Skip to content

Commit 369328a

Browse files
hug-devhug-dev
authored
Merge pull request #144 from hug-dev/psa-tests
Add tests for operations edge cases
2 parents 7301ff4 + 0817223 commit 369328a

File tree

13 files changed

+736
-90
lines changed

13 files changed

+736
-90
lines changed

‎Cargo.lock

Lines changed: 78 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,12 @@ derivative = "1.0.3"
4040
version = "3.0.0"
4141

4242
[dev-dependencies]
43-
parsec-client-test = { git = "https://github.com/parallaxsecond/parsec-client-test", tag = "0.2.2" }
43+
parsec-client-test = { git = "https://github.com/parallaxsecond/parsec-client-test", tag = "0.3.0" }
4444
num_cpus = "1.10.1"
45+
picky-asn1-der = "0.2.2"
46+
picky-asn1 = "0.2.1"
47+
serde = { version = "1.0", features = ["derive"] }
48+
sha2 = "0.8.1"
4549

4650
[build-dependencies]
4751
bindgen = "0.50.0"

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,7 @@ This project uses the following third party crates:
141141
* flexi_logger (MIT and Apache-2.0)
142142
* lazy_static (MIT and Apache-2.0)
143143
* version (MIT and Apache-2.0)
144+
* sha2 (MIT and Apache-2.0)
144145

145146
This project uses the following third party libraries:
146147
* [**Mbed Crypto**](https://github.com/ARMmbed/mbed-crypto) (Apache-2.0)

‎src/providers/mbed_provider/mod.rs

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -278,7 +278,16 @@ impl Provide for MbedProvider {
278278
&mut local_ids_handle,
279279
)?;
280280

281-
let key_attrs = utils::convert_key_attributes(&key_attributes, key_id)?;
281+
let key_attrs = utils::convert_key_attributes(&key_attributes, key_id).or_else(|e| {
282+
remove_key_id(
283+
&key_triple,
284+
key_id,
285+
&mut *store_handle,
286+
&mut local_ids_handle,
287+
)?;
288+
error!("Failed converting key attributes.");
289+
Err(e)
290+
})?;
282291

283292
let _guard = self
284293
.key_handle_mutex
@@ -331,7 +340,16 @@ impl Provide for MbedProvider {
331340
&mut local_ids_handle,
332341
)?;
333342

334-
let key_attrs = utils::convert_key_attributes(&key_attributes, key_id)?;
343+
let key_attrs = utils::convert_key_attributes(&key_attributes, key_id).or_else(|e| {
344+
remove_key_id(
345+
&key_triple,
346+
key_id,
347+
&mut *store_handle,
348+
&mut local_ids_handle,
349+
)?;
350+
error!("Failed converting key attributes.");
351+
Err(e)
352+
})?;
335353

336354
let _guard = self
337355
.key_handle_mutex

‎src/providers/mbed_provider/utils.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,11 +114,11 @@ pub fn convert_key_usage(operation: &psa_key_attributes::UsageFlags) -> psa_key_
114114
usage |= PSA_KEY_USAGE_EXPORT;
115115
}
116116

117-
if operation.sign_message || operation.sign_hash {
117+
if operation.sign_message && operation.sign_hash {
118118
usage |= PSA_KEY_USAGE_SIGN;
119119
}
120120

121-
if operation.verify_message || operation.verify_hash {
121+
if operation.verify_message && operation.verify_hash {
122122
usage |= PSA_KEY_USAGE_VERIFY;
123123
}
124124

‎src/providers/pkcs11_provider/mod.rs

Lines changed: 38 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -632,6 +632,11 @@ impl Provide for Pkcs11Provider {
632632

633633
let modulus_object = &public_key.modulus.as_unsigned_bytes_be();
634634
let exponent_object = &public_key.public_exponent.as_unsigned_bytes_be();
635+
let key_bits = key_attributes.key_bits;
636+
if key_bits != 0 && modulus_object.len() * 8 != key_bits as usize {
637+
error!("If the key_bits field is non-zero (value is {}) it must be equal to the size of the key in data.", key_attributes.key_bits);
638+
return Err(ResponseStatus::PsaErrorInvalidArgument);
639+
}
635640

636641
template.push(
637642
CK_ATTRIBUTE::new(pkcs11::types::CKA_CLASS)
@@ -711,9 +716,7 @@ impl Provide for Pkcs11Provider {
711716
let key_name = op.key_name;
712717
let key_triple = KeyTriple::new(app_name, ProviderID::Pkcs11, key_name);
713718
let store_handle = self.key_id_store.read().expect("Key store lock poisoned");
714-
let (key_id, key_attributes) = get_key_id(&key_triple, &*store_handle)?;
715-
716-
key_attributes.can_export()?;
719+
let (key_id, _key_attributes) = get_key_id(&key_triple, &*store_handle)?;
717720

718721
let session = Session::new(self, ReadWriteSession::ReadOnly)?;
719722
info!(
@@ -869,8 +872,8 @@ impl Provide for Pkcs11Provider {
869872
info!("Pkcs11 Provider - Asym Sign");
870873

871874
let key_name = op.key_name;
872-
let alg = op.alg;
873875
let mut hash = op.hash;
876+
let alg = op.alg;
874877
let key_triple = KeyTriple::new(app_name, ProviderID::Pkcs11, key_name);
875878
let store_handle = self.key_id_store.read().expect("Key store lock poisoned");
876879
let (key_id, key_attributes) = get_key_id(&key_triple, &*store_handle)?;
@@ -890,17 +893,27 @@ impl Provide for Pkcs11Provider {
890893
}
891894
}
892895

896+
if alg
897+
!= (AsymmetricSignature::RsaPkcs1v15Sign {
898+
hash_alg: Hash::Sha256,
899+
})
900+
{
901+
error!(
902+
"The PKCS 11 provider currently only supports signature algorithm to be RSA PKCS#1 v1.5 and the text hashed with SHA-256.");
903+
return Err(ResponseStatus::PsaErrorNotSupported);
904+
}
905+
906+
if hash.len() != 32 {
907+
error!("The SHA-256 hash must be 32 bytes long.");
908+
return Err(ResponseStatus::PsaErrorInvalidArgument);
909+
}
910+
893911
let mech = CK_MECHANISM {
894912
mechanism: pkcs11::types::CKM_RSA_PKCS,
895913
pParameter: std::ptr::null_mut(),
896914
ulParameterLen: 0,
897915
};
898916

899-
if hash.len() != 32 {
900-
error!("The PKCS11 provider currently only supports 256 bits long digests.");
901-
return Err(ResponseStatus::PsaErrorNotSupported);
902-
}
903-
904917
let session = Session::new(self, ReadWriteSession::ReadWrite)?;
905918
info!("Asymmetric sign in session {}", session.session_handle());
906919

@@ -946,9 +959,9 @@ impl Provide for Pkcs11Provider {
946959
info!("Pkcs11 Provider - Asym Verify");
947960

948961
let key_name = op.key_name;
949-
let alg = op.alg;
950962
let mut hash = op.hash;
951963
let signature = op.signature;
964+
let alg = op.alg;
952965
let key_triple = KeyTriple::new(app_name, ProviderID::Pkcs11, key_name);
953966
let store_handle = self.key_id_store.read().expect("Key store lock poisoned");
954967
let (key_id, key_attributes) = get_key_id(&key_triple, &*store_handle)?;
@@ -968,18 +981,28 @@ impl Provide for Pkcs11Provider {
968981
}
969982
}
970983

984+
if alg
985+
!= (AsymmetricSignature::RsaPkcs1v15Sign {
986+
hash_alg: Hash::Sha256,
987+
})
988+
{
989+
error!(
990+
"The PKCS 11 provider currently only supports signature algorithm to be RSA PKCS#1 v1.5 and the text hashed with SHA-256.");
991+
return Err(ResponseStatus::PsaErrorNotSupported);
992+
}
993+
994+
if hash.len() != 32 {
995+
error!("The SHA-256 hash must be 32 bytes long.");
996+
return Err(ResponseStatus::PsaErrorInvalidArgument);
997+
}
998+
971999
let mech = CK_MECHANISM {
9721000
// Verify without hashing.
9731001
mechanism: pkcs11::types::CKM_RSA_PKCS,
9741002
pParameter: std::ptr::null_mut(),
9751003
ulParameterLen: 0,
9761004
};
9771005

978-
if hash.len() != 32 {
979-
error!("The PKCS11 provider currently only supports 256 bits long digests.");
980-
return Err(ResponseStatus::PsaErrorNotSupported);
981-
}
982-
9831006
let session = Session::new(self, ReadWriteSession::ReadWrite)?;
9841007
info!("Asymmetric verify in session {}", session.session_handle());
9851008

‎src/providers/tpm_provider/mod.rs

Lines changed: 32 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -251,8 +251,14 @@ impl Provide for TpmProvider {
251251
return Err(ResponseStatus::PsaErrorNotSupported);
252252
}
253253
let key_data = public_key.modulus.as_unsigned_bytes_be();
254-
255254
let len = key_data.len();
255+
256+
let key_bits = attributes.key_bits;
257+
if key_bits != 0 && len * 8 != key_bits as usize {
258+
error!("If the key_bits field is non-zero (value is {}) it must be equal to the size of the key in data.", attributes.key_bits);
259+
return Err(ResponseStatus::PsaErrorInvalidArgument);
260+
}
261+
256262
if len != 128 && len != 256 {
257263
error!(
258264
"The TPM provider only supports 1024 and 2048 bits RSA public keys ({} bits given).",
@@ -295,9 +301,7 @@ impl Provide for TpmProvider {
295301
.lock()
296302
.expect("ESAPI Context lock poisoned");
297303

298-
let (password_context, key_attributes) = get_password_context(&*store_handle, key_triple)?;
299-
300-
key_attributes.can_export()?;
304+
let (password_context, _key_attributes) = get_password_context(&*store_handle, key_triple)?;
301305

302306
let pub_key_data = esapi_context
303307
.read_public_key(password_context.context)
@@ -361,12 +365,21 @@ impl Provide for TpmProvider {
361365
.lock()
362366
.expect("ESAPI Context lock poisoned");
363367

364-
let len = hash.len();
365-
if len > 64 {
366-
error!("The buffer given to sign is too big. Its length is {} and maximum authorised in the TPM provider is 64.", len);
368+
if alg
369+
!= (AsymmetricSignature::RsaPkcs1v15Sign {
370+
hash_alg: Hash::Sha256,
371+
})
372+
{
373+
error!(
374+
"The TPM provider currently only supports signature algorithm to be RSA PKCS#1 v1.5 and the text hashed with SHA-256.");
367375
return Err(ResponseStatus::PsaErrorNotSupported);
368376
}
369377

378+
if hash.len() != 32 {
379+
error!("The SHA-256 hash must be 32 bytes long.");
380+
return Err(ResponseStatus::PsaErrorInvalidArgument);
381+
}
382+
370383
let (password_context, key_attributes) = get_password_context(&*store_handle, key_triple)?;
371384

372385
key_attributes.can_sign_hash()?;
@@ -417,12 +430,21 @@ impl Provide for TpmProvider {
417430
.lock()
418431
.expect("ESAPI Context lock poisoned");
419432

420-
let len = hash.len();
421-
if len > 64 {
422-
error!("The buffer given to sign is too big. Its length is {} and maximum authorised is 64 in the TPM provider.", len);
433+
if alg
434+
!= (AsymmetricSignature::RsaPkcs1v15Sign {
435+
hash_alg: Hash::Sha256,
436+
})
437+
{
438+
error!(
439+
"The TPM provider currently only supports signature algorithm to be RSA PKCS#1 v1.5 and the text hashed with SHA-256.");
423440
return Err(ResponseStatus::PsaErrorNotSupported);
424441
}
425442

443+
if hash.len() != 32 {
444+
error!("The SHA-256 hash must be 32 bytes long.");
445+
return Err(ResponseStatus::PsaErrorInvalidArgument);
446+
}
447+
426448
let signature = Signature {
427449
scheme: AsymSchemeUnion::RSASSA(TPM2_ALG_SHA256),
428450
signature,

0 commit comments

Comments
 (0)