diff --git a/src/crypto_traits.rs b/src/crypto_traits.rs index 99afa26..0642048 100644 --- a/src/crypto_traits.rs +++ b/src/crypto_traits.rs @@ -41,26 +41,41 @@ pub trait Rsa2048Pkcs1v15: CryptoClient { ) } - fn serialize_rsa2048pkcs_key( - &mut self, - key: KeyId, - format: KeySerialization, - ) -> ClientResult<'_, reply::SerializeKey, Self> { - self.serialize_key(Mechanism::Rsa2048Pkcs1v15, key, format) + /// Serializes an RSA 2048 bit key. + /// + /// The resulting [`serialized_key`](trussed::api::reply::SerializeKey::serialized_key) contains a buffer of the parts of the key + /// as a postcard-serialized [`RsaPublicParts`](crate::RsaPublicParts): + /// ``` + ///# use rsa_backend::*; + ///# use trussed::{postcard_deserialize,syscall,types::Location::{Volatile,Internal}}; + ///# mod client { + ///# include!("../tests/client/mod.rs"); + ///# } + ///# client::get(|client| { + ///# let sk = syscall!(client.generate_rsa2048pkcs_private_key(Internal)).key; + ///# let pk = syscall!(client.derive_rsa2048pkcs_public_key(sk, Volatile)).key; + /// let serialized_key = syscall!(client.serialize_rsa2048_key(pk)).serialized_key; + /// let public_key: RsaPublicParts = postcard_deserialize(&serialized_key).unwrap(); + ///# }) + ///``` + fn serialize_rsa2048_key(&mut self, key: KeyId) -> ClientResult<'_, reply::SerializeKey, Self> { + self.serialize_key(Mechanism::Rsa2048Pkcs1v15, key, KeySerialization::RsaParts) } - fn deserialize_rsa2048pkcs_key<'c>( + fn deserialize_rsa2048_public_key<'c>( &'c mut self, - serialized_key: &[u8], - format: KeySerialization, + key_parts: RsaPublicParts, attributes: StorageAttributes, ) -> ClientResult<'c, reply::DeserializeKey, Self> { - self.deserialize_key( - Mechanism::Rsa2048Pkcs1v15, - serialized_key, - format, + self.request(DeserializeKey { + mechanism: Mechanism::Rsa2048Pkcs1v15, + serialized_key: postcard_serialize_bytes(&key_parts).map_err(|_err| { + error!("Failed to serialize key parts: {:?}", _err); + ClientError::DataTooLarge + })?, + format: KeySerialization::RsaParts, attributes, - ) + }) } fn sign_rsa2048pkcs<'c>( @@ -91,6 +106,22 @@ pub trait Rsa2048Pkcs1v15: CryptoClient { ) } + fn unsafe_inject_rsa2048<'c>( + &'c mut self, + key_parts: RsaImportFormat, + attributes: StorageAttributes, + ) -> ClientResult<'c, reply::UnsafeInjectKey, Self> { + self.request(UnsafeInjectKey { + mechanism: Mechanism::Rsa2048Pkcs1v15, + raw_key: postcard_serialize_bytes(&key_parts).map_err(|_err| { + error!("Failed to serialize key parts: {:?}", _err); + ClientError::DataTooLarge + })?, + attributes, + format: KeySerialization::RsaParts, + }) + } + fn decrypt_rsa2048pkcs<'c>( &'c mut self, key: KeyId, @@ -129,26 +160,41 @@ pub trait Rsa3072Pkcs1v15: CryptoClient { ) } - fn serialize_rsa3072pkcs_key( - &mut self, - key: KeyId, - format: KeySerialization, - ) -> ClientResult<'_, reply::SerializeKey, Self> { - self.serialize_key(Mechanism::Rsa3072Pkcs1v15, key, format) + /// Serializes an RSA 3072 bit key. + /// + /// The resulting [`serialized_key`](trussed::api::reply::SerializeKey::serialized_key) contains a buffer of the parts of the key + /// as a postcard-serialized [`RsaPublicParts`](crate::RsaPublicParts): + /// ``` + ///# use rsa_backend::*; + ///# use trussed::{postcard_deserialize,syscall,types::Location::{Volatile,Internal}}; + ///# mod client { + ///# include!("../tests/client/mod.rs"); + ///# } + ///# client::get(|client| { + ///# let sk = syscall!(client.generate_rsa3072pkcs_private_key(Internal)).key; + ///# let pk = syscall!(client.derive_rsa3072pkcs_public_key(sk, Volatile)).key; + /// let serialized_key = syscall!(client.serialize_rsa3072_key(pk)).serialized_key; + /// let public_key: RsaPublicParts = postcard_deserialize(&serialized_key).unwrap(); + ///# }) + ///``` + fn serialize_rsa3072_key(&mut self, key: KeyId) -> ClientResult<'_, reply::SerializeKey, Self> { + self.serialize_key(Mechanism::Rsa3072Pkcs1v15, key, KeySerialization::RsaParts) } - fn deserialize_rsa3072pkcs_key<'c>( + fn deserialize_rsa3072_public_key<'c>( &'c mut self, - serialized_key: &[u8], - format: KeySerialization, + key_parts: RsaPublicParts, attributes: StorageAttributes, ) -> ClientResult<'c, reply::DeserializeKey, Self> { - self.deserialize_key( - Mechanism::Rsa3072Pkcs1v15, - serialized_key, - format, + self.request(DeserializeKey { + mechanism: Mechanism::Rsa3072Pkcs1v15, + serialized_key: postcard_serialize_bytes(&key_parts).map_err(|_err| { + error!("Failed to serialize key parts: {:?}", _err); + ClientError::DataTooLarge + })?, + format: KeySerialization::RsaParts, attributes, - ) + }) } fn sign_rsa3072pkcs<'c>( @@ -179,6 +225,22 @@ pub trait Rsa3072Pkcs1v15: CryptoClient { ) } + fn unsafe_inject_rsa3072<'c>( + &'c mut self, + key_parts: RsaImportFormat, + attributes: StorageAttributes, + ) -> ClientResult<'c, reply::UnsafeInjectKey, Self> { + self.request(UnsafeInjectKey { + mechanism: Mechanism::Rsa3072Pkcs1v15, + raw_key: postcard_serialize_bytes(&key_parts).map_err(|_err| { + error!("Failed to serialize key parts: {:?}", _err); + ClientError::DataTooLarge + })?, + attributes, + format: KeySerialization::RsaParts, + }) + } + fn decrypt_rsa3072pkcs<'c>( &'c mut self, key: KeyId, diff --git a/tests/rsa2048.rs b/tests/rsa2048.rs index 6ceb962..f065f5f 100644 --- a/tests/rsa2048.rs +++ b/tests/rsa2048.rs @@ -1,8 +1,7 @@ use rsa::sha2::Sha256; -use rsa::Pkcs1v15Encrypt; -use rsa::Pkcs1v15Sign; -use rsa::PublicKeyParts; +use rsa::{Pkcs1v15Encrypt, Pkcs1v15Sign, PublicKeyParts}; use trussed::client::CryptoClient; +use trussed::postcard_deserialize; use trussed::syscall; use trussed::types::KeyId; use trussed::types::KeySerialization; @@ -59,30 +58,23 @@ fn rsa2048pkcs_serialize_key() { let sk = syscall!(client.generate_rsa2048pkcs_private_key(Internal)).key; let pk = syscall!(client.derive_rsa2048pkcs_public_key(sk, Volatile)).key; - let serialized_key = - syscall!(client.serialize_rsa2048pkcs_key(pk, KeySerialization::Pkcs8Der)) - .serialized_key; + let serialized_key = syscall!(client.serialize_rsa2048_key(pk)).serialized_key; assert!(!serialized_key.is_empty()); }) } #[test_log::test] -fn rsa2048pkcs_deserialize_key() { +fn rsa2048_deserialize_key() { client::get(|client| { let sk = syscall!(client.generate_rsa2048pkcs_private_key(Internal)).key; let pk = syscall!(client.derive_rsa2048pkcs_public_key(sk, Volatile)).key; - let serialized_key = - syscall!(client.serialize_rsa2048pkcs_key(pk, KeySerialization::Pkcs8Der)) - .serialized_key; + let serialized_key = syscall!(client.serialize_rsa2048_key(pk)).serialized_key; + let public_key = postcard_deserialize(&serialized_key).unwrap(); let location = StorageAttributes::new().set_persistence(Volatile); - let deserialized_key_id = syscall!(client.deserialize_rsa2048pkcs_key( - &serialized_key, - KeySerialization::Pkcs8Der, - location - )) - .key; + let deserialized_key_id = + syscall!(client.deserialize_rsa2048_public_key(public_key, location)).key; // This assumes we don't ever get a key with ID 0 assert_ne!(deserialized_key_id, KeyId::from_special(0)); @@ -95,10 +87,8 @@ fn rsa2048pkcs_encrypt_decrypt() { let sk = syscall!(client.generate_rsa2048pkcs_private_key(Volatile)).key; let message = [1u8, 2u8, 3u8]; let pk = syscall!(client.derive_rsa2048pkcs_public_key(sk, Volatile)).key; - let rs_pks_buffer = - syscall!(client.serialize_rsa2048pkcs_key(pk, KeySerialization::RsaParts)) - .serialized_key; - let parsed: RsaPublicParts = trussed::postcard_deserialize(&rs_pks_buffer).unwrap(); + let rs_pks_buffer = syscall!(client.serialize_rsa2048_key(pk)).serialized_key; + let parsed: RsaPublicParts = postcard_deserialize(&rs_pks_buffer).unwrap(); let pubkey = rsa::RsaPublicKey::new_unchecked( BigUint::from_bytes_be(parsed.n), BigUint::from_bytes_be(parsed.e), @@ -134,7 +124,6 @@ fn rsa2048pkcs_sign_verify() { assert!(verify_ok); }) } - #[test_log::test] fn rsa2048pkcs_inject() { client::get(|client| { diff --git a/tests/rsa3072.rs b/tests/rsa3072.rs index e355300..5ee19ed 100644 --- a/tests/rsa3072.rs +++ b/tests/rsa3072.rs @@ -1,6 +1,7 @@ use rsa::sha2::Sha384; use rsa::{Pkcs1v15Encrypt, Pkcs1v15Sign, PublicKeyParts}; use trussed::client::CryptoClient; +use trussed::postcard_deserialize; use trussed::syscall; use trussed::types::KeyId; use trussed::types::KeySerialization; @@ -57,30 +58,23 @@ fn rsa3072pkcs_serialize_key() { let sk = syscall!(client.generate_rsa3072pkcs_private_key(Internal)).key; let pk = syscall!(client.derive_rsa3072pkcs_public_key(sk, Volatile)).key; - let serialized_key = - syscall!(client.serialize_rsa3072pkcs_key(pk, KeySerialization::Pkcs8Der)) - .serialized_key; + let serialized_key = syscall!(client.serialize_rsa3072_key(pk)).serialized_key; assert!(!serialized_key.is_empty()); }) } #[test_log::test] -fn rsa3072pkcs_deserialize_key() { +fn rsa3072_deserialize_key() { client::get(|client| { let sk = syscall!(client.generate_rsa3072pkcs_private_key(Internal)).key; let pk = syscall!(client.derive_rsa3072pkcs_public_key(sk, Volatile)).key; - let serialized_key = - syscall!(client.serialize_rsa3072pkcs_key(pk, KeySerialization::Pkcs8Der)) - .serialized_key; + let serialized_key = syscall!(client.serialize_rsa3072_key(pk)).serialized_key; + let public_key = postcard_deserialize(&serialized_key).unwrap(); let location = StorageAttributes::new().set_persistence(Volatile); - let deserialized_key_id = syscall!(client.deserialize_rsa3072pkcs_key( - &serialized_key, - KeySerialization::Pkcs8Der, - location - )) - .key; + let deserialized_key_id = + syscall!(client.deserialize_rsa3072_public_key(public_key, location)).key; // This assumes we don't ever get a key with ID 0 assert_ne!(deserialized_key_id, KeyId::from_special(0)); @@ -93,10 +87,8 @@ fn rsa3072pkcs_encrypt_decrypt() { let sk = syscall!(client.generate_rsa3072pkcs_private_key(Volatile)).key; let message = [1u8, 2u8, 3u8]; let pk = syscall!(client.derive_rsa3072pkcs_public_key(sk, Volatile)).key; - let rs_pks_buffer = - syscall!(client.serialize_rsa3072pkcs_key(pk, KeySerialization::RsaParts)) - .serialized_key; - let parsed: RsaPublicParts = trussed::postcard_deserialize(&rs_pks_buffer).unwrap(); + let rs_pks_buffer = syscall!(client.serialize_rsa3072_key(pk)).serialized_key; + let parsed: RsaPublicParts = postcard_deserialize(&rs_pks_buffer).unwrap(); let pubkey = rsa::RsaPublicKey::new_unchecked( BigUint::from_bytes_be(parsed.n), BigUint::from_bytes_be(parsed.e), @@ -118,7 +110,7 @@ fn rsa3072pkcs_encrypt_decrypt() { fn rsa3072pkcs_sign_verify() { client::get(|client| { let sk = syscall!(client.generate_rsa3072pkcs_private_key(Volatile)).key; - let hash_prefix = hex!("3031 300d 0609 608648016503040201 0500 0420"); + let hash_prefix = hex!("3041 300d 0609 608648016503040202 0500 0430"); let message = [1u8, 2u8, 3u8]; use rsa::sha2::digest::Digest; let digest = Sha384::digest(&message); diff --git a/tests/rsa4096.rs b/tests/rsa4096.rs index 992df77..48f41f9 100644 --- a/tests/rsa4096.rs +++ b/tests/rsa4096.rs @@ -110,7 +110,7 @@ fn rsa4096pkcs_encrypt_decrypt() { fn rsa4096pkcs_sign_verify() { client::get(|client| { let sk = syscall!(client.generate_rsa4096pkcs_private_key(Volatile)).key; - let hash_prefix = hex!("3031 300d 0609 608648016503040201 0500 0420"); + let hash_prefix = hex!("3051 300d 0609 608648016503040203 0500 0440"); let message = [1u8, 2u8, 3u8]; use rsa::sha2::digest::Digest; let digest = Sha512::digest(&message);