/* * asn1.c * ------ * Minimal ASN.1 implementation in support of Cryptech libhal. * * The functions in this module are not intended to be part of the * public API. Rather, these are utility functions used by more than * one module within the library, which would otherwise have to be * duplicated. The main reason for keeping these private is to avoid * having the public API depend on any details of the underlying * bignum implementation (currently libtfm, but that might change). * * As of this writing, the ASN.1 support we need is quite minimal, so, * rather than attempting to clean all the unecessary cruft out of a * general purpose ASN.1 implementation, we hand code the very small * number of data types we need. At some point this will probably * become impractical, at which point we might want to look into using * something like the asn1c compiler. * * Authors: Rob Austein * Copyright (c) 2015, NORDUnet A/S * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * - Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * - Neither the name of the NORDUnet nor the names of its contributors may * be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include #include "hal.h" #include "hal_internal.h" #include "asn1_internal.h" #define INIT_FP_INT {{{0}}} /* * Algorithm OIDs used in SPKI and PKCS #8. */ /* * From RFC 5480 New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX) * * rsaEncryption OBJECT IDENTIFIER ::= { * iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) * pkcs-1(1) 1 } */ const uint8_t hal_asn1_oid_rsaEncryption[] = { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01 }; const size_t hal_asn1_oid_rsaEncryption_len = sizeof(hal_asn1_oid_rsaEncryption); /* * From RFC 5480 Elliptic Curve Cryptography Subject Public Key Information * * id-ecPublicKey OBJECT IDENTIFIER ::= { * iso(1) member-body(2) us(840) ansi-X9-62(10045) keyType(2) 1 } */ const uint8_t hal_asn1_oid_ecPublicKey[] = { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01 }; const size_t hal_asn1_oid_ecPublicKey_len = sizeof(hal_asn1_oid_ecPublicKey); /* * From RFC 5649 Advanced Encryption Standard (AES) Key Wrap with Padding Algorithm * * aes OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) * us(840) organization(1) gov(101) csor(3) * nistAlgorithm(4) 1 } * * id-aes128-wrap-pad OBJECT IDENTIFIER ::= { aes 8 } * * id-aes256-wrap-pad OBJECT IDENTIFIER ::= { aes 48 } */ #if KEK_LENGTH == (bitsToBytes(128)) const uint8_t hal_asn1_oid_aesKeyWrap[] = { 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x01, 0x08 }; const size_t hal_asn1_oid_aesKeyWrap_len = sizeof(hal_asn1_oid_aesKeyWrap); #endif #if KEK_LENGTH == (bitsToBytes(256)) const uint8_t hal_asn1_oid_aesKeyWrap[] = { 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x01, 0x30 }; const size_t hal_asn1_oid_aesKeyWrap_len = sizeof(hal_asn1_oid_aesKeyWrap); #endif /* * From draft-housley-cms-mts-hash-sig Use of the Hash-based Merkle Tree Signature (MTS) Algorithm in the Cryptographic Message Syntax (CMS) * * id-alg-mts-hashsig OBJECT IDENTIFIER ::= { iso(1) member-body(2) * us(840) rsadsi(113549) pkcs(1) pkcs9(9) smime(16) alg(3) 17 } */ const uint8_t hal_asn1_oid_mts_hashsig[] = { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x10, 0x03, 0x11 }; const size_t hal_asn1_oid_mts_hashsig_len = sizeof(hal_asn1_oid_mts_hashsig); /* * Encode tag and length fields of an ASN.1 object. * * Sets *der_len to the size of of the ASN.1 header (tag and length * fields); caller supplied length of value field, so presumably * already knows it. * * If der is NULL, just return the size of the header that would be * encoded and returns HAL_OK. * * If der isn't NULL, returns HAL_ERROR_RESULT_TOO_LONG unless full * header plus value will fit; this is a bit weird, but is useful when * using this to construct encoders for complte ASN.1 objects. */ hal_error_t hal_asn1_encode_header(const uint8_t tag, const size_t value_len, uint8_t *der, size_t *der_len, const size_t der_max) { size_t header_len = 2; /* Shortest encoding is one octet each for tag and length */ if (value_len >= 128) /* Add octets for longer length encoding as needed */ for (size_t n = value_len; n > 0; n >>= 8) ++header_len; if (der_len != NULL) *der_len = header_len; if (der == NULL) /* If caller just wanted the length, we're done */ return HAL_OK; /* * Make sure there's enough room for header + value, then encode. */ if (value_len + header_len > der_max) return HAL_ERROR_RESULT_TOO_LONG; *der++ = tag; if (value_len < 128) { *der = (uint8_t) value_len; } else { *der = 0x80 | (uint8_t) (header_len -= 2); for (size_t n = value_len; n > 0 && header_len > 0; n >>= 8) der[header_len--] = (uint8_t) (n & 0xFF); } return HAL_OK; } /* * Encode an unsigned ASN.1 INTEGER from a libtfm bignum. If der is * NULL, just return the length of what we would have encoded. */ hal_error_t hal_asn1_encode_integer(const fp_int * const bn, uint8_t *der, size_t *der_len, const size_t der_max) { if (bn == NULL) return HAL_ERROR_BAD_ARGUMENTS; /* * We only handle unsigned INTEGERs, so we need to pad data with a * leading zero if the most significant bit is set, to avoid * flipping the ASN.1 sign bit. Conveniently, this also handles the * difference between libtfm's and ASN.1's encoding of zero. */ if (fp_cmp_d(unconst_fp_int(bn), 0) == FP_LT) return HAL_ERROR_BAD_ARGUMENTS; const int leading_zero = fp_iszero(bn) || (fp_count_bits(unconst_fp_int(bn)) & 7) == 0; const size_t vlen = fp_unsigned_bin_size(unconst_fp_int(bn)) + leading_zero; hal_error_t err; size_t hlen; err = hal_asn1_encode_header(ASN1_INTEGER, vlen, der, &hlen, der_max); if (der_len != NULL) *der_len = hlen + vlen; if (der == NULL || err != HAL_OK) return err; hal_assert(hlen + vlen <= der_max); der += hlen; if (leading_zero) *der++ = 0x00; fp_to_unsigned_bin(unconst_fp_int(bn), der); return HAL_OK; } /* * Encode an unsigned ASN.1 INTEGER from a uint32_t. If der is * NULL, just return the length of what we would have encoded. */ hal_error_t hal_asn1_encode_uint32(const uint32_t n, uint8_t *der, size_t *der_len, const size_t der_max) { /* * We only handle unsigned INTEGERs, so we need to pad data with a * leading zero if the most significant bit is set, to avoid * flipping the ASN.1 sign bit. */ size_t vlen; hal_error_t err; size_t hlen; /* DER says to use the minimum number of octets */ if (n < 0x80) vlen = 1; else if (n < 0x8000) vlen = 2; else if (n < 0x800000) vlen = 3; else if (n < 0x80000000) vlen = 4; else vlen = 5; err = hal_asn1_encode_header(ASN1_INTEGER, vlen, der, &hlen, der_max); if (der_len != NULL) *der_len = hlen + vlen; if (der == NULL || err != HAL_OK) return err; hal_assert(hlen + vlen <= der_max); der += hlen; uint32_t m = n; for (size_t i = vlen; i > 0; --i) { der[i - 1] = m & 0xff; m >>= 8; } return HAL_OK; } /* * Encode an ASN.1 OCTET STRING. If der is NULL, just return the length * of what we would have encoded. */ hal_error_t hal_asn1_encode_octet_string(const uint8_t * const data, const size_t data_len, uint8_t *der, size_t *der_len, const size_t der_max) { if (data_len == 0 || (der != NULL && data == NULL)) return HAL_ERROR_BAD_ARGUMENTS; size_t hlen; hal_error_t err; if ((err = hal_asn1_encode_header(ASN1_OCTET_STRING, data_len, NULL, &hlen, 0)) != HAL_OK) return err; if (der_len != NULL) *der_len = hlen + data_len; if (der == NULL) return HAL_OK; hal_assert(hlen + data_len <= der_max); /* * Handle data early, in case it was staged into our output buffer. */ memmove(der + hlen, data, data_len); if ((err = hal_asn1_encode_header(ASN1_OCTET_STRING, data_len, der, &hlen, der_max)) != HAL_OK) return err; return HAL_OK; } /* * Encode a public key into a X.509 SubjectPublicKeyInfo (RFC 5280). */ hal_error_t hal_asn1_encode_spki(const uint8_t * const alg_oid, const size_t alg_oid_len, const uint8_t * const curve_oid, const size_t curve_oid_len, const uint8_t * const pubkey, const size_t pubkey_len, uint8_t *der, size_t *der_len, const size_t der_max) { if (alg_oid == NULL || alg_oid_len == 0 || pubkey_len == 0 || (der != NULL && pubkey == NULL) || (curve_oid == NULL && curve_oid_len != 0)) return HAL_ERROR_BAD_ARGUMENTS; const uint8_t curve_oid_tag = curve_oid == NULL ? ASN1_NULL : ASN1_OBJECT_IDENTIFIER; hal_error_t err; size_t hlen, hlen_spki, hlen_algid, hlen_alg, hlen_curve, hlen_bit; if ((err = hal_asn1_encode_header(ASN1_OBJECT_IDENTIFIER, alg_oid_len, NULL, &hlen_alg, 0)) != HAL_OK || (err = hal_asn1_encode_header(curve_oid_tag, curve_oid_len, NULL, &hlen_curve, 0)) != HAL_OK || (err = hal_asn1_encode_header(ASN1_BIT_STRING, 1 + pubkey_len, NULL, &hlen_bit, 0)) != HAL_OK) return err; const size_t algid_len = hlen_alg + alg_oid_len + hlen_curve + curve_oid_len; if ((err = hal_asn1_encode_header(ASN1_SEQUENCE, algid_len, NULL, &hlen_algid, 0)) != HAL_OK) return err; const size_t vlen = hlen_algid + hlen_alg + alg_oid_len + hlen_curve + curve_oid_len + hlen_bit + 1 + pubkey_len; if ((err = hal_asn1_encode_header(ASN1_SEQUENCE, vlen, NULL, &hlen_spki, 0)) != HAL_OK) return err; /* * Handle pubkey early, in case it was staged into our output buffer. */ if (der != NULL && hlen_spki + vlen <= der_max) memmove(der + hlen_spki + vlen - pubkey_len, pubkey, pubkey_len); err = hal_asn1_encode_header(ASN1_SEQUENCE, vlen, der, &hlen, der_max); if (der_len != NULL) *der_len = hlen + vlen; if (der == NULL || err != HAL_OK) return err; uint8_t *d = der + hlen; memset(d, 0, vlen - pubkey_len); if ((err = hal_asn1_encode_header(ASN1_SEQUENCE, algid_len, d, &hlen, der + der_max - d)) != HAL_OK) return err; d += hlen; if ((err = hal_asn1_encode_header(ASN1_OBJECT_IDENTIFIER, alg_oid_len, d, &hlen, der + der_max - d)) != HAL_OK) return err; d += hlen; memcpy(d, alg_oid, alg_oid_len); d += alg_oid_len; if ((err = hal_asn1_encode_header(curve_oid_tag, curve_oid_len, d, &hlen, der + der_max - d)) != HAL_OK) return err; d += hlen; if (curve_oid != NULL) memcpy(d, curve_oid, curve_oid_len); d += curve_oid_len; if ((err = hal_asn1_encode_header(ASN1_BIT_STRING, 1 + pubkey_len, d, &hlen, der + der_max - d)) != HAL_OK) return err; d += hlen; *d++ = 0x00; d += pubkey_len; /* pubkey handled early, above. */ hal_assert(d == der + hlen_spki + vlen); hal_assert(d <= der + der_max); return HAL_OK; } /* * Encode a PKCS #8 PrivateKeyInfo (RFC 5208). */ hal_error_t hal_asn1_encode_pkcs8_privatekeyinfo(const uint8_t * const alg_oid, const size_t alg_oid_len, const uint8_t * const curve_oid, const size_t curve_oid_len, const uint8_t * const privkey, const size_t privkey_len, uint8_t *der, size_t *der_len, const size_t der_max) { if (alg_oid == NULL || alg_oid_len == 0 || privkey_len == 0 || (der != NULL && privkey == NULL) || (curve_oid == NULL && curve_oid_len != 0)) return HAL_ERROR_BAD_ARGUMENTS; const uint8_t curve_oid_tag = curve_oid == NULL ? ASN1_NULL : ASN1_OBJECT_IDENTIFIER; fp_int version[1] = INIT_FP
# Copyright (c) 2015-2018, NORDUnet A/S
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
# - Redistributions of source code must retain the above copyright notice,
#   this list of conditions and the following disclaimer.
#
# - Redistributions in binary form must reproduce the above copyright
#   notice, this list of conditions and the following disclaimer in the
#   documentation and/or other materials provided with the distribution.
#
# - Neither the name of the NORDUnet nor the names of its contributors may
#   be used to endorse or promote products derived from this software
#   without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
# IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
# PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

# Number of various kinds of static state blocks to allocate.
# Numbers pulled out of a hat, tune as we go.

STATIC_CORE_STATE_BLOCKS = 32
STATIC_HASH_STATE_BLOCKS = 32
STATIC_HMAC_STATE_BLOCKS = 16
STATIC_PKEY_STATE_BLOCKS = 256
STATIC_KS_VOLATILE_SLOTS = 4352

LIB		= libhal.a

# Error checking on known control options, some of which allow the user entirely too much rope.

USAGE := "usage: ${MAKE} [IO_BUS=eim|i2c|fmc] [RPC_MODE=none|server|client-simple|client-mixed] [RPC_TRANSPORT=none|loopback|serial|daemon] [MODEXP_CORE=no|yes] [HASH_CORES=no|yes] [ECDSA_CORES=no|yes]"

IO_BUS		?= none
RPC_MODE	?= none
RPC_TRANSPORT	?= none
MODEXP_CORE	?= yes
HASH_CORES	?= no
ECDSA_CORES	?= yes

ifeq (,$(and \
	$(filter	none eim i2c fmc			,${IO_BUS}),\
	$(filter	none server client-simple client-mixed	,${RPC_MODE}),\
	$(filter	none loopback serial daemon		,${RPC_TRANSPORT}),\
	$(filter	no yes					,${MODEXP_CORE}),\
	$(filter	no yes					,${HASH_CORES}),\
	$(filter	no yes					,${ECDSA_CORES})))
  $(error ${USAGE})
endif

$(info Building libhal with configuration IO_BUS=${IO_BUS} RPC_MODE=${RPC_MODE} RPC_TRANSPORT=${RPC_TRANSPORT} MODEXP_CORE=${MODEXP_CORE} HASH_CORES=${HASH_CORES} ECDSA_CORES=${ECDSA_CORES})

# Whether the RSA code should use the ModExp | ModExpS6 | ModExpA7 core.

ifeq "${MODEXP_CORE}" "yes"
  RSA_USE_MODEXP_CORE := 1
else
  RSA_USE_MODEXP_CORE := 0
endif

# Whether the hash code should use the SHA-1 / SHA-256 / SHA-512 cores.

ifeq "${HASH_CORES}" "yes"
  HASH_ONLY_USE_SOFT_CORES := 0
else
  HASH_ONLY_USE_SOFT_CORES := 1
endif

# Whether the ECDSA code should use the ECDSA256 and ECDSA384 cores.

ifeq "${ECDSA_CORES}" "yes"
  ECDSA_USE_ECDSA256_CORE := 1
  ECDSA_USE_ECDSA384_CORE := 1
else
  ECDSA_USE_ECDSA256_CORE := 0
  ECDSA_USE_ECDSA384_CORE := 0
endif

# Object files to build, initialized with ones we always want.
# There's a balance here between skipping files we don't strictly
# need and reducing the number of unnecessary conditionals in this
# makefile, so the working definition of "always want" is sometimes
# just "building this is harmless even if we don't use it."

OBJ += errorstrings.o hash.o asn1.o ecdsa.o rsa.o hashsig.o xdr.o slip.o
OBJ += rpc_api.o rpc_hash.o uuid.o rpc_pkcs1.o crc32.o locks.o logging.o

# Object files to build when we're on a platform with direct access
# to our hardware (Verilog) cores.

CORE_OBJ = core.o csprng.o pbkdf2.o aes_keywrap.o modexp.o mkmif.o ${IO_OBJ}

# I/O bus to the FPGA
#
# IO_BUS = none | eim | i2c | fmc
#  none:	No FPGA I/O bus
#   eim:	EIM bus from Novena
#   i2c:	Older I2C bus from Novena
#   fmc:	FMC bus from dev-bridge and alpha boards

IO_OBJ = hal_io.o
ifeq "${IO_BUS}" "eim"
  IO_OBJ += hal_io_eim.o novena-eim.o
else ifeq "${IO_BUS}" "i2c"
  IO_OBJ += hal_io_i2c.o
else ifeq "${IO_BUS}" "fmc"
  IO_OBJ += hal_io_fmc.o
endif

# If we're building for STM32, position-independent code leads to some
# hard-to-debug function pointer errors. OTOH, if we're building for Linux
# (even on the Novena), we want to make it possible to build a shared library.

ifneq "${IO_BUS}" "fmc"
  CFLAGS += -fPIC
endif

# The keystore code has mutated a bit with the new API, and the Makefile,
# probably needs more extensive changes to track that.
#
# In the old world, the volatile keystore was for the client side,
# while the flash and mmap keystores were for the server side (on the
# Alpha and the Novena, respectively).
#
# In the new world, all keystores are on the server side, and the
# volatile keystore is always present, to support things like PKCS #11
# "session" objects.

KS_OBJ = ks.o ks_index.o ks_attribute.o ks_volatile.o ks_token.o mkm.o

# RPC_MODE = none | server | client-simple | client-mixed
#   none:		Build without RPC client, use cores directly.
#   server:		Build for server side of RPC (HSM), use cores directly.
#   client-simple:	Build for other host, communicate with cores via RPC server.
#   client-mixed:	Like client-simple but do hashing locally in software and
#			support a local keystore (for PKCS #11 public keys, etc)
#
# RPC_TRANSPORT = none | loopback | serial | daemon
#   loopback:		Communicate over loopback socket on Novena
#   serial:		Communicate over USB in serial pass-through mode
#   daemon:		Communicate over USB via a daemon, to arbitrate multiple clients
#
# Note that RPC_MODE setting also controls the RPC_CLIENT setting passed to the C
# preprocessor via CFLAGS.  Whatever we pass here must evaluate to an integer in
# the C preprocessor: we can use symbolic names so long as they're defined as macros
# in the C code, but we can't use things like C enum symbols.

RPC_CLIENT_OBJ = rpc_client.o

ifeq "${RPC_TRANSPORT}" "loopback"
  RPC_CLIENT_OBJ += rpc_client_loopback.o
else ifeq "${RPC_TRANSPORT}" "serial"
  RPC_CLIENT_OBJ += rpc_serial.o rpc_client_serial.o
else ifeq "${RPC_TRANSPORT}" "daemon"
  RPC_CLIENT_OBJ += rpc_client_daemon.o
endif

RPC_SERVER_OBJ = ${KS_OBJ} rpc_misc.o rpc_pkey.o rpc_server.o

ifeq "${RPC_TRANSPORT}" "loopback"
  RPC_SERVER_OBJ += rpc_server_loopback.o
else ifeq "${RPC_TRANSPORT}" "serial"
  RPC_SERVER_OBJ += rpc_server_serial.o
endif

ifeq "${RPC_MODE}" "none"
  OBJ += ${CORE_OBJ}
  CFLAGS += -DHAL_RSA_SIGN_USE_MODEXP=${RSA_USE_MODEXP_CORE}
  CFLAGS += -DHAL_ONLY_USE_SOFTWARE_HASH_CORES=${HASH_ONLY_USE_SOFT_CORES}
  CFLAGS += -DHAL_ECDSA_VERILOG_ECDSA256_MULTIPLIER=${ECDSA_USE_ECDSA256_CORE}
  CFLAGS += -DHAL_ECDSA_VERILOG_ECDSA384_MULTIPLIER=${ECDSA_USE_ECDSA384_CORE}
else ifeq "${RPC_MODE}" "server"
  OBJ += ${CORE_OBJ} ${RPC_SERVER_OBJ}
  CFLAGS += -DRPC_CLIENT=RPC_CLIENT_LOCAL
  CFLAGS += -DHAL_RSA_SIGN_USE_MODEXP=${RSA_USE_MODEXP_CORE}
  CFLAGS += -DHAL_ONLY_USE_SOFTWARE_HASH_CORES=${HASH_ONLY_USE_SOFT_CORES}
  CFLAGS += -DHAL_ECDSA_VERILOG_ECDSA256_MULTIPLIER=${ECDSA_USE_ECDSA256_CORE}
  CFLAGS += -DHAL_ECDSA_VERILOG_ECDSA384_MULTIPLIER=${ECDSA_USE_ECDSA384_CORE}
else ifeq "${RPC_MODE}" "client-simple"
  OBJ += ${RPC_CLIENT_OBJ}
  CFLAGS += -DRPC_CLIENT=RPC_CLIENT_REMOTE
  CFLAGS += -DHAL_RSA_SIGN_USE_MODEXP=0
  CFLAGS += -DHAL_ONLY_USE_SOFTWARE_HASH_CORES=1
  CFLAGS += -DHAL_ECDSA_VERILOG_ECDSA256_MULTIPLIER=0
  CFLAGS += -DHAL_ECDSA_VERILOG_ECDSA384_MULTIPLIER=0
else ifeq "${RPC_MODE}" "client-mixed"
  OBJ += ${RPC_CLIENT_OBJ}
  CFLAGS += -DRPC_CLIENT=RPC_CLIENT_MIXED
  CFLAGS += -DHAL_RSA_SIGN_USE_MODEXP=0
  CFLAGS += -DHAL_ONLY_USE_SOFTWARE_HASH_CORES=1
  CFLAGS += -DHAL_ECDSA_VERILOG_ECDSA256_MULTIPLIER=0
  CFLAGS += -DHAL_ECDSA_VERILOG_ECDSA384_MULTIPLIER=0
endif

ifndef CRYPTECH_ROOT
  CRYPTECH_ROOT := $(abspath ../..)
endif

LIBHAL_SRC	?= ${CRYPTECH_ROOT}/sw/libhal
LIBHAL_BLD	?= ${LIBHAL_SRC}
LIBTFM_SRC	?= ${CRYPTECH_ROOT}/sw/thirdparty/libtfm
LIBTFM_BLD	?= ${LIBTFM_SRC}

# tfm.h is a generated file, because our Makefile customizes a few
# settings from the upstream libtfm distribution.  Because of this, we
# need to search the libtfm build directory, not the libtfm source
# directory.

CFLAGS		+= -g3 -Wall -std=c99 -Wno-strict-aliasing
CFLAGS		+= -DHAL_STATIC_CORE_STATE_BLOCKS=${STATIC_CORE_STATE_BLOCKS}
CFLAGS		+= -DHAL_STATIC_HASH_STATE_BLOCKS=${STATIC_HASH_STATE_BLOCKS}
CFLAGS		+= -DHAL_STATIC_HMAC_STATE_BLOCKS=${STATIC_HMAC_STATE_BLOCKS}
CFLAGS		+= -DHAL_STATIC_PKEY_STATE_BLOCKS=${STATIC_PKEY_STATE_BLOCKS}
CFLAGS		+= -DHAL_STATIC_KS_VOLATILE_SLOTS=${STATIC_KS_VOLATILE_SLOTS}
CFLAGS		+= -I${LIBHAL_SRC}
CFLAGS		+= -I${LIBTFM_BLD}

# Enable software hash cores everywhere for now.  In theory, there might be situations
# where we don't want them on the HSM, but they're relatively harmless, and the bootstrap
# sequence on new hardware works a lot better when we can log in before loading the FPGA.

CFLAGS		+= -DHAL_ENABLE_SOFTWARE_HASH_CORES=1

# We used to "export CFLAGS" here, but for some reason that causes GNU
# make to duplicate its value, sometimes with conflicting settings.
# Weird, but this is complicated enough already, so we just pass
# CFLAGS explicitly in the small number of cases where we run a
# sub-make, below.

#export CFLAGS

export RPC_MODE
export LIBHAL_SRC LIBHAL_BLD LIBTFM_BLD

all: ${LIB}
	${MAKE} -C tests $@ CFLAGS='${CFLAGS}'
	${MAKE} -C utils $@ CFLAGS='${CFLAGS}'

client:
	${MAKE} RPC_MODE=client-simple RPC_TRANSPORT=daemon

mixed:
	${MAKE} RPC_MODE=client-mixed RPC_TRANSPORT=daemon

server:
	${MAKE} RPC_MODE=server RPC_TRANSPORT=serial IO_BUS=fmc

serial:
	${MAKE} RPC_MODE=client-mixed RPC_TRANSPORT=serial

daemon: mixed

.PHONY: client mixed server serial daemon

${LIB}: ${OBJ}
	${AR} rcs $@ $^

asn1.o rsa.o ecdsa.o:						asn1_internal.h
ecdsa.o:							ecdsa_curves.h
${OBJ}:								hal.h
${OBJ}:								hal_internal.h
ks.o ks_token.o ks_volatile.o ks_attribute.o ks_index.o:	ks.h
ks_token.o:							last_gasp_pin_internal.h
novena-eim.o hal_io_eim.o:					novena-eim.h
slip.o rpc_client_serial.o rpc_server_serial.o:			slip_internal.h
${OBJ}:								verilog_constants.h
rpc_client.o rpc_server.o xdr.o:				xdr_internal.h
hashsig.o:                                                      hashsig.h

last_gasp_pin_internal.h:
	./utils/last_gasp_default_pin >$@

test: all
	${MAKE} -C tests -k $@ CFLAGS='${CFLAGS}'

clean:
	rm -f *.o ${LIB}
	${MAKE} -C tests $@
	${MAKE} -C utils $@

distclean: clean
	rm -f TAGS

tags: TAGS

TAGS: *.[ch] tests/*.[ch] utils/*.[ch]
	etags $^

help usage:
	@echo ${USAGE}
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-08 17:16:04 +0000