Merge pull request #1136 from 00xc/attest/zeroizing

kernel: zeroize more secrets

Author: stefano-garzarella

.cargo/config.toml

@@ -4,6 +4,7 @@
 rustflags = [
 	"-C", "force-frame-pointers",
 	"--cfg", "aes_force_soft",
+	"--cfg", 'aes_backend="soft"',
 	"--cfg", "polyval_force_soft",
 ]
 

Cargo.lock

@@ -68,7 +68,7 @@ release = { path = "release" }
 
 # crates.io
 aes-gcm = { version = "0.10.3", default-features = false }
-aes-kw = { version = "0.2.1", default-features = false }
+aes-kw = { version = "0.3.1", default-features = false }
 arbitrary = "1.3.0"
 base64 = { version = "0.22.1", default-features = false }
 bindgen = {version = "0.71.0", default-features = false }

Cargo.toml

@@ -20,8 +20,8 @@ libaproxy = { workspace = true, optional = true }
 elf.workspace = true
 syscall.workspace = true
 
-aes-gcm = { workspace = true, features = ["aes", "alloc"] }
-aes-kw = { workspace = true, optional = true }
+aes-gcm = { workspace = true, features = ["aes", "alloc", "zeroize"] }
+aes-kw = { workspace = true, features = ["zeroize"], optional = true }
 bitfield-struct.workspace = true
 bitflags.workspace = true
 cocoon-tpm-crypto = { workspace = true, features = [

kernel/Cargo.toml

@@ -18,7 +18,7 @@ use crate::{
 #[cfg(feature = "vsock")]
 use crate::{vsock::VMADDR_CID_HOST, vsock::stream::VsockStream};
 use aes_gcm::{AeadInPlace, Aes256Gcm, KeyInit, Nonce, aead::generic_array::GenericArray};
-use aes_kw::{Kek, KekAes256};
+use aes_kw::{KeyInit as _, KwAes256};
 use alloc::{string::ToString, vec::Vec};
 use cocoon_tpm_crypto::{
     CryptoError, EmptyCryptoIoSlices,
@@ -215,24 +215,20 @@ impl AttestationDriver<'_> {
         kdm.extend_from_slice(&(0_u32).to_be_bytes());
         kdm.extend_from_slice(&(256_u32).to_be_bytes());
 
-        let wrapping_key: KekAes256 = {
-            let mut buf: Vec<u8> = vec_sized(32).or(Err(AttestationError::VecAlloc))?;
+        let wrapping_key: KwAes256 = {
+            let mut buf = SecretSlice::new_sized(32).or(Err(AttestationError::VecAlloc))?;
 
             concat_kdf::derive_key_into::<sha2::Sha256>(&z, &kdm, &mut buf)
                 .map_err(AttestationError::KeyDerivation)?;
 
-            let sized: [u8; 32] = buf
-                .try_into()
-                .or(Err(AttestationError::WrapKeyArrayConvert))?;
+            KwAes256::new_from_slice(&buf).or(Err(AttestationError::WrapKeyArrayConvert))
+        }?;
 
-            Kek::new(&GenericArray::from(sized))
-        };
-
-        let mut cek =
-            vec_sized(&decryption.wrapped_cek.len() - 8).or(Err(AttestationError::VecAlloc))?;
+        let mut cek = SecretSlice::new_sized(&decryption.wrapped_cek.len() - 8)
+            .or(Err(AttestationError::VecAlloc))?;
 
         wrapping_key
-            .unwrap(&decryption.wrapped_cek, &mut cek)
+            .unwrap_key(&decryption.wrapped_cek, &mut cek)
             .or(Err(AttestationError::CekUnwrap))?;
 
         let cipher = Aes256Gcm::new(GenericArray::from_slice(&cek));

kernel/src/attest.rs

@@ -9,15 +9,25 @@
 extern crate alloc;
 
 use alloc::boxed::Box;
+use alloc::collections::TryReserveError;
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
+use crate::utils::vec::vec_sized;
+
 /// Container for sensitive byte data.
 ///
 /// The owned buffer is zeroed when the `SecretSlice` is dropped or explicitly
 /// [`zeroize`](Zeroize::zeroize)d.
 #[derive(Zeroize, ZeroizeOnDrop)]
 pub struct SecretSlice(Box<[u8]>);
 
+impl SecretSlice {
+    pub fn new_sized(size: usize) -> Result<Self, TryReserveError> {
+        let v = vec_sized(size)?;
+        Ok(Self(v.into_boxed_slice()))
+    }
+}
+
 impl From<Box<[u8]>> for SecretSlice {
     fn from(data: Box<[u8]>) -> Self {
         Self(data)