tkey_exchange.cpp 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767
  1. /*
  2. * Copyright (C) 2011-2017 Intel Corporation. All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. *
  8. * * Redistributions of source code must retain the above copyright
  9. * notice, this list of conditions and the following disclaimer.
  10. * * Redistributions in binary form must reproduce the above copyright
  11. * notice, this list of conditions and the following disclaimer in
  12. * the documentation and/or other materials provided with the
  13. * distribution.
  14. * * Neither the name of Intel Corporation nor the names of its
  15. * contributors may be used to endorse or promote products derived
  16. * from this software without specific prior written permission.
  17. *
  18. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  21. * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  22. * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  23. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  24. * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  28. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29. *
  30. */
  31. #include <stdint.h>
  32. #include "sgx_tkey_exchange.h"
  33. #include "sgx_trts.h"
  34. #include "sgx_utils.h"
  35. #include "ecp_interface.h"
  36. #include "util.h"
  37. #include "string.h"
  38. #include "stdlib.h"
  39. #include "sgx_spinlock.h"
  40. #include "sgx_tkey_exchange_t.h"
  41. #include "simple_vector.h"
  42. #include "se_cdefs.h"
  43. // Add a version to tkey_exchange.
  44. SGX_ACCESS_VERSION(tkey_exchange, 1)
  45. #define ERROR_BREAK(sgx_status) if(SGX_SUCCESS!=sgx_status){break;}
  46. #define SAFE_FREE(ptr) {if (NULL != (ptr)) {free(ptr); (ptr)=NULL;}}
  47. #pragma pack(push, 1)
  48. // any call to sgx_ra_init will reset the input pubkey related ra_db_item_t.ra_state to ra_inited
  49. // only sgx_ra_get_ga can change ra_inited to ra_get_gaed
  50. // only sgx_ra_proc_msg2_trusted can change ra_get_gaed to ra_proc_msg2ed
  51. // sgx_ra_get_msg3_trusted and sgx_ra_get_keys will check ra_state whether to be ra_proc_msg2ed
  52. typedef enum _ra_state
  53. {
  54. ra_inited= 0,
  55. ra_get_gaed,
  56. ra_proc_msg2ed
  57. }ra_state;
  58. typedef struct _ra_db_item_t
  59. {
  60. sgx_ec256_public_t g_a;
  61. sgx_ec256_public_t g_b;
  62. sgx_ec_key_128bit_t vk_key;
  63. sgx_ec256_public_t sp_pubkey;
  64. sgx_ec256_private_t a;
  65. sgx_ps_sec_prop_desc_t ps_sec_prop;
  66. sgx_ec_key_128bit_t mk_key;
  67. sgx_ec_key_128bit_t sk_key;
  68. sgx_ec_key_128bit_t smk_key;
  69. sgx_quote_nonce_t quote_nonce; //to verify quote report data
  70. sgx_target_info_t qe_target; //to verify quote report
  71. ra_state state;
  72. sgx_spinlock_t item_lock;
  73. uintptr_t derive_key_cb;
  74. }ra_db_item_t;
  75. #pragma pack(pop)
  76. static simple_vector g_ra_db = {0, 0, NULL};
  77. static sgx_spinlock_t g_ra_db_lock = SGX_SPINLOCK_INITIALIZER;
  78. static uintptr_t g_kdf_cookie = 0;
  79. #define ENC_KDF_POINTER(x) (uintptr_t)(x) ^ g_kdf_cookie
  80. #define DEC_KDF_POINTER(x) (sgx_ra_derive_secret_keys_t)((x) ^ g_kdf_cookie)
  81. extern "C" sgx_status_t sgx_ra_get_ga(
  82. sgx_ra_context_t context,
  83. sgx_ec256_public_t *g_a)
  84. {
  85. sgx_status_t se_ret;
  86. if(vector_size(&g_ra_db) <= context||!g_a)
  87. return SGX_ERROR_INVALID_PARAMETER;
  88. ra_db_item_t* item = NULL;
  89. if(0 != vector_get(&g_ra_db, context, reinterpret_cast<void**>(&item)) || item == NULL )
  90. return SGX_ERROR_INVALID_PARAMETER;
  91. sgx_ecc_state_handle_t ecc_state = NULL;
  92. sgx_ec256_public_t pub_key;
  93. sgx_ec256_private_t priv_key;
  94. memset(&pub_key, 0, sizeof(pub_key));
  95. memset(&priv_key, 0, sizeof(priv_key));
  96. sgx_spin_lock(&item->item_lock);
  97. do
  98. {
  99. //sgx_ra_init must have been called
  100. if (item->state != ra_inited)
  101. {
  102. se_ret = SGX_ERROR_INVALID_STATE;
  103. break;
  104. }
  105. // ecc_state should be closed when exit.
  106. se_ret = sgx_ecc256_open_context(&ecc_state);
  107. if (SGX_SUCCESS != se_ret)
  108. {
  109. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  110. se_ret = SGX_ERROR_UNEXPECTED;
  111. break;
  112. }
  113. se_ret = sgx_ecc256_create_key_pair(&priv_key, &pub_key, ecc_state);
  114. if (SGX_SUCCESS != se_ret)
  115. {
  116. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  117. se_ret = SGX_ERROR_UNEXPECTED;
  118. break;
  119. }
  120. memcpy(&item->a, &priv_key, sizeof(item->a));
  121. memcpy(&item->g_a, &pub_key, sizeof(item->g_a));
  122. memcpy(g_a, &pub_key, sizeof(sgx_ec256_public_t));
  123. item->state = ra_get_gaed;
  124. //clear local private key to defense in depth
  125. memset_s(&priv_key,sizeof(priv_key),0,sizeof(sgx_ec256_private_t));
  126. }while(0);
  127. sgx_spin_unlock(&item->item_lock);
  128. if(ecc_state!=NULL)
  129. sgx_ecc256_close_context(ecc_state);
  130. return se_ret;
  131. }
  132. extern "C" sgx_status_t sgx_ra_proc_msg2_trusted(
  133. sgx_ra_context_t context,
  134. const sgx_ra_msg2_t *p_msg2, //(g_b||spid||quote_type|| KDF_ID ||sign_gb_ga||cmac||sig_rl_size||sig_rl)
  135. const sgx_target_info_t *p_qe_target,
  136. sgx_report_t *p_report,
  137. sgx_quote_nonce_t* p_nonce)
  138. {
  139. sgx_status_t se_ret = SGX_ERROR_UNEXPECTED;
  140. //p_msg2[in] p_qe_target[in] p_report[out] p_nonce[out] in EDL file
  141. if(vector_size(&g_ra_db) <= context
  142. || !p_msg2
  143. || !p_qe_target
  144. || !p_report
  145. || !p_nonce)
  146. return SGX_ERROR_INVALID_PARAMETER;
  147. ra_db_item_t* item = NULL;
  148. if(0 != vector_get(&g_ra_db, context, reinterpret_cast<void**>(&item)) || item == NULL )
  149. return SGX_ERROR_INVALID_PARAMETER;
  150. sgx_ec256_private_t a;
  151. memset(&a, 0, sizeof(a));
  152. // Create gb_ga
  153. sgx_ec256_public_t gb_ga[2];
  154. sgx_ec256_public_t sp_pubkey;
  155. sgx_ec_key_128bit_t smkey = {0};
  156. sgx_ec_key_128bit_t skey = {0};
  157. sgx_ec_key_128bit_t mkey = {0};
  158. sgx_ec_key_128bit_t vkey = {0};
  159. sgx_ra_derive_secret_keys_t ra_key_cb = NULL;
  160. memset(&gb_ga[0], 0, sizeof(gb_ga));
  161. sgx_spin_lock(&item->item_lock);
  162. //sgx_ra_get_ga must have been called
  163. if (item->state != ra_get_gaed)
  164. {
  165. sgx_spin_unlock(&item->item_lock);
  166. return SGX_ERROR_INVALID_STATE;
  167. }
  168. memcpy(&a, &item->a, sizeof(a));
  169. memcpy(&gb_ga[1], &item->g_a, sizeof(gb_ga[1]));
  170. memcpy(&sp_pubkey, &item->sp_pubkey, sizeof(sp_pubkey));
  171. ra_key_cb = DEC_KDF_POINTER(item->derive_key_cb);
  172. sgx_spin_unlock(&item->item_lock);
  173. memcpy(&gb_ga[0], &p_msg2->g_b, sizeof(gb_ga[0]));
  174. sgx_ecc_state_handle_t ecc_state = NULL;
  175. // ecc_state need to be freed when exit.
  176. se_ret = sgx_ecc256_open_context(&ecc_state);
  177. if (SGX_SUCCESS != se_ret)
  178. {
  179. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  180. se_ret = SGX_ERROR_UNEXPECTED;
  181. return se_ret;
  182. }
  183. sgx_ec256_dh_shared_t dh_key;
  184. memset(&dh_key, 0, sizeof(dh_key));
  185. sgx_ec256_public_t* p_msg2_g_b = const_cast<sgx_ec256_public_t*>(&p_msg2->g_b);
  186. se_ret = sgx_ecc256_compute_shared_dhkey(&a,
  187. (sgx_ec256_public_t*)p_msg2_g_b,
  188. &dh_key, ecc_state);
  189. if(SGX_SUCCESS != se_ret)
  190. {
  191. if (SGX_ERROR_OUT_OF_MEMORY != se_ret)
  192. se_ret = SGX_ERROR_UNEXPECTED;
  193. sgx_ecc256_close_context(ecc_state);
  194. return se_ret;
  195. }
  196. // Verify signature of gb_ga
  197. uint8_t result;
  198. sgx_ec256_signature_t* p_msg2_sign_gb_ga = const_cast<sgx_ec256_signature_t*>(&p_msg2->sign_gb_ga);
  199. se_ret = sgx_ecdsa_verify((uint8_t *)&gb_ga, sizeof(gb_ga),
  200. &sp_pubkey,
  201. p_msg2_sign_gb_ga,
  202. &result, ecc_state);
  203. if(SGX_SUCCESS != se_ret)
  204. {
  205. if (SGX_ERROR_OUT_OF_MEMORY != se_ret)
  206. se_ret = SGX_ERROR_UNEXPECTED;
  207. sgx_ecc256_close_context(ecc_state);
  208. return se_ret;
  209. }
  210. if(SGX_EC_VALID != result)
  211. {
  212. sgx_ecc256_close_context(ecc_state);
  213. return SGX_ERROR_INVALID_SIGNATURE;
  214. }
  215. do
  216. {
  217. if(NULL != ra_key_cb)
  218. {
  219. se_ret = ra_key_cb(&dh_key,
  220. p_msg2->kdf_id,
  221. &smkey,
  222. &skey,
  223. &mkey,
  224. &vkey);
  225. if (SGX_SUCCESS != se_ret)
  226. {
  227. if(SGX_ERROR_OUT_OF_MEMORY != se_ret &&
  228. SGX_ERROR_INVALID_PARAMETER != se_ret &&
  229. SGX_ERROR_KDF_MISMATCH != se_ret)
  230. se_ret = SGX_ERROR_UNEXPECTED;
  231. break;
  232. }
  233. }
  234. else if (p_msg2->kdf_id == 0x0001)
  235. {
  236. se_ret = derive_key(&dh_key, "SMK", (uint32_t)(sizeof("SMK") -1), &smkey);
  237. if (SGX_SUCCESS != se_ret)
  238. {
  239. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  240. se_ret = SGX_ERROR_UNEXPECTED;
  241. break;
  242. }
  243. se_ret = derive_key(&dh_key, "SK", (uint32_t)(sizeof("SK") -1), &skey);
  244. if (SGX_SUCCESS != se_ret)
  245. {
  246. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  247. se_ret = SGX_ERROR_UNEXPECTED;
  248. break;
  249. }
  250. se_ret = derive_key(&dh_key, "MK", (uint32_t)(sizeof("MK") -1), &mkey);
  251. if (SGX_SUCCESS != se_ret)
  252. {
  253. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  254. se_ret = SGX_ERROR_UNEXPECTED;
  255. break;
  256. }
  257. se_ret = derive_key(&dh_key, "VK", (uint32_t)(sizeof("VK") -1), &vkey);
  258. if (SGX_SUCCESS != se_ret)
  259. {
  260. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  261. se_ret = SGX_ERROR_UNEXPECTED;
  262. break;
  263. }
  264. }
  265. else
  266. {
  267. se_ret = SGX_ERROR_KDF_MISMATCH;
  268. break;
  269. }
  270. sgx_cmac_128bit_tag_t mac;
  271. uint32_t maced_size = offsetof(sgx_ra_msg2_t, mac);
  272. se_ret = sgx_rijndael128_cmac_msg(&smkey, (const uint8_t *)p_msg2, maced_size, &mac);
  273. if (SGX_SUCCESS != se_ret)
  274. {
  275. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  276. se_ret = SGX_ERROR_UNEXPECTED;
  277. break;
  278. }
  279. //Check mac
  280. if(0 == consttime_memequal(mac, p_msg2->mac, sizeof(mac)))
  281. {
  282. se_ret = SGX_ERROR_MAC_MISMATCH;
  283. break;
  284. }
  285. //create a nonce
  286. se_ret =sgx_read_rand((uint8_t*)p_nonce, sizeof(sgx_quote_nonce_t));
  287. if (SGX_SUCCESS != se_ret)
  288. {
  289. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  290. se_ret = SGX_ERROR_UNEXPECTED;
  291. break;
  292. }
  293. sgx_spin_lock(&item->item_lock);
  294. //sgx_ra_get_ga must have been called
  295. if (item->state != ra_get_gaed)
  296. {
  297. se_ret = SGX_ERROR_INVALID_STATE;
  298. sgx_spin_unlock(&item->item_lock);
  299. break;
  300. }
  301. memcpy(&item->g_b, &p_msg2->g_b, sizeof(item->g_b));
  302. memcpy(&item->smk_key, smkey, sizeof(item->smk_key));
  303. memcpy(&item->sk_key, skey, sizeof(item->sk_key));
  304. memcpy(&item->mk_key, mkey, sizeof(item->mk_key));
  305. memcpy(&item->vk_key, vkey, sizeof(item->vk_key));
  306. memcpy(&item->qe_target, p_qe_target, sizeof(sgx_target_info_t));
  307. memcpy(&item->quote_nonce, p_nonce, sizeof(sgx_quote_nonce_t));
  308. sgx_report_data_t report_data = {{0}};
  309. se_static_assert(sizeof(sgx_report_data_t)>=sizeof(sgx_sha256_hash_t));
  310. // H = SHA256(ga || gb || VK_CMAC)
  311. uint32_t sha256ed_size = offsetof(ra_db_item_t, sp_pubkey);
  312. //report_data is 512bits, H is 256bits. The H is in the lower 256 bits of report data while the higher 256 bits are all zeros.
  313. se_ret = sgx_sha256_msg((uint8_t *)&item->g_a, sha256ed_size,
  314. (sgx_sha256_hash_t *)&report_data);
  315. if(SGX_SUCCESS != se_ret)
  316. {
  317. if (SGX_ERROR_OUT_OF_MEMORY != se_ret)
  318. se_ret = SGX_ERROR_UNEXPECTED;
  319. sgx_spin_unlock(&item->item_lock);
  320. break;
  321. }
  322. //REPORTDATA = H
  323. se_ret = sgx_create_report(p_qe_target, &report_data, p_report);
  324. if (SGX_SUCCESS != se_ret)
  325. {
  326. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  327. se_ret = SGX_ERROR_UNEXPECTED;
  328. sgx_spin_unlock(&item->item_lock);
  329. break;
  330. }
  331. item->state = ra_proc_msg2ed;
  332. sgx_spin_unlock(&item->item_lock);
  333. }while(0);
  334. memset_s(&dh_key, sizeof(dh_key), 0, sizeof(dh_key));
  335. sgx_ecc256_close_context(ecc_state);
  336. memset_s(&a, sizeof(sgx_ec256_private_t),0, sizeof(sgx_ec256_private_t));
  337. memset_s(smkey, sizeof(sgx_ec_key_128bit_t),0, sizeof(sgx_ec_key_128bit_t));
  338. memset_s(skey, sizeof(sgx_ec_key_128bit_t),0, sizeof(sgx_ec_key_128bit_t));
  339. memset_s(mkey, sizeof(sgx_ec_key_128bit_t),0, sizeof(sgx_ec_key_128bit_t));
  340. memset_s(vkey, sizeof(sgx_ec_key_128bit_t),0, sizeof(sgx_ec_key_128bit_t));
  341. return se_ret;
  342. }
  343. /* the caller is supposed to fill the quote field in emp_msg3 before calling
  344. * this function.*/
  345. extern "C" sgx_status_t sgx_ra_get_msg3_trusted(
  346. sgx_ra_context_t context,
  347. uint32_t quote_size,
  348. sgx_report_t* qe_report,
  349. sgx_ra_msg3_t *emp_msg3, //(mac||g_a||ps_sec_prop||quote)
  350. uint32_t msg3_size)
  351. {
  352. if(vector_size(&g_ra_db) <= context ||!quote_size || !qe_report || !emp_msg3)
  353. return SGX_ERROR_INVALID_PARAMETER;
  354. ra_db_item_t* item = NULL;
  355. if(0 != vector_get(&g_ra_db, context, reinterpret_cast<void**>(&item)) || item == NULL )
  356. return SGX_ERROR_INVALID_PARAMETER;
  357. //check integer overflow of msg3_size and quote_size
  358. if (UINTPTR_MAX - reinterpret_cast<uintptr_t>(emp_msg3) < msg3_size ||
  359. UINT32_MAX - quote_size < sizeof(sgx_ra_msg3_t) ||
  360. sizeof(sgx_ra_msg3_t) + quote_size != msg3_size)
  361. return SGX_ERROR_INVALID_PARAMETER;
  362. if (!sgx_is_outside_enclave(emp_msg3, msg3_size))
  363. return SGX_ERROR_INVALID_PARAMETER;
  364. sgx_status_t se_ret = SGX_ERROR_UNEXPECTED;
  365. //verify qe report
  366. se_ret = sgx_verify_report(qe_report);
  367. if(se_ret != SGX_SUCCESS)
  368. {
  369. if (SGX_ERROR_MAC_MISMATCH != se_ret &&
  370. SGX_ERROR_OUT_OF_MEMORY != se_ret)
  371. se_ret = SGX_ERROR_UNEXPECTED;
  372. return se_ret;
  373. }
  374. sgx_spin_lock(&item->item_lock);
  375. //sgx_ra_proc_msg2_trusted must have been called
  376. if (item->state != ra_proc_msg2ed)
  377. {
  378. sgx_spin_unlock(&item->item_lock);
  379. return SGX_ERROR_INVALID_STATE;
  380. }
  381. //verify qe_report attributes and mr_enclave same as quoting enclave
  382. if( memcmp( &qe_report->body.attributes, &item->qe_target.attributes, sizeof(sgx_attributes_t)) ||
  383. memcmp( &qe_report->body.mr_enclave, &item->qe_target.mr_enclave, sizeof(sgx_measurement_t)) )
  384. {
  385. sgx_spin_unlock(&item->item_lock);
  386. return SGX_ERROR_INVALID_PARAMETER;
  387. }
  388. sgx_ra_msg3_t msg3_except_quote_in;
  389. sgx_cmac_128bit_key_t smk_key;
  390. memcpy(&msg3_except_quote_in.g_a, &item->g_a, sizeof(msg3_except_quote_in.g_a));
  391. memcpy(&msg3_except_quote_in.ps_sec_prop, &item->ps_sec_prop,
  392. sizeof(msg3_except_quote_in.ps_sec_prop));
  393. memcpy(&smk_key, &item->smk_key, sizeof(smk_key));
  394. sgx_spin_unlock(&item->item_lock);
  395. sgx_sha_state_handle_t sha_handle = NULL;
  396. sgx_cmac_state_handle_t cmac_handle = NULL;
  397. //SHA256(NONCE || emp_quote)
  398. sgx_sha256_hash_t hash = {0};
  399. se_ret = sgx_sha256_init(&sha_handle);
  400. if (SGX_SUCCESS != se_ret)
  401. {
  402. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  403. se_ret = SGX_ERROR_UNEXPECTED;
  404. return se_ret;
  405. }
  406. if (NULL == sha_handle)
  407. {
  408. return SGX_ERROR_UNEXPECTED;
  409. }
  410. do
  411. {
  412. se_ret = sgx_sha256_update((uint8_t *)&item->quote_nonce,
  413. sizeof(item->quote_nonce),
  414. sha_handle);
  415. if (SGX_SUCCESS != se_ret)
  416. {
  417. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  418. se_ret = SGX_ERROR_UNEXPECTED;
  419. break;
  420. }
  421. //cmac M := ga || PS_SEC_PROP_DESC(all zero if unused) ||emp_quote
  422. sgx_cmac_128bit_tag_t mac;
  423. se_ret = sgx_cmac128_init(&smk_key, &cmac_handle);
  424. if (SGX_SUCCESS != se_ret)
  425. {
  426. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  427. se_ret = SGX_ERROR_UNEXPECTED;
  428. break;
  429. }
  430. if (NULL == cmac_handle)
  431. {
  432. se_ret = SGX_ERROR_UNEXPECTED;
  433. break;
  434. }
  435. se_ret = sgx_cmac128_update((uint8_t*)&msg3_except_quote_in.g_a,
  436. sizeof(msg3_except_quote_in.g_a), cmac_handle);
  437. if (SGX_SUCCESS != se_ret)
  438. {
  439. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  440. se_ret = SGX_ERROR_UNEXPECTED;
  441. break;
  442. }
  443. se_ret = sgx_cmac128_update((uint8_t*)&msg3_except_quote_in.ps_sec_prop,
  444. sizeof(msg3_except_quote_in.ps_sec_prop), cmac_handle);
  445. if (SGX_SUCCESS != se_ret)
  446. {
  447. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  448. se_ret = SGX_ERROR_UNEXPECTED;
  449. break;
  450. }
  451. // sha256 and cmac quote
  452. uint8_t quote_piece[32];
  453. const uint8_t* emp_quote_piecemeal = emp_msg3->quote;
  454. uint32_t quote_piece_size = static_cast<uint32_t>(sizeof(quote_piece));
  455. while (emp_quote_piecemeal < emp_msg3->quote + quote_size)
  456. {
  457. //calculate size of one piece, the size of them are sizeof(quote_piece) except for the last one.
  458. if (static_cast<uint32_t>(emp_msg3->quote + quote_size - emp_quote_piecemeal) < quote_piece_size)
  459. quote_piece_size = static_cast<uint32_t>(emp_msg3->quote - emp_quote_piecemeal) + quote_size ;
  460. memcpy(quote_piece, emp_quote_piecemeal, quote_piece_size);
  461. se_ret = sgx_sha256_update(quote_piece,
  462. quote_piece_size,
  463. sha_handle);
  464. if (SGX_SUCCESS != se_ret)
  465. {
  466. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  467. se_ret = SGX_ERROR_UNEXPECTED;
  468. break;
  469. }
  470. se_ret = sgx_cmac128_update(quote_piece,
  471. quote_piece_size,
  472. cmac_handle);
  473. if (SGX_SUCCESS != se_ret)
  474. {
  475. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  476. se_ret = SGX_ERROR_UNEXPECTED;
  477. break;
  478. }
  479. emp_quote_piecemeal += sizeof(quote_piece);
  480. }
  481. ERROR_BREAK(se_ret);
  482. //get sha256 hash value
  483. se_ret = sgx_sha256_get_hash(sha_handle, &hash);
  484. if (SGX_SUCCESS != se_ret)
  485. {
  486. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  487. se_ret = SGX_ERROR_UNEXPECTED;
  488. break;
  489. }
  490. //get cmac value
  491. se_ret = sgx_cmac128_final(cmac_handle, &mac);
  492. if (SGX_SUCCESS != se_ret)
  493. {
  494. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  495. se_ret = SGX_ERROR_UNEXPECTED;
  496. break;
  497. }
  498. //verify qe_report->body.report_data == SHA256(NONCE || emp_quote)
  499. if(0 != memcmp(&qe_report->body.report_data, &hash, sizeof(hash)))
  500. {
  501. se_ret = SGX_ERROR_MAC_MISMATCH;
  502. break;
  503. }
  504. memcpy(&msg3_except_quote_in.mac, mac, sizeof(mac));
  505. memcpy(emp_msg3, &msg3_except_quote_in, offsetof(sgx_ra_msg3_t, quote));
  506. se_ret = SGX_SUCCESS;
  507. }while(0);
  508. memset_s(&smk_key, sizeof(smk_key), 0, sizeof(smk_key));
  509. (void)sgx_sha256_close(sha_handle);
  510. if(cmac_handle != NULL)
  511. sgx_cmac128_close(cmac_handle);
  512. return se_ret;
  513. }
  514. // TKE interface for isv enclaves
  515. sgx_status_t sgx_ra_init_ex(
  516. const sgx_ec256_public_t *p_pub_key,
  517. int b_pse,
  518. sgx_ra_derive_secret_keys_t derive_key_cb,
  519. sgx_ra_context_t *p_context)
  520. {
  521. int valid = 0;
  522. sgx_status_t ret = SGX_SUCCESS;
  523. sgx_ecc_state_handle_t ecc_state = NULL;
  524. // initialize g_kdf_cookie for the first time sgx_ra_init_ex is called.
  525. if (unlikely(g_kdf_cookie == 0))
  526. {
  527. uintptr_t rand = 0;
  528. do
  529. {
  530. if (SGX_SUCCESS != sgx_read_rand((unsigned char *)&rand, sizeof(rand)))
  531. {
  532. return SGX_ERROR_UNEXPECTED;
  533. }
  534. } while (rand == 0);
  535. sgx_spin_lock(&g_ra_db_lock);
  536. if (g_kdf_cookie == 0)
  537. {
  538. g_kdf_cookie = rand;
  539. memset_s(&rand, sizeof(rand), 0, sizeof(rand));
  540. }
  541. sgx_spin_unlock(&g_ra_db_lock);
  542. }
  543. if(!p_pub_key || !p_context)
  544. return SGX_ERROR_INVALID_PARAMETER;
  545. if(!sgx_is_within_enclave(p_pub_key, sizeof(sgx_ec256_public_t)))
  546. return SGX_ERROR_INVALID_PARAMETER;
  547. //derive_key_cb can be NULL
  548. if (NULL != derive_key_cb &&
  549. !sgx_is_within_enclave((const void*)derive_key_cb, 0))
  550. {
  551. return SGX_ERROR_INVALID_PARAMETER;
  552. }
  553. ret = sgx_ecc256_open_context(&ecc_state);
  554. if(SGX_SUCCESS != ret)
  555. {
  556. if(SGX_ERROR_OUT_OF_MEMORY != ret)
  557. ret = SGX_ERROR_UNEXPECTED;
  558. return ret;
  559. }
  560. ret = sgx_ecc256_check_point((const sgx_ec256_public_t *)p_pub_key,
  561. ecc_state, &valid);
  562. if(SGX_SUCCESS != ret)
  563. {
  564. if(SGX_ERROR_OUT_OF_MEMORY != ret)
  565. ret = SGX_ERROR_UNEXPECTED;
  566. sgx_ecc256_close_context(ecc_state);
  567. return ret;
  568. }
  569. if(!valid)
  570. {
  571. sgx_ecc256_close_context(ecc_state);
  572. return SGX_ERROR_INVALID_PARAMETER;
  573. }
  574. sgx_ecc256_close_context(ecc_state);
  575. //add new item to g_ra_db
  576. ra_db_item_t* new_item = (ra_db_item_t*)malloc(sizeof(ra_db_item_t));
  577. if (!new_item)
  578. {
  579. return SGX_ERROR_OUT_OF_MEMORY;
  580. }
  581. memset(new_item,0, sizeof(ra_db_item_t));
  582. memcpy(&new_item->sp_pubkey, p_pub_key, sizeof(new_item->sp_pubkey));
  583. if(b_pse)
  584. {
  585. //sgx_create_pse_session() must have been called
  586. ret = sgx_get_ps_sec_prop(&new_item->ps_sec_prop);
  587. if (ret!=SGX_SUCCESS)
  588. {
  589. SAFE_FREE(new_item);
  590. return ret;
  591. }
  592. }
  593. new_item->derive_key_cb = ENC_KDF_POINTER(derive_key_cb);
  594. new_item->state = ra_inited;
  595. //find first empty slot in g_ra_db
  596. int first_empty = -1;
  597. ra_db_item_t* item = NULL;
  598. sgx_spin_lock(&g_ra_db_lock);
  599. uint32_t size = vector_size(&g_ra_db);
  600. for (uint32_t i = 0; i < size; i++)
  601. {
  602. if(0 != vector_get(&g_ra_db, i, reinterpret_cast<void**>(&item)))
  603. {
  604. sgx_spin_unlock(&g_ra_db_lock);
  605. SAFE_FREE(new_item);
  606. return SGX_ERROR_UNEXPECTED;
  607. }
  608. if(item == NULL)
  609. {
  610. first_empty = i;
  611. break;
  612. }
  613. }
  614. //if there is a empty slot, use it
  615. if (first_empty >= 0)
  616. {
  617. errno_t vret = vector_set(&g_ra_db, first_empty, new_item);
  618. UNUSED(vret);
  619. assert(vret == 0);
  620. *p_context = first_empty;
  621. }
  622. //if there are no empty slots, add a new item to g_ra_db
  623. else
  624. {
  625. if(size >= INT32_MAX)
  626. {
  627. //overflow
  628. sgx_spin_unlock(&g_ra_db_lock);
  629. SAFE_FREE(new_item);
  630. return SGX_ERROR_OUT_OF_MEMORY;
  631. }
  632. if(0 != vector_push_back(&g_ra_db, new_item))
  633. {
  634. sgx_spin_unlock(&g_ra_db_lock);
  635. SAFE_FREE(new_item);
  636. return SGX_ERROR_OUT_OF_MEMORY;
  637. }
  638. *p_context = size;
  639. }
  640. sgx_spin_unlock(&g_ra_db_lock);
  641. return SGX_SUCCESS;
  642. }
  643. // TKE interface for isv enclaves
  644. sgx_status_t sgx_ra_init(
  645. const sgx_ec256_public_t *p_pub_key,
  646. int b_pse,
  647. sgx_ra_context_t *p_context)
  648. {
  649. return sgx_ra_init_ex(p_pub_key,
  650. b_pse,
  651. NULL,
  652. p_context);
  653. }
  654. // TKE interface for isv enclaves
  655. sgx_status_t sgx_ra_get_keys(
  656. sgx_ra_context_t context,
  657. sgx_ra_key_type_t type,
  658. sgx_ra_key_128_t *p_key)
  659. {
  660. if(vector_size(&g_ra_db) <= context || !p_key)
  661. return SGX_ERROR_INVALID_PARAMETER;
  662. ra_db_item_t* item = NULL;
  663. if(0 != vector_get(&g_ra_db, context, reinterpret_cast<void**>(&item)) || item == NULL )
  664. return SGX_ERROR_INVALID_PARAMETER;
  665. if(!sgx_is_within_enclave(p_key, sizeof(sgx_ra_key_128_t)))
  666. return SGX_ERROR_INVALID_PARAMETER;
  667. sgx_status_t ret = SGX_SUCCESS;
  668. sgx_spin_lock(&item->item_lock);
  669. //sgx_ra_proc_msg2_trusted fill the keys, so keys are available after it's called.
  670. if (item->state != ra_proc_msg2ed)
  671. ret = SGX_ERROR_INVALID_STATE;
  672. else if(SGX_RA_KEY_MK == type)
  673. memcpy(p_key, item->mk_key, sizeof(sgx_ra_key_128_t));
  674. else if(SGX_RA_KEY_SK == type)
  675. memcpy(p_key, item->sk_key, sizeof(sgx_ra_key_128_t));
  676. else
  677. ret = SGX_ERROR_INVALID_PARAMETER;
  678. sgx_spin_unlock(&item->item_lock);
  679. return ret;
  680. }
  681. // TKE interface for isv enclaves
  682. sgx_status_t SGXAPI sgx_ra_close(
  683. sgx_ra_context_t context)
  684. {
  685. if(vector_size(&g_ra_db) <= context)
  686. return SGX_ERROR_INVALID_PARAMETER;
  687. ra_db_item_t* item = NULL;
  688. if(0 != vector_get(&g_ra_db, context, reinterpret_cast<void**>(&item)) || item == NULL )
  689. return SGX_ERROR_INVALID_PARAMETER;
  690. sgx_spin_lock(&g_ra_db_lock);
  691. //safe clear private key and RA key before free memory to defense in depth
  692. memset_s(&item->a,sizeof(item->a),0,sizeof(sgx_ec256_private_t));
  693. memset_s(&item->vk_key,sizeof(item->vk_key),0,sizeof(sgx_ec_key_128bit_t));
  694. memset_s(&item->mk_key,sizeof(item->mk_key),0,sizeof(sgx_ec_key_128bit_t));
  695. memset_s(&item->sk_key,sizeof(item->sk_key),0,sizeof(sgx_ec_key_128bit_t));
  696. memset_s(&item->smk_key,sizeof(item->smk_key),0,sizeof(sgx_ec_key_128bit_t));
  697. SAFE_FREE(item);
  698. vector_set(&g_ra_db, context, NULL);
  699. sgx_spin_unlock(&g_ra_db_lock);
  700. return SGX_SUCCESS;
  701. }