Skip to content

Commit ead6be2

Browse files
ArekBalysNordicArekBalysNordic
committed
[nrf noup] Spake2+ alignments regarding the newest Oberon version
Aligned Spake2+ algorithm to the Oberon PSA core v1.2.1.1
1 parent ca39da4 commit ead6be2

File tree

6 files changed

+68
-125
lines changed

6 files changed

+68
-125
lines changed

‎config/nrfconnect/chip-module/Kconfig.defaults

+1-6
Original file line numberDiff line numberDiff line change
@@ -369,9 +369,7 @@ config MBEDTLS_HEAP_SIZE
369369

370370
config CHIP_CRYPTO_PSA
371371
default y if !CHIP_WIFI
372-
imply PSA_WANT_ALG_SPAKE2P
373-
# Set SPAKE2P to version 4 to be compatible with Matter specification.
374-
imply PSA_CRYPTO_SPAKE2P_USE_VERSION_04
372+
imply PSA_WANT_ALG_SPAKE2P_MATTER
375373

376374
if CHIP_CRYPTO_PSA
377375

@@ -381,9 +379,6 @@ config PSA_CRYPTO_DRIVER_CC3XX
381379
config PSA_WANT_ALG_SHA_224
382380
default n
383381

384-
config PSA_WANT_ALG_SPAKE2P
385-
default y
386-
387382
# Extend the maximum number of PSA key slots to fit Matter requirements
388383
config MBEDTLS_PSA_KEY_SLOT_COUNT
389384
default 64

‎src/crypto/CHIPCryptoPALPSA.cpp

+14-35
Original file line numberDiff line numberDiff line change
@@ -284,58 +284,37 @@ CHIP_ERROR PsaKdf::Init(const ByteSpan & secret, const ByteSpan & salt, const By
284284
psa_reset_key_attributes(&attrs);
285285
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
286286

287-
PsaHkdfKeyHandle hkdfKeyHandle = { .mKeyId = mSecretKeyId, .mIsKeyId = true };
288-
289-
return InitOperation(hkdfKeyHandle, salt, info);
287+
return InitOperation(mSecretKeyId, salt, info);
290288
}
291289

292290
CHIP_ERROR PsaKdf::Init(const HkdfKeyHandle & hkdfKey, const ByteSpan & salt, const ByteSpan & info)
293291
{
294-
return InitOperation(hkdfKey.As<PsaHkdfKeyHandle>(), salt, info);
292+
return InitOperation(hkdfKey.As<psa_key_id_t>(), salt, info);
295293
}
296294

297-
CHIP_ERROR PsaKdf::InitOperation(PsaHkdfKeyHandle hkdfKey, const ByteSpan & salt, const ByteSpan & info)
295+
CHIP_ERROR PsaKdf::InitOperation(psa_key_id_t hkdfKey, const ByteSpan & salt, const ByteSpan & info)
298296
{
299-
psa_status_t status;
300-
if (hkdfKey.mIsKeyId)
301-
{
302-
status = psa_key_derivation_setup(&mOperation, PSA_ALG_HKDF(PSA_ALG_SHA_256));
303-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
304-
305-
if (salt.size() > 0)
306-
{
307-
status = psa_key_derivation_input_bytes(&mOperation, PSA_KEY_DERIVATION_INPUT_SALT, salt.data(), salt.size());
308-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
309-
}
310-
311-
status = psa_key_derivation_input_key(&mOperation, PSA_KEY_DERIVATION_INPUT_SECRET, hkdfKey.mKeyId);
312-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
297+
psa_status_t status = psa_key_derivation_setup(&mOperation, PSA_ALG_HKDF(PSA_ALG_SHA_256));
298+
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
313299

314-
status = psa_key_derivation_input_bytes(&mOperation, PSA_KEY_DERIVATION_INPUT_INFO, info.data(), info.size());
300+
if (salt.size() > 0)
301+
{
302+
status = psa_key_derivation_input_bytes(&mOperation, PSA_KEY_DERIVATION_INPUT_SALT, salt.data(), salt.size());
315303
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
316-
317-
mDerivationOperation = &mOperation;
318304
}
319-
else
320-
{
321-
mDerivationOperation = hkdfKey.mKeyDerivationOp;
322305

323-
if (salt.size() > 0)
324-
{
325-
status = psa_key_derivation_input_bytes(mDerivationOperation, PSA_KEY_DERIVATION_INPUT_SALT, salt.data(), salt.size());
326-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
327-
}
306+
status = psa_key_derivation_input_key(&mOperation, PSA_KEY_DERIVATION_INPUT_SECRET, hkdfKey);
307+
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
328308

329-
status = psa_key_derivation_input_bytes(mDerivationOperation, PSA_KEY_DERIVATION_INPUT_INFO, info.data(), info.size());
330-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
331-
}
309+
status = psa_key_derivation_input_bytes(&mOperation, PSA_KEY_DERIVATION_INPUT_INFO, info.data(), info.size());
310+
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
332311

333312
return CHIP_NO_ERROR;
334313
}
335314

336315
CHIP_ERROR PsaKdf::DeriveBytes(const MutableByteSpan & output)
337316
{
338-
psa_status_t status = psa_key_derivation_output_bytes(mDerivationOperation, output.data(), output.size());
317+
psa_status_t status = psa_key_derivation_output_bytes(&mOperation, output.data(), output.size());
339318

340319
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
341320

@@ -344,7 +323,7 @@ CHIP_ERROR PsaKdf::DeriveBytes(const MutableByteSpan & output)
344323

345324
CHIP_ERROR PsaKdf::DeriveKey(const psa_key_attributes_t & attributes, psa_key_id_t & keyId)
346325
{
347-
psa_status_t status = psa_key_derivation_output_key(&attributes, mDerivationOperation, &keyId);
326+
psa_status_t status = psa_key_derivation_output_key(&attributes, &mOperation, &keyId);
348327

349328
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
350329

‎src/crypto/CHIPCryptoPALPSA.h

+3-15
Original file line numberDiff line numberDiff line change
@@ -95,17 +95,6 @@ inline const PsaP256KeypairContext & ToConstPsaContext(const P256KeypairContext
9595
return *SafePointerCast<const PsaP256KeypairContext *>(&context);
9696
}
9797

98-
struct PsaHkdfKeyHandle
99-
{
100-
union
101-
{
102-
psa_key_id_t mKeyId;
103-
psa_key_derivation_operation_t * mKeyDerivationOp;
104-
};
105-
106-
bool mIsKeyId = true;
107-
};
108-
10998
/**
11099
* @brief Wrapper for PSA key derivation API.
111100
*/
@@ -156,11 +145,10 @@ class PsaKdf
156145
CHIP_ERROR DeriveKey(const psa_key_attributes_t & attributes, psa_key_id_t & keyId);
157146

158147
private:
159-
CHIP_ERROR InitOperation(PsaHkdfKeyHandle hkdfKey, const ByteSpan & salt, const ByteSpan & info);
148+
CHIP_ERROR InitOperation(psa_key_id_t hkdfKey, const ByteSpan & salt, const ByteSpan & info);
160149

161-
psa_key_id_t mSecretKeyId = PSA_KEY_ID_NULL;
162-
psa_key_derivation_operation_t mOperation = PSA_KEY_DERIVATION_OPERATION_INIT;
163-
psa_key_derivation_operation_t * mDerivationOperation = nullptr;
150+
psa_key_id_t mSecretKeyId = PSA_KEY_ID_NULL;
151+
psa_key_derivation_operation_t mOperation = PSA_KEY_DERIVATION_OPERATION_INIT;
164152
};
165153
} // namespace Crypto
166154
} // namespace chip

‎src/crypto/PSASessionKeystore.cpp

+3-11
Original file line numberDiff line numberDiff line change
@@ -186,18 +186,10 @@ void PSASessionKeystore::DestroyKey(Symmetric128BitsKeyHandle & key)
186186

187187
void PSASessionKeystore::DestroyKey(HkdfKeyHandle & key)
188188
{
189-
auto & keyHandle = key.AsMutable<PsaHkdfKeyHandle>();
189+
auto & keyId = key.AsMutable<psa_key_id_t>();
190190

191-
if (keyHandle.mIsKeyId)
192-
{
193-
psa_destroy_key(keyHandle.mKeyId);
194-
keyHandle.mKeyId = 0;
195-
}
196-
else
197-
{
198-
Platform::Delete(keyHandle.mKeyDerivationOp);
199-
keyHandle.mKeyDerivationOp = nullptr;
200-
}
191+
psa_destroy_key(keyId);
192+
keyId = PSA_KEY_ID_NULL;
201193
}
202194

203195
} // namespace Crypto

‎src/crypto/PSASpake2p.cpp

+46-56
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,6 @@ CHIP_ERROR PSASpake2p_P256_SHA256_HKDF_HMAC::Init(const uint8_t * context, size_
3333

3434
VerifyOrReturnError(context_len <= sizeof(mContext), CHIP_ERROR_BUFFER_TOO_SMALL);
3535

36-
psa_pake_cipher_suite_t cs = PSA_PAKE_CIPHER_SUITE_INIT;
37-
psa_pake_cs_set_algorithm(&cs, PSA_ALG_SPAKE2P);
38-
psa_pake_cs_set_primitive(&cs, PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256));
39-
psa_pake_cs_set_hash(&cs, PSA_ALG_SHA_256);
40-
41-
psa_status_t status = psa_pake_setup(&mOperation, &cs);
42-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
43-
4436
memcpy(mContext, context, context_len);
4537
mContextLen = context_len;
4638

@@ -64,33 +56,38 @@ CHIP_ERROR PSASpake2p_P256_SHA256_HKDF_HMAC::BeginVerifier(const uint8_t * my_id
6456
VerifyOrReturnError(w0in_len <= kSpake2p_WS_Length, CHIP_ERROR_INVALID_ARGUMENT);
6557
VerifyOrReturnError(Lin_len == kP256_Point_Length, CHIP_ERROR_INVALID_ARGUMENT);
6658

67-
mRole = PSA_PAKE_ROLE_SERVER;
68-
psa_status_t status = psa_pake_set_role(&mOperation, PSA_PAKE_ROLE_SERVER);
69-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
70-
71-
status = psa_pake_set_peer(&mOperation, peer_identity, peer_identity_len);
72-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
73-
74-
status = psa_pake_set_user(&mOperation, my_identity, my_identity_len);
75-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
76-
7759
uint8_t password[kSpake2p_WS_Length + kP256_Point_Length];
7860
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
61+
psa_pake_cipher_suite_t cp = PSA_PAKE_CIPHER_SUITE_INIT;
62+
63+
psa_pake_cs_set_algorithm(&cp, PSA_ALG_SPAKE2P_MATTER);
64+
psa_pake_cs_set_primitive(&cp, PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256));
7965

8066
memcpy(password + 0, w0in, w0in_len);
8167
memcpy(password + w0in_len, Lin, Lin_len);
8268
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DERIVE);
83-
psa_set_key_algorithm(&attributes, PSA_ALG_SPAKE2P);
84-
psa_set_key_type(&attributes, PSA_KEY_TYPE_PASSWORD);
69+
psa_set_key_algorithm(&attributes, PSA_ALG_SPAKE2P_MATTER);
70+
psa_set_key_type(&attributes, PSA_KEY_TYPE_SPAKE2P_PUBLIC_KEY(PSA_ECC_FAMILY_SECP_R1));
71+
72+
psa_status_t status = psa_import_key(&attributes, password, w0in_len + Lin_len, &mKey);
8573

86-
status = psa_import_key(&attributes, password, w0in_len + Lin_len, &mKey);
8774
psa_reset_key_attributes(&attributes);
8875
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
8976

90-
status = psa_pake_set_password_key(&mOperation, mKey);
77+
status = psa_pake_setup(&mOperation, mKey, &cp);
78+
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
79+
80+
mRole = PSA_PAKE_ROLE_SERVER;
81+
status = psa_pake_set_role(&mOperation, PSA_PAKE_ROLE_SERVER);
9182
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
9283

93-
status = psa_pake_input(&mOperation, PSA_PAKE_STEP_CONTEXT, mContext, mContextLen);
84+
status = psa_pake_set_peer(&mOperation, peer_identity, peer_identity_len);
85+
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
86+
87+
status = psa_pake_set_user(&mOperation, my_identity, my_identity_len);
88+
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
89+
90+
status = psa_pake_set_context(&mOperation, mContext, mContextLen);
9491
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
9592

9693
return CHIP_NO_ERROR;
@@ -104,33 +101,38 @@ CHIP_ERROR PSASpake2p_P256_SHA256_HKDF_HMAC::BeginProver(const uint8_t * my_iden
104101
VerifyOrReturnError(w0in_len <= kSpake2p_WS_Length, CHIP_ERROR_INVALID_ARGUMENT);
105102
VerifyOrReturnError(w1in_len <= kSpake2p_WS_Length, CHIP_ERROR_INVALID_ARGUMENT);
106103

107-
mRole = PSA_PAKE_ROLE_CLIENT;
108-
psa_status_t status = psa_pake_set_role(&mOperation, PSA_PAKE_ROLE_CLIENT);
109-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
110-
111-
status = psa_pake_set_user(&mOperation, my_identity, my_identity_len);
112-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
113-
114-
status = psa_pake_set_peer(&mOperation, peer_identity, peer_identity_len);
115-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
116-
117104
uint8_t password[kSpake2p_WS_Length * 2];
118105
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
106+
psa_pake_cipher_suite_t cp = PSA_PAKE_CIPHER_SUITE_INIT;
107+
108+
psa_pake_cs_set_algorithm(&cp, PSA_ALG_SPAKE2P_MATTER);
109+
psa_pake_cs_set_primitive(&cp, PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256));
119110

120111
memcpy(password + 0, w0in, w0in_len);
121112
memcpy(password + w0in_len, w1in, w1in_len);
122113
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DERIVE);
123-
psa_set_key_algorithm(&attributes, PSA_ALG_SPAKE2P);
124-
psa_set_key_type(&attributes, PSA_KEY_TYPE_PASSWORD);
114+
psa_set_key_algorithm(&attributes, PSA_ALG_SPAKE2P_MATTER);
115+
psa_set_key_type(&attributes, PSA_KEY_TYPE_SPAKE2P_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1));
116+
117+
psa_status_t status = psa_import_key(&attributes, password, w0in_len + w1in_len, &mKey);
125118

126-
status = psa_import_key(&attributes, password, w0in_len + w1in_len, &mKey);
127119
psa_reset_key_attributes(&attributes);
128120
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
129121

130-
status = psa_pake_set_password_key(&mOperation, mKey);
122+
status = psa_pake_setup(&mOperation, mKey, &cp);
123+
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
124+
125+
mRole = PSA_PAKE_ROLE_CLIENT;
126+
status = psa_pake_set_role(&mOperation, PSA_PAKE_ROLE_CLIENT);
131127
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
132128

133-
status = psa_pake_input(&mOperation, PSA_PAKE_STEP_CONTEXT, mContext, mContextLen);
129+
status = psa_pake_set_user(&mOperation, my_identity, my_identity_len);
130+
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
131+
132+
status = psa_pake_set_peer(&mOperation, peer_identity, peer_identity_len);
133+
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
134+
135+
status = psa_pake_set_context(&mOperation, mContext, mContextLen);
134136
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
135137

136138
return CHIP_NO_ERROR;
@@ -182,29 +184,17 @@ CHIP_ERROR PSASpake2p_P256_SHA256_HKDF_HMAC::KeyConfirm(const uint8_t * in, size
182184

183185
CHIP_ERROR PSASpake2p_P256_SHA256_HKDF_HMAC::GetKeys(SessionKeystore & keystore, HkdfKeyHandle & key)
184186
{
185-
/*
186-
* TODO: use psa_pake_shared_secret() proposed in https://github.com/ARM-software/psa-api/issues/86
187-
*/
188-
189-
psa_key_derivation_operation_t * kdf = Platform::New<psa_key_derivation_operation_t>();
190-
Platform::UniquePtr<psa_key_derivation_operation_t> kdfPtr(kdf);
191-
192-
VerifyOrReturnError(kdfPtr, CHIP_ERROR_NO_MEMORY);
187+
auto & keyId = key.AsMutable<psa_key_id_t>();
193188

194-
*kdfPtr = PSA_KEY_DERIVATION_OPERATION_INIT;
189+
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
195190

196-
psa_status_t status = psa_key_derivation_setup(kdfPtr.get(), PSA_ALG_HKDF(PSA_ALG_SHA_256));
197-
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
191+
psa_set_key_type(&attributes, PSA_KEY_TYPE_DERIVE);
192+
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DERIVE);
193+
psa_set_key_algorithm(&attributes, PSA_ALG_HKDF(PSA_ALG_SHA_256));
198194

199-
status = psa_pake_get_implicit_key(&mOperation, kdfPtr.get());
195+
psa_status_t status = psa_pake_get_shared_key(&mOperation, &attributes, &keyId);
200196
VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
201197

202-
auto & hkdfKeyHandle = key.AsMutable<PsaHkdfKeyHandle>();
203-
hkdfKeyHandle.mKeyDerivationOp = kdfPtr.get();
204-
hkdfKeyHandle.mIsKeyId = false;
205-
206-
kdfPtr.release();
207-
208198
return CHIP_NO_ERROR;
209199
}
210200

‎src/platform/nrfconnect/CHIPPlatformConfig.h

+1-2
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,7 @@
4040

4141
#ifdef CONFIG_CHIP_CRYPTO_PSA
4242
#define CHIP_CONFIG_SHA256_CONTEXT_SIZE sizeof(psa_hash_operation_t)
43-
// Alignment to sizeof(PsaHkdfKeyHandle) from crypto/CHIPCryptoPALPSA.h.
44-
#define CHIP_CONFIG_HKDF_KEY_HANDLE_CONTEXT_SIZE (sizeof(psa_key_id_t) + sizeof(bool))
43+
#define CHIP_CONFIG_HKDF_KEY_HANDLE_CONTEXT_SIZE sizeof(psa_key_id_t)
4544
#elif defined(CONFIG_CC3XX_BACKEND)
4645
// Size of the statically allocated context for SHA256 operations in CryptoPAL
4746
// determined empirically.

0 commit comments

Comments
 (0)