pve_status_t get_ppid(ppid_t* ppid)
{
sgx_key_128bit_t key_tmp;
sgx_status_t sgx_status = SGX_SUCCESS;
memset(&key_tmp, 0, sizeof(key_tmp));
//get Provisioning Key with both CPUSVN and ISVSVN set to 0
pve_status_t status = get_provision_key(&key_tmp, NULL);
if(status != PVEC_SUCCESS){
(void)memset_s(&key_tmp,sizeof(key_tmp), 0, sizeof(key_tmp));
return status;
}
uint8_t content[16];
memset(&content, 0, sizeof(content));
//generate the mac as PPID
se_static_assert(sizeof(sgx_cmac_128bit_key_t) == sizeof(sgx_key_128bit_t)); /*size of sgx_cmac_128bit_key_t and sgx_key_128bit_t should be same*/
se_static_assert(sizeof(sgx_cmac_128bit_tag_t) == sizeof(ppid_t)); /*size of sgx_cmac_128bit_tag_t and ppit_t should be same*/
if((sgx_status=sgx_rijndael128_cmac_msg(reinterpret_cast<const sgx_cmac_128bit_key_t *>(&key_tmp),
content, sizeof(content), reinterpret_cast<sgx_cmac_128bit_tag_t *>(ppid)))!=SGX_SUCCESS){
status = sgx_error_to_pve_error(sgx_status);
}else{
status = PVEC_SUCCESS;
}
(void)memset_s(&key_tmp,sizeof(key_tmp), 0, sizeof(key_tmp));//clear provisioning key in stack
return status;
}
ae_error_t CertificateProvisioningProtocol::msg3_create_header(const upse::Buffer& transactionID, uint32_t nonceSize, uint32_t quoteSize, uint32_t epidSigSize, uint32_t csrSize, provision_request_header_t& header)
{
ae_error_t status = AESM_PSE_PR_INTERNAL_ERROR;
do
{
uint32_t seq2_0_tlv_block_cipher_text_size = BLOCK_CIPHER_TEXT_TLV_SIZE(quoteSize + epidSigSize + csrSize);
uint32_t seq3_0_tlv_nonce_size = nonceSize;
uint32_t seq4_0_tlv_mac_size = MAC_TLV_SIZE(MAC_SIZE);
header.protocol = PSE_PROVISIONING;
header.version = TLV_VERSION_1;
header.type = static_cast<uint8_t>(TYPE_PSE_MSG3);
if (XID_SIZE != transactionID.getSize())
break;
if (memcpy_s(header.xid, sizeof(header.xid), transactionID.getData(), transactionID.getSize()) != 0)
break;
uint32_t totalSize = seq2_0_tlv_block_cipher_text_size + seq3_0_tlv_nonce_size + seq4_0_tlv_mac_size;
uint32_t serializedSize = _htonl(totalSize);
se_static_assert(sizeof(serializedSize) == sizeof(header.size));
if (memcpy_s(header.size, sizeof(header.size), &serializedSize, sizeof(serializedSize)) != 0)
break;
status = AE_SUCCESS;
} while (0);
return status;
}
//Function to verify that ECDSA signature of XEGB is correct
sgx_status_t verify_xegb(const extended_epid_group_blob_t& xegb, uint8_t *result){
if (lv_htons(xegb.data_length) != EXTENDED_EPID_GROUP_BLOB_DATA_LEN
|| xegb.format_id != XEGB_FORMAT_ID){
return SGX_ERROR_INVALID_PARAMETER;
}
sgx_status_t status = SGX_SUCCESS;
sgx_ecc_state_handle_t handle= 0;
sgx_ec256_signature_t ec_signature;
status = sgx_ecc256_open_context(&handle);
if(SGX_SUCCESS!=status){
return status;
}
se_static_assert(sizeof(ec_signature)==sizeof(xegb.signature));
memcpy(&ec_signature, xegb.signature, sizeof(xegb.signature));
SWAP_ENDIAN_32B(ec_signature.x);
SWAP_ENDIAN_32B(ec_signature.y);
status = sgx_ecdsa_verify(reinterpret_cast<const uint8_t *>(&xegb),
static_cast<uint32_t>(sizeof(xegb)-sizeof(xegb.signature)),
const_cast<sgx_ec256_public_t *>(&g_sdsk_pub_key_little_endian),
&ec_signature,
result,
handle);
(void)sgx_ecc256_close_context(handle);
if(SGX_SUCCESS!=status){
return status;
}
return SGX_SUCCESS;
}
//Get Provisioning Wrap2 Key with respect to the PSVN
pve_status_t get_pwk2(
const psvn_t* psvn,
const uint8_t n2[NONCE_2_SIZE],
sgx_key_128bit_t* wrap_key)
{
if( psvn == NULL)
return PVEC_PARAMETER_ERROR;
uint8_t content[32];
sgx_status_t sgx_status = SGX_SUCCESS;
sgx_key_128bit_t key_tmp;
pve_status_t status = PVEC_SUCCESS;
memset(&key_tmp, 0, sizeof(key_tmp));
status = get_provision_key(&key_tmp, psvn); //Generate Provisioning Key with respect to the psvn
if(status != PVEC_SUCCESS)
goto ret_point;
memset(&content, 0, sizeof(content));
content[0] = 0x01;
memcpy(&content[START_OFF_PROV_WRAP_2], PROV_WRAP_2, PROV_WRAP_2_LEN); // byte 1-11 : "PROV_WRAP_2" (ascii encoded)
memcpy(&content[START_OFF_NONCE_2], n2, NONCE_2_SIZE);
content[OFF_BYTE_ZERO] = 0x00; //fill zero in byte offset 30
content[OFF_BYTE_0X80] = 0x80; //fill 0x80 in byte offset 31
//get the cmac of provision key as PWK2
se_static_assert(sizeof(sgx_cmac_128bit_key_t)==sizeof(key_tmp)); /*size of sgx_cmac_128bit_key_t should be same as sgx_key_128bit_t*/
se_static_assert(sizeof(sgx_cmac_128bit_tag_t)==sizeof(sgx_key_128bit_t)); /*size of sgx_cmac_128bit_tag_t should be same as sgx_key_128bit_t*/
if((sgx_status = sgx_rijndael128_cmac_msg(reinterpret_cast<const sgx_cmac_128bit_key_t *>(&key_tmp),
reinterpret_cast<const uint8_t *>(content), sizeof(content),
reinterpret_cast<sgx_cmac_128bit_tag_t *>(wrap_key)))!=SGX_SUCCESS){
status = sgx_error_to_pve_error(sgx_status);
}else{
status = PVEC_SUCCESS;
}
ret_point:
(void)memset_s(&key_tmp,sizeof(key_tmp), 0 ,sizeof(key_tmp)); //clear provisioninig key in stack
return status;
}
//Function to get the rsa public key of intel backend server
//The output rsa_pub_key should be released by function sgx_free_rsa_key
static sgx_status_t get_intel_rsa_pub_key(const public_key_t& publicKey, void **rsa_pub_key)
{
se_static_assert(sizeof(publicKey.n) == RSA_3072_KEY_BYTES);
if (NULL == rsa_pub_key)
return SGX_ERROR_INVALID_PARAMETER;
sgx_status_t status = sgx_create_rsa_pub1_key(
sizeof(publicKey.n),
sizeof(publicKey.e),
(const unsigned char*)publicKey.n,
(const unsigned char*)&publicKey.e,
rsa_pub_key);
return status;
}
//The function will try to do some preparation for piece meal encryption of field1 in ProvMsg3
// It prepares the encryption state in msg3
//@parm: structure to provide some input data to generate ProvMsg3 and also some states for piece meal processing
//@return PVEC_SUCCESS on success and error code if failed
static pve_status_t proc_msg3_state_init(prov_msg3_parm_t *parm, const sgx_key_128bit_t *pwk2)
{
pve_status_t ret = PVEC_SUCCESS;
sgx_status_t se_ret = SGX_SUCCESS;
if((se_ret=sgx_read_rand(parm->iv, IV_SIZE))!=SGX_SUCCESS){//randomly generate the IV
ret = se_read_rand_error_to_pve_error(se_ret);
goto ret_point;
}
se_static_assert(SK_SIZE==sizeof(sgx_cmac_128bit_tag_t)); /*size of sgx_cmac_128bit_tag_t should same as value of SK_SIZE*/
//initialize state for piece-meal encryption of field of ProvMsg3
ret = sgx_error_to_pve_error(sgx_aes_gcm128_enc_init((const uint8_t *)pwk2, parm->iv, IV_SIZE,//pwk2 as the key
NULL, 0,//no AAD used for the encryption of EpidSignature
(sgx_aes_state_handle_t*)&parm->p_msg3_state));
ret_point:
return ret;
}
//Function to verify the ECDSA signature of a PEK
//SHA1 value for integrity checking is not verified since the ECDSA verification could make sure the integrity at the same time.
sgx_status_t check_pek_signature(const signed_pek_t& signed_pek, const sgx_ec256_public_t* pek_sk, uint8_t *result)
{
sgx_status_t status = SGX_SUCCESS;
sgx_ecc_state_handle_t handle= 0;
sgx_ec256_signature_t ec_signature;
status = sgx_ecc256_open_context(&handle);
if(SGX_SUCCESS!=status){
return status;
}
se_static_assert(sizeof(ec_signature)==sizeof(signed_pek.pek_signature));
memcpy(&ec_signature, signed_pek.pek_signature, sizeof(signed_pek.pek_signature));
SWAP_ENDIAN_32B(ec_signature.x);
SWAP_ENDIAN_32B(ec_signature.y);
status = sgx_ecdsa_verify(reinterpret_cast<const uint8_t *>(&signed_pek),
static_cast<uint32_t>(sizeof(signed_pek.n)+sizeof(signed_pek.e)),
pek_sk,
&ec_signature,
result,
handle);
(void)sgx_ecc256_close_context(handle);
return status;
}
static bool inline _check_ex_params_(const uint32_t ex_features, const void* ex_features_p[32])
{
//update last feature index if it fails here
se_static_assert(_SGX_LAST_EX_FEATURE_IDX_ == SGX_CREATE_ENCLAVE_EX_KSS_BIT_IDX);
uint32_t i;
if (ex_features_p != NULL)
{
for (i = 0; i <= _SGX_LAST_EX_FEATURE_IDX_; i++)
{
if (((ex_features & (1<<i)) == 0) && (ex_features_p[i] != NULL))
return false;
}
for (i = _SGX_LAST_EX_FEATURE_IDX_ + 1; i < MAX_EX_FEATURES_COUNT; i++)
{
if (ex_features_p[i] != NULL)
return false;
}
}
return ((ex_features | _SGX_EX_FEATURES_MASK_) == _SGX_EX_FEATURES_MASK_);
}
uint32_t CPVEClass::gen_prov_msg1(
pve_data_t &pve_data,
uint8_t *msg1,
uint32_t msg1_size)
{
uint32_t ret = AE_SUCCESS;
uint16_t pce_id = 0;
uint16_t pce_isv_svn = 0;
sgx_report_t pek_report;
uint8_t *field2 = NULL;
uint8_t field2_iv[IV_SIZE];
uint8_t field2_mac[MAC_SIZE];
uint8_t encrypted_ppid[RSA_3072_KEY_BYTES];
//msg1 header will be in the beginning part of the output msg
provision_request_header_t *msg1_header = reinterpret_cast<provision_request_header_t *>(msg1);
memset(&pek_report, 0, sizeof(pek_report));
sgx_target_info_t pce_target_info;
sgx_status_t sgx_status;
//Load PCE Enclave required
ret = CPCEClass::instance().load_enclave();
if(ret != AE_SUCCESS){
AESM_DBG_ERROR("Fail to load PCE enclave:( ae%d)\n",ret);
return ret;
}
ret = CPCEClass::instance().get_pce_target(&pce_target_info);
if(ret != AE_SUCCESS){
AESM_DBG_ERROR("Fail to get PCE target info:( ae %d)\n",ret);
return ret;
}
//Load PvE enclave now
ret = CPVEClass::instance().load_enclave();
if( ret != AE_SUCCESS){
AESM_DBG_ERROR("Fail to load PvE enclave:(ae%d)\n",ret);
return ret;
}
//The code will generate a report on PEK by PvE
ret = gen_prov_msg1_data(&pve_data.pek, &pce_target_info, &pek_report);
if(AE_SUCCESS != ret ){
AESM_DBG_ERROR("Gen ProvMsg1 in trusted code failed:( ae %d)",ret);
return ret;
}
se_static_assert(sizeof(encrypted_ppid)==PEK_MOD_SIZE);
//Load PCE Enclave required
ret = CPCEClass::instance().load_enclave();
if(ret != AE_SUCCESS){
AESM_DBG_ERROR("Fail to load PCE enclave:( ae %d)\n",ret);
return ret;
}
ret = CPCEClass::instance().get_pce_info(pek_report, pve_data.pek, pce_id,
pce_isv_svn, encrypted_ppid);
if(AE_SUCCESS != ret){
AESM_DBG_ERROR("Fail to generate pc_info:(ae%d)",ret);
return ret;
}
//randomly generate XID
ret = aesm_read_rand(pve_data.xid, XID_SIZE);
if(AE_SUCCESS != ret ){
AESM_DBG_ERROR("Fail to generate random XID (ae%d)",ret);
return ret;
}
//randomly generate SK
ret = aesm_read_rand(pve_data.sk, SK_SIZE);
if(AE_SUCCESS != ret ){
AESM_DBG_ERROR("Fail to generate random SK (ae%d)",ret);
return ret;
}
CPCEClass::instance().unload_enclave();
ret = prov_msg1_gen_header(msg1_header, pve_data.is_performance_rekey, pve_data.xid, msg1_size);
if(AE_SUCCESS != ret){
AESM_DBG_ERROR("fail to generate ProvMsg1 Header:(ae %d)",ret);
return ret;
}
{
TLVsMsg tlvs_msg1_sub;
tlv_status_t tlv_status;
sgx_sha256_hash_t psid;
tlv_status = tlvs_msg1_sub.add_block_cipher_info(pve_data.sk);
ret = tlv_error_2_pve_error(tlv_status);
if(AE_SUCCESS!=ret){
AESM_DBG_ERROR("Fail to generate SK TLV of ProvMsg1 (ae %d)",ret);
return ret;
}
sgx_status = sgx_sha256_msg(reinterpret_cast<const uint8_t *>(&pve_data.pek.n),
static_cast<uint32_t>(sizeof(pve_data.pek.n) + sizeof(pve_data.pek.e)), &psid);
if(SGX_SUCCESS != sgx_status){
AESM_DBG_ERROR("Fail to generate PSID, (sgx0x%x)",sgx_status);
return AE_FAILURE;
}
se_static_assert(sizeof(sgx_sha256_hash_t)==sizeof(psid_t));
tlv_status = tlvs_msg1_sub.add_psid(reinterpret_cast<const psid_t *>(&psid));
ret = tlv_error_2_pve_error(tlv_status);
if(SGX_SUCCESS != ret){
AESM_DBG_ERROR("Fail to add PSID TLV ae(%d)",ret);
return ret;
}
//transform rsa format PEK public key of Provision Server
void *rsa_pub_key = NULL;
signed_pek_t le_pek{};
// Change the endian for the PEK public key
for(uint32_t i = 0; i< sizeof(le_pek.n); i++)
{
le_pek.n[i] = pve_data.pek.n[sizeof(le_pek.n) - i - 1];
}
for(uint32_t i= 0; i < sizeof(le_pek.e); i++)
{
le_pek.e[i] = pve_data.pek.e[sizeof(le_pek.e) - i - 1];
}
sgx_status = get_provision_server_rsa_pub_key(le_pek, &rsa_pub_key);
if( SGX_SUCCESS != sgx_status){
AESM_DBG_ERROR("Fail to decode PEK:%d",sgx_status);
return AE_FAILURE;
}
uint8_t field0[RSA_3072_KEY_BYTES];
ret = aesm_rsa_oaep_encrypt(tlvs_msg1_sub.get_tlv_msg(), tlvs_msg1_sub.get_tlv_msg_size(), rsa_pub_key, field0);
sgx_free_rsa_key(rsa_pub_key, SGX_RSA_PUBLIC_KEY, RSA_3072_KEY_BYTES, sizeof(le_pek.e));
if(AE_SUCCESS!=ret){
AESM_DBG_ERROR("Fail to in RSA_OAEP for ProvMsg1:(ae%d)",ret);
return ret;
}
TLVsMsg tlvs_msg1;
tlv_status= tlvs_msg1.add_cipher_text(field0, RSA_3072_KEY_BYTES, PEK_3072_PUB);
ret = tlv_error_2_pve_error(tlv_status);
if(AE_SUCCESS!=ret){
AESM_DBG_ERROR("Fail to generate field0 TLV of ProvMsg1( ae%d)",ret);
return ret;
}
TLVsMsg tlvs_msg2_sub;
tlv_status = tlvs_msg2_sub.add_cipher_text(encrypted_ppid, RSA_3072_KEY_BYTES, PEK_3072_PUB);
ret = tlv_error_2_pve_error(tlv_status);
if(AE_SUCCESS!=ret){
return ret;
}
if(!pve_data.is_backup_retrieval){
if(0!=memcpy_s(&pve_data.bpi.cpu_svn, sizeof(pve_data.bpi.cpu_svn),
&pek_report.body.cpu_svn, sizeof(pek_report.body.cpu_svn))){
AESM_DBG_FATAL("fail in memcpy_s");
return PVE_UNEXPECTED_ERROR;
}
if(0!=memcpy_s(&pve_data.bpi.pve_svn, sizeof(pve_data.bpi.pve_svn),
&pek_report.body.isv_svn, sizeof(pek_report.body.isv_svn))){
AESM_DBG_FATAL("fail in memcpy_s");
return PVE_UNEXPECTED_ERROR;
}
if(0!=memcpy_s(&pve_data.bpi.pce_svn, sizeof(pve_data.bpi.pce_svn),
&pce_isv_svn, sizeof(pce_isv_svn))){
AESM_DBG_FATAL("fail in memcpy_s");
return PVE_UNEXPECTED_ERROR;
}
}
//always use pce_id from PCE enclave
pve_data.bpi.pce_id = pce_id;
memset(&pve_data.bpi.fmsp, 0, sizeof(pve_data.bpi.fmsp));
tlv_status = tlvs_msg2_sub.add_platform_info(pve_data.bpi);
ret = tlv_error_2_pve_error(tlv_status);
if(AE_SUCCESS != ret){
AESM_DBG_ERROR("Fail to generate Platform Info TLV of ProvMsg1 (ae%d)",ret);
return ret;
}
if(pve_data.is_performance_rekey){
flags_t flags;
memset(&flags,0,sizeof(flags));
//set performance rekey flags
flags.flags[FLAGS_SIZE-1]=1;
tlv_status = tlvs_msg2_sub.add_flags(&flags);
ret = tlv_error_2_pve_error(tlv_status);
if(AE_SUCCESS != ret){
AESM_DBG_ERROR("Fail to generate FLAGS TLV of ProvMsg1, (ae %d)",ret);
return ret;
}
}
ret = aesm_read_rand(field2_iv, IV_SIZE);
if(AE_SUCCESS != ret){
AESM_DBG_ERROR("Fail to read rand:(ae%d)",ret);
return ret;
}
sgx_cmac_128bit_tag_t ek1;
se_static_assert(SK_SIZE==sizeof(sgx_cmac_128bit_key_t));
if((sgx_status = sgx_rijndael128_cmac_msg(reinterpret_cast<const sgx_cmac_128bit_key_t *>(pve_data.sk),
pve_data.xid, XID_SIZE, &ek1))!=SGX_SUCCESS){
AESM_DBG_ERROR("Fail to generate ek1:(sgx%d)",sgx_status);
return AE_FAILURE;
}
field2 = (uint8_t *)malloc(tlvs_msg2_sub.get_tlv_msg_size());
if(NULL == field2){
AESM_DBG_ERROR("Out of memory");
return AE_OUT_OF_MEMORY_ERROR;
}
sgx_status = sgx_rijndael128GCM_encrypt(&ek1,
tlvs_msg2_sub.get_tlv_msg(), tlvs_msg2_sub.get_tlv_msg_size(),
field2,field2_iv, IV_SIZE, (const uint8_t *)msg1_header, sizeof(provision_request_header_t),
(sgx_aes_gcm_128bit_tag_t *)field2_mac);
if(SGX_SUCCESS != sgx_status){
ret = sgx_error_to_ae_error(sgx_status);
AESM_DBG_ERROR("Fail to do AES encrypt (sgx %d)", sgx_status);
free(field2);
return ret;
}
tlv_status = tlvs_msg1.add_block_cipher_text(field2_iv, field2, tlvs_msg2_sub.get_tlv_msg_size());
ret = tlv_error_2_pve_error(tlv_status);
if(AE_SUCCESS!=ret){
free(field2);
AESM_DBG_ERROR("Fail to generate field1 TLV of ProvMsg1(ae%d)",ret);
return ret;
}
free(field2);
tlv_status = tlvs_msg1.add_mac(field2_mac);
ret = tlv_error_2_pve_error(tlv_status);
if(AE_SUCCESS!=ret){
AESM_DBG_ERROR("Fail to create field2 TLV of ProvMsg1:(ae %d)",ret);
return ret;
}
uint32_t size = tlvs_msg1.get_tlv_msg_size();
if(memcpy_s(msg1+PROVISION_REQUEST_HEADER_SIZE, msg1_size - PROVISION_REQUEST_HEADER_SIZE,
tlvs_msg1.get_tlv_msg(), size)!=0){
//The size overflow has been checked in header generation
AESM_DBG_FATAL("fail in memcpy_s");
return PVE_UNEXPECTED_ERROR;
}
}
return AE_SUCCESS;
}
extern "C" sgx_status_t sgx_ra_proc_msg2_trusted(
sgx_ra_context_t context,
const sgx_ra_msg2_t *p_msg2, //(g_b||spid||quote_type|| KDF_ID ||sign_gb_ga||cmac||sig_rl_size||sig_rl)
const sgx_target_info_t *p_qe_target,
sgx_report_t *p_report,
sgx_quote_nonce_t* p_nonce)
{
sgx_status_t se_ret = SGX_ERROR_UNEXPECTED;
//p_msg2[in] p_qe_target[in] p_report[out] p_nonce[out] in EDL file
if(vector_size(&g_ra_db) <= context
|| !p_msg2
|| !p_qe_target
|| !p_report
|| !p_nonce)
return SGX_ERROR_INVALID_PARAMETER;
ra_db_item_t* item = NULL;
if(0 != vector_get(&g_ra_db, context, reinterpret_cast<void**>(&item)) || item == NULL )
return SGX_ERROR_INVALID_PARAMETER;
sgx_ec256_private_t a;
memset(&a, 0, sizeof(a));
// Create gb_ga
sgx_ec256_public_t gb_ga[2];
sgx_ec256_public_t sp_pubkey;
sgx_ec_key_128bit_t smkey = {0};
sgx_ec_key_128bit_t skey = {0};
sgx_ec_key_128bit_t mkey = {0};
sgx_ec_key_128bit_t vkey = {0};
sgx_ra_derive_secret_keys_t ra_key_cb = NULL;
memset(&gb_ga[0], 0, sizeof(gb_ga));
sgx_spin_lock(&item->item_lock);
//sgx_ra_get_ga must have been called
if (item->state != ra_get_gaed)
{
sgx_spin_unlock(&item->item_lock);
return SGX_ERROR_INVALID_STATE;
}
memcpy(&a, &item->a, sizeof(a));
memcpy(&gb_ga[1], &item->g_a, sizeof(gb_ga[1]));
memcpy(&sp_pubkey, &item->sp_pubkey, sizeof(sp_pubkey));
ra_key_cb = DEC_KDF_POINTER(item->derive_key_cb);
sgx_spin_unlock(&item->item_lock);
memcpy(&gb_ga[0], &p_msg2->g_b, sizeof(gb_ga[0]));
sgx_ecc_state_handle_t ecc_state = NULL;
// ecc_state need to be freed when exit.
se_ret = sgx_ecc256_open_context(&ecc_state);
if (SGX_SUCCESS != se_ret)
{
if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
se_ret = SGX_ERROR_UNEXPECTED;
return se_ret;
}
sgx_ec256_dh_shared_t dh_key;
memset(&dh_key, 0, sizeof(dh_key));
sgx_ec256_public_t* p_msg2_g_b = const_cast<sgx_ec256_public_t*>(&p_msg2->g_b);
se_ret = sgx_ecc256_compute_shared_dhkey(&a,
(sgx_ec256_public_t*)p_msg2_g_b,
&dh_key, ecc_state);
if(SGX_SUCCESS != se_ret)
{
if (SGX_ERROR_OUT_OF_MEMORY != se_ret)
se_ret = SGX_ERROR_UNEXPECTED;
sgx_ecc256_close_context(ecc_state);
return se_ret;
}
// Verify signature of gb_ga
uint8_t result;
sgx_ec256_signature_t* p_msg2_sign_gb_ga = const_cast<sgx_ec256_signature_t*>(&p_msg2->sign_gb_ga);
se_ret = sgx_ecdsa_verify((uint8_t *)&gb_ga, sizeof(gb_ga),
&sp_pubkey,
p_msg2_sign_gb_ga,
&result, ecc_state);
if(SGX_SUCCESS != se_ret)
{
if (SGX_ERROR_OUT_OF_MEMORY != se_ret)
se_ret = SGX_ERROR_UNEXPECTED;
sgx_ecc256_close_context(ecc_state);
return se_ret;
}
if(SGX_EC_VALID != result)
{
sgx_ecc256_close_context(ecc_state);
return SGX_ERROR_INVALID_SIGNATURE;
}
do
{
if(NULL != ra_key_cb)
{
se_ret = ra_key_cb(&dh_key,
p_msg2->kdf_id,
&smkey,
&skey,
&mkey,
&vkey);
if (SGX_SUCCESS != se_ret)
{
if(SGX_ERROR_OUT_OF_MEMORY != se_ret &&
SGX_ERROR_INVALID_PARAMETER != se_ret &&
SGX_ERROR_KDF_MISMATCH != se_ret)
se_ret = SGX_ERROR_UNEXPECTED;
break;
}
}
else if (p_msg2->kdf_id == 0x0001)
{
se_ret = derive_key(&dh_key, "SMK", (uint32_t)(sizeof("SMK") -1), &smkey);
if (SGX_SUCCESS != se_ret)
{
if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
se_ret = SGX_ERROR_UNEXPECTED;
break;
}
se_ret = derive_key(&dh_key, "SK", (uint32_t)(sizeof("SK") -1), &skey);
if (SGX_SUCCESS != se_ret)
{
if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
se_ret = SGX_ERROR_UNEXPECTED;
break;
}
se_ret = derive_key(&dh_key, "MK", (uint32_t)(sizeof("MK") -1), &mkey);
if (SGX_SUCCESS != se_ret)
{
if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
se_ret = SGX_ERROR_UNEXPECTED;
break;
}
se_ret = derive_key(&dh_key, "VK", (uint32_t)(sizeof("VK") -1), &vkey);
if (SGX_SUCCESS != se_ret)
{
if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
se_ret = SGX_ERROR_UNEXPECTED;
break;
}
}
else
{
se_ret = SGX_ERROR_KDF_MISMATCH;
break;
}
sgx_cmac_128bit_tag_t mac;
uint32_t maced_size = offsetof(sgx_ra_msg2_t, mac);
se_ret = sgx_rijndael128_cmac_msg(&smkey, (const uint8_t *)p_msg2, maced_size, &mac);
if (SGX_SUCCESS != se_ret)
{
if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
se_ret = SGX_ERROR_UNEXPECTED;
break;
}
//Check mac
if(0 == consttime_memequal(mac, p_msg2->mac, sizeof(mac)))
{
se_ret = SGX_ERROR_MAC_MISMATCH;
break;
}
//create a nonce
se_ret =sgx_read_rand((uint8_t*)p_nonce, sizeof(sgx_quote_nonce_t));
if (SGX_SUCCESS != se_ret)
{
if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
se_ret = SGX_ERROR_UNEXPECTED;
break;
}
sgx_spin_lock(&item->item_lock);
//sgx_ra_get_ga must have been called
if (item->state != ra_get_gaed)
{
se_ret = SGX_ERROR_INVALID_STATE;
sgx_spin_unlock(&item->item_lock);
break;
}
memcpy(&item->g_b, &p_msg2->g_b, sizeof(item->g_b));
memcpy(&item->smk_key, smkey, sizeof(item->smk_key));
memcpy(&item->sk_key, skey, sizeof(item->sk_key));
memcpy(&item->mk_key, mkey, sizeof(item->mk_key));
memcpy(&item->vk_key, vkey, sizeof(item->vk_key));
memcpy(&item->qe_target, p_qe_target, sizeof(sgx_target_info_t));
memcpy(&item->quote_nonce, p_nonce, sizeof(sgx_quote_nonce_t));
sgx_report_data_t report_data = {{0}};
se_static_assert(sizeof(sgx_report_data_t)>=sizeof(sgx_sha256_hash_t));
// H = SHA256(ga || gb || VK_CMAC)
uint32_t sha256ed_size = offsetof(ra_db_item_t, sp_pubkey);
//report_data is 512bits, H is 256bits. The H is in the lower 256 bits of report data while the higher 256 bits are all zeros.
se_ret = sgx_sha256_msg((uint8_t *)&item->g_a, sha256ed_size,
(sgx_sha256_hash_t *)&report_data);
if(SGX_SUCCESS != se_ret)
{
if (SGX_ERROR_OUT_OF_MEMORY != se_ret)
se_ret = SGX_ERROR_UNEXPECTED;
sgx_spin_unlock(&item->item_lock);
break;
}
//REPORTDATA = H
se_ret = sgx_create_report(p_qe_target, &report_data, p_report);
if (SGX_SUCCESS != se_ret)
{
if(SGX_ERROR_OUT_OF_MEMORY != se_ret)
se_ret = SGX_ERROR_UNEXPECTED;
sgx_spin_unlock(&item->item_lock);
break;
}
item->state = ra_proc_msg2ed;
sgx_spin_unlock(&item->item_lock);
}while(0);
memset_s(&dh_key, sizeof(dh_key), 0, sizeof(dh_key));
sgx_ecc256_close_context(ecc_state);
memset_s(&a, sizeof(sgx_ec256_private_t),0, sizeof(sgx_ec256_private_t));
memset_s(smkey, sizeof(sgx_ec_key_128bit_t),0, sizeof(sgx_ec_key_128bit_t));
memset_s(skey, sizeof(sgx_ec_key_128bit_t),0, sizeof(sgx_ec_key_128bit_t));
memset_s(mkey, sizeof(sgx_ec_key_128bit_t),0, sizeof(sgx_ec_key_128bit_t));
memset_s(vkey, sizeof(sgx_ec_key_128bit_t),0, sizeof(sgx_ec_key_128bit_t));
return se_ret;
}
//Function to decode ProvMsg4 and generate epid data blob
uint32_t CPVEClass::proc_prov_msg4(
bool use_ek2_in_input,
const uint8_t ek2[SK_SIZE],
const uint8_t* msg4,
uint32_t msg4_size,
uint8_t* data_blob,
uint32_t blob_size)
{
ae_error_t ret = AE_SUCCESS;
uint8_t local_ek2[SK_SIZE];
uint8_t *decoded_msg4 = NULL;
const provision_response_header_t *msg4_header = reinterpret_cast<const provision_response_header_t *>(msg4);
if(msg4_size < PROVISION_RESPONSE_HEADER_SIZE){
AESM_DBG_ERROR("invalid msg4 size");
return PVE_MSG_ERROR;
}
if(blob_size != HARD_CODED_EPID_BLOB_SIZE){
AESM_DBG_FATAL("invalid input epid blob size");
return PVE_PARAMETER_ERROR;
}
ret = check_prov_msg4_header(msg4_header, msg4_size);
if( AE_SUCCESS != ret){
AESM_DBG_ERROR("Invalid ProvMsg4 Header:%d",ret);
return ret;
}
ret = check_epid_pve_pg_status_before_mac_verification(msg4_header);
if( AE_SUCCESS != ret){
AESM_DBG_ERROR("Backend return failure in ProvMsg4 Header:%d",ret);
return ret;
}
do{
TLVsMsg tlvs_msg4;
tlv_status_t tlv_status;
tlv_status = tlvs_msg4.init_from_buffer(msg4+static_cast<uint32_t>(PROVISION_RESPONSE_HEADER_SIZE), msg4_size - static_cast<uint32_t>(PROVISION_RESPONSE_HEADER_SIZE));
ret = tlv_error_2_pve_error(tlv_status);
if(AE_SUCCESS!=ret){
AESM_DBG_ERROR("fail to decode ProvMsg4:%d",tlv_status);
break;
}
ret = msg4_integrity_checking(tlvs_msg4);
if(AE_SUCCESS != ret){
AESM_DBG_ERROR("ProvMsg4 integrity checking error:%d",ret);
break;
}
AESM_DBG_TRACE("ProvMsg4 decoded");
if(!use_ek2_in_input){ //we need generate ek2
prov_get_ek2_input_t ek2_input;
if(memcpy_s(ek2_input.nonce, NONCE_SIZE, MSG4_TOP_FIELD_NONCE.payload, NONCE_SIZE)!=0){
AESM_DBG_ERROR("fail in memcpy");
ret = PVE_UNEXPECTED_ERROR;
break;
}
if(memcpy_s(ek2_input.xid, XID_SIZE, msg4_header->xid, XID_SIZE)!=0){
AESM_DBG_ERROR("fail in memcpy");
ret = PVE_UNEXPECTED_ERROR;
break;
}
//call PvE to get EK2
se_static_assert(SK_SIZE == sizeof(prov_get_ek2_output_t));
ret = (ae_error_t)get_ek2(&ek2_input, reinterpret_cast<prov_get_ek2_output_t *>(local_ek2));
if(AE_SUCCESS != ret){
AESM_DBG_ERROR("fail to get EK2:%d",ret);
break;
}
}else{//reuse ek2 generated in processing ProvMsg2
if(0!=memcpy_s(local_ek2, sizeof(local_ek2), ek2, SK_SIZE)){
AESM_DBG_ERROR("fail in memcpy");
ret = PVE_UNEXPECTED_ERROR;
break;
}
}
se_static_assert(SK_SIZE==sizeof(sgx_aes_gcm_128bit_key_t));
tlv_msg_t field1 = block_cipher_tlv_get_encrypted_text(MSG4_TOP_FIELD_DATA);
decoded_msg4 = reinterpret_cast<uint8_t *>(malloc(field1.msg_size));
if(NULL == decoded_msg4){
AESM_DBG_ERROR("malloc error");
ret = AE_OUT_OF_MEMORY_ERROR;
break;
}
sgx_status_t sgx_status = sgx_rijndael128GCM_decrypt(reinterpret_cast<const sgx_aes_gcm_128bit_key_t *>(local_ek2),
field1.msg_buf, field1.msg_size, decoded_msg4,
reinterpret_cast<uint8_t *>(block_cipher_tlv_get_iv(MSG4_TOP_FIELD_DATA)), IV_SIZE,
reinterpret_cast<const uint8_t *>(msg4_header), PROVISION_RESPONSE_HEADER_SIZE,
reinterpret_cast<const sgx_aes_gcm_128bit_tag_t *>(MSG4_TOP_FIELD_MAC.payload));
if(SGX_ERROR_MAC_MISMATCH == sgx_status){
AESM_DBG_ERROR("fail to decrypt ProvMsg4 by EK2");
ret = PVE_INTEGRITY_CHECK_ERROR;
break;
}
if( AE_SUCCESS != (ret = sgx_error_to_ae_error(sgx_status))){
AESM_DBG_ERROR("error in decrypting ProvMsg4:%d",sgx_status);
break;
}
AESM_DBG_TRACE("ProvMsg4 decrypted by EK2 successfully");
ret = check_epid_pve_pg_status_after_mac_verification(msg4_header);
if(AE_SUCCESS != ret){
AESM_DBG_ERROR("Backend reported error passed MAC verification:%d",ret);
break;
}
TLVsMsg tlvs_field1;
tlv_status = tlvs_field1.init_from_buffer(decoded_msg4, field1.msg_size);
ret = tlv_error_2_pve_error(tlv_status);
if(AE_SUCCESS != ret){
AESM_DBG_ERROR("ProvMsg4 Field2.1 decoding failed:%d",tlv_status);
break;
}
ret = msg4_field1_msg_checking(tlvs_field1);
if( AE_SUCCESS != ret){
AESM_DBG_ERROR("ProvMsg4 Field2.1 invalid:%d",ret);
break;
}
proc_prov_msg4_input_t msg4_input;
if(sizeof(proc_prov_msg4_output_t)!=SGX_TRUSTED_EPID_BLOB_SIZE){
AESM_DBG_FATAL("Trusted ProvMsg4 output buffer size error");
ret = PVE_UNEXPECTED_ERROR;
break;
}
tlv_msg_t tcb_data = block_cipher_tlv_get_encrypted_text(MSG4_FIELD1_ENC_TCB);
tlv_msg_t Axf_data = block_cipher_tlv_get_encrypted_text(MSG4_FIELD1_ENC_Axf);
if(0!=memcpy_s(&msg4_input.group_cert, sizeof(msg4_input.group_cert), MSG4_FIELD1_GROUP_CERT.payload, MSG4_FIELD1_GROUP_CERT.size)||
0!=memcpy_s(&msg4_input.equivalent_psvn, sizeof(psvn_t), device_id_tlv_get_psvn(MSG4_FIELD1_DEVICE_ID), sizeof(psvn_t))||
0!=memcpy_s(&msg4_input.fmsp, sizeof(fmsp_t), device_id_tlv_get_fmsp(MSG4_FIELD1_DEVICE_ID), sizeof(fmsp_t))||
0!=memcpy_s(&msg4_input.tcb_iv, IV_SIZE, block_cipher_tlv_get_iv(MSG4_FIELD1_ENC_TCB), IV_SIZE)||
0!=memcpy_s(&msg4_input.encrypted_tcb, SK_SIZE, tcb_data.msg_buf, tcb_data.msg_size)||
0!=memcpy_s(&msg4_input.tcb_mac, MAC_SIZE, MSG4_FIELD1_MAC_TCB.payload, MSG4_FIELD1_MAC_TCB.size)||
0!=memcpy_s(&msg4_input.member_credential_iv, IV_SIZE, block_cipher_tlv_get_iv(MSG4_FIELD1_ENC_Axf), IV_SIZE)||
0!=memcpy_s(&msg4_input.encrypted_member_credential, HARD_CODED_EPID_MEMBER_WITH_ESCROW_TLV_SIZE, Axf_data.msg_buf, Axf_data.msg_size)||
0!=memcpy_s(&msg4_input.member_credential_mac, MAC_SIZE, MSG4_FIELD1_MAC_Axf.payload, MSG4_FIELD1_MAC_Axf.size)){
AESM_DBG_ERROR("memcpy error");
ret = PVE_UNEXPECTED_ERROR;
break;
}
ret = (ae_error_t)proc_prov_msg4_data(&msg4_input, reinterpret_cast<proc_prov_msg4_output_t *>(data_blob));
AESM_DBG_TRACE("PvE return %d in Process ProvMsg4",ret);
}while(0);
if(decoded_msg4)free(decoded_msg4);
return ret;
}
//Function to generate Field1_0 of ProvMsg3
//@msg2_blob_input, input decoded ProvMsg2 info
//@join_proof, output the join proof and the escrow data which is encrypted f of Private Key
//@return PVEC_SUCCESS on success and error code on failure
//The function assume all required inputs have been prepared in msg2_blob_input
static pve_status_t gen_msg3_join_proof_escrow_data(const proc_prov_msg2_blob_input_t *msg2_blob_input,
join_proof_with_escrow_t& join_proof)
{
pve_status_t ret = PVEC_SUCCESS;
BitSupplier epid_prng = (BitSupplier) epid_random_func;
FpElemStr temp_f;
//first generate private key f randomly before sealing it by PSK
FpElemStr *f = &temp_f;
sgx_status_t sgx_status = SGX_SUCCESS;
JoinRequest *join_r = &join_proof.jr;
EpidStatus epid_ret = kEpidNoErr;
psvn_t psvn;
MemberCtx* ctx = NULL;
memset(&temp_f, 0, sizeof(temp_f));
//randomly generate the private EPID key f, host to network transformation not required since server will not decode it
ret=sgx_error_to_pve_error(sgx_gen_epid_priv_f((void*)f));
if(PVEC_SUCCESS != ret){
goto ret_point;
}
//generate JoinP using f before encryption by calling EPID library
memset(join_r, 0, sizeof(JoinRequest));//first clear to 0
//generate JoinP to fill it in field1_0_0 by EPID library
epid_ret = epid_member_create(epid_prng, NULL, f, &ctx);
if(kEpidNoErr!=epid_ret){
ret = epid_error_to_pve_error(epid_ret);
goto ret_point;
}
epid_ret = EpidCreateJoinRequest(ctx,
&msg2_blob_input->group_cert.key, //EPID Group Cert from ProvMsgs2 used
reinterpret_cast<const IssuerNonce *>(msg2_blob_input->challenge_nonce),
join_r);
if(kEpidNoErr != epid_ret){
ret = epid_error_to_pve_error(epid_ret);
goto ret_point;
}
//get PSK
sgx_key_128bit_t psk;
memcpy(&psvn.cpu_svn, &msg2_blob_input->equiv_pi.cpu_svn, sizeof(psvn.cpu_svn));
memcpy(&psvn.isv_svn, &msg2_blob_input->equiv_pi.pve_svn, sizeof(psvn.isv_svn));
ret = get_pve_psk(&psvn, &psk);
if(PVEC_SUCCESS != ret){
goto ret_point;
}
join_proof.escrow.version = 0;//version 0 used for escrow data
//now we could seal f by PSK
ret = se_read_rand_error_to_pve_error(sgx_read_rand(join_proof.escrow.iv, IV_SIZE));
if(PVEC_SUCCESS != ret){
goto ret_point;
}
se_static_assert(sizeof(psk)==sizeof(sgx_aes_gcm_128bit_key_t)); /*sizeof sgx_aes_gcm_128bit_key_t tshould be same as size of psk*/
se_static_assert(sizeof(sgx_aes_gcm_128bit_tag_t)==sizeof(join_proof.escrow.mac)); /*sizeof sgx_aes_gcm_128bit_tag_t should be same as MAC_SIZE*/
sgx_status = sgx_rijndael128GCM_encrypt(reinterpret_cast<const sgx_aes_gcm_128bit_key_t *>(&psk),
reinterpret_cast<uint8_t *>(f), sizeof(*f), reinterpret_cast<uint8_t *>(&join_proof.escrow.f),
join_proof.escrow.iv, IV_SIZE, NULL, 0,
reinterpret_cast<sgx_aes_gcm_128bit_tag_t *>(join_proof.escrow.mac));
if(SGX_SUCCESS != sgx_status){
ret = sgx_error_to_pve_error(sgx_status);
}
ret_point:
(void)memset_s(&psk, sizeof(psk), 0, sizeof(psk));//clear the key
(void)memset_s(&temp_f, sizeof(temp_f), 0, sizeof(temp_f));//clear temp f in stack
if(PVEC_SUCCESS != ret){
(void)memset_s(&join_proof, sizeof(join_proof), 0, sizeof(join_proof));
}
epid_member_delete(&ctx);
return ret;
}
/*
* An internal function used to verify EPID Blob, get EPID Group Cert
* and get EPID context, at the same time, you can check whether EPID blob has
* been resealed.
*
* @param p_blob[in, out] Pointer to EPID Blob.
* @param p_is_resealed[out] Whether the EPID Blob has been resealed.
* @param create_context[in] Flag indicates create EPID context or not.
* @param plaintext_epid_data[out] Used to get the plaintext part of epid blob
* @param pp_epid_context[out] Used to get the pointer of the EPID context.
* @param p_cpusvn[out] Return the raw CPUSVN.
* @return ae_error_t AE_SUCCESS or other error cases.
*/
static ae_error_t verify_blob_internal(
uint8_t *p_blob,
uint32_t blob_size,
uint8_t *p_is_resealed,
uint32_t create_context,
se_plaintext_epid_data_sdk_t& plaintext_epid_data,
MemberCtx **pp_epid_context,
sgx_cpu_svn_t *p_cpusvn)
{
ae_error_t ret = QE_UNEXPECTED_ERROR;
sgx_status_t se_ret = SGX_SUCCESS;
uint8_t resealed = FALSE;
se_secret_epid_data_sdk_t secret_epid_data;
se_plaintext_epid_data_sik_t plaintext_old_format;
uint32_t plaintext_length;
int is_old_format = 0;
uint32_t decryptedtext_length = sizeof(secret_epid_data);
sgx_sealed_data_t *p_epid_blob = (sgx_sealed_data_t *)p_blob;
uint8_t local_epid_blob[sizeof(*p_epid_blob)
+ sizeof(secret_epid_data)
+ sizeof(plaintext_epid_data)]
= {0};
MemberCtx *p_ctx = NULL;
do {
// We will use plaintext_old_format as buffer to hold the output of sgx_unseal_data.
// It can be se_plaintext_epid_data_sik_t or se_plaintext_epid_data_sdk_t.
// We use the static assert to reassure plaintext_old_format is big enough.
// If someone changed the definition of these 2 structures and break current assumption,
// it will report error in compile time.
se_static_assert(sizeof(plaintext_old_format) >= sizeof(plaintext_epid_data));
if (sgx_get_encrypt_txt_len(p_epid_blob) != sizeof(se_secret_epid_data_sdk_t) &&
sgx_get_encrypt_txt_len(p_epid_blob) != sizeof(se_secret_epid_data_sik_t)) {
return QE_EPIDBLOB_ERROR;
}
plaintext_length = sgx_get_add_mac_txt_len(p_epid_blob);
if (plaintext_length != sizeof(se_plaintext_epid_data_sik_t) &&
plaintext_length != sizeof(se_plaintext_epid_data_sdk_t))
{
return QE_EPIDBLOB_ERROR;
}
memset(&secret_epid_data, 0, sizeof(secret_epid_data));
memset(&plaintext_epid_data, 0, sizeof(plaintext_epid_data));
memset(&plaintext_old_format, 0, sizeof(plaintext_old_format));
se_ret = sgx_unseal_data(p_epid_blob,
(uint8_t *)&plaintext_old_format, // The unsealed plaintext can be old or new format, the buffer is defined as old format because it is bigger
&plaintext_length,
(uint8_t *)&secret_epid_data,
&decryptedtext_length);
BREAK_IF_TRUE(SGX_SUCCESS != se_ret, ret, QE_EPIDBLOB_ERROR);
//QE will support both epid blob with/without member precomputation
//If the epid blob without member precomputation is used, QE will generate member precomputation and reseal epid blob
//blob_type and key_version are always first two fields of plaintext in both format
BREAK_IF_TRUE((plaintext_old_format.seal_blob_type != PVE_SEAL_EPID_KEY_BLOB)
|| (plaintext_old_format.epid_key_version != EPID_KEY_BLOB_VERSION_SDK&&
plaintext_old_format.epid_key_version != EPID_KEY_BLOB_VERSION_SIK),
ret, QE_EPIDBLOB_ERROR);
// Only 2 combinations are legitimate for the tuple epid_key_version|decryptedtext_length|plaintext_length:
// EPID_KEY_BLOB_VERSION_SIK|sizeof(se_secret_epid_data_sik_t)|sizeof(se_plaintext_epid_data_sik_t)
// EPID_KEY_BLOB_VERSION_SDK|sizeof(se_secret_epid_data_sdk_t)|sizeof(se_plaintext_epid_data_sdk_t)
BREAK_IF_TRUE((plaintext_old_format.epid_key_version == EPID_KEY_BLOB_VERSION_SIK &&
(decryptedtext_length != sizeof(se_secret_epid_data_sik_t) || plaintext_length != sizeof(se_plaintext_epid_data_sik_t))) ||
(plaintext_old_format.epid_key_version == EPID_KEY_BLOB_VERSION_SDK &&
(decryptedtext_length != sizeof(se_secret_epid_data_sdk_t) || plaintext_length != sizeof(se_plaintext_epid_data_sdk_t))),
ret, QE_EPIDBLOB_ERROR);
// If the input epid blob is in sik format, we will upgrade it to sdk version
if (plaintext_old_format.epid_key_version == EPID_KEY_BLOB_VERSION_SIK) {
plaintext_epid_data.seal_blob_type = PVE_SEAL_EPID_KEY_BLOB;
plaintext_epid_data.epid_key_version = EPID_KEY_BLOB_VERSION_SDK;
memcpy(&plaintext_epid_data.equiv_cpu_svn, &plaintext_old_format.equiv_cpu_svn, sizeof(plaintext_old_format.equiv_cpu_svn));
memcpy(&plaintext_epid_data.equiv_pve_isv_svn, &plaintext_old_format.equiv_pve_isv_svn, sizeof(plaintext_old_format.equiv_pve_isv_svn));
memcpy(&plaintext_epid_data.epid_group_cert, &plaintext_old_format.epid_group_cert, sizeof(plaintext_old_format.epid_group_cert));
memcpy(&plaintext_epid_data.qsdk_exp, &plaintext_old_format.qsdk_exp, sizeof(plaintext_old_format.qsdk_exp));
memcpy(&plaintext_epid_data.qsdk_mod, &plaintext_old_format.qsdk_mod, sizeof(plaintext_old_format.qsdk_mod));
memcpy(&plaintext_epid_data.epid_sk, &plaintext_old_format.epid_sk, sizeof(plaintext_old_format.epid_sk));
plaintext_epid_data.xeid = plaintext_old_format.xeid;
memset(&secret_epid_data.member_precomp_data, 0, sizeof(secret_epid_data.member_precomp_data));
is_old_format = 1;
//PrivKey of secret_epid_data are both in offset 0 so that we need not move it
}
else {//SDK version format
memcpy(&plaintext_epid_data, &plaintext_old_format, sizeof(plaintext_epid_data));
}
/* Create report to get current cpu_svn and isv_svn. */
sgx_report_t report;
memset(&report, 0, sizeof(report));
se_ret = sgx_create_report(NULL, NULL, &report);
BREAK_IF_TRUE(SGX_SUCCESS != se_ret, ret, QE_UNEXPECTED_ERROR);
/* Get the random function pointer. */
BitSupplier rand_func = epid_random_func;
/* Create EPID member context if required. PvE is responsible for verifying
the Cert signature before storing them in the EPID blob. */
if (create_context || is_old_format)
{
EpidStatus epid_ret = kEpidNoErr;
epid_ret = epid_member_create(rand_func, NULL, NULL, &p_ctx);
BREAK_IF_TRUE(kEpidNoErr != epid_ret, ret, QE_UNEXPECTED_ERROR);
epid_ret = EpidProvisionKey(p_ctx,
&(plaintext_epid_data.epid_group_cert),
(PrivKey*)&(secret_epid_data.epid_private_key),
is_old_format ? NULL : &secret_epid_data.member_precomp_data);
BREAK_IF_TRUE(kEpidNoErr != epid_ret, ret, QE_UNEXPECTED_ERROR);
// start member
epid_ret = EpidMemberStartup(p_ctx);
BREAK_IF_TRUE(kEpidNoErr != epid_ret, ret, QE_UNEXPECTED_ERROR);
if (is_old_format)
{
epid_ret = EpidMemberWritePrecomp(p_ctx, &secret_epid_data.member_precomp_data);
BREAK_IF_TRUE(kEpidNoErr != epid_ret, ret, QE_UNEXPECTED_ERROR);
}
}
/* Update the Key Blob using the SEAL Key for the current TCB if the TCB is
upgraded after the Key Blob is generated. Here memcmp cpu_svns might be
different even though they're actually same, but for defense in depth we
will keep this comparison here. And we will also upgrade old format EPID
blob to new format here. */
if ((memcmp(&report.body.cpu_svn, &p_epid_blob->key_request.cpu_svn,
sizeof(report.body.cpu_svn)))
|| (report.body.isv_svn != p_epid_blob->key_request.isv_svn)
|| plaintext_old_format.epid_key_version == EPID_KEY_BLOB_VERSION_SIK)
{
se_ret = sgx_seal_data(sizeof(plaintext_epid_data),
(uint8_t *)&plaintext_epid_data,
sizeof(secret_epid_data),
(uint8_t *)&secret_epid_data,
SGX_TRUSTED_EPID_BLOB_SIZE_SDK,
(sgx_sealed_data_t *)local_epid_blob);
BREAK_IF_TRUE(SGX_SUCCESS != se_ret, ret, QE_UNEXPECTED_ERROR);
memcpy(p_epid_blob, local_epid_blob, blob_size);
resealed = TRUE;
}
*p_is_resealed = resealed;
memcpy(p_cpusvn, &report.body.cpu_svn, sizeof(*p_cpusvn));
ret = AE_SUCCESS;
}
while (false);
// Clear the output buffer to make sure nothing leaks.
memset_s(&secret_epid_data, sizeof(secret_epid_data), 0,
sizeof(secret_epid_data));
if (AE_SUCCESS != ret) {
if (p_ctx)
epid_member_delete(&p_ctx);
}
else if (!create_context) {
if (p_ctx)
epid_member_delete(&p_ctx);
}
else {
*pp_epid_context = p_ctx;
}
return ret;
}
/*
* External function used to get quote. Prefix "emp_" means it is a pointer
* points memory outside enclave.
*
* @param p_blob[in, out] Pointer to the EPID Blob.
* @param blob_size[in] The size of EPID Blob, in bytes.
* @param p_enclave_report[in] The application enclave's report.
* @param quote_type[in] The type of quote, random based or name based.
* @param p_spid[in] Pointer to SPID.
* @param p_nonce[in] Pointer to nonce.
* @param emp_sig_rl[in] Pointer to SIG-RL.
* @param sig_rl_size[in] The size of SIG-RL, in bytes.
* @param p_qe_report[out] Pointer to QE report, which reportdata is
* sha256(nonce || quote)
* @param emp_quote[out] Pointer to the output buffer for quote.
* @param quote_size[in] The size of emp_quote, in bytes.
* @param pce_isvsvn[in] The ISVSVN of PCE.
* @return ae_error_t AE_SUCCESS for success, otherwise for errors.
*/
uint32_t get_quote(
uint8_t *p_blob,
uint32_t blob_size,
const sgx_report_t *p_enclave_report,
sgx_quote_sign_type_t quote_type,
const sgx_spid_t *p_spid,
const sgx_quote_nonce_t *p_nonce,
const uint8_t *emp_sig_rl,
uint32_t sig_rl_size,
sgx_report_t *p_qe_report,
uint8_t *emp_quote,
uint32_t quote_size,
sgx_isv_svn_t pce_isvsvn)
{
ae_error_t ret = AE_SUCCESS;
EpidStatus epid_ret = kEpidNoErr;
MemberCtx *p_epid_context = NULL;
sgx_quote_t quote_body;
uint8_t is_resealed = 0;
sgx_basename_t basename = {{0}};
uint64_t sign_size = 0;
sgx_status_t se_ret = SGX_SUCCESS;
sgx_report_t qe_report;
uint64_t required_buffer_size = 0;
se_sig_rl_t sig_rl_header;
se_plaintext_epid_data_sdk_t plaintext;
sgx_ec256_signature_t ec_signature;
sgx_cpu_svn_t cpusvn;
memset("e_body, 0, sizeof(quote_body));
memset(&sig_rl_header, 0, sizeof(sig_rl_header));
memset(&plaintext, 0, sizeof(plaintext));
memset(&ec_signature, 0, sizeof(ec_signature));
memset(&cpusvn, 0, sizeof(cpusvn));
/* Actually, some cases here will be checked with code generated by
edger8r. Here we just want to defend in depth. */
if((NULL == p_blob)
|| (NULL == p_enclave_report)
|| (NULL == p_spid)
|| (NULL == emp_quote)
|| (!quote_size)
|| ((NULL != emp_sig_rl) && (sig_rl_size < sizeof(se_sig_rl_t)
+ 2 * SE_ECDSA_SIGN_SIZE))
//
// this size check could mispredict and cause us to
// overflow, but we have an lfence below
// that's safe to use for this case
//
|| ((NULL == emp_sig_rl) && (sig_rl_size != 0)))
return QE_PARAMETER_ERROR;
if(SGX_TRUSTED_EPID_BLOB_SIZE_SDK != blob_size)
return QE_PARAMETER_ERROR;
//
// this could mispredict and cause us to
// overflow, but we have an lfence below
// that's safe to use for this case
//
if(SGX_LINKABLE_SIGNATURE != quote_type
&& SGX_UNLINKABLE_SIGNATURE != quote_type)
return QE_PARAMETER_ERROR;
if(!p_nonce && p_qe_report)
return QE_PARAMETER_ERROR;
if(p_nonce && !p_qe_report)
return QE_PARAMETER_ERROR;
/* To reduce the memory footprint of QE, we should leave sig_rl and
quote buffer outside enclave. */
if(!sgx_is_outside_enclave(emp_sig_rl, sig_rl_size))
return QE_PARAMETER_ERROR;
//
// for user_check SigRL input
// based on quote_size input parameter
//
sgx_lfence();
if(!sgx_is_outside_enclave(emp_quote, quote_size))
return QE_PARAMETER_ERROR;
/* Check whether p_blob is copied into EPC. If we want to reduce the
memory usage, maybe we can leave the p_blob outside EPC. */
if(!sgx_is_within_enclave(p_blob, blob_size))
return QE_PARAMETER_ERROR;
if(!sgx_is_within_enclave(p_enclave_report, sizeof(*p_enclave_report)))
return QE_PARAMETER_ERROR;
if(!sgx_is_within_enclave(p_spid, sizeof(*p_spid)))
return QE_PARAMETER_ERROR;
/* If the code reach here, if p_nonce is NULL, then p_qe_report will be
NULL also. So we only check p_nonce here.*/
if(p_nonce)
{
/* Actually Edger8r will alloc the buffer within EPC, this is just kind
of defense in depth. */
if(!sgx_is_within_enclave(p_nonce, sizeof(*p_nonce)))
return QE_PARAMETER_ERROR;
if(!sgx_is_within_enclave(p_qe_report, sizeof(*p_qe_report)))
return QE_PARAMETER_ERROR;
}
/* Verify the input report. */
if(SGX_SUCCESS != sgx_verify_report(p_enclave_report))
return QE_PARAMETER_ERROR;
/* Verify EPID p_blob and create the context */
ret = random_stack_advance(verify_blob_internal, p_blob,
blob_size,
&is_resealed,
TRUE,
plaintext,
&p_epid_context,
&cpusvn);
if(AE_SUCCESS != ret)
goto CLEANUP;
/* If SIG-RL is provided, we should check its size. */
if(emp_sig_rl)
{
uint64_t temp_size = 0;
uint64_t n2 = 0;
memcpy(&sig_rl_header, emp_sig_rl, sizeof(sig_rl_header));
if(sig_rl_header.protocol_version != SE_EPID_SIG_RL_VERSION)
{
ret = QE_PARAMETER_ERROR;
goto CLEANUP;
}
if(sig_rl_header.epid_identifier != SE_EPID_SIG_RL_ID)
{
ret = QE_PARAMETER_ERROR;
goto CLEANUP;
}
if(memcmp(&sig_rl_header.sig_rl.gid, &plaintext.epid_group_cert.gid,
sizeof(sig_rl_header.sig_rl.gid)))
{
ret = QE_PARAMETER_ERROR;
goto CLEANUP;
}
temp_size = se_get_sig_rl_size(&sig_rl_header);
if(temp_size != sig_rl_size)
{
ret = QE_PARAMETER_ERROR;
goto CLEANUP;
}
se_static_assert(sizeof(ec_signature.x) == SE_ECDSA_SIGN_SIZE);
se_static_assert(sizeof(ec_signature.y) == SE_ECDSA_SIGN_SIZE);
memcpy(ec_signature.x,
emp_sig_rl + sig_rl_size - (SE_ECDSA_SIGN_SIZE * 2),
sizeof(ec_signature.x));
SWAP_ENDIAN_32B(ec_signature.x);
memcpy(ec_signature.y,
emp_sig_rl + sig_rl_size - (SE_ECDSA_SIGN_SIZE * 1),
sizeof(ec_signature.y));
SWAP_ENDIAN_32B(ec_signature.y);
n2 = SWAP_4BYTES(sig_rl_header.sig_rl.n2);
temp_size = sizeof(EpidSignature) - sizeof(NrProof)
+ n2 * sizeof(NrProof);
if(temp_size > UINT32_MAX)
{
ret = QE_PARAMETER_ERROR;
goto CLEANUP;
}
sign_size = temp_size;
}
else
{
sign_size = sizeof(BasicSignature)
+ sizeof(uint32_t) // rl_ver
+ sizeof(uint32_t); // rl_num
}
/* Verify sizeof basename is large enough and it should always be true*/
se_static_assert(sizeof(basename) > sizeof(*p_spid));
/* Because basename has already been zeroed,
so we don't need to concatenating with 0s.*/
memcpy(&basename, p_spid, sizeof(*p_spid));
if(SGX_UNLINKABLE_SIGNATURE == quote_type)
{
uint8_t *p = (uint8_t *)&basename + sizeof(*p_spid);
se_ret = sgx_read_rand(p, sizeof(basename) - sizeof(*p_spid));
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
}
epid_ret = EpidRegisterBasename(p_epid_context, (uint8_t *)&basename,
sizeof(basename));
if(kEpidNoErr != epid_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
required_buffer_size = SE_QUOTE_LENGTH_WITHOUT_SIG + sign_size;
/* We should make sure the buffer size is big enough. */
if(quote_size < required_buffer_size)
{
ret = QE_PARAMETER_ERROR;
goto CLEANUP;
}
//
// for user_check SigRL input
// based on n2 field in SigRL
//
sgx_lfence();
/* Copy the data in the report into quote body. */
memset(emp_quote, 0, quote_size);
quote_body.version = QE_QUOTE_VERSION;
quote_body.sign_type = (uint16_t)quote_type;
quote_body.pce_svn = pce_isvsvn; // Both are little endian
quote_body.xeid = plaintext.xeid; // Both are little endian
se_static_assert(sizeof(plaintext.epid_group_cert.gid) == sizeof(OctStr32));
se_static_assert(sizeof(quote_body.epid_group_id) == sizeof(uint32_t));
((uint8_t *)("e_body.epid_group_id))[0] = plaintext.epid_group_cert.gid.data[3];
((uint8_t *)("e_body.epid_group_id))[1] = plaintext.epid_group_cert.gid.data[2];
((uint8_t *)("e_body.epid_group_id))[2] = plaintext.epid_group_cert.gid.data[1];
((uint8_t *)("e_body.epid_group_id))[3] = plaintext.epid_group_cert.gid.data[0];
memcpy("e_body.basename, &basename, sizeof(quote_body.basename));
// Get the QE's report.
se_ret = sgx_create_report(NULL, NULL, &qe_report);
if(SGX_SUCCESS != se_ret)
{
ret = QE_PARAMETER_ERROR;
goto CLEANUP;
}
// Copy QE's security version in to Quote body.
quote_body.qe_svn = qe_report.body.isv_svn;
// Copy the incoming report into Quote body.
memcpy("e_body.report_body, &(p_enclave_report->body),
sizeof(quote_body.report_body));
/* Because required_buffer_size is larger than signature_len, so if we
get here, then no integer overflow will ocur. */
quote_body.signature_len = (uint32_t)(sizeof(se_wrap_key_t)
+ QUOTE_IV_SIZE
+ sizeof(uint32_t)
+ sign_size
+ sizeof(sgx_mac_t));
/* Make the signature. */
ret = qe_epid_sign(p_epid_context,
plaintext,
&basename,
emp_sig_rl ? ((const se_sig_rl_t *)emp_sig_rl)->sig_rl.bk
: NULL,
&sig_rl_header,
&ec_signature,
p_enclave_report,
p_nonce,
p_qe_report,
emp_quote,
"e_body,
(uint32_t)sign_size);
if(AE_SUCCESS != ret)
{
// Only need to clean the buffer after the fixed length part.
memset_s(emp_quote + sizeof(sgx_quote_t), quote_size - sizeof(sgx_quote_t),
0, quote_size - sizeof(sgx_quote_t));
goto CLEANUP;
}
memcpy(emp_quote, "e_body, sizeof(sgx_quote_t));
CLEANUP:
if(p_epid_context)
epid_member_delete(&p_epid_context);
return ret;
}
/*
* An internal function used to sign the EPID signature on the quote body.
* Prefix "emp_" means it is a pointer points memory outside enclave.
*
* For quote with SIG-RL
* |--------------------------------------------------------------------|
* |sgx_quote_t|wrap_key_t|iv|payload_size|basic_sig|rl_ver|n2|nrp..|mac|
* |--------------------------------------------------------------------|
* For quote without SIG-RL
* |--------------------------------------------------------------|
* |sgx_quote_t|wrap_key_t|iv|payload_size|basic_sig|rl_ver|n2|mac|
* |--------------------------------------------------------------|
*
* @param p_epid_context[in] Pointer to the EPID context.
* @param plaintext[in] Reference to the plain text part of EPID blob.
* @param p_basename[in] The pointer to basename.
* @param emp_sig_rl_entries[in] The pointer to SIG-RL entries.
* @param p_sig_rl_header[in] The header of SIG-RL, within EPC.
* @param p_sig_rl_signature[in] The ecdsa signature of SIG-RL, within EPC.
* @param p_enclave_report[in] The input isv report.
* @param p_nonce[in] The input nonce.
* @param p_qe_report[out] The output buffer for qe_report.
* @param emp_quote[out] The output buffer for quote.
* @param p_quote_body[in] The quote body in EPC.
* @param sign_size[in] size of the signature.
* @return ae_error_t AE_SUCCESS for success, otherwise for errors.
*/
static ae_error_t qe_epid_sign(
MemberCtx *p_epid_context,
const se_plaintext_epid_data_sdk_t& plaintext,
const sgx_basename_t *p_basename,
const SigRlEntry *emp_sig_rl_entries,
se_sig_rl_t *p_sig_rl_header,
sgx_ec256_signature_t *p_sig_rl_signature,
const sgx_report_t *p_enclave_report,
const sgx_quote_nonce_t *p_nonce,
sgx_report_t *p_qe_report,
uint8_t *emp_quote,
const sgx_quote_t *p_quote_body,
uint32_t sign_size)
{
ae_error_t ret = AE_SUCCESS;
sgx_status_t se_ret = SGX_SUCCESS;
EpidStatus epid_ret = kEpidNoErr;
se_wrap_key_t wrap_key;
BasicSignature basic_sig;
BasicSignature encrypted_basic_sig;
uint8_t aes_iv[QUOTE_IV_SIZE] = {0};
uint8_t aes_key[QE_AES_KEY_SIZE] = {0};
uint8_t aes_tag[SGX_SEAL_TAG_SIZE] = {0};
sgx_report_data_t qe_report_data = {{0}};
sgx_target_info_t report_target;
sgx_ec256_public_t ec_pub_key; // little endian
se_ae_ecdsa_hash_t sig_rl_hash = {{0}};
uint8_t ecc_result = SGX_EC_INVALID_SIGNATURE;
sgx_sha_state_handle_t sha_context = NULL;
sgx_sha_state_handle_t sha_quote_context = NULL;
sgx_aes_state_handle_t aes_gcm_state = NULL;
void *pub_key = NULL;
size_t pub_key_size = 0;
uint8_t* pub_key_buffer = NULL;
sgx_ecc_state_handle_t ecc_handle = NULL;
memset(&wrap_key, 0, sizeof(wrap_key));
memset(&basic_sig, 0, sizeof(basic_sig));
memset(&encrypted_basic_sig, 0, sizeof(encrypted_basic_sig));
memset(&report_target, 0, sizeof(report_target));
memset(&ec_pub_key, 0, sizeof(ec_pub_key));
se_encrypted_sign_t *emp_p = (se_encrypted_sign_t *)
(((sgx_quote_t *)emp_quote)->signature);
uint8_t* emp_nr = NULL;
uint32_t match = FALSE;
/* Sign the quote body and get the basic signature*/
epid_ret = EpidSignBasic(p_epid_context,
(uint8_t *)const_cast<sgx_quote_t *>(p_quote_body),
(uint32_t)QE_QUOTE_BODY_SIZE,
(uint8_t *)const_cast<sgx_basename_t *>(p_basename),
sizeof(*p_basename),
&basic_sig,
NULL); //Random basename, can be NULL if basename is provided
if(kEpidNoErr != epid_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
/* Prepare the context for SHA256 of quote. */
if(p_qe_report)
{
se_ret = sgx_sha256_init(&sha_quote_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
// Update hash for nonce.
se_ret = sgx_sha256_update((uint8_t *)const_cast<sgx_quote_nonce_t *>(p_nonce),
sizeof(*p_nonce),
sha_quote_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
// Update hash for the first part of quote.
se_ret = sgx_sha256_update((uint8_t *)const_cast<sgx_quote_t *>(p_quote_body),
sizeof(*p_quote_body),
sha_quote_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
}
/* Prepare the context for SHA256 and start calculate the hash of header
* of SIG-RL. */
if(emp_sig_rl_entries)
{
se_ret = sgx_sha256_init(&sha_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
/* Calculate the hash of SIG-RL header. */
se_ret = sgx_sha256_update((uint8_t *)p_sig_rl_header,
(uint32_t)(sizeof(se_sig_rl_t) - sizeof(SigRlEntry)),
sha_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
}
// Start encrypt the signature.
/* Get the random wrap key */
se_ret = sgx_read_rand(aes_key, sizeof(aes_key));
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
/* Copy the hash of wrap key into output buffer. */
se_static_assert(sizeof(wrap_key.key_hash) == sizeof(sgx_sha256_hash_t));
se_ret = sgx_sha256_msg(aes_key, sizeof(aes_key),
(sgx_sha256_hash_t *)wrap_key.key_hash);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
/* Start encrypt the wrap key by RSA algorithm. */
se_ret = sgx_create_rsa_pub1_key(sizeof(g_qsdk_pub_key_n),
sizeof(g_qsdk_pub_key_e),
(const unsigned char *)g_qsdk_pub_key_n,
(const unsigned char *)g_qsdk_pub_key_e,
&pub_key);
if(se_ret != SGX_SUCCESS)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
/* Get output buffer size */
se_ret = sgx_rsa_pub_encrypt_sha256(pub_key, NULL, &pub_key_size, aes_key, sizeof(aes_key));
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
se_ret = sgx_rsa_pub_encrypt_sha256(pub_key, wrap_key.encrypted_key, &pub_key_size, aes_key, sizeof(aes_key));
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
/* Create the random AES IV. */
se_ret = sgx_read_rand(aes_iv, sizeof(aes_iv));
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
/* Copy the wrap_key_t into output buffer. */
memcpy(&emp_p->wrap_key, &wrap_key, sizeof(wrap_key));
/* Copy the AES IV into output buffer. */
memcpy(&emp_p->iv, aes_iv, sizeof(aes_iv));
/* Copy the AES Blob payload size into output buffer. */
memcpy(&emp_p->payload_size, &sign_size, sizeof(sign_size));
se_ret = sgx_aes_gcm128_enc_init(
aes_key,
aes_iv, //input initial vector. randomly generated value and encryption of different msg should use different iv
sizeof(aes_iv), //length of initial vector, usually IV_SIZE
NULL,//AAD of AES-GCM, it could be NULL
0, //length of bytes of AAD
&aes_gcm_state);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
memset_s(aes_key, sizeof(aes_key), 0, sizeof(aes_key));
/* Encrypt the basic signature. */
se_ret = sgx_aes_gcm128_enc_update(
(uint8_t *)&basic_sig, //start address to data before/after encryption
sizeof(basic_sig),
(uint8_t *)&encrypted_basic_sig, //length of data
aes_gcm_state); //pointer to a state
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
/* Copy the encrypted basic signature into output buffer. */
memcpy(&emp_p->basic_sign, &encrypted_basic_sig,
sizeof(encrypted_basic_sig));
if(p_qe_report)
{
se_ret = sgx_sha256_update((uint8_t *)&wrap_key,
sizeof(wrap_key),
sha_quote_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
se_ret = sgx_sha256_update(aes_iv,
sizeof(aes_iv),
sha_quote_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
se_ret = sgx_sha256_update((uint8_t *)&sign_size,
sizeof(sign_size),
sha_quote_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
se_ret = sgx_sha256_update((uint8_t *)&encrypted_basic_sig,
sizeof(encrypted_basic_sig),
sha_quote_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
}
/* Start process the SIG-RL. */
if(emp_sig_rl_entries)
{
unsigned int entry_count = 0;
unsigned int i = 0;
RLver_t encrypted_rl_ver = {{0}};
RLCount encrypted_n2 = {{0}};
entry_count = lv_ntohl(p_sig_rl_header->sig_rl.n2);//entry count for big endian to little endian
// Continue encrypt the output
se_ret = sgx_aes_gcm128_enc_update(
(uint8_t *)&(p_sig_rl_header->sig_rl.version), //start address to data before/after encryption
sizeof(p_sig_rl_header->sig_rl.version),
(uint8_t *)&encrypted_rl_ver, //length of data
aes_gcm_state); //pointer to a state
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
se_ret = sgx_aes_gcm128_enc_update(
(uint8_t *)&(p_sig_rl_header->sig_rl.n2), //start address to data before/after encryption
sizeof(p_sig_rl_header->sig_rl.n2),
(uint8_t *)&encrypted_n2, //length of data
aes_gcm_state); //pointer to a state
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
memcpy(&(emp_p->rl_ver), &encrypted_rl_ver,
sizeof(encrypted_rl_ver));
memcpy(&(emp_p->rl_num), &encrypted_n2,
sizeof(encrypted_n2));
if(p_qe_report)
{
se_ret = sgx_sha256_update((uint8_t *)&encrypted_rl_ver,
sizeof(encrypted_rl_ver),
sha_quote_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
se_ret = sgx_sha256_update((uint8_t *)&encrypted_n2,
sizeof(encrypted_n2),
sha_quote_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
}
/* Start process the SIG-RL entries one by one. */
emp_nr = emp_p->nrp_mac;
for (i = 0; i < entry_count; i++, emp_nr += sizeof(NrProof))
{
/* Generate non-revoke prove one by one. */
SigRlEntry entry;
NrProof temp_nr;
NrProof encrypted_temp_nr;
memcpy(&entry, emp_sig_rl_entries + i, sizeof(entry));
memset_s(&temp_nr, sizeof(temp_nr), 0, sizeof(temp_nr));
memset_s(&encrypted_temp_nr, sizeof(encrypted_temp_nr), 0, sizeof(encrypted_temp_nr));
epid_ret = EpidNrProve(p_epid_context,
(uint8_t *)const_cast<sgx_quote_t *>(p_quote_body),
(uint32_t)QE_QUOTE_BODY_SIZE,
(uint8_t *)const_cast<sgx_basename_t *>(p_basename), // basename is required, otherwise it will return kEpidBadArgErr
sizeof(*p_basename),
&basic_sig, // Basic signature with 'b' and 'k' in it
&entry, //Single entry in SigRl composed of 'b' and 'k'
&temp_nr); // The generated non-revoked proof
if(kEpidNoErr != epid_ret)
{
if(kEpidSigRevokedInSigRl == epid_ret)
match = TRUE;
else
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
}
/* Update the hash of SIG-RL */
se_ret = sgx_sha256_update((uint8_t *)&entry,
sizeof(entry), sha_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
se_ret = sgx_aes_gcm128_enc_update(
(uint8_t *)&temp_nr, //start address to data before/after encryption
sizeof(encrypted_temp_nr),
(uint8_t *)&encrypted_temp_nr, //length of data
aes_gcm_state); //pointer to a state
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
memcpy(emp_nr, &encrypted_temp_nr, sizeof(encrypted_temp_nr));
if(p_qe_report)
{
se_ret = sgx_sha256_update((uint8_t *)&encrypted_temp_nr,
sizeof(encrypted_temp_nr),
sha_quote_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
}
}
/* Get the final hash of the whole SIG-RL. */
se_ret = sgx_sha256_get_hash(sha_context,
(sgx_sha256_hash_t *)&sig_rl_hash.hash);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
/* Verify the integrity of SIG-RL by check ECDSA signature. */
se_static_assert(sizeof(ec_pub_key) == sizeof(plaintext.epid_sk));
// Both plaintext.epid_sk and ec_pub_key are little endian
memcpy(&ec_pub_key, plaintext.epid_sk, sizeof(ec_pub_key));
se_ret = sgx_ecc256_open_context(&ecc_handle);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
// sgx_ecdsa_verify_hash will take ec_pub_key as little endian
se_ret = sgx_ecdsa_verify_hash((uint8_t*)&(sig_rl_hash.hash),
(const sgx_ec256_public_t *)&ec_pub_key,
p_sig_rl_signature,
&ecc_result,
ecc_handle);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
else if(SGX_EC_VALID != ecc_result)
{
ret = QE_SIGRL_ERROR;
goto CLEANUP;
}
else if(match)
{
ret = QE_REVOKED_ERROR;
goto CLEANUP;
}
}
else
{
se_static_assert(sizeof(emp_p->rl_ver) == sizeof(RLver_t));
se_static_assert(sizeof(emp_p->rl_num) == sizeof(RLCount));
uint8_t temp_buf[sizeof(RLver_t) + sizeof(RLCount)] = {0};
uint8_t encrypted_temp_buf[sizeof(temp_buf)] = {0};
se_ret = sgx_aes_gcm128_enc_update(
(uint8_t *)&temp_buf, //start address to data before/after encryption
sizeof(encrypted_temp_buf),
(uint8_t *)&encrypted_temp_buf, //length of data
aes_gcm_state); //pointer to a state
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
/* This will copy both encrypted rl_ver and encrypted rl_num into
Output buffer. */
memcpy(&emp_p->rl_ver, &encrypted_temp_buf,
sizeof(encrypted_temp_buf));
if(p_qe_report)
{
se_ret = sgx_sha256_update((uint8_t *)&encrypted_temp_buf,
sizeof(encrypted_temp_buf),
sha_quote_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
}
}
se_ret = sgx_aes_gcm128_enc_get_mac(aes_tag, aes_gcm_state);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
memcpy((uint8_t *)&(emp_p->basic_sign) + sign_size, &aes_tag,
sizeof(aes_tag));
if(p_qe_report)
{
se_ret = sgx_sha256_update(aes_tag, sizeof(aes_tag),
sha_quote_context);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
se_ret = sgx_sha256_get_hash(sha_quote_context,
(sgx_sha256_hash_t *)&qe_report_data);
if(SGX_SUCCESS != se_ret)
{
ret = QE_UNEXPECTED_ERROR;
goto CLEANUP;
}
memcpy(&(report_target.attributes),
&(((const sgx_report_t *)p_enclave_report)->body.attributes),
sizeof(report_target.attributes));
memcpy(&(report_target.mr_enclave),
&(((const sgx_report_t *)p_enclave_report)->body.mr_enclave),
sizeof(report_target.mr_enclave));
memcpy(&(report_target.misc_select),
&(((const sgx_report_t *)p_enclave_report)->body.misc_select),
sizeof(report_target.misc_select));
se_ret = sgx_create_report(&report_target, &qe_report_data, p_qe_report);
if(SGX_SUCCESS != se_ret)
{
ret = QE_PARAMETER_ERROR;
goto CLEANUP;
}
}
CLEANUP:
memset_s(aes_key, sizeof(aes_key), 0, sizeof(aes_key));
sgx_sha256_close(sha_context);
sgx_sha256_close(sha_quote_context);
if (aes_gcm_state)
sgx_aes_gcm_close(aes_gcm_state);
if (pub_key)
sgx_free_rsa_key(pub_key, SGX_RSA_PUBLIC_KEY, sizeof(plaintext.qsdk_mod), sizeof(plaintext.qsdk_exp));
if (pub_key_buffer)
free(pub_key_buffer);
if (ecc_handle)
sgx_ecc256_close_context(ecc_handle);
return ret;
}
//Function to create data for ProvMsg3 generation
// The sigrl of ProvMsg2 will processed in this function in piece-meal method
//@msg2_blob_input: structure to hold decoded data of ProvMsg2
//@performance_rekey_used[in]: 1 if performance rekey used or 0 if not
//@msg3_parm: structure to hold most information to generate ProvMsg3
//@msg3_output: structure to hold output data to create ProvMsg3
//@emp_epid_sig: output buffer to external memory for variable length EpidSignature
//@epid_sig_buffer_size: size in bytes of buffer emp_epid_sig
//@return PVEC_SUCCESS on success and error code if failed
pve_status_t gen_prov_msg3_data(const proc_prov_msg2_blob_input_t *msg2_blob_input,
prov_msg3_parm_t& msg3_parm,
uint8_t performance_rekey_used,
gen_prov_msg3_output_t *msg3_output,
external_memory_byte_t *emp_epid_sig,
uint32_t epid_sig_buffer_size)
{
pve_status_t ret = PVEC_SUCCESS;
sgx_status_t sgx_status = SGX_ERROR_UNEXPECTED;
uint8_t temp_buf[JOIN_PROOF_TLV_TOTAL_SIZE];
uint8_t *data_to_encrypt = NULL;
uint8_t size_to_encrypt = 0;
uint8_t pwk2_tlv_buffer[PWK2_TLV_TOTAL_SIZE];
sgx_key_128bit_t *pwk2=reinterpret_cast<sgx_key_128bit_t *>(pwk2_tlv_buffer+PWK2_TLV_HEADER_SIZE);
uint8_t report_data_payload[MAC_SIZE + HARD_CODED_JOIN_PROOF_WITH_ESCROW_TLV_SIZE + NONCE_2_SIZE + PEK_MOD_SIZE];
uint8_t* pdata = &report_data_payload[0];
sgx_report_data_t report_data = { 0 };
uint8_t aad[sizeof(GroupId)+sizeof(device_id_t)+CHALLENGE_NONCE_SIZE];
void *pub_key = NULL;
const signed_pek_t& pek = msg2_blob_input->pek;
uint32_t le_e;
int i;
size_t output_len = 0;
uint8_t le_n[sizeof(pek.n)];
static_assert(sizeof(pek.n)==384, "pek.n should be 384 bytes");
device_id_t *device_id_in_aad= (device_id_t *)(aad+sizeof(GroupId));
join_proof_with_escrow_t* join_proof_with_escrow=reinterpret_cast<join_proof_with_escrow_t *>(temp_buf+JOIN_PROOF_TLV_HEADER_SIZE);
se_static_assert(sizeof(join_proof_with_escrow_t)+JOIN_PROOF_TLV_HEADER_SIZE==JOIN_PROOF_TLV_TOTAL_SIZE); /*unmatched hardcoded size*/
se_static_assert(sizeof(sgx_key_128bit_t)==PWK2_TLV_TOTAL_SIZE-PWK2_TLV_HEADER_SIZE); /*unmatched PWK2 size*/
memset(temp_buf, 0 ,sizeof(temp_buf));
memset(aad, 0, sizeof(aad));
memset(pwk2, 0, sizeof(sgx_key_128bit_t));
memcpy(pwk2_tlv_buffer, PWK2_TLV_HEADER, PWK2_TLV_HEADER_SIZE);
msg3_output->is_join_proof_generated=false;
msg3_output->is_epid_sig_generated=false;
if ((msg2_blob_input->pce_target_info.attributes.flags & SGX_FLAGS_PROVISION_KEY) != SGX_FLAGS_PROVISION_KEY ||
(msg2_blob_input->pce_target_info.attributes.flags & SGX_FLAGS_DEBUG) != 0){
//PCE must have access to provisioning key
//Can't be debug PCE
ret = PVEC_PARAMETER_ERROR;
goto ret_point;
}
if(!performance_rekey_used){
//the temp_buf used for join_proof_with_escrow tlv
memcpy(temp_buf, JOIN_PROOF_TLV_HEADER, JOIN_PROOF_TLV_HEADER_SIZE);//first copy in tlv header
ret = random_stack_advance(gen_msg3_join_proof_escrow_data, msg2_blob_input, *join_proof_with_escrow);//generate the tlv payload
if( PVEC_SUCCESS != ret )
goto ret_point;
msg3_output->is_join_proof_generated = true;
data_to_encrypt = temp_buf;
size_to_encrypt = JOIN_PROOF_TLV_TOTAL_SIZE;
}
//now encrypt field1
ret = se_read_rand_error_to_pve_error(sgx_read_rand(msg3_output->field1_iv, IV_SIZE));//randomly generate IV
if( PVEC_SUCCESS != ret)
goto ret_point;
memcpy(aad, &msg2_blob_input->group_cert.key.gid,sizeof(GroupId));//start to prepare AAD
memcpy(&device_id_in_aad->fmsp, &msg2_blob_input->equiv_pi.fmsp, sizeof(fmsp_t));
memcpy(&device_id_in_aad->psvn.cpu_svn, &msg2_blob_input->equiv_pi.cpu_svn, sizeof(sgx_cpu_svn_t));
memcpy(&device_id_in_aad->psvn.isv_svn, &msg2_blob_input->equiv_pi.pve_svn, sizeof(sgx_isv_svn_t));
memset(&device_id_in_aad->ppid, 0, sizeof(device_id_in_aad->ppid));
ret = pve_rng_generate(NONCE_2_SIZE*8, msg3_output->n2);
if(PVEC_SUCCESS !=ret){
goto ret_point;
}
ret = random_stack_advance(get_pwk2, &device_id_in_aad->psvn, msg3_output->n2, pwk2);
if( PVEC_SUCCESS != ret )
goto ret_point;
memcpy(aad+sizeof(GroupId)+sizeof(device_id_t), msg2_blob_input->challenge_nonce, CHALLENGE_NONCE_SIZE);
se_static_assert(sizeof(sgx_aes_gcm_128bit_key_t)==SK_SIZE); /*sizeof sgx_aes_gcm_128bit_key_t should be same as TCB size*/
se_static_assert(sizeof(sgx_aes_gcm_128bit_tag_t)==MAC_SIZE); /*sizeof sgx_aes_gcm_128bit_tag_t should be same as MAC_SIZE*/
sgx_status = sgx_rijndael128GCM_encrypt(reinterpret_cast<const sgx_aes_gcm_128bit_key_t *>(pwk2),
data_to_encrypt, size_to_encrypt, msg3_output->field1_data,
msg3_output->field1_iv, IV_SIZE, aad, static_cast<uint32_t>(sizeof(GroupId)+sizeof(device_id_t)+CHALLENGE_NONCE_SIZE),
reinterpret_cast<sgx_aes_gcm_128bit_tag_t *>(msg3_output->field1_mac));//encrypt field1
if(SGX_SUCCESS != sgx_status){
ret = sgx_error_to_pve_error(sgx_status);
goto ret_point;
}
if( msg2_blob_input->is_previous_pi_provided ){
//preparing the encryption state of ProvMsg3 and encrypt inplace of msg3_inside enclave (field1_0 and field1_1)
//The function will randomly set the iv value too
ret = proc_msg3_state_init(&msg3_parm, pwk2);
if( PVEC_SUCCESS!=ret )
goto ret_point;
//Now start piece-meal generation of EPIDsign
ret = gen_msg3_signature(msg2_blob_input, &msg3_parm, emp_epid_sig, epid_sig_buffer_size);
if( PVEC_SUCCESS!=ret )
goto ret_point;
msg3_output->is_epid_sig_generated = true;
msg3_output->epid_sig_output_size = epid_sig_buffer_size;
memcpy(msg3_output->epid_sig_iv, msg3_parm.iv, IV_SIZE);
//generate MAC in EPC
ret = sgx_error_to_pve_error(sgx_aes_gcm128_enc_get_mac(msg3_output->epid_sig_mac, (sgx_aes_state_handle_t*)msg3_parm.p_msg3_state));
if (PVEC_SUCCESS != ret)
goto ret_point;
}
le_e = lv_ntohl(pek.e);
se_static_assert(sizeof(pek.n)==sizeof(le_n)); /*unmatched size of pek.n*/
//endian swap
for(i=0;i<(int)(sizeof(pek.n)/sizeof(pek.n[0]));i++){
le_n[i]=pek.n[sizeof(pek.n)/sizeof(pek.n[0])-i-1];
}
sgx_status = sgx_create_rsa_pub_key(sizeof(pek.n), sizeof(pek.e),
reinterpret_cast<const unsigned char *>(le_n), reinterpret_cast<const unsigned char *>(&le_e), &pub_key);
if (SGX_SUCCESS != sgx_status) {
ret = sgx_error_to_pve_error(sgx_status);
goto ret_point;
}
sgx_status = sgx_rsa_pub_encrypt_sha256(pub_key, NULL, &output_len, reinterpret_cast<const unsigned char*>(pwk2_tlv_buffer),
PWK2_TLV_TOTAL_SIZE);
if (SGX_SUCCESS != sgx_status) {
ret = sgx_error_to_pve_error(sgx_status);
goto ret_point;
}
sgx_status = sgx_rsa_pub_encrypt_sha256(pub_key, msg3_output->encrypted_pwk2, &output_len, reinterpret_cast<const unsigned char*>(pwk2_tlv_buffer),
PWK2_TLV_TOTAL_SIZE);
if (SGX_SUCCESS != sgx_status) {
ret = sgx_error_to_pve_error(sgx_status);
goto ret_point;
}
// X = (NT)MAC_PWK2(... (NT)E_PWK2((T)(JoinP, f)) ...) | (NT)E_PWK2((T)(JoinP, f)) | (NT)PWK2N | (NT)E_PEK((T)PWK2)
// REPORT.ReportData == SHA256[X]
memcpy(pdata, msg3_output->field1_mac, MAC_SIZE);
pdata += MAC_SIZE;
if (!performance_rekey_used){
memcpy(pdata, msg3_output->field1_data, HARD_CODED_JOIN_PROOF_WITH_ESCROW_TLV_SIZE);
pdata += HARD_CODED_JOIN_PROOF_WITH_ESCROW_TLV_SIZE;
}
memcpy(pdata, msg3_output->n2, NONCE_2_SIZE);
pdata += NONCE_2_SIZE;
memcpy(pdata, msg3_output->encrypted_pwk2, PEK_MOD_SIZE);
pdata += PEK_MOD_SIZE;
se_static_assert(sizeof(report_data) >= sizeof(sgx_sha256_hash_t)); /*report data is no large enough*/
sgx_status = sgx_sha256_msg(report_data_payload, (uint32_t)(pdata - &report_data_payload[0]), reinterpret_cast<sgx_sha256_hash_t *>(&report_data));
if (SGX_SUCCESS != sgx_status){
ret = sgx_error_to_pve_error(sgx_status);
goto ret_point;
}
sgx_status = sgx_create_report(&msg2_blob_input->pce_target_info, &report_data, &msg3_output->pwk2_report);
if (SGX_SUCCESS != sgx_status){
ret = sgx_error_to_pve_error(sgx_status);
goto ret_point;
}
ret_point:
(void)memset_s(aad, sizeof(aad), 0, sizeof(aad));
(void)memset_s(temp_buf, sizeof(temp_buf), 0, sizeof(temp_buf));
(void)memset_s(pwk2_tlv_buffer, sizeof(pwk2_tlv_buffer),0,sizeof(pwk2_tlv_buffer));
if(pub_key){
sgx_free_rsa_key(pub_key, SGX_RSA_PUBLIC_KEY, sizeof(pek.n), sizeof(pek.e));
}
return ret;
}
//Function to decode ProvMsg4 and generate epid data blob
uint32_t CPVEClass::proc_prov_msg4(
const pve_data_t &data,
const uint8_t *msg4,
uint32_t msg4_size,
uint8_t *data_blob,
uint32_t blob_size)
{
ae_error_t ret = AE_SUCCESS;
uint8_t local_ek2[SK_SIZE];
uint8_t *decoded_msg4 = NULL;
uint8_t temp[XID_SIZE+NONCE_SIZE];
sgx_status_t sgx_status;
const provision_response_header_t *msg4_header = reinterpret_cast<const provision_response_header_t *>(msg4);
if(msg4_size < PROVISION_RESPONSE_HEADER_SIZE) {
AESM_DBG_ERROR("invalid msg4 size");
return PVE_MSG_ERROR;
}
if (blob_size != SGX_TRUSTED_EPID_BLOB_SIZE_PAK) {
AESM_DBG_FATAL("invalid input epid blob size");
return PVE_PARAMETER_ERROR;
}
ret = check_prov_msg4_header(msg4_header, msg4_size);
if( AE_SUCCESS != ret) {
AESM_DBG_ERROR("Invalid ProvMsg4 Header:(ae%d)",ret);
return ret;
}
if(0!=memcmp(msg4_header->xid, data.xid, XID_SIZE)) {
AESM_DBG_ERROR("Invalid XID in msg4 header");
return PVE_MSG_ERROR;
}
ret = check_epid_pve_pg_status_before_mac_verification(msg4_header);
if( AE_SUCCESS != ret) {
AESM_DBG_ERROR("Backend return failure in ProvMsg4 Header:(ae%d)",ret);
return ret;
}
do {
TLVsMsg tlvs_msg4;
uint8_t aad[PROVISION_RESPONSE_HEADER_SIZE+NONCE_SIZE];
tlv_status_t tlv_status;
tlv_status = tlvs_msg4.init_from_buffer(msg4+static_cast<uint32_t>(PROVISION_RESPONSE_HEADER_SIZE), msg4_size - static_cast<uint32_t>(PROVISION_RESPONSE_HEADER_SIZE));
ret = tlv_error_2_pve_error(tlv_status);
if(AE_SUCCESS!=ret) {
AESM_DBG_ERROR("fail to decode ProvMsg4:(ae%d)",ret);
break;
}
ret = msg4_integrity_checking(tlvs_msg4);
if(AE_SUCCESS != ret) {
AESM_DBG_ERROR("ProvMsg4 integrity checking error:(ae%d)",ret);
break;
}
AESM_DBG_TRACE("ProvMsg4 decoded");
se_static_assert(sizeof(sgx_cmac_128bit_key_t)==SK_SIZE);
if(0!=memcpy_s(temp,sizeof(temp), data.xid, XID_SIZE)||
0!=memcpy_s(temp+XID_SIZE, sizeof(temp)-XID_SIZE, MSG4_TOP_FIELD_NONCE.payload, NONCE_SIZE)) {
AESM_DBG_ERROR("Fail in memcpy");
ret = AE_FAILURE;
break;
}
if((sgx_status=sgx_rijndael128_cmac_msg(reinterpret_cast<const sgx_cmac_128bit_key_t *>(data.sk),
temp, XID_SIZE+NONCE_SIZE, reinterpret_cast<sgx_cmac_128bit_tag_t *>(local_ek2)))!=SGX_SUCCESS) {
AESM_DBG_ERROR("Fail to generate ek2:(sgx0x%x)",sgx_status);
ret = AE_FAILURE;
break;
}
se_static_assert(SK_SIZE==sizeof(sgx_aes_gcm_128bit_key_t));
tlv_msg_t field1 = block_cipher_tlv_get_encrypted_text(MSG4_TOP_FIELD_DATA);
decoded_msg4 = reinterpret_cast<uint8_t *>(malloc(field1.msg_size));
if(NULL == decoded_msg4) {
AESM_DBG_ERROR("malloc error");
ret = AE_OUT_OF_MEMORY_ERROR;
break;
}
if (memcpy_s(aad, sizeof(aad), msg4_header, PROVISION_RESPONSE_HEADER_SIZE) != 0 ||
memcpy_s(aad + PROVISION_RESPONSE_HEADER_SIZE, sizeof(aad)-PROVISION_RESPONSE_HEADER_SIZE,
MSG4_TOP_FIELD_NONCE.payload, MSG4_TOP_FIELD_NONCE.size) != 0) {
AESM_DBG_ERROR("memcpy failure");
ret = AE_FAILURE;
break;
}
sgx_status_t sgx_status = sgx_rijndael128GCM_decrypt(reinterpret_cast<const sgx_aes_gcm_128bit_key_t *>(local_ek2),
field1.msg_buf, field1.msg_size, decoded_msg4,
reinterpret_cast<uint8_t *>(block_cipher_tlv_get_iv(MSG4_TOP_FIELD_DATA)), IV_SIZE,
aad, sizeof(aad),
reinterpret_cast<const sgx_aes_gcm_128bit_tag_t *>(MSG4_TOP_FIELD_MAC.payload));
if(SGX_ERROR_MAC_MISMATCH == sgx_status) {
AESM_DBG_ERROR("fail to decrypt ProvMsg4 by EK2 (sgx0x%x)",sgx_status);
ret = PVE_INTEGRITY_CHECK_ERROR;
break;
}
if( AE_SUCCESS != (ret = sgx_error_to_ae_error(sgx_status))) {
AESM_DBG_ERROR("error in decrypting ProvMsg4:(sgx0x%x)",sgx_status);
break;
}
AESM_DBG_TRACE("ProvMsg4 decrypted by EK2 successfully");
ret = check_epid_pve_pg_status_after_mac_verification(msg4_header);
if(AE_SUCCESS != ret) {
AESM_DBG_ERROR("Backend reported error passed MAC verification:(ae%d)",ret);
break;
}
TLVsMsg tlvs_field1;
tlv_status = tlvs_field1.init_from_buffer(decoded_msg4, field1.msg_size);
ret = tlv_error_2_pve_error(tlv_status);
if(AE_SUCCESS != ret) {
AESM_DBG_ERROR("ProvMsg4 Field2.1 decoding failed:(ae%d)",ret);
break;
}
ret = msg4_field1_msg_checking(tlvs_field1);
if( AE_SUCCESS != ret) {
AESM_DBG_ERROR("ProvMsg4 Field2.1 invalid:(ae%d)",ret);
break;
}
proc_prov_msg4_input_t msg4_input;
tlv_msg_t Axf_data = block_cipher_tlv_get_encrypted_text(MSG4_FIELD1_ENC_Axf);
if(0!=memcpy_s(&msg4_input.group_cert, sizeof(msg4_input.group_cert), MSG4_FIELD1_GROUP_CERT.payload, MSG4_FIELD1_GROUP_CERT.size)||
0!=memcpy_s(&msg4_input.n2, NONCE_2_SIZE, MSG4_FIELD1_Nonce2.payload, MSG4_FIELD1_Nonce2.size) ||
0!=memcpy_s(&msg4_input.equivalent_psvn, sizeof(psvn_t), platform_info_tlv_get_psvn(MSG4_FIELD1_PLATFORM_INFO), sizeof(psvn_t))||
0!=memcpy_s(&msg4_input.fmsp, sizeof(fmsp_t), platform_info_tlv_get_fmsp(MSG4_FIELD1_PLATFORM_INFO), sizeof(fmsp_t))||
0!=memcpy_s(&msg4_input.member_credential_iv, IV_SIZE, block_cipher_tlv_get_iv(MSG4_FIELD1_ENC_Axf), IV_SIZE)||
0!=memcpy_s(&msg4_input.encrypted_member_credential, HARD_CODED_EPID_MEMBER_WITH_ESCROW_TLV_SIZE, Axf_data.msg_buf, Axf_data.msg_size)||
0!=memcpy_s(&msg4_input.member_credential_mac, MAC_SIZE, MSG4_FIELD1_MAC_Axf.payload, MSG4_FIELD1_MAC_Axf.size)) {
AESM_DBG_ERROR("memcpy error");
ret = PVE_UNEXPECTED_ERROR;
break;
}
if (AE_SUCCESS != (ret =XEGDBlob::instance().read(msg4_input.xegb))) {
AESM_DBG_ERROR("Fail to read extend epid blob info (ae%d)",ret);
return ret;
}
ret = CPVEClass::instance().load_enclave();//Load PvE enclave now
if( ret != AE_SUCCESS) {
AESM_DBG_ERROR("Fail to load PvE enclave:(ae%d)\n",ret);
break;
}
ret = (ae_error_t)proc_prov_msg4_data(&msg4_input, reinterpret_cast<proc_prov_msg4_output_t *>(data_blob));
AESM_DBG_TRACE("PvE return (ae%d) in Process ProvMsg4",ret);
} while(0);
if(decoded_msg4)free(decoded_msg4);
return ret;
}
