| /* |
| * |
| * Copyright (c) 2016-2017 Nest Labs, Inc. |
| * All rights reserved. |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| /** |
| * @file |
| * This file implements a Wrapper for C++ implementation of pincode encryption/decryption functionality. |
| * for pin encryption. |
| * |
| */ |
| |
| #import "NLWeavePasscodeEncryptionSupport.h" |
| #include <Weave/Profiles/security/WeavePasscodes.h> |
| |
| using namespace nl::Weave::Profiles::Security::Passcodes; |
| |
| NSUInteger const NLWeavePasscode_Config1_TEST_ONLY = kPasscode_Config1_TEST_ONLY; |
| NSUInteger const NLWeavePasscode_Config2 = kPasscode_Config2; |
| |
| UInt8 const NLWeavePasscodeEncKeyDiversifier[] = { 0x1A, 0x65, 0x5D, 0x96 }; |
| UInt32 const NLWeavePasscodeEncKeyDiversifierSize = sizeof(NLWeavePasscodeEncKeyDiversifier); |
| UInt8 const NLWeavePasscodeFingerprintKeyDiversifier[] = { 0xD1, 0xA1, 0xD9, 0x6C }; |
| UInt32 const NLWeavePasscodeFingerprintKeyDiversifierSize = sizeof(NLWeavePasscodeFingerprintKeyDiversifier); |
| |
| UInt32 const NLWeavePasscodeEncryptionKeyLen = kPasscodeEncryptionKeyLen; |
| UInt32 const NLWeavePasscodeAuthenticationKeyLen = kPasscodeAuthenticationKeyLen; |
| UInt32 const NLWeavePasscodeFingerprintKeyLen = kPasscodeFingerprintKeyLen; |
| |
| NSString * const NLPasscodeEncryptionSupportDomain = @"NLPasscodeEncryptionSupportDomain"; |
| |
| @implementation NLWeavePasscodeEncryptionSupport |
| |
| #pragma mark Public Methods |
| |
| + (NSData *)encryptPasscode:(UInt8)config |
| keyId:(UInt32)keyId |
| nonce:(UInt32)nonce |
| passcode:(NSData *)passcode |
| encKey:(NSData *)encKey |
| authKey:(NSData *)authKey |
| fingerprintKey:(NSData *)fingerprintKey |
| error:(NSError **)errOut |
| { |
| |
| if (config != NLWeavePasscode_Config1_TEST_ONLY) { |
| if (![NLWeavePasscodeEncryptionSupport validateKeySize:encKey authKey:authKey fingerprintKey:fingerprintKey error:errOut]) { |
| return nil; |
| } |
| } |
| |
| NSMutableData * encPasscodeBuff = [[NSMutableData alloc] initWithLength:kPasscodeMaxEncryptedLen]; |
| size_t encPasscodeLen = 0; |
| |
| WEAVE_ERROR err = EncryptPasscode(config, keyId, nonce, (unsigned char *) [passcode bytes], [passcode length], |
| (unsigned char *) [encKey bytes], (unsigned char *) [authKey bytes], (unsigned char *) [fingerprintKey bytes], |
| (unsigned char *) [encPasscodeBuff mutableBytes], [encPasscodeBuff length], encPasscodeLen); |
| if (err != WEAVE_NO_ERROR) { |
| if (errOut) { |
| NSString * failureReason = [NSString stringWithFormat:NSLocalizedString(@"EncryptPasscode error: %d", @""), err]; |
| NSDictionary * userInfo = @{ NSLocalizedFailureReasonErrorKey : failureReason }; |
| |
| *errOut = [NSError errorWithDomain:NLPasscodeEncryptionSupportDomain |
| code:NLPasscodeEncryptionSupportDomainEncryptionFailure |
| userInfo:userInfo]; |
| } |
| return nil; |
| } |
| |
| [encPasscodeBuff setLength:encPasscodeLen]; |
| return encPasscodeBuff; |
| } |
| |
| + (nullable NSData *)decryptPasscode:(NSData *)encPasscode |
| config:(UInt8)config |
| encKey:(NSData *)encKey |
| authKey:(NSData *)authKey |
| fingerprintKey:(NSData *)fingerprintKey |
| error:(NSError **)errOut |
| { |
| |
| NSMutableData * passcodeBuff = [[NSMutableData alloc] initWithLength:kPasscodePaddedLen]; |
| size_t passcodeLen = 0; |
| |
| if (config != NLWeavePasscode_Config1_TEST_ONLY) { |
| if (![NLWeavePasscodeEncryptionSupport validateKeySize:encKey authKey:authKey fingerprintKey:fingerprintKey error:errOut]) { |
| return nil; |
| } |
| } |
| |
| WEAVE_ERROR err = DecryptPasscode((unsigned char *) [encPasscode bytes], [encPasscode length], (unsigned char *) [encKey bytes], |
| (unsigned char *) [authKey bytes], (unsigned char *) [fingerprintKey bytes], (unsigned char *) [passcodeBuff mutableBytes], |
| [passcodeBuff length], passcodeLen); |
| if (err != WEAVE_NO_ERROR) { |
| |
| NSString * failureReason = [NSString stringWithFormat:NSLocalizedString(@"DecryptPasscode error: %d", @""), err]; |
| NSDictionary * userInfo = @{ NSLocalizedFailureReasonErrorKey : failureReason }; |
| |
| *errOut = [NSError errorWithDomain:NLPasscodeEncryptionSupportDomain |
| code:NLPasscodeEncryptionSupportDomainDecryptionFailure |
| userInfo:userInfo]; |
| return nil; |
| } |
| |
| [passcodeBuff setLength:passcodeLen]; |
| return passcodeBuff; |
| } |
| |
| + (BOOL)isSupportedPasscodeEncryptionConfig:(UInt8)config |
| { |
| return IsSupportedPasscodeEncryptionConfig(config); |
| } |
| |
| + (BOOL)getEncryptedPasscodeConfig:(NSData *)encPasscode config:(UInt8 *)configOut error:(NSError **)errOut |
| { |
| UInt8 config = 0; |
| WEAVE_ERROR err = GetEncryptedPasscodeConfig((unsigned char *) [encPasscode bytes], [encPasscode length], config); |
| if (err != WEAVE_NO_ERROR) { |
| NSString * failureReason = |
| [NSString stringWithFormat:NSLocalizedString(@"retrieving encrypted config error: %d", @""), err]; |
| NSDictionary * userInfo = @{ NSLocalizedFailureReasonErrorKey : failureReason }; |
| |
| *errOut = [NSError errorWithDomain:NLPasscodeEncryptionSupportDomain |
| code:NLPasscodeEncryptionSupportDomainInvalidData |
| userInfo:userInfo]; |
| return FALSE; |
| } |
| *configOut = config; |
| |
| return TRUE; |
| } |
| + (BOOL)getEncryptedPasscodeKeyId:(NSData *)encPasscode keyId:(UInt32 *)keyIdOut error:(NSError **)errOut |
| { |
| UInt32 keyId = 0; |
| WEAVE_ERROR err = GetEncryptedPasscodeKeyId((unsigned char *) [encPasscode bytes], [encPasscode length], (uint32_t &) keyId); |
| if (err != WEAVE_NO_ERROR) { |
| NSString * failureReason = |
| [NSString stringWithFormat:NSLocalizedString(@"retrieving encrypted config error: %d", @""), err]; |
| NSDictionary * userInfo = @{ NSLocalizedFailureReasonErrorKey : failureReason }; |
| |
| *errOut = [NSError errorWithDomain:NLPasscodeEncryptionSupportDomain |
| code:NLPasscodeEncryptionSupportDomainInvalidData |
| userInfo:userInfo]; |
| return FALSE; |
| } |
| *keyIdOut = keyId; |
| |
| return TRUE; |
| } |
| |
| + (BOOL)getEncryptedPasscodeNonce:(NSData *)encPasscode nonce:(UInt32 *)nonceOut error:(NSError **)errOut |
| { |
| UInt32 nonce = 0; |
| WEAVE_ERROR err = GetEncryptedPasscodeNonce((unsigned char *) [encPasscode bytes], [encPasscode length], (uint32_t &) nonce); |
| if (err != WEAVE_NO_ERROR) { |
| NSString * failureReason = |
| [NSString stringWithFormat:NSLocalizedString(@"retrieving encrypted passcode nonce: %d", @""), err]; |
| NSDictionary * userInfo = @{ NSLocalizedFailureReasonErrorKey : failureReason }; |
| |
| *errOut = [NSError errorWithDomain:NLPasscodeEncryptionSupportDomain |
| code:NLPasscodeEncryptionSupportDomainInvalidData |
| userInfo:userInfo]; |
| return FALSE; |
| } |
| *nonceOut = nonce; |
| |
| return TRUE; |
| } |
| |
| + (nullable NSData *)getEncryptedPasscodeFingerprint:(NSData *)encPasscode error:(NSError **)errOut |
| { |
| |
| NSMutableData * fingerprint = [[NSMutableData alloc] initWithLength:kPasscodeFingerprintLen]; |
| size_t fingerprintLen = 0; |
| |
| WEAVE_ERROR err = GetEncryptedPasscodeFingerprint((unsigned char *) [encPasscode bytes], [encPasscode length], |
| (unsigned char *) [fingerprint mutableBytes], [fingerprint length], fingerprintLen); |
| if (err != WEAVE_NO_ERROR) { |
| |
| NSString * failureReason = [NSString stringWithFormat:NSLocalizedString(@"get fingerprint error: %d", @""), err]; |
| NSDictionary * userInfo = @{ NSLocalizedFailureReasonErrorKey : failureReason }; |
| |
| *errOut = [NSError errorWithDomain:NLPasscodeEncryptionSupportDomain |
| code:NLPasscodeEncryptionSupportDomainInvalidData |
| userInfo:userInfo]; |
| return nil; |
| } |
| |
| [fingerprint setLength:fingerprintLen]; |
| return fingerprint; |
| } |
| |
| #pragma mark Private Methods |
| |
| + (BOOL)validateKeySize:(NSData *)encKey authKey:(NSData *)authKey fingerprintKey:(NSData *)fingerprintKey error:(NSError **)errOut |
| { |
| |
| if ([encKey length] != kPasscodeEncryptionKeyLen) { |
| if (errOut) { |
| *errOut = [NSError errorWithDomain:NLPasscodeEncryptionSupportDomain |
| code:NLPasscodeEncryptionSupportDomainInvalidEncKeySize |
| userInfo:nil]; |
| } |
| return FALSE; |
| } |
| |
| if ([authKey length] != kPasscodeAuthenticationKeyLen) { |
| if (errOut) { |
| *errOut = [NSError errorWithDomain:NLPasscodeEncryptionSupportDomain |
| code:NLPasscodeEncryptionSupportDomainInvalidAuthKeySize |
| userInfo:nil]; |
| } |
| return FALSE; |
| } |
| |
| if ([fingerprintKey length] != kPasscodeFingerprintKeyLen) { |
| |
| if (errOut) { |
| *errOut = [NSError errorWithDomain:NLPasscodeEncryptionSupportDomain |
| code:NLPasscodeEncryptionSupportDomainInvalidFingerprintKeySize |
| userInfo:nil]; |
| } |
| return FALSE; |
| } |
| |
| return TRUE; |
| } |
| |
| @end |
