tkey_exchange.cpp 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776
  1. /*
  2. * Copyright (C) 2011-2018 Intel Corporation. All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. *
  8. * * Redistributions of source code must retain the above copyright
  9. * notice, this list of conditions and the following disclaimer.
  10. * * Redistributions in binary form must reproduce the above copyright
  11. * notice, this list of conditions and the following disclaimer in
  12. * the documentation and/or other materials provided with the
  13. * distribution.
  14. * * Neither the name of Intel Corporation nor the names of its
  15. * contributors may be used to endorse or promote products derived
  16. * from this software without specific prior written permission.
  17. *
  18. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  21. * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  22. * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  23. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  24. * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  28. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29. *
  30. */
  31. #include <stdint.h>
  32. #include "sgx_tkey_exchange.h"
  33. #include "sgx_trts.h"
  34. #include "sgx_utils.h"
  35. #include "sgx_lfence.h"
  36. #include "ecp_interface.h"
  37. #include "util.h"
  38. #include "string.h"
  39. #include "stdlib.h"
  40. #include "sgx_spinlock.h"
  41. #include "sgx_tkey_exchange_t.h"
  42. #include "simple_vector.h"
  43. #include "se_cdefs.h"
  44. // Add a version to tkey_exchange.
  45. SGX_ACCESS_VERSION(tkey_exchange, 1)
  46. #define ERROR_BREAK(sgx_status) if(SGX_SUCCESS!=sgx_status){break;}
  47. #define SAFE_FREE(ptr) {if (NULL != (ptr)) {free(ptr); (ptr)=NULL;}}
  48. #pragma pack(push, 1)
  49. // any call to sgx_ra_init will reset the input pubkey related ra_db_item_t.ra_state to ra_inited
  50. // only sgx_ra_get_ga can change ra_inited to ra_get_gaed
  51. // only sgx_ra_proc_msg2_trusted can change ra_get_gaed to ra_proc_msg2ed
  52. // sgx_ra_get_msg3_trusted and sgx_ra_get_keys will check ra_state whether to be ra_proc_msg2ed
  53. typedef enum _ra_state
  54. {
  55. ra_inited= 0,
  56. ra_get_gaed,
  57. ra_proc_msg2ed
  58. }ra_state;
  59. typedef struct _ra_db_item_t
  60. {
  61. sgx_ec256_public_t g_a;
  62. sgx_ec256_public_t g_b;
  63. sgx_ec_key_128bit_t vk_key;
  64. sgx_ec256_public_t sp_pubkey;
  65. sgx_ec256_private_t a;
  66. sgx_ps_sec_prop_desc_t ps_sec_prop;
  67. sgx_ec_key_128bit_t mk_key;
  68. sgx_ec_key_128bit_t sk_key;
  69. sgx_ec_key_128bit_t smk_key;
  70. sgx_quote_nonce_t quote_nonce; //to verify quote report data
  71. sgx_target_info_t qe_target; //to verify quote report
  72. ra_state state;
  73. sgx_spinlock_t item_lock;
  74. uintptr_t derive_key_cb;
  75. }ra_db_item_t;
  76. #pragma pack(pop)
  77. static simple_vector g_ra_db = {0, 0, NULL};
  78. static sgx_spinlock_t g_ra_db_lock = SGX_SPINLOCK_INITIALIZER;
  79. static uintptr_t g_kdf_cookie = 0;
  80. #define ENC_KDF_POINTER(x) (uintptr_t)(x) ^ g_kdf_cookie
  81. #define DEC_KDF_POINTER(x) (sgx_ra_derive_secret_keys_t)((x) ^ g_kdf_cookie)
  82. extern "C" sgx_status_t sgx_ra_get_ga(
  83. sgx_ra_context_t context,
  84. sgx_ec256_public_t *g_a)
  85. {
  86. sgx_status_t se_ret;
  87. if(vector_size(&g_ra_db) <= context||!g_a)
  88. return SGX_ERROR_INVALID_PARAMETER;
  89. ra_db_item_t* item = NULL;
  90. if(0 != vector_get(&g_ra_db, context, reinterpret_cast<void**>(&item)) || item == NULL )
  91. return SGX_ERROR_INVALID_PARAMETER;
  92. sgx_ecc_state_handle_t ecc_state = NULL;
  93. sgx_ec256_public_t pub_key;
  94. sgx_ec256_private_t priv_key;
  95. memset(&pub_key, 0, sizeof(pub_key));
  96. memset(&priv_key, 0, sizeof(priv_key));
  97. sgx_spin_lock(&item->item_lock);
  98. do
  99. {
  100. //sgx_ra_init must have been called
  101. if (item->state != ra_inited)
  102. {
  103. se_ret = SGX_ERROR_INVALID_STATE;
  104. break;
  105. }
  106. // ecc_state should be closed when exit.
  107. se_ret = sgx_ecc256_open_context(&ecc_state);
  108. if (SGX_SUCCESS != se_ret)
  109. {
  110. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  111. se_ret = SGX_ERROR_UNEXPECTED;
  112. break;
  113. }
  114. se_ret = sgx_ecc256_create_key_pair(&priv_key, &pub_key, ecc_state);
  115. if (SGX_SUCCESS != se_ret)
  116. {
  117. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  118. se_ret = SGX_ERROR_UNEXPECTED;
  119. break;
  120. }
  121. memcpy(&item->a, &priv_key, sizeof(item->a));
  122. memcpy(&item->g_a, &pub_key, sizeof(item->g_a));
  123. memcpy(g_a, &pub_key, sizeof(sgx_ec256_public_t));
  124. item->state = ra_get_gaed;
  125. //clear local private key to defense in depth
  126. memset_s(&priv_key,sizeof(priv_key),0,sizeof(sgx_ec256_private_t));
  127. }while(0);
  128. sgx_spin_unlock(&item->item_lock);
  129. if(ecc_state!=NULL)
  130. sgx_ecc256_close_context(ecc_state);
  131. return se_ret;
  132. }
  133. extern "C" sgx_status_t sgx_ra_proc_msg2_trusted(
  134. sgx_ra_context_t context,
  135. const sgx_ra_msg2_t *p_msg2, //(g_b||spid||quote_type|| KDF_ID ||sign_gb_ga||cmac||sig_rl_size||sig_rl)
  136. const sgx_target_info_t *p_qe_target,
  137. sgx_report_t *p_report,
  138. sgx_quote_nonce_t* p_nonce)
  139. {
  140. sgx_status_t se_ret = SGX_ERROR_UNEXPECTED;
  141. //p_msg2[in] p_qe_target[in] p_report[out] p_nonce[out] in EDL file
  142. if(vector_size(&g_ra_db) <= context
  143. || !p_msg2
  144. || !p_qe_target
  145. || !p_report
  146. || !p_nonce)
  147. return SGX_ERROR_INVALID_PARAMETER;
  148. ra_db_item_t* item = NULL;
  149. if(0 != vector_get(&g_ra_db, context, reinterpret_cast<void**>(&item)) || item == NULL )
  150. return SGX_ERROR_INVALID_PARAMETER;
  151. sgx_ec256_private_t a;
  152. memset(&a, 0, sizeof(a));
  153. // Create gb_ga
  154. sgx_ec256_public_t gb_ga[2];
  155. sgx_ec256_public_t sp_pubkey;
  156. sgx_ec_key_128bit_t smkey = {0};
  157. sgx_ec_key_128bit_t skey = {0};
  158. sgx_ec_key_128bit_t mkey = {0};
  159. sgx_ec_key_128bit_t vkey = {0};
  160. sgx_ra_derive_secret_keys_t ra_key_cb = NULL;
  161. memset(&gb_ga[0], 0, sizeof(gb_ga));
  162. sgx_spin_lock(&item->item_lock);
  163. //sgx_ra_get_ga must have been called
  164. if (item->state != ra_get_gaed)
  165. {
  166. sgx_spin_unlock(&item->item_lock);
  167. return SGX_ERROR_INVALID_STATE;
  168. }
  169. memcpy(&a, &item->a, sizeof(a));
  170. memcpy(&gb_ga[1], &item->g_a, sizeof(gb_ga[1]));
  171. memcpy(&sp_pubkey, &item->sp_pubkey, sizeof(sp_pubkey));
  172. ra_key_cb = DEC_KDF_POINTER(item->derive_key_cb);
  173. sgx_spin_unlock(&item->item_lock);
  174. memcpy(&gb_ga[0], &p_msg2->g_b, sizeof(gb_ga[0]));
  175. sgx_ecc_state_handle_t ecc_state = NULL;
  176. // ecc_state need to be freed when exit.
  177. se_ret = sgx_ecc256_open_context(&ecc_state);
  178. if (SGX_SUCCESS != se_ret)
  179. {
  180. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  181. se_ret = SGX_ERROR_UNEXPECTED;
  182. return se_ret;
  183. }
  184. sgx_ec256_dh_shared_t dh_key;
  185. memset(&dh_key, 0, sizeof(dh_key));
  186. sgx_ec256_public_t* p_msg2_g_b = const_cast<sgx_ec256_public_t*>(&p_msg2->g_b);
  187. se_ret = sgx_ecc256_compute_shared_dhkey(&a,
  188. (sgx_ec256_public_t*)p_msg2_g_b,
  189. &dh_key, ecc_state);
  190. if(SGX_SUCCESS != se_ret)
  191. {
  192. if (SGX_ERROR_OUT_OF_MEMORY != se_ret)
  193. se_ret = SGX_ERROR_UNEXPECTED;
  194. sgx_ecc256_close_context(ecc_state);
  195. return se_ret;
  196. }
  197. // Verify signature of gb_ga
  198. uint8_t result;
  199. sgx_ec256_signature_t* p_msg2_sign_gb_ga = const_cast<sgx_ec256_signature_t*>(&p_msg2->sign_gb_ga);
  200. se_ret = sgx_ecdsa_verify((uint8_t *)&gb_ga, sizeof(gb_ga),
  201. &sp_pubkey,
  202. p_msg2_sign_gb_ga,
  203. &result, ecc_state);
  204. if(SGX_SUCCESS != se_ret)
  205. {
  206. if (SGX_ERROR_OUT_OF_MEMORY != se_ret)
  207. se_ret = SGX_ERROR_UNEXPECTED;
  208. sgx_ecc256_close_context(ecc_state);
  209. return se_ret;
  210. }
  211. if(SGX_EC_VALID != result)
  212. {
  213. sgx_ecc256_close_context(ecc_state);
  214. return SGX_ERROR_INVALID_SIGNATURE;
  215. }
  216. do
  217. {
  218. if(NULL != ra_key_cb)
  219. {
  220. se_ret = ra_key_cb(&dh_key,
  221. p_msg2->kdf_id,
  222. &smkey,
  223. &skey,
  224. &mkey,
  225. &vkey);
  226. if (SGX_SUCCESS != se_ret)
  227. {
  228. if(SGX_ERROR_OUT_OF_MEMORY != se_ret &&
  229. SGX_ERROR_INVALID_PARAMETER != se_ret &&
  230. SGX_ERROR_KDF_MISMATCH != se_ret)
  231. se_ret = SGX_ERROR_UNEXPECTED;
  232. break;
  233. }
  234. }
  235. else if (p_msg2->kdf_id == 0x0001)
  236. {
  237. se_ret = derive_key(&dh_key, "SMK", (uint32_t)(sizeof("SMK") -1), &smkey);
  238. if (SGX_SUCCESS != se_ret)
  239. {
  240. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  241. se_ret = SGX_ERROR_UNEXPECTED;
  242. break;
  243. }
  244. se_ret = derive_key(&dh_key, "SK", (uint32_t)(sizeof("SK") -1), &skey);
  245. if (SGX_SUCCESS != se_ret)
  246. {
  247. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  248. se_ret = SGX_ERROR_UNEXPECTED;
  249. break;
  250. }
  251. se_ret = derive_key(&dh_key, "MK", (uint32_t)(sizeof("MK") -1), &mkey);
  252. if (SGX_SUCCESS != se_ret)
  253. {
  254. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  255. se_ret = SGX_ERROR_UNEXPECTED;
  256. break;
  257. }
  258. se_ret = derive_key(&dh_key, "VK", (uint32_t)(sizeof("VK") -1), &vkey);
  259. if (SGX_SUCCESS != se_ret)
  260. {
  261. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  262. se_ret = SGX_ERROR_UNEXPECTED;
  263. break;
  264. }
  265. }
  266. else
  267. {
  268. se_ret = SGX_ERROR_KDF_MISMATCH;
  269. break;
  270. }
  271. sgx_cmac_128bit_tag_t mac;
  272. uint32_t maced_size = offsetof(sgx_ra_msg2_t, mac);
  273. se_ret = sgx_rijndael128_cmac_msg(&smkey, (const uint8_t *)p_msg2, maced_size, &mac);
  274. if (SGX_SUCCESS != se_ret)
  275. {
  276. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  277. se_ret = SGX_ERROR_UNEXPECTED;
  278. break;
  279. }
  280. //Check mac
  281. if(0 == consttime_memequal(mac, p_msg2->mac, sizeof(mac)))
  282. {
  283. se_ret = SGX_ERROR_MAC_MISMATCH;
  284. break;
  285. }
  286. //create a nonce
  287. se_ret =sgx_read_rand((uint8_t*)p_nonce, sizeof(sgx_quote_nonce_t));
  288. if (SGX_SUCCESS != se_ret)
  289. {
  290. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  291. se_ret = SGX_ERROR_UNEXPECTED;
  292. break;
  293. }
  294. sgx_spin_lock(&item->item_lock);
  295. //sgx_ra_get_ga must have been called
  296. if (item->state != ra_get_gaed)
  297. {
  298. se_ret = SGX_ERROR_INVALID_STATE;
  299. sgx_spin_unlock(&item->item_lock);
  300. break;
  301. }
  302. memcpy(&item->g_b, &p_msg2->g_b, sizeof(item->g_b));
  303. memcpy(&item->smk_key, smkey, sizeof(item->smk_key));
  304. memcpy(&item->sk_key, skey, sizeof(item->sk_key));
  305. memcpy(&item->mk_key, mkey, sizeof(item->mk_key));
  306. memcpy(&item->vk_key, vkey, sizeof(item->vk_key));
  307. memcpy(&item->qe_target, p_qe_target, sizeof(sgx_target_info_t));
  308. memcpy(&item->quote_nonce, p_nonce, sizeof(sgx_quote_nonce_t));
  309. sgx_report_data_t report_data = {{0}};
  310. se_static_assert(sizeof(sgx_report_data_t)>=sizeof(sgx_sha256_hash_t));
  311. // H = SHA256(ga || gb || VK_CMAC)
  312. uint32_t sha256ed_size = offsetof(ra_db_item_t, sp_pubkey);
  313. //report_data is 512bits, H is 256bits. The H is in the lower 256 bits of report data while the higher 256 bits are all zeros.
  314. se_ret = sgx_sha256_msg((uint8_t *)&item->g_a, sha256ed_size,
  315. (sgx_sha256_hash_t *)&report_data);
  316. if(SGX_SUCCESS != se_ret)
  317. {
  318. if (SGX_ERROR_OUT_OF_MEMORY != se_ret)
  319. se_ret = SGX_ERROR_UNEXPECTED;
  320. sgx_spin_unlock(&item->item_lock);
  321. break;
  322. }
  323. //REPORTDATA = H
  324. se_ret = sgx_create_report(p_qe_target, &report_data, p_report);
  325. if (SGX_SUCCESS != se_ret)
  326. {
  327. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  328. se_ret = SGX_ERROR_UNEXPECTED;
  329. sgx_spin_unlock(&item->item_lock);
  330. break;
  331. }
  332. item->state = ra_proc_msg2ed;
  333. sgx_spin_unlock(&item->item_lock);
  334. }while(0);
  335. memset_s(&dh_key, sizeof(dh_key), 0, sizeof(dh_key));
  336. sgx_ecc256_close_context(ecc_state);
  337. memset_s(&a, sizeof(sgx_ec256_private_t),0, sizeof(sgx_ec256_private_t));
  338. memset_s(smkey, sizeof(sgx_ec_key_128bit_t),0, sizeof(sgx_ec_key_128bit_t));
  339. memset_s(skey, sizeof(sgx_ec_key_128bit_t),0, sizeof(sgx_ec_key_128bit_t));
  340. memset_s(mkey, sizeof(sgx_ec_key_128bit_t),0, sizeof(sgx_ec_key_128bit_t));
  341. memset_s(vkey, sizeof(sgx_ec_key_128bit_t),0, sizeof(sgx_ec_key_128bit_t));
  342. return se_ret;
  343. }
  344. /* the caller is supposed to fill the quote field in emp_msg3 before calling
  345. * this function.*/
  346. extern "C" sgx_status_t sgx_ra_get_msg3_trusted(
  347. sgx_ra_context_t context,
  348. uint32_t quote_size,
  349. sgx_report_t* qe_report,
  350. sgx_ra_msg3_t *emp_msg3, //(mac||g_a||ps_sec_prop||quote)
  351. uint32_t msg3_size)
  352. {
  353. if(vector_size(&g_ra_db) <= context ||!quote_size || !qe_report || !emp_msg3)
  354. return SGX_ERROR_INVALID_PARAMETER;
  355. ra_db_item_t* item = NULL;
  356. if(0 != vector_get(&g_ra_db, context, reinterpret_cast<void**>(&item)) || item == NULL )
  357. return SGX_ERROR_INVALID_PARAMETER;
  358. //check integer overflow of msg3_size and quote_size
  359. if (UINTPTR_MAX - reinterpret_cast<uintptr_t>(emp_msg3) < msg3_size ||
  360. UINT32_MAX - quote_size < sizeof(sgx_ra_msg3_t) ||
  361. sizeof(sgx_ra_msg3_t) + quote_size != msg3_size)
  362. return SGX_ERROR_INVALID_PARAMETER;
  363. if (!sgx_is_outside_enclave(emp_msg3, msg3_size))
  364. return SGX_ERROR_INVALID_PARAMETER;
  365. //
  366. // fence after boundary check
  367. // this also stops speculation in case of
  368. // branch associated
  369. // with sizeof(sgx_ra_msg3_t) + quote_size != msg3_size
  370. // mispredicting
  371. //
  372. sgx_lfence();
  373. sgx_status_t se_ret = SGX_ERROR_UNEXPECTED;
  374. //verify qe report
  375. se_ret = sgx_verify_report(qe_report);
  376. if(se_ret != SGX_SUCCESS)
  377. {
  378. if (SGX_ERROR_MAC_MISMATCH != se_ret &&
  379. SGX_ERROR_OUT_OF_MEMORY != se_ret)
  380. se_ret = SGX_ERROR_UNEXPECTED;
  381. return se_ret;
  382. }
  383. sgx_spin_lock(&item->item_lock);
  384. //sgx_ra_proc_msg2_trusted must have been called
  385. if (item->state != ra_proc_msg2ed)
  386. {
  387. sgx_spin_unlock(&item->item_lock);
  388. return SGX_ERROR_INVALID_STATE;
  389. }
  390. //verify qe_report attributes and mr_enclave same as quoting enclave
  391. if( memcmp( &qe_report->body.attributes, &item->qe_target.attributes, sizeof(sgx_attributes_t)) ||
  392. memcmp( &qe_report->body.mr_enclave, &item->qe_target.mr_enclave, sizeof(sgx_measurement_t)) )
  393. {
  394. sgx_spin_unlock(&item->item_lock);
  395. return SGX_ERROR_INVALID_PARAMETER;
  396. }
  397. sgx_ra_msg3_t msg3_except_quote_in;
  398. sgx_cmac_128bit_key_t smk_key;
  399. memcpy(&msg3_except_quote_in.g_a, &item->g_a, sizeof(msg3_except_quote_in.g_a));
  400. memcpy(&msg3_except_quote_in.ps_sec_prop, &item->ps_sec_prop,
  401. sizeof(msg3_except_quote_in.ps_sec_prop));
  402. memcpy(&smk_key, &item->smk_key, sizeof(smk_key));
  403. sgx_spin_unlock(&item->item_lock);
  404. sgx_sha_state_handle_t sha_handle = NULL;
  405. sgx_cmac_state_handle_t cmac_handle = NULL;
  406. //SHA256(NONCE || emp_quote)
  407. sgx_sha256_hash_t hash = {0};
  408. se_ret = sgx_sha256_init(&sha_handle);
  409. if (SGX_SUCCESS != se_ret)
  410. {
  411. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  412. se_ret = SGX_ERROR_UNEXPECTED;
  413. return se_ret;
  414. }
  415. if (NULL == sha_handle)
  416. {
  417. return SGX_ERROR_UNEXPECTED;
  418. }
  419. do
  420. {
  421. se_ret = sgx_sha256_update((uint8_t *)&item->quote_nonce,
  422. sizeof(item->quote_nonce),
  423. sha_handle);
  424. if (SGX_SUCCESS != se_ret)
  425. {
  426. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  427. se_ret = SGX_ERROR_UNEXPECTED;
  428. break;
  429. }
  430. //cmac M := ga || PS_SEC_PROP_DESC(all zero if unused) ||emp_quote
  431. sgx_cmac_128bit_tag_t mac;
  432. se_ret = sgx_cmac128_init(&smk_key, &cmac_handle);
  433. if (SGX_SUCCESS != se_ret)
  434. {
  435. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  436. se_ret = SGX_ERROR_UNEXPECTED;
  437. break;
  438. }
  439. if (NULL == cmac_handle)
  440. {
  441. se_ret = SGX_ERROR_UNEXPECTED;
  442. break;
  443. }
  444. se_ret = sgx_cmac128_update((uint8_t*)&msg3_except_quote_in.g_a,
  445. sizeof(msg3_except_quote_in.g_a), cmac_handle);
  446. if (SGX_SUCCESS != se_ret)
  447. {
  448. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  449. se_ret = SGX_ERROR_UNEXPECTED;
  450. break;
  451. }
  452. se_ret = sgx_cmac128_update((uint8_t*)&msg3_except_quote_in.ps_sec_prop,
  453. sizeof(msg3_except_quote_in.ps_sec_prop), cmac_handle);
  454. if (SGX_SUCCESS != se_ret)
  455. {
  456. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  457. se_ret = SGX_ERROR_UNEXPECTED;
  458. break;
  459. }
  460. // sha256 and cmac quote
  461. uint8_t quote_piece[32];
  462. const uint8_t* emp_quote_piecemeal = emp_msg3->quote;
  463. uint32_t quote_piece_size = static_cast<uint32_t>(sizeof(quote_piece));
  464. while (emp_quote_piecemeal < emp_msg3->quote + quote_size)
  465. {
  466. //calculate size of one piece, the size of them are sizeof(quote_piece) except for the last one.
  467. if (static_cast<uint32_t>(emp_msg3->quote + quote_size - emp_quote_piecemeal) < quote_piece_size)
  468. quote_piece_size = static_cast<uint32_t>(emp_msg3->quote - emp_quote_piecemeal) + quote_size ;
  469. memcpy(quote_piece, emp_quote_piecemeal, quote_piece_size);
  470. se_ret = sgx_sha256_update(quote_piece,
  471. quote_piece_size,
  472. sha_handle);
  473. if (SGX_SUCCESS != se_ret)
  474. {
  475. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  476. se_ret = SGX_ERROR_UNEXPECTED;
  477. break;
  478. }
  479. se_ret = sgx_cmac128_update(quote_piece,
  480. quote_piece_size,
  481. cmac_handle);
  482. if (SGX_SUCCESS != se_ret)
  483. {
  484. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  485. se_ret = SGX_ERROR_UNEXPECTED;
  486. break;
  487. }
  488. emp_quote_piecemeal += sizeof(quote_piece);
  489. }
  490. ERROR_BREAK(se_ret);
  491. //get sha256 hash value
  492. se_ret = sgx_sha256_get_hash(sha_handle, &hash);
  493. if (SGX_SUCCESS != se_ret)
  494. {
  495. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  496. se_ret = SGX_ERROR_UNEXPECTED;
  497. break;
  498. }
  499. //get cmac value
  500. se_ret = sgx_cmac128_final(cmac_handle, &mac);
  501. if (SGX_SUCCESS != se_ret)
  502. {
  503. if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
  504. se_ret = SGX_ERROR_UNEXPECTED;
  505. break;
  506. }
  507. //verify qe_report->body.report_data == SHA256(NONCE || emp_quote)
  508. if(0 != memcmp(&qe_report->body.report_data, &hash, sizeof(hash)))
  509. {
  510. se_ret = SGX_ERROR_MAC_MISMATCH;
  511. break;
  512. }
  513. memcpy(&msg3_except_quote_in.mac, mac, sizeof(mac));
  514. memcpy(emp_msg3, &msg3_except_quote_in, offsetof(sgx_ra_msg3_t, quote));
  515. se_ret = SGX_SUCCESS;
  516. }while(0);
  517. memset_s(&smk_key, sizeof(smk_key), 0, sizeof(smk_key));
  518. (void)sgx_sha256_close(sha_handle);
  519. if(cmac_handle != NULL)
  520. sgx_cmac128_close(cmac_handle);
  521. return se_ret;
  522. }
  523. // TKE interface for isv enclaves
  524. sgx_status_t sgx_ra_init_ex(
  525. const sgx_ec256_public_t *p_pub_key,
  526. int b_pse,
  527. sgx_ra_derive_secret_keys_t derive_key_cb,
  528. sgx_ra_context_t *p_context)
  529. {
  530. int valid = 0;
  531. sgx_status_t ret = SGX_SUCCESS;
  532. sgx_ecc_state_handle_t ecc_state = NULL;
  533. // initialize g_kdf_cookie for the first time sgx_ra_init_ex is called.
  534. if (unlikely(g_kdf_cookie == 0))
  535. {
  536. uintptr_t rand = 0;
  537. do
  538. {
  539. if (SGX_SUCCESS != sgx_read_rand((unsigned char *)&rand, sizeof(rand)))
  540. {
  541. return SGX_ERROR_UNEXPECTED;
  542. }
  543. } while (rand == 0);
  544. sgx_spin_lock(&g_ra_db_lock);
  545. if (g_kdf_cookie == 0)
  546. {
  547. g_kdf_cookie = rand;
  548. memset_s(&rand, sizeof(rand), 0, sizeof(rand));
  549. }
  550. sgx_spin_unlock(&g_ra_db_lock);
  551. }
  552. if(!p_pub_key || !p_context)
  553. return SGX_ERROR_INVALID_PARAMETER;
  554. if(!sgx_is_within_enclave(p_pub_key, sizeof(sgx_ec256_public_t)))
  555. return SGX_ERROR_INVALID_PARAMETER;
  556. //derive_key_cb can be NULL
  557. if (NULL != derive_key_cb &&
  558. !sgx_is_within_enclave((const void*)derive_key_cb, 0))
  559. {
  560. return SGX_ERROR_INVALID_PARAMETER;
  561. }
  562. ret = sgx_ecc256_open_context(&ecc_state);
  563. if(SGX_SUCCESS != ret)
  564. {
  565. if(SGX_ERROR_OUT_OF_MEMORY != ret)
  566. ret = SGX_ERROR_UNEXPECTED;
  567. return ret;
  568. }
  569. ret = sgx_ecc256_check_point((const sgx_ec256_public_t *)p_pub_key,
  570. ecc_state, &valid);
  571. if(SGX_SUCCESS != ret)
  572. {
  573. if(SGX_ERROR_OUT_OF_MEMORY != ret)
  574. ret = SGX_ERROR_UNEXPECTED;
  575. sgx_ecc256_close_context(ecc_state);
  576. return ret;
  577. }
  578. if(!valid)
  579. {
  580. sgx_ecc256_close_context(ecc_state);
  581. return SGX_ERROR_INVALID_PARAMETER;
  582. }
  583. sgx_ecc256_close_context(ecc_state);
  584. //add new item to g_ra_db
  585. ra_db_item_t* new_item = (ra_db_item_t*)malloc(sizeof(ra_db_item_t));
  586. if (!new_item)
  587. {
  588. return SGX_ERROR_OUT_OF_MEMORY;
  589. }
  590. memset(new_item,0, sizeof(ra_db_item_t));
  591. memcpy(&new_item->sp_pubkey, p_pub_key, sizeof(new_item->sp_pubkey));
  592. if(b_pse)
  593. {
  594. //sgx_create_pse_session() must have been called
  595. ret = sgx_get_ps_sec_prop(&new_item->ps_sec_prop);
  596. if (ret!=SGX_SUCCESS)
  597. {
  598. SAFE_FREE(new_item);
  599. return ret;
  600. }
  601. }
  602. new_item->derive_key_cb = ENC_KDF_POINTER(derive_key_cb);
  603. new_item->state = ra_inited;
  604. //find first empty slot in g_ra_db
  605. int first_empty = -1;
  606. ra_db_item_t* item = NULL;
  607. sgx_spin_lock(&g_ra_db_lock);
  608. uint32_t size = vector_size(&g_ra_db);
  609. for (uint32_t i = 0; i < size; i++)
  610. {
  611. if(0 != vector_get(&g_ra_db, i, reinterpret_cast<void**>(&item)))
  612. {
  613. sgx_spin_unlock(&g_ra_db_lock);
  614. SAFE_FREE(new_item);
  615. return SGX_ERROR_UNEXPECTED;
  616. }
  617. if(item == NULL)
  618. {
  619. first_empty = i;
  620. break;
  621. }
  622. }
  623. //if there is a empty slot, use it
  624. if (first_empty >= 0)
  625. {
  626. errno_t vret = vector_set(&g_ra_db, first_empty, new_item);
  627. UNUSED(vret);
  628. assert(vret == 0);
  629. *p_context = first_empty;
  630. }
  631. //if there are no empty slots, add a new item to g_ra_db
  632. else
  633. {
  634. if(size >= INT32_MAX)
  635. {
  636. //overflow
  637. sgx_spin_unlock(&g_ra_db_lock);
  638. SAFE_FREE(new_item);
  639. return SGX_ERROR_OUT_OF_MEMORY;
  640. }
  641. if(0 != vector_push_back(&g_ra_db, new_item))
  642. {
  643. sgx_spin_unlock(&g_ra_db_lock);
  644. SAFE_FREE(new_item);
  645. return SGX_ERROR_OUT_OF_MEMORY;
  646. }
  647. *p_context = size;
  648. }
  649. sgx_spin_unlock(&g_ra_db_lock);
  650. return SGX_SUCCESS;
  651. }
  652. // TKE interface for isv enclaves
  653. sgx_status_t sgx_ra_init(
  654. const sgx_ec256_public_t *p_pub_key,
  655. int b_pse,
  656. sgx_ra_context_t *p_context)
  657. {
  658. return sgx_ra_init_ex(p_pub_key,
  659. b_pse,
  660. NULL,
  661. p_context);
  662. }
  663. // TKE interface for isv enclaves
  664. sgx_status_t sgx_ra_get_keys(
  665. sgx_ra_context_t context,
  666. sgx_ra_key_type_t type,
  667. sgx_ra_key_128_t *p_key)
  668. {
  669. if(vector_size(&g_ra_db) <= context || !p_key)
  670. return SGX_ERROR_INVALID_PARAMETER;
  671. ra_db_item_t* item = NULL;
  672. if(0 != vector_get(&g_ra_db, context, reinterpret_cast<void**>(&item)) || item == NULL )
  673. return SGX_ERROR_INVALID_PARAMETER;
  674. if(!sgx_is_within_enclave(p_key, sizeof(sgx_ra_key_128_t)))
  675. return SGX_ERROR_INVALID_PARAMETER;
  676. sgx_status_t ret = SGX_SUCCESS;
  677. sgx_spin_lock(&item->item_lock);
  678. //sgx_ra_proc_msg2_trusted fill the keys, so keys are available after it's called.
  679. if (item->state != ra_proc_msg2ed)
  680. ret = SGX_ERROR_INVALID_STATE;
  681. else if(SGX_RA_KEY_MK == type)
  682. memcpy(p_key, item->mk_key, sizeof(sgx_ra_key_128_t));
  683. else if(SGX_RA_KEY_SK == type)
  684. memcpy(p_key, item->sk_key, sizeof(sgx_ra_key_128_t));
  685. else
  686. ret = SGX_ERROR_INVALID_PARAMETER;
  687. sgx_spin_unlock(&item->item_lock);
  688. return ret;
  689. }
  690. // TKE interface for isv enclaves
  691. sgx_status_t SGXAPI sgx_ra_close(
  692. sgx_ra_context_t context)
  693. {
  694. if(vector_size(&g_ra_db) <= context)
  695. return SGX_ERROR_INVALID_PARAMETER;
  696. ra_db_item_t* item = NULL;
  697. if(0 != vector_get(&g_ra_db, context, reinterpret_cast<void**>(&item)) || item == NULL )
  698. return SGX_ERROR_INVALID_PARAMETER;
  699. sgx_spin_lock(&g_ra_db_lock);
  700. //safe clear private key and RA key before free memory to defense in depth
  701. memset_s(&item->a,sizeof(item->a),0,sizeof(sgx_ec256_private_t));
  702. memset_s(&item->vk_key,sizeof(item->vk_key),0,sizeof(sgx_ec_key_128bit_t));
  703. memset_s(&item->mk_key,sizeof(item->mk_key),0,sizeof(sgx_ec_key_128bit_t));
  704. memset_s(&item->sk_key,sizeof(item->sk_key),0,sizeof(sgx_ec_key_128bit_t));
  705. memset_s(&item->smk_key,sizeof(item->smk_key),0,sizeof(sgx_ec_key_128bit_t));
  706. SAFE_FREE(item);
  707. vector_set(&g_ra_db, context, NULL);
  708. sgx_spin_unlock(&g_ra_db_lock);
  709. return SGX_SUCCESS;
  710. }