HKDF: Implement on tinydtls as well

.cirrus.yml

@@ -19,7 +19,7 @@ build_task:
     MBEDTLS_LIB: /usr/lib/x86_64-linux-gnu/libmbedcrypto.so
   install_script:
     - apt update
-    - apt install -y libgcc-6-dev build-essential pkg-config libcunit1-dev wget libsodium-dev libmbedtls-dev ca-certificates
+    - apt install -y libgcc-8-dev build-essential pkg-config libcunit1-dev wget libsodium-dev libmbedtls-dev ca-certificates
     - git clone https://github.com/intel/tinycbor/ ../tinycbor
     - bash -c "cd ../tinycbor && make -j"
     - git clone https://github.com/bergzand/nanocbor/ ../nanocbor
@@ -69,6 +69,11 @@ build_task:
         - apt install -y unzip
         - wget https://www.dlbeer.co.nz/downloads/c25519-2017-10-05.zip -O ../c25519.zip
         - bash -c 'cd .. && unzip c25519.zip' 
+    - name: tinydtls
+      env:
+        CRYPTO: tinydtls
+      crypto_script:
+        - git clone https://github.com/eclipse/tinydtls.git ../tinydtls -b develop
   test_script:
     - ls -al
     - pwd

Makefile

@@ -49,6 +49,9 @@ endif
 ifneq (,$(filter c25519,$(CRYPTO)))
 	include $(MK_DIR)/c25519.mk
 endif
+ifneq (,$(filter tinydtls,$(CRYPTO)))
+	include $(MK_DIR)/tinydtls.mk
+endif
 
 CFLAGS += $(CFLAGS_CRYPTO)
 

include/cose/crypto.h

@@ -44,6 +44,9 @@
 #if defined(CRYPTO_HACL)
 #include "cose/crypto/hacl.h"
 #endif
+#if defined(CRYPTO_TINYDTLS)
+#include "cose/crypto/tinydtls.h"
+#endif
 
 #ifdef __cplusplus
 extern "C" {
@@ -150,6 +153,9 @@ extern "C" {
 #define COSE_CRYPTO_AEAD_AES256GCM_NONCEBYTES   COSE_CRYPTO_AEAD_AESGCM_NONCEBYTES
 #define COSE_CRYPTO_AEAD_AES256GCM_ABYTES       COSE_CRYPTO_AEAD_AESGCM_ABYTES
 
+#define COSE_CRYPTO_AEAD_AESCCM_16_64_128_KEYBYTES     16
+#define COSE_CRYPTO_AEAD_AESCCM_16_64_128_ABYTES       8
+#define COSE_CRYPTO_AEAD_AESCCM_16_64_128_NONCEBYTES   13
 
 /** @} */
 
@@ -233,6 +239,26 @@ int cose_crypto_aead_decrypt_aesgcm(uint8_t *msg,
                                     const uint8_t *k,
                                     size_t keysize);
 
+int cose_crypto_aead_encrypt_aesccm(uint8_t *c,
+                                    size_t *clen,
+                                    const uint8_t *msg,
+                                    size_t msglen,
+                                    const uint8_t *aad,
+                                    size_t aadlen,
+                                    const uint8_t *npub,
+                                    const uint8_t *k,
+                                    size_t keysize);
+
+int cose_crypto_aead_decrypt_aesccm(uint8_t *msg,
+                                    size_t *msglen,
+                                    const uint8_t *c,
+                                    size_t clen,
+                                    const uint8_t *aad,
+                                    size_t aadlen,
+                                    const uint8_t *npub,
+                                    const uint8_t *k,
+                                    size_t keysize);
+
 /**
  * Generate a symmetric key for AEAD operations
  */
@@ -303,6 +329,63 @@ void cose_crypto_keypair_ecdsa(cose_key_t *key, cose_curve_t curve);
  * @return      Signature size
  */
 size_t cose_crypto_sig_size_ed25519(void);
+
+/** @} */
+
+/**
+ * @name HKDF related functions
+ *
+ * @{
+ */
+
+/** @brief Decide whether a given algorithm is known and an HKDF algorithm
+ *
+ * @param[in]  alg The algorithm to be checked
+ * @return     true iff @p alg can be used with @ref cose_crypto_hkdf_derive
+ */
+bool cose_crypto_is_hkdf(cose_algo_t alg);
+
+/** @brief Derive a key using HKDF (HMAC based key derivation function)
+ *
+ * @param[in] salt Salt for key generation. Can be empty
+ * @param[in] salt_len Length of @p salt
+ * @param[in] ikm key material
+ * @param[in] ikm_length Length of @p ikm
+ * @param[in] info Info for for derived key
+ * @param[in] info_length Length of @p info
+ * @param[out] out Output buffer where the key is written to
+ * @param[in] out_length Length of @p out
+ * @param[in] alg HKDF algorithm to use
+ */
+int cose_crypto_hkdf_derive(const uint8_t *salt,
+                            size_t salt_len,
+                            const uint8_t *ikm,
+                            size_t ikm_length,
+                            const uint8_t *info,
+                            size_t info_length,
+                            uint8_t *out,
+                            size_t out_length,
+                            cose_algo_t alg);
+
+/** @brief Derive a key using HMAC256
+ *
+ * @param[in] salt Salt for key generation. Can be empty
+ * @param[in] salt_len Length of @p salt
+ * @param[in] ikm key material
+ * @param[in] ikm_length Length of @p ikm
+ * @param[in] info Info for for derived key
+ * @param[in] info_length Length of @p info
+ * @param[out] out Output buffer where the key is written to
+ * @param[in] out_length Length of @p out
+ */
+int cose_crypto_hkdf_derive_sha256(const uint8_t *salt,
+                                   size_t salt_len,
+                                   const uint8_t *ikm,
+                                   size_t ikm_length,
+                                   const uint8_t *info,
+                                   size_t info_length,
+                                   uint8_t *out,
+                                   size_t out_length);
 /** @} */
 
 #ifdef __cplusplus

include/cose/crypto/selectors.h

@@ -48,6 +48,17 @@
 #define CRYPTO_HACL_INCLUDE_CHACHAPOLY
 #endif
 /** @} */
+
+/**
+ *
+ * @name HKDF SHA256 selector
+ */
+#ifdef CRYPTO_SODIUM
+#define CRYPTO_SODIUM_INCLUDE_HKDFSHA256
+#elif defined(CRYPTO_TINYDTLS)
+#define CRYPTO_TINYDTLS_INCLUDE_HKDFSHA256
+#endif
+
 #endif /* COSE_CRYPTO_SELECTORS_H */
 
 /** @} */

include/cose/crypto/sodium.h

@@ -34,6 +34,7 @@ extern "C" {
  */
 #define HAVE_ALGO_CHACHA20POLY1305
 #define HAVE_ALGO_EDDSA
+#define HAVE_ALGO_HMAC256
 /** @} */
 
 #ifdef __cplusplus

include/cose/crypto/tinydtls.h

@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2018 Freie Universitat Berlin
+ * Copyright (C) 2018 Inria
+ * Copyright (C) 2020 Christian Amsüss <christian@amsuess.com> and Ericsson AB
+ *
+ * This file is subject to the terms and conditions of the GNU Lesser
+ * General Public License v2.1. See the file LICENSE in the top level
+ * directory for more details.
+ */
+
+/**
+ * @defgroup    cose_cryto_tinydtls Crypto glue layer, tinydtls definitions
+ * @ingroup     cose_crypto
+ *
+ * Crypto function api for glueing tinydtls' AEAD functions.
+ * @{
+ *
+ * @file
+ * @brief       Crypto function api for glueing tinydtls.
+ *
+ * @author      Christian Amsüss <christian@amsuess.com>
+ */
+
+#ifndef COSE_CRYPTO_TINYDTLS_H
+#define COSE_CRYPTO_TINYDTLS_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @name list of provided algorithms
+ *
+ * @{
+ */
+#define HAVE_ALGO_AESCCM_16_64_128 /**< AES-CCM mode 128-bit key, 64-bit tag, 13-byte nonce */
+#define HAVE_ALGO_HMAC256
+
+/** @} */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
+
+/** @} */

include/cose_defines.h

@@ -160,6 +160,8 @@ typedef enum {
     COSE_ALGO_A128GCM = 1,              /**< AES-GCM mode w/ 128-bit key, 128-bit tag */
     COSE_ALGO_A192GCM = 2,              /**< AES-GCM mode w/ 192-bit key, 128-bit tag */
     COSE_ALGO_A256GCM = 3,              /**< AES-GCM mode w/ 256-bit key, 128-bit tag */
+    COSE_ALGO_HMAC256 = 5,              /**< HMAC w/ SHA-256 */
+    COSE_ALGO_AESCCM_16_64_128 = 10,    /**< AES-CCM mode 128-bit key, 64-bit tag, 13-byte nonce */
     COSE_ALGO_CHACHA20POLY1305 = 24,    /**< IETF ChaCha20/Poly1305 w/ 256-bit key, 128-bit tag */
 } cose_algo_t;
 

makefiles/tinydtls.mk

@@ -0,0 +1,14 @@
+TINYDTLS_DIR ?= ../tinydtls
+TINYDTLS_CONFIGDIR ?= makefiles/tinydtls_config/
+CFLAGS += -DCRYPTO_TINYDTLS
+CRYPTOSRC += $(SRC_DIR)/crypt/tinydtls.c
+CFLAGS_CRYPTO += -I$(TINYDTLS_DIR)
+CFLAGS_CRYPTO += -I$(TINYDTLS_CONFIGDIR)
+CRYPTOOBJS += $(TINYDTLS_DIR)/crypto.o
+CRYPTOOBJS += $(TINYDTLS_DIR)/aes/rijndael.o
+CRYPTOOBJS += $(TINYDTLS_DIR)/aes/rijndael_wrap.o
+CRYPTOOBJS += $(TINYDTLS_DIR)/hmac.o
+CRYPTOOBJS += $(TINYDTLS_DIR)/ccm.o
+CRYPTOOBJS += $(TINYDTLS_DIR)/sha2/sha2.o
+CRYPTOOBJS += $(TINYDTLS_DIR)/netq.o
+$(CRYPTOOBJS): CFLAGS += -Wno-gnu-zero-variadic-macro-arguments -Wno-unused-function

makefiles/tinydtls_config/dtls_config.h

@@ -0,0 +1,10 @@
+/* Not that we'd need *that* code, but if neither ECC nro PSK is defined,
+ * there's empty unions and such (and newer verisons of the library complain
+ * more explicitly) */
+#define DTLS_PSK
+
+/* Similarly, without a SHA algorithm, there's unused variables and such */
+#define WITH_SHA256
+
+/* Without, we get a #warning that is escalated to an #error by -Werror */
+#define HAVE_ASSERT_H

src/cose_crypto.c

@@ -49,6 +49,10 @@ bool cose_crypto_is_aead(cose_algo_t algo)
     switch(algo) {
         case COSE_ALGO_CHACHA20POLY1305:
             return true;
+#ifdef HAVE_ALGO_AESCCM_16_64_128
+        case COSE_ALGO_AESCCM_16_64_128:
+            return true;
+#endif
         default:
             return false;
     }
@@ -82,6 +86,10 @@ int cose_crypto_aead_encrypt(uint8_t *c,  /* NOLINT(readability-non-const-parame
 #ifdef HAVE_ALGO_AES128GCM
         case COSE_ALGO_A128GCM:
             return cose_crypto_aead_encrypt_aesgcm(c, clen, msg, msglen, aad, aadlen, npub, key, COSE_CRYPTO_AEAD_AES128GCM_KEYBYTES);
+#endif
+#ifdef HAVE_ALGO_AESCCM_16_64_128
+        case COSE_ALGO_AESCCM_16_64_128:
+            return cose_crypto_aead_encrypt_aesccm(c, clen, msg, msglen, aad, aadlen, npub, key, COSE_CRYPTO_AEAD_AESCCM_16_64_128_KEYBYTES);
 #endif
         default:
             (void)c;
@@ -124,6 +132,10 @@ int cose_crypto_aead_decrypt(uint8_t *msg, /* NOLINT(readability-non-const-param
 #ifdef HAVE_ALGO_AES128GCM
         case COSE_ALGO_A128GCM:
             return cose_crypto_aead_decrypt_aesgcm(msg, msglen, c, clen, aad, aadlen, npub, k, COSE_CRYPTO_AEAD_AES128GCM_KEYBYTES);
+#endif
+#ifdef HAVE_ALGO_AESCCM_16_64_128
+        case COSE_ALGO_AESCCM_16_64_128:
+            return cose_crypto_aead_decrypt_aesccm(msg, msglen, c, clen, aad, aadlen, npub, k, COSE_CRYPTO_AEAD_AESCCM_16_64_128_KEYBYTES);
 #endif
         default:
             (void)c;
@@ -169,6 +181,11 @@ int cose_crypto_sign(const cose_key_t *key, uint8_t *sign, size_t *signlen, uint
             break;
 #endif
         default:
+            (void)key;
+            (void)sign;
+            (void)signlen;
+            (void)msg;
+            (void)msglen;
             return COSE_ERR_NOTIMPLEMENTED;
     }
     return 0;
@@ -192,6 +209,11 @@ int cose_crypto_verify(const cose_key_t *key, const uint8_t *sign, size_t signle
             break;
 #endif
         default:
+            (void)key;
+            (void)sign;
+            (void)signlen;
+            (void)msg;
+            (void)msglen;
             return COSE_ERR_NOTIMPLEMENTED;
     }
     return 0;

src/cose_hkdf.c

@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2018 Freie Universitat Berlin
+ * Copyright (C) 2018 Inria
+ *
+ * This file is subject to the terms and conditions of the GNU Lesser
+ * General Public License v2.1. See the file LICENSE in the top level
+ * directory for more details.
+ */
+
+#include "cose/crypto.h"
+
+bool cose_crypto_is_hkdf(cose_algo_t alg)
+{
+    /* NOLINTNEXTLINE(hicpp-multiway-paths-covered) */
+    switch(alg) {
+#ifdef HAVE_ALGO_HMAC256
+        case COSE_ALGO_HMAC256:
+            return true;
+#endif
+        default:
+            (void)alg;
+            return false;
+    }
+}
+
+int cose_crypto_hkdf_derive(const uint8_t *salt,
+                                   size_t salt_len,
+                                   const uint8_t *ikm,
+                                   size_t ikm_length,
+                                   const uint8_t *info,
+                                   size_t info_length,
+                                   uint8_t *out,
+                                   size_t out_length, cose_algo_t alg) {
+    /* NOLINTNEXTLINE(hicpp-multiway-paths-covered) */
+    switch(alg) {
+#ifdef HAVE_ALGO_HMAC256
+        case COSE_ALGO_HMAC256:
+            return cose_crypto_hkdf_derive_sha256(salt, salt_len, ikm,
+                    ikm_length, info, info_length, out, out_length);
+#endif
+        default:
+            (void)salt;
+            (void)salt_len;
+            (void)ikm;
+            (void)ikm_length;
+            (void)info;
+            (void)info_length;
+            (void)out;
+            (void)out_length;
+            (void)alg;
+            return COSE_ERR_NOTIMPLEMENTED;
+    }
+}