Line data    Source code

       1              : /*
       2              :  *
       3              :  *    Copyright (c) 2021-2022 Project CHIP Authors
       4              :  *
       5              :  *    Licensed under the Apache License, Version 2.0 (the "License");
       6              :  *    you may not use this file except in compliance with the License.
       7              :  *    You may obtain a copy of the License at
       8              :  *
       9              :  *        http://www.apache.org/licenses/LICENSE-2.0
      10              :  *
      11              :  *    Unless required by applicable law or agreed to in writing, software
      12              :  *    distributed under the License is distributed on an "AS IS" BASIS,
      13              :  *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
      14              :  *    See the License for the specific language governing permissions and
      15              :  *    limitations under the License.
      16              :  */
      17              : #include "DacOnlyPartialAttestationVerifier.h"
      18              : 
      19              : #include <controller/OperationalCredentialsDelegate.h>
      20              : #include <credentials/CHIPCert.h>
      21              : #include <credentials/CertificationDeclaration.h>
      22              : #include <credentials/DeviceAttestationConstructor.h>
      23              : #include <credentials/DeviceAttestationVendorReserved.h>
      24              : #include <crypto/CHIPCryptoPAL.h>
      25              : 
      26              : #include <lib/core/CHIPError.h>
      27              : #include <lib/support/CodeUtils.h>
      28              : #include <lib/support/ScopedBuffer.h>
      29              : #include <lib/support/Span.h>
      30              : 
      31              : using namespace chip::Crypto;
      32              : 
      33              : namespace chip {
      34              : namespace Credentials {
      35              : 
      36              : // As per specifications section 11.22.5.1. Constant RESP_MAX
      37              : constexpr size_t kMaxResponseLength = 900;
      38              : 
      39              : /**
      40              :  * The implementation should track DefaultDACVerifier::VerifyAttestationInformation but with the checks
      41              :  * disabled that are outlined at the top of DacOnlyPartialAttestationVerifier.h.
      42              :  */
      43            0 : void PartialDACVerifier::VerifyAttestationInformation(const DeviceAttestationVerifier::AttestationInfo & info,
      44              :                                                       Callback::Callback<OnAttestationInformationVerification> * onCompletion)
      45              : {
      46            0 :     AttestationVerificationResult attestationError = AttestationVerificationResult::kSuccess;
      47              : 
      48            0 :     AttestationCertVidPid dacVidPid;
      49            0 :     AttestationCertVidPid paiVidPid;
      50            0 :     AttestationCertVidPid paaVidPid;
      51              : 
      52            0 :     DeviceInfoForAttestation deviceInfo{
      53            0 :         .vendorId  = info.vendorId,
      54            0 :         .productId = info.productId,
      55            0 :     };
      56              : 
      57            0 :     VerifyOrExit(!info.attestationElementsBuffer.empty() && !info.attestationChallengeBuffer.empty() &&
      58              :                      !info.attestationSignatureBuffer.empty() && !info.paiDerBuffer.empty() && !info.dacDerBuffer.empty() &&
      59              :                      !info.attestationNonceBuffer.empty() && onCompletion != nullptr,
      60              :                  attestationError = AttestationVerificationResult::kInvalidArgument);
      61              : 
      62            0 :     VerifyOrExit(info.attestationElementsBuffer.size() <= kMaxResponseLength,
      63              :                  attestationError = AttestationVerificationResult::kInvalidArgument);
      64              : 
      65              :     // match DAC and PAI VIDs
      66              :     {
      67            0 :         VerifyOrExit(ExtractVIDPIDFromX509Cert(info.dacDerBuffer, dacVidPid) == CHIP_NO_ERROR,
      68              :                      attestationError = AttestationVerificationResult::kDacFormatInvalid);
      69            0 :         VerifyOrExit(ExtractVIDPIDFromX509Cert(info.paiDerBuffer, paiVidPid) == CHIP_NO_ERROR,
      70              :                      attestationError = AttestationVerificationResult::kPaiFormatInvalid);
      71            0 :         VerifyOrExit(paiVidPid.mVendorId.HasValue() && paiVidPid.mVendorId == dacVidPid.mVendorId,
      72              :                      attestationError = AttestationVerificationResult::kDacVendorIdMismatch);
      73            0 :         VerifyOrExit(dacVidPid.mProductId.HasValue(), attestationError = AttestationVerificationResult::kDacProductIdMismatch);
      74            0 :         if (paiVidPid.mProductId.HasValue())
      75              :         {
      76            0 :             VerifyOrExit(paiVidPid.mProductId == dacVidPid.mProductId,
      77              :                          attestationError = AttestationVerificationResult::kDacProductIdMismatch);
      78              :         }
      79              :     }
      80              : 
      81              :     {
      82            0 :         P256PublicKey remoteManufacturerPubkey;
      83            0 :         P256ECDSASignature deviceSignature;
      84              : 
      85            0 :         VerifyOrExit(ExtractPubkeyFromX509Cert(info.dacDerBuffer, remoteManufacturerPubkey) == CHIP_NO_ERROR,
      86              :                      attestationError = AttestationVerificationResult::kDacFormatInvalid);
      87              : 
      88              :         // Validate overall attestation signature on attestation information
      89              :         // SetLength will fail if signature doesn't fit
      90            0 :         VerifyOrExit(deviceSignature.SetLength(info.attestationSignatureBuffer.size()) == CHIP_NO_ERROR,
      91              :                      attestationError = AttestationVerificationResult::kAttestationSignatureInvalidFormat);
      92            0 :         memcpy(deviceSignature.Bytes(), info.attestationSignatureBuffer.data(), info.attestationSignatureBuffer.size());
      93            0 :         VerifyOrExit(ValidateAttestationSignature(remoteManufacturerPubkey, info.attestationElementsBuffer,
      94              :                                                   info.attestationChallengeBuffer, deviceSignature) == CHIP_NO_ERROR,
      95              :                      attestationError = AttestationVerificationResult::kAttestationSignatureInvalid);
      96            0 :     }
      97              : 
      98              :     {
      99            0 :         MutableByteSpan akid(deviceInfo.paaSKID);
     100              : 
     101            0 :         VerifyOrExit(ExtractAKIDFromX509Cert(info.paiDerBuffer, akid) == CHIP_NO_ERROR,
     102              :                      attestationError = AttestationVerificationResult::kPaiFormatInvalid);
     103              : 
     104            0 :         ChipLogProgress(Support, "PartialDACVerifier::CheckPAA skipping vid-scoped PAA check - PAARootStore disabled");
     105              :     }
     106              : 
     107              : #if !defined(CURRENT_TIME_NOT_IMPLEMENTED)
     108            0 :     VerifyOrExit(IsCertificateValidAtCurrentTime(info.dacDerBuffer) == CHIP_NO_ERROR,
     109              :                  attestationError = AttestationVerificationResult::kDacExpired);
     110              : #endif
     111              : 
     112            0 :     ChipLogProgress(Support, "PartialDACVerifier::CheckCertChain skipping cert chain check - PAARootStore disabled");
     113              : 
     114              :     {
     115            0 :         ByteSpan certificationDeclarationSpan;
     116            0 :         ByteSpan attestationNonceSpan;
     117              :         uint32_t timestampDeconstructed;
     118            0 :         ByteSpan firmwareInfoSpan;
     119            0 :         DeviceAttestationVendorReservedDeconstructor vendorReserved;
     120            0 :         ByteSpan certificationDeclarationPayload;
     121              : 
     122            0 :         deviceInfo.dacVendorId  = dacVidPid.mVendorId.Value();
     123            0 :         deviceInfo.dacProductId = dacVidPid.mProductId.Value();
     124            0 :         deviceInfo.paiVendorId  = paiVidPid.mVendorId.Value();
     125            0 :         deviceInfo.paiProductId = paiVidPid.mProductId.ValueOr(0);
     126            0 :         deviceInfo.paaVendorId  = paaVidPid.mVendorId.ValueOr(VendorId::NotSpecified);
     127              : 
     128            0 :         ChipLogProgress(
     129              :             Support,
     130              :             "PartialDACVerifier::VerifyAttestationInformation skipping PAA subject key id extraction - PAARootStore disabled");
     131              : 
     132            0 :         VerifyOrExit(DeconstructAttestationElements(info.attestationElementsBuffer, certificationDeclarationSpan,
     133              :                                                     attestationNonceSpan, timestampDeconstructed, firmwareInfoSpan,
     134              :                                                     vendorReserved) == CHIP_NO_ERROR,
     135              :                      attestationError = AttestationVerificationResult::kAttestationElementsMalformed);
     136              : 
     137              :         // Verify that Nonce matches with what we sent
     138            0 :         VerifyOrExit(attestationNonceSpan.data_equal(info.attestationNonceBuffer),
     139              :                      attestationError = AttestationVerificationResult::kAttestationNonceMismatch);
     140              : 
     141            0 :         ChipLogProgress(Support,
     142              :                         "PartialDACVerifier::VerifyAttestationInformation skipping CD signature check - LocalCSAStore disabled");
     143            0 :         VerifyOrExit(CMS_ExtractCDContent(certificationDeclarationSpan, certificationDeclarationPayload) == CHIP_NO_ERROR,
     144              :                      attestationError = AttestationVerificationResult::kPaaFormatInvalid);
     145              : 
     146            0 :         attestationError = ValidateCertificateDeclarationPayload(certificationDeclarationPayload, firmwareInfoSpan, deviceInfo);
     147            0 :         VerifyOrExit(attestationError == AttestationVerificationResult::kSuccess, attestationError = attestationError);
     148              :     }
     149              : 
     150            0 : exit:
     151            0 :     onCompletion->mCall(onCompletion->mContext, info, attestationError);
     152            0 : }
     153              : 
     154              : } // namespace Credentials
     155              : } // namespace chip