Kyber
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
---
usr/lib/ep11_stdll/ep11_specific.c | 174 ++++++++++++++++++++++++++++++++++---
usr/lib/ep11_stdll/new_host.c | 24 +++--
2 files changed, 180 insertions(+), 18 deletions(-)
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
index bc17b07a..9efce053 100644
--- a/usr/lib/ep11_stdll/ep11_specific.c
+++ b/usr/lib/ep11_stdll/ep11_specific.c
@@ -5196,6 +5196,126 @@ CK_RV token_specific_aes_cmac(STDLL_TokData_t *tokdata,
return rc;
}
+struct EP11_KYBER_MECH {
+ CK_MECHANISM mech;
+ struct XCP_KYBER_KEM_PARAMS params;
+};
+
+static CK_RV ep11tok_kyber_mech_pre_process(STDLL_TokData_t *tokdata,
+ CK_MECHANISM *mech,
+ struct EP11_KYBER_MECH *mech_ep11,
+ OBJECT **secret_key_obj)
+{
+ CK_IBM_KYBER_PARAMS *kyber_params;
+ CK_RV rc;
+
+ kyber_params = mech->pParameter;
+ if (mech->ulParameterLen != sizeof(CK_IBM_KYBER_PARAMS)) {
+ TRACE_ERROR("Mechanism parameter length not as expected\n");
+ return CKR_MECHANISM_PARAM_INVALID;
+ }
+
+ if (kyber_params->ulVersion != CK_IBM_KYBER_KEM_VERSION) {
+ TRACE_ERROR("Unsupported version in Kyber mechanism param\n");
+ return CKR_MECHANISM_PARAM_INVALID;
+ }
+
+ mech_ep11->mech.mechanism = mech->mechanism;
+ mech_ep11->mech.pParameter = &mech_ep11->params;
+ mech_ep11->mech.ulParameterLen = sizeof(mech_ep11->params);
+
+ memset(&mech_ep11->params, 0, sizeof(mech_ep11->params));
+ mech_ep11->params.version = XCP_KYBER_KEM_VERSION;
+ mech_ep11->params.mode = kyber_params->mode;
+ mech_ep11->params.kdf = kyber_params->kdf;
+ mech_ep11->params.prepend = kyber_params->bPrepend;
+ mech_ep11->params.pSharedData = kyber_params->pSharedData;
+ mech_ep11->params.ulSharedDataLen = kyber_params->ulSharedDataLen;
+
+ switch (kyber_params->mode) {
+ case CK_IBM_KYBER_KEM_ENCAPSULATE:
+ if (kyber_params->ulCipherLen > 0 && kyber_params->pCipher == NULL) {
+ TRACE_ERROR("Unsupported cipher buffer in Kyber mechnism param "
+ "cannot be NULL\n");
+ return CKR_MECHANISM_PARAM_INVALID;
+ }
+
+ mech_ep11->params.pCipher = NULL;
+ mech_ep11->params.ulCipherLen = 0;
+ /* Cipher is returned in 2nd output param of m_DeriveKey */
+ break;
+
+ case CK_IBM_KEM_DECAPSULATE:
+ mech_ep11->params.pCipher = kyber_params->pCipher;
+ mech_ep11->params.ulCipherLen = kyber_params->ulCipherLen;
+ break;
+
+ default:
+ TRACE_ERROR("Unsupported mode in Kyber mechanism param\n");
+ return CKR_MECHANISM_PARAM_INVALID;
+ }
+
+ if (kyber_params->bPrepend) {
+ rc = h_opaque_2_blob(tokdata, kyber_params->hSecret,
+ &mech_ep11->params.pBlob,
+ &mech_ep11->params.ulBlobLen,
+ secret_key_obj, READ_LOCK);
+ if (rc != CKR_OK) {
+ TRACE_ERROR("%s failed hSecret=0x%lx\n", __func__,
+ kyber_params->hSecret);
+ return rc;
+ }
+ }
+
+ return CKR_OK;
+}
+
+static CK_RV ep11tok_kyber_mech_post_process(STDLL_TokData_t *tokdata,
+ CK_MECHANISM *mech,
+ CK_BYTE *csum, CK_ULONG cslen)
+{
+ CK_IBM_KYBER_PARAMS *kyber_params;
+ CK_ULONG cipher_len;
+
+ UNUSED(tokdata);
+
+ kyber_params = mech->pParameter;
+ if (mech->ulParameterLen != sizeof(CK_IBM_KYBER_PARAMS)) {
+ TRACE_ERROR("Mechanism parameter length not as expected\n");
+ return CKR_MECHANISM_PARAM_INVALID;
+ }
+
+ if (kyber_params->mode != CK_IBM_KYBER_KEM_ENCAPSULATE)
+ return CKR_OK;
+
+ /*
+ * For encapsulate:
+ * Generated cipher is returned in csum prepended with the checksum of
+ * the generated symmetric key and its bit count (in total 7 bytes).
+ */
+ if (cslen < EP11_CSUMSIZE + 4) {
+ TRACE_ERROR("%s returned cipher size is invalid: %lu\n",
+ __func__, cslen);
+ return CKR_FUNCTION_FAILED;
+ }
+
+ cipher_len = cslen - (EP11_CSUMSIZE + 4);
+
+ if (kyber_params->ulCipherLen < cipher_len) {
+ TRACE_ERROR("%s Cipher buffer in kyber mechanism param too small, required: %lu\n",
+ __func__, cipher_len);
+ kyber_params->ulCipherLen = cipher_len;
+ OPENSSL_cleanse(&csum[EP11_CSUMSIZE + 4], cipher_len);
+ return CKR_BUFFER_TOO_SMALL;
+ }
+
+ memcpy(kyber_params->pCipher, &csum[EP11_CSUMSIZE + 4], cipher_len);
+ kyber_params->ulCipherLen = cipher_len;
+
+ OPENSSL_cleanse(&csum[EP11_CSUMSIZE + 4], cipher_len);
+ return CKR_OK;
+}
+
CK_RV ep11tok_derive_key(STDLL_TokData_t * tokdata, SESSION * session,
CK_MECHANISM_PTR mech, CK_OBJECT_HANDLE hBaseKey,
CK_OBJECT_HANDLE_PTR handle, CK_ATTRIBUTE_PTR attrs,
@@ -5236,6 +5356,8 @@ CK_RV ep11tok_derive_key(STDLL_TokData_t * tokdata, SESSION * session,
CK_BYTE *spki = NULL;
CK_ULONG spki_length = 0;
CK_ATTRIBUTE *spki_attr = NULL;
+ struct EP11_KYBER_MECH mech_ep11;
+ OBJECT *kyber_secret_obj = NULL;
memset(newblob, 0, sizeof(newblob));
@@ -5517,16 +5639,29 @@ CK_RV ep11tok_derive_key(STDLL_TokData_t * tokdata, SESSION * session,
}
}
+ if (mech->mechanism == CKM_IBM_KYBER) {
+ rc = ep11tok_kyber_mech_pre_process(tokdata, mech, &mech_ep11,
+ &kyber_secret_obj);
+ if (rc != CKR_OK)
+ goto error;
+ mech = &mech_ep11.mech;
+ }
+
trace_attributes(__func__, "Derive:", new_attrs2, new_attrs2_len);
ep11_get_pin_blob(ep11_session, ep11_is_session_object(attrs, attrs_len),
&ep11_pin_blob, &ep11_pin_blob_len);
RETRY_START(rc, tokdata)
- rc =
- dll_m_DeriveKey(mech, new_attrs2, new_attrs2_len, keyblob, keyblobsize,
- NULL, 0, ep11_pin_blob, ep11_pin_blob_len, newblob,
- &newblobsize, csum, &cslen, target_info->target);
+ if (ep11_pqc_obj_strength_supported(target_info, mech->mechanism,
+ base_key_obj))
+ rc = dll_m_DeriveKey(mech, new_attrs2, new_attrs2_len,
+ keyblob, keyblobsize, NULL, 0,
+ ep11_pin_blob, ep11_pin_blob_len, newblob,
+ &newblobsize, csum, &cslen,
+ target_info->target);
+ else
+ rc = CKR_KEY_SIZE_RANGE;
RETRY_END(rc, tokdata, session)
if (rc != CKR_OK) {
@@ -5610,6 +5745,12 @@ CK_RV ep11tok_derive_key(STDLL_TokData_t * tokdata, SESSION * session,
}
}
+ if (mech->mechanism == CKM_IBM_KYBER) {
+ rc = ep11tok_kyber_mech_post_process(tokdata, mech_orig, csum, cslen);
+ if (rc != CKR_OK)
+ goto error;
+ }
+
if (class == CKO_SECRET_KEY && cslen >= EP11_CSUMSIZE) {
/* First 3 bytes of csum is the check value */
rc = build_attribute(CKA_CHECK_VALUE, csum, EP11_CSUMSIZE, &chk_attr);
@@ -5666,6 +5807,8 @@ error:
object_put(tokdata, base_key_obj, TRUE);
base_key_obj = NULL;
+ object_put(tokdata, kyber_secret_obj, TRUE);
+ kyber_secret_obj = NULL;
return rc;
}
@@ -7399,6 +7542,7 @@ CK_BOOL ep11tok_mech_single_only(CK_MECHANISM *mech)
{
switch (mech->mechanism) {
case CKM_IBM_ECDSA_OTHER:
+ case CKM_IBM_KYBER:
return CK_TRUE;
default:
return CK_FALSE;
@@ -8301,9 +8445,14 @@ CK_RV ep11tok_decrypt_single(STDLL_TokData_t *tokdata, SESSION *session,
}
RETRY_START(rc, tokdata)
- rc = dll_m_DecryptSingle(keyblob, keyblobsize, mech, input_data,
- input_data_len, output_data, p_output_data_len,
- target_info->target);
+ if (ep11_pqc_obj_strength_supported(target_info, mech->mechanism,
+ key_obj))
+ rc = dll_m_DecryptSingle(keyblob, keyblobsize, mech, input_data,
+ input_data_len, output_data,
+ p_output_data_len,
+ target_info->target);
+ else
+ rc = CKR_KEY_SIZE_RANGE;
RETRY_END(rc, tokdata, session)
if (rc != CKR_OK) {
rc = ep11_error_to_pkcs11_error(rc, session);
@@ -8511,9 +8660,14 @@ CK_RV ep11tok_encrypt_single(STDLL_TokData_t *tokdata, SESSION *session,
}
RETRY_START(rc, tokdata)
- rc = dll_m_EncryptSingle(keyblob, keyblobsize, mech, input_data,
- input_data_len, output_data, p_output_data_len,
- target_info->target);
+ if (ep11_pqc_obj_strength_supported(target_info, mech->mechanism,
+ key_obj))
+ rc = dll_m_EncryptSingle(keyblob, keyblobsize, mech, input_data,
+ input_data_len, output_data,
+ p_output_data_len,
+ target_info->target);
+ else
+ rc = CKR_KEY_SIZE_RANGE;
RETRY_END(rc, tokdata, session)
if (rc != CKR_OK) {
rc = ep11_error_to_pkcs11_error(rc, session);
diff --git a/usr/lib/ep11_stdll/new_host.c b/usr/lib/ep11_stdll/new_host.c
index dccdfe96..60027c85 100644
--- a/usr/lib/ep11_stdll/new_host.c
+++ b/usr/lib/ep11_stdll/new_host.c
@@ -2061,7 +2061,8 @@ CK_RV SC_EncryptInit(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
sess->encr_ctx.multi_init = FALSE;
sess->encr_ctx.multi = FALSE;
- if (ep11tok_optimize_single_ops(tokdata) &&
+ if ((ep11tok_optimize_single_ops(tokdata) ||
+ ep11tok_mech_single_only(pMechanism)) &&
!ep11tok_pkey_usage_ok(tokdata, sess, hKey, pMechanism)) {
/* In case of a single part encrypt operation we don't need the
* EncryptInit, instead we can use the EncryptSingle which is much
@@ -2159,7 +2160,8 @@ CK_RV SC_Encrypt(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
goto done;
}
- if (ep11tok_optimize_single_ops(tokdata) &&
+ if ((ep11tok_optimize_single_ops(tokdata) ||
+ ep11tok_mech_single_only(&sess->encr_ctx.mech)) &&
!ep11tok_pkey_usage_ok(tokdata, sess, sess->encr_ctx.key, &sess->encr_ctx.mech)) {
rc = ep11tok_encrypt_single(tokdata, sess, &sess->encr_ctx.mech,
length_only, sess->encr_ctx.key,
@@ -2217,7 +2219,8 @@ CK_RV SC_EncryptUpdate(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
goto done;
}
- if (sess->encr_ctx.active == FALSE) {
+ if (sess->encr_ctx.active == FALSE ||
+ ep11tok_mech_single_only(&sess->encr_ctx.mech)) {
TRACE_ERROR("%s\n", ock_err(ERR_OPERATION_NOT_INITIALIZED));
rc = CKR_OPERATION_NOT_INITIALIZED;
goto done;
@@ -2293,7 +2296,8 @@ CK_RV SC_EncryptFinal(STDLL_TokData_t * tokdata, ST_SESSION_HANDLE * sSession,
goto done;
}
- if (sess->encr_ctx.active == FALSE) {
+ if (sess->encr_ctx.active == FALSE ||
+ ep11tok_mech_single_only(&sess->encr_ctx.mech)) {
TRACE_ERROR("%s\n", ock_err(ERR_OPERATION_NOT_INITIALIZED));
rc = CKR_OPERATION_NOT_INITIALIZED;
goto done;
@@ -2385,7 +2389,8 @@ CK_RV SC_DecryptInit(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
sess->decr_ctx.multi_init = FALSE;
sess->decr_ctx.multi = FALSE;
- if (ep11tok_optimize_single_ops(tokdata) &&
+ if ((ep11tok_optimize_single_ops(tokdata) ||
+ ep11tok_mech_single_only(pMechanism)) &&
!ep11tok_pkey_usage_ok(tokdata, sess, hKey, pMechanism)) {
/* In case of a single part decrypt operation we don't need the
* DecryptInit, instead we can use the EncryptSingle which is much
@@ -2483,7 +2488,8 @@ CK_RV SC_Decrypt(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
goto done;
}
- if (ep11tok_optimize_single_ops(tokdata) &&
+ if ((ep11tok_optimize_single_ops(tokdata) ||
+ ep11tok_mech_single_only(&sess->decr_ctx.mech)) &&
!ep11tok_pkey_usage_ok(tokdata, sess, sess->decr_ctx.key, &sess->decr_ctx.mech)) {
rc = ep11tok_decrypt_single(tokdata, sess, &sess->decr_ctx.mech,
length_only, sess->decr_ctx.key,
@@ -2541,7 +2547,8 @@ CK_RV SC_DecryptUpdate(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
goto done;
}
- if (sess->decr_ctx.active == FALSE) {
+ if (sess->decr_ctx.active == FALSE ||
+ ep11tok_mech_single_only(&sess->decr_ctx.mech)) {
TRACE_ERROR("%s\n", ock_err(ERR_OPERATION_NOT_INITIALIZED));
rc = CKR_OPERATION_NOT_INITIALIZED;
goto done;
@@ -2617,7 +2624,8 @@ CK_RV SC_DecryptFinal(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
goto done;
}
- if (sess->decr_ctx.active == FALSE) {
+ if (sess->decr_ctx.active == FALSE ||
+ ep11tok_mech_single_only(&sess->decr_ctx.mech)) {
TRACE_ERROR("%s\n", ock_err(ERR_OPERATION_NOT_INITIALIZED));
rc = CKR_OPERATION_NOT_INITIALIZED;
goto done;
--
2.16.2.windows.1