trussed 0.2.0

Modern Cryptographic Firmware
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74

mod client;

use serial_test::serial;
use trussed_core::{
    mechanisms::{P256, X255},
    syscall, try_syscall,
    types::{KeyId, Location::*, Mechanism, SignatureSerialization},
    CryptoClient, Error,
};

fn assert_sign_mechanims_reject(key: KeyId, client: &mut impl CryptoClient) {
    for m in [
        Mechanism::Ed255,
        Mechanism::HmacBlake2s,
        Mechanism::HmacSha1,
        Mechanism::HmacSha256,
        Mechanism::HmacSha512,
    ] {
        let res = try_syscall!(client.sign(m, key, &[48; 32], SignatureSerialization::Raw));
        assert!(
            res == Err(Error::WrongKeyKind)
                || res == Err(Error::MechanismNotAvailable)
                || res == Err(Error::NoSuchKey),
            "Got result: {res:?}"
        );
    }
}

fn assert_encrypt_mechanims_reject(key: KeyId, client: &mut impl CryptoClient) {
    for m in [Mechanism::Aes256Cbc, Mechanism::Chacha8Poly1305] {
        let res_encrypt = try_syscall!(client.encrypt(m, key, b"", b"", None));
        assert!(
            res_encrypt == Err(Error::WrongKeyKind)
                || res_encrypt == Err(Error::MechanismNotAvailable)
                || res_encrypt == Err(Error::NoSuchKey),
            "Got result: {res_encrypt:?}"
        );

        let res_decrypt = try_syscall!(client.decrypt(m, key, b"", b"", b"", b""));
        assert!(
            res_decrypt == Err(Error::WrongKeyKind)
                || res_decrypt == Err(Error::MechanismNotAvailable)
                || res_decrypt == Err(Error::NoSuchKey),
            "Got result: {res_decrypt:?}"
        );
    }
}

#[test]
#[serial]
fn p256() {
    client::get(|client| {
        let sk1 = syscall!(client.generate_p256_private_key(Internal)).key;
        let pk1 = syscall!(client.derive_p256_public_key(sk1, Volatile)).key;

        assert_sign_mechanims_reject(sk1, client);
        assert_sign_mechanims_reject(pk1, client);
        assert_encrypt_mechanims_reject(sk1, client);
        assert_encrypt_mechanims_reject(pk1, client);
    })
}

#[test]
#[serial]
fn x255() {
    client::get(|client| {
        let sk1 = syscall!(client.generate_x255_secret_key(Internal)).key;
        let pk1 = syscall!(client.derive_x255_public_key(sk1, Volatile)).key;
        assert_sign_mechanims_reject(sk1, client);
        assert_sign_mechanims_reject(pk1, client);
        assert_encrypt_mechanims_reject(sk1, client);
        assert_encrypt_mechanims_reject(pk1, client);
    })
}