Skip to content

Commit 221e466

Browse files
yunhanw-googlemkardous-silabsrestyled-commits
authored
[ICD]add hmac support in icd client storage (#30939)
* add hmac support in icd client storage * address comment * address comments * add missing change * Update examples/chip-tool/commands/icd/ICDCommand.cpp Co-authored-by: mkardous-silabs <84793247+mkardous-silabs@users.noreply.github.com> * Update src/app/icd/client/DefaultICDClientStorage.cpp Co-authored-by: mkardous-silabs <84793247+mkardous-silabs@users.noreply.github.com> * Restyled by clang-format --------- Co-authored-by: mkardous-silabs <84793247+mkardous-silabs@users.noreply.github.com> Co-authored-by: Restyled.io <commits@restyled.io>
1 parent 73b8588 commit 221e466

File tree

6 files changed

+51
-23
lines changed

6 files changed

+51
-23
lines changed

‎examples/chip-tool/commands/icd/ICDCommand.cpp

+8-5
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ CHIP_ERROR ICDListCommand::RunCommand()
2727
{
2828
app::ICDClientInfo info;
2929
auto iter = CHIPCommand::sICDClientStorage.IterateICDClientInfo();
30-
char icdSymmetricKeyHex[Crypto::kAES_CCM128_Key_Length * 2 + 1];
31-
30+
char icdAesKeyHex[Crypto::kAES_CCM128_Key_Length * 2 + 1];
31+
char icdHmacKeyHex[Crypto::kHMAC_CCM128_Key_Length * 2 + 1];
3232
fprintf(stderr, " +-----------------------------------------------------------------------------+\n");
3333
fprintf(stderr, " | %-75s |\n", "Known ICDs:");
3434
fprintf(stderr, " +-----------------------------------------------------------------------------+\n");
@@ -45,9 +45,12 @@ CHIP_ERROR ICDListCommand::RunCommand()
4545
static_assert(std::is_same<decltype(CHIPCommand::sSessionKeystore), Crypto::RawKeySessionKeystore>::value,
4646
"The following BytesToHex can copy/encode the key bytes from sharedKey to hexadecimal format, which only "
4747
"works for RawKeySessionKeystore");
48-
Encoding::BytesToHex(info.shared_key.As<Crypto::Symmetric128BitsKeyByteArray>(), Crypto::kAES_CCM128_Key_Length,
49-
icdSymmetricKeyHex, sizeof(icdSymmetricKeyHex), chip::Encoding::HexFlags::kNullTerminate);
50-
fprintf(stderr, " | Symmetric Key: %60s |\n", icdSymmetricKeyHex);
48+
Encoding::BytesToHex(info.aes_key_handle.As<Crypto::Symmetric128BitsKeyByteArray>(), Crypto::kAES_CCM128_Key_Length,
49+
icdAesKeyHex, sizeof(icdAesKeyHex), chip::Encoding::HexFlags::kNullTerminate);
50+
fprintf(stderr, " | aes key: %60s |\n", icdAesKeyHex);
51+
Encoding::BytesToHex(info.hmac_key_handle.As<Crypto::Symmetric128BitsKeyByteArray>(), Crypto::kHMAC_CCM128_Key_Length,
52+
icdHmacKeyHex, sizeof(icdHmacKeyHex), chip::Encoding::HexFlags::kNullTerminate);
53+
fprintf(stderr, " | hmac key: %60s |\n", icdHmacKeyHex);
5154
}
5255

5356
fprintf(stderr, " +-----------------------------------------------------------------------------+\n");

‎src/app/icd/client/DefaultICDClientStorage.cpp

+29-10
Original file line numberDiff line numberDiff line change
@@ -258,13 +258,22 @@ CHIP_ERROR DefaultICDClientStorage::Load(FabricIndex fabricIndex, std::vector<IC
258258
ReturnErrorOnFailure(reader.Next(TLV::ContextTag(ClientInfoTag::kMonitoredSubject)));
259259
ReturnErrorOnFailure(reader.Get(clientInfo.monitored_subject));
260260

261-
// Shared key
262-
ReturnErrorOnFailure(reader.Next(TLV::ContextTag(ClientInfoTag::kSharedKey)));
263-
ByteSpan buf;
264-
ReturnErrorOnFailure(reader.Get(buf));
265-
VerifyOrReturnError(buf.size() == sizeof(Crypto::Symmetric128BitsKeyByteArray), CHIP_ERROR_INTERNAL);
266-
memcpy(clientInfo.shared_key.AsMutable<Crypto::Symmetric128BitsKeyByteArray>(), buf.data(),
261+
// Aes key handle
262+
ReturnErrorOnFailure(reader.Next(TLV::ContextTag(ClientInfoTag::kAesKeyHandle)));
263+
ByteSpan aesBuf;
264+
ReturnErrorOnFailure(reader.Get(aesBuf));
265+
VerifyOrReturnError(aesBuf.size() == sizeof(Crypto::Symmetric128BitsKeyByteArray), CHIP_ERROR_INTERNAL);
266+
memcpy(clientInfo.aes_key_handle.AsMutable<Crypto::Symmetric128BitsKeyByteArray>(), aesBuf.data(),
267267
sizeof(Crypto::Symmetric128BitsKeyByteArray));
268+
269+
// Hmac key handle
270+
ReturnErrorOnFailure(reader.Next(TLV::ContextTag(ClientInfoTag::kHmacKeyHandle)));
271+
ByteSpan hmacBuf;
272+
ReturnErrorOnFailure(reader.Get(hmacBuf));
273+
VerifyOrReturnError(hmacBuf.size() == sizeof(Crypto::Symmetric128BitsKeyByteArray), CHIP_ERROR_INTERNAL);
274+
memcpy(clientInfo.hmac_key_handle.AsMutable<Crypto::Symmetric128BitsKeyByteArray>(), hmacBuf.data(),
275+
sizeof(Crypto::Symmetric128BitsKeyByteArray));
276+
268277
ReturnErrorOnFailure(reader.ExitContainer(ICDClientInfoType));
269278
clientInfoVector.push_back(clientInfo);
270279
}
@@ -285,12 +294,20 @@ CHIP_ERROR DefaultICDClientStorage::SetKey(ICDClientInfo & clientInfo, const Byt
285294
Crypto::Symmetric128BitsKeyByteArray keyMaterial;
286295
memcpy(keyMaterial, keyData.data(), sizeof(Crypto::Symmetric128BitsKeyByteArray));
287296

288-
return mpKeyStore->CreateKey(keyMaterial, clientInfo.shared_key);
297+
// TODO : Update key lifetime once creaKey method supports it.
298+
ReturnErrorOnFailure(mpKeyStore->CreateKey(keyMaterial, clientInfo.aes_key_handle));
299+
CHIP_ERROR err = mpKeyStore->CreateKey(keyMaterial, clientInfo.hmac_key_handle);
300+
if (err != CHIP_NO_ERROR)
301+
{
302+
mpKeyStore->DestroyKey(clientInfo.aes_key_handle);
303+
}
304+
return err;
289305
}
290306

291307
void DefaultICDClientStorage::RemoveKey(ICDClientInfo & clientInfo)
292308
{
293-
mpKeyStore->DestroyKey(clientInfo.shared_key);
309+
mpKeyStore->DestroyKey(clientInfo.aes_key_handle);
310+
mpKeyStore->DestroyKey(clientInfo.hmac_key_handle);
294311
}
295312

296313
CHIP_ERROR DefaultICDClientStorage::SerializeToTlv(TLV::TLVWriter & writer, const std::vector<ICDClientInfo> & clientInfoVector)
@@ -306,8 +323,10 @@ CHIP_ERROR DefaultICDClientStorage::SerializeToTlv(TLV::TLVWriter & writer, cons
306323
ReturnErrorOnFailure(writer.Put(TLV::ContextTag(ClientInfoTag::kStartICDCounter), clientInfo.start_icd_counter));
307324
ReturnErrorOnFailure(writer.Put(TLV::ContextTag(ClientInfoTag::kOffset), clientInfo.offset));
308325
ReturnErrorOnFailure(writer.Put(TLV::ContextTag(ClientInfoTag::kMonitoredSubject), clientInfo.monitored_subject));
309-
ByteSpan buf(clientInfo.shared_key.As<Crypto::Symmetric128BitsKeyByteArray>());
310-
ReturnErrorOnFailure(writer.Put(TLV::ContextTag(ClientInfoTag::kSharedKey), buf));
326+
ByteSpan aesBuf(clientInfo.aes_key_handle.As<Crypto::Symmetric128BitsKeyByteArray>());
327+
ReturnErrorOnFailure(writer.Put(TLV::ContextTag(ClientInfoTag::kAesKeyHandle), aesBuf));
328+
ByteSpan hmacBuf(clientInfo.hmac_key_handle.As<Crypto::Symmetric128BitsKeyByteArray>());
329+
ReturnErrorOnFailure(writer.Put(TLV::ContextTag(ClientInfoTag::kHmacKeyHandle), hmacBuf));
311330
ReturnErrorOnFailure(writer.EndContainer(ICDClientInfoContainerType));
312331
}
313332
return writer.EndContainer(arrayType);

‎src/app/icd/client/DefaultICDClientStorage.h

+2-1
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,8 @@ class DefaultICDClientStorage : public ICDClientStorage
9191
kStartICDCounter = 3,
9292
kOffset = 4,
9393
kMonitoredSubject = 5,
94-
kSharedKey = 6
94+
kAesKeyHandle = 6,
95+
kHmacKeyHandle = 7,
9596
};
9697

9798
enum class CounterTag : uint8_t

‎src/app/icd/client/ICDClientInfo.h

+10-6
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,11 @@ namespace app {
3030
struct ICDClientInfo
3131
{
3232
ScopedNodeId peer_node;
33-
uint32_t start_icd_counter = 0;
34-
uint32_t offset = 0;
35-
uint64_t monitored_subject = static_cast<uint64_t>(0);
36-
Crypto::Aes128KeyHandle shared_key = Crypto::Aes128KeyHandle();
33+
uint32_t start_icd_counter = 0;
34+
uint32_t offset = 0;
35+
uint64_t monitored_subject = static_cast<uint64_t>(0);
36+
Crypto::Aes128KeyHandle aes_key_handle = Crypto::Aes128KeyHandle();
37+
Crypto::Hmac128KeyHandle hmac_key_handle = Crypto::Hmac128KeyHandle();
3738

3839
ICDClientInfo() {}
3940
ICDClientInfo(const ICDClientInfo & other) { *this = other; }
@@ -44,8 +45,11 @@ struct ICDClientInfo
4445
start_icd_counter = other.start_icd_counter;
4546
offset = other.offset;
4647
monitored_subject = other.monitored_subject;
47-
ByteSpan buf(other.shared_key.As<Crypto::Symmetric128BitsKeyByteArray>());
48-
memcpy(shared_key.AsMutable<Crypto::Symmetric128BitsKeyByteArray>(), buf.data(),
48+
ByteSpan aes_buf(other.aes_key_handle.As<Crypto::Symmetric128BitsKeyByteArray>());
49+
memcpy(aes_key_handle.AsMutable<Crypto::Symmetric128BitsKeyByteArray>(), aes_buf.data(),
50+
sizeof(Crypto::Symmetric128BitsKeyByteArray));
51+
ByteSpan hmac_buf(other.hmac_key_handle.As<Crypto::Symmetric128BitsKeyByteArray>());
52+
memcpy(hmac_key_handle.AsMutable<Crypto::Symmetric128BitsKeyByteArray>(), hmac_buf.data(),
4953
sizeof(Crypto::Symmetric128BitsKeyByteArray));
5054
return *this;
5155
}

‎src/app/icd/client/ICDClientStorage.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ class ICDClientStorage
5050

5151
/**
5252
* Called during ICD device registration in commissioning, commissioner/controller
53-
* provides raw key data, the shared key handle in clientInfo is updated based upon raw key data
53+
* provides raw key data, the shared aes key handle and hmac key handle in clientInfo are updated based upon raw key data
5454
*
5555
* @param[inout] clientInfo the ICD Client information to be updated with keyData and be saved
5656
* @param[in] aKeyData raw key data provided by application

‎src/crypto/CHIPCryptoPAL.h

+1
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ inline constexpr size_t kAES_CCM128_Key_Length = 128u / 8u;
9292
inline constexpr size_t kAES_CCM128_Block_Length = kAES_CCM128_Key_Length;
9393
inline constexpr size_t kAES_CCM128_Nonce_Length = 13;
9494
inline constexpr size_t kAES_CCM128_Tag_Length = 16;
95+
inline constexpr size_t kHMAC_CCM128_Key_Length = 128u / 8u;
9596

9697
inline constexpr size_t CHIP_CRYPTO_AEAD_NONCE_LENGTH_BYTES = kAES_CCM128_Nonce_Length;
9798

0 commit comments

Comments
 (0)