trussed/trussed-rsa-backend
0
0
Fork 0
mirror of https://github.com/trussed-dev/trussed-rsa-backend.git synced 2026-06-20 04:16:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Port 725d4d6c85 to all key sizes

Browse Source
This commit is contained in:
Sosthène Guédon
2023-02-06 14:39:50 +01:00
parent 725d4d6c85
commit eed9e06ca9
4 changed files with 111 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/crypto_traits.rs
+90 -28
View File
@@ -41,26 +41,41 @@ pub trait Rsa2048Pkcs1v15: CryptoClient {
)
}
fn serialize_rsa2048pkcs_key(
&mut self,
key: KeyId,
format: KeySerialization,
) -> ClientResult<'_, reply::SerializeKey, Self> {
self.serialize_key(Mechanism::Rsa2048Pkcs1v15, key, format)
/// Serializes an RSA 2048 bit key.
///
/// The resulting [`serialized_key`](trussed::api::reply::SerializeKey::serialized_key) contains a buffer of the parts of the key
/// as a postcard-serialized [`RsaPublicParts`](crate::RsaPublicParts):
/// ```
///# use rsa_backend::*;
///# use trussed::{postcard_deserialize,syscall,types::Location::{Volatile,Internal}};
///# mod client {
///# include!("../tests/client/mod.rs");
///# }
///# client::get(|client| {
///# let sk = syscall!(client.generate_rsa2048pkcs_private_key(Internal)).key;
///# let pk = syscall!(client.derive_rsa2048pkcs_public_key(sk, Volatile)).key;
/// let serialized_key = syscall!(client.serialize_rsa2048_key(pk)).serialized_key;
/// let public_key: RsaPublicParts = postcard_deserialize(&serialized_key).unwrap();
///# })
///```
fn serialize_rsa2048_key(&mut self, key: KeyId) -> ClientResult<'_, reply::SerializeKey, Self> {
self.serialize_key(Mechanism::Rsa2048Pkcs1v15, key, KeySerialization::RsaParts)
}
fn deserialize_rsa2048pkcs_key<'c>(
fn deserialize_rsa2048_public_key<'c>(
&'c mut self,
serialized_key: &[u8],
format: KeySerialization,
key_parts: RsaPublicParts,
attributes: StorageAttributes,
) -> ClientResult<'c, reply::DeserializeKey, Self> {
self.deserialize_key(
Mechanism::Rsa2048Pkcs1v15,
serialized_key,
format,
self.request(DeserializeKey {
mechanism: Mechanism::Rsa2048Pkcs1v15,
serialized_key: postcard_serialize_bytes(&key_parts).map_err(|_err| {
error!("Failed to serialize key parts: {:?}", _err);
ClientError::DataTooLarge
})?,
format: KeySerialization::RsaParts,
attributes,
)
})
}
fn sign_rsa2048pkcs<'c>(
@@ -91,6 +106,22 @@ pub trait Rsa2048Pkcs1v15: CryptoClient {
)
}
fn unsafe_inject_rsa2048<'c>(
&'c mut self,
key_parts: RsaImportFormat,
attributes: StorageAttributes,
) -> ClientResult<'c, reply::UnsafeInjectKey, Self> {
self.request(UnsafeInjectKey {
mechanism: Mechanism::Rsa2048Pkcs1v15,
raw_key: postcard_serialize_bytes(&key_parts).map_err(|_err| {
error!("Failed to serialize key parts: {:?}", _err);
ClientError::DataTooLarge
})?,
attributes,
format: KeySerialization::RsaParts,
})
}
fn decrypt_rsa2048pkcs<'c>(
&'c mut self,
key: KeyId,
@@ -129,26 +160,41 @@ pub trait Rsa3072Pkcs1v15: CryptoClient {
)
}
fn serialize_rsa3072pkcs_key(
&mut self,
key: KeyId,
format: KeySerialization,
) -> ClientResult<'_, reply::SerializeKey, Self> {
self.serialize_key(Mechanism::Rsa3072Pkcs1v15, key, format)
/// Serializes an RSA 3072 bit key.
///
/// The resulting [`serialized_key`](trussed::api::reply::SerializeKey::serialized_key) contains a buffer of the parts of the key
/// as a postcard-serialized [`RsaPublicParts`](crate::RsaPublicParts):
/// ```
///# use rsa_backend::*;
///# use trussed::{postcard_deserialize,syscall,types::Location::{Volatile,Internal}};
///# mod client {
///# include!("../tests/client/mod.rs");
///# }
///# client::get(|client| {
///# let sk = syscall!(client.generate_rsa3072pkcs_private_key(Internal)).key;
///# let pk = syscall!(client.derive_rsa3072pkcs_public_key(sk, Volatile)).key;
/// let serialized_key = syscall!(client.serialize_rsa3072_key(pk)).serialized_key;
/// let public_key: RsaPublicParts = postcard_deserialize(&serialized_key).unwrap();
///# })
///```
fn serialize_rsa3072_key(&mut self, key: KeyId) -> ClientResult<'_, reply::SerializeKey, Self> {
self.serialize_key(Mechanism::Rsa3072Pkcs1v15, key, KeySerialization::RsaParts)
}
fn deserialize_rsa3072pkcs_key<'c>(
fn deserialize_rsa3072_public_key<'c>(
&'c mut self,
serialized_key: &[u8],
format: KeySerialization,
key_parts: RsaPublicParts,
attributes: StorageAttributes,
) -> ClientResult<'c, reply::DeserializeKey, Self> {
self.deserialize_key(
Mechanism::Rsa3072Pkcs1v15,
serialized_key,
format,
self.request(DeserializeKey {
mechanism: Mechanism::Rsa3072Pkcs1v15,
serialized_key: postcard_serialize_bytes(&key_parts).map_err(|_err| {
error!("Failed to serialize key parts: {:?}", _err);
ClientError::DataTooLarge
})?,
format: KeySerialization::RsaParts,
attributes,
)
})
}
fn sign_rsa3072pkcs<'c>(
@@ -179,6 +225,22 @@ pub trait Rsa3072Pkcs1v15: CryptoClient {
)
}
fn unsafe_inject_rsa3072<'c>(
&'c mut self,
key_parts: RsaImportFormat,
attributes: StorageAttributes,
) -> ClientResult<'c, reply::UnsafeInjectKey, Self> {
self.request(UnsafeInjectKey {
mechanism: Mechanism::Rsa3072Pkcs1v15,
raw_key: postcard_serialize_bytes(&key_parts).map_err(|_err| {
error!("Failed to serialize key parts: {:?}", _err);
ClientError::DataTooLarge
})?,
attributes,
format: KeySerialization::RsaParts,
})
}
fn decrypt_rsa3072pkcs<'c>(
&'c mut self,
key: KeyId,
tests/rsa2048.rs
+10 -21
View File
@@ -1,8 +1,7 @@
use rsa::sha2::Sha256;
use rsa::Pkcs1v15Encrypt;
use rsa::Pkcs1v15Sign;
use rsa::PublicKeyParts;
use rsa::{Pkcs1v15Encrypt, Pkcs1v15Sign, PublicKeyParts};
use trussed::client::CryptoClient;
use trussed::postcard_deserialize;
use trussed::syscall;
use trussed::types::KeyId;
use trussed::types::KeySerialization;
@@ -59,30 +58,23 @@ fn rsa2048pkcs_serialize_key() {
let sk = syscall!(client.generate_rsa2048pkcs_private_key(Internal)).key;
let pk = syscall!(client.derive_rsa2048pkcs_public_key(sk, Volatile)).key;
let serialized_key =
syscall!(client.serialize_rsa2048pkcs_key(pk, KeySerialization::Pkcs8Der))
.serialized_key;
let serialized_key = syscall!(client.serialize_rsa2048_key(pk)).serialized_key;
assert!(!serialized_key.is_empty());
})
}
#[test_log::test]
fn rsa2048pkcs_deserialize_key() {
fn rsa2048_deserialize_key() {
client::get(|client| {
let sk = syscall!(client.generate_rsa2048pkcs_private_key(Internal)).key;
let pk = syscall!(client.derive_rsa2048pkcs_public_key(sk, Volatile)).key;
let serialized_key =
syscall!(client.serialize_rsa2048pkcs_key(pk, KeySerialization::Pkcs8Der))
.serialized_key;
let serialized_key = syscall!(client.serialize_rsa2048_key(pk)).serialized_key;
let public_key = postcard_deserialize(&serialized_key).unwrap();
let location = StorageAttributes::new().set_persistence(Volatile);
let deserialized_key_id = syscall!(client.deserialize_rsa2048pkcs_key(
&serialized_key,
KeySerialization::Pkcs8Der,
location
))
.key;
let deserialized_key_id =
syscall!(client.deserialize_rsa2048_public_key(public_key, location)).key;
// This assumes we don't ever get a key with ID 0
assert_ne!(deserialized_key_id, KeyId::from_special(0));
@@ -95,10 +87,8 @@ fn rsa2048pkcs_encrypt_decrypt() {
let sk = syscall!(client.generate_rsa2048pkcs_private_key(Volatile)).key;
let message = [1u8, 2u8, 3u8];
let pk = syscall!(client.derive_rsa2048pkcs_public_key(sk, Volatile)).key;
let rs_pks_buffer =
syscall!(client.serialize_rsa2048pkcs_key(pk, KeySerialization::RsaParts))
.serialized_key;
let parsed: RsaPublicParts = trussed::postcard_deserialize(&rs_pks_buffer).unwrap();
let rs_pks_buffer = syscall!(client.serialize_rsa2048_key(pk)).serialized_key;
let parsed: RsaPublicParts = postcard_deserialize(&rs_pks_buffer).unwrap();
let pubkey = rsa::RsaPublicKey::new_unchecked(
BigUint::from_bytes_be(parsed.n),
BigUint::from_bytes_be(parsed.e),
@@ -134,7 +124,6 @@ fn rsa2048pkcs_sign_verify() {
assert!(verify_ok);
})
}
#[test_log::test]
fn rsa2048pkcs_inject() {
client::get(|client| {
tests/rsa3072.rs
+10 -18
View File
@@ -1,6 +1,7 @@
use rsa::sha2::Sha384;
use rsa::{Pkcs1v15Encrypt, Pkcs1v15Sign, PublicKeyParts};
use trussed::client::CryptoClient;
use trussed::postcard_deserialize;
use trussed::syscall;
use trussed::types::KeyId;
use trussed::types::KeySerialization;
@@ -57,30 +58,23 @@ fn rsa3072pkcs_serialize_key() {
let sk = syscall!(client.generate_rsa3072pkcs_private_key(Internal)).key;
let pk = syscall!(client.derive_rsa3072pkcs_public_key(sk, Volatile)).key;
let serialized_key =
syscall!(client.serialize_rsa3072pkcs_key(pk, KeySerialization::Pkcs8Der))
.serialized_key;
let serialized_key = syscall!(client.serialize_rsa3072_key(pk)).serialized_key;
assert!(!serialized_key.is_empty());
})
}
#[test_log::test]
fn rsa3072pkcs_deserialize_key() {
fn rsa3072_deserialize_key() {
client::get(|client| {
let sk = syscall!(client.generate_rsa3072pkcs_private_key(Internal)).key;
let pk = syscall!(client.derive_rsa3072pkcs_public_key(sk, Volatile)).key;
let serialized_key =
syscall!(client.serialize_rsa3072pkcs_key(pk, KeySerialization::Pkcs8Der))
.serialized_key;
let serialized_key = syscall!(client.serialize_rsa3072_key(pk)).serialized_key;
let public_key = postcard_deserialize(&serialized_key).unwrap();
let location = StorageAttributes::new().set_persistence(Volatile);
let deserialized_key_id = syscall!(client.deserialize_rsa3072pkcs_key(
&serialized_key,
KeySerialization::Pkcs8Der,
location
))
.key;
let deserialized_key_id =
syscall!(client.deserialize_rsa3072_public_key(public_key, location)).key;
// This assumes we don't ever get a key with ID 0
assert_ne!(deserialized_key_id, KeyId::from_special(0));
@@ -93,10 +87,8 @@ fn rsa3072pkcs_encrypt_decrypt() {
let sk = syscall!(client.generate_rsa3072pkcs_private_key(Volatile)).key;
let message = [1u8, 2u8, 3u8];
let pk = syscall!(client.derive_rsa3072pkcs_public_key(sk, Volatile)).key;
let rs_pks_buffer =
syscall!(client.serialize_rsa3072pkcs_key(pk, KeySerialization::RsaParts))
.serialized_key;
let parsed: RsaPublicParts = trussed::postcard_deserialize(&rs_pks_buffer).unwrap();
let rs_pks_buffer = syscall!(client.serialize_rsa3072_key(pk)).serialized_key;
let parsed: RsaPublicParts = postcard_deserialize(&rs_pks_buffer).unwrap();
let pubkey = rsa::RsaPublicKey::new_unchecked(
BigUint::from_bytes_be(parsed.n),
BigUint::from_bytes_be(parsed.e),
@@ -118,7 +110,7 @@ fn rsa3072pkcs_encrypt_decrypt() {
fn rsa3072pkcs_sign_verify() {
client::get(|client| {
let sk = syscall!(client.generate_rsa3072pkcs_private_key(Volatile)).key;
let hash_prefix = hex!("3031 300d 0609 608648016503040201 0500 0420");
let hash_prefix = hex!("3041 300d 0609 608648016503040202 0500 0430");
let message = [1u8, 2u8, 3u8];
use rsa::sha2::digest::Digest;
let digest = Sha384::digest(&message);
tests/rsa4096.rs
+1 -1
View File
@@ -110,7 +110,7 @@ fn rsa4096pkcs_encrypt_decrypt() {
fn rsa4096pkcs_sign_verify() {
client::get(|client| {
let sk = syscall!(client.generate_rsa4096pkcs_private_key(Volatile)).key;
let hash_prefix = hex!("3031 300d 0609 608648016503040201 0500 0420");
let hash_prefix = hex!("3051 300d 0609 608648016503040203 0500 0440");
let message = [1u8, 2u8, 3u8];
use rsa::sha2::digest::Digest;
let digest = Sha512::digest(&message);