| /* |
| * |
| * Copyright (c) 2016-2017 Nest Labs, Inc. |
| * All rights reserved. |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| /** |
| * @file |
| * This file implements a Wrapper for C++ implementation of pincode encryption/decryption functionality. |
| * for pin encryption. |
| * |
| */ |
| |
| #import "NLWeavePasscodeEncryptionSupport.h" |
| #include <Weave/Profiles/security/WeavePasscodes.h> |
| |
| using namespace nl::Weave::Profiles::Security::Passcodes; |
| |
| NSUInteger const NLWeavePasscode_Config1_TEST_ONLY = kPasscode_Config1_TEST_ONLY; |
| NSUInteger const NLWeavePasscode_Config2 = kPasscode_Config2; |
| |
| UInt8 const NLWeavePasscodeEncKeyDiversifier[] = { 0x1A, 0x65, 0x5D, 0x96 }; |
| UInt32 const NLWeavePasscodeEncKeyDiversifierSize = sizeof(NLWeavePasscodeEncKeyDiversifier); |
| UInt8 const NLWeavePasscodeFingerprintKeyDiversifier[] = { 0xD1, 0xA1, 0xD9, 0x6C }; |
| UInt32 const NLWeavePasscodeFingerprintKeyDiversifierSize = sizeof(NLWeavePasscodeFingerprintKeyDiversifier); |
| |
| UInt32 const NLWeavePasscodeEncryptionKeyLen = kPasscodeEncryptionKeyLen; |
| UInt32 const NLWeavePasscodeAuthenticationKeyLen = kPasscodeAuthenticationKeyLen; |
| UInt32 const NLWeavePasscodeFingerprintKeyLen = kPasscodeFingerprintKeyLen; |
| |
| NSString *const NLPasscodeEncryptionSupportDomain = @"NLPasscodeEncryptionSupportDomain"; |
| |
| @implementation NLWeavePasscodeEncryptionSupport |
| |
| #pragma mark Public Methods |
| |
| + (NSData *) encryptPasscode: (UInt8) config |
| keyId: (UInt32) keyId |
| nonce: (UInt32) nonce |
| passcode: (NSData *) passcode |
| encKey: (NSData *) encKey |
| authKey: (NSData *) authKey |
| fingerprintKey: (NSData *) fingerprintKey |
| error: (NSError **) errOut { |
| |
| if (config != NLWeavePasscode_Config1_TEST_ONLY) { |
| if (![NLWeavePasscodeEncryptionSupport validateKeySize: encKey |
| authKey: authKey |
| fingerprintKey: fingerprintKey |
| error: errOut]) { |
| return nil; |
| } |
| } |
| |
| NSMutableData * encPasscodeBuff = [[NSMutableData alloc] initWithLength: kPasscodeMaxEncryptedLen]; |
| size_t encPasscodeLen =0; |
| |
| WEAVE_ERROR err = EncryptPasscode(config, keyId, nonce, |
| (unsigned char *) [passcode bytes], |
| [passcode length], |
| (unsigned char *) [encKey bytes], |
| (unsigned char *) [authKey bytes], |
| (unsigned char *) [fingerprintKey bytes], |
| (unsigned char *) [encPasscodeBuff mutableBytes], |
| [encPasscodeBuff length], |
| encPasscodeLen); |
| if (err != WEAVE_NO_ERROR){ |
| if (errOut) { |
| NSString *failureReason = [NSString stringWithFormat:NSLocalizedString(@"EncryptPasscode error: %d", @""), err]; |
| NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason }; |
| |
| *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain |
| code: NLPasscodeEncryptionSupportDomainEncryptionFailure |
| userInfo: userInfo]; |
| } |
| return nil; |
| } |
| |
| [encPasscodeBuff setLength: encPasscodeLen]; |
| return encPasscodeBuff; |
| } |
| |
| + (nullable NSData *) decryptPasscode: (NSData *) encPasscode |
| config: (UInt8) config |
| encKey: (NSData *) encKey |
| authKey: (NSData *) authKey |
| fingerprintKey: (NSData *) fingerprintKey |
| error: (NSError **) errOut { |
| |
| NSMutableData * passcodeBuff = [[NSMutableData alloc] initWithLength: kPasscodePaddedLen]; |
| size_t passcodeLen =0; |
| |
| if (config != NLWeavePasscode_Config1_TEST_ONLY) { |
| if (![NLWeavePasscodeEncryptionSupport validateKeySize: encKey |
| authKey: authKey |
| fingerprintKey: fingerprintKey |
| error: errOut]) { |
| return nil; |
| } |
| } |
| |
| WEAVE_ERROR err = DecryptPasscode((unsigned char *) [encPasscode bytes], |
| [encPasscode length], |
| (unsigned char *) [encKey bytes], |
| (unsigned char *) [authKey bytes], |
| (unsigned char *) [fingerprintKey bytes], |
| (unsigned char *) [passcodeBuff mutableBytes], |
| [passcodeBuff length], |
| passcodeLen); |
| if (err != WEAVE_NO_ERROR){ |
| |
| NSString *failureReason = [NSString stringWithFormat:NSLocalizedString(@"DecryptPasscode error: %d", @""), err]; |
| NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason }; |
| |
| *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain |
| code: NLPasscodeEncryptionSupportDomainDecryptionFailure |
| userInfo: userInfo]; |
| return nil; |
| } |
| |
| [passcodeBuff setLength: passcodeLen]; |
| return passcodeBuff; |
| } |
| |
| + (BOOL) isSupportedPasscodeEncryptionConfig: (UInt8) config { |
| return IsSupportedPasscodeEncryptionConfig(config); |
| } |
| |
| + (BOOL) getEncryptedPasscodeConfig: (NSData *) encPasscode |
| config: (UInt8 *) configOut |
| error: (NSError **) errOut { |
| UInt8 config =0; |
| WEAVE_ERROR err = GetEncryptedPasscodeConfig((unsigned char *) [encPasscode bytes], |
| [encPasscode length], config); |
| if (err != WEAVE_NO_ERROR){ |
| NSString *failureReason = |
| [NSString stringWithFormat:NSLocalizedString(@"retrieving encrypted config error: %d", @""), err]; |
| NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason }; |
| |
| *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain |
| code: NLPasscodeEncryptionSupportDomainInvalidData |
| userInfo: userInfo]; |
| return FALSE; |
| } |
| *configOut = config; |
| |
| return TRUE; |
| } |
| + (BOOL) getEncryptedPasscodeKeyId: (NSData *) encPasscode |
| keyId: (UInt32 *) keyIdOut |
| error: (NSError **) errOut { |
| UInt32 keyId =0; |
| WEAVE_ERROR err = GetEncryptedPasscodeKeyId((unsigned char *) [encPasscode bytes], |
| [encPasscode length], (uint32_t &) keyId); |
| if (err != WEAVE_NO_ERROR) { |
| NSString *failureReason = |
| [NSString stringWithFormat:NSLocalizedString(@"retrieving encrypted config error: %d", @""), err]; |
| NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason }; |
| |
| *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain |
| code: NLPasscodeEncryptionSupportDomainInvalidData |
| userInfo: userInfo]; |
| return FALSE; |
| } |
| *keyIdOut = keyId; |
| |
| return TRUE; |
| } |
| |
| + (BOOL) getEncryptedPasscodeNonce: (NSData *) encPasscode |
| nonce: (UInt32 *) nonceOut |
| error: (NSError **) errOut { |
| UInt32 nonce = 0; |
| WEAVE_ERROR err = GetEncryptedPasscodeNonce((unsigned char *) [encPasscode bytes], |
| [encPasscode length], (uint32_t &) nonce); |
| if (err != WEAVE_NO_ERROR) { |
| NSString *failureReason = |
| [NSString stringWithFormat:NSLocalizedString(@"retrieving encrypted passcode nonce: %d", @""), err]; |
| NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason }; |
| |
| *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain |
| code: NLPasscodeEncryptionSupportDomainInvalidData |
| userInfo: userInfo]; |
| return FALSE; |
| } |
| *nonceOut = nonce; |
| |
| return TRUE; |
| |
| } |
| |
| + (nullable NSData *) getEncryptedPasscodeFingerprint: (NSData *) encPasscode |
| error: (NSError **) errOut { |
| |
| NSMutableData * fingerprint = [[NSMutableData alloc] initWithLength: kPasscodeFingerprintLen]; |
| size_t fingerprintLen =0; |
| |
| WEAVE_ERROR err = GetEncryptedPasscodeFingerprint((unsigned char *) [encPasscode bytes], |
| [encPasscode length], |
| (unsigned char *) [fingerprint mutableBytes], |
| [fingerprint length], |
| fingerprintLen); |
| if (err != WEAVE_NO_ERROR){ |
| |
| NSString *failureReason = [NSString stringWithFormat:NSLocalizedString(@"get fingerprint error: %d", @""), err]; |
| NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason }; |
| |
| *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain |
| code: NLPasscodeEncryptionSupportDomainInvalidData |
| userInfo: userInfo]; |
| return nil; |
| } |
| |
| [fingerprint setLength: fingerprintLen]; |
| return fingerprint; |
| } |
| |
| #pragma mark Private Methods |
| |
| + (BOOL) validateKeySize: (NSData *) encKey |
| authKey: (NSData *) authKey |
| fingerprintKey: (NSData *) fingerprintKey |
| error: (NSError **) errOut { |
| |
| if ([encKey length] != kPasscodeEncryptionKeyLen) { |
| if (errOut) { |
| *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain |
| code: NLPasscodeEncryptionSupportDomainInvalidEncKeySize |
| userInfo: nil]; |
| } |
| return FALSE; |
| } |
| |
| if ([authKey length] != kPasscodeAuthenticationKeyLen) { |
| if (errOut) { |
| *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain |
| code: NLPasscodeEncryptionSupportDomainInvalidAuthKeySize |
| userInfo: nil]; |
| } |
| return FALSE; |
| } |
| |
| if ([fingerprintKey length] != kPasscodeFingerprintKeyLen) { |
| |
| if (errOut) { |
| *errOut = [NSError errorWithDomain: NLPasscodeEncryptionSupportDomain |
| code: NLPasscodeEncryptionSupportDomainInvalidFingerprintKeySize |
| userInfo: nil]; |
| } |
| return FALSE; |
| } |
| |
| return TRUE; |
| } |
| |
| @end |
