Skip to content

acipher: add dynamic algorithm selection and decryption support #133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

acipher: add dynamic algorithm selection and decryption support #133

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
61a8c38
acipher: add dynamic algorithm selection and decryption support
amey-raghatate Aug 7, 2025
1cb7c67
review_1: update as per the review comments
amey-raghatate Sep 8, 2025
bd48ca5
[REVIEW] update acipher TA and host as per review
amey-raghatate Oct 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
86 changes: 78 additions & 8 deletions acipher/host/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,24 +16,29 @@
/* For the UUID (found in the TA's h-file(s)) */
#include <acipher_ta.h>

#define ENCRYPT 1
#define DECRYPT 0

static void usage(int argc, char *argv[])
{
const char *pname = "acipher";

if (argc)
pname = argv[0];

fprintf(stderr, "usage: %s <key_size> <string to encrypt>\n", pname);
fprintf(stderr, "%s: %s <key_size> <string to encrypt> <algo name>\n",
__func__, pname);
exit(1);
}

static void get_args(int argc, char *argv[], size_t *key_size, void **inbuf,
size_t *inbuf_len)
size_t *inbuf_len, uint32_t *algo_num)
{
char *ep;
long ks;
char *algo;

if (argc != 3) {
if ((argc > 4) || (argc < 3)) {
warnx("Unexpected number of arguments %d (expected 2)",
argc - 1);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if ((argc > 4) || (argc < 3)) {
warnx("Unexpected number of arguments %d (expected 2)",
argc - 1);
if ((argc > 4) || (argc < 3)) {
warnx("Unexpected number of arguments %d", argc - 1);

usage(argc, argv);
Expand All @@ -52,6 +57,32 @@ static void get_args(int argc, char *argv[], size_t *key_size, void **inbuf,

*inbuf = argv[2];
*inbuf_len = strlen(argv[2]);

if (argc > 3) {
algo = argv[3];
printf("%s algo selected\n", algo);
if (strcmp(algo, "TA_ALG_OAEP_MGF1_SHA1") == 0) {
*algo_num = TA_ALG_OAEP_MGF1_SHA1;
} else if (strcmp(algo, "TA_ALG_OAEP_MGF1_SHA224") == 0) {
*algo_num = TA_ALG_OAEP_MGF1_SHA224;
} else if (strcmp(algo, "TA_ALG_OAEP_MGF1_SHA256") == 0) {
*algo_num = TA_ALG_OAEP_MGF1_SHA256;
} else if (strcmp(algo, "TA_ALG_OAEP_MGF1_SHA384") == 0) {
*algo_num = TA_ALG_OAEP_MGF1_SHA384;
} else if (strcmp(algo, "TA_ALG_OAEP_MGF1_SHA512") == 0) {
*algo_num = TA_ALG_OAEP_MGF1_SHA512;
} else if (strcmp(algo, "TA_ALG_PKCS1_V1_5") == 0) {
*algo_num = TA_ALG_PKCS1_V1_5;
} else {
printf("%s algo is invalid\n", algo);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For consistency:

Suggested change
printf("%s algo is invalid\n", algo);
fprintf(stderr, "%s algo is invalid\n", algo);

usage(argc, argv);
}
} else {
printf("TA_ALG_PKCS1_V1_5 algo selected\n");
*algo_num = TA_ALG_PKCS1_V1_5;
}


}

static void teec_err(TEEC_Result res, uint32_t eo, const char *str)
Expand All @@ -69,10 +100,13 @@ int main(int argc, char *argv[])
size_t key_size;
void *inbuf;
size_t inbuf_len;
void *outbuf = NULL;
size_t outbuf_len = 0;
size_t n;
uint32_t algo_num;
const TEEC_UUID uuid = TA_ACIPHER_UUID;

get_args(argc, argv, &key_size, &inbuf, &inbuf_len);
get_args(argc, argv, &key_size, &inbuf, &inbuf_len, &algo_num);

res = TEEC_InitializeContext(NULL, &ctx);
if (res)
Expand All @@ -95,26 +129,62 @@ int main(int argc, char *argv[])
memset(&op, 0, sizeof(op));
op.paramTypes = TEEC_PARAM_TYPES(TEEC_MEMREF_TEMP_INPUT,
TEEC_MEMREF_TEMP_OUTPUT,
TEEC_NONE, TEEC_NONE);
TEEC_VALUE_INPUT, TEEC_VALUE_INPUT);
op.params[0].tmpref.buffer = inbuf;
op.params[0].tmpref.size = inbuf_len;
op.params[2].value.a = ENCRYPT; /* encrypt */
op.params[3].value.a = algo_num;

res = TEEC_InvokeCommand(&sess, TA_ACIPHER_CMD_ENCRYPT, &op, &eo);
if (eo != TEEC_ORIGIN_TRUSTED_APP || res != TEEC_ERROR_SHORT_BUFFER)
teec_err(res, eo, "TEEC_InvokeCommand(TA_ACIPHER_CMD_ENCRYPT)");

outbuf_len = op.params[1].tmpref.size;
op.params[1].tmpref.buffer = malloc(op.params[1].tmpref.size);
if (!op.params[1].tmpref.buffer)
err(1, "Cannot allocate out buffer of size %zu",
op.params[1].tmpref.size);
outbuf_len);

res = TEEC_InvokeCommand(&sess, TA_ACIPHER_CMD_ENCRYPT, &op, &eo);
if (res)
teec_err(res, eo, "TEEC_InvokeCommand(TA_ACIPHER_CMD_ENCRYPT)");

outbuf = malloc(outbuf_len);
if (!outbuf)
err(1, "Cannot allocate out buffer of size %zu", outbuf_len);

memmove(outbuf, op.params[1].tmpref.buffer, outbuf_len);
printf("Encrypted buffer: ");
for (n = 0; n < op.params[1].tmpref.size; n++)
printf("%02x ", ((uint8_t *)op.params[1].tmpref.buffer)[n]);
for (n = 0; n < outbuf_len; n++)
printf("%02x ", ((uint8_t *)outbuf)[n]);
printf("\n");

memset(&op, 0, sizeof(op));
op.paramTypes = TEEC_PARAM_TYPES(TEEC_MEMREF_TEMP_INPUT,
TEEC_MEMREF_TEMP_OUTPUT,
TEEC_VALUE_INPUT, TEEC_VALUE_INPUT);
op.params[0].tmpref.buffer = outbuf;
op.params[0].tmpref.size = outbuf_len;
op.params[2].value.a = DECRYPT; /* decrypt */
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Having a command called TA_ACIPHER_CMD_ENCRYPT to do decryption is inconsistent. Please introduce TA_ACIPHER_CMD_DECRYPT instead.

op.params[3].value.a = algo_num;

res = TEEC_InvokeCommand(&sess, TA_ACIPHER_CMD_ENCRYPT, &op, &eo);
if (eo != TEEC_ORIGIN_TRUSTED_APP || res != TEEC_ERROR_SHORT_BUFFER)
teec_err(res, eo, "TEEC_InvokeCommand(TA_ACIPHER_CMD_DYCRYPT)");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DECRYPT

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually the command is still TA_ACIPHER_CMD_ENCRYPT.
Maybe update the message here and below (line 191):

		teec_err(res, eo, "Command TA_ACIPHER_CMD_ENCRYPT failed for decryption");

and at line 159 above:

 	res = TEEC_InvokeCommand(&sess, TA_ACIPHER_CMD_ENCRYPT, &op, &eo);
 	if (res)
-		teec_err(res, eo, "TEEC_InvokeCommand(TA_ACIPHER_CMD_ENCRYPT)");
+		teec_err(res, eo, "Command TA_ACIPHER_CMD_ENCRYPT failed for encryption");

Alternatively, introduce a dedicated command for decryption: TA_ACIPHER_CMD_DECRYPT.


op.params[1].tmpref.buffer = malloc(op.params[1].tmpref.size);
if (!op.params[1].tmpref.buffer)
err(1, "Cannot allocate out buffer of size %zu",
outbuf_len);

res = TEEC_InvokeCommand(&sess, TA_ACIPHER_CMD_ENCRYPT, &op, &eo);
if (res)
teec_err(res, eo, "TEEC_InvokeCommand(TA_ACIPHER_CMD_DYCRYPT)");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DECRYPT


if (memcmp(inbuf, op.params[1].tmpref.buffer, op.params[1].tmpref.size))
printf("message is not matching\n");
else
printf("message is matching successfully\n");

return 0;
}
72 changes: 62 additions & 10 deletions acipher/ta/acipher_ta.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,8 @@ static TEE_Result cmd_gen_key(struct acipher *state, uint32_t pt,

res = TEE_AllocateTransientObject(key_type, key_size, &key);
if (res) {
EMSG("TEE_AllocateTransientObject(%#" PRIx32 ", %" PRId32 "): %#" PRIx32, key_type, key_size, res);
EMSG("TEE_AllocateTransientObject(%#" PRIx32 ", %" PRId32 "): %#"
PRIx32, key_type, key_size, res);
return res;
}

Expand All @@ -49,6 +50,33 @@ static TEE_Result cmd_gen_key(struct acipher *state, uint32_t pt,
return TEE_SUCCESS;
}

static TEE_Result select_algo(uint32_t param, uint32_t *algo)
{
switch (param) {
case TA_ALG_PKCS1_V1_5:
*algo = TEE_ALG_RSAES_PKCS1_V1_5;
return TEE_SUCCESS;
case TA_ALG_OAEP_MGF1_SHA1:
*algo = TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA1;
return TEE_SUCCESS;
case TA_ALG_OAEP_MGF1_SHA224:
*algo = TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA224;
return TEE_SUCCESS;
case TA_ALG_OAEP_MGF1_SHA256:
*algo = TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA256;
return TEE_SUCCESS;
case TA_ALG_OAEP_MGF1_SHA384:
*algo = TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA384;
return TEE_SUCCESS;
case TA_ALG_OAEP_MGF1_SHA512:
*algo = TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA512;
return TEE_SUCCESS;
default:
EMSG("Invalid algo %u", param);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
EMSG("Invalid algo %u", param);
EMSG("Invalid algo %"PRIu32, param);

return TEE_ERROR_BAD_PARAMETERS;
}
}

static TEE_Result cmd_enc(struct acipher *state, uint32_t pt,
TEE_Param params[TEE_NUM_PARAMS])
{
Expand All @@ -57,13 +85,14 @@ static TEE_Result cmd_enc(struct acipher *state, uint32_t pt,
uint32_t inbuf_len;
void *outbuf;
uint32_t outbuf_len;
uint32_t alg_num;
TEE_OperationHandle op;
TEE_ObjectInfo key_info;
const uint32_t alg = TEE_ALG_RSAES_PKCS1_V1_5;
uint32_t encrypt;
const uint32_t exp_pt = TEE_PARAM_TYPES(TEE_PARAM_TYPE_MEMREF_INPUT,
TEE_PARAM_TYPE_MEMREF_OUTPUT,
TEE_PARAM_TYPE_NONE,
TEE_PARAM_TYPE_NONE);
TEE_PARAM_TYPE_VALUE_INPUT,
TEE_PARAM_TYPE_VALUE_INPUT);

if (pt != exp_pt)
return TEE_ERROR_BAD_PARAMETERS;
Expand All @@ -81,10 +110,21 @@ static TEE_Result cmd_enc(struct acipher *state, uint32_t pt,
outbuf = params[1].memref.buffer;
outbuf_len = params[1].memref.size;

res = TEE_AllocateOperation(&op, alg, TEE_MODE_ENCRYPT,
res = select_algo(params[3].value.a, &alg_num);
if (res != TEE_SUCCESS)
return res;

if (params[2].value.a)
encrypt = TEE_MODE_ENCRYPT;
else
encrypt = TEE_MODE_DECRYPT;

res = TEE_AllocateOperation(&op, alg_num, encrypt,
key_info.keySize);
if (res) {
EMSG("TEE_AllocateOperation(TEE_MODE_ENCRYPT, %#" PRIx32 ", %" PRId32 "): %#" PRIx32, alg, key_info.keySize, res);
EMSG("TEE_AllocateOperation(TEE_MODE_ENCRYPT, %#"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TEE_MODE_ENCRYPT or TEE_MODE_DECRYPT depending on encrypt.

PRIx32 ", %" PRId32 "): %#" PRIx32,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The show argument do not match the order used in TEE_AllocateOperation(). Not a big issue but one may found that confusing.

alg_num, key_info.keySize, res);
return res;
}

Expand All @@ -94,10 +134,22 @@ static TEE_Result cmd_enc(struct acipher *state, uint32_t pt,
goto out;
}

res = TEE_AsymmetricEncrypt(op, NULL, 0, inbuf, inbuf_len, outbuf,
&outbuf_len);
if (res) {
EMSG("TEE_AsymmetricEncrypt(%" PRId32 ", %" PRId32 "): %#" PRIx32, inbuf_len, params[1].memref.size, res);
if (encrypt == TEE_MODE_ENCRYPT) {
res = TEE_AsymmetricEncrypt(op, NULL, 0, inbuf,
inbuf_len, outbuf, &outbuf_len);
if (res) {
EMSG("TEE_AsymmetricEncrypt(%" PRId32 ", %"
PRId32 "): %#" PRIx32, inbuf_len,
params[1].memref.size, res);
}
} else {
res = TEE_AsymmetricDecrypt(op, NULL, 0, inbuf, inbuf_len,
outbuf, &outbuf_len);
if (res) {
EMSG("TEE_AsymmetricDecrypt(%" PRId32 ", %"
PRId32 "): %#" PRIx32, inbuf_len,
params[1].memref.size, res);
}
}
params[1].memref.size = outbuf_len;

Expand Down
8 changes: 8 additions & 0 deletions acipher/ta/include/acipher_ta.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,12 @@
*/
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need to add the algo: in params[3].value algorithm (TA_ALG_*)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually:

/*
 * in	params[0].memref  Input data to cipher
 * out	params[1].memref  Ciphered output data
 * in   params[2].value.a  Mode: 0 for decryption, any other value for encryption
 * in   params[3].value.a  Algorithm (TA_ALG_*)
 */

#define TA_ACIPHER_CMD_ENCRYPT 1

#define TA_ALG_PKCS1_V1_5 0
#define TA_ALG_OAEP_MGF1_SHA1 1
#define TA_ALG_OAEP_MGF1_SHA224 2
#define TA_ALG_OAEP_MGF1_SHA256 3
#define TA_ALG_OAEP_MGF1_SHA384 4
#define TA_ALG_OAEP_MGF1_SHA512 5

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe use GP TEE Internal Core API algorithm IDs? as suggestion by @jenswi-linaro in another P-R?
Nitpicking: could you remove the extra empty line.


#endif /* __ACIPHER_TA_H */