CAAM operation failure with secure memory

[ethanyang]

Hi,

When we use the linux asynchronous crypto api calls with the secure memory slots as source and destination of the operations, they complete without reporting any error, but when we examine the destination slot, its contents remain unchanged.

When we use buffers allocated using kmalloc or buffers on the stack, the destination buffers are properly updated with the desired results.

Here is how we use the secure memory with the linux crypto API:

(we don't use unit 0 when establishing keystores.)

// init.. establist keystore using secure memory api, acquire/init cipher etc.
...
// allocate secure memory slots for src and dst
sm_keystore_slot_alloc(ksdev, unit, size, &slot_src);
sm_keystore_slot_alloc(ksdev, unit, size, &slot_dst);
// get address of the src and dst slots
addr_src=kspriv->slot_get_address(ksdev, unit, slot_src);
addr_dst = kspriv->slot_get_address(ksdev, unit, slot_dst);
// copy data to source (addr_src)
...
// set src and dst scatterlists
sg_init_one(&sg_src, addr_src, size);
sg_init_one(&sg_dst, addr_dst, size);
// invoke appropriate linux async crypto api calls
ablkcipher_request_set_crypt(ablk->req, &sg_src, &sg_dst, size, iv_data);
...

Is this using scenario allowed with the CAAM implementation?
And how to make it work?

Thanks.

[Yuri]

Hello,

  Hope the following helps.

https://community.nxp.com/message/825746 

Have a great day,
Yuri

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[ethanyang]

Yuri,

Thanks for your reply.

In the sample code, they use buffer allocated with kzalloc() as the

input = kzalloc(block_size, GFP_KERNEL | GFP_DMA);
 memcpy(input, text, block_size);
 sg_init_one(sg, input, block_size);
iv_len = crypto_ablkcipher_ivsize(tfm);
 if (iv_len)
 memset(&iv, 0xff, iv_len);
ablkcipher_request_set_crypt(req, sg, sg, block_size, iv);‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Is is possible to use the memory from keystore to do the ciphering?

1. addr_dst = kspriv->slot_get_address(ksdev, unit, slot_dst);  
2. sm_keystore_slot_alloc(ksdev, unit, size, &slot_dst);  

We need this when we're doing the key variant calculation.

We want the calculated result is located in the secure memory as it will be used as a cipher key.

Regards,

Ethan

[teddyhsiung]

Hi NXP Team,

Any update on this issue? We're still anticipating for your rely since September, thanks.

Best Regards

Teddy

[Yuri]

Hello,

 “CAAM implements operations that convert between blob encapsulation
and black-key encapsulation without exposing the key in plaintext.”

   But we do not have such example for publishing, sorry.

NXP Professional Services|NXP 

Regards,

Yuri.