Skip to content

Commit 0e7a53c

Browse files
tymoteuszblochmobicatymoteuszblochmobica
committed
DeviceKey Root of Trust generation refactored.
It's no longer automatically and silently created.
1 parent 8dc15ee commit 0e7a53c

File tree

8 files changed

+74
-42
lines changed

8 files changed

+74
-42
lines changed

‎TESTS/psa/its_ps/main.cpp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,10 @@
3636
#include "KVStore.h"
3737
#include "kv_config.h"
3838
#include "psa_storage_common_impl.h"
39+
#include "DeviceKey.h"
3940

4041
using namespace utest::v1;
42+
using namespace mbed;
4143

4244
#define TEST_BUFF_SIZE 16
4345
#define STR_EXPAND(tok) #tok
@@ -217,6 +219,9 @@ utest::v1::status_t case_its_setup_handler(const Case *const source, const size_
217219
status = psa_ps_reset();
218220
TEST_ASSERT_EQUAL(PSA_SUCCESS, status);
219221
}
222+
#if DEVICEKEY_ENABLED
223+
DeviceKey::get_instance().generate_root_of_trust();
224+
#endif
220225
return greentea_case_setup_handler(source, index_of_case);
221226
}
222227

‎features/device_key/TESTS/device_key/functionality/main.cpp

Lines changed: 28 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,10 @@ void generate_derived_key_consistency_16_byte_key_long_consistency_test(char *ke
104104
int ret = inner_store->reset();
105105
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
106106

107-
ret = inject_dummy_rot_key();
107+
ret = DeviceKey::get_instance().generate_root_of_trust();
108+
if (ret != DEVICEKEY_SUCCESS) {
109+
ret = inject_dummy_rot_key();
110+
}
108111
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
109112

110113
memset(output1, 0, sizeof(output1));
@@ -165,7 +168,10 @@ void generate_derived_key_consistency_32_byte_key_long_consistency_test(char *ke
165168
int ret = inner_store->reset();
166169
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
167170

168-
ret = inject_dummy_rot_key();
171+
ret = DeviceKey::get_instance().generate_root_of_trust();
172+
if (ret != DEVICEKEY_SUCCESS) {
173+
ret = inject_dummy_rot_key();
174+
}
169175
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
170176

171177
memset(output1, 0, sizeof(output1));
@@ -318,7 +324,10 @@ void generate_derived_key_consistency_16_byte_key_test()
318324
int ret = inner_store->reset();
319325
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
320326

321-
ret = inject_dummy_rot_key();
327+
ret = DeviceKey::get_instance().generate_root_of_trust();
328+
if (ret != DEVICEKEY_SUCCESS) {
329+
ret = inject_dummy_rot_key();
330+
}
322331
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
323332

324333
size_t salt_size = sizeof(salt);
@@ -355,7 +364,10 @@ void generate_derived_key_consistency_32_byte_key_test()
355364
int ret = inner_store->reset();
356365
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
357366

358-
ret = inject_dummy_rot_key();
367+
ret = DeviceKey::get_instance().generate_root_of_trust();
368+
if (ret != DEVICEKEY_SUCCESS) {
369+
ret = inject_dummy_rot_key();
370+
}
359371
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
360372

361373
size_t salt_size = sizeof(salt);
@@ -392,7 +404,10 @@ void generate_derived_key_key_type_16_test()
392404
int ret = inner_store->reset();
393405
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
394406

395-
ret = inject_dummy_rot_key();
407+
ret = DeviceKey::get_instance().generate_root_of_trust();
408+
if (ret != DEVICEKEY_SUCCESS) {
409+
ret = inject_dummy_rot_key();
410+
}
396411
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
397412

398413
memset(output, 0, DEVICE_KEY_16BYTE * 2);
@@ -425,7 +440,10 @@ void generate_derived_key_key_type_32_test()
425440
int ret = inner_store->reset();
426441
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
427442

428-
ret = inject_dummy_rot_key();
443+
ret = DeviceKey::get_instance().generate_root_of_trust();
444+
if (ret != DEVICEKEY_SUCCESS) {
445+
ret = inject_dummy_rot_key();
446+
}
429447
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
430448

431449
memset(output, 0, DEVICE_KEY_32BYTE * 2);
@@ -456,7 +474,10 @@ void generate_derived_key_wrong_key_type_test()
456474
int ret = inner_store->reset();
457475
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
458476

459-
ret = inject_dummy_rot_key();
477+
ret = DeviceKey::get_instance().generate_root_of_trust();
478+
if (ret != DEVICEKEY_SUCCESS) {
479+
ret = inject_dummy_rot_key();
480+
}
460481
TEST_ASSERT_EQUAL_INT(DEVICEKEY_SUCCESS, ret);
461482

462483
memset(output, 0, DEVICE_KEY_16BYTE);

‎features/device_key/source/DeviceKey.cpp

Lines changed: 9 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -94,23 +94,10 @@ int DeviceKey::generate_derived_key(const unsigned char *salt, size_t isalt_size
9494

9595
//First try to read the key from KVStore
9696
int ret = read_key_from_kvstore(key_buff, actual_size);
97-
if (DEVICEKEY_SUCCESS != ret && DEVICEKEY_NOT_FOUND != ret) {
97+
if (DEVICEKEY_SUCCESS != ret) {
9898
return ret;
9999
}
100100

101-
//If the key was not found in KVStore we will create it by using random generation and then save it to KVStore
102-
if (DEVICEKEY_NOT_FOUND == ret) {
103-
ret = generate_key_by_random(key_buff, actual_size);
104-
if (DEVICEKEY_SUCCESS != ret) {
105-
return ret;
106-
}
107-
108-
ret = device_inject_root_of_trust(key_buff, actual_size);
109-
if (DEVICEKEY_SUCCESS != ret) {
110-
return ret;
111-
}
112-
}
113-
114101
ret = get_derived_key(key_buff, actual_size, salt, isalt_size, output, ikey_type);
115102
return ret;
116103
}
@@ -259,22 +246,22 @@ int DeviceKey::get_derived_key(uint32_t *ikey_buff, size_t ikey_size, const unsi
259246
return DEVICEKEY_SUCCESS;
260247
}
261248

262-
int DeviceKey::generate_key_by_random(uint32_t *output, size_t size)
249+
int DeviceKey::generate_root_of_trust()
263250
{
264251
int ret = DEVICEKEY_GENERATE_RANDOM_ERROR;
252+
uint32_t key_buff[DEVICE_KEY_32BYTE / sizeof(uint32_t)];
253+
size_t actual_size = DEVICE_KEY_32BYTE;
265254

266-
if (DEVICE_KEY_16BYTE > size) {
267-
return DEVICEKEY_BUFFER_TOO_SMALL;
268-
} else if (DEVICE_KEY_16BYTE != size && DEVICE_KEY_32BYTE != size) {
269-
return DEVICEKEY_INVALID_PARAM;
255+
if (read_key_from_kvstore(key_buff, actual_size) == DEVICEKEY_SUCCESS) {
256+
return DEVICEKEY_ALREADY_EXIST;
270257
}
271258

272259
#if defined(DEVICE_TRNG) || defined(MBEDTLS_ENTROPY_NV_SEED) || defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
273260
mbedtls_entropy_context *entropy = new mbedtls_entropy_context;
274261
mbedtls_entropy_init(entropy);
275-
memset(output, 0, size);
262+
memset(key_buff, 0, actual_size);
276263

277-
ret = mbedtls_entropy_func(entropy, (unsigned char *)output, size);
264+
ret = mbedtls_entropy_func(entropy, (unsigned char *)key_buff, actual_size);
278265
if (ret != MBED_SUCCESS) {
279266
ret = DEVICEKEY_GENERATE_RANDOM_ERROR;
280267
} else {
@@ -283,7 +270,7 @@ int DeviceKey::generate_key_by_random(uint32_t *output, size_t size)
283270

284271
mbedtls_entropy_free(entropy);
285272
delete entropy;
286-
273+
ret = device_inject_root_of_trust(key_buff, actual_size);
287274
#endif
288275

289276
return ret;

‎features/device_key/source/DeviceKey.h

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,16 @@ class DeviceKey : private mbed::NonCopyable<DeviceKey> {
106106
* @return 0 on success, negative error code on failure
107107
*/
108108
int device_inject_root_of_trust(uint32_t *value, size_t isize);
109+
/** Generate Root of Trust.
110+
* Uses TRNG or various other entropy sources to generate random device key and
111+
* inject it into device's KVStore. Device Key can only be generated once.
112+
*
113+
* \return DEVICEKEY_SUCCESS, when device key successfully generated and injected.
114+
* \return DEVICEKEY_ALREADY_EXIST, if the key has already been written.
115+
* \return DEVICEKEY_GENERATE_RANDOM_ERROR if this device does not contain entropy sources and cannot generate a key.
116+
* \return error codes on other failures.
117+
*/
118+
int generate_root_of_trust();
109119

110120
private:
111121
// Private constructor, as class is a singleton
@@ -139,17 +149,6 @@ class DeviceKey : private mbed::NonCopyable<DeviceKey> {
139149
int get_derived_key(uint32_t *ikey_buff, size_t ikey_size, const unsigned char *isalt, size_t isalt_size,
140150
unsigned char *output, uint32_t ikey_type);
141151

142-
/** Generate a random ROT key by using entropy
143-
* @param output Output buffer for the generated key.
144-
* @param size Input: The size of the buffer. If size is less
145-
* than 16 bytes, the method generates an
146-
* error. 16-31 bytes creates a 16-byte key.
147-
* 32 or higher generates a 32-byte key
148-
* Output: The actual written size to the buffer
149-
* @return 0 on success, negative error code on failure
150-
*/
151-
int generate_key_by_random(uint32_t *output, size_t size);
152-
153152
};
154153

155154
/** @}*/

‎features/storage/TESTS/kvstore/general_tests_phase_1/main.cpp

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
#include "unity/unity.h"
2929
#include "utest/utest.h"
3030
#include "FileSystemStore.h"
31+
#include "DeviceKey.h"
3132

3233
using namespace utest::v1;
3334
using namespace mbed;
@@ -901,7 +902,9 @@ int main()
901902
total_num_cases++;
902903
}
903904
}
904-
905+
#if DEVICEKEY_ENABLED
906+
DeviceKey::get_instance().generate_root_of_trust();
907+
#endif
905908
Specification specification(greentea_test_setup, cases, total_num_cases,
906909
greentea_test_teardown_handler, default_handler);
907910

‎features/storage/TESTS/kvstore/general_tests_phase_2/main.cpp

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
#include "unity/unity.h"
2929
#include "utest/utest.h"
3030
#include "FileSystemStore.h"
31+
#include "DeviceKey.h"
3132

3233
using namespace utest::v1;
3334
using namespace mbed;
@@ -884,6 +885,9 @@ int main()
884885
}
885886
}
886887

888+
#if DEVICEKEY_ENABLED
889+
DeviceKey::get_instance().generate_root_of_trust();
890+
#endif
887891
Specification specification(greentea_test_setup, cases, total_num_cases,
888892
greentea_test_teardown_handler, default_handler);
889893

‎features/storage/TESTS/kvstore/securestore_whitebox/main.cpp

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
#include <stdlib.h>
3434
#include <stdio.h>
3535
#include <algorithm>
36+
#include "DeviceKey.h"
3637

3738
#if (!defined(TARGET_K64F) && !defined(TARGET_ARM_FM)) && !defined(TARGET_MCU_PSOC6) || !SECURESTORE_ENABLED
3839
#error [NOT_SUPPORTED] Kvstore API tests run only on K64F devices, Fastmodels, and PSoC 6. KVStore & SecureStore need to be enabled for this test
@@ -145,6 +146,9 @@ static void white_box_test()
145146
timer.reset();
146147
result = sec_kv->reset();
147148
TEST_ASSERT_EQUAL_ERROR_CODE(MBED_SUCCESS, result);
149+
#if DEVICEKEY_ENABLED
150+
DeviceKey::get_instance().generate_root_of_trust();
151+
#endif
148152
elapsed = timer.read_ms();
149153
printf("Elapsed time for reset is %d ms\n", elapsed);
150154

‎features/storage/TESTS/kvstore/static_tests/main.cpp

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
#include "unity/unity.h"
2424
#include "utest/utest.h"
2525
#include "kvstore_global_api.h"
26-
26+
#include "DeviceKey.h"
2727
#include <cstring>
2828

2929
using namespace utest::v1;
@@ -85,6 +85,9 @@ static void kvstore_init()
8585
init_res = kv_reset(def_kv);
8686
TEST_SKIP_UNLESS_MESSAGE(init_res != MBED_ERROR_UNSUPPORTED, "Unsupported configuration. Test skipped.");
8787
TEST_ASSERT_EQUAL_ERROR_CODE(MBED_SUCCESS, init_res);
88+
#if DEVICEKEY_ENABLED
89+
DeviceKey::get_instance().generate_root_of_trust();
90+
#endif
8891
}
8992

9093
/*----------------set()------------------*/
@@ -207,6 +210,9 @@ static void set_write_once_flag_try_remove()
207210

208211
res = kv_reset(def_kv);
209212
TEST_ASSERT_EQUAL_ERROR_CODE(MBED_SUCCESS, res);
213+
#if DEVICEKEY_ENABLED
214+
DeviceKey::get_instance().generate_root_of_trust();
215+
#endif
210216
}
211217

212218
//set key value one byte size
@@ -622,6 +628,9 @@ static void get_info_existed_key()
622628

623629
res = kv_reset(def_kv);
624630
TEST_ASSERT_EQUAL_ERROR_CODE(MBED_SUCCESS, res);
631+
#if DEVICEKEY_ENABLED
632+
DeviceKey::get_instance().generate_root_of_trust();
633+
#endif
625634
}
626635

627636
//get_info of overwritten key

0 commit comments

Comments
 (0)