Skip to content

Commit c3b6677

Browse files
polhenarejospolhenarejos
committed
Use new asn1 structs.
Signed-off-by: Pol Henarejos <[email protected]>
1 parent 3ca23b9 commit c3b6677

13 files changed

+244
-249
lines changed

‎CMakeLists.txt

+3-3
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ target_compile_options(pico_hsm PUBLIC
8989
-Wall
9090
)
9191
if (NOT MSVC)
92-
target_compile_options(pico_hsm PUBLIC
92+
target_compile_options(pico_hsm PUBLIC
9393
-Werror
9494
)
9595
endif()
@@ -106,10 +106,10 @@ target_link_options(pico_hsm PUBLIC
106106
-Wl,-dead_strip
107107
)
108108
elseif(MSVC)
109-
target_compile_options(pico_hsm PUBLIC
109+
target_compile_options(pico_hsm PUBLIC
110110
-WX
111111
)
112-
112+
113113
target_link_libraries(pico_hsm PUBLIC wsock32 ws2_32 Bcrypt)
114114
else()
115115
target_link_options(pico_hsm PUBLIC

‎pico-keys-sdk

‎src/hsm/cmd_bip_slip.c

+4-1
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,10 @@ int node_derive_path(const uint8_t *path,
160160
int r = 0;
161161
memset(last_node, 0, 4);
162162
memset(fingerprint, 0, 4);
163-
for (; walk_tlv(path, path_len, &p, &tag, &tag_len, &tag_data); node++) {
163+
164+
asn1_ctx_t ctxi;
165+
asn1_ctx_init((uint8_t *)path, path_len, &ctxi);
166+
for (; walk_tlv(&ctxi, &p, &tag, &tag_len, &tag_data); node++) {
164167
if (tag == 0x02) {
165168
if ((node == 0 && tag_len != 1) || (node != 0 && tag_len != 4)) {
166169
return CCID_WRONG_DATA;

‎src/hsm/cmd_cipher_sym.c

+120-121
Large diffs are not rendered by default.

‎src/hsm/cmd_decrypt_asym.c

+12-14
Original file line numberDiff line numberDiff line change
@@ -152,34 +152,32 @@ int cmd_decrypt_asym() {
152152
if ((ext = cvc_get_ext(apdu.data, (uint16_t)apdu.nc, &ext_len)) == NULL) {
153153
return SW_WRONG_DATA();
154154
}
155-
uint8_t *p = NULL, *tag_data = NULL, *kdom_uid = NULL;
155+
uint8_t *p = NULL;
156156
uint16_t tag = 0;
157-
uint16_t tag_len = 0, kdom_uid_len = 0;
158-
while (walk_tlv(ext, ext_len, &p, &tag, &tag_len, &tag_data)) {
157+
asn1_ctx_t ctxi, ctxo = { 0 }, kdom_uid = { 0 };
158+
asn1_ctx_init((uint8_t *)ext, ext_len, &ctxi);
159+
while (walk_tlv(&ctxi, &p, &tag, &ctxo.len, &ctxo.data)) {
159160
if (tag == 0x73) {
160-
uint16_t oid_len = 0;
161-
uint8_t *oid_data = NULL;
162-
if (asn1_find_tag(tag_data, tag_len, 0x6, &oid_len,
163-
&oid_data) == true &&
164-
oid_len == strlen(OID_ID_KEY_DOMAIN_UID) &&
165-
memcmp(oid_data, OID_ID_KEY_DOMAIN_UID,
161+
asn1_ctx_t oid = {0};
162+
if (asn1_find_tag(&ctxo, 0x6, &oid) == true &&
163+
oid.len == strlen(OID_ID_KEY_DOMAIN_UID) &&
164+
memcmp(oid.data, OID_ID_KEY_DOMAIN_UID,
166165
strlen(OID_ID_KEY_DOMAIN_UID)) == 0) {
167-
if (asn1_find_tag(tag_data, tag_len, 0x80, &kdom_uid_len,
168-
&kdom_uid) == false) {
166+
if (asn1_find_tag(&ctxo, 0x80, &kdom_uid) == false) {
169167
return SW_WRONG_DATA();
170168
}
171169
break;
172170
}
173171
}
174172
}
175-
if (kdom_uid_len == 0 || kdom_uid == NULL) {
173+
if (asn1_len(&kdom_uid) == 0) {
176174
return SW_WRONG_DATA();
177175
}
178176
for (uint8_t n = 0; n < MAX_KEY_DOMAINS; n++) {
179177
file_t *tf = search_dynamic_file(EF_XKEK + n);
180178
if (tf) {
181-
if (file_get_size(tf) == kdom_uid_len &&
182-
memcmp(file_get_data(tf), kdom_uid, kdom_uid_len) == 0) {
179+
if (file_get_size(tf) == kdom_uid.len &&
180+
memcmp(file_get_data(tf), kdom_uid.data, kdom_uid.len) == 0) {
183181
file_new(EF_DKEK + n);
184182
if (store_dkek_key(n, res_APDU + 1) != CCID_OK) {
185183
return SW_EXEC_ERROR();

‎src/hsm/cmd_general_authenticate.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,9 @@ int cmd_general_authenticate() {
3333
uint16_t tag = 0x0;
3434
uint8_t *tag_data = NULL, *p = NULL;
3535
uint16_t tag_len = 0;
36-
while (walk_tlv(apdu.data + 2, (uint16_t)(apdu.nc - 2), &p, &tag, &tag_len, &tag_data)) {
36+
asn1_ctx_t ctxi;
37+
asn1_ctx_init(apdu.data + 2, (uint16_t)(apdu.nc - 2), &ctxi);
38+
while (walk_tlv(&ctxi, &p, &tag, &tag_len, &tag_data)) {
3739
if (tag == 0x80) {
3840
pubkey = tag_data - 1; //mbedtls ecdh starts reading one pos before
3941
pubkey_len = tag_len + 1;

‎src/hsm/cmd_initialize.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,9 @@ int cmd_initialize() {
4949
uint16_t tag = 0x0;
5050
uint8_t *tag_data = NULL, *p = NULL, *kds = NULL, *dkeks = NULL;
5151
uint16_t tag_len = 0;
52-
while (walk_tlv(apdu.data, (uint16_t)apdu.nc, &p, &tag, &tag_len, &tag_data)) {
52+
asn1_ctx_t ctxi;
53+
asn1_ctx_init(apdu.data, (uint16_t)apdu.nc, &ctxi);
54+
while (walk_tlv(&ctxi, &p, &tag, &tag_len, &tag_data)) {
5355
if (tag == 0x80) { //options
5456
file_t *tf = search_by_fid(EF_DEVOPS, NULL, SPECIFY_EF);
5557
flash_write_data_to_file(tf, tag_data, tag_len);

‎src/hsm/cmd_keypair_gen.c

+32-46
Original file line numberDiff line numberDiff line change
@@ -31,31 +31,21 @@ int cmd_keypair_gen() {
3131
}
3232
int ret = 0;
3333

34-
uint16_t tout = 0;
3534
//sc_asn1_print_tags(apdu.data, apdu.nc);
36-
uint8_t *p = NULL;
3735
//DEBUG_DATA(apdu.data,apdu.nc);
38-
if (asn1_find_tag(apdu.data, (uint16_t)apdu.nc, 0x7f49, &tout, &p) && tout > 0 && p != NULL) {
39-
uint16_t oid_len = 0;
40-
uint8_t *oid = NULL;
41-
if (asn1_find_tag(p, tout, 0x6, &oid_len, &oid) && oid_len > 0 && oid != NULL) {
42-
if (memcmp(oid, OID_ID_TA_RSA_V1_5_SHA_256, oid_len) == 0) { //RSA
43-
uint16_t ex_len = 3, ks_len = 2;
44-
uint8_t *ex = NULL, *ks = NULL;
36+
asn1_ctx_t ctxi, ctxo = { 0 };
37+
asn1_ctx_init(apdu.data, (uint16_t)apdu.nc, &ctxi);
38+
if (asn1_find_tag(&ctxi, 0x7f49, &ctxo) && asn1_len(&ctxo) > 0) {
39+
asn1_ctx_t oid = { 0 };
40+
if (asn1_find_tag(&ctxo, 0x6, &oid) && asn1_len(&oid) > 0) {
41+
if (memcmp(oid.data, OID_ID_TA_RSA_V1_5_SHA_256, oid.len) == 0) { //RSA
42+
asn1_ctx_t ex = { 0 }, ks = { 0 };
4543
uint32_t exponent = 65537, key_size = 2048;
46-
if (asn1_find_tag(p, tout, 0x82, &ex_len, &ex) && ex_len > 0 && ex != NULL) {
47-
uint8_t *dt = ex;
48-
exponent = 0;
49-
for (uint16_t i = 0; i < ex_len; i++) {
50-
exponent = (exponent << 8) | *dt++;
51-
}
44+
if (asn1_find_tag(&ctxo, 0x82, &ex) && asn1_len(&ex) > 0) {
45+
exponent = asn1_get_uint(&ex);
5246
}
53-
if (asn1_find_tag(p, tout, 0x2, &ks_len, &ks) && ks_len > 0 && ks != NULL) {
54-
uint8_t *dt = ks;
55-
key_size = 0;
56-
for (uint16_t i = 0; i < ks_len; i++) {
57-
key_size = (key_size << 8) | *dt++;
58-
}
47+
if (asn1_find_tag(&ctxo, 0x2, &ks) && asn1_len(&ks) > 0) {
48+
key_size = asn1_get_uint(&ks);
5949
}
6050
printf("KEYPAIR RSA %lu (%lx)\r\n",
6151
(unsigned long) key_size,
@@ -79,13 +69,12 @@ int cmd_keypair_gen() {
7969
}
8070
mbedtls_rsa_free(&rsa);
8171
}
82-
else if (memcmp(oid, OID_ID_TA_ECDSA_SHA_256, MIN(oid_len, 10)) == 0) { //ECC
83-
uint16_t prime_len;
84-
uint8_t *prime = NULL;
85-
if (asn1_find_tag(p, tout, 0x81, &prime_len, &prime) != true) {
72+
else if (memcmp(oid.data, OID_ID_TA_ECDSA_SHA_256, MIN(oid.len, 10)) == 0) { //ECC
73+
asn1_ctx_t prime = { 0 };
74+
if (asn1_find_tag(&ctxo, 0x81, &prime) != true) {
8675
return SW_WRONG_DATA();
8776
}
88-
mbedtls_ecp_group_id ec_id = ec_get_curve_from_prime(prime, prime_len);
77+
mbedtls_ecp_group_id ec_id = ec_get_curve_from_prime(prime.data, prime.len);
8978
printf("KEYPAIR ECC %d\r\n", ec_id);
9079
if (ec_id == MBEDTLS_ECP_DP_NONE) {
9180
return SW_FUNC_NOT_SUPPORTED();
@@ -98,30 +87,27 @@ int cmd_keypair_gen() {
9887
mbedtls_ecdsa_free(&ecdsa);
9988
return SW_EXEC_ERROR();
10089
}
101-
uint16_t l91 = 0, ext_len = 0;
102-
uint8_t *p91 = NULL, *ext = NULL;
103-
if (asn1_find_tag(apdu.data, (uint16_t)apdu.nc, 0x91, &l91, &p91) && p91 != NULL && l91 > 0) {
104-
for (size_t n = 0; n < l91; n++) {
105-
if (p91[n] == ALGO_EC_DH_XKEK) {
106-
uint16_t l92 = 0;
107-
uint8_t *p92 = NULL;
108-
if (!asn1_find_tag(apdu.data, (uint16_t)apdu.nc, 0x92, &l92,
109-
&p92) || p92 == NULL || l92 == 0) {
90+
asn1_ctx_t a91 = { 0 }, ext = { 0 };
91+
if (asn1_find_tag(&ctxi, 0x91, &a91) && asn1_len(&a91) > 0) {
92+
for (size_t n = 0; n < a91.len; n++) {
93+
if (a91.data[n] == ALGO_EC_DH_XKEK) {
94+
asn1_ctx_t a92 = {0};
95+
if (!asn1_find_tag(&ctxi, 0x92, &a92) || asn1_len(&a92) == 0) {
11096
return SW_WRONG_DATA();
11197
}
112-
if (p92[0] > MAX_KEY_DOMAINS) {
98+
if (a92.data[0] > MAX_KEY_DOMAINS) {
11399
return SW_WRONG_DATA();
114100
}
115-
file_t *tf_xkek = search_dynamic_file(EF_XKEK + p92[0]);
101+
file_t *tf_xkek = search_dynamic_file(EF_XKEK + a92.data[0]);
116102
if (!tf_xkek) {
117103
return SW_WRONG_DATA();
118104
}
119-
ext_len = 2 + 2 + (uint16_t)strlen(OID_ID_KEY_DOMAIN_UID) + 2 + file_get_size(
105+
ext.len = 2 + 2 + (uint16_t)strlen(OID_ID_KEY_DOMAIN_UID) + 2 + file_get_size(
120106
tf_xkek);
121-
ext = (uint8_t *) calloc(1, ext_len);
122-
uint8_t *pe = ext;
107+
ext.data = (uint8_t *) calloc(1, ext.len);
108+
uint8_t *pe = ext.data;
123109
*pe++ = 0x73;
124-
*pe++ = (uint8_t)ext_len - 2;
110+
*pe++ = (uint8_t)ext.len - 2;
125111
*pe++ = 0x6;
126112
*pe++ = (uint8_t)strlen(OID_ID_KEY_DOMAIN_UID);
127113
memcpy(pe, OID_ID_KEY_DOMAIN_UID, strlen(OID_ID_KEY_DOMAIN_UID));
@@ -133,15 +119,15 @@ int cmd_keypair_gen() {
133119
}
134120
}
135121
if ((res_APDU_size =
136-
(uint16_t)asn1_cvc_aut(&ecdsa, PICO_KEYS_KEY_EC, res_APDU, 4096, ext, ext_len)) == 0) {
137-
if (ext) {
138-
free(ext);
122+
(uint16_t)asn1_cvc_aut(&ecdsa, PICO_KEYS_KEY_EC, res_APDU, 4096, ext.data, ext.len)) == 0) {
123+
if (ext.data) {
124+
free(ext.data);
139125
}
140126
mbedtls_ecdsa_free(&ecdsa);
141127
return SW_EXEC_ERROR();
142128
}
143-
if (ext) {
144-
free(ext);
129+
if (ext.data) {
130+
free(ext.data);
145131
}
146132
ret = store_keys(&ecdsa, PICO_KEYS_KEY_EC, key_id);
147133
mbedtls_ecdsa_free(&ecdsa);

‎src/hsm/cmd_mse.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,9 @@ int cmd_mse() {
3434
uint16_t tag = 0x0;
3535
uint8_t *tag_data = NULL, *p = NULL;
3636
uint16_t tag_len = 0;
37-
while (walk_tlv(apdu.data, (uint16_t)apdu.nc, &p, &tag, &tag_len, &tag_data)) {
37+
asn1_ctx_t ctxi;
38+
asn1_ctx_init(apdu.data, (uint16_t)apdu.nc, &ctxi);
39+
while (walk_tlv(&ctxi, &p, &tag, &tag_len, &tag_data)) {
3840
if (tag == 0x80) {
3941
if (p2 == 0xA4) {
4042
if (tag_len == 10 &&

‎src/hsm/cmd_signature.c

+16-18
Original file line numberDiff line numberDiff line change
@@ -152,8 +152,7 @@ int cmd_signature() {
152152
}
153153
return SW_EXEC_ERROR();
154154
}
155-
uint8_t *hash = apdu.data;
156-
uint16_t hash_len = (uint16_t)apdu.nc;
155+
asn1_ctx_t hash = {.len = (uint16_t)apdu.nc, .data = apdu.data};
157156
if (p2 == ALGO_RSA_PKCS1) { //DigestInfo attached
158157
uint16_t nc = (uint16_t)apdu.nc;
159158
if (pkcs1_strip_digest_info_prefix(&md, apdu.data, (uint16_t)apdu.nc, apdu.data,
@@ -164,35 +163,34 @@ int cmd_signature() {
164163
}
165164
else {
166165
//sc_asn1_print_tags(apdu.data, apdu.nc);
167-
uint16_t tout = 0, oid_len = 0;
168-
uint8_t *p = NULL, *oid = NULL;
169-
if (asn1_find_tag(apdu.data, (uint16_t)apdu.nc, 0x30, &tout, &p) && tout > 0 && p != NULL) {
170-
uint16_t tout30 = 0;
171-
uint8_t *c30 = NULL;
172-
if (asn1_find_tag(p, tout, 0x30, &tout30, &c30) && tout30 > 0 && c30 != NULL) {
173-
asn1_find_tag(c30, tout30, 0x6, &oid_len, &oid);
166+
asn1_ctx_t ctxi, ctxo = { 0 }, oid = { 0 };
167+
asn1_ctx_init(apdu.data, (uint16_t)apdu.nc, &ctxi);
168+
if (asn1_find_tag(&ctxi, 0x30, &ctxo) && asn1_len(&ctxo) > 0) {
169+
asn1_ctx_t a30 = { 0 };
170+
if (asn1_find_tag(&ctxo, 0x30, &a30) && asn1_len(&a30) > 0) {
171+
asn1_find_tag(&a30, 0x6, &oid);
174172
}
175-
asn1_find_tag(p, tout, 0x4, &hash_len, &hash);
173+
asn1_find_tag(&ctxo, 0x4, &hash);
176174
}
177-
if (oid && oid_len > 0) {
178-
if (memcmp(oid, MBEDTLS_OID_DIGEST_ALG_SHA1, oid_len) == 0) {
175+
if (asn1_len(&oid)) {
176+
if (memcmp(oid.data, MBEDTLS_OID_DIGEST_ALG_SHA1, oid.len) == 0) {
179177
md = MBEDTLS_MD_SHA1;
180178
}
181-
else if (memcmp(oid, MBEDTLS_OID_DIGEST_ALG_SHA224, oid_len) == 0) {
179+
else if (memcmp(oid.data, MBEDTLS_OID_DIGEST_ALG_SHA224, oid.len) == 0) {
182180
md = MBEDTLS_MD_SHA224;
183181
}
184-
else if (memcmp(oid, MBEDTLS_OID_DIGEST_ALG_SHA256, oid_len) == 0) {
182+
else if (memcmp(oid.data, MBEDTLS_OID_DIGEST_ALG_SHA256, oid.len) == 0) {
185183
md = MBEDTLS_MD_SHA256;
186184
}
187-
else if (memcmp(oid, MBEDTLS_OID_DIGEST_ALG_SHA384, oid_len) == 0) {
185+
else if (memcmp(oid.data, MBEDTLS_OID_DIGEST_ALG_SHA384, oid.len) == 0) {
188186
md = MBEDTLS_MD_SHA384;
189187
}
190-
else if (memcmp(oid, MBEDTLS_OID_DIGEST_ALG_SHA512, oid_len) == 0) {
188+
else if (memcmp(oid.data, MBEDTLS_OID_DIGEST_ALG_SHA512, oid.len) == 0) {
191189
md = MBEDTLS_MD_SHA512;
192190
}
193191
}
194192
if (p2 >= ALGO_RSA_PSS && p2 <= ALGO_RSA_PSS_SHA512) {
195-
if (p2 == ALGO_RSA_PSS && !oid) {
193+
if (p2 == ALGO_RSA_PSS && asn1_len(&oid) == 0) {
196194
if (apdu.nc == 20) { //default is sha1
197195
md = MBEDTLS_MD_SHA1;
198196
}
@@ -220,7 +218,7 @@ int cmd_signature() {
220218
}
221219
else {
222220
uint8_t *signature = (uint8_t *) calloc(key_size, sizeof(uint8_t));
223-
r = mbedtls_rsa_pkcs1_sign(&ctx, random_gen, NULL, md, hash_len, hash, signature);
221+
r = mbedtls_rsa_pkcs1_sign(&ctx, random_gen, NULL, md, hash.len, hash.data, signature);
224222
memcpy(res_APDU, signature, key_size);
225223
free(signature);
226224
}

‎src/hsm/cmd_update_ef.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,9 @@ int cmd_update_ef() {
4949
uint16_t tag = 0x0;
5050
uint8_t *tag_data = NULL, *p = NULL;
5151
uint16_t tag_len = 0;
52-
while (walk_tlv(apdu.data, (uint16_t)apdu.nc, &p, &tag, &tag_len, &tag_data)) {
52+
asn1_ctx_t ctxi;
53+
asn1_ctx_init(apdu.data, (uint16_t)apdu.nc, &ctxi);
54+
while (walk_tlv(&ctxi, &p, &tag, &tag_len, &tag_data)) {
5355
if (tag == 0x54) { //ofset tag
5456
for (size_t i = 1; i <= tag_len; i++) {
5557
offset |= (*tag_data++ << (8 * (tag_len - i)));

0 commit comments

Comments
 (0)