Skip to content

Commit 1003462

Browse files
sujaygkulkarni-nxpJagadish-NXP
authored and
pull[bot]
committed
Se05x HSM support in thermostat example (#22220)
* fix - pbkdf integration * added se05x platform support for thermostat example * device attest with internal sign working * code clean up * updated simw repo commit id * restyler * updated api names * restyler * deleting tlv objects after use * updated tlv parsing code * updated error checks for TLV lengths * using GetRemainingLength() insted of recomputing the length * restyler * using length of TLV after Get() member is called Co-authored-by: Jagadish-NXP <[email protected]>
1 parent 183ceb7 commit 1003462

20 files changed

+1029
-31
lines changed

‎examples/platform/nxp/se05x/DeviceAttestationSe05xCredsExample.cpp

+6-5
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,9 @@
3030

3131
#include <crypto/hsm/nxp/CHIPCryptoPALHsm_SE05X_utils.h>
3232

33-
#define DEV_ATTESTATION_KEY_ID 0xDADADADA
34-
#define DEV_ATTESTATION_CERT_ID 0xDADADADB
33+
/* Device attestation key ids */
34+
#define DEV_ATTESTATION_KEY_SE05X_ID 0x7D300000
35+
#define DEV_ATTESTATION_CERT_SE05X_ID 0x7D300001
3536

3637
extern CHIP_ERROR se05xGetCertificate(uint32_t keyId, uint8_t * buf, size_t * buflen);
3738

@@ -57,8 +58,8 @@ CHIP_ERROR ExampleSe05xDACProvider::GetDeviceAttestationCert(MutableByteSpan & o
5758
return CopySpanToMutableSpan(DevelopmentCerts::kDacCert, out_dac_buffer);
5859
#else
5960
size_t buflen = out_dac_buffer.size();
60-
ChipLogDetail(Crypto, "Get certificate from se05x");
61-
ReturnErrorOnFailure(se05xGetCertificate(DEV_ATTESTATION_CERT_ID, out_dac_buffer.data(), &buflen));
61+
ChipLogDetail(Crypto, "Get DA certificate from se05x");
62+
ReturnErrorOnFailure(se05xGetCertificate(DEV_ATTESTATION_CERT_SE05X_ID, out_dac_buffer.data(), &buflen));
6263
out_dac_buffer.reduce_size(buflen);
6364
return CHIP_NO_ERROR;
6465
#endif
@@ -142,7 +143,7 @@ CHIP_ERROR ExampleSe05xDACProvider::SignWithDeviceAttestationKey(const ByteSpan
142143
VerifyOrReturnError(IsSpanUsable(message_to_sign), CHIP_ERROR_INVALID_ARGUMENT);
143144
VerifyOrReturnError(out_signature_buffer.size() >= signature.Capacity(), CHIP_ERROR_BUFFER_TOO_SMALL);
144145

145-
keypair.SetKeyId(DEV_ATTESTATION_KEY_ID);
146+
keypair.SetKeyId(DEV_ATTESTATION_KEY_SE05X_ID);
146147
keypair.provisioned_key = true;
147148
keypair.Initialize();
148149

‎examples/platform/nxp/se05x/DeviceAttestationSe05xCredsExample.h

100644100755
+1
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ namespace Examples {
3030
* storage abstractions.
3131
*/
3232
DeviceAttestationCredentialsProvider * GetExampleSe05xDACProvider();
33+
DeviceAttestationCredentialsProvider * GetExampleSe05xDACProviderv2();
3334

3435
} // namespace Examples
3536
} // namespace Credentials

‎examples/platform/nxp/se05x/DeviceAttestationSe05xCredsExample_v2.cpp

+298
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,298 @@
1+
/*
2+
*
3+
* Copyright (c) 2021 Project CHIP Authors
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
#include "DeviceAttestationSe05xCredsExample.h"
18+
19+
#include <credentials/examples/ExampleDACs.h>
20+
#include <credentials/examples/ExamplePAI.h>
21+
#include <crypto/CHIPCryptoPAL.h>
22+
#include <lib/core/CHIPError.h>
23+
#include <lib/core/CHIPTLV.h>
24+
#include <lib/core/CHIPTLVTags.h>
25+
#include <lib/core/CHIPTLVTypes.h>
26+
#include <lib/core/CHIPTLVUtilities.hpp>
27+
#include <lib/support/Span.h>
28+
29+
#if CHIP_CRYPTO_HSM
30+
#include <crypto/hsm/CHIPCryptoPALHsm.h>
31+
#endif
32+
33+
#ifdef ENABLE_HSM_DEVICE_ATTESTATION
34+
35+
#include <crypto/hsm/nxp/CHIPCryptoPALHsm_SE05X_utils.h>
36+
37+
/* Device attestation key ids */
38+
#define DEV_ATTESTATION_KEY_SE05X_ID 0x7D300000
39+
#define DEV_ATTESTATION_CERT_SE05X_ID 0x7D300001
40+
41+
/* Device attestation key ids (Used with internal sign) */
42+
#define CD_DEV_ATTESTATION_KEY_SE05X_ID 0x7D300002
43+
#define NOCSR_DEV_ATTESTATION_KEY_SE05X_ID 0x7D300004
44+
45+
/* Device attestation data ids (for Cert decl) */
46+
#define CD_CERT_DECLARATION_DATA_SE05X_ID 0x7D300009
47+
#define CD_ATTEST_NONCE_DATA_SE05X_ID 0x7D30000C
48+
#define CD_TIME_STAMP_LEN_SE05X_ID 0x7D30000E
49+
#define CD_TIME_STAMP_DATA_SE05X_ID 0x7D30000F
50+
#define CD_ATTEST_CHALLENGE_SE05X_ID 0x7D300011
51+
52+
/* Device attestation data ids (for CSR) */
53+
#define NOCSR_CSR_LEN_SE05X_ID 0x7D300014
54+
#define NOCSR_CSR_DATA_SE05X_ID 0x7D300015
55+
#define NOCSR_CSR_NONCE_DATA_SE05X_ID 0x7D300018
56+
#define NOCSR_ATTEST_CHALLENGE_SE05X_ID 0x7D30001A
57+
58+
extern CHIP_ERROR se05xGetCertificate(uint32_t keyId, uint8_t * buf, size_t * buflen);
59+
extern CHIP_ERROR se05xSetCertificate(uint32_t keyId, const uint8_t * buf, size_t buflen);
60+
extern CHIP_ERROR se05xPerformInternalSign(uint32_t keyId, uint8_t * sigBuf, size_t * sigBufLen);
61+
extern void se05x_delete_key(uint32_t keyid);
62+
63+
namespace chip {
64+
namespace Credentials {
65+
namespace Examples {
66+
67+
namespace {
68+
69+
class ExampleSe05xDACProviderv2 : public DeviceAttestationCredentialsProvider
70+
{
71+
public:
72+
CHIP_ERROR GetCertificationDeclaration(MutableByteSpan & out_cd_buffer) override;
73+
CHIP_ERROR GetFirmwareInformation(MutableByteSpan & out_firmware_info_buffer) override;
74+
CHIP_ERROR GetDeviceAttestationCert(MutableByteSpan & out_dac_buffer) override;
75+
CHIP_ERROR GetProductAttestationIntermediateCert(MutableByteSpan & out_pai_buffer) override;
76+
CHIP_ERROR SignWithDeviceAttestationKey(const ByteSpan & message_to_sign, MutableByteSpan & out_signature_buffer) override;
77+
};
78+
79+
CHIP_ERROR ExampleSe05xDACProviderv2::GetDeviceAttestationCert(MutableByteSpan & out_dac_buffer)
80+
{
81+
#if 0
82+
return CopySpanToMutableSpan(DevelopmentCerts::kDacCert, out_dac_buffer);
83+
#else
84+
size_t buflen = out_dac_buffer.size();
85+
ChipLogDetail(Crypto, "Get DA certificate from se05x");
86+
ReturnErrorOnFailure(se05xGetCertificate(DEV_ATTESTATION_CERT_SE05X_ID, out_dac_buffer.data(), &buflen));
87+
out_dac_buffer.reduce_size(buflen);
88+
return CHIP_NO_ERROR;
89+
#endif
90+
}
91+
92+
CHIP_ERROR ExampleSe05xDACProviderv2::GetProductAttestationIntermediateCert(MutableByteSpan & out_pai_buffer)
93+
{
94+
return CopySpanToMutableSpan(ByteSpan(DevelopmentCerts::kPaiCert), out_pai_buffer);
95+
}
96+
97+
CHIP_ERROR ExampleSe05xDACProviderv2::GetCertificationDeclaration(MutableByteSpan & out_cd_buffer)
98+
{
99+
//-> format_version = 1
100+
//-> vendor_id = 0xFFF1
101+
//-> product_id_array = [ 0x8000, 0x8001, 0x8002, 0x8003, 0x8004, 0x8005, 0x8006, 0x8007, 0x8008, 0x8009, 0x800A, 0x800B,
102+
// 0x800C, 0x800D, 0x800E, 0x800F, 0x8010, 0x8011, 0x8012, 0x8013, 0x8014, 0x8015, 0x8016, 0x8017, 0x8018, 0x8019, 0x801A,
103+
// 0x801B, 0x801C, 0x801D, 0x801E, 0x801F, 0x8020, 0x8021, 0x8022, 0x8023, 0x8024, 0x8025, 0x8026, 0x8027, 0x8028, 0x8029,
104+
// 0x802A, 0x802B, 0x802C, 0x802D, 0x802E, 0x802F, 0x8030, 0x8031, 0x8032, 0x8033, 0x8034, 0x8035, 0x8036, 0x8037, 0x8038,
105+
// 0x8039, 0x803A, 0x803B, 0x803C, 0x803D, 0x803E, 0x803F, 0x8040, 0x8041, 0x8042, 0x8043, 0x8044, 0x8045, 0x8046, 0x8047,
106+
// 0x8048, 0x8049, 0x804A, 0x804B, 0x804C, 0x804D, 0x804E, 0x804F, 0x8050, 0x8051, 0x8052, 0x8053, 0x8054, 0x8055, 0x8056,
107+
// 0x8057, 0x8058, 0x8059, 0x805A, 0x805B, 0x805C, 0x805D, 0x805E, 0x805F, 0x8060, 0x8061, 0x8062, 0x8063 ]
108+
//-> device_type_id = 0x0016
109+
//-> certificate_id = "ZIG20142ZB330003-24"
110+
//-> security_level = 0
111+
//-> security_information = 0
112+
//-> version_number = 0x2694
113+
//-> certification_type = 0
114+
//-> dac_origin_vendor_id is not present
115+
//-> dac_origin_product_id is not present
116+
#if 0
117+
const uint8_t kCdForAllExamples[541] = {
118+
0x30, 0x82, 0x02, 0x19, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x02, 0xa0, 0x82, 0x02, 0x0a, 0x30,
119+
0x82, 0x02, 0x06, 0x02, 0x01, 0x03, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
120+
0x01, 0x30, 0x82, 0x01, 0x71, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x01, 0xa0, 0x82, 0x01, 0x62,
121+
0x04, 0x82, 0x01, 0x5e, 0x15, 0x24, 0x00, 0x01, 0x25, 0x01, 0xf1, 0xff, 0x36, 0x02, 0x05, 0x00, 0x80, 0x05, 0x01, 0x80,
122+
0x05, 0x02, 0x80, 0x05, 0x03, 0x80, 0x05, 0x04, 0x80, 0x05, 0x05, 0x80, 0x05, 0x06, 0x80, 0x05, 0x07, 0x80, 0x05, 0x08,
123+
0x80, 0x05, 0x09, 0x80, 0x05, 0x0a, 0x80, 0x05, 0x0b, 0x80, 0x05, 0x0c, 0x80, 0x05, 0x0d, 0x80, 0x05, 0x0e, 0x80, 0x05,
124+
0x0f, 0x80, 0x05, 0x10, 0x80, 0x05, 0x11, 0x80, 0x05, 0x12, 0x80, 0x05, 0x13, 0x80, 0x05, 0x14, 0x80, 0x05, 0x15, 0x80,
125+
0x05, 0x16, 0x80, 0x05, 0x17, 0x80, 0x05, 0x18, 0x80, 0x05, 0x19, 0x80, 0x05, 0x1a, 0x80, 0x05, 0x1b, 0x80, 0x05, 0x1c,
126+
0x80, 0x05, 0x1d, 0x80, 0x05, 0x1e, 0x80, 0x05, 0x1f, 0x80, 0x05, 0x20, 0x80, 0x05, 0x21, 0x80, 0x05, 0x22, 0x80, 0x05,
127+
0x23, 0x80, 0x05, 0x24, 0x80, 0x05, 0x25, 0x80, 0x05, 0x26, 0x80, 0x05, 0x27, 0x80, 0x05, 0x28, 0x80, 0x05, 0x29, 0x80,
128+
0x05, 0x2a, 0x80, 0x05, 0x2b, 0x80, 0x05, 0x2c, 0x80, 0x05, 0x2d, 0x80, 0x05, 0x2e, 0x80, 0x05, 0x2f, 0x80, 0x05, 0x30,
129+
0x80, 0x05, 0x31, 0x80, 0x05, 0x32, 0x80, 0x05, 0x33, 0x80, 0x05, 0x34, 0x80, 0x05, 0x35, 0x80, 0x05, 0x36, 0x80, 0x05,
130+
0x37, 0x80, 0x05, 0x38, 0x80, 0x05, 0x39, 0x80, 0x05, 0x3a, 0x80, 0x05, 0x3b, 0x80, 0x05, 0x3c, 0x80, 0x05, 0x3d, 0x80,
131+
0x05, 0x3e, 0x80, 0x05, 0x3f, 0x80, 0x05, 0x40, 0x80, 0x05, 0x41, 0x80, 0x05, 0x42, 0x80, 0x05, 0x43, 0x80, 0x05, 0x44,
132+
0x80, 0x05, 0x45, 0x80, 0x05, 0x46, 0x80, 0x05, 0x47, 0x80, 0x05, 0x48, 0x80, 0x05, 0x49, 0x80, 0x05, 0x4a, 0x80, 0x05,
133+
0x4b, 0x80, 0x05, 0x4c, 0x80, 0x05, 0x4d, 0x80, 0x05, 0x4e, 0x80, 0x05, 0x4f, 0x80, 0x05, 0x50, 0x80, 0x05, 0x51, 0x80,
134+
0x05, 0x52, 0x80, 0x05, 0x53, 0x80, 0x05, 0x54, 0x80, 0x05, 0x55, 0x80, 0x05, 0x56, 0x80, 0x05, 0x57, 0x80, 0x05, 0x58,
135+
0x80, 0x05, 0x59, 0x80, 0x05, 0x5a, 0x80, 0x05, 0x5b, 0x80, 0x05, 0x5c, 0x80, 0x05, 0x5d, 0x80, 0x05, 0x5e, 0x80, 0x05,
136+
0x5f, 0x80, 0x05, 0x60, 0x80, 0x05, 0x61, 0x80, 0x05, 0x62, 0x80, 0x05, 0x63, 0x80, 0x18, 0x24, 0x03, 0x16, 0x2c, 0x04,
137+
0x13, 0x5a, 0x49, 0x47, 0x32, 0x30, 0x31, 0x34, 0x32, 0x5a, 0x42, 0x33, 0x33, 0x30, 0x30, 0x30, 0x33, 0x2d, 0x32, 0x34,
138+
0x24, 0x05, 0x00, 0x24, 0x06, 0x00, 0x25, 0x07, 0x94, 0x26, 0x24, 0x08, 0x00, 0x18, 0x31, 0x7d, 0x30, 0x7b, 0x02, 0x01,
139+
0x03, 0x80, 0x14, 0x62, 0xfa, 0x82, 0x33, 0x59, 0xac, 0xfa, 0xa9, 0x96, 0x3e, 0x1c, 0xfa, 0x14, 0x0a, 0xdd, 0xf5, 0x04,
140+
0xf3, 0x71, 0x60, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x30, 0x0a, 0x06, 0x08,
141+
0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x04, 0x47, 0x30, 0x45, 0x02, 0x20, 0x24, 0xe5, 0xd1, 0xf4, 0x7a, 0x7d,
142+
0x7b, 0x0d, 0x20, 0x6a, 0x26, 0xef, 0x69, 0x9b, 0x7c, 0x97, 0x57, 0xb7, 0x2d, 0x46, 0x90, 0x89, 0xde, 0x31, 0x92, 0xe6,
143+
0x78, 0xc7, 0x45, 0xe7, 0xf6, 0x0c, 0x02, 0x21, 0x00, 0xf8, 0xaa, 0x2f, 0xa7, 0x11, 0xfc, 0xb7, 0x9b, 0x97, 0xe3, 0x97,
144+
0xce, 0xda, 0x66, 0x7b, 0xae, 0x46, 0x4e, 0x2b, 0xd3, 0xff, 0xdf, 0xc3, 0xcc, 0xed, 0x7a, 0xa8, 0xca, 0x5f, 0x4c, 0x1a,
145+
0x7c,
146+
};
147+
148+
return CopySpanToMutableSpan(ByteSpan{ kCdForAllExamples }, out_cd_buffer);
149+
150+
#else
151+
size_t buflen = out_cd_buffer.size();
152+
ChipLogDetail(Crypto, "Get certificate declaration from se05x");
153+
ReturnErrorOnFailure(se05xGetCertificate(CD_CERT_DECLARATION_DATA_SE05X_ID, out_cd_buffer.data(), &buflen));
154+
out_cd_buffer.reduce_size(buflen);
155+
return CHIP_NO_ERROR;
156+
#endif
157+
}
158+
159+
CHIP_ERROR ExampleSe05xDACProviderv2::GetFirmwareInformation(MutableByteSpan & out_firmware_info_buffer)
160+
{
161+
// TODO: We need a real example FirmwareInformation to be populated.
162+
out_firmware_info_buffer.reduce_size(0);
163+
164+
return CHIP_NO_ERROR;
165+
}
166+
167+
CHIP_ERROR ExampleSe05xDACProviderv2::SignWithDeviceAttestationKey(const ByteSpan & message_to_sign,
168+
MutableByteSpan & out_signature_buffer)
169+
{
170+
CHIP_ERROR err = CHIP_NO_ERROR;
171+
VerifyOrReturnError(IsSpanUsable(out_signature_buffer), CHIP_ERROR_INVALID_ARGUMENT);
172+
VerifyOrReturnError(IsSpanUsable(message_to_sign), CHIP_ERROR_INVALID_ARGUMENT);
173+
174+
ChipLogDetail(Crypto, "Sign using DA key from se05x (Using internal sign)");
175+
176+
TLV::TLVReader msg_reader;
177+
TLV::TLVReader tagReader;
178+
179+
msg_reader.Init(message_to_sign);
180+
181+
/* To be removed. Use common key id to sign message */
182+
static bool sign_cert_decl_attest = 1;
183+
184+
if (sign_cert_decl_attest)
185+
{
186+
/* Check if certificate declaration tag is present and Skip certificate declaration tag */
187+
ReturnErrorOnFailure(TLV::Utilities::Find(msg_reader, TLV::ContextTag(1), tagReader));
188+
189+
ReturnErrorOnFailure(TLV::Utilities::Find(msg_reader, TLV::ContextTag(2), tagReader));
190+
uint8_t attlen = tagReader.GetLength();
191+
VerifyOrReturnError(attlen > 0, CHIP_ERROR_INVALID_TLV_TAG);
192+
/* Get attestation nonce */
193+
ByteSpan attest_nonce;
194+
ReturnErrorOnFailure(tagReader.Get(attest_nonce));
195+
/* Set attestation nonce */
196+
VerifyOrReturnError(CHIP_NO_ERROR ==
197+
se05xSetCertificate(CD_ATTEST_NONCE_DATA_SE05X_ID, attest_nonce.data(), attest_nonce.size()),
198+
CHIP_ERROR_INTERNAL);
199+
200+
ReturnErrorOnFailure(TLV::Utilities::Find(msg_reader, TLV::ContextTag(3), tagReader));
201+
uint8_t tslen = tagReader.GetLength();
202+
if (tslen > 0)
203+
{
204+
ByteSpan time_stamp;
205+
ReturnErrorOnFailure(tagReader.Get(time_stamp));
206+
/* Set time stamp data */
207+
VerifyOrReturnError(CHIP_NO_ERROR ==
208+
se05xSetCertificate(CD_TIME_STAMP_DATA_SE05X_ID, time_stamp.data(), time_stamp.size()),
209+
CHIP_ERROR_INTERNAL);
210+
}
211+
/* Set time stamp length */
212+
VerifyOrReturnError(CHIP_NO_ERROR == se05xSetCertificate(CD_TIME_STAMP_LEN_SE05X_ID, &tslen, 1), CHIP_ERROR_INTERNAL);
213+
214+
if ((tagReader.GetRemainingLength() + 1 /* End container */) >= 16)
215+
{
216+
/* Set attestation challenge */
217+
VerifyOrReturnError(CHIP_NO_ERROR ==
218+
se05xSetCertificate(CD_ATTEST_CHALLENGE_SE05X_ID, (message_to_sign.end() - 16), 16),
219+
CHIP_ERROR_INTERNAL);
220+
}
221+
}
222+
else
223+
{
224+
ReturnErrorOnFailure(TLV::Utilities::Find(msg_reader, TLV::ContextTag(1), tagReader));
225+
uint8_t csrlen = tagReader.GetLength();
226+
VerifyOrReturnError(csrlen > 0, CHIP_ERROR_INVALID_TLV_TAG);
227+
ByteSpan csr_data;
228+
/* Get nocsr */
229+
ReturnErrorOnFailure(tagReader.Get(csr_data));
230+
/* Set nocsr length */
231+
VerifyOrReturnError(CHIP_NO_ERROR == se05xSetCertificate(NOCSR_CSR_LEN_SE05X_ID, &csrlen, 1), CHIP_ERROR_INTERNAL);
232+
/* Set nocsr data */
233+
se05x_delete_key(NOCSR_CSR_DATA_SE05X_ID);
234+
VerifyOrReturnError(CHIP_NO_ERROR == se05xSetCertificate(NOCSR_CSR_DATA_SE05X_ID, csr_data.data(), csr_data.size()),
235+
CHIP_ERROR_INTERNAL);
236+
237+
ReturnErrorOnFailure(TLV::Utilities::Find(msg_reader, TLV::ContextTag(2), tagReader));
238+
uint8_t noncelen = tagReader.GetLength();
239+
VerifyOrReturnError(noncelen > 0, CHIP_ERROR_INVALID_TLV_TAG);
240+
/* Get nocsr nonce */
241+
ByteSpan nocsr_nonce;
242+
ReturnErrorOnFailure(tagReader.Get(nocsr_nonce));
243+
/* Set nocsr nonce data */
244+
VerifyOrReturnError(CHIP_NO_ERROR ==
245+
se05xSetCertificate(NOCSR_CSR_NONCE_DATA_SE05X_ID, nocsr_nonce.data(), nocsr_nonce.size()),
246+
CHIP_ERROR_INTERNAL);
247+
248+
if ((tagReader.GetRemainingLength() + 1 /* End container */) >= 16)
249+
{
250+
/* Set attestation challenge */
251+
VerifyOrReturnError(CHIP_NO_ERROR ==
252+
se05xSetCertificate(NOCSR_ATTEST_CHALLENGE_SE05X_ID, (message_to_sign.end() - 16), 16),
253+
CHIP_ERROR_INTERNAL);
254+
}
255+
}
256+
257+
uint8_t signature_se05x[Crypto::kMax_ECDSA_Signature_Length_Der] = { 0 };
258+
size_t signature_se05x_len = sizeof(signature_se05x);
259+
260+
if (sign_cert_decl_attest)
261+
{
262+
err = se05xPerformInternalSign(CD_DEV_ATTESTATION_KEY_SE05X_ID, signature_se05x, &signature_se05x_len);
263+
se05x_delete_key(CD_ATTEST_NONCE_DATA_SE05X_ID);
264+
se05x_delete_key(CD_TIME_STAMP_LEN_SE05X_ID);
265+
se05x_delete_key(CD_TIME_STAMP_DATA_SE05X_ID);
266+
se05x_delete_key(CD_ATTEST_CHALLENGE_SE05X_ID);
267+
sign_cert_decl_attest = 0;
268+
}
269+
else
270+
{
271+
err = se05xPerformInternalSign(NOCSR_DEV_ATTESTATION_KEY_SE05X_ID, signature_se05x, &signature_se05x_len);
272+
se05x_delete_key(NOCSR_CSR_LEN_SE05X_ID);
273+
se05x_delete_key(NOCSR_CSR_DATA_SE05X_ID);
274+
se05x_delete_key(NOCSR_CSR_NONCE_DATA_SE05X_ID);
275+
se05x_delete_key(NOCSR_ATTEST_CHALLENGE_SE05X_ID);
276+
sign_cert_decl_attest = 1;
277+
}
278+
279+
ReturnErrorOnFailure(err);
280+
281+
return chip::Crypto::EcdsaAsn1SignatureToRaw(chip::Crypto::kP256_FE_Length, ByteSpan{ signature_se05x, signature_se05x_len },
282+
out_signature_buffer);
283+
}
284+
285+
} // namespace
286+
287+
DeviceAttestationCredentialsProvider * GetExampleSe05xDACProviderv2()
288+
{
289+
static ExampleSe05xDACProviderv2 example_dac_provider;
290+
291+
return &example_dac_provider;
292+
}
293+
294+
} // namespace Examples
295+
} // namespace Credentials
296+
} // namespace chip
297+
298+
#endif //#ifdef ENABLE_HSM_DEVICE_ATTESTATION

0 commit comments

Comments
 (0)