1 /**
2 * @file hci_ecc.c
3 * HCI ECC emulation
4 */
5
6 /*
7 * Copyright (c) 2016 Intel Corporation
8 *
9 * SPDX-License-Identifier: Apache-2.0
10 */
11
12 #include <ble_os.h>
13 #include <atomic.h>
14 #include <misc/stack.h>
15 #include <misc/byteorder.h>
16
17 #include <tinycrypt/constants.h>
18 #include <tinycrypt/utils.h>
19 #include <tinycrypt/ecc.h>
20 #include <tinycrypt/ecc_dh.h>
21
22 #include <bluetooth/bluetooth.h>
23 #include <bluetooth/conn.h>
24 #include <bluetooth/hci.h>
25 #include <bluetooth/hci_driver.h>
26 #define BT_DBG_ENABLED IS_ENABLED(CONFIG_BT_DEBUG_HCI_CORE)
27 #define LOG_MODULE_NAME bt_hci_ecc
28 #include "common/log.h"
29
30 #include "hci_ecc.h"
31 #ifdef CONFIG_BT_HCI_RAW
32 #include <bluetooth/hci_raw.h>
33 #include "hci_raw_internal.h"
34 #else
35 #include "hci_core.h"
36 #endif
37
38 /*
39 NOTE: This is an advanced setting and should not be changed unless
40 absolutely necessary
41 */
42 #ifndef CONFIG_BT_HCI_ECC_STACK_SIZE
43 #define CONFIG_BT_HCI_ECC_STACK_SIZE 1100
44 #endif
45
46 static struct k_thread ecc_thread_data;
47 static BT_STACK_NOINIT(ecc_thread_stack, 1100);
48
49 /* based on Core Specification 4.2 Vol 3. Part H 2.3.5.6.1 */
50 static const bt_u32_t debug_private_key[8] = {
51 0xcd3c1abd, 0x5899b8a6, 0xeb40b799, 0x4aff607b, 0xd2103f50, 0x74c9b3e3,
52 0xa3c55f38, 0x3f49f6d4
53 };
54
55 #if defined(CONFIG_BT_USE_DEBUG_KEYS)
56 static const u8_t debug_public_key[64] = {
57 0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc, 0xdb, 0xfd, 0xf4, 0xac,
58 0x11, 0x91, 0xf4, 0xef, 0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
59 0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20, 0x8b, 0xd2, 0x89, 0x15,
60 0xd0, 0x8e, 0x1c, 0x74, 0x24, 0x30, 0xed, 0x8f, 0xc2, 0x45, 0x63, 0x76,
61 0x5c, 0x15, 0x52, 0x5a, 0xbf, 0x9a, 0x32, 0x63, 0x6d, 0xeb, 0x2a, 0x65,
62 0x49, 0x9c, 0x80, 0xdc
63 };
64 #endif
65
66 enum {
67 PENDING_PUB_KEY,
68 PENDING_DHKEY,
69
70 /* Total number of flags - must be at the end of the enum */
71 NUM_FLAGS,
72 };
73
74 static ATOMIC_DEFINE(flags, NUM_FLAGS);
75
76 //static K_SEM_DEFINE(cmd_sem, 0, 1);
77 static struct k_sem cmd_sem;
78
79 static struct {
80 u8_t private_key[32];
81
82 union {
83 u8_t pk[64];
84 u8_t dhkey[32];
85 };
86 } ecc;
87
send_cmd_status(u16_t opcode,u8_t status)88 static void send_cmd_status(u16_t opcode, u8_t status)
89 {
90 struct bt_hci_evt_cmd_status *evt;
91 struct bt_hci_evt_hdr *hdr;
92 struct net_buf *buf;
93
94 BT_DBG("opcode %x status %x", opcode, status);
95
96 buf = bt_buf_get_evt(BT_HCI_EVT_CMD_STATUS, false, K_FOREVER);
97 bt_buf_set_type(buf, BT_BUF_EVT);
98
99 hdr = net_buf_add(buf, sizeof(*hdr));
100 hdr->evt = BT_HCI_EVT_CMD_STATUS;
101 hdr->len = sizeof(*evt);
102
103 evt = net_buf_add(buf, sizeof(*evt));
104 evt->ncmd = 1U;
105 evt->opcode = sys_cpu_to_le16(opcode);
106 evt->status = status;
107
108 bt_recv_prio(buf);
109 }
110
generate_keys(void)111 static u8_t generate_keys(void)
112 {
113 #if !defined(CONFIG_BT_USE_DEBUG_KEYS)
114 do {
115 int rc;
116
117 rc = uECC_make_key(ecc.pk, ecc.private_key, &curve_secp256r1);
118 if (rc == TC_CRYPTO_FAIL) {
119 BT_ERR("Failed to create ECC public/private pair");
120 return BT_HCI_ERR_UNSPECIFIED;
121 }
122
123 /* make sure generated key isn't debug key */
124 } while (memcmp(ecc.private_key, debug_private_key, 32) == 0);
125 #else
126 sys_memcpy_swap(&ecc.pk, debug_public_key, 32);
127 sys_memcpy_swap(&ecc.pk[32], &debug_public_key[32], 32);
128 sys_memcpy_swap(ecc.private_key, debug_private_key, 32);
129 #endif
130 return 0;
131 }
132
emulate_le_p256_public_key_cmd(void)133 static void emulate_le_p256_public_key_cmd(void)
134 {
135 struct bt_hci_evt_le_p256_public_key_complete *evt;
136 struct bt_hci_evt_le_meta_event *meta;
137 struct bt_hci_evt_hdr *hdr;
138 struct net_buf *buf;
139 u8_t status;
140
141 BT_DBG("");
142
143 status = generate_keys();
144
145 buf = bt_buf_get_rx(BT_BUF_EVT, K_FOREVER);
146
147 hdr = net_buf_add(buf, sizeof(*hdr));
148 hdr->evt = BT_HCI_EVT_LE_META_EVENT;
149 hdr->len = sizeof(*meta) + sizeof(*evt);
150
151 meta = net_buf_add(buf, sizeof(*meta));
152 meta->subevent = BT_HCI_EVT_LE_P256_PUBLIC_KEY_COMPLETE;
153
154 evt = net_buf_add(buf, sizeof(*evt));
155 evt->status = status;
156
157 if (status) {
158 (void)memset(evt->key, 0, sizeof(evt->key));
159 } else {
160 /* Convert X and Y coordinates from big-endian (provided
161 * by crypto API) to little endian HCI.
162 */
163 sys_memcpy_swap(evt->key, ecc.pk, 32);
164 sys_memcpy_swap(&evt->key[32], &ecc.pk[32], 32);
165 }
166
167 atomic_clear_bit(flags, PENDING_PUB_KEY);
168
169 bt_recv(buf);
170 }
171
emulate_le_generate_dhkey(void)172 static void emulate_le_generate_dhkey(void)
173 {
174 struct bt_hci_evt_le_generate_dhkey_complete *evt;
175 struct bt_hci_evt_le_meta_event *meta;
176 struct bt_hci_evt_hdr *hdr;
177 struct net_buf *buf;
178 int ret;
179
180 ret = uECC_valid_public_key(ecc.pk, &curve_secp256r1);
181 if (ret < 0) {
182 BT_ERR("public key is not valid (ret %d)", ret);
183 ret = TC_CRYPTO_FAIL;
184 } else {
185 ret = uECC_shared_secret(ecc.pk, ecc.private_key, ecc.dhkey,
186 &curve_secp256r1);
187 }
188 if (ret == TC_CRYPTO_SUCCESS)
189 {
190 ret = 0;
191 }
192 else
193 {
194 ret = -1;
195 }
196 buf = bt_buf_get_rx(BT_BUF_EVT, K_FOREVER);
197
198 hdr = net_buf_add(buf, sizeof(*hdr));
199 hdr->evt = BT_HCI_EVT_LE_META_EVENT;
200 hdr->len = sizeof(*meta) + sizeof(*evt);
201
202 meta = net_buf_add(buf, sizeof(*meta));
203 meta->subevent = BT_HCI_EVT_LE_GENERATE_DHKEY_COMPLETE;
204
205 evt = net_buf_add(buf, sizeof(*evt));
206
207 if (ret) {
208 evt->status = BT_HCI_ERR_UNSPECIFIED;
209 (void)memset(evt->dhkey, 0, sizeof(evt->dhkey));
210 } else {
211 evt->status = 0U;
212 /* Convert from big-endian (provided by crypto API) to
213 * little-endian HCI.
214 */
215 sys_memcpy_swap(evt->dhkey, ecc.dhkey, sizeof(ecc.dhkey));
216 }
217
218 atomic_clear_bit(flags, PENDING_DHKEY);
219
220 bt_recv(buf);
221 }
222
ecc_thread(void * arg)223 static void ecc_thread(void *arg)
224 {
225 while (true) {
226 k_sem_take(&cmd_sem, K_FOREVER);
227
228 if (atomic_test_bit(flags, PENDING_PUB_KEY)) {
229 emulate_le_p256_public_key_cmd();
230 } else if (atomic_test_bit(flags, PENDING_DHKEY)) {
231 emulate_le_generate_dhkey();
232 } else {
233 __ASSERT(0, "Unhandled ECC command");
234 }
235 }
236 }
237
clear_ecc_events(struct net_buf * buf)238 static void clear_ecc_events(struct net_buf *buf)
239 {
240 struct bt_hci_cp_le_set_event_mask *cmd;
241
242 cmd = (void *)(buf->data + sizeof(struct bt_hci_cmd_hdr));
243
244 /*
245 * don't enable controller ECC events as those will be generated from
246 * emulation code
247 */
248 cmd->events[0] &= ~0x80; /* LE Read Local P-256 PKey Compl */
249 cmd->events[1] &= ~0x01; /* LE Generate DHKey Compl Event */
250 }
251
le_gen_dhkey(struct net_buf * buf)252 static void le_gen_dhkey(struct net_buf *buf)
253 {
254 struct bt_hci_cp_le_generate_dhkey *cmd;
255 u8_t status;
256
257 if (atomic_test_bit(flags, PENDING_PUB_KEY)) {
258 status = BT_HCI_ERR_CMD_DISALLOWED;
259 goto send_status;
260 }
261
262 if (buf->len < sizeof(struct bt_hci_cp_le_generate_dhkey)) {
263 status = BT_HCI_ERR_INVALID_PARAM;
264 goto send_status;
265 }
266
267 if (atomic_test_and_set_bit(flags, PENDING_DHKEY)) {
268 status = BT_HCI_ERR_CMD_DISALLOWED;
269 goto send_status;
270 }
271
272 cmd = (void *)buf->data;
273 /* Convert X and Y coordinates from little-endian HCI to
274 * big-endian (expected by the crypto API).
275 */
276 sys_memcpy_swap(ecc.pk, cmd->key, 32);
277 sys_memcpy_swap(&ecc.pk[32], &cmd->key[32], 32);
278 k_sem_give(&cmd_sem);
279 status = BT_HCI_ERR_SUCCESS;
280
281 send_status:
282 net_buf_unref(buf);
283 send_cmd_status(BT_HCI_OP_LE_GENERATE_DHKEY, status);
284 }
285
le_p256_pub_key(struct net_buf * buf)286 static void le_p256_pub_key(struct net_buf *buf)
287 {
288 u8_t status;
289
290 net_buf_unref(buf);
291
292 if (atomic_test_bit(flags, PENDING_DHKEY)) {
293 status = BT_HCI_ERR_CMD_DISALLOWED;
294 } else if (atomic_test_and_set_bit(flags, PENDING_PUB_KEY)) {
295 status = BT_HCI_ERR_CMD_DISALLOWED;
296 } else {
297 k_sem_give(&cmd_sem);
298 status = BT_HCI_ERR_SUCCESS;
299 }
300
301 send_cmd_status(BT_HCI_OP_LE_P256_PUBLIC_KEY, status);
302 }
303
bt_hci_ecc_send(struct net_buf * buf)304 int bt_hci_ecc_send(struct net_buf *buf)
305 {
306 if (bt_buf_get_type(buf) == BT_BUF_CMD) {
307 struct bt_hci_cmd_hdr *chdr = (void *)buf->data;
308
309 switch (sys_le16_to_cpu(chdr->opcode)) {
310 case BT_HCI_OP_LE_P256_PUBLIC_KEY:
311 net_buf_pull(buf, sizeof(*chdr));
312 le_p256_pub_key(buf);
313 return 0;
314 case BT_HCI_OP_LE_GENERATE_DHKEY:
315 net_buf_pull(buf, sizeof(*chdr));
316 le_gen_dhkey(buf);
317 return 0;
318 case BT_HCI_OP_LE_SET_EVENT_MASK:
319 clear_ecc_events(buf);
320 break;
321 default:
322 break;
323 }
324 }
325
326 return bt_dev.drv->send(buf);
327 }
328
default_CSPRNG(u8_t * dst,unsigned int len)329 int default_CSPRNG(u8_t *dst, unsigned int len)
330 {
331 return !bt_rand(dst, len);
332 }
333
bt_hci_ecc_init(void)334 void bt_hci_ecc_init(void)
335 {
336 k_sem_init(&cmd_sem, 0, 1);
337
338 k_thread_spawn(&ecc_thread_data, "ecc task", ecc_thread_stack,
339 K_THREAD_STACK_SIZEOF(ecc_thread_stack),
340 ecc_thread, NULL, 30);
341 }
342