1 /*
2 * Copyright (c) 2017 Nordic Semiconductor ASA
3 * Copyright (c) 2015-2016 Intel Corporation
4 *
5 * SPDX-License-Identifier: Apache-2.0
6 */
7
8 #include <errno.h>
9 #include <stdint.h>
10 #include <string.h>
11
12 #include <zephyr/autoconf.h>
13 #include <zephyr/bluetooth/bluetooth.h>
14 #include <zephyr/bluetooth/conn.h>
15 #include <zephyr/bluetooth/crypto.h>
16 #include <zephyr/bluetooth/hci.h>
17 #include <zephyr/kernel.h>
18 #include <zephyr/logging/log.h>
19 #include <zephyr/sys/byteorder.h>
20 #include <zephyr/sys/check.h>
21 #include <psa/crypto.h>
22 #include <psa/crypto_struct.h>
23 #include <psa/crypto_types.h>
24 #include <psa/crypto_values.h>
25
26 #include "common/bt_str.h"
27 #include "hci_core.h"
28
29 #define LOG_LEVEL CONFIG_BT_HCI_CORE_LOG_LEVEL
30 LOG_MODULE_REGISTER(bt_host_crypto);
31
bt_crypto_init(void)32 int bt_crypto_init(void)
33 {
34 psa_status_t status = psa_crypto_init();
35
36 if (status != PSA_SUCCESS) {
37 LOG_ERR("psa_crypto_init() failed %d", status);
38 return -EIO;
39 }
40 return 0;
41 }
42
43 #if defined(CONFIG_BT_HOST_CRYPTO_PRNG)
bt_rand(void * buf,size_t len)44 int bt_rand(void *buf, size_t len)
45 {
46 psa_status_t status = psa_generate_random(buf, len);
47
48 if (status == PSA_SUCCESS) {
49 return 0;
50 }
51
52 LOG_ERR("psa_generate_random() failed %d", status);
53 return -EIO;
54 }
55 #else /* !CONFIG_BT_HOST_CRYPTO_PRNG */
bt_rand(void * buf,size_t len)56 int bt_rand(void *buf, size_t len)
57 {
58 CHECKIF(buf == NULL || len == 0) {
59 return -EINVAL;
60 }
61
62 return bt_hci_le_rand(buf, len);
63 }
64 #endif /* CONFIG_BT_HOST_CRYPTO_PRNG */
65
bt_encrypt_le(const uint8_t key[16],const uint8_t plaintext[16],uint8_t enc_data[16])66 int bt_encrypt_le(const uint8_t key[16], const uint8_t plaintext[16],
67 uint8_t enc_data[16])
68 {
69 psa_key_attributes_t attr = PSA_KEY_ATTRIBUTES_INIT;
70 psa_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
71 psa_status_t status, destroy_status;
72 size_t out_len;
73 uint8_t tmp[16];
74
75 CHECKIF(key == NULL || plaintext == NULL || enc_data == NULL) {
76 return -EINVAL;
77 }
78
79 LOG_DBG("key %s", bt_hex(key, 16));
80 LOG_DBG("plaintext %s", bt_hex(plaintext, 16));
81
82 sys_memcpy_swap(tmp, key, 16);
83
84 psa_set_key_type(&attr, PSA_KEY_TYPE_AES);
85 psa_set_key_bits(&attr, 128);
86 psa_set_key_usage_flags(&attr, PSA_KEY_USAGE_ENCRYPT);
87 psa_set_key_algorithm(&attr, PSA_ALG_ECB_NO_PADDING);
88 status = psa_import_key(&attr, tmp, 16, &key_id);
89 if (status != PSA_SUCCESS) {
90 LOG_ERR("Failed to import AES key %d", status);
91 return -EINVAL;
92 }
93
94 sys_memcpy_swap(tmp, plaintext, 16);
95
96 status = psa_cipher_encrypt(key_id, PSA_ALG_ECB_NO_PADDING, tmp, 16,
97 enc_data, 16, &out_len);
98 if (status != PSA_SUCCESS) {
99 LOG_ERR("AES encryption failed %d", status);
100 }
101
102 destroy_status = psa_destroy_key(key_id);
103 if (destroy_status != PSA_SUCCESS) {
104 LOG_ERR("Failed to destroy AES key %d", destroy_status);
105 }
106
107 if ((status != PSA_SUCCESS) || (destroy_status != PSA_SUCCESS)) {
108 return -EIO;
109 }
110
111 sys_mem_swap(enc_data, 16);
112
113 LOG_DBG("enc_data %s", bt_hex(enc_data, 16));
114
115 return 0;
116 }
117
bt_encrypt_be(const uint8_t key[16],const uint8_t plaintext[16],uint8_t enc_data[16])118 int bt_encrypt_be(const uint8_t key[16], const uint8_t plaintext[16],
119 uint8_t enc_data[16])
120 {
121 psa_key_attributes_t attr = PSA_KEY_ATTRIBUTES_INIT;
122 psa_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
123 psa_status_t status, destroy_status;
124 size_t out_len;
125
126 CHECKIF(key == NULL || plaintext == NULL || enc_data == NULL) {
127 return -EINVAL;
128 }
129
130 LOG_DBG("key %s", bt_hex(key, 16));
131 LOG_DBG("plaintext %s", bt_hex(plaintext, 16));
132
133 psa_set_key_type(&attr, PSA_KEY_TYPE_AES);
134 psa_set_key_bits(&attr, 128);
135 psa_set_key_usage_flags(&attr, PSA_KEY_USAGE_ENCRYPT);
136 psa_set_key_algorithm(&attr, PSA_ALG_ECB_NO_PADDING);
137 status = psa_import_key(&attr, key, 16, &key_id);
138 if (status != PSA_SUCCESS) {
139 LOG_ERR("Failed to import AES key %d", status);
140 return -EINVAL;
141 }
142
143 status = psa_cipher_encrypt(key_id, PSA_ALG_ECB_NO_PADDING,
144 plaintext, 16, enc_data, 16, &out_len);
145 if (status != PSA_SUCCESS) {
146 LOG_ERR("AES encryption failed %d", status);
147 }
148
149 destroy_status = psa_destroy_key(key_id);
150 if (destroy_status != PSA_SUCCESS) {
151 LOG_ERR("Failed to destroy AES key %d", destroy_status);
152 }
153
154 if ((status != PSA_SUCCESS) || (destroy_status != PSA_SUCCESS)) {
155 return -EIO;
156 }
157
158 LOG_DBG("enc_data %s", bt_hex(enc_data, 16));
159
160 return 0;
161 }
162