cr50: drop cryptoc for SHA1/SHA2 supportstabilize-14150.882.B-cr50_stabstabilize-14150.881.B-cr50_stabstabilize-14150.74.B-cr50_stabstabilize-14150.734.B-cr50_stabstabilize-14150.64.B-cr50_stabstabilize-14150.43.B-cr50_stabstabilize-14150.376.B-cr50_stabrelease-R94-14150.B-cr50_stabrelease-R94-14150.49.B-cr50_stab

To implement FIPS module we need to bring many crypto functions in the
module boundary. Unfortunately, cryptoc is a third-party library used
by dcrypto code in cr50. Cryptoc is also not well-maintained and shared
with other projects. While just making local copy of cryptoc would
solve an issue, it's suboptimal as prevents from many optimizations and
improvements.

Provided SHA & HMAC implementations from Ti50 project. This provides
better performance (500us vs. 670us earlier for HMAC DRBG) and reduce
code size. This implementation also enables stack use savings when
only specific digest is needed. Earlier SHA512 context was allocated
when only SHA256 is needed greatly increasing stack consumption for
code using HMAC_DRBG and others.

However, it introduce subtle API changes which require handling.
As for tests, since core implementation is hardware-independent, make
it available for BOARD=host too.

Before change (with cryptoc):
*** 12368 bytes in flash and 5784 bytes in RAM

After:
*** 13136 bytes in flash and 5796 bytes in RAM

BUG=b:138578318
TEST=make BOARD=cr50 CRYPTO_TEST=1; test/tpm_test/tpmtest.py

Signed-off-by: Vadim Sukhomlinov <sukhomlinov@google.com>
Change-Id: I2ff5362aee9078ce83dc1f8081943a5101d5f666
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/3064201
Reviewed-by: Vadim Sukhomlinov <sukhomlinov@chromium.org>
Reviewed-by: Andrey Pronin <apronin@chromium.org>
Tested-by: Vadim Sukhomlinov <sukhomlinov@chromium.org>
Auto-Submit: Vadim Sukhomlinov <sukhomlinov@chromium.org>
Commit-Queue: Vadim Sukhomlinov <sukhomlinov@chromium.org>

1 files changed, 72 insertions, 0 deletions

diff --git a/board/cr50/dcrypto/hmac_sw.c b/board/cr50/dcrypto/hmac_sw.c
new file mode 100644
index 0000000000..91e056546d
--- /dev/null
+++ b/board/cr50/dcrypto/hmac_sw.c
@@ -0,0 +1,72 @@
+/* Copyright 2021 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+#include "dcrypto.h"
+#include "internal.h"
+
+#include <stdint.h>
+
+#include "cryptoc/util.h"
+
+/**
+ * Generic software HMAC support for any type of hash.
+ */
+
+/* Calculate location of storage for ipad/opad in generic way */
+static inline uint32_t *HMAC_opad(union hmac_ctx *const ctx)
+{
+	return (uint32_t *)((uint8_t *)ctx + ctx->f->context_size);
+}
+/**
+ * Initialize HMAC for pre-configured hash function.
+ * This is generic function which can initialize HMAC with any supported
+ * hash function.
+ */
+void HMAC_sw_init(union hmac_ctx *const ctx, const void *key, size_t len)
+{
+	uint32_t *const opad = HMAC_opad(ctx);
+	const size_t block_size = HASH_block_size(&ctx->hash);
+	size_t i;
+	/* inner padding with zeros */
+	memset(opad, 0, block_size);
+	/**
+	 * HMAC (K, m) = H( (K' ⊕ opad) || H ((K' ⊕ ipad) || m) )
+	 * K' = H(K) if K is longer than block size for H, or
+	 *    = K padded with zeroes otherwise
+	 */
+	if (len > block_size) {
+		/* ctx already contains proper vtable for hash functions */
+		/* But we need to reinit it after use. */
+		HASH_update(&ctx->hash, key, len);
+		memcpy(opad, HASH_final(&ctx->hash), HASH_size(&ctx->hash));
+		HASH_reinit(&ctx->hash);
+	} else {
+		memcpy(opad, key, len);
+	}
+	/* inner pad is K ⊕ 0x36, computed at word level */
+	for (i = 0; i < block_size / sizeof(opad[0]); ++i)
+		opad[i] ^= 0x36363636;
+
+	HASH_update(&ctx->hash, opad, block_size); /* hash ipad */
+	/* compute outer padding from the inner. */
+	for (i = 0; i < block_size / sizeof(opad[0]); ++i)
+		opad[i] ^= (0x36363636 ^ 0x5c5c5c5c);
+}
+
+const union sha_digests *HMAC_sw_final(union hmac_ctx *const ctx)
+{
+	uint32_t *const opad = HMAC_opad(ctx);
+	uint32_t *digest; /* storage for intermediate digest */
+	const size_t block_size = HASH_block_size(&ctx->hash);
+	const size_t hash_size = HASH_size(&ctx->hash);
+	/* allocate storage dynamically, just enough for particular hash. */
+	digest = alloca(hash_size);
+	memcpy(digest, HASH_final(&ctx->hash), hash_size);
+	HASH_reinit(&ctx->hash);
+	HASH_update(&ctx->hash, opad, block_size);
+	HASH_update(&ctx->hash, digest, hash_size);
+	memset(opad, 0, block_size); /* wipe key */
+	return HASH_final(&ctx->hash);
+}