From 666cd6a0ba8fc4184f959742dec9018be12e114b Mon Sep 17 00:00:00 2001 From: Conor Patrick Date: Sun, 27 Oct 2019 08:40:06 -0400 Subject: [PATCH] migrate certs --- fido2/storage.h | 1 + targets/stm32l432/src/app.h | 2 + targets/stm32l432/src/attestation.c | 11 +++- targets/stm32l432/src/device.c | 86 +++++++++++++++++++++++++++ targets/stm32l432/src/memory_layout.h | 6 +- 5 files changed, 100 insertions(+), 6 deletions(-) diff --git a/fido2/storage.h b/fido2/storage.h index 271e234..077afef 100644 --- a/fido2/storage.h +++ b/fido2/storage.h @@ -53,6 +53,7 @@ typedef struct uint16_t key_lens[MAX_KEYS]; uint8_t key_space[KEY_SPACE_BYTES]; uint8_t data_version; + uint8_t flags; } AuthenticatorState_0x01; typedef AuthenticatorState_0x01 AuthenticatorState; diff --git a/targets/stm32l432/src/app.h b/targets/stm32l432/src/app.h index fcd5629..351e4ca 100644 --- a/targets/stm32l432/src/app.h +++ b/targets/stm32l432/src/app.h @@ -78,4 +78,6 @@ void hw_init(int lf); #define SKIP_BUTTON_CHECK_WITH_DELAY 0 #define SKIP_BUTTON_CHECK_FAST 0 +#define SOLO_FLAG_LOCKED 0x2 + #endif diff --git a/targets/stm32l432/src/attestation.c b/targets/stm32l432/src/attestation.c index 5ce64fe..db06ea5 100644 --- a/targets/stm32l432/src/attestation.c +++ b/targets/stm32l432/src/attestation.c @@ -98,9 +98,14 @@ const uint16_t attestation_hacker_cert_der_size = sizeof(attestation_hacker_cert // const uint16_t attestation_key_size = 32; const uint8_t * attestation_cert_der = ((flash_attestation_page *)ATTESTATION_PAGE_ADDR)->attestation_cert; +#include "log.h" uint16_t attestation_cert_der_get_size(){ - return ((flash_attestation_page *)ATTESTATION_PAGE_ADDR)->attestation_cert_size; + uint16_t sz = (uint16_t)((flash_attestation_page *)ATTESTATION_PAGE_ADDR)->attestation_cert_size; + + printf1(TAG_GREEN,"CERT SIZE: %d\r\n", sz); + printf1(TAG_GREEN,"CERT bytes: \r\n"); + dump_hex1(TAG_GREEN, attestation_cert_der, sz); + + return sz; } - -const uint diff --git a/targets/stm32l432/src/device.c b/targets/stm32l432/src/device.c index dd4e9c5..2285038 100644 --- a/targets/stm32l432/src/device.c +++ b/targets/stm32l432/src/device.c @@ -191,6 +191,90 @@ void device_init_button(void) } } +/** device_migrate + * Depending on version of device, migrates: + * * Moves attestation certificate to data segment. + * * Creates locked variable and stores in data segment. + * + * Once in place, this allows all devices to accept same firmware, + * rather than using "hacker" and "secure" builds. +*/ +static void device_migrate(){ + extern const uint16_t attestation_solo_cert_der_size; + extern const uint16_t attestation_hacker_cert_der_size; + + extern uint8_t attestation_solo_cert_der[]; + extern uint8_t attestation_hacker_cert_der[]; + + AuthenticatorState state; + authenticator_read_state(&state); + printf1(TAG_GREEN,"flags: %02x\r\n", state.flags); + // if (state.flags == 0xFF) + { + printf1(TAG_GREEN,"MIGRATING\r\n"); + // do migrate. + state.flags = 0; + + // Read current device lock level. + uint32_t optr = FLASH->OPTR; + if ((optr & 0xff) != 0xAA){ + state.flags |= SOLO_FLAG_LOCKED; + } + + uint8_t tmp_attestation_key[32]; + + memmove(tmp_attestation_key, + ((flash_attestation_page *)ATTESTATION_PAGE_ADDR)->attestation_key, + 32); + + flash_erase_page(ATTESTATION_PAGE); + flash_write( + (uint32_t)((flash_attestation_page *)ATTESTATION_PAGE_ADDR)->attestation_key, + tmp_attestation_key, + 32 + ); + + // Check if this is Solo Hacker attestation (not confidential) + // then write solo or hacker attestation cert to flash page. + uint8_t solo_hacker_attestation_key[32] = "\x1b\x26\x26\xec\xc8\xf6\x9b\x0f\x69\xe3\x4f" + "\xb2\x36\xd7\x64\x66\xba\x12\xac\x16\xc3\xab" + "\x57\x50\xba\x06\x4e\x8b\x90\xe0\x24\x48"; + + if (memcmp(solo_hacker_attestation_key, + tmp_attestation_key, + 32) == 0) + { + printf1(TAG_GREEN,"Updating solo hacker cert\r\n"); + flash_write_dword( + (uint32_t)&((flash_attestation_page *)ATTESTATION_PAGE_ADDR)->attestation_cert_size, + (uint64_t)attestation_hacker_cert_der_size + ); + flash_write( + (uint32_t)((flash_attestation_page *)ATTESTATION_PAGE_ADDR)->attestation_cert, + attestation_hacker_cert_der, + attestation_hacker_cert_der_size + ); + } + else + { + printf1(TAG_GREEN,"Updating solo secure cert\r\n"); + flash_write_dword( + (uint32_t)&((flash_attestation_page *)ATTESTATION_PAGE_ADDR)->attestation_cert_size, + (uint64_t)attestation_solo_cert_der_size + ); + flash_write( + (uint32_t)((flash_attestation_page *)ATTESTATION_PAGE_ADDR)->attestation_cert, + attestation_solo_cert_der, + attestation_solo_cert_der_size + ); + } + + // Save. + authenticator_write_state(&state,0); + authenticator_write_state(&state,1); + } +} + void device_init(int argc, char *argv[]) { @@ -219,6 +303,8 @@ void device_init(int argc, char *argv[]) ctaphid_init(); ctap_init(); + device_migrate(); + #if BOOT_TO_DFU flash_option_bytes_init(1); #else diff --git a/targets/stm32l432/src/memory_layout.h b/targets/stm32l432/src/memory_layout.h index 2d42c09..88002bf 100644 --- a/targets/stm32l432/src/memory_layout.h +++ b/targets/stm32l432/src/memory_layout.h @@ -68,9 +68,9 @@ static_assert(sizeof(flash_memory_st) == 256*1024, "Data structure doesn't match struct flash_attestation_page{ uint8_t attestation_key[32]; - uint16_t attestation_format; - uint16_t attestation_cert_size; - uint8_t attestation_cert[2048 - 32 - 2 - 2]; + // DWORD padded. + uint64_t attestation_cert_size; + uint8_t attestation_cert[2048 - 32 - 8]; } __attribute__((packed)); typedef struct flash_attestation_page flash_attestation_page;