MA-15142 Support secure attestation provision

In host end, need encrypt the attestation keys and certs
by manufacture protection public key though  AES-128-ECB.
Then use below 4 set of commands to provision encrypted
RSA attestation and EC attestation:
  * $fastboot stage atte_rsa_key.bin
  * $fastboot oem set-rsa-atte-key-enc
  * $fastboot stage atte_rsa_cert.bin
  * $fastboot oem append-rsa-atte-cert-enc
  * $fastboot stage atte_ec_key.bin
  * $fastboot oem set-ec-atte-key-enc
  * $fastboot stage atte_ec_cert.bin
  * $fastboot oem append-ec-atte-cert-enc

Change-Id: I8a7c64004a17f7dde89f28c3123a2e2b1a6d3346
Signed-off-by: Haoran.Wang <elven.wang@nxp.com>

diff --git a/drivers/fastboot/fb_fsl/fb_fsl_command.c b/drivers/fastboot/fb_fsl/fb_fsl_command.c
index 4778edf..bacfc9c 100755 (executable)
--- a/drivers/fastboot/fb_fsl/fb_fsl_command.c
+++ b/drivers/fastboot/fb_fsl/fb_fsl_command.c
@@ -502,6 +502,46 @@ static void flashing(char *cmd, char *response)
                        strcpy(response, "FAILInternal error!");
                } else
                        strcpy(response, "OKAY");
+       } else if (endswith(cmd, FASTBOOT_SET_RSA_ATTESTATION_KEY_ENC)) {
+               if (trusty_set_attestation_key_enc(fastboot_buf_addr,
+                                                       fastboot_bytes_received,
+                                                       KM_ALGORITHM_RSA)) {
+                       printf("ERROR set rsa attestation key failed!\n");
+                       strcpy(response, "FAILInternal error!");
+               } else {
+                       printf("Set rsa attestation key successfully!\n");
+                       strcpy(response, "OKAY");
+               }
+       } else if (endswith(cmd, FASTBOOT_SET_EC_ATTESTATION_KEY_ENC)) {
+               if (trusty_set_attestation_key_enc(fastboot_buf_addr,
+                                                       fastboot_bytes_received,
+                                                       KM_ALGORITHM_EC)) {
+                       printf("ERROR set ec attestation key failed!\n");
+                       strcpy(response, "FAILInternal error!");
+               } else {
+                       printf("Set ec attestation key successfully!\n");
+                       strcpy(response, "OKAY");
+               }
+       } else if (endswith(cmd, FASTBOOT_APPEND_RSA_ATTESTATION_CERT_ENC)) {
+               if (trusty_append_attestation_cert_chain_enc(fastboot_buf_addr,
+                                                               fastboot_bytes_received,
+                                                               KM_ALGORITHM_RSA)) {
+                       printf("ERROR append rsa attestation cert chain failed!\n");
+                       strcpy(response, "FAILInternal error!");
+               } else {
+                       printf("Append rsa attestation key successfully!\n");
+                       strcpy(response, "OKAY");
+               }
+       }  else if (endswith(cmd, FASTBOOT_APPEND_EC_ATTESTATION_CERT_ENC)) {
+               if (trusty_append_attestation_cert_chain_enc(fastboot_buf_addr,
+                                                               fastboot_bytes_received,
+                                                               KM_ALGORITHM_EC)) {
+                       printf("ERROR append ec attestation cert chain failed!\n");
+                       strcpy(response, "FAILInternal error!");
+               } else {
+                       printf("Append ec attestation key successfully!\n");
+                       strcpy(response, "OKAY");
+               }
        } else if (endswith(cmd, FASTBOOT_SET_RSA_ATTESTATION_KEY)) {
                if (trusty_set_attestation_key(fastboot_buf_addr,
                                                fastboot_bytes_received,

diff --git a/include/fb_fsl.h b/include/fb_fsl.h
index 91107ab..4f173ce 100644 (file)
--- a/include/fb_fsl.h
+++ b/include/fb_fsl.h
@@ -95,6 +95,10 @@
 #define FASTBOOT_SET_EC_ATTESTATION_KEY  "set-ec-atte-key"
 #define FASTBOOT_APPEND_RSA_ATTESTATION_CERT  "append-rsa-atte-cert"
 #define FASTBOOT_APPEND_EC_ATTESTATION_CERT  "append-ec-atte-cert"
+#define FASTBOOT_SET_RSA_ATTESTATION_KEY_ENC  "set-rsa-atte-key-enc"
+#define FASTBOOT_SET_EC_ATTESTATION_KEY_ENC  "set-ec-atte-key-enc"
+#define FASTBOOT_APPEND_RSA_ATTESTATION_CERT_ENC  "append-rsa-atte-cert-enc"
+#define FASTBOOT_APPEND_EC_ATTESTATION_CERT_ENC  "append-ec-atte-cert-enc"
 #define FASTBOOT_GET_MPPUBK  "get-mppubk"
 #endif
 

diff --git a/include/interface/keymaster/keymaster.h b/include/interface/keymaster/keymaster.h
index ff55834..1b1fc63 100644 (file)
--- a/include/interface/keymaster/keymaster.h
+++ b/include/interface/keymaster/keymaster.h
@@ -63,6 +63,8 @@ enum keymaster_command {
     KM_ATAP_SET_CA_RESPONSE_FINISH     = (0x7000 << KEYMASTER_REQ_SHIFT),
     KM_ATAP_READ_UUID                  = (0x8000 << KEYMASTER_REQ_SHIFT),
     KM_SET_PRODUCT_ID                  = (0x9000 << KEYMASTER_REQ_SHIFT),
+    KM_SET_ATTESTATION_KEY_ENC         = (0xa000 << KEYMASTER_REQ_SHIFT),
+    KM_APPEND_ATTESTATION_CERT_CHAIN_ENC = (0xb000 << KEYMASTER_REQ_SHIFT),
     KM_GET_MPPUBK                      = (0xc000 << KEYMASTER_REQ_SHIFT)
 };
 

diff --git a/lib/trusty/ql-tipc/keymaster.c b/lib/trusty/ql-tipc/keymaster.c
index 0826002..01828e0 100644 (file)
--- a/lib/trusty/ql-tipc/keymaster.c
+++ b/lib/trusty/ql-tipc/keymaster.c
@@ -410,6 +410,21 @@ int trusty_append_attestation_cert_chain(const uint8_t *cert,
                                         cert, cert_size, algorithm);
 }
 
+int trusty_set_attestation_key_enc(const uint8_t *key, uint32_t key_size,
+                               keymaster_algorithm_t algorithm)
+{
+    return trusty_send_attestation_data(KM_SET_ATTESTATION_KEY_ENC, key, key_size,
+                                        algorithm);
+}
+
+int trusty_append_attestation_cert_chain_enc(const uint8_t *cert,
+                                         uint32_t cert_size,
+                                         keymaster_algorithm_t algorithm)
+{
+    return trusty_send_attestation_data(KM_APPEND_ATTESTATION_CERT_CHAIN_ENC,
+                                        cert, cert_size, algorithm);
+}
+
 int trusty_atap_get_ca_request(const uint8_t *operation_start,
                                uint32_t operation_start_size,
                                uint8_t **ca_request_p,