clone/pico-hsm
1
0
Fork 0
mirror of https://github.com/polhenarejos/pico-hsm synced 2026-06-20 17:23:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Migrate PIN and MKEK to new system.

Browse Source 
This new system is more robust, with derived keys by context and safe in case of flash/ram dumps.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
This commit is contained in:
Pol Henarejos
2026-03-20 01:19:35 +01:00
parent 1f96fe619b
commit 75c56bb2c7
7 changed files with 136 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/hsm/cmd_reset_retry.c
View File

@@ -55,10 +55,6 @@ int cmd_reset_retry(void) {
}
newpin_len = (uint8_t)apdu.nc;
}
uint8_t dhash[33];
dhash[0] = newpin_len;
double_hash_pin(apdu.data + (apdu.nc - newpin_len), newpin_len, dhash + 1);
file_put_data(file_pin1, dhash, sizeof(dhash));
if (pin_reset_retries(file_pin1, true) != PICOKEY_OK) {
return SW_MEMORY_FAILURE();
}
@@ -67,13 +63,18 @@ int cmd_reset_retry(void) {
if (r != PICOKEY_OK) {
return SW_EXEC_ERROR();
}
hash_multi(apdu.data + (apdu.nc - newpin_len), newpin_len, session_pin);
pin_derive_session(apdu.data + (apdu.nc - newpin_len), newpin_len, session_pin);
has_session_pin = true;
r = store_mkek(mkek);
release_mkek(mkek);
if (r != PICOKEY_OK) {
return SW_EXEC_ERROR();
}
uint8_t dhash[34];
dhash[0] = newpin_len;
dhash[1] = 1; // Format
pin_derive_verifier(apdu.data + (apdu.nc - newpin_len), newpin_len, dhash + 2);
file_put_data(file_pin1, dhash, sizeof(dhash));
low_flash_available();
return SW_OK();
}