dearsky/pico-hsm
1
0
Fork 0
Code Issues 17 Pull Requests 4 Actions Packages Projects Releases 26 Wiki Activity
781 Commits 2 Branches 32 Tags
685c7f25fc6dc2a968012e1129c0a160bacf6945
Commit Graph

360 Commits

Author SHA1 Message Date
Pol Henarejos
f631e4a5f3 Code style. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-07-17 12:56:16 +02:00
Pol Henarejos
f880ee6c93 Added support for HD symmetric ciphering. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-07-17 12:55:14 +02:00
Pol Henarejos
fe315e7326 Fix AES derivation (HKDF). 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-05-27 19:00:04 +02:00
Pol Henarejos
ee3ee21e40 Added support for signatures based on HD BIP/SLIP. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-05-26 18:07:06 +02:00
Pol Henarejos
29544a3f17 Added support for SLIP-0021 node derivation. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-05-26 17:15:14 +02:00
Pol Henarejos
5135404083 Fix node derivation. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-05-25 15:17:39 +02:00
Pol Henarejos
55520ce184 Added support for master key generation for symmetric derivation. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-05-25 14:07:48 +02:00
Pol Henarejos
525b05b7ef Small refactoring to avoid unnecessary casts from uint32 to byte strings. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-05-25 12:18:28 +02:00
Pol Henarejos
0eea0fb096 Fix deriving nodes with retries (invalid first key). 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-05-24 12:47:27 +02:00
Pol Henarejos
82c03ee6c4 Fix memory free on error. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-05-24 12:40:51 +02:00
Pol Henarejos
20dfbcaaed Fix xpub for masters. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-05-24 11:25:36 +02:00
Pol Henarejos
46d85c029e Added first commit with BIP and SLIP support for cryptowallets. 
Needs more work.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-05-23 20:40:16 +02:00
Pol Henarejos
6d3809a792 Allow signatures with device key. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-04-06 14:09:18 +02:00
Pol Henarejos
f22f58f983 Fix returning EOF when reading an element outside the size. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-04-06 14:08:43 +02:00
Pol Henarejos
405bf92e18 Added support for TokenInfo and StaticTokenInfo files. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-04-04 09:53:26 +02:00
Pol Henarejos
371ae93fcd Added support for AES CCM. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-23 19:20:33 +01:00
Pol Henarejos
f5e875a6b7 Added support for AES CTR. 
Note: the OID used by CTR does not exist.
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-23 18:47:32 +01:00
Pol Henarejos
4d647ba3c8 Add sanity check if wrong oid is provided. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-22 23:28:55 +01:00
Pol Henarejos
008db87fa7 Fix AES XTS call. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-22 23:28:22 +01:00
Pol Henarejos
17560034ec Fix AES extended encoding call. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-22 23:23:12 +01:00
Pol Henarejos
8b0d85fbd4 Fix PRKD generation for AES. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-22 22:57:15 +01:00
Pol Henarejos
3dcb2e9d70 A PRKD is generated on every key import, regardless it might be replaced later. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-22 22:56:55 +01:00
Pol Henarejos
0f12ff1c48 Added support for PRKD for AES. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-22 22:07:34 +01:00
Pol Henarejos
2a5fe1cc6d Added initialization with self-signed certificate. 
It will allow the initialization with OpenSC tool (sc-hsm-tool --initialize). However, it will not allow the use of card with SCS3, as it needs a PKI with trust chain. In this case, pico-hsm-tool.py shall be used for initialization.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-22 01:04:24 +01:00
Pol Henarejos
5e0f62265d Fix key size of terminal cert. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-20 21:41:38 +01:00
Pol Henarejos
0990805fb6 More code style. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-20 20:08:29 +01:00
Pol Henarejos
efba39adc5 Add SW_WRONG_DATA return on bad tag for Chachapoly. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-20 17:58:01 +01:00
Pol Henarejos
13755cb4d5 Fix buffer overflow when importing AES 512 key. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-20 17:06:06 +01:00
Pol Henarejos
a69d06b2d9 Fixed chachapoly crypt algorithm. 
It missed setkey function. So, no key was used at any moment.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-19 20:24:32 +01:00
Pol Henarejos
1c7bc18161 Added support for AES 512 bit key size. 
AES XTS uses two keys. Therefore, XTS with 2 AES 256 implies 64 bytes key length.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-19 20:22:40 +01:00
Pol Henarejos
86ce01cac2 Added AES XTS via AES_EXT command. 
Note that it requires 32 bytes or 64 bytes key length.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-19 19:42:37 +01:00
Pol Henarejos
9cb60ba420 Added AES ECB (insecure), CBC (with custom IV), OFB, CFB and GCM (with 16-byte tag) via AES_EXT command. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-19 19:34:34 +01:00
Pol Henarejos
99f1620e7d Fixes #22. 
SC-HSM returns the result with a 0x04 prepended. This comes from OpenSC but it is not clear the exact reason. 0x04 is usually for encoding uncompressed EC points but in that case it does not seem to make sense.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-18 18:40:27 +01:00
Pol Henarejos
132054c9b9 Public point is calculated everytime a private key is loaded. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-13 18:01:56 +01:00
Pol Henarejos
2a3b9b7474 Fix wrapping points. 
Now it uses mbedtls_ecp_point_write_binary() for better control.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-13 18:01:20 +01:00
Pol Henarejos
4e73723747 Fix checking key domain set. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-10 15:59:52 +01:00
Pol Henarejos
11e5338736 Check if key domain is not already initialized when initializing. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-09 20:09:32 +01:00
Pol Henarejos
3660120b11 Before wrapping, check if DKEK is properly configured. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-09 20:09:03 +01:00
Pol Henarejos
bee6a7bb92 Return error if a non-initialized key domain is deleted. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-09 18:27:47 +01:00
Pol Henarejos
ed674b379c Zeroize ecdh key. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-08 11:15:02 +01:00
Pol Henarejos
6aa8d37d07 If a key does not belong to any key domain, it cannot be wrapped. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-07 23:45:37 +01:00
Pol Henarejos
963456051e If public point is not found, it is computed automatically. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-07 23:45:10 +01:00
Pol Henarejos
d81b21695f If no key domain is found, 0 is used by default. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-07 23:15:50 +01:00
Pol Henarejos
51e9e6722e Reset puk status on failed authentication. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-07 23:14:55 +01:00
Pol Henarejos
ee73c6e781 Code style 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-07 17:28:23 +01:00
Pol Henarejos
2f63966c60 Fix checking status of PUK. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-07 15:55:59 +01:00
Pol Henarejos
e624f9ff72 Fix checking if PKU is enabled. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-07 11:15:07 +01:00
Pol Henarejos
fb4ff9424e Call reset puk store on init. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-07 11:14:42 +01:00
Pol Henarejos
63b245b858 Fix initialize with PUK store memory. 
Now it is cleared.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-07 11:14:13 +01:00
Pol Henarejos
3c160f69c0 Add DV cert to PUK store. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2023-03-06 00:40:31 +01:00