Exchange CDI for CDI handle via DPE::Crypto trait

crypto/src/lib.rs

@@ -25,6 +25,8 @@ pub use rand::*;
 mod hkdf;
 mod signer;
 
+pub const MAX_EXPORTED_CDI_SIZE: usize = 32;
+
 #[derive(Debug, Clone, Copy)]
 #[cfg_attr(test, derive(strum_macros::EnumIter))]
 pub enum AlgLen {
@@ -54,6 +56,7 @@ pub enum CryptoError {
     Size = 0x3,
     NotImplemented = 0x4,
     HashError(u32) = 0x5,
+    ExportedCdiHandleLimitExceeded = 0x6,
 }
 
 impl CryptoError {
@@ -66,11 +69,12 @@ impl CryptoError {
 
     pub fn get_error_detail(&self) -> Option<u32> {
         match self {
-            CryptoError::AbstractionLayer(code) => Some(*code),
-            CryptoError::CryptoLibError(code) => Some(*code),
-            CryptoError::Size => None,
-            CryptoError::NotImplemented => None,
-            CryptoError::HashError(code) => Some(*code),
+            CryptoError::AbstractionLayer(code) | 
+                CryptoError::CryptoLibError(code) | 
+                CryptoError::HashError(code) => Some(*code),
+            CryptoError::Size | 
+                CryptoError::ExportedCdiHandleLimitExceeded | 
+                CryptoError::NotImplemented => None,
         }
     }
 }
@@ -208,6 +212,13 @@ pub trait Crypto {
         info: &[u8],
     ) -> Result<Self::Cdi, CryptoError>;
 
+    /// Retrieve an exported CDI Handle from a CDI.
+    ///
+    /// # Arguments
+    ///
+    /// * `cdi` - The CDI to request a handle for.
+    fn get_exported_cdi_handle(&mut self, cdi: &Self::Cdi) -> Result<[u8; MAX_EXPORTED_CDI_SIZE], CryptoError>;
+
     /// Derives a key pair using a cryptographically secure KDF
     ///
     /// # Arguments

crypto/src/openssl.rs

@@ -1,6 +1,6 @@
 // Licensed under the Apache-2.0 license
 
-use crate::{hkdf::*, AlgLen, Crypto, CryptoBuf, CryptoError, Digest, EcdsaPub, Hasher};
+use crate::{hkdf::*, AlgLen, Crypto, CryptoBuf, CryptoError, Digest, EcdsaPub, Hasher, MAX_EXPORTED_CDI_SIZE};
 #[cfg(not(feature = "no-cfi"))]
 use caliptra_cfi_derive_git::cfi_impl_fn;
 use openssl::{
@@ -14,6 +14,7 @@ use openssl::{
 };
 #[cfg(feature = "deterministic_rand")]
 use rand::{rngs::StdRng, RngCore, SeedableRng};
+use std::collections::HashMap;
 
 impl From<ErrorStack> for CryptoError {
     fn from(e: ErrorStack) -> Self {
@@ -41,23 +42,32 @@ impl Hasher for OpensslHasher {
     }
 }
 
+// Only currently support one CDI handle, but in the future we may want to support multiple.
+const MAX_CDI_HANDLES: usize = 1;
+type ExportCdiHandle = [u8; MAX_EXPORTED_CDI_SIZE];
+
 #[cfg(feature = "deterministic_rand")]
-pub struct OpensslCrypto(StdRng);
+pub struct OpensslCrypto{
+    rng: StdRng,
+    export_cdi_slots: HashMap<<OpensslCrypto as Crypto>::Cdi, ExportCdiHandle>,
+}
 
 #[cfg(not(feature = "deterministic_rand"))]
-pub struct OpensslCrypto;
+pub struct OpensslCrypto {
+    export_cdi_slots: Vec<ExportCdiHandle>,
+}
 
 impl OpensslCrypto {
     #[cfg(feature = "deterministic_rand")]
     pub fn new() -> Self {
         const SEED: [u8; 32] = [1; 32];
         let seeded_rng = StdRng::from_seed(SEED);
-        OpensslCrypto(seeded_rng)
+        Self{ rng: seeded_rng, export_cdi_slots: HashMap::new()}
     }
 
     #[cfg(not(feature = "deterministic_rand"))]
     pub fn new() -> Self {
-        Self {}
+        Self{ export_cdi_slots: HashMap::new()}
     }
 
     fn get_digest(algs: AlgLen) -> MessageDigest {
@@ -141,7 +151,7 @@ impl Crypto for OpensslCrypto {
 
     #[cfg(feature = "deterministic_rand")]
     fn rand_bytes(&mut self, dst: &mut [u8]) -> Result<(), CryptoError> {
-        StdRng::fill_bytes(&mut self.0, dst);
+        StdRng::fill_bytes(&mut self.rng, dst);
         Ok(())
     }
 
@@ -177,6 +187,18 @@ impl Crypto for OpensslCrypto {
         Ok(cdi)
     }
 
+    fn get_exported_cdi_handle(&mut self, cdi: &Self::Cdi) -> Result<[u8; MAX_EXPORTED_CDI_SIZE], CryptoError> {
+        if self.export_cdi_slots.len() >= MAX_CDI_HANDLES {
+            return Err(CryptoError::ExportedCdiHandleLimitExceeded);
+        }
+
+        let mut exported_cdi_handle = [0; MAX_EXPORTED_CDI_SIZE];
+        self.rand_bytes(&mut exported_cdi_handle)?;
+        self.export_cdi_slots.insert(cdi.clone(), exported_cdi_handle);
+
+        Ok(exported_cdi_handle)
+    }
+
     #[cfg_attr(not(feature = "no-cfi"), cfi_impl_fn)]
     fn derive_key_pair(
         &mut self,

dpe/src/commands/certify_key.rs

@@ -97,7 +97,7 @@ impl CommandExecution for CertifyKeyCmd {
         };
         let mut cert = [0; MAX_CERT_SIZE];
 
-        let CreateDpeCertResult { cert_size, pub_key } = match self.format {
+        let CreateDpeCertResult { cert_size, pub_key, .. } = match self.format {
             Self::FORMAT_X509 => {
                 cfg_if! {
                     if #[cfg(not(feature = "disable_x509"))] {

dpe/src/lib.rs

@@ -25,7 +25,7 @@ pub mod x509;
 
 use zerocopy::{FromBytes, Immutable, IntoBytes, KnownLayout};
 
-const MAX_EXPORTED_CDI_SIZE: usize = 32;
+pub use crypto::MAX_EXPORTED_CDI_SIZE;
 
 // Max cert size returned by CertifyKey
 const MAX_CERT_SIZE: usize = 6144;

dpe/src/x509.rs

@@ -16,7 +16,7 @@ use bitflags::bitflags;
 use caliptra_cfi_lib_git::cfi_launder;
 #[cfg(not(feature = "no-cfi"))]
 use caliptra_cfi_lib_git::{cfi_assert, cfi_assert_eq};
-use crypto::{Crypto, Digest, EcdsaPub, EcdsaSig, Hasher};
+use crypto::{Crypto, Digest, EcdsaPub, EcdsaSig, Hasher, MAX_EXPORTED_CDI_SIZE};
 #[cfg(not(feature = "disable_x509"))]
 use platform::CertValidity;
 #[cfg(not(feature = "disable_csr"))]
@@ -2256,6 +2256,11 @@ pub(crate) struct CreateDpeCertArgs<'a> {
 pub(crate) struct CreateDpeCertResult {
     pub cert_size: u32,
     pub pub_key: EcdsaPub,
+    //TODO(clundin): Remove once https://github.com/chipsalliance/caliptra-dpe/pull/376 is merged.
+    /// If the cert_type is `CertificateType::Exported` the CDI is exchanged for a handle, and
+    /// returned via `exported_cdi_handle`.
+    #[allow(unused)]
+    pub exported_cdi_handle: [u8; MAX_EXPORTED_CDI_SIZE],
 }
 
 fn get_dpe_measurement_digest(
@@ -2381,18 +2386,20 @@ fn create_dpe_cert_or_csr(
     let algs = DPE_PROFILE.alg_len();
     let digest = get_dpe_measurement_digest(dpe, env, args.handle, args.locality)?;
 
-    let key_pair = match cert_type {
+    let (key_pair, cdi) = match cert_type {
         CertificateType::Exported => {
             let cdi = env
                 .crypto
                 .derive_exported_cdi(algs, &digest, args.cdi_label)?;
-            env.crypto
-                .derive_key_pair_exported(algs, &cdi, args.key_label, args.context)
+            let key_pair = env.crypto
+                .derive_key_pair_exported(algs, &cdi, args.key_label, args.context);
+            (key_pair, cdi)
         }
         CertificateType::Leaf => {
             let cdi = env.crypto.derive_cdi(algs, &digest, args.cdi_label)?;
-            env.crypto
-                .derive_key_pair(algs, &cdi, args.key_label, args.context)
+            let key_pair = env.crypto
+                .derive_key_pair(algs, &cdi, args.key_label, args.context);
+            (key_pair, cdi)
         }
     };
     if cfi_launder(key_pair.is_ok()) {
@@ -2528,7 +2535,17 @@ fn create_dpe_cert_or_csr(
         }
     };
 
-    Ok(CreateDpeCertResult { cert_size, pub_key })
+    let result = match cert_type {
+        CertificateType::Exported => {
+            let exported_cdi_handle = env.crypto.get_exported_cdi_handle(&cdi)?;
+            CreateDpeCertResult { cert_size, pub_key, exported_cdi_handle }
+        },
+        _ => {
+            CreateDpeCertResult { cert_size, pub_key, exported_cdi_handle: [0; MAX_EXPORTED_CDI_SIZE] }
+        }
+    };
+
+    Ok(result)
 }
 
 #[cfg(test)]