Merge pull request #4 from AndrzejKurek/verification_pubkey_importing

Add verification and public key importing

Author: Patater

atecc608a_se.c

@@ -22,6 +22,8 @@
 #include "atecc608a_se.h"
 #include "atca_helpers.h"
 
+#include "psa/crypto.h"
+
 #ifdef DEBUG_PRINT
 #include <stdio.h>
 #endif
@@ -60,7 +62,7 @@
 
 static ATCAIfaceCfg atca_iface_config = {
     .iface_type = ATCA_I2C_IFACE,
-    .devtype = ATECC608A,
+    .devtype = ATECC508A,
     .atcai2c.slave_address = 0xC0,
     .atcai2c.bus = 2,
     .atcai2c.baud = 400000,
@@ -120,6 +122,12 @@ psa_status_t atecc608a_to_psa_error(ATCA_STATUS ret)
     }
 }
 
+static psa_status_t is_public_key_slot(uint16_t key_slot)
+{
+    /* Keys 8 to 15 can store public keys. Slots 1-7 are too small. */
+    return ((key_slot >= 8 && key_slot <=15) ? PSA_SUCCESS : PSA_ERROR_INVALID_ARGUMENT);
+}
+
 psa_status_t atecc608a_init()
 {
     return atecc608a_to_psa_error(atcab_init(&atca_iface_config));
@@ -146,7 +154,7 @@ static psa_status_t atecc608a_export_public_key(psa_key_slot_number_t key,
     ASSERT_SUCCESS_PSA(atecc608a_init());
 
     /* atcab_get_pubkey returns concatenated x and y values, and the desired
-       format is 0x04 + x + y. We start at &p_data[1] and add a 0x04 at p_data[0]. */
+     * format is 0x04 + x + y. Start at &p_data[1] and add a 0x04 at p_data[0]. */
     ASSERT_SUCCESS(atcab_get_pubkey(slot, &p_data[1]));
 
     p_data[0] = 4;
@@ -161,6 +169,47 @@ static psa_status_t atecc608a_export_public_key(psa_key_slot_number_t key,
     atecc608a_deinit();
     return status;
 }
+static psa_status_t atecc608a_import_public_key(psa_key_slot_number_t key_slot,
+                                                psa_key_lifetime_t lifetime,
+                                                psa_key_type_t type,
+                                                psa_algorithm_t alg,
+                                                psa_key_usage_t usage,
+                                                const uint8_t *p_data,
+                                                size_t data_length)
+{
+    const uint16_t key_id = key_slot;
+    psa_status_t status = PSA_ERROR_GENERIC_ERROR;
+
+    ASSERT_SUCCESS_PSA(is_public_key_slot(key_id));
+
+    /* Check if the key has a size of 65 {0x04, X, Y}. */
+    if (data_length != PSA_KEY_EXPORT_MAX_SIZE(PSA_KEY_TYPE_ECC_PUBLIC_KEY(
+                                                   PSA_ECC_CURVE_SECP256R1),
+                                               256))
+    {
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
+
+    if (type != PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_CURVE_SECP256R1))
+    {
+        return PSA_ERROR_NOT_SUPPORTED;
+    }
+
+    /* The driver can only do randomized ECDSA on SHA-256 */
+    if (alg != PSA_ALG_ECDSA(PSA_ALG_SHA_256) && alg != PSA_ALG_ECDSA_ANY)
+    {
+        return PSA_ERROR_NOT_SUPPORTED;
+    }
+
+    ASSERT_SUCCESS_PSA(atecc608a_init());
+
+    /* PSA public key format is {0x04, X, Y}, and the cryptoauthlib accepts
+     * raw {X,Y}. */
+    ASSERT_SUCCESS(atcab_write_pubkey(key_id, p_data + 1));
+exit:
+    atecc608a_deinit();
+    return status;
+}
 
 static psa_status_t atecc608a_asymmetric_sign(psa_key_slot_number_t key_slot,
                                               psa_algorithm_t alg,
@@ -173,13 +222,13 @@ static psa_status_t atecc608a_asymmetric_sign(psa_key_slot_number_t key_slot,
     const uint16_t key_id = key_slot;
     psa_status_t status = PSA_ERROR_GENERIC_ERROR;
 
-    /* We can only do ECDSA on SHA-256 */
+    /* The driver can only do randomized ECDSA on SHA-256 */
     if (alg != PSA_ALG_ECDSA(PSA_ALG_SHA_256) && alg != PSA_ALG_ECDSA_ANY)
     {
         return PSA_ERROR_NOT_SUPPORTED;
     }
 
-    if (hash_length != 32)
+    if (hash_length != PSA_HASH_SIZE(PSA_ALG_SHA_256))
     {
         /* The driver only supports signing things of length 32. */
         return PSA_ERROR_NOT_SUPPORTED;
@@ -208,24 +257,64 @@ static psa_status_t atecc608a_asymmetric_sign(psa_key_slot_number_t key_slot,
     return status;
 }
 
+psa_status_t atecc608a_asymmetric_verify(psa_key_slot_number_t key_slot,
+                                         psa_algorithm_t alg,
+                                         const uint8_t *p_hash,
+                                         size_t hash_length,
+                                         const uint8_t *p_signature,
+                                         size_t signature_length)
+{
+    const uint16_t key_id = key_slot;
+    psa_status_t status = PSA_ERROR_GENERIC_ERROR;
+    bool is_verified = false;
+
+    ASSERT_SUCCESS_PSA(is_public_key_slot(key_id));
+
+    /* The driver can only do randomized ECDSA on SHA-256 */
+    if (alg != PSA_ALG_ECDSA(PSA_ALG_SHA_256) && alg != PSA_ALG_ECDSA_ANY)
+    {
+        return PSA_ERROR_NOT_SUPPORTED;
+    }
+
+    if (hash_length != PSA_HASH_SIZE(PSA_ALG_SHA_256))
+    {
+        /* The driver only supports hashes of length 32. */
+        return PSA_ERROR_NOT_SUPPORTED;
+    }
+
+    if (signature_length != ATCA_SIG_SIZE)
+    {
+        /* The driver only supports signatures of length 64. */
+        return PSA_ERROR_INVALID_SIGNATURE;
+    }
+
+    ASSERT_SUCCESS_PSA(atecc608a_init());
+
+    ASSERT_SUCCESS(atcab_verify_stored(p_hash, p_signature, key_id, &is_verified));
+
+exit:
+    atecc608a_deinit();
+    return status;
+}
 
 #define PSA_ATECC608A_LIFETIME 0xdeadbeefU
 
 static psa_drv_se_asymmetric_t atecc608a_asymmetric =
 {
-    .p_sign = &atecc608a_asymmetric_sign,
-    .p_verify = 0,
+    .p_sign = atecc608a_asymmetric_sign,
+    .p_verify = atecc608a_asymmetric_verify,
     .p_encrypt = 0,
     .p_decrypt = 0,
 };
 
 static psa_drv_se_key_management_t atecc608a_key_management =
 {
-    .p_import = 0,
+    /* So far there is no public key import function in the API, so use this instead */
+    .p_import = atecc608a_import_public_key,
     .p_generate = 0,
     .p_destroy = 0,
     /* So far there is no public key export function in the API, so use this instead */
-    .p_export = &atecc608a_export_public_key,
+    .p_export = atecc608a_export_public_key,
 };
 
 psa_drv_se_info_t atecc608a_drv_info =

mbed-cryptoauthlib.lib

@@ -1 +1 @@
-https://github.com/janjongboom/mbed-cryptoauthlib/#c74828b1bbdf67281ad4689b05d88b2b32e86c75
+https://github.com/ARMmbed/mbed-cryptoauthlib/#6c0cacc6bb1428cff8b7e252c86ecc0f03d83ce7