You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@teaclave.apache.org by GitBox <gi...@apache.org> on 2022/09/07 14:27:00 UTC
[GitHub] [incubator-teaclave-trustzone-sdk] syedelec opened a new issue, #88: ECDH shared secret derivation
syedelec opened a new issue, #88:
URL: https://github.com/apache/incubator-teaclave-trustzone-sdk/issues/88
Hello
I noticed that the ECDH shared secret derivation is not supported [`TEE_ALG_ECDH_DERIVE_SHARED_SECRET 0x80000042`]
Right now only the `TEE_ALG_DH_DERIVE_SHARED_SECRET` is supported
https://github.com/apache/incubator-teaclave-trustzone-sdk/blob/master/optee-utee/src/crypto_op.rs#L1548-L1549
Same for `TEE_ALG_ECDSA_SHAXXX`
In the [TEE Internal GlobalPlatform API](https://globalplatform.org/wp-content/uploads/2018/06/GPD_TEE_Internal_Core_API_Specification_v1.1.2.50_PublicReview.pdf), it's specified `if supported`, is it related to the reason these are not supported?
My questions are:
What would be the approximate effort to implement these algorithms in the Rust SDK?
Do you plan on supporting these algorithms?
Thanks for your inputs
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For additional commands, e-mail: dev-help@teaclave.apache.org
[GitHub] [incubator-teaclave-trustzone-sdk] syedelec commented on issue #88: ECDH shared secret derivation
Posted by GitBox <gi...@apache.org>.
syedelec commented on issue #88:
URL: https://github.com/apache/incubator-teaclave-trustzone-sdk/issues/88#issuecomment-1241443574
I noticed that the `TEE_ALG_ECDH_P192, TEE_ALG_ECDH_P224 ...` defines are deprecated and are being replaced as mentioned in the [TEE API](https://globalplatform.org/wp-content/uploads/2018/06/GPD_TEE_Internal_Core_API_Specification_v1.1.2.50_PublicReview.pdf)
Table B-2: Deprecated Algorithm Identifiers Page 327
They are all being replaced by `TEE_ALG_ECDH_DERIVE_SHARED_SECRET`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For additional commands, e-mail: dev-help@teaclave.apache.org
[GitHub] [incubator-teaclave-trustzone-sdk] DemesneGH commented on issue #88: ECDH shared secret derivation
Posted by GitBox <gi...@apache.org>.
DemesneGH commented on issue #88:
URL: https://github.com/apache/incubator-teaclave-trustzone-sdk/issues/88#issuecomment-1240416755
> Let me know if I am mistaken but the:
> `TEE_ALG_DH_DERIVE_SHARED_SECRET` should ONLY work with `DH_KEYPAIR`
> and
> `TEE_ALG_ECDH_DERIVE_SHARED_SECRET` should ONLY work with `ECDH_KEYPAIR`
Sorry I copied the wrong text which should be `TEE_ALG_ECDH_DERIVE_SHARED_SECRET` instead of `TEE_ALG_DH_DERIVE_SHARED_SECRET` in the previous comment.
> In the Rust SDK, the `TEE_ALG_ECDH_DERIVE_SHARED_SECRET 0x80000042` define is missing
If this constant flag is needed, just add the definition in `crypto_op.rs` after this line of code:
https://github.com/apache/incubator-teaclave-trustzone-sdk/blob/341b77aae515852d01ae6183d13c58419c1b0094/optee-utee/src/crypto_op.rs#L1718
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For additional commands, e-mail: dev-help@teaclave.apache.org
[GitHub] [incubator-teaclave-trustzone-sdk] DemesneGH commented on issue #88: ECDH shared secret derivation
Posted by GitBox <gi...@apache.org>.
DemesneGH commented on issue #88:
URL: https://github.com/apache/incubator-teaclave-trustzone-sdk/issues/88#issuecomment-1240357031
Hi @syedelec
> In the [TEE Internal GlobalPlatform API](https://globalplatform.org/wp-content/uploads/2018/06/GPD_TEE_Internal_Core_API_Specification_v1.1.2.50_PublicReview.pdf), it's specified `if supported`, is it related to the reason these are not supported?
Algorithms marked as `If supported` means they're not mandatorily implemented in TEE OSs. Those are optional features.
> What would be the approximate effort to implement these algorithms in the Rust SDK?
In Rust SDK we just wrap the TEE crypto APIs which are implemented in the OP-TEE Core.
For example, I noticed that OP-TEE supports `TEE_ALG_DH_DERIVE_SHARED_SECRET`. To invoke this algorithm, we should allocate a `TransientObject` whose type is `TEE_TYPE_ECDH_KEYPAIR`. Allocation of an `ECDH_KEYPAIR` object is in `TEE_Generatekey()` which needs these arguments: `TEE_ATTR_ECC_CURVE`, `TEE_ATTR_ECC_PUBLIC_VALUE_X`, `TEE_ATTR_ECC_PUBLIC_VALUE_Y` and `TEE_ATTR_ECC_PRIVATE_VALUE`. (See the definitions in the GP Specification).
In Rust SDK we can populate and pass those values to `TransientObject::generate_key()` (which is the wrapper of `TEE_Generatekey()`).
Since OP-TEE supports `TEE_ALG_DH_DERIVE_SHARED_SECRET`, it is possible to invoke this algorithm in Rust but we've not tested for it. The function call is similar to the [Diffie-Hellman example](https://github.com/apache/incubator-teaclave-trustzone-sdk/tree/master/examples/diffie_hellman-rs).
> Do you plan on supporting these algorithms?
As mentioned above, there're just wrappers in Rust SDK and the algorithms are implemented in OP-TEE Core.
Since Rust SDK supports using third-party crates, the other way is using Ring which supports the ECDH key agreement and other algorithms. Reference: https://docs.rs/ring/latest/ring/agreement/index.html
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For additional commands, e-mail: dev-help@teaclave.apache.org
[GitHub] [incubator-teaclave-trustzone-sdk] DemesneGH commented on issue #88: ECDH shared secret derivation
Posted by GitBox <gi...@apache.org>.
DemesneGH commented on issue #88:
URL: https://github.com/apache/incubator-teaclave-trustzone-sdk/issues/88#issuecomment-1240448474
In OP-TEE it uses `TEE_ALG_ECDH_P192`, `TEE_ALG_ECDH_P224`, etc. Not the `TEE_ALG_ECDH_DERIVE_SHARED_SECRET`:
https://github.com/OP-TEE/optee_test/blob/00b3f2cbf4ad959423f8f1abdef52a2f0280db1b/host/xtest/regression_4000_data.h#L6490-L6504
The function call example can be found at the xtest code:
https://github.com/OP-TEE/optee_test/blob/1cf0e6d2bdd1145370033d4e182634458528579d/host/xtest/regression_4000.c#L4793
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For additional commands, e-mail: dev-help@teaclave.apache.org
[GitHub] [incubator-teaclave-trustzone-sdk] syedelec closed issue #88: ECDH shared secret derivation
Posted by GitBox <gi...@apache.org>.
syedelec closed issue #88: ECDH shared secret derivation
URL: https://github.com/apache/incubator-teaclave-trustzone-sdk/issues/88
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For additional commands, e-mail: dev-help@teaclave.apache.org
[GitHub] [incubator-teaclave-trustzone-sdk] syedelec commented on issue #88: ECDH shared secret derivation
Posted by GitBox <gi...@apache.org>.
syedelec commented on issue #88:
URL: https://github.com/apache/incubator-teaclave-trustzone-sdk/issues/88#issuecomment-1240395366
> Algorithms marked as If supported means they're not mandatorily implemented in TEE OSs. Those are optional features.
Thanks I understood. These algorithms are implemented in TEE OS part.
> For example, I noticed that OP-TEE supports TEE_ALG_DH_DERIVE_SHARED_SECRET. To invoke this algorithm, we should allocate a TransientObject whose type is TEE_TYPE_ECDH_KEYPAIR. Allocation of an ECDH_KEYPAIR object is in TEE_Generatekey() which needs these arguments: TEE_ATTR_ECC_CURVE, TEE_ATTR_ECC_PUBLIC_VALUE_X, TEE_ATTR_ECC_PUBLIC_VALUE_Y and TEE_ATTR_ECC_PRIVATE_VALUE. (See the definitions in the GP Specification).
Let me know if I am mistaken but the:
`TEE_ALG_DH_DERIVE_SHARED_SECRET` should ONLY work with `DH_KEYPAIR`
and
`TEE_ALG_ECDH_DERIVE_SHARED_SECRET` should ONLY work with `ECDH_KEYPAIR`
As you mentioned in the: [Diffie-Hellman example](https://github.com/apache/incubator-teaclave-trustzone-sdk/tree/master/examples/diffie_hellman-rs), the `DH_KEYPAIR` is used instead of `ECDH_KEYPAIR` (which is supported)
In the Rust SDK, the `TEE_ALG_ECDH_DERIVE_SHARED_SECRET 0x80000042` define is missing so we cannot derive shared secret using `ECDH_KEYPAIR`
[Same for the algorithms in my initial screenshots `TEE_ALG_ECDSA_SHAXXX` so EC signatures are not availables]
> As mentioned above, there're just wrappers in Rust SDK and the algorithms are implemented in OP-TEE Core.
Since Rust SDK supports using third-party crates, the other way is using Ring which supports the ECDH key agreement and other algorithms. Reference: https://docs.rs/ring/latest/ring/agreement/index.html
Yes I am using also this crate but I just wanted to try the wrappers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For additional commands, e-mail: dev-help@teaclave.apache.org