mirrors/pico-hsm
1
0
Fork 0
mirror of https://github.com/polhenarejos/pico-hsm.git synced 2026-01-17 09:28:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
498 commits 2 branches 31 tags 2.8 MiB
Commit graph

498 commits

This branch
This branch
All branches
Author SHA1 Message Date
Pol Henarejos
fc6c852e09
When used this tool, the device is always reset to default state. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-18 20:09:23 +02:00
Pol Henarejos
82f61ff1d4
When initialized, the device key (EF_KEY_DEV) is only generated if not found. 
To generate a new device key, it must be wiped.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-18 20:08:54 +02:00
Pol Henarejos
64052f4f70
Marked EF_DEV files as persistent to remain permanent. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-18 20:08:11 +02:00
Pol Henarejos
36c8150f25
Enhanced the procedure for burning the device certificate. 
When initialized, the device generates a private key in place and stores it encrypted. The publick key is recovered and sent to our PKI, which generates a CV certificate. This CV certificate is stored inside the device, jointly with the DV CVC.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-18 18:17:48 +02:00
Pol Henarejos
cb492728ec
Device key now uses SECP256R1 curve. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-18 18:17:48 +02:00
Pol Henarejos
fec02ca733
Removing cvcerts.h dependency. 
A python script gets the public key of the device (EF_EE_DEV) and requests to our PKI for a CVC. Once got, it is updated to EF_TERMCA (0x2f02).
termca_pk is now on EF_KEY_DEV and termca is on EF_TERMCA (concat with DICA).

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-18 18:17:48 +02:00
Pol Henarejos
4e01a78286
Fix OID names. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-18 18:17:48 +02:00
Pol Henarejos
538b39386b
List keys returns the DEV key if exists. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-18 18:17:48 +02:00
Pol Henarejos
977aced343
Fix OID names. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-18 18:17:48 +02:00
Pol Henarejos
83b5753bb5
Fix saving DEV key. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-18 18:17:48 +02:00
Pol Henarejos
a57c3b691f
Fix passing DEBUG_APDU flag. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-18 18:17:48 +02:00
Pol Henarejos
648a374ebb
Create codeql.yml 2022-08-17 18:27:55 +02:00
Pol Henarejos
c3568e1211
Create the terminal private key with id = 0. 
This is the terminal private key, which will be signed by our PKI.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-14 01:20:54 +02:00
Pol Henarejos
6a16d4d55c
Fix returning store_keys(); 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-14 01:17:06 +02:00
Pol Henarejos
ab2e71cc40
By default, all CVC are self-generated (chr=car). 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-14 01:16:53 +02:00
Pol Henarejos
f79fe9f7d0
Fix when no DKEK is present. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-14 01:16:33 +02:00
Pol Henarejos
6956587106
Add newline at the end of file. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-13 23:31:09 +02:00
Pol Henarejos
349df56b09
Missing header. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-13 15:00:05 +02:00
Pol Henarejos
e6f082d512
Splitting cmd_xxx() functions in separate files. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-13 14:59:27 +02:00
Pol Henarejos
87feed1222
Renaming KEK files. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-13 13:47:43 +02:00
Pol Henarejos
55c8a66613
Fix wrap/unwrap keys with specific allowed algorithms. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-13 02:58:36 +02:00
Pol Henarejos
2e88422c86
Fix deleting KEK when a key is present in the key domain. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-13 00:50:22 +02:00
Pol Henarejos
da841b82d4
Fix deleting KEK. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-13 00:48:05 +02:00
Pol Henarejos
9256a72c3e
Added XKEK derivation to save the KEK from XKEK key domain. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-13 00:43:55 +02:00
Pol Henarejos
69120cc961
Added cvc_get_ext() to find CVC extensions. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-13 00:43:35 +02:00
Pol Henarejos
06aaf58f0b
Added extension optional parameter to be included in the CVC body. 
This field should be a concatenation of tag 73, which should include an OID and a context.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-13 00:07:24 +02:00
Pol Henarejos
12e5a586d2
Adding support for XKEK CVC extension. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 22:18:21 +02:00
Pol Henarejos
0e76ed7077
Adding OID for CVC extensions. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 21:12:56 +02:00
Pol Henarejos
be911a7aa7
Clearing hash, just in case. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 19:55:07 +02:00
Pol Henarejos
0556a528f3
Fix DKEK key domain creation. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 19:51:59 +02:00
Pol Henarejos
de789cef66
Fix Key Domain deletion. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 19:46:08 +02:00
Pol Henarejos
7208d01547
Adding XKEK Key Domain creation. 
It validates the membership and creates a XKEK Key Domain. XKEK Key Domains can only be created based on memberships for THAT device. A device can only create XKEK Key Domains with memberships issued for itself.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 19:36:10 +02:00
Pol Henarejos
46cb0a455d
Fix DKEK are only created when requested and not by default. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 14:01:19 +02:00
Pol Henarejos
300e19b612
Moving to mbedtls_platform_zeroize() for better zeroization. 
Also added more zeroization when a private/secret key is loaded in memory.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 01:52:37 +02:00
Pol Henarejos
2666573050
Fix dkek status report when device is initialized without dkek. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 01:00:27 +02:00
Pol Henarejos
5506b46c9d
Fix finding MKEK file. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 00:57:08 +02:00
Pol Henarejos
7b27cb7a1c
MKEK is also stored with SO encryption. 
A copy of MKEK is also stored but encrypted with SO-PIN. Thus, we always ensure that we have an operative copy of MKEK, either with PIN and/or SO-PIN. If user resets PIN, the MKEK is loaded with SO-PIN and stored with the derived key from new PIN.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 00:41:04 +02:00
Pol Henarejos
84a70a1de0
Adding MKEK_SO file descriptor. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 00:39:25 +02:00
Pol Henarejos
1756ec49ad
When user resets retry counter and sends the SO-PIN (P1=0x0) it becomes authenticated in this session. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 00:29:34 +02:00
Pol Henarejos
7b286b04b1
Introducing MKEK (Master Key Encryption Key). 
MKEK is used to encrypt all keys in the device, regardless of Key Domains or DKEK. From now on, all keys are encrypted using an AES 256-bit secret key. MKEK is also encrypted and stored based on a derived key from PIN. When user introduces the PIN, the MKEK can be unlocked to load the stored private/secret keys.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-12 00:20:02 +02:00
Pol Henarejos
a731e88c78
Adding MKEK ef id. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-11 22:59:54 +02:00
Pol Henarejos
ffd31f2ea7
Memset kcv to 0 always when called. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-10 23:58:01 +02:00
Pol Henarejos
356eeea505
Added support for ECDH_XKEK. 
Note that it is unfinished. ECDH_XKEK is utilized for deriving and setting the KEK, based on the calc DH secret. It should not return anything, just SW_OK (this is not what is happening right now).

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-10 23:51:41 +02:00
Pol Henarejos
34d9469157
When creating XKEK domain, it returns key domain UID. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-10 23:29:08 +02:00
Pol Henarejos
36b1bf9875
Added ECDH algorithms for XKEK and AUT. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-10 23:28:44 +02:00
Pol Henarejos
7badd19a07
Upgrading PICO SDK to v1.4 and adding new boards. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-09 01:28:39 +02:00
Pol Henarejos
f122a9ab28
Upgrade to version 2.6. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-09 00:42:58 +02:00
Pol Henarejos
14dbad4dd7
Do not return PIN unitialized if PKA is enabled. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-09 00:27:53 +02:00
Pol Henarejos
cdce9ab50b
Adding pka_enabled() to check whether the device is configured with PKA. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-09 00:26:56 +02:00
Pol Henarejos
30d3270e1d
Adding clarification on setting PKA and PIN with SCS3. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-08-09 00:26:35 +02:00