commit 8722d9e0d3f2e63a5b9efa3b68784d9d56a7dffc
author Alice Wang <aliceywang@google.com> Mon Feb 13 14:56:56 2023 +0000
committer Alice Wang <aliceywang@google.com> Mon Feb 13 15:11:20 2023 +0000
tree 93b3473c84453962f1f6c6c1602ca63c3cfa7a94
parent 4d61177c706b1bc7cddfc159e636c0f143bb6663

[dice] Move DiceSign/Verify nostd/std versions to diced_open_dice

As a step of merging the existing diced_open_dice_cbor library into
the new open-dice wrapper diced_open_dice.

Bug: 267575445
Test: atest diced_utils_test diced_sample_inputs_test \
diced_vendor_test diced_open_dice_cbor_test \
libdiced_open_dice_nostd.integration_test \
libdiced_open_dice.integration_test diced_open_dice_cbor_test

Change-Id: I1f8baecd92a516bc724741ffbe322b913f89db5b

diced/open_dice/src/dice.rs

diff --git a/diced/open_dice/src/dice.rs b/diced/open_dice/src/dice.rs
index ed7d843..c87bbfd 100644
--- a/diced/open_dice/src/dice.rs
+++ b/diced/open_dice/src/dice.rs
@@ -20,7 +20,8 @@
 use open_dice_cbor_bindgen::{
     DiceConfigType, DiceDeriveCdiCertificateId, DiceDeriveCdiPrivateKeySeed, DiceInputValues,
     DiceMainFlow, DICE_CDI_SIZE, DICE_HASH_SIZE, DICE_HIDDEN_SIZE, DICE_ID_SIZE,
-    DICE_INLINE_CONFIG_SIZE, DICE_PRIVATE_KEY_SEED_SIZE,
+    DICE_INLINE_CONFIG_SIZE, DICE_PRIVATE_KEY_SEED_SIZE, DICE_PRIVATE_KEY_SIZE,
+    DICE_PUBLIC_KEY_SIZE, DICE_SIGNATURE_SIZE,
 };
 use std::ptr;
 use zeroize::{Zeroize, ZeroizeOnDrop};
@@ -35,6 +36,12 @@
 pub const CDI_SIZE: usize = DICE_CDI_SIZE as usize;
 /// The size of a private key seed.
 pub const PRIVATE_KEY_SEED_SIZE: usize = DICE_PRIVATE_KEY_SEED_SIZE as usize;
+/// The size of a private key.
+pub const PRIVATE_KEY_SIZE: usize = DICE_PRIVATE_KEY_SIZE as usize;
+/// The size of a public key.
+pub const PUBLIC_KEY_SIZE: usize = DICE_PUBLIC_KEY_SIZE as usize;
+/// The size of a signature.
+pub const SIGNATURE_SIZE: usize = DICE_SIGNATURE_SIZE as usize;
 /// The size of an ID.
 pub const ID_SIZE: usize = DICE_ID_SIZE as usize;
 
@@ -48,6 +55,10 @@
 pub type Cdi = [u8; CDI_SIZE];
 /// Array type of private key seeds.
 pub type PrivateKeySeed = [u8; PRIVATE_KEY_SEED_SIZE];
+/// Array type of the public key.
+pub type PublicKey = [u8; PUBLIC_KEY_SIZE];
+/// Array type of the signature.
+pub type Signature = [u8; SIGNATURE_SIZE];
 /// Array type of DICE ID.
 pub type DiceId = [u8; ID_SIZE];
 

diced/open_dice/src/lib.rs

diff --git a/diced/open_dice/src/lib.rs b/diced/open_dice/src/lib.rs
index 7e8c59a..7e08956 100644
--- a/diced/open_dice/src/lib.rs
+++ b/diced/open_dice/src/lib.rs
@@ -34,7 +34,7 @@
     HIDDEN_SIZE, ID_SIZE, PRIVATE_KEY_SEED_SIZE,
 };
 pub use error::{check_result, DiceError, Result};
-pub use ops::{generate_certificate, hash, kdf};
+pub use ops::{generate_certificate, hash, kdf, sign, verify};
 #[cfg(feature = "std")]
 pub use retry::{
     retry_bcc_format_config_descriptor, retry_bcc_main_flow, retry_dice_main_flow,

diced/open_dice/src/ops.rs

diff --git a/diced/open_dice/src/ops.rs b/diced/open_dice/src/ops.rs
index 3c0ef23..21b7d9e 100644
--- a/diced/open_dice/src/ops.rs
+++ b/diced/open_dice/src/ops.rs
@@ -16,9 +16,12 @@
 //! It contains the set of functions that implement various operations that the
 //! main DICE functions depend on.
 
-use crate::dice::{Hash, InputValues, HASH_SIZE, PRIVATE_KEY_SEED_SIZE};
+use crate::dice::{
+    Hash, InputValues, PublicKey, Signature, HASH_SIZE, PRIVATE_KEY_SEED_SIZE, PRIVATE_KEY_SIZE,
+    SIGNATURE_SIZE,
+};
 use crate::error::{check_result, Result};
-use open_dice_cbor_bindgen::{DiceGenerateCertificate, DiceHash, DiceKdf};
+use open_dice_cbor_bindgen::{DiceGenerateCertificate, DiceHash, DiceKdf, DiceSign, DiceVerify};
 use std::ptr;
 
 /// Hashes the provided input using DICE's hash function `DiceHash`.
@@ -57,6 +60,38 @@
     })
 }
 
+/// Signs the `message` with the give `private_key` using `DiceSign`.
+pub fn sign(message: &[u8], private_key: &[u8; PRIVATE_KEY_SIZE]) -> Result<Signature> {
+    let mut signature = [0u8; SIGNATURE_SIZE];
+    // SAFETY: The function writes to the `signature` within the given bounds, and only reads the
+    // message and the private key. The first argument context is not used in this function.
+    check_result(unsafe {
+        DiceSign(
+            ptr::null_mut(), // context
+            message.as_ptr(),
+            message.len(),
+            private_key.as_ptr(),
+            signature.as_mut_ptr(),
+        )
+    })?;
+    Ok(signature)
+}
+
+/// Verifies the `signature` of the `message` with the given `public_key` using `DiceVerify`.
+pub fn verify(message: &[u8], signature: &Signature, public_key: &PublicKey) -> Result<()> {
+    // SAFETY: only reads the messages, signature and public key as constant values.
+    // The first argument context is not used in this function.
+    check_result(unsafe {
+        DiceVerify(
+            ptr::null_mut(), // context
+            message.as_ptr(),
+            message.len(),
+            signature.as_ptr(),
+            public_key.as_ptr(),
+        )
+    })
+}
+
 /// Generates an X.509 certificate from the given `subject_private_key_seed` and
 /// `input_values`, and signed by `authority_private_key_seed`.
 /// The subject private key seed is supplied here so the implementation can choose