Skip to content

Commit d5a7ffe

Browse files
maciejbaczmanskimaciejbaczmanski
committedAug 8, 2024
WIP
1 parent 450d9f0 commit d5a7ffe

File tree

7 files changed

+130
-51
lines changed

7 files changed

+130
-51
lines changed
 

‎src/app/clusters/icd-management-server/icd-management-server.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -312,7 +312,7 @@ Status ICDManagementServer::RegisterClient(CommandHandler * commandObj, const Co
312312
entry.DeleteKey();
313313
}
314314

315-
err = entry.SetKey(key);
315+
err = entry.SetKey(key, true);
316316
VerifyOrReturnError(CHIP_ERROR_INVALID_ARGUMENT != err, Status::ConstraintError);
317317
VerifyOrReturnError(CHIP_NO_ERROR == err, Status::Failure);
318318
err = table.Set(entry.index, entry);

‎src/app/icd/server/ICDMonitoringTable.cpp

+29-6
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@
1919

2020
#include <crypto/RandUtils.h>
2121

22+
#ifdef CONFIG_CHIP_CRYPTO_PSA
23+
#include <crypto/CHIPCryptoPALPSA.h>
24+
#endif
25+
2226
namespace chip {
2327

2428
enum class Fields : uint8_t
@@ -131,7 +135,7 @@ void ICDMonitoringEntry::Clear()
131135
this->clientType = app::Clusters::IcdManagement::ClientTypeEnum::kPermanent;
132136
}
133137

134-
CHIP_ERROR ICDMonitoringEntry::SetKey(ByteSpan keyData)
138+
CHIP_ERROR ICDMonitoringEntry::SetKey(ByteSpan keyData, bool persistent)
135139
{
136140
VerifyOrReturnError(keyData.size() == sizeof(Crypto::Symmetric128BitsKeyByteArray), CHIP_ERROR_INVALID_ARGUMENT);
137141
VerifyOrReturnError(symmetricKeystore != nullptr, CHIP_ERROR_INTERNAL);
@@ -140,7 +144,20 @@ CHIP_ERROR ICDMonitoringEntry::SetKey(ByteSpan keyData)
140144
Crypto::Symmetric128BitsKeyByteArray keyMaterial;
141145
memcpy(keyMaterial, keyData.data(), sizeof(Crypto::Symmetric128BitsKeyByteArray));
142146

143-
// TODO - Add function to set PSA key lifetime
147+
#ifdef CONFIG_CHIP_CRYPTO_PSA
148+
if (persistent)
149+
{
150+
ReturnErrorOnFailure(Crypto::FindFreeKeySlotInRange(aesKeyHandle.AsMutable<psa_key_id_t>(),
151+
to_underlying(Crypto::KeyIdBase::ICDAesKeyRangeStart),
152+
Crypto::kMaxICDClientKeys));
153+
ReturnErrorOnFailure(Crypto::FindFreeKeySlotInRange(hmacKeyHandle.AsMutable<psa_key_id_t>(),
154+
to_underlying(Crypto::KeyIdBase::ICDHmacKeyRangeStart),
155+
Crypto::kMaxICDClientKeys));
156+
}
157+
#else
158+
IgnoreUnusedVariable(persistent);
159+
#endif // CONFIG_CHIP_CRYPTO_PSA
160+
144161
ReturnErrorOnFailure(symmetricKeystore->CreateKey(keyMaterial, aesKeyHandle));
145162
CHIP_ERROR error = symmetricKeystore->CreateKey(keyMaterial, hmacKeyHandle);
146163

@@ -242,15 +259,21 @@ CHIP_ERROR ICDMonitoringTable::Get(uint16_t index, ICDMonitoringEntry & entry) c
242259

243260
CHIP_ERROR ICDMonitoringTable::Find(NodeId id, ICDMonitoringEntry & entry)
244261
{
245-
uint16_t index = 0;
246-
while (index < this->Limit())
262+
CHIP_ERROR err;
263+
uint16_t index;
264+
ICDMonitoringEntry tempEntry(mSymmetricKeystore);
265+
266+
for (index = 0; index < this->Limit(); index++)
247267
{
248-
ReturnErrorOnFailure(this->Get(index++, entry));
249-
if (id == entry.checkInNodeID)
268+
SuccessOrExit(err = this->Get(index, tempEntry));
269+
if (id == tempEntry.checkInNodeID)
250270
{
271+
entry = tempEntry;
251272
return CHIP_NO_ERROR;
252273
}
253274
}
275+
276+
exit:
254277
entry.index = index;
255278
return CHIP_ERROR_NOT_FOUND;
256279
}

‎src/app/icd/server/ICDMonitoringTable.h

+3-2
Original file line numberDiff line numberDiff line change
@@ -69,13 +69,14 @@ struct ICDMonitoringEntry : public PersistentData<kICDMonitoringBufferSize>
6969
* A new entry object should be used for each key when adding entries to the ICDMonitoring
7070
* table.
7171
*
72-
* @param keyData A byte span containing the raw key
72+
* @param keyData A byte span containing the raw key
73+
* @param persistent Persistence of the key to be set (optional, needed only when setting persistent key with PSA Crypto API)
7374
* @return CHIP_ERROR CHIP_NO_ERROR success
7475
* CHIP_ERROR_INVALID_ARGUMENT wrong size of the raw key
7576
* CHIP_ERROR_INTERNAL No KeyStore for the entry or Key Handle already present
7677
* CHIP_ERROR_XXX Crypto API related failure
7778
*/
78-
CHIP_ERROR SetKey(ByteSpan keyData);
79+
CHIP_ERROR SetKey(ByteSpan keyData, bool persistent = false);
7980
CHIP_ERROR DeleteKey(void);
8081
inline bool IsValid()
8182
{

‎src/crypto/BUILD.gn

+1
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ source_set("public_headers") {
7171
"${chip_root}/src/lib/core",
7272
"${chip_root}/src/lib/core:types",
7373
"${chip_root}/src/lib/support",
74+
"${chip_root}/src/app/icd/server:icd-server-config",
7475
"${nlassert_root}:nlassert",
7576
]
7677
}

‎src/crypto/CHIPCryptoPALPSA.cpp

+22
Original file line numberDiff line numberDiff line change
@@ -263,6 +263,28 @@ void Hash_SHA256_stream::Clear()
263263
psa_hash_abort(toHashOperation(&mContext));
264264
}
265265

266+
CHIP_ERROR FindFreeKeySlotInRange(psa_key_id_t & keyId, psa_key_id_t start, uint32_t range)
267+
{
268+
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
269+
psa_key_id_t end = start + range;
270+
271+
VerifyOrReturnError(start >= PSA_KEY_ID_USER_MIN && end - 1 <= PSA_KEY_ID_USER_MAX, CHIP_ERROR_INVALID_ARGUMENT);
272+
273+
for(keyId = start; keyId < end; keyId++)
274+
{
275+
psa_status_t status = psa_get_key_attributes(keyId, &attributes);
276+
if (status == PSA_ERROR_INVALID_HANDLE)
277+
{
278+
return CHIP_NO_ERROR;
279+
}
280+
else if (status != PSA_SUCCESS)
281+
{
282+
return CHIP_ERROR_INTERNAL;
283+
}
284+
}
285+
return CHIP_ERROR_NOT_FOUND;
286+
}
287+
266288
CHIP_ERROR PsaKdf::Init(const ByteSpan & secret, const ByteSpan & salt, const ByteSpan & info)
267289
{
268290
psa_status_t status = PSA_SUCCESS;

‎src/crypto/CHIPCryptoPALPSA.h

+32-3
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
#pragma once
2828

2929
#include "CHIPCryptoPAL.h"
30+
#include <app/icd/server/ICDServerConfig.h>
3031
#include <lib/core/DataModelTypes.h>
3132
#include <lib/support/SafePointerCast.h>
3233

@@ -55,19 +56,47 @@ namespace Crypto {
5556
#define CHIP_CONFIG_CRYPTO_PSA_KEY_ID_BASE 0x30000
5657
#endif // CHIP_CONFIG_CRYPTO_PSA_KEY_ID_BASE
5758

59+
#if CHIP_CONFIG_ENABLE_ICD_SERVER
60+
static constexpr uint32_t kMaxICDClientKeys = CHIP_CONFIG_ICD_CLIENTS_SUPPORTED_PER_FABRIC * CHIP_CONFIG_MAX_FABRICS;
61+
#endif // CONFIG_ENABLE_ICD_SERVER
62+
5863
/**
5964
* @brief Defines subranges of the PSA key identifier space used by Matter.
6065
*/
6166
enum class KeyIdBase : psa_key_id_t
6267
{
63-
Minimum = CHIP_CONFIG_CRYPTO_PSA_KEY_ID_BASE,
64-
Operational = Minimum, ///< Base of the PSA key ID range for Node Operational Certificate private keys
65-
Maximum = Operational + kMaxValidFabricIndex,
68+
Minimum = CHIP_CONFIG_CRYPTO_PSA_KEY_ID_BASE,
69+
Operational = Minimum, ///< Base of the PSA key ID range for Node Operational Certificate private keys
70+
DACPrivKey = Operational + kMaxValidFabricIndex + 1,
71+
#if CHIP_CONFIG_ENABLE_ICD_SERVER
72+
ICDHmacKeyRangeStart = DACPrivKey + 1,
73+
ICDAesKeyRangeStart = ICDHmacKeyRangeStart + kMaxICDClientKeys,
74+
ICDKeysRangeEnd = ICDAesKeyRangeStart + kMaxICDClientKeys,
75+
#else
76+
// If ICD server is disabled, set ICDKeysRangeEnd to previous key, to allow setting next key ID to `ICDKeysRangeEnd + 1`
77+
ICDKeysRangeEnd = DACPrivKey,
78+
#endif // CHIP_CONFIG_ENABLE_ICD_SERVER
79+
Maximum = ICDKeysRangeEnd,
6680
};
6781

6882
static_assert(to_underlying(KeyIdBase::Minimum) >= PSA_KEY_ID_USER_MIN && to_underlying(KeyIdBase::Maximum) <= PSA_KEY_ID_USER_MAX,
6983
"PSA key ID base out of allowed range");
7084

85+
86+
/**
87+
* @brief Finds first free persistent Key slot ID within range.
88+
*
89+
* @param[out] keyId Key ID handler to which free ID will be set.
90+
* @param[in] start Starting ID in search range.
91+
* @param[in] range Search range.
92+
*
93+
* @retval CHIP_NO_ERROR On success.
94+
* @retval CHIP_ERROR_INTERNAL On PSA crypto API error.
95+
* @retval CHIP_ERROR_NOT_FOUND On no free Key ID within range.
96+
* @retval CHIP_ERROR_INVALID_ARGUMENT On search arguments out of PSA allowed range.
97+
*/
98+
CHIP_ERROR FindFreeKeySlotInRange(psa_key_id_t & keyId, psa_key_id_t start, uint32_t range);
99+
71100
/**
72101
* @brief Calculates PSA key ID for Node Operational Certificate private key for the given fabric.
73102
*/

‎src/crypto/PSASessionKeystore.cpp

+42-39
Original file line numberDiff line numberDiff line change
@@ -24,62 +24,65 @@ namespace Crypto {
2424

2525
namespace {
2626

27-
class AesKeyAttributes
27+
class keyAttributesBase
2828
{
2929
public:
30-
AesKeyAttributes()
30+
keyAttributesBase(psa_key_id_t keyId, psa_key_type_t type, psa_algorithm_t algorithm,
31+
psa_key_usage_t usageFlags, size_t bits)
3132
{
32-
constexpr psa_algorithm_t kAlgorithm = PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(PSA_ALG_CCM, 8);
33-
34-
psa_set_key_type(&mAttrs, PSA_KEY_TYPE_AES);
35-
psa_set_key_algorithm(&mAttrs, kAlgorithm);
36-
psa_set_key_usage_flags(&mAttrs, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT);
37-
psa_set_key_bits(&mAttrs, CHIP_CRYPTO_SYMMETRIC_KEY_LENGTH_BYTES * 8);
33+
psa_set_key_type(&mAttrs, type);
34+
psa_set_key_algorithm(&mAttrs, algorithm);
35+
psa_set_key_usage_flags(&mAttrs, usageFlags);
36+
psa_set_key_bits(&mAttrs, bits);
37+
if (to_underlying(KeyIdBase::Maximum) >= keyId && keyId >= to_underlying(KeyIdBase::Minimum))
38+
{
39+
psa_set_key_lifetime(&mAttrs, PSA_KEY_LIFETIME_PERSISTENT);
40+
psa_set_key_id(&mAttrs, keyId);
41+
}
3842
}
3943

40-
~AesKeyAttributes() { psa_reset_key_attributes(&mAttrs); }
44+
~keyAttributesBase() { psa_reset_key_attributes(&mAttrs); }
4145

4246
const psa_key_attributes_t & Get() { return mAttrs; }
4347

4448
private:
4549
psa_key_attributes_t mAttrs = PSA_KEY_ATTRIBUTES_INIT;
4650
};
4751

48-
class HmacKeyAttributes
52+
class AesKeyAttributes : public keyAttributesBase
4953
{
5054
public:
51-
HmacKeyAttributes()
52-
{
53-
psa_set_key_type(&mAttrs, PSA_KEY_TYPE_HMAC);
54-
psa_set_key_algorithm(&mAttrs, PSA_ALG_HMAC(PSA_ALG_SHA_256));
55-
psa_set_key_usage_flags(&mAttrs, PSA_KEY_USAGE_SIGN_MESSAGE);
56-
psa_set_key_bits(&mAttrs, CHIP_CRYPTO_SYMMETRIC_KEY_LENGTH_BYTES * 8);
57-
}
58-
59-
~HmacKeyAttributes() { psa_reset_key_attributes(&mAttrs); }
60-
61-
const psa_key_attributes_t & Get() { return mAttrs; }
62-
63-
private:
64-
psa_key_attributes_t mAttrs = PSA_KEY_ATTRIBUTES_INIT;
55+
AesKeyAttributes(psa_key_id_t keyId = 0)
56+
: keyAttributesBase(keyId,
57+
PSA_KEY_TYPE_AES,
58+
PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(PSA_ALG_CCM, 8),
59+
PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT,
60+
CHIP_CRYPTO_SYMMETRIC_KEY_LENGTH_BYTES * 8)
61+
{}
6562
};
6663

67-
class HkdfKeyAttributes
64+
class HmacKeyAttributes : public keyAttributesBase
6865
{
6966
public:
70-
HkdfKeyAttributes()
71-
{
72-
psa_set_key_type(&mAttrs, PSA_KEY_TYPE_DERIVE);
73-
psa_set_key_algorithm(&mAttrs, PSA_ALG_HKDF(PSA_ALG_SHA_256));
74-
psa_set_key_usage_flags(&mAttrs, PSA_KEY_USAGE_DERIVE);
75-
}
76-
77-
~HkdfKeyAttributes() { psa_reset_key_attributes(&mAttrs); }
78-
79-
const psa_key_attributes_t & Get() { return mAttrs; }
67+
HmacKeyAttributes(psa_key_id_t keyId = 0)
68+
: keyAttributesBase(keyId,
69+
PSA_KEY_TYPE_HMAC,
70+
PSA_ALG_HMAC(PSA_ALG_SHA_256),
71+
PSA_KEY_USAGE_SIGN_MESSAGE,
72+
CHIP_CRYPTO_SYMMETRIC_KEY_LENGTH_BYTES * 8)
73+
{}
74+
};
8075

81-
private:
82-
psa_key_attributes_t mAttrs = PSA_KEY_ATTRIBUTES_INIT;
76+
class HkdfKeyAttributes : public keyAttributesBase
77+
{
78+
public:
79+
HkdfKeyAttributes(psa_key_id_t keyId = 0)
80+
: keyAttributesBase(keyId,
81+
PSA_KEY_TYPE_DERIVE,
82+
PSA_ALG_HKDF(PSA_ALG_SHA_256),
83+
PSA_KEY_USAGE_DERIVE,
84+
0)
85+
{}
8386
};
8487

8588
} // namespace
@@ -89,7 +92,7 @@ CHIP_ERROR PSASessionKeystore::CreateKey(const Symmetric128BitsKeyByteArray & ke
8992
// Destroy the old key if already allocated
9093
psa_destroy_key(key.As<psa_key_id_t>());
9194

92-
AesKeyAttributes attrs;
95+
AesKeyAttributes attrs(key.As<psa_key_id_t>());
9396
psa_status_t status =
9497
psa_import_key(&attrs.Get(), keyMaterial, sizeof(Symmetric128BitsKeyByteArray), &key.AsMutable<psa_key_id_t>());
9598
LogPsaError(status);
@@ -103,7 +106,7 @@ CHIP_ERROR PSASessionKeystore::CreateKey(const Symmetric128BitsKeyByteArray & ke
103106
// Destroy the old key if already allocated
104107
psa_destroy_key(key.As<psa_key_id_t>());
105108

106-
HmacKeyAttributes attrs;
109+
HmacKeyAttributes attrs(key.As<psa_key_id_t>());
107110
psa_status_t status =
108111
psa_import_key(&attrs.Get(), keyMaterial, sizeof(Symmetric128BitsKeyByteArray), &key.AsMutable<psa_key_id_t>());
109112
LogPsaError(status);

0 commit comments

Comments
 (0)