Skip to content

Introduce HKDF to PKCS11 TA #7837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Hussainity wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Introduce HKDF to PKCS11 TA #7837

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c360e44
core: tee: tee_svc_cryp: default TEE_ALG_HKDF hash to SHA-256
Hussainity Jun 10, 2026
4b61d52
libutee: tee_api_operations: accept TEE_ALG_HKDF in TEE_AllocateOpera…
Hussainity Jun 10, 2026
09a85c2
ta: pkcs11: Introduce HKDF_DERIVE support
Hussainity Jun 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion core/tee/tee_svc_cryp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3350,7 +3350,7 @@ static TEE_Result get_hkdf_params(uint32_t algo, const TEE_Attribute *params,
*salt_len = *info_len = *okm_len = 0;

if (algo == TEE_ALG_HKDF) {
*hash_id = TEE_ALG_SHA256;
*hash_id = TEE_ALG_GET_DIGEST_HASH(TEE_ALG_HKDF_SHA256_DERIVE_KEY);
} else {
*hash_id = TEE_ALG_GET_DIGEST_HASH(algo);
found |= HASH;
Expand Down
1 change: 1 addition & 0 deletions lib/libutee/tee_api_operations.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,6 +242,7 @@ TEE_Result TEE_AllocateOperation(TEE_OperationHandle *operation,
case __OPTEE_ALG_ECDH_P256:
case __OPTEE_ALG_ECDH_P384:
case __OPTEE_ALG_ECDH_P521:
case TEE_ALG_HKDF:
case TEE_ALG_HKDF_MD5_DERIVE_KEY:
case TEE_ALG_HKDF_SHA1_DERIVE_KEY:
case TEE_ALG_HKDF_SHA224_DERIVE_KEY:
Expand Down
11 changes: 11 additions & 0 deletions ta/pkcs11/include/pkcs11_ta.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1329,6 +1329,7 @@ enum pkcs11_mechanism_id {
PKCS11_CKM_AES_CMAC_GENERAL = 0x0108b,
PKCS11_CKM_AES_ECB_ENCRYPT_DATA = 0x01104,
PKCS11_CKM_AES_CBC_ENCRYPT_DATA = 0x01105,
PKCS11_CKM_HKDF_DERIVE = 0x0402a,
/*
* Vendor extensions below.
* PKCS11 added IDs for operation not related to a CK mechanism ID
Expand All @@ -1337,6 +1338,16 @@ enum pkcs11_mechanism_id {
PKCS11_CKM_UNDEFINED_ID = PKCS11_UNDEFINED_ID,
};

/*
* Valid values for HKDF source selectors
* PKCS11_CKF_HKDF_SALT_<x> reflects CryptoKi client API IDs CKF_HKDF_SALT_<x>.
*/
enum pkcs11_hkdf_salt_type {
PKCS11_CKF_HKDF_SALT_NULL = 0x00000001,
PKCS11_CKF_HKDF_SALT_DATA = 0x00000002,
PKCS11_CKF_HKDF_SALT_KEY = 0x00000004,
};

/*
* PKCS11_CKD_<x> reflects CryptoKi client API key diff function IDs CKD_<x>.
*/
Expand Down
7 changes: 7 additions & 0 deletions ta/pkcs11/src/pkcs11_attributes.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1654,6 +1654,7 @@ check_created_attrs_against_processing(uint32_t proc_id,
switch (proc_id) {
case PKCS11_PROCESSING_IMPORT:
case PKCS11_CKM_ECDH1_DERIVE:
case PKCS11_CKM_HKDF_DERIVE:
case PKCS11_CKM_AES_ECB:
case PKCS11_CKM_AES_CBC:
case PKCS11_CKM_AES_ECB_ENCRYPT_DATA:
Expand Down Expand Up @@ -1962,6 +1963,12 @@ check_parent_attrs_against_processing(enum pkcs11_mechanism_id proc_id,
else
return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;

case PKCS11_CKM_HKDF_DERIVE:
if (key_class != PKCS11_CKO_SECRET_KEY ||
key_type != PKCS11_CKK_GENERIC_SECRET)
return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
break;

@etienne-lms etienne-lms Jun 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add an empty line below, for conssitency.


case PKCS11_CKM_AES_ECB_ENCRYPT_DATA:
case PKCS11_CKM_AES_CBC_ENCRYPT_DATA:
if (key_class != PKCS11_CKO_SECRET_KEY &&
Expand Down
10 changes: 10 additions & 0 deletions ta/pkcs11/src/processing.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -995,6 +995,16 @@ enum pkcs11_rc entry_processing_key(struct pkcs11_client *client,
if (rc)
goto out;

} else if (processing_is_tee_hkdf(proc_params->id)) {
if (function != PKCS11_FUNCTION_DERIVE)
TEE_Panic(function);

rc = derive_key_by_hkdf(session, proc_params, parent, &head);
if (rc)
goto out;

goto done;

} else if (processing_is_tee_asymm(proc_params->id)) {
switch (function) {
case PKCS11_FUNCTION_DERIVE:
Expand Down
11 changes: 11 additions & 0 deletions ta/pkcs11/src/processing.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,6 +201,17 @@ enum pkcs11_rc step_digest_operation(struct pkcs11_session *session,
struct pkcs11_object *obj,
uint32_t ptypes, TEE_Param *params);

/*
* HKDF specific functions
*/

bool processing_is_tee_hkdf(enum pkcs11_mechanism_id proc_id);

enum pkcs11_rc derive_key_by_hkdf(struct pkcs11_session *session,
struct pkcs11_attribute_head *proc_params,
struct pkcs11_object *parent,
struct obj_attrs **head);

/*
* Elliptic curve crypto algorithm specific functions
*/
Expand Down
Loading
Loading