diff --git a/Cargo.lock b/Cargo.lock index 24b63f7a0..69262c9b4 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -113,6 +113,7 @@ dependencies = [ "embedded-hal", "fido-authenticator", "hex", + "littlefs2", "ndef-app", "opcard", "piv-authenticator", @@ -238,6 +239,12 @@ version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f8fe8f5a8a398345e52358e18ff07cc17a568fbca5c6f73873d3a62056309603" +[[package]] +name = "base16ct" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf" + [[package]] name = "base64ct" version = "1.6.0" @@ -776,6 +783,18 @@ dependencies = [ "zeroize", ] +[[package]] +name = "crypto-bigint" +version = "0.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "740fe28e594155f10cfc383984cbefd529d7396050557148f79cb0f621204124" +dependencies = [ + "generic-array 0.14.7", + "rand_core", + "subtle", + "zeroize", +] + [[package]] name = "crypto-common" version = "0.1.6" @@ -913,7 +932,7 @@ version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "79b71cca7d95d7681a4b3b9cdf63c8dbc3730d0584c2c74e31416d64a90493f4" dependencies = [ - "crypto-bigint", + "crypto-bigint 0.2.5", "der_derive 0.4.1", ] @@ -927,6 +946,16 @@ dependencies = [ "zeroize", ] +[[package]] +name = "der" +version = "0.7.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fffa369a668c8af7dbf8b5e56c9f744fbd399949ed171606040001947de40b1c" +dependencies = [ + "const-oid", + "zeroize", +] + [[package]] name = "der_derive" version = "0.2.2" @@ -998,11 +1027,22 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "43ee23aa5b4f68c7a092b5c3beb25f50c406adc75e2363634f242f28ab255372" dependencies = [ "der 0.4.5", - "elliptic-curve", + "elliptic-curve 0.10.4", "hmac 0.11.0", "signature 1.3.2", ] +[[package]] +name = "ecdsa" +version = "0.16.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a4b1e0c257a9e9f25f90ff76d7a68360ed497ee519c8e428d1825ef0000799d4" +dependencies = [ + "der 0.7.8", + "elliptic-curve 0.13.6", + "signature 2.1.0", +] + [[package]] name = "ed25519" version = "1.5.3" @@ -1027,7 +1067,7 @@ version = "0.10.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "83e5c176479da93a0983f0a6fdc3c1b8e7d5be0d7fe3fe05a99f15b96582b9a8" dependencies = [ - "crypto-bigint", + "crypto-bigint 0.2.5", "ff", "generic-array 0.14.7", "group", @@ -1036,6 +1076,22 @@ dependencies = [ "zeroize", ] +[[package]] +name = "elliptic-curve" +version = "0.13.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d97ca172ae9dc9f9b779a6e3a65d308f2af74e5b8c921299075bdb4a0370e914" +dependencies = [ + "base16ct", + "crypto-bigint 0.5.3", + "digest 0.10.7", + "generic-array 0.14.7", + "rand_core", + "sec1", + "subtle", + "zeroize", +] + [[package]] name = "embedded-dma" version = "0.2.0" @@ -1385,6 +1441,7 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" dependencies = [ "typenum", "version_check", + "zeroize", ] [[package]] @@ -2204,11 +2261,21 @@ version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d053368e1bae4c8a672953397bd1bd7183dde1c72b0b7612a15719173148d186" dependencies = [ - "ecdsa", - "elliptic-curve", + "ecdsa 0.12.4", + "elliptic-curve 0.10.4", "sha2 0.9.9", ] +[[package]] +name = "p256" +version = "0.13.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b" +dependencies = [ + "ecdsa 0.16.8", + "elliptic-curve 0.13.6", +] + [[package]] name = "p256-cortex-m4" version = "0.1.0-alpha.6" @@ -2216,9 +2283,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "647353e42d97cbbc7018cb27c0258a7f5ec1db69a0ac336bd954f468a66af38a" dependencies = [ "der 0.4.5", - "ecdsa", - "elliptic-curve", - "p256", + "ecdsa 0.12.4", + "elliptic-curve 0.10.4", + "p256 0.9.0", "p256-cortex-m4-sys", "rand_core", "sha2 0.9.9", @@ -2696,7 +2763,7 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" [[package]] name = "se05x" version = "0.0.1" -source = "git+https://github.com/Nitrokey/se05x.git?tag=v0.1.0#d8e4d1bdccce12aa8e506fb9b504d85d33efa8ed" +source = "git+https://github.com/Nitrokey/se05x.git?rev=d09a451246a97446f18f61b58d2b3e569b0e58f3#d09a451246a97446f18f61b58d2b3e569b0e58f3" dependencies = [ "aes", "bitflags 2.4.1", @@ -2716,6 +2783,19 @@ dependencies = [ "typed-builder", ] +[[package]] +name = "sec1" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc" +dependencies = [ + "base16ct", + "der 0.7.8", + "generic-array 0.14.7", + "subtle", + "zeroize", +] + [[package]] name = "secrets-app" version = "0.13.0" @@ -3250,7 +3330,7 @@ dependencies = [ [[package]] name = "trussed" version = "0.1.0" -source = "git+https://github.com/Nitrokey/trussed.git?rev=v0.1.0-nitrokey.14#30a4764ddca80fd5f23eff6db1c53770f84c2c2f" +source = "git+https://github.com/trussed-dev/trussed.git?rev=012788c1af5559c5c94dfb17c92332516b5b812e#012788c1af5559c5c94dfb17c92332516b5b812e" dependencies = [ "aes", "bitflags 2.4.1", @@ -3287,7 +3367,7 @@ dependencies = [ [[package]] name = "trussed-auth" version = "0.2.2" -source = "git+https://github.com/Nitrokey/trussed-auth?tag=v0.2.2-nitrokey.1#203a90dd13a7378f596b3099cd986a8da6185137" +source = "git+https://github.com/Nitrokey/trussed-auth?rev=1826aaee72da5e539c35aa6d9fbc036c30c94d6f#1826aaee72da5e539c35aa6d9fbc036c30c94d6f" dependencies = [ "chacha20poly1305", "hkdf", @@ -3303,7 +3383,7 @@ dependencies = [ [[package]] name = "trussed-rsa-alloc" version = "0.1.0" -source = "git+https://github.com/Nitrokey/trussed-rsa-backend.git?tag=v0.1.0#a72ce195a4495a8db26debfb0240a4dc712d8dbe" +source = "git+https://github.com/Nitrokey/trussed-rsa-backend.git?rev=2088e2f8a8d706276c1559717b4c6b6d4f270253#2088e2f8a8d706276c1559717b4c6b6d4f270253" dependencies = [ "delog", "heapless-bytes 0.3.0", @@ -3317,28 +3397,37 @@ dependencies = [ [[package]] name = "trussed-se050-backend" version = "0.1.0" -source = "git+https://github.com/Nitrokey/trussed-se050-backend.git?tag=v0.1.0-test-driver#d71261b350858e117b3766172cbc896fc1b75d11" +source = "git+https://github.com/Nitrokey/trussed-se050-backend.git?rev=dc8bea608a5b7d1b18179709c8b6e9ffa9999196#dc8bea608a5b7d1b18179709c8b6e9ffa9999196" dependencies = [ "cbor-smol", + "crypto-bigint 0.5.3", "delog", "embedded-hal", "hex-literal 0.4.1", + "hkdf", "hmac 0.12.1", "iso7816", "littlefs2", + "p256 0.13.2", + "p256-cortex-m4", + "postcard 0.7.3", "rand", - "rand_chacha", + "salty 0.3.0", "se05x", "serde", "serde-byte-array", "serde_bytes", + "sha2 0.10.8", "trussed", + "trussed-auth", + "trussed-rsa-alloc", + "trussed-staging", ] [[package]] name = "trussed-staging" version = "0.1.0" -source = "git+https://github.com/trussed-dev/trussed-staging.git?branch=hmacsha256p256#1b54bf8703d515688a58f2f605c3efa0f2f60ced" +source = "git+https://github.com/Nitrokey/trussed-staging.git?branch=hmacsha256p256-rebased#edb966aba4a3c211b6453d6f01259823e82b932b" dependencies = [ "chacha20poly1305", "delog", diff --git a/Cargo.toml b/Cargo.toml index e2ee896ec..f97b41b4c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -23,7 +23,7 @@ serde-indexed = { git = "https://github.com/nitrokey/serde-indexed.git", tag = " apdu-dispatch = { git = "https://github.com/Nitrokey/apdu-dispatch.git", tag = "v0.1.2-nitrokey.2" } ctaphid-dispatch = { git = "https://github.com/Nitrokey/ctaphid-dispatch.git", tag = "v0.1.1-nitrokey.3" } iso7816 = { git = "https://github.com/Nitrokey/iso7816.git", tag = "v0.1.1-nitrokey.2"} -trussed = { git = "https://github.com/Nitrokey/trussed.git", rev = "v0.1.0-nitrokey.14" } +trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "012788c1af5559c5c94dfb17c92332516b5b812e" } usbd-ctaphid = { git = "https://github.com/Nitrokey/usbd-ctaphid.git", tag = "v0.1.0-nitrokey.2" } usbd-ccid = { git = "https://github.com/Nitrokey/usbd-ccid", tag = "v0.2.0-nitrokey.1" } @@ -32,12 +32,12 @@ secrets-app = { git = "https://github.com/Nitrokey/trussed-secrets-app", tag = " webcrypt = { git = "https://github.com/nitrokey/nitrokey-websmartcard-rust", tag = "v0.8.0-rc4"} opcard = { git = "https://github.com/Nitrokey/opcard-rs", tag = "v1.2.0" } piv-authenticator = { git = "https://github.com/Nitrokey/piv-authenticator", tag = "v0.3.3" } -se05x = { git = "https://github.com/Nitrokey/se05x.git", tag = "v0.1.0"} -trussed-auth = { git = "https://github.com/Nitrokey/trussed-auth", tag = "v0.2.2-nitrokey.1" } -trussed-rsa-alloc = { git = "https://github.com/Nitrokey/trussed-rsa-backend.git", tag = "v0.1.0"} -trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", branch = "hmacsha256p256" } +se05x = { git = "https://github.com/Nitrokey/se05x.git", rev = "d09a451246a97446f18f61b58d2b3e569b0e58f3"} +trussed-auth = { git = "https://github.com/Nitrokey/trussed-auth", rev = "1826aaee72da5e539c35aa6d9fbc036c30c94d6f" } +trussed-rsa-alloc = { git = "https://github.com/Nitrokey/trussed-rsa-backend.git", rev = "2088e2f8a8d706276c1559717b4c6b6d4f270253"} +trussed-staging = { git = "https://github.com/Nitrokey/trussed-staging.git", branch = "hmacsha256p256-rebased" } trussed-usbip = { git = "https://github.com/Nitrokey/pc-usbip-runner.git", tag = "v0.0.1-nitrokey.3" } -trussed-se050-backend = { git = "https://github.com/Nitrokey/trussed-se050-backend.git", tag = "v0.1.0-test-driver" } +trussed-se050-backend = { git = "https://github.com/Nitrokey/trussed-se050-backend.git", rev = "dc8bea608a5b7d1b18179709c8b6e9ffa9999196" } [profile.release] codegen-units = 1 diff --git a/components/apps/Cargo.toml b/components/apps/Cargo.toml index af2f57904..004373d90 100644 --- a/components/apps/Cargo.toml +++ b/components/apps/Cargo.toml @@ -29,6 +29,7 @@ provisioner-app = { path = "../provisioner-app", optional = true } se05x = { version = "0.0.1", optional = true} trussed-se050-backend = { version = "0.1.0", optional = true } embedded-hal = "0.2.7" +littlefs2 = "0.4" [dev-dependencies] cbor-smol = "0.4" @@ -45,13 +46,13 @@ webcrypt = ["dep:webcrypt", "backend-auth", "backend-rsa", "backend-staging", "t fido-authenticator = ["dep:fido-authenticator", "usbd-ctaphid"] opcard = ["dep:opcard", "backend-rsa", "backend-auth", "backend-staging"] piv-authenticator = ["dep:piv-authenticator", "backend-rsa", "backend-auth", "backend-staging"] -se050-test-app = ["se050", "admin-app/se050"] -se050 = ["trussed-se050-backend", "dep:se05x"] # backends backend-auth = ["trussed-auth"] backend-rsa = ["trussed-rsa-alloc"] backend-staging = ["trussed-staging"] +se050 = ["trussed-se050-backend", "dep:se05x", "backend-auth"] +se050-test-app = ["admin-app/se050"] log-all = ["admin-app/log-all", "fido-authenticator?/log-all", "secrets-app?/log-all", "webcrypt?/log-all", "opcard?/log-all", "provisioner-app?/log-all"] diff --git a/components/apps/src/dispatch.rs b/components/apps/src/dispatch.rs index 27bf144b2..321798df4 100644 --- a/components/apps/src/dispatch.rs +++ b/components/apps/src/dispatch.rs @@ -64,12 +64,30 @@ pub struct DispatchContext { se050: Se050Context, } +#[cfg(feature = "se050")] +const NAMESPACE: trussed_se050_backend::namespacing::Namespace = { + use trussed_se050_backend::namespacing::*; + use littlefs2::path::Path; + use littlefs2::path; + + Namespace(&[ + NamespaceItem { + client: path!("admin"), + value: NamespaceValue::Client1, + }, + NamespaceItem { + client: path!("opcard"), + value: NamespaceValue::Client2, + } + ]) +}; + impl Dispatch { pub fn new( auth_location: Location, #[cfg(feature = "se050")] se050: Option>, ) -> Self { - #[cfg(not(feature = "backend-auth"))] + #[cfg(not(all(feature = "backend-auth", feature = "se050")))] let _ = auth_location; Self { #[cfg(feature = "backend-auth")] @@ -77,7 +95,7 @@ impl Dispatch { #[cfg(feature = "backend-staging")] staging: StagingBackend::new(), #[cfg(feature = "se050")] - se050: se050.map(trussed_se050_backend::Se050Backend::new), + se050: se050.map(|driver| Se050Backend::new(driver, auth_location, None, NAMESPACE)), #[cfg(not(feature = "se050"))] __: Default::default(), } @@ -89,12 +107,15 @@ impl Dispatch { hw_key: Bytes, #[cfg(feature = "se050")] se050: Option>, ) -> Self { + #[cfg(feature = "se050")] + // Should the backend really use the same key? + let hw_key_se050 = hw_key.clone(); Self { auth: AuthBackend::with_hw_key(auth_location, hw_key), #[cfg(feature = "backend-staging")] staging: StagingBackend::new(), #[cfg(feature = "se050")] - se050: se050.map(trussed_se050_backend::Se050Backend::new), + se050: se050.map(|driver| Se050Backend::new(driver, auth_location, Some(hw_key_se050), NAMESPACE)), #[cfg(not(feature = "se050"))] __: Default::default(), } diff --git a/runners/embedded/Cargo.toml b/runners/embedded/Cargo.toml index be9b1802a..3ae897db9 100644 --- a/runners/embedded/Cargo.toml +++ b/runners/embedded/Cargo.toml @@ -73,7 +73,7 @@ toml = "0.5" [features] default = ["alloc"] -test = ["apps/test", "utils/test", "se050", "se050-test-app"] +test = ["apps/test", "utils/test", "se050"] develop = ["no-encrypted-storage", "apps/no-reset-time-window", "log-traceP"] develop-no-press = ["develop", "no-buttons"] provisioner = ["apps/provisioner", "write-undefined-flash", "no-buttons", "apps/no-reset-time-window", "lpc55-hardware-checks"]