Skip to content

Commit 573efe9

Browse files
nasahlpaandreaskurth
nasahlpa
authored and
andreaskurth
committed
[pentest] Random mask for sym. CL implementation
Replace the static mask with a randomized mask when generating the masked keyblob. The Ibex RND register is used for this, which gets randomness from EDN. Signed-off-by: Pascal Nasahl <nasahlpa@lowrisc.org> (cherry-picked from commit 59bd7a9)
1 parent 9998873 commit 573efe9

File tree

5 files changed

+80
-30
lines changed

5 files changed

+80
-30
lines changed

‎sw/device/tests/penetrationtests/firmware/fi/cryptolib_fi_sym_impl.c

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,11 +101,16 @@ status_t cryptolib_fi_aes_impl(cryptolib_fi_sym_aes_in_t uj_input,
101101
// Create buffer to store key.
102102
uint32_t key_buf[kPentestAesMaxKeyWords];
103103
memset(key_buf, 0, AES_CMD_MAX_KEY_BYTES);
104-
memcpy(key_buf, uj_input.key, sizeof(uj_input.key));
104+
memcpy(key_buf, uj_input.key, uj_input.key_len);
105105
// Create keyblob.
106106
uint32_t keyblob[keyblob_num_words(config)];
107107
// Create blinded key.
108-
TRY(keyblob_from_key_and_mask(key_buf, kAesKeyMask, config, keyblob));
108+
uint32_t aes_key_mask[kPentestAesMaxKeyWords];
109+
memset(aes_key_mask, 0, AES_CMD_MAX_KEY_BYTES);
110+
for (size_t it = 0; it < kPentestAesMaxKeyWords; it++) {
111+
aes_key_mask[it] = pentest_ibex_rnd32_read();
112+
}
113+
TRY(keyblob_from_key_and_mask(key_buf, aes_key_mask, config, keyblob));
109114
otcrypto_blinded_key_t key = {
110115
.config = config,
111116
.keyblob_length = sizeof(keyblob),
@@ -210,8 +215,15 @@ status_t cryptolib_fi_gcm_impl(cryptolib_fi_sym_gcm_in_t uj_input,
210215
memset(key_buf, 0, AES_CMD_MAX_KEY_BYTES);
211216
memcpy(key_buf, uj_input.key, uj_input.key_len);
212217

218+
// Create random mask.
219+
uint32_t aes_key_mask[kPentestAesMaxKeyWords];
220+
memset(aes_key_mask, 0, AES_CMD_MAX_KEY_BYTES);
221+
for (size_t it = 0; it < kPentestAesMaxKeyWords; it++) {
222+
aes_key_mask[it] = pentest_ibex_rnd32_read();
223+
}
224+
213225
uint32_t keyblob[keyblob_num_words(config)];
214-
TRY(keyblob_from_key_and_mask(key_buf, kAesKeyMask, config, keyblob));
226+
TRY(keyblob_from_key_and_mask(key_buf, aes_key_mask, config, keyblob));
215227

216228
// Construct the blinded key.
217229
otcrypto_blinded_key_t key = {
@@ -327,12 +339,20 @@ status_t cryptolib_fi_hmac_impl(cryptolib_fi_sym_hmac_in_t uj_input,
327339
};
328340

329341
// Create buffer to store key.
330-
uint32_t key_buf[uj_input.key_len];
342+
343+
// Create buffer to store key.
344+
uint32_t key_buf[kPentestHmacMaxKeyWords];
345+
memset(key_buf, 0, HMAC_CMD_MAX_KEY_BYTES);
331346
memcpy(key_buf, uj_input.key, uj_input.key_len);
332347
// Create keyblob.
333348
uint32_t keyblob[keyblob_num_words(config)];
334349
// Create blinded key.
335-
TRY(keyblob_from_key_and_mask(key_buf, kHmacMask, config, keyblob));
350+
uint32_t hmac_key_mask[kPentestHmacMaxKeyWords];
351+
memset(hmac_key_mask, 0, HMAC_CMD_MAX_KEY_BYTES);
352+
for (size_t it = 0; it < kPentestHmacMaxKeyWords; it++) {
353+
hmac_key_mask[it] = pentest_ibex_rnd32_read();
354+
}
355+
TRY(keyblob_from_key_and_mask(key_buf, hmac_key_mask, config, keyblob));
336356
otcrypto_blinded_key_t key = {
337357
.config = config,
338358
.keyblob_length = sizeof(keyblob),

‎sw/device/tests/penetrationtests/firmware/lib/cryptolib_sym.h

Lines changed: 5 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,13 @@ enum {
2929
*/
3030
kPentestAesBlockWords = AES_CMD_MAX_BLOCK_BYTES / sizeof(uint32_t),
3131
/**
32-
* Number of words in a key.
32+
* Number of words in an AES key.
3333
*/
3434
kPentestAesMaxKeyWords = AES_CMD_MAX_KEY_BYTES / sizeof(uint32_t),
35+
/**
36+
* Number of words in a HMAC key.
37+
*/
38+
kPentestHmacMaxKeyWords = HMAC_CMD_MAX_KEY_BYTES / sizeof(uint32_t),
3539
/**
3640
* HMAC mode definitions.
3741
*/
@@ -50,21 +54,4 @@ enum {
5054
kPentestHmacMaxTagWords = HMAC_CMD_MAX_TAG_BYTES / sizeof(uint32_t),
5155
};
5256

53-
// Arbitrary mask for testing (borrowed from aes_functest.c).
54-
static const uint32_t kAesKeyMask[8] = {
55-
0x1b81540c, 0x220733c9, 0x8bf85383, 0x05ab50b4,
56-
0x8acdcb7e, 0x15e76440, 0x8459b2ce, 0xdc2110cc,
57-
};
58-
59-
static const uint32_t kHmacMask[48] = {
60-
0xBA81767F, 0xA913C751, 0x34209992, 0x5F66021B, 0x775F4577, 0x7C02E1CE,
61-
0xB4A8B698, 0x1986B902, 0x7251045B, 0x3C827C6F, 0x00909D12, 0x81ABC8F9,
62-
0x62F2FCB6, 0x15B63124, 0x66F60052, 0xAD637669, 0x522779CF, 0x07E9FBA8,
63-
0x1258E541, 0x860719EF, 0x1D4F5386, 0xA9B04F7C, 0x6E98A861, 0xEFADEBA6,
64-
0x900E1EC8, 0xB290DBCE, 0x05946814, 0xB83A01CE, 0x4EEC86BD, 0xAE836C6C,
65-
0x20182AAE, 0x4476F6F4, 0x7C4A0A31, 0x7D2809BA, 0x367B29B9, 0x42444BEA,
66-
0xDFD6025C, 0x1E665207, 0x18E0895B, 0x20D435DB, 0xC509A6D6, 0x8CC19AB1,
67-
0xA5D39BD2, 0xAB479AD5, 0x5786D029, 0x2E4B7CD7, 0xB77A3D76, 0xE2A09962,
68-
};
69-
7057
#endif // OPENTITAN_SW_DEVICE_TESTS_PENETRATIONTESTS_FIRMWARE_LIB_CRYPTOLIB_SYM_H_

‎sw/device/tests/penetrationtests/firmware/lib/pentest_lib.c

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,9 @@
4040
#include "clkmgr_regs.h" // Generated
4141
#include "csrng_regs.h" // Generated
4242
#include "hw/top_earlgrey/sw/autogen/top_earlgrey.h"
43-
#include "sensor_ctrl_regs.h" // Generated.
43+
#include "rv_core_ibex_regs.h" // Generated
44+
#include "sensor_ctrl_regs.h" // Generated.
45+
#include "sram_ctrl_regs.h" // Generated
4446

4547
#if !OT_IS_ENGLISH_BREAKFAST
4648
#include "sw/device/lib/crypto/drivers/otbn.h"
@@ -1229,3 +1231,19 @@ status_t pentest_send_sku_config(ujson_t *uj) {
12291231

12301232
return OK_STATUS();
12311233
}
1234+
1235+
static void wait_rnd_valid(void) {
1236+
while (true) {
1237+
uint32_t reg = abs_mmio_read32(TOP_EARLGREY_RV_CORE_IBEX_CFG_BASE_ADDR +
1238+
RV_CORE_IBEX_RND_STATUS_REG_OFFSET);
1239+
if (bitfield_bit32_read(reg, RV_CORE_IBEX_RND_STATUS_RND_DATA_VALID_BIT)) {
1240+
return;
1241+
}
1242+
}
1243+
}
1244+
1245+
uint32_t pentest_ibex_rnd32_read(void) {
1246+
wait_rnd_valid();
1247+
return abs_mmio_read32(TOP_EARLGREY_RV_CORE_IBEX_CFG_BASE_ADDR +
1248+
RV_CORE_IBEX_RND_DATA_REG_OFFSET);
1249+
}

‎sw/device/tests/penetrationtests/firmware/lib/pentest_lib.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -541,4 +541,12 @@ status_t pentest_read_rstmgr_alert_info(ujson_t *uj);
541541
*/
542542
status_t pentest_send_sku_config(ujson_t *uj);
543543

544+
/**
545+
* Read the Ibex RND register.
546+
*
547+
* Blocks until data is available in the Ibex RND register. Rnd data comes from
548+
* the EDN.
549+
*/
550+
uint32_t pentest_ibex_rnd32_read(void);
551+
544552
#endif // OPENTITAN_SW_DEVICE_TESTS_PENETRATIONTESTS_FIRMWARE_LIB_PENTEST_LIB_H_

‎sw/device/tests/penetrationtests/firmware/sca/cryptolib_sca_sym_impl.c

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,12 @@ status_t cryptolib_sca_aes_impl(uint8_t data_in[AES_CMD_MAX_MSG_BYTES],
111111
// Create keyblob.
112112
uint32_t keyblob[keyblob_num_words(config)];
113113
// Create blinded key.
114-
TRY(keyblob_from_key_and_mask(key_buf, kAesKeyMask, config, keyblob));
114+
uint32_t aes_key_mask[kPentestAesMaxKeyWords];
115+
memset(aes_key_mask, 0, AES_CMD_MAX_KEY_BYTES);
116+
for (size_t it = 0; it < kPentestAesMaxKeyWords; it++) {
117+
aes_key_mask[it] = pentest_ibex_rnd32_read();
118+
}
119+
TRY(keyblob_from_key_and_mask(key_buf, aes_key_mask, config, keyblob));
115120
otcrypto_blinded_key_t aes_key = {
116121
.config = config,
117122
.keyblob_length = sizeof(keyblob),
@@ -223,14 +228,21 @@ status_t cryptolib_sca_gcm_impl(
223228
.security_level = kOtcryptoKeySecurityLevelLow,
224229
};
225230

226-
// Construct blinded key from the key and testing mask.
231+
// Construct blinded key from the key and mask.
227232
uint32_t key_buf[kPentestAesMaxKeyWords];
228233
memset(key_buf, 0, AES_CMD_MAX_KEY_BYTES);
229234
memcpy(key_buf, key, key_len);
230235

236+
// Create random mask.
237+
uint32_t aes_key_mask[kPentestAesMaxKeyWords];
238+
memset(aes_key_mask, 0, AES_CMD_MAX_KEY_BYTES);
239+
for (size_t it = 0; it < kPentestAesMaxKeyWords; it++) {
240+
aes_key_mask[it] = pentest_ibex_rnd32_read();
241+
}
242+
231243
uint32_t keyblob[keyblob_num_words(config)];
232-
TRY(keyblob_from_key_and_mask(key_buf, kAesKeyMask, config, keyblob));
233-
LOG_INFO("GCM IMPl1");
244+
TRY(keyblob_from_key_and_mask(key_buf, aes_key_mask, config, keyblob));
245+
234246
// Construct the blinded key.
235247
otcrypto_blinded_key_t gcm_key = {
236248
.config = config,
@@ -241,7 +253,7 @@ status_t cryptolib_sca_gcm_impl(
241253

242254
// Set the checksum.
243255
gcm_key.checksum = integrity_blinded_checksum(&gcm_key);
244-
LOG_INFO("GCM IMPl1");
256+
245257
// Prepare the input buffers.
246258
size_t iv_num_words = 4;
247259
uint32_t iv_data[iv_num_words];
@@ -354,7 +366,12 @@ status_t cryptolib_sca_hmac_impl(uint8_t data_in[HMAC_CMD_MAX_MSG_BYTES],
354366
// Create keyblob.
355367
uint32_t keyblob[keyblob_num_words(config)];
356368
// Create blinded key.
357-
TRY(keyblob_from_key_and_mask(key_buf, kHmacMask, config, keyblob));
369+
uint32_t hmac_key_mask[kPentestHmacMaxKeyWords];
370+
memset(hmac_key_mask, 0, HMAC_CMD_MAX_KEY_BYTES);
371+
for (size_t it = 0; it < kPentestHmacMaxKeyWords; it++) {
372+
hmac_key_mask[it] = pentest_ibex_rnd32_read();
373+
}
374+
TRY(keyblob_from_key_and_mask(key_buf, hmac_key_mask, config, keyblob));
358375
otcrypto_blinded_key_t hmac_key = {
359376
.config = config,
360377
.keyblob_length = sizeof(keyblob),

0 commit comments

Comments
 (0)