Skip to content

Commit 9a37b8d

Browse files
bryan-huntbryan-hunt
authored
Merge pull request #291 from JamieHunter/main
CKA_ID support to enable Java / Greengrass V2
2 parents c6e9d55 + 4d7361a commit 9a37b8d

5 files changed

Lines changed: 149 additions & 36 deletions

File tree

‎lib/CMakeLists.txt‎

Lines changed: 8 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -84,15 +84,13 @@ file(GLOB HOST_SRC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "host/*.c")
8484
file(GLOB HOST_INC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "host/*.h")
8585
file(GLOB JWT_SRC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "jwt/*.c")
8686
file(GLOB JWT_INC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "jwt/*.h")
87-
file(GLOB PKCS11_SRC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "pkcs11/*.c")
88-
file(GLOB PKCS11_INC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "pkcs11/*.h")
8987
file(GLOB TNG_SRC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "../app/tng/*.c")
9088
file(GLOB TNG_INC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "../app/tng/*.h")
9189
file(GLOB SHA206_API_SRC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "../app/api_206a/*.c")
9290
file(GLOB SHA206_API_INC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "../app/api_206a/*.h")
9391

94-
if(ATCA_PKCS11 AND (ATCA_TNGTLS_SUPPORT OR ATCA_TNGLORA_SUPPORT OR ATCA_TFLEX_SUPPORT))
95-
SET(TNG_SRC ${TNG_SRC} ../app/pkcs11/trust_pkcs11_config.c)
92+
if(ATCA_PKCS11)
93+
include(cmake/pkcs11.cmake)
9694
endif()
9795

9896
if(${CMAKE_VERSION} VERSION_GREATER "3.8.0")
@@ -102,7 +100,6 @@ source_group(TREE ${CMAKE_CURRENT_SOURCE_DIR} FILES ${TALIB_SRC})
102100
source_group(TREE ${CMAKE_CURRENT_SOURCE_DIR} FILES ${CRYPTO_SRC})
103101
source_group(TREE ${CMAKE_CURRENT_SOURCE_DIR} FILES ${HOST_SRC})
104102
source_group(TREE ${CMAKE_CURRENT_SOURCE_DIR} FILES ${JWT_SRC})
105-
source_group(TREE ${CMAKE_CURRENT_SOURCE_DIR} FILES ${PKCS11_SRC})
106103
source_group("App/Tng" FILES ${TNG_SRC})
107104
endif()
108105

@@ -216,6 +213,7 @@ set(CRYPTOAUTH_SRC ${LIB_SRC}
216213
${CRYPTO_SRC}
217214
${JWT_SRC}
218215
${TNG_SRC}
216+
${PKCS11_SRC}
219217
${MBEDTLS_SRC}
220218
${WOLFSSL_SRC}
221219
${OPENSSL_SRC}
@@ -317,14 +315,6 @@ if(ATCA_MBEDTLS)
317315
set(CRYPTOAUTH_SRC ${CRYPTOAUTH_SRC} ${MBEDTLS_SRC})
318316
endif()
319317

320-
if(ATCA_PKCS11)
321-
set(CRYPTOAUTH_SRC ${CRYPTOAUTH_SRC} ${PKCS11_SRC})
322-
set(ATCA_LIBRARY_CONF ${DEFAULT_CONF_PATH}/${DEFAULT_CONF_FILE_NAME} CACHE STRING "" FORCE)
323-
if(PKCS11_DEBUG_ENABLE)
324-
add_definitions(-DPKCS11_DEBUG_ENABLE)
325-
endif(PKCS11_DEBUG_ENABLE)
326-
endif()
327-
328318
if(ATCA_BUILD_SHARED_LIBS)
329319
add_definitions(-DATCA_BUILD_SHARED_LIBS)
330320
set(CRYPTOAUTH_SRC ${CRYPTOAUTH_SRC} atca_utils_sizes.c)
@@ -346,14 +336,11 @@ if(BUILD_TESTS)
346336
set(ATCA_TESTS_ENABLED ON CACHE INTERNAL "")
347337
endif(BUILD_TESTS)
348338

339+
set(ATCA_LIBRARY_CONF ${DEFAULT_CONF_PATH}/${DEFAULT_CONF_FILE_NAME} CACHE STRING "" FORCE)
340+
349341
configure_file(atca_config.h.in atca_config.h @ONLY)
350342
set(LIB_INC ${LIB_INC} ${CMAKE_CURRENT_BINARY_DIR}/atca_config.h)
351343

352-
if(ATCA_PKCS11)
353-
configure_file(pkcs11/pkcs11_config.h.in pkcs11_config.h @ONLY)
354-
set(PKCS11_INC ${PKCS11_INC} ${CMAKE_CURRENT_BINARY_DIR}/pkcs11_config.h)
355-
endif()
356-
357344
include_directories(cryptoauth PUBLIC ${CMAKE_CURRENT_BINARY_DIR} ${CMAKE_CURRENT_SOURCE_DIR} ../app/tng ../third_party ../third_party/hidapi/hidapi ${USB_INCLUDE_DIR})
358345

359346
if(ATCA_MBEDTLS)
@@ -415,7 +402,9 @@ install(FILES ${CRYPTO_INC} DESTINATION ${DEFAULT_INC_PATH}/crypto COMPONENT Dev
415402
install(FILES ${CRYPTO_HASHES_INC} DESTINATION ${DEFAULT_INC_PATH}/crypto/hashes COMPONENT Development)
416403
install(FILES ${HOST_INC} DESTINATION ${DEFAULT_INC_PATH}/host COMPONENT Development)
417404
install(FILES ${JWT_INC} DESTINATION ${DEFAULT_INC_PATH}/jwt COMPONENT Development)
405+
if (ATCA_PKCS11)
418406
install(FILES ${PKCS11_INC} DESTINATION ${DEFAULT_INC_PATH}/pkcs11 COMPONENT Development)
407+
endif()
419408
install(FILES ${TNG_INC} DESTINATION ${DEFAULT_INC_PATH}/app/tng COMPONENT Development)
420409
install(FILES ${SHA206_API_INC} DESTINATION ${DEFAULT_INC_PATH}/app/api_206a COMPONENT Development)
421-
endif(DEFAULT_INC_PATH)
410+
endif(DEFAULT_INC_PATH)

‎lib/cmake/pkcs11.cmake‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Helper CMake file for PKCS11 extension to the library
2+
3+
# PKCS11 Configuration Options - See pkcs11_config.h.in
4+
set(PKCS11_DEBUG_ENABLE OFF CACHE BOOL "Enable PKCS#11 Debugging Messages")
5+
set(PKCS11_USE_STATIC_MEMORY ${ATCA_NO_HEAP} CACHE BOOL "Use Static Memory Allocation")
6+
set(PKCS11_USE_STATIC_CONFIG OFF CACHE BOOL "Use a compiled configuration rather than loading from a filestore")
7+
set(PKCS11_MAX_SLOTS_ALLOWED 1 CACHE STRING "Maximum number of slots allowed in the system")
8+
set(PKCS11_MAX_SESSIONS_ALLOWED 10 CACHE STRING "Maximum number of total sessions allowed in the system")
9+
set(PKCS11_MAX_OBJECTS_ALLOWED 16 CACHE STRING "Maximum number of cryptographic objects allowed to be cached")
10+
set(PKCS11_MAX_LABEL_SIZE 30 CACHE STRING "Maximum label size in characters")
11+
set(PKCS11_LOCK_PIN_SLOT OFF CACHE BOOL "Define to lock the PIN slot after writing")
12+
set(PKCS11_PIN_KDF_ALWAYS OFF CACHE BOOL "Define to always convert PIN using KDF")
13+
set(PKCS11_PIN_PBKDF2_EN OFF CACHE BOOL "Define to use PBKDF2 for PIN KDF")
14+
set(PKCS11_PIN_PBKDF2_ITERATIONS 2 CACHE STRING "Define how many iterations PBKDF2 will use for PIN KDF")
15+
set(PKCS11_SEARCH_CACHE_SIZE 250 CACHE STRING "Static Search Attribute Cache in bytes")
16+
set(PKCS11_TOKEN_INIT_SUPPORT OFF CACHE BOOL "Support for configuring a blank or new device")
17+
set(PKCS11_MONOTONIC_ENABLE OFF CACHE BOOL "Include the monotonic hardware feature as an object")
18+
set(PKCS11_AUTO_ID_ENABLE ON CACHE BOOL "Generate CKA_ID values based on standards")
19+
20+
file(GLOB PKCS11_SRC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "pkcs11/*.c")
21+
file(GLOB PKCS11_INC RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} "pkcs11/*.h")
22+
23+
configure_file(pkcs11/pkcs11_config.h.in ${CMAKE_CURRENT_BINARY_DIR}/pkcs11_config.h @ONLY)
24+
set(PKCS11_INC ${PKCS11_INC} ${CMAKE_CURRENT_BINARY_DIR}/pkcs11_config.h)
25+
26+
if(ATCA_TNGTLS_SUPPORT OR ATCA_TNGLORA_SUPPORT OR ATCA_TFLEX_SUPPORT)
27+
SET(TNG_SRC ${TNG_SRC} ../app/pkcs11/trust_pkcs11_config.c)
28+
endif()
29+
30+
if(${CMAKE_VERSION} VERSION_GREATER "3.8.0")
31+
source_group(TREE ${CMAKE_CURRENT_SOURCE_DIR} FILES ${PKCS11_SRC})
32+
endif()

‎lib/pkcs11/pkcs11_cert.c‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -335,6 +335,10 @@ CK_RV pkcs11_cert_get_subject_key_id(CK_VOID_PTR pObject, CK_ATTRIBUTE_PTR pAttr
335335
else
336336
{
337337
pAttribute->ulValueLen = 20;
338+
if (pAttribute->pValue == NULL)
339+
{
340+
return CKR_OK;
341+
}
338342
}
339343
}
340344
else
@@ -372,6 +376,35 @@ CK_RV pkcs11_cert_get_trusted_flag(CK_VOID_PTR pObject, CK_ATTRIBUTE_PTR pAttrib
372376
return CKR_ARGUMENTS_BAD;
373377
}
374378

379+
static CK_RV pkcs11_cert_get_id(CK_VOID_PTR pObject, CK_ATTRIBUTE_PTR pAttribute)
380+
{
381+
#if PKCS11_AUTO_ID_ENABLE
382+
return pkcs11_cert_get_subject_key_id(pObject, pAttribute);
383+
#elif ATCA_CA_SUPPORT
384+
pkcs11_object_ptr obj_ptr = (pkcs11_object_ptr)pObject;
385+
CK_RV rv = CKR_ARGUMENTS_BAD;
386+
387+
if (obj_ptr)
388+
{
389+
pkcs11_cert_check_trust_data(obj_ptr);
390+
391+
if (obj_ptr->data)
392+
{
393+
atcacert_def_t * cert_cfg = (atcacert_def_t*)obj_ptr->data;
394+
uint16_t key_id = ATCA_UINT16_HOST_TO_BE(cert_cfg->public_key_dev_loc.slot);
395+
rv = pkcs11_attrib_fill(pAttribute, &key_id, sizeof(uint16_t));
396+
}
397+
else
398+
{
399+
return pkcs11_attrib_empty(pObject, pAttribute);
400+
}
401+
}
402+
return rv;
403+
#else
404+
return pkcs11_attrib_empty(pObject, pAttribute);
405+
#endif
406+
}
407+
375408
/**
376409
* CKO_CERTIFICATE (Type: CKC_X_509) - X509 Public Key Certificate Model
377410
*/
@@ -411,7 +444,7 @@ const pkcs11_attrib_model pkcs11_cert_x509public_attributes[] = {
411444
/** DER-encoded Certificate subject name */
412445
{ CKA_SUBJECT, pkcs11_cert_get_subject },
413446
/** Key identifier for public/private key pair (default empty) */
414-
{ CKA_ID, pkcs11_attrib_empty },
447+
{ CKA_ID, pkcs11_cert_get_id },
415448
/** DER-encoded Certificate issuer name (default empty)*/
416449
{ CKA_ISSUER, pkcs11_attrib_empty },
417450
/** DER-encoding of the certificate serial number (default empty) */

‎lib/pkcs11/pkcs11_config.h.in‎

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -35,44 +35,44 @@
3535

3636
/** Define to lock the PIN slot after writing */
3737
#ifndef PKCS11_LOCK_PIN_SLOT
38-
#define PKCS11_LOCK_PIN_SLOT 0
38+
#cmakedefine01 PKCS11_LOCK_PIN_SLOT
3939
#endif
4040

4141
/** Enable PKCS#11 Debugging Messages */
4242
#ifndef PKCS11_DEBUG_ENABLE
43-
#define PKCS11_DEBUG_ENABLE 0
43+
#cmakedefine01 PKCS11_DEBUG_ENABLE
4444
#endif
4545

4646
/** Use Static or Dynamic Allocation */
4747
#ifndef PKCS11_USE_STATIC_MEMORY
48-
#define PKCS11_USE_STATIC_MEMORY 1
48+
#cmakedefine01 PKCS11_USE_STATIC_MEMORY
4949
#endif
5050

5151
/** Use a compiled configuration rather than loading from a filestore */
5252
#ifndef PKCS11_USE_STATIC_CONFIG
53-
#define PKCS11_USE_STATIC_CONFIG 0
53+
#cmakedefine01 PKCS11_USE_STATIC_CONFIG
5454
#endif
5555

5656
/** Maximum number of slots allowed in the system - if static memory this will
5757
always be the number of slots */
5858
#ifndef PKCS11_MAX_SLOTS_ALLOWED
59-
#define PKCS11_MAX_SLOTS_ALLOWED 1
59+
#define PKCS11_MAX_SLOTS_ALLOWED @PKCS11_MAX_SLOTS_ALLOWED@
6060
#endif
6161

6262
/** Maximum number of total sessions allowed in the system - if using static
6363
memory then this many session contexts will be allocated */
6464
#ifndef PKCS11_MAX_SESSIONS_ALLOWED
65-
#define PKCS11_MAX_SESSIONS_ALLOWED 10
65+
#define PKCS11_MAX_SESSIONS_ALLOWED @PKCS11_MAX_SESSIONS_ALLOWED@
6666
#endif
6767

6868
/** Maximum number of cryptographic objects allowed to be cached */
6969
#ifndef PKCS11_MAX_OBJECTS_ALLOWED
70-
#define PKCS11_MAX_OBJECTS_ALLOWED 16
70+
#define PKCS11_MAX_OBJECTS_ALLOWED @PKCS11_MAX_OBJECTS_ALLOWED@
7171
#endif
7272

7373
/** Maximum label size in characters */
7474
#ifndef PKCS11_MAX_LABEL_SIZE
75-
#define PKCS11_MAX_LABEL_SIZE 30
75+
#define PKCS11_MAX_LABEL_SIZE @PKCS11_MAX_LABEL_SIZE@
7676
#endif
7777

7878
/** Define to always convert PIN using KDF */
@@ -83,8 +83,8 @@
8383

8484
/** Define how many iterations PBKDF2 will use for PIN KDF */
8585
#if defined(PKCS11_PIN_PBKDF2_EN) && !defined(PKCS11_PIN_PBKDF2_ITERATIONS)
86-
#define PKCS11_PIN_PBKDF2_ITERATIONS 2
87-
#endif
86+
#define PKCS11_PIN_PBKDF2_ITERATIONS @PKCS11_PIN_PBKDF2_ITERATIONS@
87+
#endif
8888

8989
/****************************************************************************/
9090
/* The following configuration options are for fine tuning of the library */
@@ -96,25 +96,29 @@
9696
intends to use. Otherwise compilers will not be able to optimize out the unusued
9797
functions */
9898
#ifndef PKCS11_EXTERNAL_FUNCTION_LIST
99-
#define PKCS11_EXTERNAL_FUNCTION_LIST 0
99+
#cmakedefine01 PKCS11_EXTERNAL_FUNCTION_LIST
100100
#endif
101101

102102
/** Static Search Attribute Cache in bytes (variable number of attributes based
103103
on size and memory requirements) */
104104
#ifndef PKCS11_SEARCH_CACHE_SIZE
105-
#define PKCS11_SEARCH_CACHE_SIZE 250
105+
#define PKCS11_SEARCH_CACHE_SIZE @PKCS11_SEARCH_CACHE_SIZE@
106106
#endif
107107

108108
/** Support for configuring a "blank" or new device */
109109
#ifndef PKCS11_TOKEN_INIT_SUPPORT
110-
#define PKCS11_TOKEN_INIT_SUPPORT 1
110+
#cmakedefine01 PKCS11_TOKEN_INIT_SUPPORT
111111
#endif
112112

113113
/** Include the monotonic hardware feature as an object */
114114
#ifndef PKCS11_MONOTONIC_ENABLE
115-
#define PKCS11_MONOTONIC_ENABLE 0
115+
#cmakedefine01 PKCS11_MONOTONIC_ENABLE
116116
#endif
117117

118+
/** Automatically generate CKA_ID values based on standards */
119+
#ifndef PKCS11_AUTO_ID_ENABLE
120+
#cmakedefine01 PKCS11_AUTO_ID_ENABLE
121+
#endif
118122

119123
#include "pkcs11/cryptoki.h"
120124
#include <stddef.h>

‎lib/pkcs11/pkcs11_key.c‎

Lines changed: 57 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -373,6 +373,61 @@ static CK_RV pkcs11_key_auth_required(CK_VOID_PTR pObject, CK_ATTRIBUTE_PTR pAtt
373373
return rv;
374374
}
375375

376+
static CK_RV pkcs11_key_get_id(CK_VOID_PTR pObject, CK_ATTRIBUTE_PTR pAttribute)
377+
{
378+
pkcs11_object_ptr obj_ptr = (pkcs11_object_ptr)pObject;
379+
CK_RV rv = CKR_ARGUMENTS_BAD;
380+
381+
if (obj_ptr)
382+
{
383+
#if PKCS11_AUTO_ID_ENABLE
384+
if (pAttribute->pValue)
385+
{
386+
CK_BBOOL is_private;
387+
388+
if (CKR_OK == (rv = pkcs11_object_is_private(obj_ptr, &is_private)))
389+
{
390+
ATCA_STATUS status;
391+
uint8_t buffer[1 + ATCA_ECCP256_PUBKEY_SIZE] = {0x04};
392+
393+
if (is_private)
394+
{
395+
status = atcab_get_pubkey(obj_ptr->slot, &buffer[1]);
396+
PKCS11_DEBUG("atcab_get_pubkey: %x\r\n", status);
397+
}
398+
else
399+
{
400+
status = atcab_read_pubkey(obj_ptr->slot, &buffer[1]);
401+
PKCS11_DEBUG("atcab_read_pubkey: %x\r\n", status);
402+
}
403+
404+
if (ATCA_SUCCESS == status)
405+
{
406+
status = atcac_sw_sha1(buffer, sizeof(buffer), buffer);
407+
}
408+
409+
if (ATCA_SUCCESS == status)
410+
{
411+
rv = pkcs11_attrib_fill(pAttribute, buffer, ATCA_SHA1_DIGEST_SIZE);
412+
}
413+
else
414+
{
415+
rv = pkcs11_util_convert_rv(status);
416+
}
417+
}
418+
}
419+
else
420+
{
421+
rv = pkcs11_attrib_fill(pAttribute, NULL, ATCA_SHA1_DIGEST_SIZE);
422+
}
423+
#else
424+
uint16_t key_id = ATCA_UINT16_HOST_TO_BE(obj_ptr->slot);
425+
rv = pkcs11_attrib_fill(pAttribute, &key_id, sizeof(uint16_t));
426+
#endif
427+
}
428+
return rv;
429+
}
430+
376431
/**
377432
* CKO_PUBLIC_KEY - Public Key Object Model
378433
*/
@@ -394,7 +449,7 @@ const pkcs11_attrib_model pkcs11_key_public_attributes[] = {
394449
/** Type of key */
395450
{ CKA_KEY_TYPE, pkcs11_object_get_type },
396451
/** Key identifier for key (default empty) */
397-
{ CKA_ID, pkcs11_attrib_empty },
452+
{ CKA_ID, pkcs11_key_get_id },
398453
/** Start date for the key (default empty) */
399454
{ CKA_START_DATE, pkcs11_attrib_empty },
400455
/** End date for the key (default empty) */
@@ -484,7 +539,7 @@ const pkcs11_attrib_model pkcs11_key_private_attributes[] = {
484539
/** Type of key */
485540
{ CKA_KEY_TYPE, pkcs11_object_get_type },
486541
/** Key identifier for key (default empty) */
487-
{ CKA_ID, pkcs11_attrib_empty },
542+
{ CKA_ID, pkcs11_key_get_id },
488543
/** Start date for the key (default empty) */
489544
{ CKA_START_DATE, pkcs11_attrib_empty },
490545
/** End date for the key (default empty) */

0 commit comments

Comments
 (0)