diff --git a/CMakeLists.txt b/CMakeLists.txt index a5171d6..136ac3d 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -48,10 +48,10 @@ endif() set(USB_ITF_CCID 1) set(USB_ITF_WCID 1) -include(pico-keys-sdk/pico_keys_sdk_import.cmake) +include(pico-keys-sdk/picokeys_sdk_import.cmake) if(NOT ESP_PLATFORM) - set(SOURCES ${PICO_KEYS_SOURCES}) + set(SOURCES ${PICOKEYS_SOURCES}) endif() set(SOURCES ${SOURCES} ${CMAKE_CURRENT_LIST_DIR}/src/openpgp/openpgp.c @@ -99,7 +99,7 @@ if(NOT ESP_PLATFORM) ) target_compile_options(pico_openpgp PRIVATE ${COMMON_COMPILE_OPTIONS}) - pico_keys_apply_strict_flags( + picokeys_apply_strict_flags( SOURCES ${SOURCES} FILTER_REGEX "/src/openpgp/|/pico-keys-sdk/src/|/pico-keys-sdk/config/" ) @@ -135,7 +135,7 @@ if(NOT ESP_PLATFORM) -Wl,--gc-sections ) endif(APPLE) - target_link_libraries(pico_openpgp PRIVATE pico_keys_sdk mbedtls pthread m) + target_link_libraries(pico_openpgp PRIVATE picokeys_sdk mbedtls pthread m) else() pico_add_extra_outputs(${CMAKE_PROJECT_NAME}) endif() diff --git a/pico-keys-sdk b/pico-keys-sdk index 44ee025..e7be117 160000 --- a/pico-keys-sdk +++ b/pico-keys-sdk @@ -1 +1 @@ -Subproject commit 44ee0254165d6338e27e6739c19c648f83b5c6c9 +Subproject commit e7be1171dacab7dbb8569bef9b9d91c930ad9ab8 diff --git a/src/openpgp/cmd_change_pin.c b/src/openpgp/cmd_change_pin.c index 16cef6f..cb196f1 100644 --- a/src/openpgp/cmd_change_pin.c +++ b/src/openpgp/cmd_change_pin.c @@ -24,7 +24,7 @@ int cmd_change_pin(void) { } uint16_t fid = 0x1000 | P2(apdu); file_t *pw; - if (!(pw = search_by_fid(fid, NULL, SPECIFY_EF))) { + if (!(pw = file_search_by_fid(fid, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } uint8_t pin_len = file_get_data(pw)[0]; @@ -33,7 +33,7 @@ int cmd_change_pin(void) { if (r != 0x9000) { return r; } - if ((r = load_dek()) != PICOKEY_OK) { + if ((r = load_dek()) != PICOKEYS_OK) { return SW_EXEC_ERROR(); } @@ -44,7 +44,7 @@ int cmd_change_pin(void) { file_put_data(pw, dhash, sizeof(dhash)); if (P2(apdu) == 0x81) { - file_t *tf = search_by_fid(EF_DEK_PW1, NULL, SPECIFY_EF); + file_t *tf = file_search_by_fid(EF_DEK_PW1, NULL, SPECIFY_EF); if (!tf) { return SW_REFERENCE_NOT_FOUND(); } @@ -55,7 +55,7 @@ int cmd_change_pin(void) { r = file_put_data(tf, def, sizeof(def)); } else if (P2(apdu) == 0x83) { - file_t *tf = search_by_fid(EF_DEK_PW3, NULL, SPECIFY_EF); + file_t *tf = file_search_by_fid(EF_DEK_PW3, NULL, SPECIFY_EF); if (!tf) { return SW_REFERENCE_NOT_FOUND(); } @@ -65,6 +65,6 @@ int cmd_change_pin(void) { encrypt_with_aad(session_pw3, dek, DEK_SIZE, PIN_KDF_DEFAULT_VERSION, def + 1); r = file_put_data(tf, def, sizeof(def)); } - low_flash_available(); + flash_commit(); return SW_OK(); } diff --git a/src/openpgp/cmd_get_data.c b/src/openpgp/cmd_get_data.c index dc054b2..5a03ff5 100644 --- a/src/openpgp/cmd_get_data.c +++ b/src/openpgp/cmd_get_data.c @@ -26,7 +26,7 @@ int cmd_get_data(void) { } uint16_t fid = (P1(apdu) << 8) | P2(apdu); file_t *ef; - if (!(ef = search_by_fid(fid, NULL, SPECIFY_EF))) { + if (!(ef = file_search_by_fid(fid, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } if (fid == EF_PRIV_DO_3) { @@ -39,7 +39,7 @@ int cmd_get_data(void) { return SW_SECURITY_STATUS_NOT_SATISFIED(); } } - else if (!authenticate_action(ef, ACL_OP_READ_SEARCH)) { + else if (!file_authenticate_action(ef, ACL_OP_READ_SEARCH)) { return SW_SECURITY_STATUS_NOT_SATISFIED(); } if (currentEF && currentEF->fid == fid) { // previously selected same EF @@ -124,17 +124,17 @@ int cmd_get_next_data(void) { return SW_RECORD_NOT_FOUND(); } uint16_t fid = (P1(apdu) << 8) | P2(apdu); - if (!(ef = search_by_fid(fid, NULL, SPECIFY_EF))) { + if (!(ef = file_search_by_fid(fid, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } - if (!authenticate_action(ef, ACL_OP_UPDATE_ERASE)) { + if (!file_authenticate_action(ef, ACL_OP_UPDATE_ERASE)) { return SW_SECURITY_STATUS_NOT_SATISFIED(); } if ((currentEF->fid & 0x1FF0) != (fid & 0x1FF0)) { return SW_WRONG_P1P2(); } fid = currentEF->fid + 1; //curentEF contains private DO. so, we select the next one - if (!(ef = search_by_fid(fid, NULL, SPECIFY_EF))) { + if (!(ef = file_search_by_fid(fid, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } select_file(ef); diff --git a/src/openpgp/cmd_import_data.c b/src/openpgp/cmd_import_data.c index be1dbd4..56ae1af 100644 --- a/src/openpgp/cmd_import_data.c +++ b/src/openpgp/cmd_import_data.c @@ -65,10 +65,10 @@ int cmd_import_data(void) { return SW_WRONG_DATA(); } start++; - if (!(ef = search_by_fid(fid, NULL, SPECIFY_EF))) { + if (!(ef = file_search_by_fid(fid, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } - if (!authenticate_action(ef, ACL_OP_UPDATE_ERASE)) { + if (!file_authenticate_action(ef, ACL_OP_UPDATE_ERASE)) { return SW_SECURITY_STATUS_NOT_SATISFIED(); } start += (*start + 1); @@ -99,7 +99,7 @@ int cmd_import_data(void) { } } - file_t *algo_ef = search_by_fid(fid - 0x0010, NULL, SPECIFY_EF); + file_t *algo_ef = file_search_by_fid(fid - 0x0010, NULL, SPECIFY_EF); if (!algo_ef) { return SW_REFERENCE_NOT_FOUND(); } @@ -150,7 +150,7 @@ int cmd_import_data(void) { r = store_keys(&rsa, ALGO_RSA, fid, true); make_rsa_response(&rsa); mbedtls_rsa_free(&rsa); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_EXEC_ERROR(); } } @@ -177,12 +177,12 @@ int cmd_import_data(void) { } #ifdef MBEDTLS_EDDSA_C if (ecdsa.grp.id == MBEDTLS_ECP_DP_ED25519) { - r = mbedtls_ecp_point_edwards(&ecdsa.grp, &ecdsa.Q, &ecdsa.d, random_gen, NULL); + r = mbedtls_ecp_point_edwards(&ecdsa.grp, &ecdsa.Q, &ecdsa.d, random_fill_iterator, NULL); } else #endif { - r = mbedtls_ecp_mul(&ecdsa.grp, &ecdsa.Q, &ecdsa.d, &ecdsa.grp.G, random_gen, NULL); + r = mbedtls_ecp_mul(&ecdsa.grp, &ecdsa.Q, &ecdsa.d, &ecdsa.grp.G, random_fill_iterator, NULL); } if (r != 0) { mbedtls_ecp_keypair_free(&ecdsa); @@ -191,7 +191,7 @@ int cmd_import_data(void) { r = store_keys(&ecdsa, ALGO_ECDSA, fid, true); make_ecdsa_response(&ecdsa); mbedtls_ecp_keypair_free(&ecdsa); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_EXEC_ERROR(); } } @@ -201,12 +201,12 @@ int cmd_import_data(void) { if (fid == EF_PK_SIG) { reset_sig_count(); } - file_t *pbef = search_by_fid(fid + 3, NULL, SPECIFY_EF); + file_t *pbef = file_search_by_fid(fid + 3, NULL, SPECIFY_EF); if (!pbef) { return SW_REFERENCE_NOT_FOUND(); } r = file_put_data(pbef, res_APDU, res_APDU_size); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_EXEC_ERROR(); } res_APDU_size = 0; //make_*_response sets a response. we need to overwrite diff --git a/src/openpgp/cmd_internal_aut.c b/src/openpgp/cmd_internal_aut.c index 9d4ee65..98cd117 100644 --- a/src/openpgp/cmd_internal_aut.c +++ b/src/openpgp/cmd_internal_aut.c @@ -25,7 +25,7 @@ int cmd_internal_aut(void) { if (!has_pw3 && !has_pw2) { return SW_SECURITY_STATUS_NOT_SATISFIED(); } - file_t *algo_ef = search_by_fid(algo_aut, NULL, SPECIFY_EF); + file_t *algo_ef = file_search_by_fid(algo_aut, NULL, SPECIFY_EF); if (!algo_ef) { return SW_REFERENCE_NOT_FOUND(); } @@ -33,19 +33,19 @@ int cmd_internal_aut(void) { if (algo_ef && algo_ef->data) { algo = file_get_data(algo_ef); } - file_t *ef = search_by_fid(pk_aut, NULL, SPECIFY_EF); + file_t *ef = file_search_by_fid(pk_aut, NULL, SPECIFY_EF); if (!ef) { return SW_REFERENCE_NOT_FOUND(); } if (wait_button_pressed_fid(EF_UIF_AUT) == true) { return SW_SECURE_MESSAGE_EXEC_ERROR(); } - int r = PICOKEY_OK; + int r = PICOKEYS_OK; if (algo[0] == ALGO_RSA) { mbedtls_rsa_context ctx; mbedtls_rsa_init(&ctx); r = load_private_key_rsa(&ctx, ef, true); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { mbedtls_rsa_free(&ctx); return SW_EXEC_ERROR(); } @@ -61,7 +61,7 @@ int cmd_internal_aut(void) { mbedtls_ecp_keypair ctx; mbedtls_ecp_keypair_init(&ctx); r = load_private_key_ecdsa(&ctx, ef, true); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { mbedtls_ecp_keypair_free(&ctx); return SW_EXEC_ERROR(); } diff --git a/src/openpgp/cmd_keypair_gen.c b/src/openpgp/cmd_keypair_gen.c index a334aca..3bf368a 100644 --- a/src/openpgp/cmd_keypair_gen.c +++ b/src/openpgp/cmd_keypair_gen.c @@ -15,6 +15,7 @@ * along with this program. If not, see . */ +#include #include "openpgp.h" #include "do.h" #include "random.h" @@ -31,7 +32,7 @@ int cmd_keypair_gen(void) { } uint16_t fid = 0x0; - int r = PICOKEY_OK; + int r = PICOKEYS_OK; if (apdu.data[0] == 0xB6) { fid = EF_PK_SIG; } @@ -45,7 +46,7 @@ int cmd_keypair_gen(void) { return SW_WRONG_DATA(); } - file_t *algo_ef = search_by_fid(fid - 0x0010, NULL, SPECIFY_EF); + file_t *algo_ef = file_search_by_fid(fid - 0x0010, NULL, SPECIFY_EF); if (!algo_ef) { return SW_REFERENCE_NOT_FOUND(); } @@ -63,8 +64,7 @@ int cmd_keypair_gen(void) { // return SW_FUNC_NOT_SUPPORTED(); mbedtls_rsa_context rsa; mbedtls_rsa_init(&rsa); - uint8_t index = 0; - r = mbedtls_rsa_gen_key(&rsa, random_gen, &index, nlen, exponent); + r = mbedtls_rsa_gen_key(&rsa, random_fill_iterator, NULL, nlen, exponent); if (r != 0) { mbedtls_rsa_free(&rsa); return SW_EXEC_ERROR(); @@ -72,7 +72,7 @@ int cmd_keypair_gen(void) { r = store_keys(&rsa, ALGO_RSA, fid, true); make_rsa_response(&rsa); mbedtls_rsa_free(&rsa); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_EXEC_ERROR(); } } @@ -84,8 +84,7 @@ int cmd_keypair_gen(void) { } mbedtls_ecp_keypair ecdsa; mbedtls_ecp_keypair_init(&ecdsa); - uint8_t index = 0; - r = mbedtls_ecdsa_genkey(&ecdsa, gid, random_gen, &index); + r = mbedtls_ecdsa_genkey(&ecdsa, gid, random_fill_iterator, NULL); if (r != 0) { mbedtls_ecp_keypair_free(&ecdsa); return SW_EXEC_ERROR(); @@ -93,19 +92,19 @@ int cmd_keypair_gen(void) { r = store_keys(&ecdsa, algo[0], fid, true); make_ecdsa_response(&ecdsa); mbedtls_ecp_keypair_free(&ecdsa); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_EXEC_ERROR(); } } else { return SW_FUNC_NOT_SUPPORTED(); } - file_t *pbef = search_by_fid(fid + 3, NULL, SPECIFY_EF); + file_t *pbef = file_search_by_fid(fid + 3, NULL, SPECIFY_EF); if (!pbef) { return SW_REFERENCE_NOT_FOUND(); } r = file_put_data(pbef, res_APDU, res_APDU_size); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_EXEC_ERROR(); } if (fid == EF_PK_SIG) { @@ -119,14 +118,14 @@ int cmd_keypair_gen(void) { memcpy(aes_key, random_bytes_get(key_size), key_size); r = store_keys(aes_key, ALGO_AES_256, EF_AES_KEY, true); /* if storing the key fails, we silently continue */ - //if (r != PICOKEY_OK) + //if (r != PICOKEYS_OK) // return SW_EXEC_ERROR(); } - low_flash_available(); + flash_commit(); return SW_OK(); } else if (P1(apdu) == 0x81) { //read - file_t *ef = search_by_fid(fid + 3, NULL, SPECIFY_EF); + file_t *ef = file_search_by_fid(fid + 3, NULL, SPECIFY_EF); if (!file_has_data(ef)) { return SW_REFERENCE_NOT_FOUND(); } diff --git a/src/openpgp/cmd_pso.c b/src/openpgp/cmd_pso.c index d922040..af7fc83 100644 --- a/src/openpgp/cmd_pso.c +++ b/src/openpgp/cmd_pso.c @@ -45,7 +45,7 @@ int cmd_pso(void) { else { return SW_INCORRECT_P1P2(); } - file_t *algo_ef = search_by_fid(algo_fid, NULL, SPECIFY_EF); + file_t *algo_ef = file_search_by_fid(algo_fid, NULL, SPECIFY_EF); if (!algo_ef) { return SW_REFERENCE_NOT_FOUND(); } @@ -60,35 +60,35 @@ int cmd_pso(void) { is_aes = true; } } - file_t *ef = search_by_fid(pk_fid, NULL, SPECIFY_EF); + file_t *ef = file_search_by_fid(pk_fid, NULL, SPECIFY_EF); if (!ef) { return SW_REFERENCE_NOT_FOUND(); } if (wait_button_pressed_fid(pk_fid == EF_PK_SIG ? EF_UIF_SIG : EF_UIF_DEC) == true) { return SW_SECURE_MESSAGE_EXEC_ERROR(); } - int r = PICOKEY_OK; + int r = PICOKEYS_OK; size_t key_size = file_get_size(ef); if (is_aes) { uint8_t aes_key[32]; r = load_aes_key(aes_key, ef); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { memset(aes_key, 0, sizeof(aes_key)); return SW_EXEC_ERROR(); } if (P1(apdu) == 0x80 && P2(apdu) == 0x86) { //decipher - r = aes_decrypt(aes_key, NULL, key_size, PICO_KEYS_AES_MODE_CBC, apdu.data + 1, apdu.nc - 1); + r = aes_decrypt(aes_key, NULL, key_size, PICOKEYS_AES_MODE_CBC, apdu.data + 1, apdu.nc - 1); memset(aes_key, 0, sizeof(aes_key)); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_EXEC_ERROR(); } memcpy(res_APDU, apdu.data + 1, apdu.nc - 1); res_APDU_size = apdu.nc - 1; } else if (P1(apdu) == 0x86 && P2(apdu) == 0x80) { //encipher - r = aes_encrypt(aes_key, NULL, key_size, PICO_KEYS_AES_MODE_CBC, apdu.data, apdu.nc); + r = aes_encrypt(aes_key, NULL, key_size, PICOKEYS_AES_MODE_CBC, apdu.data, apdu.nc); memset(aes_key, 0, sizeof(aes_key)); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_EXEC_ERROR(); } res_APDU[0] = 0x2; @@ -101,7 +101,7 @@ int cmd_pso(void) { mbedtls_rsa_context ctx; mbedtls_rsa_init(&ctx); r = load_private_key_rsa(&ctx, ef, true); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { mbedtls_rsa_free(&ctx); return SW_EXEC_ERROR(); } @@ -121,13 +121,7 @@ int cmd_pso(void) { memset(apdu.data + apdu.nc, 0, key_size - apdu.nc); } size_t olen = 0; - r = mbedtls_rsa_pkcs1_decrypt(&ctx, - random_gen, - NULL, - &olen, - apdu.data + 1, - res_APDU, - key_size); + r = mbedtls_rsa_pkcs1_decrypt(&ctx, random_fill_iterator, NULL, &olen, apdu.data + 1, res_APDU, key_size); mbedtls_rsa_free(&ctx); if (r != 0) { return SW_EXEC_ERROR(); @@ -140,7 +134,7 @@ int cmd_pso(void) { mbedtls_ecp_keypair ctx; mbedtls_ecp_keypair_init(&ctx); r = load_private_key_ecdsa(&ctx, ef, true); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { mbedtls_ecp_keypair_free(&ctx); return SW_EXEC_ERROR(); } @@ -193,12 +187,7 @@ int cmd_pso(void) { return SW_DATA_INVALID(); } size_t olen = 0; - r = mbedtls_ecdh_calc_secret(&ctx, - &olen, - res_APDU, - MBEDTLS_ECP_MAX_BYTES, - random_gen, - NULL); + r = mbedtls_ecdh_calc_secret(&ctx, &olen, res_APDU, MBEDTLS_ECP_MAX_BYTES, random_fill_iterator, NULL); if (r != 0) { mbedtls_ecdh_free(&ctx); return SW_EXEC_ERROR(); diff --git a/src/openpgp/cmd_put_data.c b/src/openpgp/cmd_put_data.c index 13b6595..d6d4034 100644 --- a/src/openpgp/cmd_put_data.c +++ b/src/openpgp/cmd_put_data.c @@ -26,10 +26,10 @@ int cmd_put_data(void) { else if (fid == EF_ALGO_SIG || fid == EF_ALGO_DEC || fid == EF_ALGO_AUT) { fid |= 0x1000; } - if (!(ef = search_by_fid(fid, NULL, SPECIFY_EF))) { + if (!(ef = file_search_by_fid(fid, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } - if (!authenticate_action(ef, ACL_OP_UPDATE_ERASE)) { + if (!file_authenticate_action(ef, ACL_OP_UPDATE_ERASE)) { return SW_SECURITY_STATUS_NOT_SATISFIED(); } if ((fid == EF_PRIV_DO_1 || fid == EF_PRIV_DO_3) && (!has_pw2 && !has_pw3)) { @@ -50,7 +50,7 @@ int cmd_put_data(void) { if (apdu.nc > 0) { if (fid == EF_RC) { has_rc = false; - if ((r = load_dek()) != PICOKEY_OK) { + if ((r = load_dek()) != PICOKEYS_OK) { return SW_EXEC_ERROR(); } uint8_t dhash[34]; @@ -59,7 +59,7 @@ int cmd_put_data(void) { pin_derive_verifier(apdu.data, apdu.nc, dhash + 2); file_put_data(ef, dhash, sizeof(dhash)); - file_t *tf = search_by_fid(EF_DEK, NULL, SPECIFY_EF); + file_t *tf = file_search_by_fid(EF_DEK, NULL, SPECIFY_EF); if (!tf) { return SW_REFERENCE_NOT_FOUND(); } @@ -73,13 +73,13 @@ int cmd_put_data(void) { else { r = file_put_data(ef, apdu.data, apdu.nc); } - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_MEMORY_FAILURE(); } - low_flash_available(); + flash_commit(); } else { - delete_file(ef); + file_delete(ef); } } return SW_OK(); diff --git a/src/openpgp/cmd_reset_retry.c b/src/openpgp/cmd_reset_retry.c index 9f21285..e30d497 100644 --- a/src/openpgp/cmd_reset_retry.c +++ b/src/openpgp/cmd_reset_retry.c @@ -26,12 +26,12 @@ int cmd_reset_retry(void) { int newpin_len = 0; file_t *pw = NULL; has_pw1 = false; - if (!(pw = search_by_fid(EF_PW1, NULL, SPECIFY_EF))) { + if (!(pw = file_search_by_fid(EF_PW1, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } if (P1(apdu) == 0x0) { file_t *rc; - if (!(rc = search_by_fid(EF_RC, NULL, SPECIFY_EF))) { + if (!(rc = file_search_by_fid(EF_RC, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } uint8_t pin_len = file_get_data(rc)[0]; @@ -55,10 +55,10 @@ int cmd_reset_retry(void) { newpin_len = apdu.nc; } int r = 0; - if ((r = load_dek()) != PICOKEY_OK) { + if ((r = load_dek()) != PICOKEYS_OK) { return SW_EXEC_ERROR(); } - file_t *tf = search_by_fid(EF_DEK_PW1, NULL, SPECIFY_EF); + file_t *tf = file_search_by_fid(EF_DEK_PW1, NULL, SPECIFY_EF); if (!tf) { return SW_REFERENCE_NOT_FOUND(); } @@ -73,11 +73,11 @@ int cmd_reset_retry(void) { dhash[1] = 0x1; // Format pin_derive_verifier(apdu.data + (apdu.nc - newpin_len), newpin_len, dhash + 2); file_put_data(pw, dhash, sizeof(dhash)); - if (pin_reset_retries(pw, true) != PICOKEY_OK) { + if (pin_reset_retries(pw, true) != PICOKEYS_OK) { return SW_MEMORY_FAILURE(); } - low_flash_available(); - if ((r = load_dek()) != PICOKEY_OK) { + flash_commit(); + if ((r = load_dek()) != PICOKEYS_OK) { return SW_EXEC_ERROR(); } return SW_OK(); diff --git a/src/openpgp/cmd_select.c b/src/openpgp/cmd_select.c index 32d1e4b..f1a4da5 100644 --- a/src/openpgp/cmd_select.c +++ b/src/openpgp/cmd_select.c @@ -24,7 +24,7 @@ int cmd_select(void) { uint16_t fid = 0x0; if (apdu.nc >= 2) { - fid = get_uint16_t_be(apdu.data); + fid = get_uint16_be(apdu.data); } if (!pe) { @@ -34,18 +34,18 @@ int cmd_select(void) { //ac_fini(); } else if (apdu.nc == 2) { - if (!(pe = search_by_fid(fid, NULL, SPECIFY_ANY))) { + if (!(pe = file_search_by_fid(fid, NULL, SPECIFY_ANY))) { return SW_REFERENCE_NOT_FOUND(); } } } else if (p1 == 0x01) { //Select child DF - DF identifier - if (!(pe = search_by_fid(fid, currentDF, SPECIFY_DF))) { + if (!(pe = file_search_by_fid(fid, currentDF, SPECIFY_DF))) { return SW_REFERENCE_NOT_FOUND(); } } else if (p1 == 0x02) { //Select EF under the current DF - EF identifier - if (!(pe = search_by_fid(fid, currentDF, SPECIFY_EF))) { + if (!(pe = file_search_by_fid(fid, currentDF, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } } @@ -55,7 +55,7 @@ int cmd_select(void) { } } else if (p1 == 0x04) { //Select by DF name - e.g., [truncated] application identifier - if (!(pe = search_by_name(apdu.data, apdu.nc))) { + if (!(pe = file_search_by_name(apdu.data, apdu.nc))) { return SW_REFERENCE_NOT_FOUND(); } if (card_terminated) { @@ -63,19 +63,19 @@ int cmd_select(void) { } } else if (p1 == 0x08) { //Select from the MF - Path without the MF identifier - if (!(pe = search_by_path(apdu.data, apdu.nc, MF))) { + if (!(pe = file_search_by_path(apdu.data, apdu.nc, MF))) { return SW_REFERENCE_NOT_FOUND(); } } else if (p1 == 0x09) { //Select from the current DF - Path without the current DF identifier - if (!(pe = search_by_path(apdu.data, apdu.nc, currentDF))) { + if (!(pe = file_search_by_path(apdu.data, apdu.nc, currentDF))) { return SW_REFERENCE_NOT_FOUND(); } } } if ((p2 & 0xfc) == 0x00 || (p2 & 0xfc) == 0x04) { if ((p2 & 0xfc) == 0x04) { - process_fci(pe, 0); + file_process_fci(pe, 0); } } else { diff --git a/src/openpgp/cmd_select_data.c b/src/openpgp/cmd_select_data.c index 65dc96f..ce6a8bb 100644 --- a/src/openpgp/cmd_select_data.c +++ b/src/openpgp/cmd_select_data.c @@ -38,15 +38,15 @@ int cmd_select_data(void) { else { fid = apdu.data[4]; } - if (!(ef = search_by_fid(fid, NULL, SPECIFY_EF))) { + if (!(ef = file_search_by_fid(fid, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } - if (!authenticate_action(ef, ACL_OP_UPDATE_ERASE)) { + if (!file_authenticate_action(ef, ACL_OP_UPDATE_ERASE)) { return SW_SECURITY_STATUS_NOT_SATISFIED(); } fid &= ~0x6000; //Now get private DO fid += P1(apdu); - if (!(ef = search_by_fid(fid, NULL, SPECIFY_EF))) { + if (!(ef = file_search_by_fid(fid, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } select_file(ef); diff --git a/src/openpgp/cmd_terminate_df.c b/src/openpgp/cmd_terminate_df.c index 7f8145d..bcc0eed 100644 --- a/src/openpgp/cmd_terminate_df.c +++ b/src/openpgp/cmd_terminate_df.c @@ -22,7 +22,7 @@ int cmd_terminate_df(void) { return SW_INCORRECT_P1P2(); } file_t *retries; - if (!(retries = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF))) { + if (!(retries = file_search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } if (!has_pw3 && *(file_get_data(retries) + 6) > 0) { @@ -31,7 +31,7 @@ int cmd_terminate_df(void) { if (apdu.nc != 0) { return SW_WRONG_LENGTH(); } - initialize_flash(true); + file_initialize_flash(true); scan_files_openpgp(); return SW_OK(); } diff --git a/src/openpgp/cmd_verify.c b/src/openpgp/cmd_verify.c index 590e0be..fa0404d 100644 --- a/src/openpgp/cmd_verify.c +++ b/src/openpgp/cmd_verify.c @@ -44,10 +44,10 @@ int cmd_verify(void) { fid = EF_PW1; } file_t *pw, *pw_status; - if (!(pw = search_by_fid(fid, NULL, SPECIFY_EF))) { + if (!(pw = file_search_by_fid(fid, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } - if (!(pw_status = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF))) { + if (!(pw_status = file_search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } if (file_get_data(pw)[0] == 0) { //not initialized diff --git a/src/openpgp/do.c b/src/openpgp/do.c index fe11f39..8221951 100644 --- a/src/openpgp/do.c +++ b/src/openpgp/do.c @@ -36,7 +36,7 @@ int parse_do(uint16_t *fids, int mode) { int len = 0; file_t *ef; for (int i = 0; i < fids[0]; i++) { - if ((ef = search_by_fid(fids[i + 1], NULL, SPECIFY_EF))) { + if ((ef = file_search_by_fid(fids[i + 1], NULL, SPECIFY_EF))) { uint16_t data_len; if ((ef->type & FILE_DATA_FUNC) == FILE_DATA_FUNC) { int (*file_data_func)(const file_t *, int) = NULL; @@ -71,7 +71,7 @@ int parse_do(uint16_t *fids, int mode) { int parse_trium(uint16_t fid, uint8_t num, size_t size) { for (uint8_t i = 0; i < num; i++) { file_t *ef; - if ((ef = search_by_fid(fid + i, NULL, SPECIFY_EF)) && ef->data) { + if ((ef = file_search_by_fid(fid + i, NULL, SPECIFY_EF)) && ef->data) { uint16_t data_len = file_get_size(ef); memcpy(res_APDU + res_APDU_size, file_get_data(ef), data_len); res_APDU_size += data_len; @@ -106,7 +106,7 @@ int parse_sec_tpl(const file_t *f, int mode) { (void) mode; res_APDU[res_APDU_size++] = EF_SEC_TPL & 0xff; res_APDU[res_APDU_size++] = 5; - file_t *ef = search_by_fid(EF_SIG_COUNT, NULL, SPECIFY_ANY); + file_t *ef = file_search_by_fid(EF_SIG_COUNT, NULL, SPECIFY_ANY); if (ef && ef->data) { res_APDU[res_APDU_size++] = EF_SIG_COUNT & 0xff; res_APDU[res_APDU_size++] = 3; @@ -154,7 +154,7 @@ int parse_keyinfo(const file_t *f, int mode) { res_APDU[res_APDU_size++] = EF_KEY_INFO & 0xff; res_APDU[res_APDU_size++] = 6; } - file_t *ef = search_by_fid(EF_PK_SIG, NULL, SPECIFY_ANY); + file_t *ef = file_search_by_fid(EF_PK_SIG, NULL, SPECIFY_ANY); res_APDU[res_APDU_size++] = 0x00; if (ef && ef->data) { res_APDU[res_APDU_size++] = 0x01; @@ -163,7 +163,7 @@ int parse_keyinfo(const file_t *f, int mode) { res_APDU[res_APDU_size++] = 0x00; } - ef = search_by_fid(EF_PK_DEC, NULL, SPECIFY_ANY); + ef = file_search_by_fid(EF_PK_DEC, NULL, SPECIFY_ANY); res_APDU[res_APDU_size++] = 0x01; if (ef && ef->data) { res_APDU[res_APDU_size++] = 0x01; @@ -172,7 +172,7 @@ int parse_keyinfo(const file_t *f, int mode) { res_APDU[res_APDU_size++] = 0x00; } - ef = search_by_fid(EF_PK_AUT, NULL, SPECIFY_ANY); + ef = file_search_by_fid(EF_PK_AUT, NULL, SPECIFY_ANY); res_APDU[res_APDU_size++] = 0x02; if (ef && ef->data) { res_APDU[res_APDU_size++] = 0x01; @@ -192,7 +192,7 @@ int parse_pw_status(const file_t *f, int mode) { res_APDU[res_APDU_size++] = EF_PW_STATUS & 0xff; res_APDU[res_APDU_size++] = 7; } - ef = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_ANY); + ef = file_search_by_fid(EF_PW_PRIV, NULL, SPECIFY_ANY); if (ef && ef->data) { memcpy(res_APDU + res_APDU_size, file_get_data(ef), 7); res_APDU_size += 7; @@ -369,7 +369,7 @@ int parse_algoinfo(const file_t *f, int mode) { else if (f->fid == EF_ALGO_SIG || f->fid == EF_ALGO_DEC || f->fid == EF_ALGO_AUT) { uint16_t fid = 0x1000 | f->fid; file_t *ef; - if (!(ef = search_by_fid(fid, NULL, SPECIFY_EF)) || !ef->data) { + if (!(ef = file_search_by_fid(fid, NULL, SPECIFY_EF)) || !ef->data) { datalen += parse_algo(algorithm_attr_rsa2k, f->fid); } else { diff --git a/src/openpgp/files.h b/src/openpgp/files.h index ffa3211..3a9cf02 100644 --- a/src/openpgp/files.h +++ b/src/openpgp/files.h @@ -172,4 +172,6 @@ #define EF_PRIV_DO_3 0x0103 #define EF_PRIV_DO_4 0x0104 +extern const file_t *file_openpgp; + #endif diff --git a/src/openpgp/management.c b/src/openpgp/management.c index cf0fe80..e521fdc 100644 --- a/src/openpgp/management.c +++ b/src/openpgp/management.c @@ -15,7 +15,9 @@ * along with this program. If not, see . */ -#include "pico_keys.h" +#include +#include "picokeys.h" +#include "serial.h" #include "apdu.h" #include "version.h" #include "files.h" @@ -42,7 +44,7 @@ static int man_select(app_t *a, uint8_t force) { apdu.ne = res_APDU_size; init_piv(); is_gpg = false; - return PICOKEY_OK; + return PICOKEYS_OK; } INITIALIZER( man_ctor ) { @@ -50,11 +52,11 @@ INITIALIZER( man_ctor ) { } static int man_unload(void) { - return PICOKEY_OK; + return PICOKEYS_OK; } bool cap_supported(uint16_t cap) { - file_t *ef = search_dynamic_file(EF_DEV_CONF); + file_t *ef = file_search(EF_DEV_CONF); if (file_has_data(ef)) { uint16_t tag = 0x0; uint8_t *tag_data = NULL, *p = NULL; @@ -75,7 +77,7 @@ bool cap_supported(uint16_t cap) { } int man_get_config(void) { - file_t *ef = search_dynamic_file(EF_DEV_CONF); + file_t *ef = file_search(EF_DEV_CONF); res_APDU_size = 0; res_APDU[res_APDU_size++] = 0; // Overall length. Filled later res_APDU[res_APDU_size++] = TAG_USB_SUPPORTED; @@ -129,7 +131,7 @@ static int cmd_write_config(void) { } file_t *ef = file_new(EF_DEV_CONF); file_put_data(ef, apdu.data + 1, apdu.nc - 1); - low_flash_available(); + flash_commit(); return SW_OK(); } diff --git a/src/openpgp/openpgp.c b/src/openpgp/openpgp.c index 021e723..9c5c9b7 100644 --- a/src/openpgp/openpgp.c +++ b/src/openpgp/openpgp.c @@ -15,11 +15,13 @@ * along with this program. If not, see . */ +#include #ifdef ESP_PLATFORM #include "esp_compat.h" #define MBEDTLS_ALLOW_PRIVATE_ACCESS #endif #include "openpgp.h" +#include "serial.h" #include "version.h" #include "random.h" #include "eac.h" @@ -66,7 +68,7 @@ extern uint32_t board_button_read(void); bool wait_button_pressed_fid(uint16_t fid) { uint32_t val = EV_PRESS_BUTTON; #ifndef ENABLE_EMULATION - file_t *ef = search_by_fid(fid, NULL, SPECIFY_ANY); + file_t *ef = file_search_by_fid(fid, NULL, SPECIFY_ANY); if (ef && ef->data && file_get_data(ef)[0] > 0) { queue_try_add(&card_to_usb_q, &val); do { @@ -98,15 +100,15 @@ void select_file(file_t *pe) { } void scan_files_openpgp(void) { - scan_flash(); + file_scan_flash(); file_t *ef; - if ((ef = search_by_fid(EF_FULL_AID, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_FULL_AID, NULL, SPECIFY_ANY))) { ef->data = openpgp_aid_full; memcpy(ef->data + 12, pico_serial.id, 4); } bool reset_dek = false; bool bootstrap_legacy = false; - file_t *ef_dek = search_by_fid(EF_DEK, NULL, SPECIFY_ANY), *ef_dek_pw1 = search_by_fid(EF_DEK_PW1, NULL, SPECIFY_ANY), *ef_dek_rc = search_by_fid(EF_DEK_RC, NULL, SPECIFY_ANY), *ef_dek_pw3 = search_by_fid(EF_DEK_PW3, NULL, SPECIFY_ANY); + file_t *ef_dek = file_search_by_fid(EF_DEK, NULL, SPECIFY_ANY), *ef_dek_pw1 = file_search_by_fid(EF_DEK_PW1, NULL, SPECIFY_ANY), *ef_dek_rc = file_search_by_fid(EF_DEK_RC, NULL, SPECIFY_ANY), *ef_dek_pw3 = file_search_by_fid(EF_DEK_PW3, NULL, SPECIFY_ANY); if (!file_has_data(ef_dek_pw1) && !file_has_data(ef_dek_rc) && !file_has_data(ef_dek_pw3) && !file_has_data(ef_dek)) { printf("DEK are empty\r\n"); const uint8_t *random_dek = random_bytes_get(DEK_SIZE); @@ -147,7 +149,7 @@ void scan_files_openpgp(void) { reset_dek = true; } - if ((ef = search_by_fid(EF_PW1, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_PW1, NULL, SPECIFY_ANY))) { if (!ef->data || reset_dek) { printf("PW1 is empty. Initializing with default password\r\n"); const uint8_t def[6] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 }; @@ -165,7 +167,7 @@ void scan_files_openpgp(void) { } } } - if ((ef = search_by_fid(EF_RC, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_RC, NULL, SPECIFY_ANY))) { if (!ef->data || reset_dek) { printf("RC is empty. Initializing with default password\r\n"); @@ -184,7 +186,7 @@ void scan_files_openpgp(void) { } } } - if ((ef = search_by_fid(EF_PW3, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_PW3, NULL, SPECIFY_ANY))) { if (!ef->data || reset_dek) { printf("PW3 is empty. Initializing with default password\r\n"); @@ -203,63 +205,63 @@ void scan_files_openpgp(void) { } } } - if ((ef = search_by_fid(EF_SIG_COUNT, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_SIG_COUNT, NULL, SPECIFY_ANY))) { if (!ef->data) { printf("SigCount is empty. Initializing to zero\r\n"); const uint8_t def[3] = { 0 }; file_put_data(ef, def, sizeof(def)); } } - if ((ef = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_PW_PRIV, NULL, SPECIFY_ANY))) { if (!ef->data) { printf("PW status is empty. Initializing to default\r\n"); const uint8_t def[] = { 0x1, 127, 127, 127, 3, 3, 3 }; file_put_data(ef, def, sizeof(def)); } } - if ((ef = search_by_fid(EF_UIF_SIG, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_UIF_SIG, NULL, SPECIFY_ANY))) { if (!ef->data) { printf("UIF SIG is empty. Initializing to default\r\n"); const uint8_t def[] = { 0x0, 0x20 }; file_put_data(ef, def, sizeof(def)); } } - if ((ef = search_by_fid(EF_UIF_DEC, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_UIF_DEC, NULL, SPECIFY_ANY))) { if (!ef->data) { printf("UIF DEC is empty. Initializing to default\r\n"); const uint8_t def[] = { 0x0, 0x20 }; file_put_data(ef, def, sizeof(def)); } } - if ((ef = search_by_fid(EF_UIF_AUT, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_UIF_AUT, NULL, SPECIFY_ANY))) { if (!ef->data) { printf("UIF AUT is empty. Initializing to default\r\n"); const uint8_t def[] = { 0x0, 0x20 }; file_put_data(ef, def, sizeof(def)); } } - if ((ef = search_by_fid(EF_KDF, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_KDF, NULL, SPECIFY_ANY))) { if (!ef->data) { printf("KDF is empty. Initializing to default\r\n"); const uint8_t def[] = { 0x81, 0x1, 0x0 }; file_put_data(ef, def, sizeof(def)); } } - if ((ef = search_by_fid(EF_SEX, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_SEX, NULL, SPECIFY_ANY))) { if (!ef->data) { printf("Sex is empty. Initializing to default\r\n"); const uint8_t def[] = { 0x30 }; file_put_data(ef, def, sizeof(def)); } } - if ((ef = search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_ANY))) { if (!ef->data) { printf("PW retries is empty. Initializing to default\r\n"); const uint8_t def[] = { 0x1, 3, 3, 3 }; file_put_data(ef, def, sizeof(def)); } } - low_flash_available(); + flash_commit(); } static void release_dek(void) { @@ -270,25 +272,25 @@ extern bool has_pwpiv; extern uint8_t session_pwpiv[32]; int load_dek(void) { if (!has_pw1 && !has_pw2 && !has_pw3 && !has_pwpiv) { - return PICOKEY_NO_LOGIN; + return PICOKEYS_NO_LOGIN; } - int r = PICOKEY_OK; + int r = PICOKEYS_OK; if (has_pw1 || has_pw2) { - file_t *ef_dek_pw1 = search_file(EF_DEK_PW1); + file_t *ef_dek_pw1 = file_search(EF_DEK_PW1); if (file_has_data(ef_dek_pw1)) { uint8_t *ef_data = file_get_data(ef_dek_pw1); if (ef_data[0] == 0x3) { // Format r = decrypt_with_aad(session_pw1, ef_data + 1, DEK_AAD_SIZE, PIN_KDF_DEFAULT_VERSION, dek); } else { - return PICOKEY_ERR_NULL_PARAM; + return PICOKEYS_ERR_NULL_PARAM; } } else { - file_t *tf = search_by_fid(EF_DEK, NULL, SPECIFY_EF); + file_t *tf = file_search_by_fid(EF_DEK, NULL, SPECIFY_EF); if (!tf) { - return PICOKEY_ERR_FILE_NOT_FOUND; + return PICOKEYS_ERR_FILE_NOT_FOUND; } memcpy(dek, file_get_data(tf), IV_SIZE + 32); @@ -296,20 +298,20 @@ int load_dek(void) { } } else if (has_pw3) { - file_t *ef_dek_pw3 = search_file(EF_DEK_PW3); + file_t *ef_dek_pw3 = file_search(EF_DEK_PW3); if (file_has_data(ef_dek_pw3)) { uint8_t *ef_data = file_get_data(ef_dek_pw3); if (ef_data[0] == 0x3) { // Format r = decrypt_with_aad(session_pw3, ef_data + 1, DEK_AAD_SIZE, PIN_KDF_DEFAULT_VERSION, dek); } else { - return PICOKEY_ERR_NULL_PARAM; + return PICOKEYS_ERR_NULL_PARAM; } } else { - file_t *tf = search_by_fid(EF_DEK, NULL, SPECIFY_EF); + file_t *tf = file_search_by_fid(EF_DEK, NULL, SPECIFY_EF); if (!tf) { - return PICOKEY_ERR_FILE_NOT_FOUND; + return PICOKEYS_ERR_FILE_NOT_FOUND; } memcpy(dek, file_get_data(tf), IV_SIZE); @@ -318,20 +320,20 @@ int load_dek(void) { } } else if (has_pwpiv) { - file_t *ef_dek_pwpiv = search_file(EF_DEK_PWPIV); + file_t *ef_dek_pwpiv = file_search(EF_DEK_PWPIV); if (file_has_data(ef_dek_pwpiv)) { uint8_t *ef_data = file_get_data(ef_dek_pwpiv); if (ef_data[0] == 0x3) { // Format r = decrypt_with_aad(session_pwpiv, ef_data + 1, DEK_AAD_SIZE, PIN_KDF_DEFAULT_VERSION, dek); } else { - return PICOKEY_ERR_NULL_PARAM; + return PICOKEYS_ERR_NULL_PARAM; } } else { - file_t *tf = search_by_fid(EF_DEK, NULL, SPECIFY_EF); + file_t *tf = file_search_by_fid(EF_DEK, NULL, SPECIFY_EF); if (!tf) { - return PICOKEY_ERR_FILE_NOT_FOUND; + return PICOKEYS_ERR_FILE_NOT_FOUND; } memcpy(dek, file_get_data(tf), IV_SIZE); @@ -341,14 +343,14 @@ int load_dek(void) { } if (r != 0) { release_dek(); - return PICOKEY_EXEC_ERROR; + return PICOKEYS_EXEC_ERROR; } - return PICOKEY_OK; + return PICOKEYS_OK; } int dek_encrypt(uint8_t *data, size_t len) { int r; - if ((r = load_dek()) != PICOKEY_OK) { + if ((r = load_dek()) != PICOKEYS_OK) { return r; } r = aes_encrypt_cfb_256(dek + IV_SIZE, dek, data, len); @@ -358,7 +360,7 @@ int dek_encrypt(uint8_t *data, size_t len) { int dek_decrypt(uint8_t *data, size_t len) { int r; - if ((r = load_dek()) != PICOKEY_OK) { + if ((r = load_dek()) != PICOKEYS_OK) { return r; } r = aes_decrypt_cfb_256(dek + IV_SIZE, dek, data, len); @@ -384,7 +386,7 @@ static int openpgp_unload(void) { algo_aut = EF_ALGO_PRIV3; pk_dec = EF_PK_DEC; pk_aut = EF_PK_AUT; - return PICOKEY_OK; + return PICOKEYS_OK; } extern char __StackLimit; @@ -404,7 +406,7 @@ static int openpgp_select_aid(app_t *a, uint8_t force) { a->process_apdu = openpgp_process_apdu; a->unload = openpgp_unload; init_openpgp(); - process_fci(file_openpgp, 1); + file_process_fci(file_openpgp, 1); memcpy(res_APDU + res_APDU_size, "\x64\x06\x53\x04", 4); res_APDU_size += 4; int heap_left = heapLeft(); @@ -414,62 +416,66 @@ static int openpgp_select_aid(app_t *a, uint8_t force) { res_APDU[res_APDU_size++] = ((heap_left >> 0) & 0xff); res_APDU[1] += 8; apdu.ne = res_APDU_size; - return PICOKEY_OK; + return PICOKEYS_OK; } INITIALIZER( openpgp_ctor ) { - ccid_atr = (uint8_t *) atr_openpgp; register_app(openpgp_select_aid, openpgp_aid); } +int set_atr(void) { + ccid_atr = (uint8_t *) atr_openpgp; + return 0; +} + int pin_reset_retries(const file_t *pin, bool force) { if (!pin) { - return PICOKEY_ERR_NULL_PARAM; + return PICOKEYS_ERR_NULL_PARAM; } - file_t *pw_status = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF); - file_t *pw_retries = search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_EF); + file_t *pw_status = file_search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF); + file_t *pw_retries = file_search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_EF); if (!pw_status || !pw_retries) { - return PICOKEY_ERR_FILE_NOT_FOUND; + return PICOKEYS_ERR_FILE_NOT_FOUND; } if (3 + (pin->fid & 0xf) >= file_get_size(pw_status) || (pin->fid & 0xf) >= file_get_size(pw_retries)) { - return PICOKEY_ERR_MEMORY_FATAL; + return PICOKEYS_ERR_MEMORY_FATAL; } uint8_t p[64]; memcpy(p, file_get_data(pw_status), file_get_size(pw_status)); uint8_t retries = p[3 + (pin->fid & 0xf)]; if (retries == 0 && force == false) { //blocked - return PICOKEY_ERR_BLOCKED; + return PICOKEYS_ERR_BLOCKED; } uint8_t max_retries = file_get_data(pw_retries)[(pin->fid & 0xf)]; p[3 + (pin->fid & 0xf)] = max_retries; int r = file_put_data(pw_status, p, file_get_size(pw_status)); - low_flash_available(); + flash_commit(); return r; } static int pin_wrong_retry(const file_t *pin) { if (!pin) { - return PICOKEY_ERR_NULL_PARAM; + return PICOKEYS_ERR_NULL_PARAM; } - file_t *pw_status = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF); + file_t *pw_status = file_search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF); if (!pw_status) { - return PICOKEY_ERR_FILE_NOT_FOUND; + return PICOKEYS_ERR_FILE_NOT_FOUND; } uint8_t p[64]; memcpy(p, file_get_data(pw_status), file_get_size(pw_status)); if (p[3 + (pin->fid & 0xf)] > 0) { p[3 + (pin->fid & 0xf)] -= 1; int r = file_put_data(pw_status, p, file_get_size(pw_status)); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return r; } - low_flash_available(); + flash_commit(); if (p[3 + (pin->fid & 0xf)] == 0) { - return PICOKEY_ERR_BLOCKED; + return PICOKEYS_ERR_BLOCKED; } return p[3 + (pin->fid & 0xf)]; } - return PICOKEY_ERR_BLOCKED; + return PICOKEYS_ERR_BLOCKED; } int check_pin(const file_t *pin, const uint8_t *data, size_t len) { @@ -492,17 +498,17 @@ int check_pin(const file_t *pin, const uint8_t *data, size_t len) { } if (memcmp(file_get_data(pin) + off, dhash, sizeof(dhash)) != 0) { int retries; - if ((retries = pin_wrong_retry(pin)) < PICOKEY_OK) { + if ((retries = pin_wrong_retry(pin)) < PICOKEYS_OK) { return SW_PIN_BLOCKED(); } return set_res_sw(0x63, 0xc0 | retries); } int r = pin_reset_retries(pin, false); - if (r == PICOKEY_ERR_BLOCKED) { + if (r == PICOKEYS_ERR_BLOCKED) { return SW_PIN_BLOCKED(); } - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_MEMORY_FAILURE(); } if (off == 1) { @@ -533,31 +539,31 @@ int check_pin(const file_t *pin, const uint8_t *data, size_t len) { if (pin_sp) { hash_multi(data, len, pin_sp); r = load_dek(); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_EXEC_ERROR(); } uint8_t old_data[DEK_FILE_SIZE_OLD], ef_data[DEK_FILE_SIZE]; file_t *ef_dek_pw = NULL; if (has_pw1 || has_pw2) { - ef_dek_pw = search_by_fid(EF_DEK_PW1, NULL, SPECIFY_EF); + ef_dek_pw = file_search_by_fid(EF_DEK_PW1, NULL, SPECIFY_EF); } else if (has_pw3) { - ef_dek_pw = search_by_fid(EF_DEK_PW3, NULL, SPECIFY_EF); + ef_dek_pw = file_search_by_fid(EF_DEK_PW3, NULL, SPECIFY_EF); } else if (has_pwpiv) { - ef_dek_pw = search_by_fid(EF_DEK_PWPIV, NULL, SPECIFY_EF); + ef_dek_pw = file_search_by_fid(EF_DEK_PWPIV, NULL, SPECIFY_EF); } if (!ef_dek_pw) { - return PICOKEY_ERR_FILE_NOT_FOUND; + return PICOKEYS_ERR_FILE_NOT_FOUND; } ef_data[0] = 0x3; // Format pin_derive_session(data, len, pin_sp); encrypt_with_aad(pin_sp, dek, DEK_SIZE, PIN_KDF_DEFAULT_VERSION, ef_data + 1); file_put_data(ef_dek_pw, ef_data, sizeof(ef_data)); - file_t *ef_dek = search_by_fid(EF_DEK, NULL, SPECIFY_EF); + file_t *ef_dek = file_search_by_fid(EF_DEK, NULL, SPECIFY_EF); if (!ef_dek) { - return PICOKEY_ERR_FILE_NOT_FOUND; + return PICOKEYS_ERR_FILE_NOT_FOUND; } memcpy(old_data, file_get_data(ef_dek), sizeof(old_data)); if (has_pw1 || has_pw2) { @@ -570,7 +576,7 @@ int check_pin(const file_t *pin, const uint8_t *data, size_t len) { memset(old_data + IV_SIZE + 32 + 32 + 32, 0, 32); } file_put_data(ef_dek, old_data, sizeof(old_data)); - low_flash_available(); + flash_commit(); } has_pw1 = has_pw2 = has_pw3 = false; } @@ -593,40 +599,40 @@ int check_pin(const file_t *pin, const uint8_t *data, size_t len) { int inc_sig_count(void) { file_t *pw_status; - if (!(pw_status = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF)) || !pw_status->data) { + if (!(pw_status = file_search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF)) || !pw_status->data) { return SW_REFERENCE_NOT_FOUND(); } if (file_get_data(pw_status)[0] == 0) { has_pw1 = false; } - file_t *ef = search_by_fid(EF_SIG_COUNT, NULL, SPECIFY_ANY); + file_t *ef = file_search_by_fid(EF_SIG_COUNT, NULL, SPECIFY_ANY); if (!ef || !ef->data) { - return PICOKEY_ERR_FILE_NOT_FOUND; + return PICOKEYS_ERR_FILE_NOT_FOUND; } uint8_t *p = file_get_data(ef); uint32_t counter = (p[0] << 16) | (p[1] << 8) | p[2]; counter++; uint8_t q[3] = { (counter >> 16) & 0xff, (counter >> 8) & 0xff, counter & 0xff }; int r = file_put_data(ef, q, sizeof(q)); - if (r != PICOKEY_OK) { - return PICOKEY_EXEC_ERROR; + if (r != PICOKEYS_OK) { + return PICOKEYS_EXEC_ERROR; } - low_flash_available(); - return PICOKEY_OK; + flash_commit(); + return PICOKEYS_OK; } int reset_sig_count(void) { - file_t *ef = search_by_fid(EF_SIG_COUNT, NULL, SPECIFY_ANY); + file_t *ef = file_search_by_fid(EF_SIG_COUNT, NULL, SPECIFY_ANY); if (!ef || !ef->data) { - return PICOKEY_ERR_FILE_NOT_FOUND; + return PICOKEYS_ERR_FILE_NOT_FOUND; } uint8_t q[3] = { 0 }; int r = file_put_data(ef, q, sizeof(q)); - if (r != PICOKEY_OK) { - return PICOKEY_EXEC_ERROR; + if (r != PICOKEYS_OK) { + return PICOKEYS_EXEC_ERROR; } - low_flash_available(); - return PICOKEY_OK; + flash_commit(); + return PICOKEYS_OK; } int store_keys(void *key_ctx, int type, uint16_t key_id, bool use_kek) { @@ -634,13 +640,13 @@ int store_keys(void *key_ctx, int type, uint16_t key_id, bool use_kek) { uint8_t kdata[4096 / 8]; //worst //if (!has_pw3) - // return PICOKEY_NO_LOGIN; - //file_t *pw3 = search_by_fid(EF_PW3, NULL, SPECIFY_EF); + // return PICOKEYS_NO_LOGIN; + //file_t *pw3 = file_search_by_fid(EF_PW3, NULL, SPECIFY_EF); //if (!pw3) - // return PICOKEY_ERR_FILE_NOT_FOUND; - file_t *ef = search_by_fid(key_id, NULL, SPECIFY_EF); + // return PICOKEYS_ERR_FILE_NOT_FOUND; + file_t *ef = file_search_by_fid(key_id, NULL, SPECIFY_EF); if (!ef) { - return PICOKEY_ERR_FILE_NOT_FOUND; + return PICOKEYS_ERR_FILE_NOT_FOUND; } if (type == ALGO_RSA) { mbedtls_rsa_context *rsa = (mbedtls_rsa_context *) key_ctx; @@ -669,19 +675,19 @@ int store_keys(void *key_ctx, int type, uint16_t key_id, bool use_kek) { } if (use_kek) { r = dek_encrypt(kdata, key_size); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return r; } } //r = aes_encrypt_cfb_256(file_read(pw3->data+2), session_pw3, kdata, key_size); - //if (r != PICOKEY_OK) + //if (r != PICOKEYS_OK) // return r; r = file_put_data(ef, kdata, key_size); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return r; } - low_flash_available(); - return PICOKEY_OK; + flash_commit(); + return PICOKEYS_OK; } int load_private_key_rsa(mbedtls_rsa_context *ctx, file_t *fkey, bool use_dek) { @@ -689,33 +695,33 @@ int load_private_key_rsa(mbedtls_rsa_context *ctx, file_t *fkey, bool use_dek) { uint8_t kdata[4096 / 8]; memcpy(kdata, file_get_data(fkey), key_size); if (use_dek && dek_decrypt(kdata, key_size) != 0) { - return PICOKEY_EXEC_ERROR; + return PICOKEYS_EXEC_ERROR; } if (mbedtls_mpi_read_binary(&ctx->P, kdata, key_size / 2) != 0) { mbedtls_rsa_free(ctx); - return PICOKEY_WRONG_DATA; + return PICOKEYS_WRONG_DATA; } if (mbedtls_mpi_read_binary(&ctx->Q, kdata + key_size / 2, key_size / 2) != 0) { mbedtls_rsa_free(ctx); - return PICOKEY_WRONG_DATA; + return PICOKEYS_WRONG_DATA; } if (mbedtls_mpi_lset(&ctx->E, 0x10001) != 0) { mbedtls_rsa_free(ctx); - return PICOKEY_EXEC_ERROR; + return PICOKEYS_EXEC_ERROR; } if (mbedtls_rsa_import(ctx, NULL, &ctx->P, &ctx->Q, NULL, &ctx->E) != 0) { mbedtls_rsa_free(ctx); - return PICOKEY_WRONG_DATA; + return PICOKEYS_WRONG_DATA; } if (mbedtls_rsa_complete(ctx) != 0) { mbedtls_rsa_free(ctx); - return PICOKEY_WRONG_DATA; + return PICOKEYS_WRONG_DATA; } if (mbedtls_rsa_check_privkey(ctx) != 0) { mbedtls_rsa_free(ctx); - return PICOKEY_WRONG_DATA; + return PICOKEYS_WRONG_DATA; } - return PICOKEY_OK; + return PICOKEYS_OK; } int load_private_key_ecdsa(mbedtls_ecp_keypair *ctx, file_t *fkey, bool use_dek) { @@ -723,38 +729,38 @@ int load_private_key_ecdsa(mbedtls_ecp_keypair *ctx, file_t *fkey, bool use_dek) uint8_t kdata[67]; //Worst case, 521 bit + 1byte memcpy(kdata, file_get_data(fkey), key_size); if (use_dek && dek_decrypt(kdata, key_size) != 0) { - return PICOKEY_EXEC_ERROR; + return PICOKEYS_EXEC_ERROR; } mbedtls_ecp_group_id gid = kdata[0]; int r = mbedtls_ecp_read_key(gid, ctx, kdata + 1, key_size - 1); if (r != 0) { mbedtls_ecp_keypair_free(ctx); - return PICOKEY_EXEC_ERROR; + return PICOKEYS_EXEC_ERROR; } mbedtls_platform_zeroize(kdata, sizeof(kdata)); #ifdef MBEDTLS_EDDSA_C if (ctx->grp.id == MBEDTLS_ECP_DP_ED25519 || ctx->grp.id == MBEDTLS_ECP_DP_ED448) { - r = mbedtls_ecp_point_edwards(&ctx->grp, &ctx->Q, &ctx->d, random_gen, NULL); + r = mbedtls_ecp_point_edwards(&ctx->grp, &ctx->Q, &ctx->d, random_fill_iterator, NULL); } else #endif { - r = mbedtls_ecp_mul(&ctx->grp, &ctx->Q, &ctx->d, &ctx->grp.G, random_gen, NULL); + r = mbedtls_ecp_mul(&ctx->grp, &ctx->Q, &ctx->d, &ctx->grp.G, random_fill_iterator, NULL); } if (r != 0) { mbedtls_ecdsa_free(ctx); - return PICOKEY_EXEC_ERROR; + return PICOKEYS_EXEC_ERROR; } - return PICOKEY_OK; + return PICOKEYS_OK; } int load_aes_key(uint8_t *aes_key, file_t *fkey) { int key_size = file_get_size(fkey); memcpy(aes_key, file_get_data(fkey), key_size); if (dek_decrypt(aes_key, key_size) != 0) { - return PICOKEY_EXEC_ERROR; + return PICOKEYS_EXEC_ERROR; } - return PICOKEY_OK; + return PICOKEYS_OK; } mbedtls_ecp_group_id get_ec_group_id_from_attr(const uint8_t *algo, size_t algo_len) { @@ -801,14 +807,14 @@ void make_rsa_response(mbedtls_rsa_context *rsa) { res_APDU_size = 5; res_APDU[res_APDU_size++] = 0x81; res_APDU[res_APDU_size++] = 0x82; - put_uint16_t_be(mbedtls_mpi_size(&rsa->N), res_APDU + res_APDU_size); res_APDU_size += 2; + put_uint16_be(mbedtls_mpi_size(&rsa->N), res_APDU + res_APDU_size); res_APDU_size += 2; mbedtls_mpi_write_binary(&rsa->N, res_APDU + res_APDU_size, mbedtls_mpi_size(&rsa->N)); res_APDU_size += mbedtls_mpi_size(&rsa->N); res_APDU[res_APDU_size++] = 0x82; res_APDU[res_APDU_size++] = mbedtls_mpi_size(&rsa->E) & 0xff; mbedtls_mpi_write_binary(&rsa->E, res_APDU + res_APDU_size, mbedtls_mpi_size(&rsa->E)); res_APDU_size += mbedtls_mpi_size(&rsa->E); - put_uint16_t_be(res_APDU_size - 5, res_APDU + 3); + put_uint16_be(res_APDU_size - 5, res_APDU + 3); } void make_ecdsa_response(mbedtls_ecp_keypair *ecdsa) { @@ -883,11 +889,11 @@ int rsa_sign(mbedtls_rsa_context *ctx, const uint8_t *data, size_t data_len, uin if (data_len < key_size) { //needs padding memset((uint8_t *) data + data_len, 0, key_size - data_len); } - r = mbedtls_rsa_private(ctx, random_gen, NULL, data, out); + r = mbedtls_rsa_private(ctx, random_fill_iterator, NULL, data, out); } else { uint8_t *signature = (uint8_t *) calloc(key_size, sizeof(uint8_t)); - r = mbedtls_rsa_pkcs1_sign(ctx, random_gen, NULL, md, hash_len, hsh, signature); + r = mbedtls_rsa_pkcs1_sign(ctx, random_fill_iterator, NULL, md, hash_len, hsh, signature); memcpy(out, signature, key_size); free(signature); } @@ -900,7 +906,7 @@ int ecdsa_sign(mbedtls_ecp_keypair *ctx, const uint8_t *data, size_t data_len, u int r = 0; #ifdef MBEDTLS_EDDSA_C if (ctx->grp.id == MBEDTLS_ECP_DP_ED25519 || ctx->grp.id == MBEDTLS_ECP_DP_ED448) { - r = mbedtls_eddsa_write_signature(ctx, data, data_len, out, 114, out_len, MBEDTLS_EDDSA_PURE, NULL, 0, random_gen, NULL); + r = mbedtls_eddsa_write_signature(ctx, data, data_len, out, 114, out_len, MBEDTLS_EDDSA_PURE, NULL, 0, random_fill_iterator, NULL); } else #endif @@ -908,7 +914,7 @@ int ecdsa_sign(mbedtls_ecp_keypair *ctx, const uint8_t *data, size_t data_len, u mbedtls_mpi ri, si; mbedtls_mpi_init(&ri); mbedtls_mpi_init(&si); - r = mbedtls_ecdsa_sign(&ctx->grp, &ri, &si, &ctx->d, data, data_len, random_gen, NULL); + r = mbedtls_ecdsa_sign(&ctx->grp, &ri, &si, &ctx->d, data, data_len, random_fill_iterator, NULL); if (r == 0) { size_t plen = (ctx->grp.nbits + 7) / 8; mbedtls_mpi_write_binary(&ri, out, plen); diff --git a/src/openpgp/openpgp.h b/src/openpgp/openpgp.h index 0486f0c..0b763a2 100644 --- a/src/openpgp/openpgp.h +++ b/src/openpgp/openpgp.h @@ -23,7 +23,7 @@ #include #endif -#include "pico_keys.h" +#include "picokeys.h" #include "apdu.h" #include "mbedtls/rsa.h" #include "mbedtls/ecdsa.h" diff --git a/src/openpgp/piv.c b/src/openpgp/piv.c index d47ee16..87f77bd 100644 --- a/src/openpgp/piv.c +++ b/src/openpgp/piv.c @@ -15,13 +15,15 @@ * along with this program. If not, see . */ +#include #ifdef ESP_PLATFORM #include "esp_compat.h" #define MBEDTLS_ALLOW_PRIVATE_ACCESS #endif #include "files.h" #include "apdu.h" -#include "pico_keys.h" +#include "picokeys.h" +#include "serial.h" #include "random.h" #include "eac.h" #include "crypto_utils.h" @@ -89,7 +91,7 @@ static int x509_create_cert(void *pk_ctx, uint8_t algo, uint8_t slot, bool attes mbedtls_x509write_crt_set_version(&ctx, MBEDTLS_X509_CRT_VERSION_3); mbedtls_x509write_crt_set_validity(&ctx, "20240325000000", "20741231235959"); uint8_t serial[20]; - random_gen(NULL, serial, sizeof(serial)); + random_fill_buffer(serial, sizeof(serial)); mbedtls_x509write_crt_set_serial_raw(&ctx, serial, sizeof(serial)); mbedtls_pk_context skey, ikey; mbedtls_ecdsa_context actx; // attestation key @@ -108,7 +110,7 @@ static int x509_create_cert(void *pk_ctx, uint8_t algo, uint8_t slot, bool attes sprintf(buf_sname, "C=ES,O=Pico Keys,CN=Pico OpenPGP PIV Attestation %X", slot); mbedtls_x509write_crt_set_subject_name(&ctx, buf_sname); mbedtls_x509write_crt_set_issuer_name(&ctx, "C=ES,O=Pico Keys,CN=Pico OpenPGP PIV Slot F9"); - file_t *ef_key = search_by_fid(EF_PIV_KEY_ATTESTATION, NULL, SPECIFY_EF); + file_t *ef_key = file_search_by_fid(EF_PIV_KEY_ATTESTATION, NULL, SPECIFY_EF); mbedtls_ecdsa_init(&actx); load_private_key_ecdsa(&actx, ef_key, false); mbedtls_pk_setup(&ikey, mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY)); @@ -154,7 +156,7 @@ static int x509_create_cert(void *pk_ctx, uint8_t algo, uint8_t slot, bool attes mbedtls_x509write_crt_set_subject_key_identifier(&ctx); mbedtls_x509write_crt_set_authority_key_identifier(&ctx); mbedtls_x509write_crt_set_key_usage(&ctx, MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_CERT_SIGN); - int ret = mbedtls_x509write_crt_der(&ctx, buffer, buffer_size, random_gen, NULL); + int ret = mbedtls_x509write_crt_der(&ctx, buffer, buffer_size, random_fill_iterator, NULL); /* skey cannot be freed, as it is freed later */ if (attestation) { mbedtls_ecdsa_free(&actx); @@ -164,9 +166,9 @@ static int x509_create_cert(void *pk_ctx, uint8_t algo, uint8_t slot, bool attes } static void scan_files_piv(void) { - scan_flash(); - file_t *ef = search_by_fid(EF_PIV_KEY_CARDMGM, NULL, SPECIFY_EF); - if ((ef = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_ANY))) { + file_scan_flash(); + file_t *ef = file_search_by_fid(EF_PIV_KEY_CARDMGM, NULL, SPECIFY_EF); + if ((ef = file_search_by_fid(EF_PW_PRIV, NULL, SPECIFY_ANY))) { if (file_get_size(ef) == 0) { printf("PW status is empty. Initializing to default\r\n"); const uint8_t def[] = { 0x1, 127, 127, 127, 3, 3, 3, 3, 3 }; @@ -180,7 +182,7 @@ static void scan_files_piv(void) { file_put_data(ef, def, sizeof(def)); } } - if ((ef = search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_ANY))) { if (file_get_size(ef) == 0) { printf("PW retries is empty. Initializing to default\r\n"); const uint8_t def[] = { 0x1, 3, 3, 3, 3, 3 }; @@ -195,7 +197,7 @@ static void scan_files_piv(void) { } } bool reset_dek = false; - if ((ef = search_by_fid(EF_DEK_PWPIV, NULL, SPECIFY_ANY)) && !file_has_data(ef)) { + if ((ef = file_search_by_fid(EF_DEK_PWPIV, NULL, SPECIFY_ANY)) && !file_has_data(ef)) { printf("DEK PIV is empty or older\r\n"); const uint8_t defpin[8] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 }; const uint8_t *random_dek = random_bytes_get(IV_SIZE + 32); @@ -209,14 +211,14 @@ static void scan_files_piv(void) { file_put_data(ef, def, sizeof(def)); uint8_t *key = (uint8_t *)"\x01\x02\x03\x04\x05\x06\x07\x08\x01\x02\x03\x04\x05\x06\x07\x08\x01\x02\x03\x04\x05\x06\x07\x08"; - file_t *ef_cardmgm = search_by_fid(EF_PIV_KEY_CARDMGM, NULL, SPECIFY_ANY); + file_t *ef_cardmgm = file_search_by_fid(EF_PIV_KEY_CARDMGM, NULL, SPECIFY_ANY); file_put_data(ef_cardmgm, key, 24); uint8_t meta[] = { PIV_ALGO_AES192, PINPOLICY_ALWAYS, TOUCHPOLICY_ALWAYS }; meta_add(EF_PIV_KEY_CARDMGM, meta, sizeof(meta)); reset_dek = true; } - if ((ef = search_by_fid(EF_PIV_PIN, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_PIV_PIN, NULL, SPECIFY_ANY))) { if (!ef->data || reset_dek) { printf("PIV PIN is empty. Initializing with default password\r\n"); const uint8_t def[8] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0xFF, 0xFF }; @@ -227,7 +229,7 @@ static void scan_files_piv(void) { file_put_data(ef, dhash, sizeof(dhash)); } } - if ((ef = search_by_fid(EF_PIV_PUK, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_PIV_PUK, NULL, SPECIFY_ANY))) { if (!ef->data) { printf("PIV PUK is empty. Initializing with default password\r\n"); const uint8_t def[8] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 }; @@ -238,21 +240,21 @@ static void scan_files_piv(void) { file_put_data(ef, dhash, sizeof(dhash)); } } - if ((ef = search_by_fid(EF_PIV_KEY_ATTESTATION, NULL, SPECIFY_ANY))) { + if ((ef = file_search_by_fid(EF_PIV_KEY_ATTESTATION, NULL, SPECIFY_ANY))) { if (!ef->data) { printf("ATTESTATION key is empty. Initializing with random one\r\n"); mbedtls_ecdsa_context ecdsa; mbedtls_ecdsa_init(&ecdsa); - int r = mbedtls_ecdsa_genkey(&ecdsa, MBEDTLS_ECP_DP_SECP384R1, random_gen, NULL); + int r = mbedtls_ecdsa_genkey(&ecdsa, MBEDTLS_ECP_DP_SECP384R1, random_fill_iterator, NULL); r = store_keys(&ecdsa, ALGO_ECDSA, EF_PIV_KEY_ATTESTATION, false); uint8_t cert[2048]; r = x509_create_cert(&ecdsa, PIV_ALGO_ECCP384, EF_PIV_KEY_ATTESTATION, false, cert, sizeof(cert)); - ef = search_by_fid(EF_PIV_ATTESTATION, NULL, SPECIFY_ANY); + ef = file_search_by_fid(EF_PIV_ATTESTATION, NULL, SPECIFY_ANY); file_put_data(ef, cert + sizeof(cert) - r, r); mbedtls_ecdsa_free(&ecdsa); } } - low_flash_available(); + flash_commit(); } void init_piv(void) { @@ -262,7 +264,7 @@ void init_piv(void) { } static int piv_unload(void) { - return PICOKEY_OK; + return PICOKEYS_OK; } static void select_piv_aid(void) { @@ -298,7 +300,7 @@ static int piv_select_aid(app_t *a, uint8_t force) { a->unload = piv_unload; init_piv(); select_piv_aid(); - return PICOKEY_OK; + return PICOKEYS_OK; } INITIALIZER( piv_ctor ) { @@ -349,10 +351,10 @@ static int cmd_piv_verify(void) { } file_t *pw, *pw_status; uint16_t fid = EF_PIV_PIN; - if (!(pw = search_by_fid(fid, NULL, SPECIFY_EF))) { + if (!(pw = file_search_by_fid(fid, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } - if (!(pw_status = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF))) { + if (!(pw_status = file_search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } if (file_get_data(pw)[0] == 0) { //not initialized @@ -392,7 +394,7 @@ static int cmd_piv_get_data(void) { return SW_FILE_NOT_FOUND(); } file_t *ef = NULL; - if ((ef = search_by_fid((uint16_t)(fid & 0xFFFF), NULL, SPECIFY_EF))) { + if ((ef = file_search_by_fid((uint16_t)(fid & 0xFFFF), NULL, SPECIFY_EF))) { uint16_t data_len = 0; res_APDU_size = 2; // Minimum: TAG+LEN if ((ef->type & FILE_DATA_FUNC) == FILE_DATA_FUNC) { @@ -436,7 +438,7 @@ static int cmd_get_metadata(void) { else if (key_ref == 0x81) { key_ref = EF_PIV_PUK; } - file_t *ef_key = search_by_fid(key_ref, NULL, SPECIFY_EF); + file_t *ef_key = file_search_by_fid(key_ref, NULL, SPECIFY_EF); if (!file_has_data(ef_key)) { return SW_REFERENCE_NOT_FOUND(); } @@ -464,13 +466,13 @@ static int cmd_get_metadata(void) { mbedtls_rsa_context ctx; mbedtls_rsa_init(&ctx); int r = load_private_key_rsa(&ctx, ef_key, false); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { mbedtls_rsa_free(&ctx); return SW_EXEC_ERROR(); } res_APDU[res_APDU_size++] = 0x81; res_APDU[res_APDU_size++] = 0x82; - put_uint16_t_be(mbedtls_mpi_size(&ctx.N), res_APDU + res_APDU_size); res_APDU_size += 2; + put_uint16_be(mbedtls_mpi_size(&ctx.N), res_APDU + res_APDU_size); res_APDU_size += 2; mbedtls_mpi_write_binary(&ctx.N, res_APDU + res_APDU_size, mbedtls_mpi_size(&ctx.N)); res_APDU_size += mbedtls_mpi_size(&ctx.N); res_APDU[res_APDU_size++] = 0x82; @@ -483,7 +485,7 @@ static int cmd_get_metadata(void) { mbedtls_ecdsa_context ctx; mbedtls_ecdsa_init(&ctx); int r = load_private_key_ecdsa(&ctx, ef_key, false); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { mbedtls_ecdsa_free(&ctx); return SW_EXEC_ERROR(); } @@ -539,11 +541,11 @@ static int cmd_get_metadata(void) { res_APDU[res_APDU_size++] = eq == 0; if (key_ref == EF_PIV_PIN || key_ref == EF_PIV_PUK) { file_t *pw_status; - if (!(pw_status = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF))) { + if (!(pw_status = file_search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } uint8_t retries = *(file_get_data(pw_status) + 3 + (key_ref & 0xf)); - if (!(pw_status = search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_EF))) { + if (!(pw_status = file_search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } uint8_t total = *(file_get_data(pw_status) + (key_ref & 0xf)); @@ -570,7 +572,7 @@ static int cmd_authenticate(void) { if (algo != PIV_ALGO_AES128 && algo != PIV_ALGO_AES192 && algo != PIV_ALGO_AES256 && algo != PIV_ALGO_3DES) { return SW_INCORRECT_P1P2(); } - file_t *ef_mgm = search_by_fid(key_ref, NULL, SPECIFY_EF); + file_t *ef_mgm = file_search_by_fid(key_ref, NULL, SPECIFY_EF); if (!file_has_data(ef_mgm)) { return SW_MEMORY_FAILURE(); } @@ -612,7 +614,7 @@ static int cmd_authenticate(void) { if (key_ref != EF_PIV_KEY_CARDMGM) { return SW_INCORRECT_P1P2(); } - file_t *ef_mgm = search_by_fid(key_ref, NULL, SPECIFY_EF); + file_t *ef_mgm = file_search_by_fid(key_ref, NULL, SPECIFY_EF); if (!file_has_data(ef_mgm)) { return SW_MEMORY_FAILURE(); } @@ -679,7 +681,7 @@ static int cmd_authenticate(void) { has_challenge = true; } else { - file_t *ef_key = search_by_fid(key_ref == 0x93 ? EF_PIV_KEY_RETIRED18 : key_ref, NULL, SPECIFY_EF); + file_t *ef_key = file_search_by_fid(key_ref == 0x93 ? EF_PIV_KEY_RETIRED18 : key_ref, NULL, SPECIFY_EF); if (!file_has_data(ef_key)) { return SW_MEMORY_FAILURE(); } @@ -687,7 +689,7 @@ static int cmd_authenticate(void) { mbedtls_rsa_context ctx; mbedtls_rsa_init(&ctx); int r = load_private_key_rsa(&ctx, ef_key, false); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { mbedtls_rsa_free(&ctx); return SW_EXEC_ERROR(); } @@ -700,7 +702,7 @@ static int cmd_authenticate(void) { memcpy(res_APDU, "\x7C\x82\x00\x00\x82\x82\x00\x00", 8); res_APDU_size = 8; } - r = mbedtls_rsa_private(&ctx, random_gen, NULL, a81.data, res_APDU + res_APDU_size); + r = mbedtls_rsa_private(&ctx, random_fill_iterator, NULL, a81.data, res_APDU + res_APDU_size); mbedtls_rsa_free(&ctx); if (algo == PIV_ALGO_RSA1024) { res_APDU[res_APDU_size - 1] = olen; @@ -721,14 +723,14 @@ static int cmd_authenticate(void) { mbedtls_ecdsa_context ctx; mbedtls_ecdsa_init(&ctx); int r = load_private_key_ecdsa(&ctx, ef_key, false); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { mbedtls_ecdsa_free(&ctx); return SW_EXEC_ERROR(); } size_t olen = 0; memcpy(res_APDU, "\x7C\x00\x82\x00", 4); res_APDU_size = 4; - r = mbedtls_ecdsa_write_signature(&ctx, algo == PIV_ALGO_ECCP256 ? MBEDTLS_MD_SHA256 : MBEDTLS_MD_SHA384, a81.data, a81.len, res_APDU + res_APDU_size, MBEDTLS_ECDSA_MAX_LEN, &olen, random_gen, NULL); + r = mbedtls_ecdsa_write_signature(&ctx, algo == PIV_ALGO_ECCP256 ? MBEDTLS_MD_SHA256 : MBEDTLS_MD_SHA384, a81.data, a81.len, res_APDU + res_APDU_size, MBEDTLS_ECDSA_MAX_LEN, &olen, random_fill_iterator, NULL); mbedtls_ecdsa_free(&ctx); res_APDU[res_APDU_size - 1] = olen; res_APDU[res_APDU_size - 3] = olen + 2; @@ -792,7 +794,7 @@ static int cmd_authenticate(void) { if (chal_len != a82.len) { return SW_DATA_INVALID(); } - file_t *ef_key = search_by_fid(key_ref, NULL, SPECIFY_EF); + file_t *ef_key = file_search_by_fid(key_ref, NULL, SPECIFY_EF); if (!file_has_data(ef_key)) { return SW_MEMORY_FAILURE(); } @@ -890,7 +892,7 @@ static int cmd_asym_keygen(void) { if (asn1_len(&a81)) { exponent = (int)asn1_get_uint(&a81); } - int r = mbedtls_rsa_gen_key(&rsa, random_gen, NULL, nlen, exponent); + int r = mbedtls_rsa_gen_key(&rsa, random_fill_iterator, NULL, nlen, exponent); if (r != 0) { mbedtls_rsa_free(&rsa); return SW_EXEC_ERROR(); @@ -898,11 +900,11 @@ static int cmd_asym_keygen(void) { make_rsa_response(&rsa); uint8_t cert[2048]; r = x509_create_cert(&rsa, a80.data[0], key_ref, false, cert, sizeof(cert)); - file_t *ef = search_by_fid(key_cert, NULL, SPECIFY_ANY); + file_t *ef = file_search_by_fid(key_cert, NULL, SPECIFY_ANY); file_put_data(ef, cert + sizeof(cert) - r, r); r = store_keys(&rsa, ALGO_RSA, key_ref == 0x93 ? EF_PIV_KEY_RETIRED18 : key_ref, false); mbedtls_rsa_free(&rsa); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_EXEC_ERROR(); } } @@ -911,7 +913,7 @@ static int cmd_asym_keygen(void) { mbedtls_ecp_group_id gid = a80.data[0] == PIV_ALGO_ECCP256 ? MBEDTLS_ECP_DP_SECP256R1 : MBEDTLS_ECP_DP_SECP384R1; mbedtls_ecdsa_context ecdsa; mbedtls_ecdsa_init(&ecdsa); - int r = mbedtls_ecdsa_genkey(&ecdsa, gid, random_gen, NULL); + int r = mbedtls_ecdsa_genkey(&ecdsa, gid, random_fill_iterator, NULL); if (r != 0) { mbedtls_ecdsa_free(&ecdsa); return SW_EXEC_ERROR(); @@ -919,11 +921,11 @@ static int cmd_asym_keygen(void) { make_ecdsa_response(&ecdsa); uint8_t cert[2048]; r = x509_create_cert(&ecdsa, a80.data[0], key_ref, false, cert, sizeof(cert)); - file_t *ef = search_by_fid(key_cert, NULL, SPECIFY_ANY); + file_t *ef = file_search_by_fid(key_cert, NULL, SPECIFY_ANY); file_put_data(ef, cert + sizeof(cert) - r, r); r = store_keys(&ecdsa, ALGO_ECDSA, key_ref == 0x93 ? EF_PIV_KEY_RETIRED18 : key_ref, false); mbedtls_ecdsa_free(&ecdsa); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { return SW_EXEC_ERROR(); } } @@ -938,7 +940,7 @@ static int cmd_asym_keygen(void) { } uint8_t meta[] = {a80.data[0], asn1_len(&aaa) ? aaa.data[0] : def_pinpol, asn1_len(&aab) ? aab.data[0] : TOUCHPOLICY_ALWAYS, ORIGIN_GENERATED}; meta_add(key_ref, meta, sizeof(meta)); - low_flash_available(); + flash_commit(); return SW_OK(); } @@ -956,7 +958,7 @@ static int cmd_piv_put_data(void) { return SW_WRONG_DATA(); } uint16_t fid = (a5c.data[1] << 8 | a5c.data[2]); - file_t *ef = search_by_fid(fid, NULL, SPECIFY_EF); + file_t *ef = file_search_by_fid(fid, NULL, SPECIFY_EF); if (!ef) { return SW_MEMORY_FAILURE(); } @@ -966,7 +968,7 @@ static int cmd_piv_put_data(void) { else { flash_clear_file(ef); } - low_flash_available(); + flash_commit(); } return SW_OK(); } @@ -992,7 +994,7 @@ static int cmd_set_mgmkey(void) { if ((key_ref != EF_PIV_KEY_CARDMGM) || (!(algo == PIV_ALGO_AES128 && pinlen == 16) && !(algo == PIV_ALGO_AES192 && pinlen == 24) && !(algo == PIV_ALGO_AES256 && pinlen == 32) && !(algo == PIV_ALGO_3DES && pinlen == 24))) { return SW_WRONG_DATA(); } - file_t *ef = search_by_fid(key_ref, NULL, SPECIFY_ANY); + file_t *ef = file_search_by_fid(key_ref, NULL, SPECIFY_ANY); file_put_data(ef, apdu.data + 3, pinlen); uint8_t *meta = NULL, new_meta[4]; int meta_len = 0; @@ -1003,7 +1005,7 @@ static int cmd_set_mgmkey(void) { new_meta[0] = algo; new_meta[2] = touch; meta_add(key_ref, new_meta, sizeof(new_meta)); - low_flash_available(); + flash_commit(); return SW_OK(); } @@ -1025,7 +1027,7 @@ static int cmd_move_key(void) { to = EF_PIV_KEY_RETIRED18; } file_t *efs, *efd; - if (!(efs = search_by_fid(from, NULL, SPECIFY_EF)) || (!(efd = search_by_fid(to, NULL, SPECIFY_EF)) && to != 0xFF)) { + if (!(efs = file_search_by_fid(from, NULL, SPECIFY_EF)) || (!(efd = file_search_by_fid(to, NULL, SPECIFY_EF)) && to != 0xFF)) { return SW_FILE_NOT_FOUND(); } uint16_t cert_from_fid = 0; @@ -1073,9 +1075,9 @@ static int cmd_move_key(void) { file_put_data(efd, file_get_data(efs), file_get_size(efs)); } - file_t *ef_cert_from = search_by_fid(cert_from_fid, NULL, SPECIFY_EF); + file_t *ef_cert_from = file_search_by_fid(cert_from_fid, NULL, SPECIFY_EF); if (to != 0xFF) { - file_t *ef_cert_to = search_by_fid(cert_to_fid, NULL, SPECIFY_EF); + file_t *ef_cert_to = file_search_by_fid(cert_to_fid, NULL, SPECIFY_EF); if (!ef_cert_to) { return SW_FILE_NOT_FOUND(); } @@ -1108,7 +1110,7 @@ static int cmd_move_key(void) { } meta_delete(from); flash_clear_file(efs); - low_flash_available(); + flash_commit(); return SW_OK(); } @@ -1117,7 +1119,7 @@ static int cmd_piv_change_pin(void) { if (P1(apdu) != 0x0 || (pin_ref != 0x80 && pin_ref != 0x81)) { return SW_INCORRECT_P1P2(); } - file_t *ef = search_by_fid(pin_ref == 0x80 ? EF_PIV_PIN : EF_PIV_PUK, NULL, SPECIFY_ANY); + file_t *ef = file_search_by_fid(pin_ref == 0x80 ? EF_PIV_PIN : EF_PIV_PUK, NULL, SPECIFY_ANY); if (!ef) { return SW_MEMORY_FAILURE(); } @@ -1132,7 +1134,7 @@ static int cmd_piv_change_pin(void) { dhash[1] = 0x1; // Format pin_derive_verifier(apdu.data + pin_data[0], pin_len, dhash + 2); file_put_data(ef, dhash, sizeof(dhash)); - low_flash_available(); + flash_commit(); return SW_OK(); } @@ -1140,7 +1142,7 @@ static int cmd_piv_reset_retry(void) { if (P1(apdu) != 0x0 || P2(apdu) != 0x80) { return SW_INCORRECT_P1P2(); } - file_t *ef = search_by_fid(EF_PIV_PUK, NULL, SPECIFY_ANY); + file_t *ef = file_search_by_fid(EF_PIV_PUK, NULL, SPECIFY_ANY); if (!ef) { return SW_MEMORY_FAILURE(); } @@ -1153,15 +1155,15 @@ static int cmd_piv_reset_retry(void) { dhash[0] = pin_len; dhash[1] = 0x1; // Format pin_derive_verifier(apdu.data + puk_data[0], pin_len, dhash + 2); - ef = search_by_fid(EF_PIV_PIN, NULL, SPECIFY_ANY); + ef = file_search_by_fid(EF_PIV_PIN, NULL, SPECIFY_ANY); file_put_data(ef, dhash, sizeof(dhash)); pin_reset_retries(ef, true); - low_flash_available(); + flash_commit(); return SW_OK(); } static int cmd_set_retries(void) { - file_t *ef = search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_ANY); + file_t *ef = file_search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_ANY); if (!ef) { return SW_MEMORY_FAILURE(); } @@ -1172,7 +1174,7 @@ static int cmd_set_retries(void) { file_put_data(ef, tmp, file_get_size(ef)); free(tmp); - ef = search_by_fid(EF_PIV_PIN, NULL, SPECIFY_ANY); + ef = file_search_by_fid(EF_PIV_PIN, NULL, SPECIFY_ANY); const uint8_t def_pin[8] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0xFF, 0xFF }; uint8_t dhash[34]; @@ -1182,7 +1184,7 @@ static int cmd_set_retries(void) { file_put_data(ef, dhash, sizeof(dhash)); pin_reset_retries(ef, true); - ef = search_by_fid(EF_PIV_PUK, NULL, SPECIFY_ANY); + ef = file_search_by_fid(EF_PIV_PUK, NULL, SPECIFY_ANY); const uint8_t def_puk[8] = {0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38}; dhash[0] = sizeof(def_puk); dhash[1] = 0x1; // Format @@ -1190,7 +1192,7 @@ static int cmd_set_retries(void) { file_put_data(ef, dhash, sizeof(dhash)); pin_reset_retries(ef, true); - low_flash_available(); + flash_commit(); return SW_OK(); } @@ -1199,7 +1201,7 @@ static int cmd_reset(void) { return SW_INCORRECT_P1P2(); } file_t *pw_status; - if (!(pw_status = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF))) + if (!(pw_status = file_search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF))) { return SW_REFERENCE_NOT_FOUND(); } @@ -1207,8 +1209,8 @@ static int cmd_reset(void) { if (retPIN != 0 || retPUK != 0) { return SW_INCORRECT_PARAMS(); } - initialize_flash(true); - low_flash_available(); + file_initialize_flash(true); + flash_commit(); init_piv(); return SW_OK(); } @@ -1224,7 +1226,7 @@ static int cmd_attestation(void) { file_t *ef_key = NULL; int meta_len = 0; uint8_t *meta = NULL; - if (!(ef_key = search_by_fid(key_ref == 0x93 ? EF_PIV_KEY_RETIRED18 : key_ref, NULL, SPECIFY_EF)) || !file_has_data(ef_key)) { + if (!(ef_key = file_search_by_fid(key_ref == 0x93 ? EF_PIV_KEY_RETIRED18 : key_ref, NULL, SPECIFY_EF)) || !file_has_data(ef_key)) { return SW_REFERENCE_NOT_FOUND(); } if ((meta_len = meta_find(key_ref, &meta)) <= 0) { @@ -1239,7 +1241,7 @@ static int cmd_attestation(void) { mbedtls_rsa_context ctx; mbedtls_rsa_init(&ctx); r = load_private_key_rsa(&ctx, ef_key, false); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { mbedtls_rsa_free(&ctx); return SW_EXEC_ERROR(); } @@ -1250,7 +1252,7 @@ static int cmd_attestation(void) { mbedtls_ecdsa_context ctx; mbedtls_ecdsa_init(&ctx); r = load_private_key_ecdsa(&ctx, ef_key, false); - if (r != PICOKEY_OK) { + if (r != PICOKEYS_OK) { mbedtls_ecdsa_free(&ctx); return SW_EXEC_ERROR(); } @@ -1333,12 +1335,12 @@ static int cmd_import_asym(void) { mbedtls_ecdsa_free(&ecdsa); return SW_EXEC_ERROR(); } - r = mbedtls_ecp_mul(&ecdsa.grp, &ecdsa.Q, &ecdsa.d, &ecdsa.grp.G, random_gen, NULL); + r = mbedtls_ecp_mul(&ecdsa.grp, &ecdsa.Q, &ecdsa.d, &ecdsa.grp.G, random_fill_iterator, NULL); if (r != 0) { mbedtls_ecdsa_free(&ecdsa); return SW_EXEC_ERROR(); } - r = mbedtls_ecp_check_pub_priv(&ecdsa, &ecdsa, random_gen, NULL); + r = mbedtls_ecp_check_pub_priv(&ecdsa, &ecdsa, random_fill_iterator, NULL); if (r != 0) { mbedtls_ecdsa_free(&ecdsa); return SW_EXEC_ERROR();