dearsky/pico-hsm
1
0
Fork 0
Code Issues 17 Pull Requests 4 Actions Packages Projects Releases 26 Wiki Activity
462 Commits 2 Branches 32 Tags
7b27cb7a1c477a47d05675cdd7afef1172a22f40
Commit Graph

462 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Pol Henarejos
7b27cb7a1c MKEK is also stored with SO encryption. 
A copy of MKEK is also stored but encrypted with SO-PIN. Thus, we always ensure that we have an operative copy of MKEK, either with PIN and/or SO-PIN. If user resets PIN, the MKEK is loaded with SO-PIN and stored with the derived key from new PIN.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 00:41:04 +02:00
Pol Henarejos
84a70a1de0 Adding MKEK_SO file descriptor. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 00:39:25 +02:00
Pol Henarejos
1756ec49ad When user resets retry counter and sends the SO-PIN (P1=0x0) it becomes authenticated in this session. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 00:29:34 +02:00
Pol Henarejos
7b286b04b1 Introducing MKEK (Master Key Encryption Key). 
MKEK is used to encrypt all keys in the device, regardless of Key Domains or DKEK. From now on, all keys are encrypted using an AES 256-bit secret key. MKEK is also encrypted and stored based on a derived key from PIN. When user introduces the PIN, the MKEK can be unlocked to load the stored private/secret keys.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 00:20:02 +02:00
Pol Henarejos
a731e88c78 Adding MKEK ef id. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-11 22:59:54 +02:00
Pol Henarejos
ffd31f2ea7 Memset kcv to 0 always when called. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-10 23:58:01 +02:00
Pol Henarejos
356eeea505 Added support for ECDH_XKEK. 
Note that it is unfinished. ECDH_XKEK is utilized for deriving and setting the KEK, based on the calc DH secret. It should not return anything, just SW_OK (this is not what is happening right now).

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-10 23:51:41 +02:00
Pol Henarejos
34d9469157 When creating XKEK domain, it returns key domain UID. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-10 23:29:08 +02:00
Pol Henarejos
36b1bf9875 Added ECDH algorithms for XKEK and AUT. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-10 23:28:44 +02:00
Pol Henarejos
7badd19a07 Upgrading PICO SDK to v1.4 and adding new boards. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-09 01:28:39 +02:00
Pol Henarejos
f122a9ab28 Upgrade to version 2.6. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
v2.6 		2022-08-09 00:42:58 +02:00
Pol Henarejos
14dbad4dd7 Do not return PIN unitialized if PKA is enabled. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-09 00:27:53 +02:00
Pol Henarejos
cdce9ab50b Adding pka_enabled() to check whether the device is configured with PKA. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-09 00:26:56 +02:00
Pol Henarejos
30d3270e1d Adding clarification on setting PKA and PIN with SCS3. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-09 00:26:35 +02:00
Pol Henarejos
157923decc Clafiricate docs about PKA and PIN 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-06 01:44:24 +02:00
Pol Henarejos
7bbcbc57eb Removing unnecessary debug. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-06 01:36:03 +02:00
Pol Henarejos
9074463f4e Added clarification on PKA and PIN 
DKEK is protected in the device with a derived key from the PIN number. Unfortunately, SCS3 does not support the combination of PKA and PIN but OpenSC does. This is explained here.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-06 01:27:51 +02:00
Pol Henarejos
3ebf4fdff5 User authentication is unlinked from session_pin 
Due to PUK Authentication, user authentication is not linked to having a valid session_pin anymore. In case of enabled PUK Auth, session_pin is used only for unlocking DKEK, but not for granting auth privileges, as they only are granted when PUK Auth succeeds.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-06 01:13:09 +02:00
Pol Henarejos
77e5fa2d2b Added static files for device key and certiticate. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-15 15:57:54 +02:00
Pol Henarejos
6bd2e65459 Add function for building PrKD asn1 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-15 15:38:11 +02:00
Pol Henarejos
3363e9ad0c Updating ccid. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-14 19:12:31 +02:00
Pol Henarejos
d1f0f45525 Added support for native PKCS1.5 and OEP decryption. 
It is not tested, as it is not supported by pkcs11 modules. For instance, OpenSSL implements OEP in local side, calling a RAW decryption on the device.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-14 17:00:23 +02:00
Pol Henarejos
efc1b4a4ae Fix meta deletion. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-14 16:45:06 +02:00
Pol Henarejos
a45303d9e6 Added support for specific purposes. Added support for SHA512 operations. 
Keys can only be used for the specific purpose provided during the keypair generation.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-14 16:12:04 +02:00
Pol Henarejos
871ff69f56 Fix critical bug. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
v2.4 		2022-06-14 11:46:44 +02:00
Pol Henarejos
d4b4289c0b Update extra_command.md 
Added explanation for Key usage counter.
 2022-06-14 11:27:49 +02:00
Pol Henarejos
32af000435 Upgrading to version 2.4. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-13 19:39:35 +02:00
Pol Henarejos
64178192ad Update README.md 
Added PKA description.
 2022-06-13 15:03:46 +02:00
Pol Henarejos
598752956f Update scs3.md 
Added macOS notes.
 2022-06-13 14:58:09 +02:00
Pol Henarejos
4dce0e5958 Update public_key_authentication.md 
Added screenshots.
 2022-06-13 14:33:33 +02:00
Pol Henarejos
9f02aef930 Add PKA doc. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-13 14:28:09 +02:00
Pol Henarejos
0c25b0968b Update scs3.md 
Added a patch.
 2022-06-13 11:59:28 +02:00
Pol Henarejos
ddc0bd7202 Updated SCS3 doc. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-13 11:57:33 +02:00
Pol Henarejos
20727e1508 Point to last checkout. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-12 18:10:59 +02:00
Pol Henarejos
3afc1964dc Store in dynamic memory PUK authentication. 
When a PUK is authenticated, session PIN is set to true.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-12 18:10:37 +02:00
Pol Henarejos
914020fd36 Added PUK authentication. 
Surprisingly, it works from the very beginning.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-12 17:43:50 +02:00
Pol Henarejos
168a8cd5a6 Fix selecting PUK for AUT. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-12 17:42:21 +02:00
Pol Henarejos
eb94ed7806 Separated routines for verifying and parsing CV certificates. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-10 20:04:48 +02:00
Pol Henarejos
db6b3ec427 Added select MSE for puk AUT. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-10 20:04:32 +02:00
Pol Henarejos
32d0cdcea7 Save cached challenge length. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-10 18:58:35 +02:00
Pol Henarejos
332fe8c884 Generated challenges are cached and dev_name (ESTERMXXXXX) based on terminal certificate. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-10 16:40:51 +02:00
Pol Henarejos
59f0cf7732 Fix CA certificates selection. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-10 16:33:53 +02:00
Pol Henarejos
b803505287 When a certificate is verified, the corresponding certificate description and the certificate are cached and saved. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-10 16:30:19 +02:00
Pol Henarejos
3542062ecd Added function to write the ASN1 certificate description. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-10 16:29:28 +02:00
Pol Henarejos
824c327a2c Added function to obtain EC params from root CA cert. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-10 16:28:55 +02:00
Pol Henarejos
76a41dffa1 Store all verified certificates (INS MSE) into CA_PREFIX files. 
When a certificate is sent for verification, it is always cached and saved onto a CA_PREFIX.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-10 11:59:06 +02:00
Pol Henarejos
65482cad9c Added dynamic public key references. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-10 11:09:39 +02:00
Pol Henarejos
a17a4c0a3c Finished key public registration. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-10 11:09:25 +02:00
Pol Henarejos
2437cf09d1 Added EF for PUKs 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-10 11:08:47 +02:00
Pol Henarejos
c4c394845d Updated pico-ccid. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-09 21:25:33 +02:00