Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enforce that P256Keypair is not copyable #31118

Merged
merged 1 commit into from
Jan 20, 2024
Merged

Enforce that P256Keypair is not copyable #31118

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 39 additions & 12 deletions src/crypto/CHIPCryptoPAL.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,8 +222,16 @@ bool IsBufferContentEqualConstantTime(const void * a, const void * b, size_t n);
template <typename Sig>
class ECPKey
{
protected:
andy31415 marked this conversation as resolved.
Show resolved Hide resolved
// This base type can't be copied / assigned directly.
// Sub-types should be either uncopyable or final.
ECPKey() = default;
ECPKey(const ECPKey &) = default;
ECPKey & operator=(const ECPKey &) = default;

public:
virtual ~ECPKey() {}
virtual ~ECPKey() = default;

virtual SupportedECPKeyTypes Type() const = 0;
virtual size_t Length() const = 0;
virtual bool IsUncompressed() const = 0;
Expand Down Expand Up @@ -377,10 +385,11 @@ using IdentityProtectionKeySpan = FixedByteSpan<Crypto::CHIP_CRYPTO_SYMMETRIC_KE

using AttestationChallenge = SensitiveDataFixedBuffer<CHIP_CRYPTO_SYMMETRIC_KEY_LENGTH_BYTES>;

class P256PublicKey : public ECPKey<P256ECDSASignature>
class P256PublicKey final // final due to being copyable
: public ECPKey<P256ECDSASignature>
{
public:
P256PublicKey() {}
P256PublicKey() = default;

template <size_t N>
constexpr P256PublicKey(const uint8_t (&raw_value)[N])
Expand Down Expand Up @@ -430,8 +439,15 @@ class P256PublicKey : public ECPKey<P256ECDSASignature>
template <typename PK, typename Secret, typename Sig>
class ECPKeypair
{
protected:
// This base type can't be copied / assigned directly.
// Sub-types should be either uncopyable or final.
ECPKeypair() = default;
ECPKeypair(const ECPKeypair &) = default;
ECPKeypair & operator=(const ECPKeypair &) = default;

public:
virtual ~ECPKeypair() {}
virtual ~ECPKeypair() = default;

/** @brief Generate a new Certificate Signing Request (CSR).
* @param csr Newly generated CSR in DER format
Expand Down Expand Up @@ -472,6 +488,13 @@ using P256SerializedKeypair = SensitiveDataBuffer<kP256_PublicKey_Length + kP256

class P256KeypairBase : public ECPKeypair<P256PublicKey, P256ECDHDerivedSecret, P256ECDSASignature>
{
protected:
// This base type can't be copied / assigned directly.
tehampson marked this conversation as resolved.
Show resolved Hide resolved
// Sub-types should be either uncopyable or final.
P256KeypairBase() = default;
P256KeypairBase(const P256KeypairBase &) = default;
P256KeypairBase & operator=(const P256KeypairBase &) = default;

public:
/**
* @brief Initialize the keypair.
Expand All @@ -495,9 +518,13 @@ class P256KeypairBase : public ECPKeypair<P256PublicKey, P256ECDHDerivedSecret,
class P256Keypair : public P256KeypairBase
{
public:
P256Keypair() {}
P256Keypair() = default;
~P256Keypair() override;

// P256Keypair can't be copied / assigned.
P256Keypair(const P256Keypair &) = delete;
P256Keypair & operator=(const P256Keypair &) = delete;

/**
* @brief Initialize the keypair.
* @return Returns a CHIP_ERROR on error, CHIP_NO_ERROR otherwise
Expand Down Expand Up @@ -919,8 +946,8 @@ class Hash_SHA256_stream
class HKDF_sha
{
public:
HKDF_sha() {}
virtual ~HKDF_sha() {}
HKDF_sha() = default;
virtual ~HKDF_sha() = default;

/**
* @brief A function that implements SHA-256 based HKDF
Expand Down Expand Up @@ -952,8 +979,8 @@ class HKDF_sha
class HMAC_sha
{
public:
HMAC_sha() {}
virtual ~HMAC_sha() {}
HMAC_sha() = default;
virtual ~HMAC_sha() = default;

/**
* @brief A function that implements SHA-256 based HMAC per FIPS1981.
Expand Down Expand Up @@ -1043,8 +1070,8 @@ CHIP_ERROR add_entropy_source(entropy_source fn_source, void * p_source, size_t
class PBKDF2_sha256
{
public:
PBKDF2_sha256() {}
virtual ~PBKDF2_sha256() {}
PBKDF2_sha256() = default;
virtual ~PBKDF2_sha256() = default;

/** @brief Function to derive key using password. SHA256 hashing algorithm is used for calculating hmac.
* @param password password used for key derivation
Expand Down Expand Up @@ -1085,7 +1112,7 @@ class Spake2p
{
public:
Spake2p(size_t fe_size, size_t point_size, size_t hash_size);
virtual ~Spake2p() {}
virtual ~Spake2p() = default;

/**
* @brief Initialize Spake2+ with some context specific information.
Expand Down
Loading