libcoap 4.3.5-develop-490e4e0
Loading...
Searching...
No Matches
oscore.c
Go to the documentation of this file.
1/* -*- Mode: C; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
2
3/*
4 * Copyright (c) 2018, SICS, RISE AB
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the Institute nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 *
31 */
32
48
49#if COAP_OSCORE_SUPPORT
50
51/* oscore_cs_params
52 * returns cbor array [[param_type], [paramtype, param]]
53 */
54uint8_t *
55oscore_cs_params(int8_t param, int8_t param_type, size_t *len) {
56 uint8_t buf[50];
57 size_t rem_size = sizeof(buf);
58 uint8_t *pt = buf;
59
60 *len = 0;
61 *len += oscore_cbor_put_array(&pt, &rem_size, 2);
62 *len += oscore_cbor_put_array(&pt, &rem_size, 1);
63 *len += oscore_cbor_put_number(&pt, &rem_size, param_type);
64 *len += oscore_cbor_put_array(&pt, &rem_size, 2);
65 *len += oscore_cbor_put_number(&pt, &rem_size, param_type);
66 *len += oscore_cbor_put_number(&pt, &rem_size, param);
67 uint8_t *result = coap_malloc_type(COAP_STRING, *len);
68 memcpy(result, buf, *len);
69 return result;
70}
71
72/* oscore_cs_key_params
73 * returns cbor array [paramtype, param]
74 */
75uint8_t *
76oscore_cs_key_params(cose_curve_t param, int8_t param_type, size_t *len) {
77 uint8_t buf[50];
78 size_t rem_size = sizeof(buf);
79 uint8_t *pt = buf;
80
81 *len = 0;
82 *len += oscore_cbor_put_array(&pt, &rem_size, 2);
83 *len += oscore_cbor_put_number(&pt, &rem_size, param_type);
84 *len += oscore_cbor_put_number(&pt, &rem_size, param);
85 uint8_t *result = coap_malloc_type(COAP_STRING, *len);
86 memcpy(result, buf, *len);
87 return result;
88}
89
90/*
91 * Build the CBOR for external_aad
92 *
93 * external_aad = bstr .cbor aad_array
94 *
95 * No group mode
96 * aad_array = [
97 * oscore_version : uint,
98 * algorithms : [ alg_aead : int / tstr ],
99 * request_kid : bstr,
100 * request_piv : bstr,
101 * options : bstr,
102 * ]
103 *
104 * Group mode
105 * aad_array = [
106 * oscore_version : uint,
107 * algorithms : [alg_aead : int / tstr / null,
108 * alg_signature_enc : int / tstr / null,
109 * alg_signature : int / tstr / null,
110 * alg_pairwise_key_agreement : int / tstr / null],
111 * request_kid : bstr,
112 * request_piv : bstr,
113 * options : bstr,
114 * request_kid_context : bstr,
115 * OSCORE_option: bstr,
116 * sender_public_key: bstr, (initiator's key)
117 * gm_public_key: bstr / null
118 * ]
119 */
120size_t
122 cose_encrypt0_t *cose,
123 const uint8_t *oscore_option,
124 size_t oscore_option_len,
125 coap_bin_const_t *sender_public_key,
126 uint8_t *external_aad_ptr,
127 size_t external_aad_size) {
128 size_t external_aad_len = 0;
129 size_t rem_size = external_aad_size;
130
131 (void)oscore_option;
132 (void)oscore_option_len;
133 (void)sender_public_key;
134
135 if (ctx->mode != OSCORE_MODE_SINGLE)
136 external_aad_len += oscore_cbor_put_array(&external_aad_ptr, &rem_size, 9);
137 else
138 external_aad_len += oscore_cbor_put_array(&external_aad_ptr, &rem_size, 5);
139
140 /* oscore_version, always "1" */
141 external_aad_len += oscore_cbor_put_unsigned(&external_aad_ptr, &rem_size, 1);
142
143 if (ctx->mode == OSCORE_MODE_SINGLE) {
144 /* Algoritms array with one item*/
145 external_aad_len += oscore_cbor_put_array(&external_aad_ptr, &rem_size, 1);
146 /* Encryption Algorithm */
147 external_aad_len +=
148 oscore_cbor_put_number(&external_aad_ptr, &rem_size, ctx->aead_alg);
149 }
150 /* request_kid */
151 external_aad_len += oscore_cbor_put_bytes(&external_aad_ptr,
152 &rem_size,
153 cose->key_id.s,
154 cose->key_id.length);
155 /* request_piv */
156 external_aad_len += oscore_cbor_put_bytes(&external_aad_ptr,
157 &rem_size,
158 cose->partial_iv.s,
159 cose->partial_iv.length);
160 /* options */
161 /* Put integrity protected options, at present there are none. */
162 external_aad_len +=
163 oscore_cbor_put_bytes(&external_aad_ptr, &rem_size, NULL, 0);
164
165 return external_aad_len;
166}
167
168/*
169 * oscore_encode_option_value
170 */
171size_t
172oscore_encode_option_value(uint8_t *option_buffer,
173 size_t option_buf_len,
174 cose_encrypt0_t *cose,
175 uint8_t group_flag,
176 uint8_t appendix_b_2) {
177 size_t offset = 1;
178 size_t rem_space = option_buf_len;
179
180 (void)group_flag;
181 if (cose->partial_iv.length > 5) {
182 return 0;
183 }
184 option_buffer[0] = 0;
185
186 if (cose->partial_iv.length > 0 && cose->partial_iv.length <= 5 &&
187 cose->partial_iv.s != NULL) {
188 option_buffer[0] |= (0x07 & cose->partial_iv.length);
189 memcpy(&(option_buffer[offset]),
190 cose->partial_iv.s,
191 cose->partial_iv.length);
192 offset += cose->partial_iv.length;
193 assert(rem_space > cose->partial_iv.length);
194 rem_space -= cose->partial_iv.length;
195 }
196
197 if (cose->kid_context.length > 0 && cose->kid_context.s != NULL) {
198 if (appendix_b_2) {
199 /* Need to CBOR wrap kid_context - yuk! */
200 uint8_t *ptr = &option_buffer[offset+1];
201
202 option_buffer[0] |= 0x10;
203 option_buffer[offset] = (uint8_t)oscore_cbor_put_bytes(&ptr, &rem_space,
204 cose->kid_context.s,
205 cose->kid_context.length);
206 offset += option_buffer[offset] + 1;
207 } else {
208 option_buffer[0] |= 0x10;
209 option_buffer[offset] = (uint8_t)cose->kid_context.length;
210 offset++;
211 memcpy(&(option_buffer[offset]),
212 cose->kid_context.s,
213 (uint8_t)cose->kid_context.length);
214 offset += cose->kid_context.length;
215 assert(rem_space > cose->kid_context.length);
216 rem_space -= cose->kid_context.length;
217 }
218 }
219
220 if (cose->key_id.s != NULL) {
221 option_buffer[0] |= 0x08;
222 if (cose->key_id.length) {
223 memcpy(&(option_buffer[offset]), cose->key_id.s, cose->key_id.length);
224 offset += cose->key_id.length;
225 assert(rem_space > cose->key_id.length);
226 rem_space -= cose->key_id.length;
227 }
228 }
229
230 if (offset == 1 && option_buffer[0] == 0) {
231 /* If option_value is 0x00 it should be empty. */
232 offset = 0;
233 }
234 assert(offset <= option_buf_len);
235 cose->oscore_option.s = option_buffer;
236 cose->oscore_option.length = offset;
237 return offset;
238}
239
240/*
241 * oscore_decode_option_value
242 * error: return 0
243 * OK: return 1
244 *
245 * Basic assupmption is that all is preset to 0 or NULL on entry
246 */
247int
248oscore_decode_option_value(const uint8_t *opt_value,
249 size_t option_len,
250 cose_encrypt0_t *cose) {
251 uint8_t partial_iv_len = (opt_value[0] & 0x07);
252 size_t offset = 1;
253
254 cose->oscore_option.s = opt_value;
255 cose->oscore_option.length = option_len;
256
257 if (option_len == 0)
258 return 1; /* empty option */
259
260 if (option_len > 255 || partial_iv_len == 6 || partial_iv_len == 7 ||
261 (opt_value[0] & 0xC0) != 0) {
262 return 0;
263 }
264
265 if ((opt_value[0] & 0x20) != 0) {
266 return 0;
267 }
268
269 if (partial_iv_len != 0) {
270 coap_bin_const_t partial_iv;
271 if (offset + partial_iv_len > option_len) {
272 return 0;
273 }
274 partial_iv.s = &(opt_value[offset]);
275 partial_iv.length = partial_iv_len;
276 cose_encrypt0_set_partial_iv(cose, &partial_iv);
277 offset += partial_iv_len;
278 }
279
280 if ((opt_value[0] & 0x10) != 0) {
281 coap_bin_const_t kid_context;
282
283 if (offset >= option_len)
284 return 0;
285 kid_context.length = opt_value[offset];
286 offset++;
287 if (offset + kid_context.length > option_len) {
288 return 0;
289 }
290 kid_context.s = &(opt_value[offset]);
291 cose_encrypt0_set_kid_context(cose, &kid_context);
292 offset = offset + kid_context.length;
293 }
294
295 if ((opt_value[0] & 0x08) != 0) {
296 coap_bin_const_t key_id;
297
298 key_id.length = option_len - offset;
299 if ((int)key_id.length < 0) {
300 return 0;
301 }
302 key_id.s = &(opt_value[offset]);
303 cose_encrypt0_set_key_id(cose, &key_id);
304 }
305 return 1;
306}
307
308/*
309 * oscore_prepare_aad
310 *
311 * Creates and sets External AAD for encryption
312 */
313size_t
314oscore_prepare_aad(const uint8_t *external_aad_buffer,
315 size_t external_aad_len,
316 uint8_t *aad_buffer,
317 size_t aad_size) {
318 size_t ret = 0;
319 size_t rem_size = aad_size;
320 char encrypt0[] = "Encrypt0";
321
322 (void)aad_size; /* TODO */
323 /* Creating the AAD */
324 ret += oscore_cbor_put_array(&aad_buffer, &rem_size, 3);
325 /* 1. "Encrypt0" */
326 ret +=
327 oscore_cbor_put_text(&aad_buffer, &rem_size, encrypt0, strlen(encrypt0));
328 /* 2. Empty h'' entry */
329 ret += oscore_cbor_put_bytes(&aad_buffer, &rem_size, NULL, 0);
330 /* 3. External AAD */
331 ret += oscore_cbor_put_bytes(&aad_buffer,
332 &rem_size,
333 external_aad_buffer,
334 external_aad_len);
335
336 return ret;
337}
338
339/*
340 * oscore_generate_nonce
341 *
342 * Creates Nonce
343 */
344void
346 oscore_ctx_t *ctx,
347 uint8_t *buffer,
348 uint8_t size) {
349 memset(buffer, 0, size);
350 buffer[0] = (uint8_t)(ptr->key_id.length);
351 memcpy(&(buffer[((size - 5) - ptr->key_id.length)]),
352 ptr->key_id.s,
353 ptr->key_id.length);
354 memcpy(&(buffer[size - ptr->partial_iv.length]),
355 ptr->partial_iv.s,
356 ptr->partial_iv.length);
357 for (int i = 0; i < size; i++) {
358 buffer[i] = buffer[i] ^ (uint8_t)ctx->common_iv->s[i];
359 }
360}
361
362/*
363 * oscore_validate_sender_seq
364 *
365 * Return 1 if OK, 0 otherwise
366 */
367uint8_t
369 uint64_t incoming_seq =
371
372 if (incoming_seq >= OSCORE_SEQ_MAX) {
373 coap_log_warn("OSCORE Replay protection, SEQ larger than SEQ_MAX.\n");
374 return 0;
375 }
376
377 ctx->rollback_last_seq = ctx->last_seq;
379
380 /* Special case since we do not use unsigned int for seq */
381 if (ctx->initial_state == 1) {
382 ctx->initial_state = 0;
383 /* bitfield. B0 biggest seq seen. B1 seq-1 seen, B2 seq-2 seen etc. */
384 ctx->sliding_window = 1;
385 ctx->last_seq = incoming_seq;
386 } else if (incoming_seq > ctx->last_seq) {
387 /* Update the replay window */
388 uint64_t shift = incoming_seq - ctx->last_seq;
389 ctx->sliding_window = ctx->sliding_window << shift;
390 /* bitfield. B0 biggest seq seen. B1 seq-1 seen, B2 seq-2 seen etc. */
391 ctx->sliding_window |= 1;
392 ctx->last_seq = incoming_seq;
393 } else if (incoming_seq == ctx->last_seq) {
394 coap_log_warn("OSCORE: Replay protection, replayed SEQ (%" PRIu64 ")\n",
395 incoming_seq);
396 return 0;
397 } else { /* incoming_seq < last_seq */
398 uint64_t shift = ctx->last_seq - incoming_seq - 1;
399 uint64_t pattern;
400
401 if (shift > ctx->osc_ctx->replay_window_size || shift > 63) {
402 coap_log_warn("OSCORE: Replay protection, SEQ outside of replay window (%"
403 PRIu64 " %" PRIu64 ")\n",
404 ctx->last_seq,
405 incoming_seq);
406 return 0;
407 }
408 /* seq + replay_window_size > last_seq */
409 pattern = 1ULL << shift;
410 if (ctx->sliding_window & pattern) {
411 coap_log_warn("OSCORE: Replay protection, replayed SEQ (%" PRIu64 ")\n",
412 incoming_seq);
413 return 0;
414 }
415 /* bitfield. B0 biggest seq seen. B1 seq-1 seen, B2 seq-2 seen etc. */
416 ctx->sliding_window |= pattern;
417 }
418 coap_log_oscore("OSCORE: window 0x%" PRIx64 " seq-B0 %" PRIu64 " SEQ %"
419 PRIu64 "\n",
420 ctx->sliding_window,
421 ctx->last_seq,
422 incoming_seq);
423 return 1;
424}
425
426/*
427 * oscore_increment_sender_seq
428 *
429 * Return 0 if SEQ MAX, return 1 if OK
430 */
431uint8_t
433 ctx->sender_context->seq++;
434
435 if (ctx->sender_context->seq >= OSCORE_SEQ_MAX) {
436 return 0;
437 } else {
438 return 1;
439 }
440}
441
442/*
443 * oscore_roll_back_seq
444 *
445 * Restore the sequence number and replay-window to the previous state. This
446 * is to be used when decryption fail.
447 */
448void
450
451 if (ctx->rollback_sliding_window != 0) {
454 }
455 if (ctx->rollback_last_seq != 0) {
456 ctx->last_seq = ctx->rollback_last_seq;
457 ctx->rollback_last_seq = 0;
458 }
459}
460
461#else /* ! COAP_OSCORE_SUPPORT */
462
463#ifdef __clang__
464/* Make compilers happy that do not like empty modules. As this function is
465 * never used, we ignore -Wunused-function at the end of compiling this file
466 */
467#pragma GCC diagnostic ignored "-Wunused-function"
468#endif
469static inline void
470dummy(void) {
471}
472
473#endif /* ! COAP_OSCORE_SUPPORT */
#define PRIx64
#define PRIu64
Library specific build wrapper for coap_internal.h.
@ COAP_STRING
Definition coap_mem.h:34
void * coap_malloc_type(coap_memory_tag_t type, size_t size)
Allocates a chunk of size bytes and returns a pointer to the newly allocated memory.
uint64_t coap_decode_var_bytes8(const uint8_t *buf, size_t len)
Decodes multiple-length byte sequences.
Definition coap_encode.c:67
#define coap_log_oscore(...)
Definition coap_debug.h:132
#define coap_log_warn(...)
Definition coap_debug.h:108
size_t oscore_cbor_put_text(uint8_t **buffer, size_t *buf_size, const char *text, size_t text_len)
size_t oscore_cbor_put_number(uint8_t **buffer, size_t *buf_size, int64_t value)
size_t oscore_cbor_put_unsigned(uint8_t **buffer, size_t *buf_size, uint64_t value)
size_t oscore_cbor_put_bytes(uint8_t **buffer, size_t *buf_size, const uint8_t *bytes, size_t bytes_len)
size_t oscore_cbor_put_array(uint8_t **buffer, size_t *buf_size, size_t elements)
void cose_encrypt0_set_kid_context(cose_encrypt0_t *ptr, coap_bin_const_t *kid_context)
cose_curve_t
Definition oscore_cose.h:64
void cose_encrypt0_set_partial_iv(cose_encrypt0_t *ptr, coap_bin_const_t *partial_iv)
void cose_encrypt0_set_key_id(cose_encrypt0_t *ptr, coap_bin_const_t *key_id)
size_t oscore_prepare_aad(const uint8_t *external_aad_buffer, size_t external_aad_len, uint8_t *aad_buffer, size_t aad_size)
size_t oscore_encode_option_value(uint8_t *option_buffer, size_t option_buf_len, cose_encrypt0_t *cose, uint8_t group, uint8_t appendix_b_2)
uint8_t oscore_validate_sender_seq(oscore_recipient_ctx_t *ctx, cose_encrypt0_t *cose)
#define OSCORE_SEQ_MAX
int oscore_decode_option_value(const uint8_t *option_value, size_t option_len, cose_encrypt0_t *cose)
uint8_t oscore_increment_sender_seq(oscore_ctx_t *ctx)
void oscore_roll_back_seq(oscore_recipient_ctx_t *ctx)
size_t oscore_prepare_e_aad(oscore_ctx_t *ctx, cose_encrypt0_t *cose, const uint8_t *oscore_option, size_t oscore_option_len, coap_bin_const_t *sender_public_key, uint8_t *external_aad_ptr, size_t external_aad_size)
uint8_t * oscore_cs_key_params(cose_curve_t param, int8_t param_type, size_t *len)
void oscore_generate_nonce(cose_encrypt0_t *ptr, oscore_ctx_t *ctx, uint8_t *buffer, uint8_t size)
uint8_t * oscore_cs_params(int8_t param, int8_t param_type, size_t *len)
@ OSCORE_MODE_SINGLE
Vanilla RFC8613 support.
static void dummy(void)
Definition oscore.c:470
CoAP binary data definition with const data.
Definition coap_str.h:67
size_t length
length of binary data
Definition coap_str.h:68
const uint8_t * s
read-only binary data
Definition coap_str.h:69
coap_bin_const_t partial_iv
coap_bin_const_t kid_context
coap_bin_const_t key_id
coap_bin_const_t oscore_option
uint32_t replay_window_size
coap_bin_const_t * common_iv
Derived from Master Secret, Master Salt, and ID Context.
oscore_mode_t mode
oscore_sender_ctx_t * sender_context
cose_alg_t aead_alg