diff options
author | Jerome Forissier <jerome.forissier@linaro.org> | 2014-12-04 15:26:47 +0100 |
---|---|---|
committer | Jerome Forissier <jerome.forissier@linaro.org> | 2015-01-16 15:27:19 +0100 |
commit | cdb198a7dbc3a5787edb53f5d2a256e5738d4377 (patch) | |
tree | 7788999fcae164b0d904a7a8744e78c5b941b679 /core/tee/sub.mk | |
parent | 8854d3c6c052cddc4e77ec7bd2d6b9f0f2368ab6 (diff) |
Add HMAC-based extract-and-expand key derivation function (HKDF)
HKDF (http://tools.ietf.org/html/rfc5869) is a key derivation algorithm.
As per the RFC:
A key derivation function (KDF) is a basic and essential component of
cryptographic systems. Its goal is to take some source of initial
keying material and derive from it one or more cryptographically
strong secret keys.
[...]
HKDF follows the "extract-then-expand" paradigm, where the KDF
logically consists of two modules.
[...]
The goal of the "extract" stage is to "concentrate" the possibly
dispersed entropy of the input keying material into a short, but
cryptographically strong, pseudorandom key.
[...]
The second stage "expands" the pseudorandom key to the desired
length; the number and lengths of the output keys depend on the
specific cryptographic algorithms for which the keys are needed.
Since HKDF is not covered by the GlobalPlatform Internal API specification
v1.0/v1.1, this commit introduces extensions to the specification.
More specifically: it defines new algorithms, a new object type and new
object attributes. This implementation supports all the usual hash
functions (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512) and may
produce output keys of length up to 4096 bits (currently limited only by
the maximum size allowed for an object of type TEE_TYPE_GENERIC_SECRET).
Aside from minor updates to object manipulation functions to support
the new data, the function TEE_DeriveKey() is mostly impacted.
The file documentation/extensions/crypto_hkdf.md contains the modifications
to the GP Internal API v1.0 spec in order to support HKDF.
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Xiaoqiang Du <xiaoqiang.du@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Tested-by: Pascal Brand <pascal.brand@linaro.org> (STM platform)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Diffstat (limited to 'core/tee/sub.mk')
-rw-r--r-- | core/tee/sub.mk | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/core/tee/sub.mk b/core/tee/sub.mk index 3c72c1f5..0d3ab404 100644 --- a/core/tee/sub.mk +++ b/core/tee/sub.mk @@ -1,16 +1,23 @@ CFG_CRYPTO ?= y ifeq (y,$(CFG_CRYPTO)) + +# HMAC-based Extract-and-Expand Key Derivation Function +# http://tools.ietf.org/html/rfc5869 +# This is an OP-TEE extension, not part of the GlobalPlatform Internal API v1.0 +CFG_CRYPTO_HKDF ?= y + # NIST SP800-56A Concatenation Key Derivation Function # This is an OP-TEE extension CFG_CRYPTO_CONCAT_KDF ?= y + endif srcs-y += tee_svc.c srcs-y += tee_svc_cryp.c srcs-y += tee_svc_storage.c - srcs-y += tee_cryp_utl.c +srcs-$(CFG_CRYPTO_HKDF) += tee_cryp_hkdf.c srcs-$(CFG_CRYPTO_CONCAT_KDF) += tee_cryp_concat_kdf.c srcs-y += tee_fs.c srcs-y += tee_obj.c |