openharmony/security_deviceauth
1
0
Fork 0
mirror of https://github.com/openharmony/security_deviceauth.git synced 2026-07-19 15:37:11 -04:00
Code Issues Packages Projects Releases Wiki Activity

clear sensitive data

Browse Source 
Signed-off-by: winnieHu <huyu35@huawei.com>
This commit is contained in:
winnieHu
2021-09-30 16:28:24 +08:00
parent a822f06b1d
commit ce5615c8c1
5 changed files with 38 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frameworks/deviceauth_lite/source/auth_info/add_auth_info.c
+11
View File
@@ -151,6 +151,7 @@ static int32_t save_import_auth_info(const struct hichain *hichain, const struct
}
int32_t ret = save_auth_info(hichain, pair_type, &cache);
(void)memset_s(&cache.ltpk, sizeof(struct ltpk), 0, sizeof(struct ltpk));
if (ret != HC_OK) {
LOGE("Save auth info failed, error code is %d", ret);
return HC_IMPORT_AUTH_DATA_FAILED;
@@ -202,6 +203,7 @@ int32_t import_signed_auth_info_hilink(const struct hichain *hichain, const stru
struct signature sign_result = { 0, {0} };
if (memcpy_s(sign_result.signature, sizeof(sign_result.signature), receive_data, HC_SIGNATURE_LEN) != EOK) {
(void)memset_s(receive_data, len, 0, len);
FREE(receive_data);
return memory_copy_error(__func__, __LINE__);
}
@@ -214,18 +216,23 @@ int32_t import_signed_auth_info_hilink(const struct hichain *hichain, const stru
(char *)message.val, JSON_STRING_DATA);
if (import_data == NULL) {
LOGE("Parse import add auth data failed");
(void)memset_s(receive_data, len, 0, len);
FREE(receive_data);
return HC_BUILD_OBJECT_FAILED;
}
int32_t ret = verify_import_auth_info(hichain, import_data, &message, &sign_result);
if (ret != HC_OK) {
(void)memset_s(receive_data, len, 0, len);
(void)memset_s(&import_data->ltpk, sizeof(struct ltpk), 0, sizeof(struct ltpk));
FREE(receive_data);
free_import_add_auth_data(import_data);
return ret;
}
ret = save_import_auth_info(hichain, auth_id, import_data);
(void)memset_s(receive_data, len, 0, len);
(void)memset_s(&import_data->ltpk, sizeof(struct ltpk), 0, sizeof(struct ltpk));
FREE(receive_data);
free_import_add_auth_data(import_data);
return ret;
@@ -262,11 +269,13 @@ int32_t import_signed_auth_info(const struct hichain *hichain, const struct hc_a
int32_t ret = verify_import_auth_info(hichain, import_data, &message, &sign_result);
if (ret != HC_OK) {
LOGE("Verify failed!");
(void)memset_s(&import_data->ltpk, sizeof(struct ltpk), 0, sizeof(struct ltpk));
free_import_add_auth_data(import_data);
return ret;
}
ret = save_import_auth_info(hichain, auth_id, import_data);
(void)memset_s(&import_data->ltpk, sizeof(struct ltpk), 0, sizeof(struct ltpk));
free_import_add_auth_data(import_data);
LOGI("Import signed auth info success");
return ret;
@@ -310,6 +319,7 @@ int32_t import_lite_auth_info(const struct hichain *hichain, const struct hc_aut
struct import_auth_data *import_data = (struct import_auth_data *)parse_import_add_auth_data(
(char *)out_plain.val, JSON_STRING_DATA);
(void)memset_s(out_plain.val, data->length, 0, data->length);
free_import_add_auth_data(out_plain.val);
out_plain.val = NULL;
if (import_data == NULL) {
@@ -318,6 +328,7 @@ int32_t import_lite_auth_info(const struct hichain *hichain, const struct hc_aut
}
ret = save_import_auth_info(hichain, auth_id, import_data);
(void)memset_s(&import_data->ltpk, sizeof(struct ltpk), 0, sizeof(struct ltpk));
free_import_add_auth_data(import_data);
if (ret != HC_OK) {
LOGE("Import lite auth info failed");
frameworks/deviceauth_lite/source/key_agreement/pake_client.c
+10
View File
@@ -65,6 +65,11 @@ void destroy_pake_client(struct pake_client *pake_client)
}
LOGI("Destroy pake client object %u success", pake_client_sn(pake_client));
(void)memset_s(&pake_client->pin, sizeof(struct hc_pin), 0, sizeof(struct hc_pin));
(void)memset_s(&pake_client->self_esk, sizeof(struct esk), 0, sizeof(struct esk));
(void)memset_s(&pake_client->session_key, sizeof(struct pake_session_key), 0, sizeof(struct pake_session_key));
(void)memset_s(&pake_client->hmac_key, sizeof(struct pake_hmac_key), 0, sizeof(struct pake_hmac_key));
(void)memset_s(&pake_client->service_key, sizeof(struct hc_session_key), 0, sizeof(struct hc_session_key));
FREE(pake_client);
}
@@ -204,12 +209,14 @@ static int32_t parse_start_response_data(void *handle, void *data)
uint32_t prime_len = 0;
ret = gen_esk_prime_len(pake_client, receive, &esk_len, &prime_len);
if (ret != HC_OK) {
(void)memset_s(&secret, sizeof(struct hkdf), 0, sizeof(struct hkdf));
return ret;
}
if (pake_client->client_info.protocol_base_info.state == START_REQUEST) {
struct random_value rand = generate_random(esk_len);
if (rand.length == 0) {
LOGE("Generate random value failed");
(void)memset_s(&secret, sizeof(struct hkdf), 0, sizeof(struct hkdf));
return HC_GEN_RANDOM_FAILED;
}
@@ -222,6 +229,7 @@ static int32_t parse_start_response_data(void *handle, void *data)
ret = cal_bignum_exp((struct var_buffer *)&secret, (struct var_buffer *)&exp,
prime_len, (struct big_num *)&base);
(void)memset_s(&secret, sizeof(struct hkdf), 0, sizeof(struct hkdf));
if (ret != HC_OK) {
return HC_CAL_BIGNUM_EXP_FAILED;
}
@@ -306,6 +314,7 @@ static int32_t generate_session_key(struct pake_client *pake_client, struct epk
struct hkdf hkdf = { 0, {0} };
ret = compute_hkdf((struct var_buffer *)&shared_secret, &pake_client->salt,
HICHAIN_SPEKE_SESSIONKEY_INFO, HC_HKDF_SECRET_LEN, (struct var_buffer *)&hkdf);
(void)memset_s(&shared_secret, sizeof(struct pake_shared_secret), 0, sizeof(struct pake_shared_secret));
if (ret != HC_OK) {
LOGE("Object %u generate hkdf failed, error code is %d", pake_client_sn(pake_client), ret);
goto error;
@@ -317,6 +326,7 @@ static int32_t generate_session_key(struct pake_client *pake_client, struct epk
hkdf.hkdf + PAKE_SESSION_KEY_LENGTH, PAKE_HMAC_KEY_LENGTH);
pake_client->session_key.length = PAKE_SESSION_KEY_LENGTH;
pake_client->hmac_key.length = PAKE_HMAC_KEY_LENGTH;
(void)memset_s(&hkdf, sizeof(struct hkdf), 0, sizeof(struct hkdf));
return HC_OK;
error:
frameworks/deviceauth_lite/source/key_agreement/pake_server.c
+9
View File
@@ -68,6 +68,11 @@ void destroy_pake_server(struct pake_server *pake_server)
}
LOGI("Destroy pake server object %u success", pake_server_sn(pake_server));
(void)memset_s(&pake_server->pin, sizeof(struct hc_pin), 0, sizeof(struct hc_pin));
(void)memset_s(&pake_server->self_esk, sizeof(struct esk), 0, sizeof(struct esk));
(void)memset_s(&pake_server->session_key, sizeof(struct pake_session_key), 0, sizeof(struct pake_session_key));
(void)memset_s(&pake_server->hmac_key, sizeof(struct pake_hmac_key), 0, sizeof(struct pake_hmac_key));
(void)memset_s(&pake_server->service_key, sizeof(struct hc_session_key), 0, sizeof(struct hc_session_key));
FREE(pake_server);
}
@@ -254,11 +259,13 @@ static int32_t generate_pake_params(struct pake_server *pake_server, struct epk
ret = cal_bignum_exp((struct var_buffer *)&secret, (struct var_buffer *)&exp,
prime_len, (struct big_num *)&base);
(void)memset_s(&secret, sizeof(struct hkdf), 0, sizeof(struct hkdf));
if (ret != HC_OK) {
return HC_CAL_BIGNUM_EXP_FAILED;
}
ret = cal_bignum_exp((struct var_buffer *)&base, (struct var_buffer *)&pake_server->self_esk,
prime_len, (struct big_num *)self_epk);
(void)memset_s(&base, sizeof(struct epk), 0, sizeof(struct epk));
if (ret != HC_OK) {
return HC_CAL_BIGNUM_EXP_FAILED;
}
@@ -373,6 +380,7 @@ static int32_t generate_session_key(struct pake_server *pake_server, struct epk
struct hkdf hkdf = { 0, {0} };
ret = compute_hkdf((struct var_buffer *)&shared_secret, &pake_server->salt,
HICHAIN_SPEKE_SESSIONKEY_INFO, HC_HKDF_SECRET_LEN, (struct var_buffer *)&hkdf);
(void)memset_s(&shared_secret, sizeof(struct pake_shared_secret), 0, sizeof(struct pake_shared_secret));
if (ret != HC_OK) {
LOGE("Object %u generate hkdf failed, error code is %d", pake_server_sn(pake_server), ret);
goto error;
@@ -384,6 +392,7 @@ static int32_t generate_session_key(struct pake_server *pake_server, struct epk
hkdf.hkdf + PAKE_SESSION_KEY_LENGTH, PAKE_HMAC_KEY_LENGTH);
pake_server->session_key.length = PAKE_SESSION_KEY_LENGTH;
pake_server->hmac_key.length = PAKE_HMAC_KEY_LENGTH;
(void)memset_s(&hkdf, sizeof(struct hkdf), 0, sizeof(struct hkdf));
return HC_OK;
error:
frameworks/deviceauth_lite/source/key_agreement/sts_client.c
+4 -1
View File
@@ -61,7 +61,9 @@ void destroy_sts_client(struct sts_client *handle)
DBG_OUT("Destroy sts client object failed");
return;
}
(void)memset_s(&handle->self_private_key, sizeof(struct stsk), 0, sizeof(struct stsk));
(void)memset_s(&handle->session_key, sizeof(struct sts_session_key), 0, sizeof(struct sts_session_key));
(void)memset_s(&handle->service_key, sizeof(struct hc_session_key), 0, sizeof(struct hc_session_key));
FREE(handle);
DBG_OUT("FREE sts client object success");
}
@@ -128,6 +130,7 @@ static int32_t parse_start_response_data(void *handle, void *data)
ret = compute_hkdf((struct var_buffer *)&shared_secret, &sts_client->salt, HICHAIN_AUTH_INFO,
STS_SESSION_KEY_LENGTH, (struct var_buffer *)&sts_client->session_key);
(void)memset_s(&shared_secret, sizeof(struct sts_shared_secret), 0, sizeof(struct sts_shared_secret));
if (ret != HC_OK) {
LOGE("Object %u compute_hkdf failed, error code is %d", sts_client_sn(sts_client), ret);
return HC_STS_OBJECT_ERROR;
frameworks/deviceauth_lite/source/key_agreement/sts_server.c
+4 -1
View File
@@ -67,7 +67,9 @@ void destroy_sts_server(struct sts_server *handle)
DBG_OUT("Destroy sts server object failed");
return;
}
(void)memset_s(&handle->self_private_key, sizeof(struct stsk), 0, sizeof(struct stsk));
(void)memset_s(&handle->session_key, sizeof(struct sts_session_key), 0, sizeof(struct sts_session_key));
(void)memset_s(&handle->service_key, sizeof(struct hc_session_key), 0, sizeof(struct hc_session_key));
FREE(handle);
LOGI("FREE sts server object success");
}
@@ -206,6 +208,7 @@ static int32_t parse_start_request_data(void *handle, void *receive_data)
ret = compute_hkdf((struct var_buffer *)&shared_secret, &sts_server->salt, HICHAIN_AUTH_INFO,
STS_SESSION_KEY_LENGTH, (struct var_buffer *)&sts_server->session_key);
(void)memset_s(&shared_secret, sizeof(struct sts_shared_secret), 0, sizeof(struct sts_shared_secret));
if (ret != HC_OK) {
LOGE("Object %u compute_hkdf failed, error code is %d", sts_server_sn(sts_server), ret);
return HC_COMPUTE_HKDF_FAILED;