Skip to content

Commit 73da496

Browse files
hug-devhug-dev
authored
Merge pull request #193 from sbailey-arm/update-to-parsec-interface-0.17.0
Updated Parsec to use latest parsec-interface (0.17.0)
2 parents 5f96b21 + 9b7c3dd commit 73da496

File tree

10 files changed

+60
-39
lines changed

10 files changed

+60
-39
lines changed

‎Cargo.toml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ name = "parsec"
1818
path = "src/bin/main.rs"
1919

2020
[dependencies]
21-
parsec-interface = "0.16.0"
21+
parsec-interface = "0.17.0"
2222
rand = { version = "0.7.2", features = ["small_rng"] }
2323
base64 = "0.10.1"
2424
uuid = "0.7.4"
@@ -41,6 +41,7 @@ version = "3.0.0"
4141
hex = "0.4.2"
4242
picky = "5.0.0"
4343
psa-crypto = { version = "0.2.1" , default-features = false, features = ["with-mbed-crypto"], optional = true }
44+
zeroize = { version = "1.1.0", features = ["zeroize_derive"] }
4445

4546
[dev-dependencies]
4647
ring = "0.16.12"

‎src/authenticators/direct_authenticator/mod.rs‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,19 @@ use super::Authenticate;
1313
use log::error;
1414
use parsec_interface::requests::request::RequestAuth;
1515
use parsec_interface::requests::{ResponseStatus, Result};
16+
use parsec_interface::secrecy::ExposeSecret;
1617
use std::str;
1718

1819
#[derive(Copy, Clone, Debug)]
1920
pub struct DirectAuthenticator;
2021

2122
impl Authenticate for DirectAuthenticator {
2223
fn authenticate(&self, auth: &RequestAuth) -> Result<ApplicationName> {
23-
if auth.is_empty() {
24+
if auth.buffer.expose_secret().is_empty() {
2425
error!("The direct authenticator does not expect empty authentication values.");
2526
Err(ResponseStatus::AuthenticationError)
2627
} else {
27-
match str::from_utf8(auth.bytes()) {
28+
match str::from_utf8(auth.buffer.expose_secret()) {
2829
Ok(str) => Ok(ApplicationName(String::from(str))),
2930
Err(_) => {
3031
error!("Error parsing the authentication value as a UTF-8 string.");
@@ -47,7 +48,7 @@ mod test {
4748
let authenticator = DirectAuthenticator {};
4849

4950
let app_name = "app_name".to_string();
50-
let req_auth = RequestAuth::from_bytes(app_name.clone().into_bytes());
51+
let req_auth = RequestAuth::new(app_name.clone().into_bytes());
5152

5253
let auth_name = authenticator
5354
.authenticate(&req_auth)
@@ -60,7 +61,7 @@ mod test {
6061
fn failed_authentication() {
6162
let authenticator = DirectAuthenticator {};
6263
let status = authenticator
63-
.authenticate(&RequestAuth::from_bytes(vec![0xff; 5]))
64+
.authenticate(&RequestAuth::new(vec![0xff; 5]))
6465
.expect_err("Authentication should have failed");
6566

6667
assert_eq!(status, ResponseStatus::AuthenticationError);
@@ -70,7 +71,7 @@ mod test {
7071
fn empty_auth() {
7172
let authenticator = DirectAuthenticator {};
7273
let status = authenticator
73-
.authenticate(&RequestAuth::from_bytes(Vec::new()))
74+
.authenticate(&RequestAuth::new(Vec::new()))
7475
.expect_err("Empty auth should have failed");
7576

7677
assert_eq!(status, ResponseStatus::AuthenticationError);

‎src/providers/mbed_provider/asym_sign.rs‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,9 @@ impl MbedProvider {
3636
match asym_signature::sign_hash(id, alg, &hash, &mut signature) {
3737
Ok(size) => {
3838
signature.resize(size, 0);
39-
Ok(psa_sign_hash::Result { signature })
39+
Ok(psa_sign_hash::Result {
40+
signature: signature.into(),
41+
})
4042
}
4143
Err(error) => {
4244
let error = ResponseStatus::from(error);

‎src/providers/mbed_provider/key_management.rs‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ use parsec_interface::operations::{
1111
psa_destroy_key, psa_export_public_key, psa_generate_key, psa_import_key,
1212
};
1313
use parsec_interface::requests::{ProviderID, ResponseStatus, Result};
14+
use parsec_interface::secrecy::ExposeSecret;
1415
use psa_crypto::operations::key_management as psa_crypto_key_management;
1516
use psa_crypto::types::key;
1617
use std::sync::atomic::{AtomicU32, Ordering::Relaxed};
@@ -159,7 +160,11 @@ impl MbedProvider {
159160
.lock()
160161
.expect("Grabbing key handle mutex failed");
161162

162-
match psa_crypto_key_management::import(key_attributes, Some(key_id), &key_data[..]) {
163+
match psa_crypto_key_management::import(
164+
key_attributes,
165+
Some(key_id),
166+
key_data.expose_secret(),
167+
) {
163168
Ok(_) => Ok(psa_import_key::Result {}),
164169
Err(error) => {
165170
remove_key_id(&key_triple, &mut *store_handle)?;
@@ -194,7 +199,9 @@ impl MbedProvider {
194199
let export_length = psa_crypto_key_management::export_public(id, &mut buffer)?;
195200

196201
buffer.resize(export_length, 0);
197-
Ok(psa_export_public_key::Result { data: buffer })
202+
Ok(psa_export_public_key::Result {
203+
data: buffer.into(),
204+
})
198205
}
199206

200207
pub(super) fn psa_destroy_key_internal(

‎src/providers/pkcs11_provider/asym_sign.rs‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -84,15 +84,17 @@ impl Pkcs11Provider {
8484
info!("Signing operation initialized.");
8585
let digest_info = DigestInfo {
8686
oid: AlgorithmIdentifier::new_sha(SHAVariant::SHA2_256),
87-
digest: hash.into(),
87+
digest: hash.to_vec().into(),
8888
};
8989
let digest_info = picky_asn1_der::to_vec(&digest_info)
9090
// should not fail - if it does, there's some error in our stack
9191
.or(Err(ResponseStatus::PsaErrorGenericError))?;
9292

9393
trace!("Sign command");
9494
match self.backend.sign(session.session_handle(), &digest_info) {
95-
Ok(signature) => Ok(psa_sign_hash::Result { signature }),
95+
Ok(signature) => Ok(psa_sign_hash::Result {
96+
signature: signature.into(),
97+
}),
9698
Err(e) => {
9799
format_error!("Failed to execute signing operation", e);
98100
Err(utils::to_response_status(e))
@@ -175,7 +177,7 @@ impl Pkcs11Provider {
175177
info!("Verify operation initialized.");
176178
let digest_info = DigestInfo {
177179
oid: AlgorithmIdentifier::new_sha(SHAVariant::SHA2_256),
178-
digest: hash.into(),
180+
digest: hash.to_vec().into(),
179181
};
180182
let digest_info = picky_asn1_der::to_vec(&digest_info)
181183
// should not fail - if it does, there's some error in our stack

‎src/providers/pkcs11_provider/key_management.rs‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ use parsec_interface::operations::{
1313
psa_destroy_key, psa_export_public_key, psa_generate_key, psa_import_key,
1414
};
1515
use parsec_interface::requests::{ProviderID, ResponseStatus, Result};
16+
use parsec_interface::secrecy::ExposeSecret;
1617
use picky_asn1::wrapper::IntegerAsn1;
1718
use pkcs11::types::{CKR_OK, CK_ATTRIBUTE, CK_MECHANISM, CK_OBJECT_HANDLE, CK_SESSION_HANDLE};
1819
use std::mem;
@@ -276,16 +277,17 @@ impl Pkcs11Provider {
276277

277278
let mut template: Vec<CK_ATTRIBUTE> = Vec::new();
278279

279-
let public_key: RsaPublicKey = picky_asn1_der::from_bytes(&op.data).or_else(|e| {
280-
format_error!("Failed to parse RsaPublicKey data", e);
281-
remove_key_id(
282-
&key_triple,
283-
key_id,
284-
&mut *store_handle,
285-
&mut local_ids_handle,
286-
)?;
287-
Err(ResponseStatus::PsaErrorInvalidArgument)
288-
})?;
280+
let public_key: RsaPublicKey = picky_asn1_der::from_bytes(op.data.expose_secret())
281+
.or_else(|e| {
282+
format_error!("Failed to parse RsaPublicKey data", e);
283+
remove_key_id(
284+
&key_triple,
285+
key_id,
286+
&mut *store_handle,
287+
&mut local_ids_handle,
288+
)?;
289+
Err(ResponseStatus::PsaErrorInvalidArgument)
290+
})?;
289291

290292
if public_key.modulus.is_negative() || public_key.public_exponent.is_negative() {
291293
error!("Only positive modulus and public exponent are supported.");
@@ -473,7 +475,7 @@ impl Pkcs11Provider {
473475
format_error!("Could not serialise key elements", err);
474476
Err(ResponseStatus::PsaErrorCommunicationFailure)
475477
})?;
476-
Ok(psa_export_public_key::Result { data })
478+
Ok(psa_export_public_key::Result { data: data.into() })
477479
}
478480
}
479481
Err(e) => {

‎src/providers/tpm_provider/asym_sign.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ impl TpmProvider {
5757
})?;
5858

5959
Ok(psa_sign_hash::Result {
60-
signature: utils::signature_data_to_bytes(signature.signature, key_attributes)?,
60+
signature: utils::signature_data_to_bytes(signature.signature, key_attributes)?.into(),
6161
})
6262
}
6363

‎src/providers/tpm_provider/key_management.rs‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ use parsec_interface::operations::{
1313
psa_destroy_key, psa_export_public_key, psa_generate_key, psa_import_key,
1414
};
1515
use parsec_interface::requests::{ProviderID, ResponseStatus, Result};
16+
use parsec_interface::secrecy::ExposeSecret;
1617

1718
// Public exponent value for all RSA keys.
1819
const PUBLIC_EXPONENT: [u8; 3] = [0x01, 0x00, 0x01];
@@ -129,10 +130,11 @@ impl TpmProvider {
129130
.lock()
130131
.expect("ESAPI Context lock poisoned");
131132

132-
let public_key: RsaPublicKey = picky_asn1_der::from_bytes(&key_data).or_else(|err| {
133-
format_error!("Could not deserialise key elements", err);
134-
Err(ResponseStatus::PsaErrorInvalidArgument)
135-
})?;
133+
let public_key: RsaPublicKey = picky_asn1_der::from_bytes(key_data.expose_secret())
134+
.or_else(|err| {
135+
format_error!("Could not deserialise key elements", err);
136+
Err(ResponseStatus::PsaErrorInvalidArgument)
137+
})?;
136138

137139
if public_key.modulus.is_negative() || public_key.public_exponent.is_negative() {
138140
error!("Only positive modulus and public exponent are supported.");
@@ -222,7 +224,7 @@ impl TpmProvider {
222224
})?;
223225

224226
Ok(psa_export_public_key::Result {
225-
data: utils::pub_key_to_bytes(pub_key_data, key_attributes)?,
227+
data: utils::pub_key_to_bytes(pub_key_data, key_attributes)?.into(),
226228
})
227229
}
228230

‎src/providers/tpm_provider/utils.rs‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ use tss_esapi::abstraction::transient::KeyParams;
1313
use tss_esapi::response_code::{Error, Tss2ResponseCodeKind};
1414
use tss_esapi::utils::algorithm_specifiers::{EllipticCurve, HashingAlgorithm};
1515
use tss_esapi::utils::{AsymSchemeUnion, PublicKey, Signature, SignatureData, TpmsContext};
16+
use zeroize::Zeroizing;
1617
const PUBLIC_EXPONENT: [u8; 3] = [0x01, 0x00, 0x01];
1718

1819
/// Convert the TSS library specific error values to ResponseStatus values that are returned on
@@ -233,7 +234,7 @@ pub fn signature_data_to_bytes(data: SignatureData, key_attributes: Attributes)
233234
}
234235

235236
pub fn parsec_to_tpm_signature(
236-
data: Vec<u8>,
237+
data: Zeroizing<Vec<u8>>,
237238
key_attributes: Attributes,
238239
signature_alg: AsymmetricSignature,
239240
) -> Result<Signature> {
@@ -243,9 +244,12 @@ pub fn parsec_to_tpm_signature(
243244
})
244245
}
245246

246-
fn bytes_to_signature_data(data: Vec<u8>, key_attributes: Attributes) -> Result<SignatureData> {
247+
fn bytes_to_signature_data(
248+
data: Zeroizing<Vec<u8>>,
249+
key_attributes: Attributes,
250+
) -> Result<SignatureData> {
247251
match key_attributes.key_type {
248-
Type::RsaKeyPair | Type::RsaPublicKey => Ok(SignatureData::RsaSignature(data)),
252+
Type::RsaKeyPair | Type::RsaPublicKey => Ok(SignatureData::RsaSignature(data.to_vec())),
249253
Type::EccKeyPair { .. } | Type::EccPublicKey { .. } => {
250254
// ECDSA signature data is represented the concatenation of the two result values, r and s,
251255
// in big endian format, as described here:
@@ -255,7 +259,7 @@ fn bytes_to_signature_data(data: Vec<u8>, key_attributes: Attributes) -> Result<
255259
return Err(ResponseStatus::PsaErrorInvalidArgument);
256260
}
257261

258-
let mut r = data;
262+
let mut r = data.to_vec();
259263
let s = r.split_off(p_size);
260264
Ok(SignatureData::EcdsaSignature { r, s })
261265
}

‎tests/providers/tpm.rs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -116,15 +116,15 @@ fn verify_with_ring() {
116116
alg: AsymmetricSignature::RsaPkcs1v15Sign {
117117
hash_alg: Hash::Sha256.into(),
118118
},
119-
hash: HASH.clone(),
119+
hash: HASH.clone().into(),
120120
},
121121
)
122122
.unwrap();
123123

124124
let psa_export_public_key::Result { data } = TPM_PROVIDER
125125
.psa_export_public_key(app_name, psa_export_public_key::Operation { key_name })
126126
.unwrap();
127-
let pk = UnparsedPublicKey::new(&signature::RSA_PKCS1_2048_8192_SHA256, data);
127+
let pk = UnparsedPublicKey::new(&signature::RSA_PKCS1_2048_8192_SHA256, data.to_vec());
128128
pk.verify(&MESSAGE, &sign).unwrap();
129129
}
130130

@@ -144,15 +144,15 @@ fn verify_ecc_with_ring() {
144144
alg: AsymmetricSignature::Ecdsa {
145145
hash_alg: Hash::Sha256.into(),
146146
},
147-
hash: HASH.clone(),
147+
hash: HASH.clone().into(),
148148
},
149149
)
150150
.unwrap();
151151

152152
let psa_export_public_key::Result { data } = TPM_PROVIDER
153153
.psa_export_public_key(app_name, psa_export_public_key::Operation { key_name })
154154
.unwrap();
155-
let pk = UnparsedPublicKey::new(&signature::ECDSA_P256_SHA256_FIXED, data);
155+
let pk = UnparsedPublicKey::new(&signature::ECDSA_P256_SHA256_FIXED, data.to_vec());
156156
pk.verify(&MESSAGE, &sign).unwrap();
157157
}
158158

@@ -172,7 +172,7 @@ fn sign_verify_ecc() {
172172
alg: AsymmetricSignature::Ecdsa {
173173
hash_alg: Hash::Sha256.into(),
174174
},
175-
hash: HASH.clone(),
175+
hash: HASH.clone().into(),
176176
},
177177
)
178178
.unwrap();
@@ -185,7 +185,7 @@ fn sign_verify_ecc() {
185185
alg: AsymmetricSignature::Ecdsa {
186186
hash_alg: Hash::Sha256.into(),
187187
},
188-
hash: HASH.clone(),
188+
hash: HASH.clone().into(),
189189
signature: sign,
190190
},
191191
)

0 commit comments

Comments
 (0)