coelner/pico-hsm
1
0
Fork 0
mirror of https://github.com/polhenarejos/pico-hsm.git synced 2024-09-20 03:10:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix DKEK import when no logged.

Browse Source 
DKEK shall accept import even if it is not logged in. However, to store the DKEK, the PIN is used for MKEK, which is not available if it is nog logged in. I added a queueing system to store a pending DKEK after login.

Therefore, to import a DKEK, the user must import it AND call VERIFY command if it is not already logged in.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
This commit is contained in:
Pol Henarejos 2023-10-12 17:42:31 +02:00
parent 2693ab4926
commit 6b1eeb4004
No known key found for this signature in database
GPG Key ID: C0095B7870A4CCD3
4 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/hsm/cmd_key_domain.c
View File

@ -68,10 +68,16 @@ int cmd_key_domain() {
}
import_dkek_share(p2, apdu.data);
if (++current_dkeks >= dkeks) {
if (save_dkek_key(p2, NULL) != CCID_OK) {
/* On fail, it will return to previous dkek state. */
import_dkek_share(p2, apdu.data);
return SW_FILE_NOT_FOUND();
int r = save_dkek_key(p2, NULL);
if (r != CCID_OK) {
if (r == CCID_NO_LOGIN) {
pending_save_dkek = p2;
}
else {
/* On fail, it will return to previous dkek state. */
import_dkek_share(p2, apdu.data);
return SW_FILE_NOT_FOUND();
}
}
}
uint8_t t[MAX_KEY_DOMAINS * 2];

1
src/hsm/kek.c
View File

@ -36,6 +36,7 @@ extern bool has_session_pin, has_session_sopin;
extern uint8_t session_pin[32], session_sopin[32];
uint8_t mkek_mask[MKEK_KEY_SIZE];
bool has_mkek_mask = false;
uint8_t pending_save_dkek = 0xff;
#define POLY 0xedb88320

2
src/hsm/kek.h
View File

@ -74,4 +74,6 @@ extern mse_t mse;
extern int mse_decrypt_ct(uint8_t *, size_t);
extern uint8_t pending_save_dkek;
#endif

4
src/hsm/sc_hsm.c
View File

@ -407,6 +407,10 @@ int check_pin(const file_t *pin, const uint8_t *data, size_t len) {
hash_multi(data, len, session_sopin);
has_session_sopin = true;
}
if (pending_save_dkek != 0xff) {
save_dkek_key(pending_save_dkek, NULL);
pending_save_dkek = 0xff;
}
return SW_OK();
}