Skip to content

Commit ccb1526

Browse files
dongbeioubadongbeiouba
committed
SMTC改进
根据GM/T 0105-2021设置参数值. 完整性验证机制采用SM2签名. SMTC随机数获取熵后,使用扩展函数sm3_df(). rand app supports get entropy from specified source. Rename rtc1 to rtcode, rtc2 to rtmem. Support acquiring entropy from specified entropy source. imporve self_test_drbg, test instantiate, reseed and generate. Support atf-slibce engine. Add sdf framework and few APIs. Add sdf app. Speed app add Keygen(SM2) and SDF(GenerateKey). Add TSAPI.
1 parent 8ad48a8 commit ccb1526

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

78 files changed

+5821
-761
lines changed

‎Configurations/00-base-templates.conf

+6
Original file line numberDiff line numberDiff line change
@@ -50,13 +50,19 @@ my %targets=(
5050
my @defs = ( 'OPENSSL_BUILDING_OPENSSL' );
5151
push @defs, "ZLIB" unless $disabled{zlib};
5252
push @defs, "ZLIB_SHARED" unless $disabled{"zlib-dynamic"};
53+
54+
push @defs, "SDF_LIB" unless $disabled{"sdf-lib"};
55+
push @defs, "SDF_LIB_SHARED" unless $disabled{"sdf-lib-dynamic"};
5356
return [ @defs ];
5457
},
5558
includes =>
5659
sub {
5760
my @incs = ();
5861
push @incs, $withargs{zlib_include}
5962
if !$disabled{zlib} && $withargs{zlib_include};
63+
64+
push @incs, $withargs{sdf_include}
65+
if !$disabled{sdf_lib} && $withargs{sdf_include};
6066
return [ @incs ];
6167
},
6268
},

‎Configure

+52-16
Original file line numberDiff line numberDiff line change
@@ -271,9 +271,14 @@ $config{builddir} = abs2rel($blddir, $blddir);
271271
# echo -n 'holy hand grenade of antioch' | openssl sha256
272272
$config{FIPSKEY} =
273273
'f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813';
274-
# echo -n "Tongsuo in hand, no worries about compliance" | tongsuo sm3
275-
$config{SMTCKEY} =
276-
'5b3d9ad84fd72961e63f27a3d5da2bb663e2ed9c7b761b8ad6d041ebc68f5098';
274+
$config{SMTCPASSWD} = 'Tongsuo123';
275+
$config{SMTCPUBKEY} =
276+
'-----BEGIN PUBLIC KEY-----
277+
MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAERjiZ5ubxrnOZnjhvqvuJ5UcdRI64
278+
sBEVwF0UztQK9eYzqOsFEm0PKkCjoYkdmiZ+Und0agHk94eFKhtUYsu0bw==
279+
-----END PUBLIC KEY-----';
280+
$config{SMTCPUBKEY} =~ s|\n|\\n|g;
281+
277282

278283
# Collect reconfiguration information if needed
279284
my @argvcopy=@ARGV;
@@ -355,8 +360,6 @@ $config{tongsuo_prerelease} =
355360
$config{tongsuo_version} = "$config{tongsuo_major}.$config{tongsuo_minor}.$config{tongsuo_patch}";
356361
$config{tongsuo_full_version} = "$config{tongsuo_version}$config{tongsuo_prerelease}";
357362

358-
$config{tongsuo_smtc_info} = $version{TONGSUO_SMTC_INFO};
359-
360363
die "erroneous version information in VERSION.dat: ",
361364
"$config{version}, $config{shlib_version}\n"
362365
unless (defined $version{MAJOR}
@@ -404,6 +407,7 @@ my @dtls = qw(dtls1 dtls1_2);
404407
my @disablables = (
405408
"acvp-tests",
406409
"afalgeng",
410+
"atf_slibce",
407411
"asan",
408412
"asm",
409413
"async",
@@ -474,6 +478,8 @@ my @disablables = (
474478
"smtc-debug",
475479
"scrypt",
476480
"sctp",
481+
"sdf-lib",
482+
"sdf-lib-dynamic",
477483
"secure-memory",
478484
"shared",
479485
"siphash",
@@ -588,8 +594,11 @@ our %disabled = ( # "what" => "comment"
588594
"zkp-gadget" => "default",
589595
"zkp-transcript" => "default",
590596
"bn-method" => "default",
591-
"smtc" => "default",
592-
"smtc-debug" => "default",
597+
"smtc" => "default",
598+
"smtc-debug" => "default",
599+
"atf_slibce" => "default",
600+
"sdf-lib" => "default",
601+
"sdf-lib-dynamic" => "default",
593602
);
594603

595604
# Note: => pair form used for aesthetics, not to truly make a hash table
@@ -679,6 +688,7 @@ my @disable_cascades = (
679688
# SMTC does not support ct for now
680689
# SMTC only support builtin module for now
681690
sub { !$disabled{"smtc"}} => [ "ct", "module" ],
691+
"sdf-lib" => [ "sdf-lib-dynamic" ],
682692
);
683693

684694
# Avoid protocol support holes. Also disable all versions below N, if version
@@ -796,7 +806,7 @@ my %cmdvars = (); # Stores FOO='blah' type arguments
796806
my %unsupported_options = ();
797807
my %deprecated_options = ();
798808
# If you change this, update apps/version.c
799-
my @known_seed_sources = qw(getrandom devrandom os egd none rdcpu librandom rtc);
809+
my @known_seed_sources = qw(getrandom devrandom os egd none rdcpu librandom rtcode rtmem rtsock);
800810
my @seed_sources = ();
801811
while (@argvcopy)
802812
{
@@ -914,6 +924,10 @@ while (@argvcopy)
914924
{
915925
delete $disabled{"zlib"};
916926
}
927+
elsif ($1 eq "sdf-lib-dynamic")
928+
{
929+
delete $disabled{"sdf-lib"};
930+
}
917931
my $algo = $1;
918932
delete $disabled{$algo};
919933

@@ -1011,6 +1025,18 @@ while (@argvcopy)
10111025
push @seed_sources, $x;
10121026
}
10131027
}
1028+
elsif (/^--with-atf_slibce-lib=(.*)$/)
1029+
{
1030+
$withargs{atf_slibce_lib}=$1;
1031+
}
1032+
elsif (/^--with-sdf-lib=(.*)$/)
1033+
{
1034+
$withargs{sdf_lib}=$1;
1035+
}
1036+
elsif (/^--with-sdf-include=(.*)$/)
1037+
{
1038+
$withargs{sdf_include}=$1;
1039+
}
10141040
elsif (/^--fips-key=(.*)$/)
10151041
{
10161042
$user{FIPSKEY}=lc($1);
@@ -1021,15 +1047,25 @@ while (@argvcopy)
10211047
die "FIPS key too long (64 bytes max)\n"
10221048
if length $1 > 64;
10231049
}
1024-
elsif (/^--smtc-key=(.*)$/)
1050+
elsif (/^--smtc-pubkey=(.*)$/)
10251051
{
1026-
$user{SMTCKEY}=lc($1);
1027-
die "Non-hex character in SMTC key\n"
1028-
if $user{SMTCKEY} =~ /[^a-f0-9]/;
1029-
die "SMTC key must have even number of characters\n"
1030-
if length $1 & 1;
1031-
die "SMTC key too long (64 bytes max)\n"
1032-
if length $1 > 64;
1052+
open my $fh, "<", $1 or die "Can't open $1: $!\n";
1053+
$user{SMTCPUBKEY} = do { local $/; <$fh> };
1054+
close $fh;
1055+
chomp $user{SMTCPUBKEY};
1056+
$user{SMTCPUBKEY} =~ s|\n|\\n|g;
1057+
}
1058+
elsif (/^--smtc-passwd=(.*)$/)
1059+
{
1060+
$user{SMTCPASSWD} = $1;
1061+
die "Invalid character in SMTC password (A-Z, a-z, 0-9)\n"
1062+
if $user{SMTCPASSWD} =~ /[^A-Za-z0-9]/;
1063+
die "Invalid SMTC password length (8 ~ 64 bytes)\n"
1064+
if length $1 < 8 or length $1 > 64;
1065+
}
1066+
elsif (/^--smtc-info=(.*)$/)
1067+
{
1068+
$config{tongsuo_smtc_info} = $1;
10331069
}
10341070
elsif (/^--banner=(.*)$/)
10351071
{

‎VERSION.dat

+1-2
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,4 @@ SHLIB_VERSION=3
88
TONGSUO_MAJOR=8
99
TONGSUO_MINOR=5
1010
TONGSUO_PATCH=0
11-
TONGSUO_PRE_RELEASE_TAG=dev
12-
TONGSUO_SMTC_INFO=
11+
TONGSUO_PRE_RELEASE_TAG=dev

‎apps/build.info

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ $OPENSSLSRC=\
1515
pkcs8.c pkey.c pkeyparam.c pkeyutl.c prime.c rand.c req.c \
1616
s_client.c s_server.c s_time.c sess_id.c smime.c speed.c \
1717
spkac.c verify.c version.c x509.c rehash.c storeutl.c \
18-
list.c info.c fipsinstall.c pkcs12.c
18+
list.c info.c fipsinstall.c pkcs12.c sdf.c
1919
IF[{- !$disabled{'ec'} -}]
2020
$OPENSSLSRC=$OPENSSLSRC ec.c ecparam.c
2121
ENDIF

‎apps/enc.c

+128-2
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
#include <openssl/x509.h>
2121
#include <openssl/rand.h>
2222
#include <openssl/pem.h>
23+
#include <openssl/tsapi.h>
2324
#ifndef OPENSSL_NO_COMP
2425
# include <openssl/comp.h>
2526
#endif
@@ -32,6 +33,11 @@
3233

3334
static int set_hex(const char *in, unsigned char *out, int size);
3435
static void show_ciphers(const OBJ_NAME *name, void *bio_);
36+
#ifdef NDEBUG
37+
static int do_crypt_with_isk(const EVP_CIPHER *cipher, int enc,
38+
const char *hkey, const char *hiv, const char *isk,
39+
BIO *rbio, BIO *wbio);
40+
#endif
3541

3642
struct doall_enc_ciphers {
3743
BIO *bio;
@@ -44,7 +50,7 @@ typedef enum OPTION_choice {
4450
OPT_E, OPT_IN, OPT_OUT, OPT_PASS, OPT_ENGINE, OPT_D, OPT_P, OPT_V,
4551
OPT_NOPAD, OPT_SALT, OPT_NOSALT, OPT_DEBUG, OPT_UPPER_P, OPT_UPPER_A,
4652
OPT_A, OPT_Z, OPT_BUFSIZE, OPT_K, OPT_KFILE, OPT_UPPER_K, OPT_NONE,
47-
OPT_UPPER_S, OPT_IV, OPT_MD, OPT_ITER, OPT_PBKDF2, OPT_CIPHER,
53+
OPT_UPPER_S, OPT_IV, OPT_MD, OPT_ITER, OPT_PBKDF2, OPT_CIPHER, OPT_ISK,
4854
OPT_R_ENUM, OPT_PROV_ENUM
4955
} OPTION_CHOICE;
5056

@@ -62,6 +68,7 @@ const OPTIONS enc_options[] = {
6268
#ifndef OPENSSL_NO_ENGINE
6369
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
6470
#endif
71+
{"isk", OPT_ISK, 's', "Internal private key, possibly in a hardware device"},
6572

6673
OPT_SECTION("Input"),
6774
{"in", OPT_IN, '<', "Input file"},
@@ -112,7 +119,7 @@ int enc_main(int argc, char **argv)
112119
EVP_CIPHER *cipher = NULL;
113120
EVP_MD *dgst = NULL;
114121
const char *digestname = NULL;
115-
char *hkey = NULL, *hiv = NULL, *hsalt = NULL, *p;
122+
char *hkey = NULL, *hiv = NULL, *hsalt = NULL, *p, *isk = NULL;
116123
char *infile = NULL, *outfile = NULL, *prog;
117124
char *str = NULL, *passarg = NULL, *pass = NULL, *strbuf = NULL;
118125
const char *ciphername = NULL;
@@ -253,6 +260,9 @@ int enc_main(int argc, char **argv)
253260
case OPT_UPPER_K:
254261
hkey = opt_arg();
255262
break;
263+
case OPT_ISK:
264+
isk = opt_arg();
265+
break;
256266
case OPT_UPPER_S:
257267
hsalt = opt_arg();
258268
break;
@@ -534,6 +544,55 @@ int enc_main(int argc, char **argv)
534544
BIO_printf(bio_err, "iv undefined\n");
535545
goto end;
536546
}
547+
548+
if (isk != NULL) {
549+
#ifndef NDEBUG
550+
EVP_PKEY_CTX *pctx = NULL;
551+
EVP_PKEY *pisk = NULL;
552+
size_t outlen;
553+
char path[512];
554+
BIO *bio_isk = NULL;
555+
unsigned char *kk = NULL, *key1 = NULL;
556+
char *hbuf = NULL;
557+
long keylen;
558+
snprintf(path, sizeof(path), "/tmp/.keys/%s.key", isk);
559+
560+
if ((bio_isk = BIO_new(BIO_s_file())) == NULL
561+
|| BIO_read_filename(bio_isk, path) <= 0) {
562+
BIO_printf(bio_err, "Error reading internal private key\n");
563+
goto end;
564+
}
565+
566+
pisk = PEM_read_bio_PrivateKey(bio_isk, NULL, NULL, NULL);
567+
if (pisk == NULL)
568+
goto end;
569+
570+
key1 = OPENSSL_hexstr2buf(hkey, &keylen);
571+
if (key1 == NULL)
572+
goto end;
573+
574+
pctx = EVP_PKEY_CTX_new(pisk, NULL);
575+
if (EVP_PKEY_decrypt_init(pctx) <= 0
576+
|| EVP_PKEY_decrypt(pctx, NULL, &outlen, key1, keylen) <= 0)
577+
goto end;
578+
579+
kk = OPENSSL_malloc(outlen);
580+
if (EVP_PKEY_decrypt(pctx, kk, &outlen, key1, keylen) <= 0)
581+
goto end;
582+
583+
hbuf = OPENSSL_zalloc(outlen * 2 + 1);
584+
if (!OPENSSL_buf2hexstr_ex(hbuf, outlen * 2 + 1, NULL, kk, outlen, '\0'))
585+
goto end;
586+
hkey = hbuf;
587+
OPENSSL_free(kk);
588+
#else
589+
if (do_crypt_with_isk(cipher, enc, hkey, hiv, isk, rbio, wbio) == 1)
590+
ret = 0;
591+
592+
goto end;
593+
#endif
594+
}
595+
537596
if (hkey != NULL) {
538597
if (!set_hex(hkey, key, EVP_CIPHER_get_key_length(cipher))) {
539598
BIO_printf(bio_err, "invalid hex key value\n");
@@ -696,3 +755,70 @@ static int set_hex(const char *in, unsigned char *out, int size)
696755
}
697756
return 1;
698757
}
758+
759+
#ifdef NDEBUG
760+
static int do_crypt_with_isk(const EVP_CIPHER *cipher, int enc,
761+
const char *hkey, const char *hiv, const char *isk,
762+
BIO *rbio, BIO *wbio)
763+
{
764+
int ok = 0, inl;
765+
unsigned char *keybuf = NULL, *ivbuf = NULL;
766+
long keylen, ivlen;
767+
unsigned char inbuf[EVP_MAX_BLOCK_LENGTH];
768+
unsigned char outbuf[EVP_MAX_BLOCK_LENGTH];
769+
int blocksize = EVP_CIPHER_block_size(cipher);
770+
size_t outlen;
771+
772+
if (hkey == NULL) {
773+
BIO_printf(bio_err, "No hex key found\n");
774+
goto end;
775+
}
776+
777+
keybuf = OPENSSL_hexstr2buf(hkey, &keylen);
778+
if (keybuf == NULL) {
779+
BIO_printf(bio_err, "invalid hex key value\n");
780+
goto end;
781+
}
782+
783+
if (hiv == NULL) {
784+
BIO_printf(bio_err, "No hex iv found\n");
785+
goto end;
786+
}
787+
788+
ivbuf = OPENSSL_hexstr2buf(hiv, &ivlen);
789+
if (ivbuf == NULL) {
790+
BIO_printf(bio_err, "invalid hex iv value\n");
791+
goto end;
792+
}
793+
794+
while (BIO_pending(rbio) || !BIO_eof(rbio)) {
795+
inl = BIO_read(rbio, (char *)inbuf, blocksize);
796+
if (inl <= 0)
797+
break;
798+
799+
if (enc) {
800+
if (TSAPI_encrypt_with_isk(EVP_CIPHER_get0_name(cipher), keybuf,
801+
keylen, ivbuf, ivlen, isk, inbuf, inl,
802+
outbuf, &outlen) != 1)
803+
goto end;
804+
} else {
805+
if (TSAPI_decrypt_with_isk(EVP_CIPHER_get0_name(cipher), keybuf,
806+
keylen, ivbuf, ivlen, isk, inbuf, inl,
807+
outbuf, &outlen) != 1)
808+
goto end;
809+
}
810+
811+
if (BIO_write(wbio, (char *)outbuf, outlen) != (int)outlen) {
812+
BIO_printf(bio_err, "error writing output file\n");
813+
goto end;
814+
}
815+
}
816+
817+
ok = 1;
818+
end:
819+
OPENSSL_free(keybuf);
820+
OPENSSL_free(ivbuf);
821+
822+
return ok;
823+
}
824+
#endif

0 commit comments

Comments
 (0)