mini平台新增接口,3DES、DES、RSA问题修改

Signed-off-by: 绫地宁宁 <756090608@qq.com>

frameworks/huks_standard/main/common/include/hks_config_lite_wearable.h

@@ -51,6 +51,7 @@
 
 /* HMAC */
 #define HKS_SUPPORT_HMAC_C
+#define HKS_SUPPORT_HMAC_GENERATE_KEY
 #define HKS_SUPPORT_HMAC_SHA256
 #define HKS_SUPPORT_HMAC_SHA384
 #define HKS_SUPPORT_HMAC_SHA512

frameworks/huks_standard/main/common/include/hks_crypto_hal.h

@@ -143,11 +143,11 @@ typedef int32_t (*HmacUpdate)(void *, const struct HksBlob *);
 
 typedef int32_t (*HmacFinal)(void **, const struct HksBlob *, struct HksBlob *);
 
-typedef int32_t (*CmacInit)(void **, const struct HksBlob *, uint32_t);
+typedef int32_t (*CmacInit)(void **, const struct HksBlob *, const struct HksUsageSpec *);
 
-typedef int32_t (*CmacUpdate)(void *, const struct HksBlob *);
+typedef int32_t (*CmacUpdate)(void *, const struct HksBlob *, const struct HksUsageSpec *);
 
-typedef int32_t (*CmacFinal)(void **, const struct HksBlob *, struct HksBlob *);
+typedef int32_t (*CmacFinal)(void **, const struct HksBlob *, struct HksBlob *, const struct HksUsageSpec *);
 
 typedef int32_t (*Hash)(uint32_t, const struct HksBlob *, struct HksBlob *);
 
@@ -223,11 +223,12 @@ void HksCryptoHalHmacFreeCtx(void **ctx);
 int32_t HksCryptoHalHmac(const struct HksBlob *key, uint32_t digestAlg, const struct HksBlob *msg,
     struct HksBlob *mac);
 
-int32_t HksCryptoHalCmacInit(const struct HksBlob *key, uint32_t digestAlg, void **ctx);
+int32_t HksCryptoHalCmacInit(const struct HksBlob *key, void **ctx, const struct HksUsageSpec *usageSpec);
 
-int32_t HksCryptoHalCmacUpdate(const struct HksBlob *chunk, void *ctx);
+int32_t HksCryptoHalCmacUpdate(const struct HksBlob *chunk, void *ctx, const struct HksUsageSpec *usageSpec);
 
-int32_t HksCryptoHalCmacFinal(const struct HksBlob *msg, void **ctx, struct HksBlob *mac);
+int32_t HksCryptoHalCmacFinal(
+    const struct HksBlob *msg, void **ctx, struct HksBlob *mac, const struct HksUsageSpec *usageSpec);
 
 void HksCryptoHalCmacFreeCtx(void **ctx);
 

frameworks/huks_standard/main/common/src/hks_crypto_adapter.c

@@ -184,22 +184,32 @@ static bool HksIsAlgorithmSm4(const struct HksParamSet *paramSet)
 }
 
 #ifdef HKS_SUPPORT_3DES_C
-static bool HksIsAlgorithm3DES(const struct HksParamSet *paramSet)
+static bool HksIsNeedIv3DES(const struct HksParamSet *paramSet)
 {
     struct HksParam *algParam = NULL;
     int32_t ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &algParam);
     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, false, "check 3DES get alg param failed!")
-    return (algParam->uint32Param == HKS_ALG_3DES);
+
+    struct HksParam *modeParam = NULL;
+    ret = HksGetParam(paramSet, HKS_TAG_BLOCKMODE, &modeParam);
+    HKS_IF_NOT_SUCC_LOGE_RETURN(ret, false, "check 3DES get block mode param failed!")
+
+    return ((algParam->uint32Param == HKS_ALG_3DES) && (modeParam->uint32Param == HKS_MODE_CBC));
 }
 #endif
 
 #ifdef HKS_SUPPORT_DES_C
-static bool HksIsAlgorithmDES(const struct HksParamSet *paramSet)
+static bool HksIsNeedIvDES(const struct HksParamSet *paramSet)
 {
     struct HksParam *algParam = NULL;
     int32_t ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &algParam);
     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, false, "check DES get alg param failed!")
-    return (algParam->uint32Param == HKS_ALG_DES);
+
+    struct HksParam *modeParam = NULL;
+    ret = HksGetParam(paramSet, HKS_TAG_BLOCKMODE, &modeParam);
+    HKS_IF_NOT_SUCC_LOGE_RETURN(ret, false, "check DES get block mode param failed!")
+
+    return ((algParam->uint32Param == HKS_ALG_DES) && (modeParam->uint32Param == HKS_MODE_CBC));
 }
 #endif
 
@@ -223,11 +233,11 @@ int32_t HksBuildCipherUsageSpec(
     if (HksIsAlgorithmSm4(paramSet)) { // is sm4
         ret = HksFillIvParam(paramSet, usageSpec);
 #ifdef HKS_SUPPORT_3DES_C
-    } else if (HksIsAlgorithm3DES(paramSet)) { // is 3des
+    } else if (HksIsNeedIv3DES(paramSet)) { // is 3des
         ret = HksFillIvParam(paramSet, usageSpec);
 #endif
 #ifdef HKS_SUPPORT_DES_C
-    } else if (HksIsAlgorithmDES(paramSet)) { // is des
+    } else if (HksIsNeedIvDES(paramSet)) { // is des
         ret = HksFillIvParam(paramSet, usageSpec);
 #endif
     } else if (!isAes) { // not sm4, not aes

frameworks/huks_standard/main/crypto_engine/mbedtls/src/hks_mbedtls_3des.c

@@ -133,6 +133,14 @@ static int32_t Des3CbcNoPaddingCryptInit(
         return HKS_ERROR_CRYPTO_ENGINE_ERROR;
     }
 
+    struct HksCipherParam *iv = (struct HksCipherParam *)(usageSpec->algParam);
+    if (iv->iv.size != HKS_3DES_CBC_NOPADDING_IV_SIZE) {
+        HKS_LOG_E("initialize iv fail");
+        mbedtls_des3_free(ctx);
+        HKS_FREE(ctx);
+        return HKS_ERROR_INVALID_IV;
+    }
+
     struct HksMbedtls3DesCtx *outCtx = (struct HksMbedtls3DesCtx *)HksMalloc(sizeof(struct HksMbedtls3DesCtx));
     if (outCtx == NULL) {
         HKS_LOG_E("initialize outCtx fail");
@@ -144,7 +152,6 @@ static int32_t Des3CbcNoPaddingCryptInit(
     outCtx->append = (void *)ctx;
     outCtx->mode = usageSpec->mode;
     outCtx->padding = usageSpec->padding;
-    struct HksCipherParam *iv = (struct HksCipherParam *)(usageSpec->algParam);
     (void)memcpy_s(outCtx->iv, HKS_3DES_CBC_NOPADDING_IV_SIZE, iv->iv.data, HKS_3DES_CBC_NOPADDING_IV_SIZE);
 
     *cryptoCtx = (void *)outCtx;

frameworks/huks_standard/main/crypto_engine/mbedtls/src/hks_mbedtls_aes.c

@@ -160,6 +160,14 @@ static int32_t AesCbcNoPaddingCryptInit(void **cryptoCtx, const struct HksBlob *
         return HKS_ERROR_CRYPTO_ENGINE_ERROR;
     }
 
+    struct HksCipherParam *iv = (struct HksCipherParam *)(usageSpec->algParam);
+    if (iv->iv.size != HKS_AES_CBC_NOPADDING_IV_SIZE) {
+        HKS_LOG_E("initialize iv fail");
+        mbedtls_aes_free(ctx);
+        HKS_FREE(ctx);
+        return HKS_ERROR_INVALID_IV;
+    }
+
     struct HksMbedtlsAesCtx *outCtx = (struct HksMbedtlsAesCtx *)HksMalloc(sizeof(HksMbedtlsAesCtx));
     if (outCtx == NULL) {
         HKS_LOG_E("initialize outCtx fail");
@@ -171,7 +179,6 @@ static int32_t AesCbcNoPaddingCryptInit(void **cryptoCtx, const struct HksBlob *
     outCtx->append = (void *)ctx;
     outCtx->mode = usageSpec->mode;
     outCtx->padding = usageSpec->padding;
-    struct HksCipherParam *iv = (struct HksCipherParam *)(usageSpec->algParam);
     (void)memcpy_s(outCtx->iv, HKS_AES_CBC_NOPADDING_IV_SIZE, iv->iv.data, HKS_AES_CBC_NOPADDING_IV_SIZE);
 
     *cryptoCtx = (void *)outCtx;

frameworks/huks_standard/main/crypto_engine/mbedtls/src/hks_mbedtls_des.c

@@ -122,6 +122,14 @@ static int32_t DesCbcNoPaddingCryptInit(
         return HKS_ERROR_CRYPTO_ENGINE_ERROR;
     }
 
+    struct HksCipherParam *iv = (struct HksCipherParam *)(usageSpec->algParam);
+    if (iv->iv.size != HKS_DES_CBC_NOPADDING_IV_SIZE) {
+        HKS_LOG_E("initialize iv fail");
+        mbedtls_des_free(ctx);
+        HKS_FREE(ctx);
+        return HKS_ERROR_INVALID_IV;
+    }
+
     struct HksMbedtlsDesCtx *outCtx = (struct HksMbedtlsDesCtx *)HksMalloc(sizeof(struct HksMbedtlsDesCtx));
     if (outCtx == NULL) {
         HKS_LOG_E("initialize outCtx fail");
@@ -133,8 +141,6 @@ static int32_t DesCbcNoPaddingCryptInit(
     outCtx->append = (void *)ctx;
     outCtx->mode = usageSpec->mode;
     outCtx->padding = usageSpec->padding;
-
-    struct HksCipherParam *iv = (struct HksCipherParam *)(usageSpec->algParam);
     (void)memcpy_s(outCtx->iv, HKS_DES_CBC_NOPADDING_IV_SIZE, iv->iv.data, HKS_DES_CBC_NOPADDING_IV_SIZE);
 
     *cryptoCtx = (void *)outCtx;

frameworks/huks_standard/main/crypto_engine/mbedtls/src/hks_mbedtls_engine.c

@@ -100,9 +100,9 @@ void HksCryptoHalHmacFreeCtx(void **ctx)
 }
 
 #ifdef HKS_SUPPORT_CMAC_C
-int32_t HksCryptoHalCmacInit(const struct HksBlob *key, uint32_t digestAlg, void **ctx)
+int32_t HksCryptoHalCmacInit(const struct HksBlob *key, void **ctx, const struct HksUsageSpec *usageSpec)
 {
-    if (CheckBlob(key) != HKS_SUCCESS || ctx == NULL) {
+    if (CheckBlob(key) != HKS_SUCCESS || ctx == NULL || usageSpec == NULL) {
         HKS_LOG_E("Crypt Hal Cmac init msg is NULL");
         return HKS_ERROR_INVALID_ARGUMENT;
     }
@@ -110,12 +110,12 @@ int32_t HksCryptoHalCmacInit(const struct HksBlob *key, uint32_t digestAlg, void
     CmacInit func = (CmacInit)GetAbility(HKS_CRYPTO_ABILITY_CMAC_INIT);
     HKS_IF_NULL_RETURN(func, HKS_ERROR_INVALID_ARGUMENT)
 
-    return func(ctx, key, digestAlg);
+    return func(ctx, key, usageSpec);
 }
 
-int32_t HksCryptoHalCmacUpdate(const struct HksBlob *chunk, void *ctx)
+int32_t HksCryptoHalCmacUpdate(const struct HksBlob *chunk, void *ctx, const struct HksUsageSpec *usageSpec)
 {
-    if (CheckBlob(chunk) != HKS_SUCCESS || ctx == NULL) {
+    if (CheckBlob(chunk) != HKS_SUCCESS || ctx == NULL || usageSpec == NULL) {
         HKS_LOG_E("Crypt Hal Cmac update chunk is invalid param");
         return HKS_ERROR_INVALID_ARGUMENT;
     }
@@ -123,12 +123,13 @@ int32_t HksCryptoHalCmacUpdate(const struct HksBlob *chunk, void *ctx)
     CmacUpdate func = (CmacUpdate)GetAbility(HKS_CRYPTO_ABILITY_CMAC_UPDATE);
     HKS_IF_NULL_RETURN(func, HKS_ERROR_INVALID_ARGUMENT)
 
-    return func(ctx, chunk);
+    return func(ctx, chunk, usageSpec);
 }
 
-int32_t HksCryptoHalCmacFinal(const struct HksBlob *msg, void **ctx, struct HksBlob *mac)
+int32_t HksCryptoHalCmacFinal(
+    const struct HksBlob *msg, void **ctx, struct HksBlob *mac, const struct HksUsageSpec *usageSpec)
 {
-    if (msg == NULL || ctx == NULL || *ctx == NULL || CheckBlob(mac) != HKS_SUCCESS) {
+    if (msg == NULL || ctx == NULL || *ctx == NULL || usageSpec == NULL || CheckBlob(mac) != HKS_SUCCESS) {
         HKS_LOG_E("Crypt Hal Cmac final msg or mac is NULL");
         return HKS_ERROR_INVALID_ARGUMENT;
     }
@@ -136,7 +137,7 @@ int32_t HksCryptoHalCmacFinal(const struct HksBlob *msg, void **ctx, struct HksB
     CmacFinal func = (CmacFinal)GetAbility(HKS_CRYPTO_ABILITY_CMAC_FINAL);
     HKS_IF_NULL_RETURN(func, HKS_ERROR_INVALID_ARGUMENT)
 
-    return func(ctx, msg, mac);
+    return func(ctx, msg, mac, usageSpec);
 }
 
 void HksCryptoHalCmacFreeCtx(void **ctx)

frameworks/huks_standard/main/crypto_engine/mbedtls/src/hks_mbedtls_rsa.c

@@ -34,6 +34,7 @@
 
 #include "hks_log.h"
 #include "hks_mbedtls_common.h"
+#include "hks_common_check.h"
 #include "hks_mem.h"
 #include "hks_template.h"
 
@@ -42,6 +43,13 @@
 #define MBEDTLS_RSA_PUBLIC	0
 #define MBEDTLS_RSA_PRIVATE	1
 #define HKS_RSA_KEYSIZE_CNT 8
+#define MBEDTLS_RSA_PSS_DIGEST_NUM 2
+
+typedef struct HksMbedtlsSignVerifyParam {
+    uint32_t mbedtlsAlg;
+    int32_t padding;
+    uint32_t pssSaltLen;
+} HksMbedtlsSignVerifyParam;
 
 static int32_t RsaCheckKeySize(const uint32_t keySize)
 {
@@ -384,6 +392,67 @@ static int32_t HksToMbedtlsSignPadding(uint32_t hksPadding, int32_t *padding)
     return HKS_SUCCESS;
 }
 
+static int32_t HksToMbedtlsRsaSetPssSaltLen(const struct HksBlob *key, const uint32_t digest,
+    const uint32_t hksPssSaltLen, HksMbedtlsSignVerifyParam *param)
+{
+    const struct KeyMaterialRsa *keyMaterial = (struct KeyMaterialRsa *)(key->data);
+    uint32_t digestLen = 0;
+    int32_t ret = HksGetDigestLen(digest, &digestLen);
+    HKS_IF_NOT_SUCC_RETURN(ret, ret);
+    int32_t saltLen = 0;
+
+    switch (hksPssSaltLen) {
+        case HKS_RSA_PSS_SALTLEN_DIGEST:
+            saltLen = digestLen;
+            break;
+        case HKS_RSA_PSS_SALTLEN_MAX:
+            saltLen = (keyMaterial->keySize / HKS_BITS_PER_BYTE) - digestLen - MBEDTLS_RSA_PSS_DIGEST_NUM;
+            if (saltLen < 0) {
+                return HKS_ERROR_INVALID_KEY_SIZE;
+            }
+            break;
+        default:
+            return HKS_ERROR_NOT_SUPPORTED;
+    }
+    param->pssSaltLen = saltLen;
+
+    return HKS_SUCCESS;
+}
+
+static int32_t HksMbedtlsRsaSignHandle(mbedtls_rsa_context *ctx, mbedtls_ctr_drbg_context *ctrDrbg,
+    HksMbedtlsSignVerifyParam *signParam, const struct HksBlob *message, struct HksBlob *signature)
+{
+    int32_t ret = HKS_SUCCESS;
+    if (signParam->padding == MBEDTLS_RSA_PKCS_V21) {
+        // 支持传入saltlen
+        ret = mbedtls_rsa_rsassa_pss_sign_ext(ctx, mbedtls_ctr_drbg_random, ctrDrbg,
+            (mbedtls_md_type_t)signParam->mbedtlsAlg, message->size, message->data, signParam->pssSaltLen,
+            signature->data);
+    } else {
+        ret = mbedtls_rsa_pkcs1_sign(ctx, mbedtls_ctr_drbg_random, ctrDrbg,
+            (mbedtls_md_type_t)signParam->mbedtlsAlg, message->size, message->data, signature->data);
+    }
+
+    return ret;
+}
+
+static int32_t HksMbedtlsRsaVerifyHandle(mbedtls_rsa_context *ctx, mbedtls_ctr_drbg_context *ctrDrbg,
+    HksMbedtlsSignVerifyParam *verifyParam, const struct HksBlob *message, struct HksBlob *signature)
+{
+    int32_t ret = HKS_SUCCESS;
+    if (verifyParam->padding == MBEDTLS_RSA_PKCS_V21) {
+        // 支持传入saltlen
+        ret = mbedtls_rsa_rsassa_pss_verify_ext(ctx, (mbedtls_md_type_t)verifyParam->mbedtlsAlg,
+            message->size, message->data, (mbedtls_md_type_t)verifyParam->mbedtlsAlg, verifyParam->pssSaltLen,
+            signature->data);
+    } else {
+        ret = mbedtls_rsa_pkcs1_verify(ctx,
+            (mbedtls_md_type_t)verifyParam->mbedtlsAlg, message->size, message->data, signature->data);
+    }
+
+    return ret;
+}
+
 static int32_t HksMbedtlsRsaSignVerify(const struct HksBlob *key, const struct HksUsageSpec *usageSpec,
     const struct HksBlob *message, const bool sign, struct HksBlob *signature)
 {
@@ -404,16 +473,22 @@ static int32_t HksMbedtlsRsaSignVerify(const struct HksBlob *key, const struct H
     mbedtls_rsa_context ctx;
     (void)memset_s(&ctx, sizeof(mbedtls_rsa_context), 0, sizeof(mbedtls_rsa_context));
     mbedtls_rsa_init(&ctx);
+    mbedtls_rsa_set_padding(&ctx, padding, (mbedtls_md_type_t)mbedtlsAlg);
+    HksMbedtlsSignVerifyParam mbedtlsSignVerifyParam = { 0 };
+    if (padding == MBEDTLS_RSA_PKCS_V21) {
+        ret = HksToMbedtlsRsaSetPssSaltLen(key, usageSpec->digest, usageSpec->pssSaltLenType, &mbedtlsSignVerifyParam);
+        HKS_IF_NOT_SUCC_RETURN(ret, ret)
+    }
+    mbedtlsSignVerifyParam.mbedtlsAlg = mbedtlsAlg;
+    mbedtlsSignVerifyParam.padding = padding;
 
     do {
         ret = RsaKeyMaterialToCtx(key, sign, &ctx); /* sign need private exponent (d) */
         HKS_IF_NOT_SUCC_BREAK(ret)
         if (sign) {
-            ret = mbedtls_rsa_pkcs1_sign(&ctx, mbedtls_ctr_drbg_random, &ctrDrbg,
+            ret = HksMbedtlsRsaSignHandle(&ctx, &ctrDrbg, &mbedtlsSignVerifyParam, message, signature);
-                (mbedtls_md_type_t)mbedtlsAlg, message->size, message->data, signature->data);
         } else {
-            ret = mbedtls_rsa_pkcs1_verify(&ctx,
+            ret = HksMbedtlsRsaVerifyHandle(&ctx, &ctrDrbg, &mbedtlsSignVerifyParam, message, signature);
-                (mbedtls_md_type_t)mbedtlsAlg, message->size, message->data, signature->data);
         }
         if (ret != HKS_MBEDTLS_SUCCESS) {
             HKS_LOG_E("Mbedtls rsa sign/verify failed! mbedtls ret = 0x%" LOG_PUBLIC "X", ret);

services/huks_standard/huks_engine/main/core/src/hks_auth.c

@@ -37,7 +37,7 @@ static uint32_t g_signVerifyEccPolicyTag[] = { HKS_TAG_ALGORITHM, HKS_TAG_DIGEST
 static uint32_t g_signVerifyEd25519PolicyTag[] = { HKS_TAG_PURPOSE };
 static uint32_t g_macPolicyTag[] = { HKS_TAG_DIGEST, HKS_TAG_PURPOSE };
 static uint32_t g_macSm3PolicyTag[] = { HKS_TAG_ALGORITHM, HKS_TAG_DIGEST, HKS_TAG_PURPOSE };
-static uint32_t g_macCmacPolicyTag[] = { HKS_TAG_ALGORITHM, HKS_TAG_PURPOSE };
+static uint32_t g_macCmacPolicyTag[] = { HKS_TAG_BLOCK_MODE, HKS_TAG_PADDING, HKS_TAG_PURPOSE };
 static uint32_t g_derivePolicyTag[] = { HKS_TAG_DIGEST, HKS_TAG_PURPOSE };
 static uint32_t g_agreePolicyTag[] = { HKS_TAG_PURPOSE };
 

services/huks_standard/huks_engine/main/core/src/hks_core_service_three_stage.c

@@ -50,6 +50,7 @@
 #define HKS_RSA_OAEP_DIGEST_NUM          2
 #define HKS_SM2_C1_LEN_NUM               2
 #define HKS_BLOCK_CIPHER_CBC_BLOCK_SIZE  16
+#define HKS_BLOCK_CIPHER_DES_CBC_BLOCK_SIZE 8
 #define HKS_TEMP_SIZE                    32
 #define MAX_BUF_SIZE                     (5 * 1024 * 1024)
 #define HKS_AES_GCM_NONCE_LEN            12
@@ -136,19 +137,23 @@ static int32_t CheckAesCipherAead(bool isEncrypt, const struct HksBlob *inData,
     return HKS_SUCCESS;
 }
 
-static int32_t CheckBlockCipherOther(uint32_t mode, bool isEncrypt, uint32_t padding, const struct HksBlob *inData,
+static int32_t CheckBlockCipherOther(uint32_t mode, bool isEncrypt, const struct HksUsageSpec *usageSpec,
-    const struct HksBlob *outData)
+    const struct HksBlob *inData, const struct HksBlob *outData)
 {
     uint32_t paddingSize = 0;
 
     if (isEncrypt) {
-        if (padding == HKS_PADDING_NONE) {
+        uint32_t blockSize = HKS_BLOCK_CIPHER_CBC_BLOCK_SIZE;
-            if ((mode == HKS_MODE_CBC || mode == HKS_MODE_ECB) && inData->size % HKS_BLOCK_CIPHER_CBC_BLOCK_SIZE != 0) {
+        if (usageSpec->algType == HKS_ALG_DES || usageSpec->algType == HKS_ALG_3DES) {
+            blockSize = HKS_BLOCK_CIPHER_DES_CBC_BLOCK_SIZE;
+        }
+        if (usageSpec->padding == HKS_PADDING_NONE) {
+            if ((mode == HKS_MODE_CBC || mode == HKS_MODE_ECB) && inData->size % blockSize != 0) {
                 HKS_LOG_E("encrypt cbc or ecb no-padding, invalid inSize: %" LOG_PUBLIC "u", inData->size);
                 return HKS_ERROR_INVALID_ARGUMENT;
             }
         } else {
-            paddingSize = HKS_BLOCK_CIPHER_CBC_BLOCK_SIZE - inData->size % HKS_BLOCK_CIPHER_CBC_BLOCK_SIZE;
+            paddingSize = blockSize - inData->size % blockSize;
             if (inData->size > (UINT32_MAX - paddingSize)) {
                 HKS_LOG_E("encrypt, invalid inData size: %" LOG_PUBLIC "u", inData->size);
                 return HKS_ERROR_INVALID_ARGUMENT;
@@ -173,7 +178,6 @@ static int32_t CheckBlockCipherOther(uint32_t mode, bool isEncrypt, uint32_t pad
 static int32_t CheckBlockCipherData(bool isEncrypt, const struct HksUsageSpec *usageSpec,
     const struct HksBlob *inData, const struct HksBlob *outData)
 {
-    const uint32_t padding = usageSpec->padding;
     const uint32_t mode = usageSpec->mode;
     const uint32_t alg = usageSpec->algType;
     int32_t ret = HKS_ERROR_NOT_SUPPORTED;
@@ -184,10 +188,10 @@ static int32_t CheckBlockCipherData(bool isEncrypt, const struct HksUsageSpec *u
         }
     } else if (mode == HKS_MODE_CFB || mode == HKS_MODE_OFB) {
         if (alg == HKS_ALG_SM4) {
-            ret = CheckBlockCipherOther(mode, isEncrypt, padding, inData, outData);
+            ret = CheckBlockCipherOther(mode, isEncrypt, usageSpec, inData, outData);
         }
     } else if (mode == HKS_MODE_CBC || mode == HKS_MODE_CTR || mode == HKS_MODE_ECB) {
-        ret = CheckBlockCipherOther(mode, isEncrypt, padding, inData, outData);
+        ret = CheckBlockCipherOther(mode, isEncrypt, usageSpec, inData, outData);
     }
 
     return ret;
@@ -269,7 +273,7 @@ static int32_t HmacAuth(const struct HuksKeyNode *keyNode, const struct HksParam
     if (algParam->uint32Param == HKS_ALG_HMAC) {
         return HksThreeStageAuth(HKS_AUTH_ID_MAC_HMAC, keyNode);
 #ifdef HKS_SUPPORT_CMAC_C
-    } else if (algParam->uint32Param == HKS_ALG_3DES) {  // CMACinit校验密钥算法，只支持3DES
+    } else if (algParam->uint32Param == HKS_ALG_CMAC) {
         return HksThreeStageAuth(HKS_AUTH_ID_MAC_CMAC, keyNode);
 #endif
     } else if (algParam->uint32Param == HKS_ALG_SM3) {
@@ -1973,9 +1977,16 @@ int32_t HksCoreMacThreeStageInit(const struct HuksKeyNode *keyNode, const struct
         struct HksParam *algParam = NULL;
         ret = HksGetParam(paramSet, HKS_TAG_ALGORITHM, &algParam);
         HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "append hmac get alg param failed!");
-        if (algParam->uint32Param == HKS_ALG_3DES) {  // CMACinit阶段校验密钥，只支持3DES
+        if (algParam->uint32Param == HKS_ALG_CMAC) {
 #ifdef HKS_SUPPORT_CMAC_C
-            ret = HksCryptoHalCmacInit(&rawKey, alg, &ctx);
+            struct HksUsageSpec usageSpec = {0};
+            HksFillUsageSpec(paramSet, &usageSpec);
+            ret = HksFillIvParam(paramSet, &usageSpec);
+            if (ret != HKS_SUCCESS) {
+                HKS_LOG_E("fill Iv failed!");
+                break;
+            }
+            ret = HksCryptoHalCmacInit(&rawKey, &ctx, &usageSpec);
 #endif
         } else {
             ret = HksCryptoHalHmacInit(&rawKey, alg, &ctx);
@@ -2009,7 +2020,9 @@ int32_t HksCoreMacThreeStageUpdate(const struct HuksKeyNode *keyNode, const stru
     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "append hmac get alg param failed!");
     if (algParam->uint32Param == HKS_ALG_CMAC) {
 #ifdef HKS_SUPPORT_CMAC_C
-        ret = HksCryptoHalCmacUpdate(srcData, ctx);
+        struct HksUsageSpec usageSpec = {0};
+        HksFillUsageSpec(paramSet, &usageSpec);
+        ret = HksCryptoHalCmacUpdate(srcData, ctx, &usageSpec);
 #endif
     } else {
         ret = HksCryptoHalHmacUpdate(srcData, ctx);
@@ -2054,7 +2067,9 @@ int32_t HksCoreMacThreeStageFinish(const struct HuksKeyNode *keyNode, const stru
 
     if (algParam->uint32Param == HKS_ALG_CMAC) {
 #ifdef HKS_SUPPORT_CMAC_C
-        ret = HksCryptoHalCmacFinal(inData, &ctx, outData);
+        struct HksUsageSpec usageSpec = {0};
+        HksFillUsageSpec(paramSet, &usageSpec);
+        ret = HksCryptoHalCmacFinal(inData, &ctx, outData, &usageSpec);
 #endif
     } else {
         ret = HksCryptoHalHmacFinal(inData, &ctx, outData);

utils/crypto_adapter/hks_client_service_adapter_common.c

@@ -74,6 +74,40 @@ static int32_t TranslateToInnerCurve25519Format(const uint32_t alg, const struct
 }
 #endif
 
+static int32_t HksSymmetricKeySizeCheck(
+    struct HksParam *algParam, const struct HksBlob *key, struct HksBlob *outKey)
+{
+    switch (algParam->uint32Param) {
+        case HKS_ALG_AES:
+            if ((key->size != HKS_KEY_BYTES(HKS_AES_KEY_SIZE_128)) &&
+                (key->size != HKS_KEY_BYTES(HKS_AES_KEY_SIZE_192)) &&
+                (key->size != HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256))) {
+                HKS_LOG_E("invalid input key size: %" LOG_PUBLIC "u", key->size);
+                return HKS_ERROR_INVALID_KEY_INFO;
+            }
+            break;
+        case HKS_ALG_DES:
+            if (key->size != HKS_KEY_BYTES(HKS_DES_KEY_SIZE_64)) {
+                HKS_LOG_E("invalid input key size: %" LOG_PUBLIC "u", key->size);
+                return HKS_ERROR_INVALID_KEY_INFO;
+            }
+            break;
+        case HKS_ALG_3DES:
+            if ((key->size != HKS_KEY_BYTES(HKS_3DES_KEY_SIZE_128)) &&
+                (key->size != HKS_KEY_BYTES(HKS_3DES_KEY_SIZE_192))) {
+                HKS_LOG_E("invalid input key size: %" LOG_PUBLIC "u", key->size);
+                return HKS_ERROR_INVALID_KEY_INFO;
+            }
+            break;
+        default:
+            HKS_LOG_E("invalid input key algParam: %" LOG_PUBLIC "u", algParam->uint32Param);
+            return HKS_ERROR_INVALID_ALGORITHM;
+    }
+
+    return CopyToInnerKey(key, outKey);
+}
+
+
 int32_t GetHksPubKeyInnerFormat(const struct HksParamSet *paramSet,
     const struct HksBlob *key, struct HksBlob *outKey)
 {
@@ -88,14 +122,11 @@ int32_t GetHksPubKeyInnerFormat(const struct HksParamSet *paramSet,
 
     switch (algParam->uint32Param) {
 #if defined(HKS_SUPPORT_HMAC_C) || defined(HKS_SUPPORT_SM3_C) || defined(HKS_SUPPORT_SM4_C) || \
-    defined(HKS_SUPPORT_AES_C)
+    defined(HKS_SUPPORT_AES_C) || defined(HKS_SUPPORT_DES_C) || defined(HKS_SUPPORT_3DES_C)
         case HKS_ALG_AES:
-            if ((key->size != HKS_KEY_BYTES(HKS_AES_KEY_SIZE_128)) &&
+        case HKS_ALG_DES:
-                (key->size != HKS_KEY_BYTES(HKS_AES_KEY_SIZE_192)) &&
+        case HKS_ALG_3DES:
-                (key->size != HKS_KEY_BYTES(HKS_AES_KEY_SIZE_256))) {
+            return HksSymmetricKeySizeCheck(algParam, key, outKey);
-                HKS_LOG_E("invalid input key size: %" LOG_PUBLIC "u", key->size);
-                return HKS_ERROR_INVALID_KEY_INFO;
-            } /* fall-through */
         case HKS_ALG_HMAC:
         case HKS_ALG_SM3:
         case HKS_ALG_SM4: