Skip to content

Commit 342ae90

Browse files
polhenarejospolhenarejos
committed
Upgrade PicoKeys SDK
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
1 parent 39b9dbb commit 342ae90

23 files changed

Lines changed: 262 additions & 253 deletions

‎CMakeLists.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -88,10 +88,10 @@ else()
8888
endif()
8989

9090
set(USB_ITF_HID 1)
91-
include(pico-keys-sdk/pico_keys_sdk_import.cmake)
91+
include(pico-keys-sdk/picokeys_sdk_import.cmake)
9292

9393
if(NOT ESP_PLATFORM)
94-
set(SOURCES ${PICO_KEYS_SOURCES})
94+
set(SOURCES ${PICOKEYS_SOURCES})
9595
endif()
9696

9797
list(APPEND SOURCES
@@ -147,7 +147,7 @@ if(NOT ESP_PLATFORM)
147147
)
148148
target_compile_options(pico_fido PRIVATE ${COMMON_COMPILE_OPTIONS})
149149

150-
pico_keys_apply_strict_flags(
150+
picokeys_apply_strict_flags(
151151
SOURCES ${SOURCES}
152152
FILTER_REGEX "/src/fido/|/pico-keys-sdk/src/|/pico-keys-sdk/config/"
153153
)
@@ -193,12 +193,12 @@ if(NOT ESP_PLATFORM)
193193
target_link_options(pico_fido PRIVATE ${EMULATION_NON_APPLE_LINK_OPTIONS})
194194
endif()
195195

196-
target_link_libraries(pico_fido PRIVATE pico_keys_sdk mbedtls pthread m)
196+
target_link_libraries(pico_fido PRIVATE picokeys_sdk mbedtls pthread m)
197197
else()
198198
target_link_libraries(
199199
pico_fido
200200
PRIVATE
201-
pico_keys_sdk
201+
picokeys_sdk
202202
pico_stdlib
203203
pico_multicore
204204
hardware_flash

‎pico-keys-sdk‎

Submodule pico-keys-sdk updated 81 files

‎src/fido/cbor.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
* along with this program. If not, see <https://www.gnu.org/licenses/>.
1616
*/
1717

18-
#include "pico_keys.h"
18+
#include "picokeys.h"
1919
#if defined(PICO_PLATFORM)
2020
#include "pico/stdlib.h"
2121
#endif

‎src/fido/cbor_client_pin.c‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
* along with this program. If not, see <https://www.gnu.org/licenses/>.
1616
*/
1717

18-
#include "pico_keys.h"
18+
#include "picokeys.h"
1919
#include "mbedtls/ecp.h"
2020
#include "mbedtls/ecdh.h"
2121
#include "mbedtls/sha256.h"
@@ -99,7 +99,7 @@ static int regenerate(void) {
9999
mbedtls_ecdh_init(&hkey);
100100
hkey_init = true;
101101
mbedtls_ecdh_setup(&hkey, MBEDTLS_ECP_DP_SECP256R1);
102-
int ret = mbedtls_ecdh_gen_public(&hkey.ctx.mbed_ecdh.grp, &hkey.ctx.mbed_ecdh.d, &hkey.ctx.mbed_ecdh.Q, random_gen, NULL);
102+
int ret = mbedtls_ecdh_gen_public(&hkey.ctx.mbed_ecdh.grp, &hkey.ctx.mbed_ecdh.d, &hkey.ctx.mbed_ecdh.Q, random_fill_iterator, NULL);
103103
mbedtls_mpi_lset(&hkey.ctx.mbed_ecdh.Qp.Z, 1);
104104
if (ret != 0) {
105105
return ret;
@@ -131,7 +131,7 @@ static int kdf(uint8_t protocol, const mbedtls_mpi *z, uint8_t *sharedSecret) {
131131
int ecdh(uint8_t protocol, const mbedtls_ecp_point *Q, uint8_t *sharedSecret) {
132132
mbedtls_mpi z;
133133
mbedtls_mpi_init(&z);
134-
int ret = mbedtls_ecdh_compute_shared(&hkey.ctx.mbed_ecdh.grp, &z, Q, &hkey.ctx.mbed_ecdh.d, random_gen, NULL);
134+
int ret = mbedtls_ecdh_compute_shared(&hkey.ctx.mbed_ecdh.grp, &z, Q, &hkey.ctx.mbed_ecdh.d, random_fill_iterator, NULL);
135135
ret = kdf(protocol, &z, sharedSecret);
136136
mbedtls_mpi_free(&z);
137137
return ret;
@@ -142,11 +142,11 @@ static void resetAuthToken(bool persistent) {
142142
if (persistent) {
143143
fid = EF_PAUTHTOKEN;
144144
}
145-
file_t *ef = search_by_fid(fid, NULL, SPECIFY_EF);
145+
file_t *ef = file_search_by_fid(fid, NULL, SPECIFY_EF);
146146
uint8_t t[32];
147-
random_gen(NULL, t, sizeof(t));
147+
random_fill_buffer(t, sizeof(t));
148148
file_put_data(ef, t, sizeof(t));
149-
low_flash_available();
149+
flash_commit();
150150
}
151151

152152
int resetPinUvAuthToken(void) {
@@ -159,7 +159,7 @@ int resetPinUvAuthToken(void) {
159159

160160
int resetPersistentPinUvAuthToken(void) {
161161
resetAuthToken(true);
162-
file_t *ef_pauthtoken = search_by_fid(EF_PAUTHTOKEN, NULL, SPECIFY_EF);
162+
file_t *ef_pauthtoken = file_search_by_fid(EF_PAUTHTOKEN, NULL, SPECIFY_EF);
163163
ppaut.permissions = 0;
164164
ppaut.data = file_get_data(ef_pauthtoken);
165165
ppaut.len = file_get_size(ef_pauthtoken);
@@ -169,12 +169,12 @@ int resetPersistentPinUvAuthToken(void) {
169169
int encrypt(uint8_t protocol, const uint8_t *key, const uint8_t *in, uint16_t in_len, uint8_t *out) {
170170
if (protocol == 1) {
171171
memcpy(out, in, in_len);
172-
return aes_encrypt(key, NULL, 32 * 8, PICO_KEYS_AES_MODE_CBC, out, in_len);
172+
return aes_encrypt(key, NULL, 32 * 8, PICOKEYS_AES_MODE_CBC, out, in_len);
173173
}
174174
else if (protocol == 2) {
175-
random_gen(NULL, out, IV_SIZE);
175+
random_fill_buffer(out, IV_SIZE);
176176
memcpy(out + IV_SIZE, in, in_len);
177-
return aes_encrypt(key + 32, out, 32 * 8, PICO_KEYS_AES_MODE_CBC, out + IV_SIZE, in_len);
177+
return aes_encrypt(key + 32, out, 32 * 8, PICOKEYS_AES_MODE_CBC, out + IV_SIZE, in_len);
178178
}
179179

180180
return -1;
@@ -183,11 +183,11 @@ int encrypt(uint8_t protocol, const uint8_t *key, const uint8_t *in, uint16_t in
183183
int decrypt(uint8_t protocol, const uint8_t *key, const uint8_t *in, uint16_t in_len, uint8_t *out) {
184184
if (protocol == 1) {
185185
memcpy(out, in, in_len);
186-
return aes_decrypt(key, NULL, 32 * 8, PICO_KEYS_AES_MODE_CBC, out, in_len);
186+
return aes_decrypt(key, NULL, 32 * 8, PICOKEYS_AES_MODE_CBC, out, in_len);
187187
}
188188
else if (protocol == 2) {
189189
memcpy(out, in + IV_SIZE, in_len - IV_SIZE);
190-
return aes_decrypt(key + 32, in, 32 * 8, PICO_KEYS_AES_MODE_CBC, out, in_len - IV_SIZE);
190+
return aes_decrypt(key + 32, in, 32 * 8, PICOKEYS_AES_MODE_CBC, out, in_len - IV_SIZE);
191191
}
192192

193193
return -1;
@@ -266,9 +266,9 @@ static int check_keydev_encrypted(const uint8_t pin_token[32]) {
266266
encrypt_with_aad(pin_token, file_get_data(ef_keydev) + 1, 32, 2, tmp_keydev + 1);
267267
file_put_data(ef_keydev, tmp_keydev, sizeof(tmp_keydev));
268268
mbedtls_platform_zeroize(tmp_keydev, sizeof(tmp_keydev));
269-
low_flash_available();
269+
flash_commit();
270270
}
271-
return PICOKEY_OK;
271+
return PICOKEYS_OK;
272272
}
273273

274274
uint8_t new_pin_mismatches = 0;
@@ -400,7 +400,7 @@ int cbor_client_pin(const uint8_t *data, size_t len) {
400400
pin_len++;
401401
}
402402
uint8_t minPin = 4;
403-
file_t *ef_minpin = search_by_fid(EF_MINPINLEN, NULL, SPECIFY_EF);
403+
file_t *ef_minpin = file_search_by_fid(EF_MINPINLEN, NULL, SPECIFY_EF);
404404
if (file_has_data(ef_minpin)) {
405405
minPin = *file_get_data(ef_minpin);
406406
}
@@ -415,11 +415,11 @@ int cbor_client_pin(const uint8_t *data, size_t len) {
415415
mbedtls_platform_zeroize(paddedNewPin, sizeof(paddedNewPin));
416416
pin_derive_verifier(dhash, 16, hsh + 3);
417417
file_put_data(ef_pin, hsh, sizeof(hsh));
418-
low_flash_available();
418+
flash_commit();
419419

420420
pin_derive_session(dhash, 16, session_pin);
421421
ret = check_keydev_encrypted(session_pin);
422-
if (ret != PICOKEY_OK) {
422+
if (ret != PICOKEYS_OK) {
423423
CBOR_ERROR(ret);
424424
}
425425
mbedtls_platform_zeroize(hsh, sizeof(hsh));
@@ -474,7 +474,7 @@ int cbor_client_pin(const uint8_t *data, size_t len) {
474474
memcpy(pin_data, file_get_data(ef_pin), file_get_size(ef_pin));
475475
pin_data[0] -= 1;
476476
file_put_data(ef_pin, pin_data, file_get_size(ef_pin));
477-
low_flash_available();
477+
flash_commit();
478478
uint8_t retries = pin_data[0];
479479
uint8_t paddedNewPin[64];
480480
ret = decrypt((uint8_t)pinUvAuthProtocol, sharedSecret, pinHashEnc.data, (uint16_t)pinHashEnc.len, paddedNewPin);
@@ -512,18 +512,18 @@ int cbor_client_pin(const uint8_t *data, size_t len) {
512512

513513
hash_multi(paddedNewPin, 16, session_pin);
514514
ret = load_keydev(keydev);
515-
if (ret != PICOKEY_OK) {
515+
if (ret != PICOKEYS_OK) {
516516
CBOR_ERROR(CTAP2_ERR_PIN_INVALID);
517517
}
518518
encrypt_keydev_f1(keydev);
519519
}
520520
pin_derive_session(paddedNewPin, 16, session_pin);
521521
pin_data[0] = MAX_PIN_RETRIES;
522522
file_put_data(ef_pin, pin_data, sizeof(pin_data));
523-
low_flash_available();
523+
flash_commit();
524524

525525
ret = check_keydev_encrypted(session_pin);
526-
if (ret != PICOKEY_OK) {
526+
if (ret != PICOKEYS_OK) {
527527
CBOR_ERROR(ret);
528528
}
529529

@@ -541,7 +541,7 @@ int cbor_client_pin(const uint8_t *data, size_t len) {
541541
pin_len++;
542542
}
543543
uint8_t minPin = 4;
544-
file_t *ef_minpin = search_by_fid(EF_MINPINLEN, NULL, SPECIFY_EF);
544+
file_t *ef_minpin = file_search_by_fid(EF_MINPINLEN, NULL, SPECIFY_EF);
545545
if (file_has_data(ef_minpin)) {
546546
minPin = *file_get_data(ef_minpin);
547547
}
@@ -551,18 +551,18 @@ int cbor_client_pin(const uint8_t *data, size_t len) {
551551

552552
// New PIN is valid and verified
553553
ret = load_keydev(keydev);
554-
if (ret != PICOKEY_OK) {
554+
if (ret != PICOKEYS_OK) {
555555
CBOR_ERROR(CTAP2_ERR_PIN_INVALID);
556556
}
557557
encrypt_keydev_f1(keydev);
558558

559559
mbedtls_md(mbedtls_md_info_from_type(MBEDTLS_MD_SHA256), paddedNewPin, pin_len, dhash);
560560
pin_derive_session(dhash, 16, session_pin);
561561
ret = check_keydev_encrypted(session_pin);
562-
if (ret != PICOKEY_OK) {
562+
if (ret != PICOKEYS_OK) {
563563
CBOR_ERROR(ret);
564564
}
565-
low_flash_available();
565+
flash_commit();
566566

567567
pin_data[0] = MAX_PIN_RETRIES;
568568
pin_data[1] = pin_len;
@@ -583,7 +583,7 @@ int cbor_client_pin(const uint8_t *data, size_t len) {
583583
file_put_data(ef_minpin, tmpf, file_get_size(ef_minpin));
584584
free(tmpf);
585585
}
586-
low_flash_available();
586+
flash_commit();
587587
resetPinUvAuthToken();
588588
resetPersistentPinUvAuthToken();
589589
needs_power_cycle = false;
@@ -636,7 +636,7 @@ int cbor_client_pin(const uint8_t *data, size_t len) {
636636
memcpy(pin_data, file_get_data(ef_pin), file_get_size(ef_pin));
637637
pin_data[0] -= 1;
638638
file_put_data(ef_pin, pin_data, file_get_size(ef_pin));
639-
low_flash_available();
639+
flash_commit();
640640
uint8_t retries = pin_data[0];
641641
uint8_t paddedNewPin[64], poff = ((uint8_t)pinUvAuthProtocol - 1) * IV_SIZE;
642642
ret = decrypt((uint8_t)pinUvAuthProtocol, sharedSecret, pinHashEnc.data, (uint16_t)pinHashEnc.len, paddedNewPin);
@@ -675,15 +675,15 @@ int cbor_client_pin(const uint8_t *data, size_t len) {
675675
pin_derive_verifier(paddedNewPin, 16, pin_data + 3);
676676
hash_multi(paddedNewPin, 16, session_pin);
677677
ret = load_keydev(keydev);
678-
if (ret != PICOKEY_OK) {
678+
if (ret != PICOKEYS_OK) {
679679
CBOR_ERROR(CTAP2_ERR_PIN_INVALID);
680680
}
681681
encrypt_keydev_f1(keydev);
682682
}
683683

684684
pin_derive_session(paddedNewPin, 16, session_pin);
685685
ret = check_keydev_encrypted(session_pin);
686-
if (ret != PICOKEY_OK) {
686+
if (ret != PICOKEYS_OK) {
687687
CBOR_ERROR(ret);
688688
}
689689

@@ -693,8 +693,8 @@ int cbor_client_pin(const uint8_t *data, size_t len) {
693693
file_put_data(ef_pin, pin_data, sizeof(pin_data));
694694
mbedtls_platform_zeroize(pin_data, sizeof(pin_data));
695695

696-
low_flash_available();
697-
file_t *ef_minpin = search_by_fid(EF_MINPINLEN, NULL, SPECIFY_EF);
696+
flash_commit();
697+
file_t *ef_minpin = file_search_by_fid(EF_MINPINLEN, NULL, SPECIFY_EF);
698698
if (file_has_data(ef_minpin) && file_get_data(ef_minpin)[1] == 1) {
699699
CBOR_ERROR(CTAP2_ERR_PIN_INVALID);
700700
}

‎src/fido/cbor_config.c‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
* along with this program. If not, see <https://www.gnu.org/licenses/>.
1616
*/
1717

18-
#include "pico_keys.h"
18+
#include "picokeys.h"
1919
#include "ctap2_cbor.h"
2020
#include "fido.h"
2121
#include "ctap.h"
@@ -151,7 +151,7 @@ int cbor_config(const uint8_t *data, size_t len) {
151151
file_put_data(ef_keydev, keydev_dec, sizeof(keydev_dec));
152152
mbedtls_platform_zeroize(keydev_dec, sizeof(keydev_dec));
153153
file_put_data(ef_keydev_enc, NULL, 0); // Set ef to 0 bytes
154-
low_flash_available();
154+
flash_commit();
155155
}
156156
else if (vendorCommandId == CTAP_CONFIG_AUT_ENABLE) {
157157
if (!file_has_data(ef_keydev)) {
@@ -168,7 +168,7 @@ int cbor_config(const uint8_t *data, size_t len) {
168168
}
169169

170170
uint8_t key_dev_enc[12 + 32 + 16];
171-
random_gen(NULL, key_dev_enc, 12);
171+
random_fill_buffer(key_dev_enc, 12);
172172
mbedtls_chachapoly_init(&chatx);
173173
mbedtls_chachapoly_setkey(&chatx, vendorParamByteString.data);
174174
ret = mbedtls_chachapoly_encrypt_and_tag(&chatx, file_get_size(ef_keydev), key_dev_enc, NULL, 0, file_get_data(ef_keydev), key_dev_enc + 12, key_dev_enc + 12 + file_get_size(ef_keydev));
@@ -181,17 +181,17 @@ int cbor_config(const uint8_t *data, size_t len) {
181181
mbedtls_platform_zeroize(key_dev_enc, sizeof(key_dev_enc));
182182
file_put_data(ef_keydev, key_dev_enc, file_get_size(ef_keydev)); // Overwrite ef with 0
183183
file_put_data(ef_keydev, NULL, 0); // Set ef to 0 bytes
184-
low_flash_available();
184+
flash_commit();
185185
}
186186
else if (vendorCommandId == CTAP_CONFIG_EA_UPLOAD) {
187187
if (vendorParamByteString.present == false) {
188188
CBOR_ERROR(CTAP2_ERR_MISSING_PARAMETER);
189189
}
190-
file_t *ef_ee_ea = search_by_fid(EF_EE_DEV_EA, NULL, SPECIFY_EF);
190+
file_t *ef_ee_ea = file_search_by_fid(EF_EE_DEV_EA, NULL, SPECIFY_EF);
191191
if (ef_ee_ea) {
192192
file_put_data(ef_ee_ea, vendorParamByteString.data, (uint16_t)vendorParamByteString.len);
193193
}
194-
low_flash_available();
194+
flash_commit();
195195
}
196196
else if (vendorCommandId == CTAP_CONFIG_PIN_POLICY) {
197197
file_t *ef_pin_policy = file_new(EF_PIN_COMPLEXITY_POLICY);
@@ -206,7 +206,7 @@ int cbor_config(const uint8_t *data, size_t len) {
206206
free(val);
207207
}
208208
}
209-
low_flash_available();
209+
flash_commit();
210210
}
211211
else {
212212
CBOR_ERROR(CTAP2_ERR_INVALID_SUBCOMMAND);
@@ -215,7 +215,7 @@ int cbor_config(const uint8_t *data, size_t len) {
215215
}
216216
else if (subcommand == 0x03) {
217217
uint8_t currentMinPinLen = 4;
218-
file_t *ef_minpin = search_by_fid(EF_MINPINLEN, NULL, SPECIFY_EF);
218+
file_t *ef_minpin = file_search_by_fid(EF_MINPINLEN, NULL, SPECIFY_EF);
219219
if (file_has_data(ef_minpin)) {
220220
currentMinPinLen = *file_get_data(ef_minpin);
221221
}
@@ -242,7 +242,7 @@ int cbor_config(const uint8_t *data, size_t len) {
242242
mbedtls_sha256((uint8_t *) minPinLengthRPIDs[m].data, minPinLengthRPIDs[m].len, dataf + 2 + m * 32, 0);
243243
}
244244
file_put_data(ef_minpin, dataf, (uint16_t)(2 + minPinLengthRPIDs_len * 32));
245-
low_flash_available();
245+
flash_commit();
246246
free(dataf);
247247
goto err; //No return
248248
}

0 commit comments

Comments
 (0)