sec_lib_definitions.h

00001 /*
00002  * Copyright (c) 2014-2017, Arm Limited and affiliates.
00003  * SPDX-License-Identifier: Apache-2.0
00004  *
00005  * Licensed under the Apache License, Version 2.0 (the "License");
00006  * you may not use this file except in compliance with the License.
00007  * You may obtain a copy of the License at
00008  *
00009  *     http://www.apache.org/licenses/LICENSE-2.0
00010  *
00011  * Unless required by applicable law or agreed to in writing, software
00012  * distributed under the License is distributed on an "AS IS" BASIS,
00013  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
00014  * See the License for the specific language governing permissions and
00015  * limitations under the License.
00016  */
00017 
00018 #ifndef SEC_LIB_DEFINITIONS_H_
00019 #define SEC_LIB_DEFINITIONS_H_
00020 
00021 #include "ns_sha256.h"
00022 
00023 #define SEC_CIPHERSUITE_PSK 1
00024 #define SEC_CIPHERSUITE_ECC 2
00025 
00026 #define SEC_DEFAULT_SUPPORTED_CHIPHER_SUITES SEC_CIPHERSUITE_PSK
00027 
00028 //Pana & TLS Auhentication Parameters
00029 
00030 
00031 #define AUTHENTICATION_DONE     0x80
00032 #define AUTHENTICATION_FAIL     0
00033 #define AUTHENTICATION_CLOSE    1
00034 #define TLS_SERVER_MODE 0x10
00035 #define TLS_HANSHAKE_HASH 0x08
00036 
00037 #define TLS_ECC_CERTIFICATE_NO_REQUEST   0
00038 #define TLS_ECC_CERTIFICATE_REQUESTED    0x04
00039 #define TLS_ECC_CERTIFICATE_RECEIVED     0x40
00040 #define TLS_ECC_CERTIFICATE_VERIFY       0x80
00041 
00042 #define PANA_KEY_UPDATE_DEFAULT_TIMEOUT 120000
00043 
00044 #define SOCKET_ID_MASK  0x03
00045 #define TLS_CIPHER_NONE 0
00046 
00047 #define TLS_CERT_TYPE_ECDSA             64
00048 
00049 
00050 typedef enum {
00051     CHIPHER_NONE = 0,
00052     CHIPHER_PSK,
00053     CHIPHER_ECC
00054 } tls_chipher_mode_t;
00055 
00056 typedef struct auth_info {
00057     uint8_t network_key[16];
00058     uint8_t key_id;
00059 } auth_info_t;
00060 
00061 
00062 #define ALERT_CLOSE 0
00063 #define ALERT_BAD_RECORD    20
00064 #define ALERT_INTERNAL_ERR  80
00065 #define ALERT_BAD_CERTIFICATE 42
00066 
00067 
00068 /****************************************
00069  * TLS BASE
00070  *
00071  * Type     Version     Length
00072  *
00073  *  8-bit   0x03 0x03   16-bit
00074  *
00075  *
00076  */
00077 
00078 #define PANA_ST_IDLE 0
00079 #define PANA_ST_READY 1
00080 #define PANA_ST_KEY_WRAP 2
00081 #define PANA_ST_SERVER  4
00082 
00083 typedef struct {
00084     uint8_t security_support;
00085     uint16_t pan_id;
00086     uint32_t psk_key_id;
00087 } pana_tls_setup_s;
00088 
00089 #define CLIENT_HELLO_PTR 0
00090 #define SERVER_HELLO_PTR 32
00091 
00092 /* HandshakeType */
00093 #define TLS_CLIENT_HELLO                1
00094 #define TLS_SERVER_HELLO                2
00095 #define TLS_CERTIFICATE                 11
00096 #define TLS_SERVER_KEY_EXCHANGE         12
00097 #define TLS_CERTIFICATE_REQUEST         13
00098 #define TLS_SERVER_HELLO_DONE           14
00099 #define TLS_CERTIFICATE_VERIFY          15
00100 #define TLS_CLIENT_KEY_EXCHANGE         16
00101 #define TLS_FINISHED                    20
00102 
00103 /* ContentType */
00104 #define TLS_CHANGE_CIPHER_SPEC          20
00105 #define TLS_ALERT_TYPE                  21
00106 #define TLS_HANDSHAKE                   22
00107 #define TLS_APP_DATA                    23
00108 
00109 #define TLS_1_2_VERSION                 0x0303
00110 
00111 #define TLS_PSK_WITH_AES_128_CCM_8                  0xc0a8  // RFC 6655
00112 #define TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8          0xc0ae  // RFC 7251
00113 #define TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8_COMPAT   0xc0c6  // Non-standard, from ZigBee IP
00114 
00115 #define TLS_COMPRESSION_METHOD_NULL         0
00116 
00117 #define TLS_EXTENSION_ELLIPTIC_CURVES       10
00118 #define TLS_EXTENSION_EC_POINT_FORMATS      11
00119 #define TLS_EXTENSION_SIGNATURE_ALGORITHMS  13
00120 
00121 #define TLS_HASH_SHA256                     4
00122 #define TLS_SIGNATURE_ECDSA                 3
00123 #define TLS_SIG_HASH_ALG_SHA256_ECDSA       ((TLS_HASH_SHA256 << 8) | TLS_SIGNATURE_ECDSA)
00124 
00125 #define TLS_EC_CURVE_TYPE_NAMED_CURVE       3
00126 
00127 #define TLS_NAMED_CURVE_SECP256R1           23
00128 
00129 #ifdef ECC
00130 #include "GMPNlib.h"
00131 #include "GELAlib.h"
00132 #include "ecdsa.h"
00133 #include "libX509_V3.h"
00134 
00135 typedef struct {
00136     EllipticPoint cert_pub_key;     // 80 bytes
00137     uint8_t client_public_key[64];  // Pk Client: client_public_key[0-31] X point, client_public_key[32-63] y point remember change byte order
00138     uint8_t server_public_key[64];  // Pk server server_public_key[0-31] X point, server_public_key[32-63] y point remember change byte order
00139     uint8_t pre_secret_mat[32];     // Client Pk server * k*curve and server Pk client*k*curve only x point
00140     ECDSASignature *sgnt;
00141     MPint private_key;
00142 } tls_ecc_heap_t;
00143 #endif
00144 
00145 typedef struct {
00146 #ifdef ECC
00147     tls_ecc_heap_t *ecc_heap;
00148 #endif
00149     uint8_t temp_buf[64];               // len 64 bytes
00150     uint8_t verify[16];             // len 16 bytes
00151     uint8_t tls_hello_random[64];
00152     uint8_t hash_buf[32];           //32 bytes
00153     uint16_t tls_handshake_h_len;
00154     uint16_t client_verify_buf_len;
00155     uint8_t *client_verify_buf;
00156     tls_chipher_mode_t tls_chipher_mode;
00157     ns_sha256_context sha256_ctx;
00158 #ifdef ECC
00159     certificate_chain_t rx_ceri_chain;
00160     bool client_knows_standard_ecc_ciphersuite;
00161 #endif /*ECC*/
00162     uint8_t pointer_types;
00163     void *cert_temp_buf;
00164     void *signature_temp_buf;
00165     uint8_t *key_signature_ptr;
00166 } tls_heap_t;
00167 
00168 typedef struct {
00169     uint8_t type;
00170     uint16_t length;
00171     uint8_t *ptr;
00172 } tls_header_t;
00173 
00174 typedef struct {
00175     uint16_t type;
00176     uint16_t len;
00177     uint8_t *msg_ptr;
00178 } tls_msg_t;
00179 
00180 
00181 typedef enum {
00182     PANA_INIT = 0,
00183     PANA_PCI_TX,
00184     PANA_REQUEST_TX,
00185     PANA_START_RESPONSE,
00186     PANA_PING_REQ,
00187     PANA_KEY_PULL,
00188     PANA_RE_VALID,
00189     PANA_PULL_DONE,
00190     PANA_READY,
00191     PANA_KEY_UPDATE, /*10*/
00192     PANA_FAILURE,
00193     PANA_FAILURE_RESPONSE,
00194     EAP_IDENTITY_REQ,
00195     EAP_IDENTITY_RES,
00196     EAP_FINISH,
00197     EAP_PANA_FINISH,
00198     TLS_START,
00199     TLS_INIT,
00200     PRF_CALC,
00201     PRF_CALC2, /*20*/
00202     TLS_ECC_CERTIFICATE_VERIFY_SIGNATURE,
00203     TLS_ECC_CERTIFICATE_SIGNATURE_CHECK,
00204     TLS_ECC_MESSAGE_VERIFY,
00205     TLS_ECC_MESSAGE_VERIFY_START,
00206     TLS_ECC_MESSAGE_VERIFY_START2,
00207     TLS_ECC_MESSAGE_SERVER_VERIFY_START,
00208     TLS_ECC_GENERATE_PUBLIC_KEY,
00209     TLS_ECC_GENERATE_PUBLIC_KEY_START,
00210     TLS_ECC_GENERATE_PREMASTER_SECRET,
00211     TLS_ECC_SIGNATURE_MESSAGE,/*30*/
00212     TLS_ECC_CLIENT_SIGNATURE_START,
00213     TLS_KEY_CHANGE,
00214     TLS_CHANGE_CHIPHER,
00215     TLS_HELLO_DONE,
00216     TLS_FINNISH_RX,
00217     TLS_FINISH,
00218     TLS_EAP_END_PANA_VERIFY,
00219     TLS_ALERT,
00220     TLS_ALERT_INTERNAL,
00221     TLS_ALERT_CHIPHER_SUITE,/*40*/
00222     TLS_ALERT_DECRYPT,
00223     TLS_ALERT_BAD_CERTIFICATE,
00224     TLS_ALERT_CLOSE_FATAL,
00225     TLS_SERVER_TX_SERVER_HELLO,
00226     TLS_UPDATE_HAS_WITH_CERTIFICATE,
00227     TLS_TX_SERVER_KEY_EXCHANGE,
00228     TLS_SERVER_ECC_PUB_KEY_GEN,
00229     TLS_SERVER_TX_CHANGE_CIPHERSUITE,
00230     TLS_CLIENT_TX_CERTIFICATE_VERIFY,
00231     TLS_SERVER_WAIT_CHANGE_CHIPHERSUITE,/*50*/
00232     TLS_SERVER_WAIT_CLIENT_HELLO,
00233     TLS_CERTIFICATE_RX,
00234     TLS_SERVER_KEY_EXCHANGE_RX,
00235     TLS_CLIENT_KEY_EXCHANGE_RX,
00236     TLS_HELLO_RX,
00237     PANA_ERROR
00238 } sec_state_machine_t;
00239 
00240 typedef struct {
00241     uint8_t pana_handshake[120];// 80 bytes
00242     uint16_t handshake_req_offset;
00243     uint16_t handshake_len;
00244     uint8_t client_nonce[16];
00245     uint8_t agent_nonce[16];
00246     /* Pana MSK */
00247     uint8_t MSK[64];        // calculated only ones / session
00248 } pana_heap_t;
00249 
00250 typedef struct {
00251     uint8_t key_id;
00252     uint8_t new_key_material[16];
00253     uint16_t key_delivery_cnt;
00254 } pana_key_update_t;
00255 
00256 typedef struct {
00257     uint8_t key_material[16];
00258     uint8_t key_id;
00259 } pana_key_material_t;
00260 
00261 
00262 typedef struct {
00263     uint8_t type;
00264     uint16_t length;
00265     uint16_t offset;
00266     uint8_t *ptr;
00267 } tls_record_segment_t;
00268 
00269 typedef struct {
00270     int8_t network_interface_id;
00271     uint32_t pana_key_id;
00272     uint32_t session_lifetime;
00273     uint32_t key_wrap;
00274     uint32_t prf_algorythm;
00275     uint32_t integrity_algorythm;
00276     uint32_t next_session_id;
00277     pana_key_material_t sec_key_material[2];
00278     uint8_t primary_material;
00279     uint8_t supported_chipher_suites;
00280     pana_key_update_t *pana_key_update;
00281     uint32_t key_update_delay;
00282     uint8_t auth_cnt;
00283     uint8_t open_pana_authentication_cnt;
00284     uint32_t pana_key_update_delay_used;
00285 } pana_server_base_t;
00286 
00287 
00288 typedef struct pana_session_t {
00289     uint16_t nvm_offset;
00290     /* Pana Session Key */
00291     uint8_t pana_auth_key[32]; //calculated only ones /session
00292     /* Pana Encryption key */
00293     uint8_t pana_PAA_enc_key[16]; // calculated only ones /session
00294     //uint8_t pana_PAC_enc_key[16]; // calculated only ones /session
00295     uint32_t pana_key_id;
00296     uint32_t session_id;
00297     uint32_t req_seq;
00298     uint32_t res_seq;
00299     uint32_t session_lifetime;
00300 
00301     uint32_t key_wrap;
00302     uint32_t prf_algorythm;
00303     uint32_t integrity_algorythm;
00304     /* EAP Segment */
00305 
00306     buffer_t *eap_frag_buf;
00307     uint16_t frag_off_set;
00308     uint16_t frag_length;
00309 
00310     buffer_t *eap_assy_buf;
00311     uint16_t assy_off_set;
00312     uint16_t assy_length;
00313     uint16_t last_assy_size;
00314     uint8_t eap_id_seq;
00315     uint8_t auth_cnt;
00316     uint8_t nwk_key_id;
00317     bool session_ready:1;
00318     bool key_warp:1;
00319     bool user_server:1;
00320     bool packet_delivered:1;
00321     /* Define Relay usage */
00322     uint8_t address_status;
00323     uint8_t session_relay_address[16];
00324     uint16_t relay_port;
00325 
00326     pana_heap_t *pana_heap;
00327     auth_info_t *auth_info;
00328 } pana_session_t;
00329 
00330 typedef struct tls_session_t {
00331     uint8_t key_expansion[64];
00332     uint8_t id_length;
00333     uint8_t tls_session_id[32];
00334     uint8_t tls_nonce_explit[8];
00335     uint8_t temp_buf[5];
00336     uint8_t master_secret[48];  //len 48 bytes
00337     tls_heap_t *tls_heap;
00338 } tls_session_t;
00339 
00340 typedef struct sec_suite_t {
00341     pana_session_t pana_session;
00342     tls_session_t *tls_session;
00343     protocol_interface_info_entry_t *interface;
00344     sec_state_machine_t state;
00345     uint8_t retry_counter;
00346     uint8_t supported_chipher_suites;
00347     uint16_t setups;
00348     uint16_t session_port;
00349     uint32_t timer;
00350     int32_t psk_key_id;
00351     uint8_t session_address[16];
00352     uint16_t pan_id;
00353     ns_list_link_t link;
00354 } sec_suite_t;
00355 
00356 #endif /* SEC_LIB_DEFINITIONS_H_ */