DemesneGH commented on code in PR #209: URL: https://github.com/apache/incubator-teaclave-trustzone-sdk/pull/209#discussion_r2204880708
########## optee-utee/src/object/transient_object.rs: ########## @@ -0,0 +1,427 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +use alloc::vec::Vec; + +use optee_utee_sys as raw; + +use super::{Attribute, GenericObject, ObjectHandle}; +use crate::{Error, Result}; + +/// Define types of [TransientObject](crate::TransientObject) with +/// predefined maximum sizes. +#[repr(u32)] +pub enum TransientObjectType { + /// 128, 192, or 256 bits + Aes = 0xA0000010, + /// Always 64 bits including the parity bits. This gives an effective key + /// size of 56 bits + Des = 0xA0000011, + /// 128 or 192 bits including the parity bits. This gives effective key + /// sizes of 112 or 168 bits + Des3 = 0xA0000013, + /// Between 64 and 512 bits, multiple of 8 bits + HmacMd5 = 0xA0000001, + /// Between 80 and 512 bits, multiple of 8 bits + HmacSha1 = 0xA0000002, + /// Between 112 and 512 bits, multiple of 8 bits + HmacSha224 = 0xA0000003, + /// Between 192 and 1024 bits, multiple of 8 bits + HmacSha256 = 0xA0000004, + /// Between 256 and 1024 bits, multiple of 8 bits + HmacSha384 = 0xA0000005, + /// Between 256 and 1024 bits, multiple of 8 bits + HmacSha512 = 0xA0000006, + /// The number of bits in the modulus. 256, 512, 768, 1024, 1536 and + /// 2048-bit keys SHALL be supported. + /// Support for other key sizes including bigger key sizes is + /// implementation-dependent. Minimum key size is 256 bits + RsaPublicKey = 0xA0000030, + /// Same as [RsaPublicKey](crate::TransientObjectType::RsaPublicKey) key + /// size. + RsaKeypair = 0xA1000030, + /// Depends on Algorithm: + /// 1) [DsaSha1](crate::AlgorithmId::DsaSha1): + /// Between 512 and 1024 bits, multiple of 64 bits + /// 2) [DsaSha224](crate::AlgorithmId::DsaSha224): 2048 bits + /// 3) [DsaSha256](crate::AlgorithmId::DsaSha256): 2048 or 3072 bits + DsaPublicKey = 0xA0000031, + /// Same as [DsaPublicKey](crate::TransientObjectType::DsaPublicKey) key + /// size. + DsaKeypair = 0xA1000031, + /// From 256 to 2048 bits, multiple of 8 bits. + DhKeypair = 0xA1000032, + /// Between 160 and 521 bits. Conditional: Available only if at least + /// one of the ECC the curves defined in Table 6-14 with "generic" + /// equal to "Y" is supported. + EcdsaPublicKey = 0xA0000041, + /// Between 160 and 521 bits. Conditional: Available only if at least + /// one of the ECC curves defined in Table 6-14 with "generic" equal to + /// "Y" is supported. SHALL be same value as for ECDSA public key size. + EcdsaKeypair = 0xA1000041, + /// Between 160 and 521 bits. Conditional: Available only if at least + /// one of the ECC curves defined in Table 6-14 with "generic" equal to + /// "Y" is supported. + EcdhPublicKey = 0xA0000042, + /// Between 160 and 521 bits. Conditional: Available only if at least + /// one of the ECC curves defined in Table 6-14 with "generic" equal to + /// "Y" is supported. SHALL be same value as for ECDH public key size + EcdhKeypair = 0xA1000042, + /// 256 bits. Conditional: Available only if TEE_ECC_CURVE_25519 + /// defined in Table 6-14 is supported. + Ed25519PublicKey = 0xA0000043, + /// 256 bits. Conditional: Available only if TEE_ECC_CURVE_25519 + /// defined in Table 6-14 is supported. + Ed25519Keypair = 0xA1000043, + /// 256 bits. Conditional: Available only if TEE_ECC_CURVE_25519 + /// defined in Table 6-14 is supported. + X25519PublicKey = 0xA0000044, + /// 256 bits. Conditional: Available only if TEE_ECC_CURVE_25519 + /// defined in Table 6-14 is supported. + X25519Keypair = 0xA1000044, + /// Multiple of 8 bits, up to 4096 bits. This type is intended for secret + /// data that has been derived from a key derivation scheme. + GenericSecret = 0xA0000000, + /// Object is corrupted. + CorruptedObject = 0xA00000BE, + /// 0 – All data is in the associated data stream. + Data = 0xA00000BF, +} + +/// An object containing attributes but no data stream, which is reclaimed +/// when closed or when the TA instance is destroyed. +/// Transient objects are used to hold a cryptographic object (key or key-pair). +/// +/// Contrast [PersistentObject](crate::PersistentObject). +#[derive(Debug)] +pub struct TransientObject(ObjectHandle); + +impl TransientObject { + /// Create an object with a null handle which points to nothing. + pub fn null_object() -> Self { + Self(ObjectHandle::new_null()) + } Review Comment: Looks like `null_object()` is used in the crypto examples to initialize the session context, e.g.https://github.com/apache/incubator-teaclave-trustzone-sdk/blob/main/examples/acipher-rs/ta/src/main.rs#L39. Since refactoring the session context is planned but not urgent, I agree we keep `null_object()` for now and leave it for a future PR. @ivila Could you help to add a brief comment above `null_object()` explaining its current purpose and usage context? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: dev-unsubscr...@teaclave.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@teaclave.apache.org For additional commands, e-mail: dev-h...@teaclave.apache.org
