Skip to content

Commit

Permalink
nrf_security: Add platform key revocation support for SICR keys
Browse files Browse the repository at this point in the history 
Adds support of key revocation using the psa_destroy_key API.
The value 0xfa50 is used in the key type in order to mark an
revoked key.

The return code PSA_ERROR_NOT_PERMITTED is returned for
revoked keys for all the functions in the PSA crypto driver
wrapper. This error code seems OK since it mentions
platform specific policies for not permitted an operation.

Ref: NCSDK-30076

Signed-off-by: Georgios Vasilakis <[email protected]>
  • Loading branch information
@Vge0rge
Vge0rge committed Jan 6, 2025
1 parent 1d269a6 commit 8008df6
Show file tree
Hide file tree
Showing 3 changed files with 63 additions and 4 deletions.
3 changes: 3 additions & 0 deletions subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1388,6 +1388,9 @@ psa_status_t cracen_destroy_key(const psa_key_attributes_t *attributes)
#ifdef CONFIG_PSA_NEED_CRACEN_KMU_DRIVER
return cracen_kmu_destroy_key(attributes);
#endif
#ifdef CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
return cracen_platform_destroy_key(attributes);
#endif

return PSA_ERROR_DOES_NOT_EXIST;
}
62 changes: 58 additions & 4 deletions subsys/nrf_security/src/drivers/cracen/cracenpsa/src/platform_keys/platform_keys.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,8 @@
#define PLATFORM_KEY_GET_DOMAIN(x) (((x) >> 16) & 0xff)
#define PLATFORM_KEY_GET_ACCESS(x) (((x) >> 24) & 0xf)

#define PLATFORM_KEY_REVOKED_FLAG (0xFA50)

#define MAX_KEY_SIZE 32

static struct {
Expand Down Expand Up @@ -144,6 +146,7 @@ typedef enum {
DERIVED,
SICR,
IKG,
REVOKED
} key_type;

#define APPEND_STR(str, end, part) \
Expand Down Expand Up @@ -176,7 +179,7 @@ static key_type find_key(uint32_t id, platform_key *key)
key->sicr.key_buffer_max_length = sizeof((x)[gen].CIPHERTEXT); \
key->sicr.mac = (uint8_t *)(x)[gen].MAC; \
key->sicr.mac_size = sizeof((x)[gen].MAC); \
return SICR; \
return (key->sicr.type == PLATFORM_KEY_REVOKED_FLAG) ? REVOKED : SICR; \
} \
break;

Expand All @@ -194,7 +197,7 @@ static key_type find_key(uint32_t id, platform_key *key)
key->sicr.key_buffer_max_length = sizeof((x)[gen].PUBKEY); \
key->sicr.mac = (uint8_t *)(x)[gen].MAC; \
key->sicr.mac_size = sizeof((x)[gen].MAC); \
return SICR; \
return (key->sicr.type == PLATFORM_KEY_REVOKED_FLAG) ? REVOKED : SICR; \
} \
break;

Expand Down Expand Up @@ -370,6 +373,10 @@ psa_status_t cracen_platform_get_builtin_key(psa_drv_slot_number_t slot_number,
platform_key key;
key_type type = find_key((uint32_t)slot_number, &key);

if (type == REVOKED) {
return PSA_ERROR_NOT_PERMITTED;
}

if (type == SICR) {
uint32_t key_id = (uint32_t)slot_number;
uint32_t domain = PLATFORM_KEY_GET_DOMAIN(key_id);
Expand Down Expand Up @@ -559,7 +566,7 @@ size_t cracen_platform_keys_get_size(psa_key_attributes_t const *attributes)
key_type type = find_key(MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes)), &key);
psa_key_type_t key_type = psa_get_key_type(attributes);

if (type == INVALID) {
if (type == INVALID || type == REVOKED) {
return 0;
}

Expand All @@ -581,6 +588,10 @@ psa_status_t cracen_platform_get_key_slot(mbedtls_svc_key_id_t key_id, psa_key_l
platform_key key;
key_type type = find_key(MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key_id), &key);

if (type == REVOKED) {
return PSA_ERROR_NOT_PERMITTED;
}

psa_status_t status = verify_access(MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(key_id),
MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key_id));
if (status != PSA_SUCCESS) {
Expand Down Expand Up @@ -619,7 +630,9 @@ psa_status_t cracen_platform_keys_provision(const psa_key_attributes_t *attribut
uint8_t encrypted_key[MAX_KEY_SIZE];
size_t outlen;

if (type != SICR) {
if (type == REVOKED) {
return PSA_ERROR_NOT_PERMITTED;
} else if (type != SICR) {
return PSA_ERROR_INVALID_ARGUMENT;
}

Expand Down Expand Up @@ -706,3 +719,44 @@ psa_status_t cracen_platform_keys_provision(const psa_key_attributes_t *attribut

return status;
}

#define STATIC_ARRAY[ARRAY_SIZE] = {


}

psa_status_t cracen_platform_destroy_key(const psa_key_attributes_t *attributes)
{
uint32_t key_id = MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes));
platform_key key;
key_type type = find_key(MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes)), &key);
uint32_t domain = PLATFORM_KEY_GET_DOMAIN(key_id);
/* The value 0x00 was chosen arbitarily here, 0xFF was not used to distinguish revoked keys
* from keys not yet written.
*/
const static uint8_t revoked_key_val[MAX_KEY_SIZE] = {0x0};

if (type == REVOKED) {
return PSA_ERROR_NOT_PERMITTED;
} else if (type != SICR) {
return PSA_ERROR_INVALID_ARGUMENT;
}

psa_status_t status =
verify_access(MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(psa_get_key_id(attributes)),
MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes)));

if (status != PSA_SUCCESS) {
return status;
}

uint32_t revoked_key_attr = (key.sicr.bits << 16) | PLATFORM_KEY_REVOKED_FLAG;

/* The nonce will be written to MRAM based from the buffer in the platform_key, so we
* set it here before the call to write function.
*/
key.sicr.nonce[0] = 0x0;
write_sicr_key_to_mram(key, revoked_key_attr, revoked_key_val, sizeof(revoked_key_val));

return PSA_SUCCESS;
}
2 changes: 2 additions & 0 deletions subsys/nrf_security/src/drivers/cracen/cracenpsa/src/platform_keys/platform_keys.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,4 +21,6 @@ psa_status_t cracen_platform_get_key_slot(mbedtls_svc_key_id_t key_id, psa_key_l
psa_status_t cracen_platform_keys_provision(const psa_key_attributes_t *attributes,
const uint8_t *key_buffer, size_t key_buffer_size);

psa_status_t cracen_platform_destroy_key(const psa_key_attributes_t *attributes);

#endif /* CRACEN_PLATFORM_KEYS_H */

0 comments on commit 8008df6

Please sign in to comment.