NVIDIA DRIVE OS Linux API Reference

5.1.3.0 Release

 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
ote_nvcrypto.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2013-2018, NVIDIA CORPORATION. All rights reserved.
3  *
4  * Permission is hereby granted, free of charge, to any person obtaining a
5  * copy of this software and associated documentation files (the "Software"),
6  * to deal in the Software without restriction, including without limitation
7  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8  * and/or sell copies of the Software, and to permit persons to whom the
9  * Software is furnished to do so, subject to the following conditions:
10  *
11  * The above copyright notice and this permission notice shall be included in
12  * all copies or substantial portions of the Software.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
15  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
17  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
18  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
19  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
20  * DEALINGS IN THE SOFTWARE.
21  */
22 
41 #ifndef __OTE_NVCRYPTO_H
42 #define __OTE_NVCRYPTO_H
43 
44 #include <common/ote_error.h>
45 
51 // mobile and common cmd id (start from 0x00)
52 #define CRYPTO_SERVICE_SANITY_CHECK 0
53 #define CRYPTO_SERVICE_GET_KEYBOX 1
54 #define CRYPTO_SERVICE_GET_STORAGE_KEY 2
55 #define CRYPTO_SERVICE_GET_ROLLBACK_KEY 3
56 #define CRYPTO_SERVICE_GET_RO_TRUST_KEY 4
57 #define CRYPTO_SERVICE_GET_WV_SIG_RSA_KEY 5
58 #define CRYPTO_SERVICE_GET_GS_SIG_KEY 6
59 #define CRYPTO_SERVICE_GET_VUDU_PLATFORM_KEY 7 /* Deprecated */
60 #define CRYPTO_SERVICE_GET_HWRANDOM 8
61 #define CRYPTO_SERVICE_GET_EKS2_MAC_KEY 9U
62 #define CRYPTO_SERVICE_INSTALL_EKS2_KEYS 10U
63 #define CRYPTO_SERVICE_GET_WIDEVINE_KEY 11U
64 #define CRYPTO_SERVICE_GET_KEYBOX_ATTRIBUTE 12U
65 
66 // auto cmd id (start from 0x80)
67 #define CRYPTO_SERVICE_GET_STORAGE_MASTER_KEY CRYPTO_SERVICE_GET_STORAGE_KEY // for compatibility
68 #define CRYPTO_SERVICE_GET_RANDOM_NUMBER CRYPTO_SERVICE_GET_HWRANDOM
69 #define CRYPTO_SERVICE_DERIVE_KEY 0x80
70 #define CRYPTO_SERVICE_UPDATE_SE_KEYSLOT 0x81
71 #define CRYPTO_SERVICE_RSA_RAW_PRIVATE_ENCRYPT 0x82
72 #define CRYPTO_SERVICE_DO_CRYPT_FUNCTIONS 0x83
73 #define CRYPTO_SERVICE_GET_EFS_MASTER_KEY 0x84
74 /* Adding SE Keyslot access interface through crypto service */
75 #define CRYPTO_SERVICE_REQUEST_SE_KEYSLOT 0x85
76 #define CRYPTO_SERVICE_RELEASE_SE_KEYSLOT 0x86
77 
79 // AES, RSA keyslot types registered at kernel using apps manifest.c
80 #define KEYSLOT_TYPE_AES 0
81 #define KEYSLOT_TYPE_RSA 1
82 
83 // HW keyslot accessible setting
84 enum {
87 };
88 
89 /*
90  * @brief defines various key lookup schemes supported by NVCrypto
91  * for each lookup scheme, the key index has a different meaning
92  * KEY_LOOKUP_ABSOLUTE Absolute lookup. Use this option when a client knows the
93  * exact key index of the key slot. This option is for
94  * backward compatibility as old key lookup implementation
95  * uses absolute lookups. Ideally, this should be
96  * deprecated
97  * KEY_LOOKUP_RELATIVE Lookup relative to UUID. If there are more than one keys
98  * present for a given UUID, clients can use this lookup
99  * to get Nth key from the keyslots that they are allowed
100  * to access (UUID is an access control field)
101  * KEY_LOOKUP_BY_ID Lookup by entry ID. Each Key is uniquely identified by
102  * (UUID, Entry ID) tuple. Client can use this lookup if it
103  * knows the exact tuple to access.
104  */
105 typedef enum {
110 
111 /*
112  * @brief defines various attributes that can be queried for a keybox entry
113  *
114  * KEYBOX_ATTR_SIZE The length of a particular keybox entry
115  */
116 typedef enum {
119 
134 
142 
156 te_error_t ote_nvcrypto_get_keybox(uint32_t keybox_lookup_index,
157 keystore_lookup_type lookup_type, void *buf, uint32_t *len);
158 
170 te_error_t ote_nvcrypto_get_keybox_size(uint32_t keybox_lookup_index,
171 keystore_lookup_type lookup_type, uint32_t *len);
172 
180 te_error_t ote_nvcrypto_get_storage_key(uint8_t *key, uint32_t key_size);
181 
189 te_error_t ote_nvcrypto_get_rollback_key(uint8_t *key, uint32_t key_size);
190 
197 te_error_t ote_nvcrypto_get_ro_trust_key(uint8_t *key, uint32_t key_size);
198 
199 /* Size limit for HW RNG request */
200 #define MAX_HWRANDOM_SIZE 4096
201 
208 te_error_t ote_nvcrypto_get_random(uint8_t *buf, uint32_t buf_len);
209 
217 te_error_t ote_nvcrypto_get_wv_rsa_sig_key(uint8_t *key, uint32_t *key_size);
224 te_error_t ote_nvcrypto_get_gs_key(uint8_t *key, uint32_t *key_size);
225 
241 te_error_t ote_nvcrypto_get_key(uint8_t *key, uint32_t key_size, uint32_t key_type);
242 
256 te_error_t ote_nvcrypto_derive_key(const uint8_t *src_buffer,
257  const uint32_t src_buf_len, uint8_t *dest);
258 
266 te_error_t ote_nvcrypto_get_widevine_key(uint8_t *key, uint32_t key_size);
267 
277 te_error_t ote_nvcrypto_update_se_keyslot(uint32_t KeySlotType, uint32_t KeySlotIdx,
278  uint32_t access_control, const uint32_t *pData, uint32_t pData_len);
279 
297  uint8_t *pri_key,uint32_t pri_key_len, uint32_t *data_in,
298  uint32_t data_in_len, uint8_t* signedData, uint32_t signed_data_len);
299 
300 
317  uint32_t algo, uint32_t mode,
318  uint8_t *inbuf,uint32_t inbuf_len,
319  uint8_t *iv,uint32_t iv_len,
320  uint8_t *key,uint32_t key_len,
321  uint8_t *outbuf,uint32_t *outbuf_len);
322 
331 te_error_t ote_nvcrypto_get_eks2_mac_key(uint8_t *key, uint32_t *key_size);
332 
341 te_error_t ote_nvcrypto_install_eks2_keys(const uint8_t *buf, uint32_t buf_len, uint32_t num_keys);
342 
343 #endif
344 
te_error_t ote_nvcrypto_get_ro_trust_key(uint8_t *key, uint32_t key_size)
Gets the key derived from the root of trust.
te_error_t ote_nvcrypto_get_rollback_key(uint8_t *key, uint32_t key_size)
Gets the rollback key.
te_error_t ote_nvcrypto_get_gs_key(uint8_t *key, uint32_t *key_size)
Gets the vrr auth key.
keybox_attr_type
Definition: ote_nvcrypto.h:116
te_error_t ote_nvcrypto_get_random(uint8_t *buf, uint32_t buf_len)
Gets SE HW random number generated data.
te_error_t ote_nvcrypto_get_storage_key(uint8_t *key, uint32_t key_size)
Gets the storage key.
keystore_lookup_type
Definition: ote_nvcrypto.h:105
te_error_t ote_nvcrypto_rsa_raw_private_encrypt(uint8_t *pri_key, uint32_t pri_key_len, uint32_t *data_in, uint32_t data_in_len, uint8_t *signedData, uint32_t signed_data_len)
Interface sign a data blob with a RSA key with no data padding.
NVIDIA Trusted Little Kernel Interface: Error Handling
te_error_t ote_nvcrypto_init(void)
Initializes and opens an nvcrypto service session.
te_error_t ote_nvcrypto_do_crypt_functions(uint32_t algo, uint32_t mode, uint8_t *inbuf, uint32_t inbuf_len, uint8_t *iv, uint32_t iv_len, uint8_t *key, uint32_t key_len, uint8_t *outbuf, uint32_t *outbuf_len)
Interface for crypto operations such as AES, SHA, and RSA using openssl library.
te_error_t ote_nvcrypto_get_wv_rsa_sig_key(uint8_t *key, uint32_t *key_size)
Gets the wv rsa sig key.
te_error_t ote_nvcrypto_get_key(uint8_t *key, uint32_t key_size, uint32_t key_type)
Gets the storage/rollback key.
te_error_t ote_nvcrypto_install_eks2_keys(const uint8_t *buf, uint32_t buf_len, uint32_t num_keys)
Installs EKS2 keys in NVCrypto key slots.
te_error_t ote_nvcrypto_deinit(void)
Closes an nvcrypto service session.
te_error_t ote_nvcrypto_update_se_keyslot(uint32_t KeySlotType, uint32_t KeySlotIdx, uint32_t access_control, const uint32_t *pData, uint32_t pData_len)
Updates the HW security engine AES/RSA keyslots with an input Key.
te_error_t ote_nvcrypto_get_eks2_mac_key(uint8_t *key, uint32_t *key_size)
Gets the EKS2 mac key, which is used to validate integrity of the EKS2 blob coming from the non-secur...
te_error_t ote_nvcrypto_get_keybox_size(uint32_t keybox_lookup_index, keystore_lookup_type lookup_type, uint32_t *len)
Gets the size of the key box provisioned in the EKS partition.
te_error_t ote_nvcrypto_get_widevine_key(uint8_t *key, uint32_t key_size)
Gets the Widevine Device Unique key.
te_error_t
Defines Open Trusted Environment (OTE) error codes.
Definition: ote_error.h:45
te_error_t ote_nvcrypto_derive_key(const uint8_t *src_buffer, const uint32_t src_buf_len, uint8_t *dest)
Generates a unique encryption key by performing crypto operations on the src_buffer a predefined init...
te_error_t ote_nvcrypto_get_keybox(uint32_t keybox_lookup_index, keystore_lookup_type lookup_type, void *buf, uint32_t *len)
Gets the key box provisioned in the EKS partition.