\documentclass[aspectratio=169,obeyspaces,spaces,hyphens,dvipsnames]{beamer}
\usepackage[utf8]{inputenc}
\usepackage{lmodern}% http://ctan.org/pkg/lm
\usepackage{minted}
\usepackage{hyperref}
\usepackage{xcolor}
\usepackage{pgfplots}
\usepackage{tikz}
\usepackage[normalem]{ulem}

\mode<presentation>
\usetheme{Bootlin}

\def\signed #1{{\leavevmode\unskip\nobreak\hfil\penalty50\hskip2em
  \hbox{}\nobreak\hfil(#1)
  \parfillskip=0pt \finalhyphendemerits=0 \endgraf}}

\newsavebox\mybox
\newenvironment{aquote}[1]
  {\savebox\mybox{#1}\begin{quotation}}
  {\signed{\usebox\mybox}\end{quotation}}

\title{PKCS\#11 with OP-TEE}
\authors{Thomas Perrot}
\email{thomas.perrot@bootlin.com}
\slidesurl{https://bootlin.com/pub/conferences/2022/lee/perrot-optee-pkcs11/}
\institute{Bootlin}
\conference{Live Embedded Event, May 18th 2022}

\begin{document}

\addtocontents{toc}{\protect\setcounter{tocdepth}{-1}}
\section{PKCS\#11 with OP-TEE}
\addtocontents{toc}{\protect\setcounter{tocdepth}{2}}

\begin{frame}{Who is speaking ?}
  \begin{columns}
    \column{0.6\textwidth}
    \begin{itemize}
    \item Thomas Perrot
    \item Embedded Linux and kernel engineer at Bootlin
    \item Joined in 2020
    \item Embedded Linux engineer and trainer
    \item Open-source contributor
    \item Based in Toulouse, France
    \end{itemize}
    \column{0.4\textwidth}
    \includegraphics[width=\textwidth]{thomas-perrot-small.png}
  \end{columns}
\end{frame}

\begin{frame}{Agenda}
  \begin{columns}
    \column{0.5\textwidth}
    \begin{itemize}
    \item Introduction
      \begin{itemize}
      \item The Goal
      \item PKCS\#11
      \item OP-TEE
      \item i.MX8
      \end{itemize}
    \end{itemize}
    \column{0.5\textwidth}
    \begin{itemize}
    \item Implementation
      \begin{itemize}
      \item List required software parts
      \item Customize the distribution
      \item Perform functional tests
      \item Generate a key
      \end{itemize}
    \end{itemize}
  \end{columns}
\end{frame}

\subsection{Introduction}

\begin{frame}{The goal}
  \begin{columns}
    \begin{column}{0.5\textwidth}
      \begin{center}
        \includegraphics[height=0.75\textheight]{graphics/pkcs11_stack.pdf}
      \end{center}
    \end{column}
    \begin{column}{0.5\textwidth}
      Perform cryptographic operations with:
      \begin{itemize}
      \item OpenSSL
      \item Isolate assets
      \item Control access
      \item On-die secure enclave
      \item Without HSM, TPM...
      \end{itemize}
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}{PKCS\#11}
  \begin{columns}
    \begin{column}{0.5\textwidth}
      \begin{itemize}
      \item Public-Key Cryptographic Standards (PKCS)
      \item Defines a platform independent API (Cryptoki)
      \item Can be used with HSM, TPM, Secure element...
      \item Supported by OpenSSL, GnuTLS, OpenSSH...
      \end{itemize}
    \end{column}
    \begin{column}{0.5\textwidth}
      \begin{center}
        \includegraphics[height=0.40\textheight]{graphics/pkcs11_cryptoki_1.png}
        \includegraphics[height=0.13\textheight]{graphics/pkcs11_cryptoki_2.png}
      \end{center}
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}{OP-TEE}
  \begin{columns}
    \begin{column}{0.5\textwidth}
      \begin{center}
        \includegraphics[height=0.75\textheight]{graphics/imx8_secure_world.pdf}
      \end{center}
    \end{column}
    \begin{column}{0.5\textwidth}
      \begin{itemize}
      \item Is a Trusted Execution Environment (TEE)
      \item Based on hardware isolation (ARM TrustZone)
      \item Protection against REE security vulnerabilities
      \item Communicates through Secure Monitor Call (SMC)
      \item Executes Trusted Applications (TAs)
      \end{itemize}
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}{i.MX8 features}
  \begin{columns}
    \begin{column}{0.5\textwidth}
      \begin{itemize}
      \item ARM TrustZone
      \item HABv4 or AHAB
      \item Hardware Tampering
      \item One Time Programmable (OTP)
      \item Secure Non-Volatile Storage (SNVS)
      \item Cryptographic Accelerator and Assurance Module (CAAM)
      \item Random Number Generator (RNG)
      \end{itemize}
    \end{column}
    \begin{column}{0.5\textwidth}
      \begin{center}
        \includegraphics[height=0.75\textheight]{graphics/imx8_blocks.png}
      \end{center}
    \end{column}
  \end{columns}
\end{frame}

\begin{frame}{i.MX8 Boot sequence}
  \begin{center}
    \includegraphics[height=0.30\textheight]{graphics/imx8_boot_sequence.pdf}
  \end{center}
  \begin{itemize}
  \item The boot sequence is platform dependent, here:
    \begin{itemize}
    \item SPL loads and executes TF-A
    \item TF-A and OP-TEE are executed from the \textbf{Secure world}
    \item Then TF-A starts U-Boot from the \textbf{Normal world}
    \item Bootloader stages can be signed
    \end{itemize}
  \end{itemize}
\end{frame}

\subsection{Implementation}

\begin{frame}[fragile]{Required software parts}
  \begin{itemize}
  \item OpenSSL
  \item PKCS\#11 library and engine (OpenSC)
  \item TEE Client library (libckteec)
  \item OP-TEE client
  \item OP-TEE PKCS\#11 TA
  \item PKCS\#11 tools
  \end{itemize}
\end{frame}

\begin{frame}[fragile]{Customize the distribution}
  \begin{itemize}
  \item Enable the support of OP-TEE
    \begin{block}{}
      \begin{minted}[fontsize=\scriptsize]{console}
DISTRO_FEATURES:append = " optee"
      \end{minted}
    \end{block}
  \item BSP is automatically customized, thanks to \textit{COMBINED\_FEATURES}
    \begin{itemize}
    \item Build the SPL
    \item Build OPTEE-OS wit the right platform flavor
    \item Update TF-A variables
      \begin{block}{}
        \begin{minted}[fontsize=\scriptsize]{console}
NEED_BL32=yes BL32_BASE=0xbe000000 SPD=opteed
        \end{minted}
      \end{block}
    \end{itemize}
  \item Install rootfs packages
    \begin{block}{}
      \begin{minted}[fontsize=\scriptsize]{console}
IMAGE_INSTALL:append = " optee-test libp11 opensc openssl-bin"
      \end{minted}
    \end{block}
  \end{itemize}
\end{frame}

\begin{frame}[fragile]{Customize the i.MX8 BSP (optional)}
  \begin{itemize}
  \item To use NXP BSP instead of the mainline
    \begin{block}{}
      \begin{minted}[fontsize=\scriptsize]{console}
IMX_DEFAULT_BSP = "nxp"
      \end{minted}
    \end{block}
  \item Enable the PKCS\#11 support in OP-TEE
    \begin{block}{}
      \begin{minted}[fontsize=\scriptsize]{console}
CFG_PKCS11_TA=y
      \end{minted}
    \end{block}
  \item Customize the OP-TEE features
    \begin{block}{}
      \begin{minted}[fontsize=\scriptsize]{console}
CFG_TEE_TA_LOG_LEVEL=4 CFG_TEE_CORE_LOG_LEVEL=4
CFG_UNWIND=y
TA_PUBLIC_KEY=ta_pub_key.pem
      \end{minted}
    \end{block}
  \item Modify the default platform configuration
    \begin{block}{}
      \begin{minted}[fontsize=\scriptsize]{console}
CFG_UART_BASE=UART2_BASE [...]
      \end{minted}
    \end{block}
  \end{itemize}
\end{frame}

\begin{frame}[fragile]{Check that OP-TEE is functioning}
  \begin{block}{}
    \begin{minted}[fontsize=\scriptsize]{console}
dmesg|grep optee
[    1.807123] optee: probing for conduit method.
[    1.811603] optee: revision 3.10 (87956c34)
[    1.813114] optee: dynamic shared memory is enabled
[    1.822546] optee: initialized driver
    \end{minted}
  \end{block}
  \begin{block}{}
    \begin{minted}[fontsize=\scriptsize]{console}
ls -lh /dev/tee*
crw------- 1 root root 246,  0 Sep 20 10:44 /dev/tee0
crw------- 1 root root 246, 16 Sep 20 10:44 /dev/teepriv0
    \end{minted}
  \end{block}
  \begin{block}{}
    \begin{minted}[fontsize=\scriptsize]{console}
ls -lh /lib/optee_armtz/|grep fd02c9da-306c-48c7-a49c-bbd827ae86ee
-r--r--r--    1 root     root      155.1K Mar  9 12:34 fd02c9da-306c-48c7-a49c-bbd827ae86ee.ta
    \end{minted}
  \end{block}
  \begin{block}{}
    \begin{minted}[fontsize=\scriptsize]{console}
xtest
[...]
35546 subtests of which 0 failed
126 test cases of which 0 failed
0 test cases were skipped
TEE test application done!
    \end{minted}
  \end{block}
\end{frame}

\begin{frame}[fragile]{Check that OP-TEE provides PKCS\#11}
  \begin{block}{}
    \begin{minted}[fontsize=\scriptsize]{console}
pkcs11-tool --show-info --module /usr/lib/libckteec.so.0
Cryptoki version 2.40
Manufacturer     Linaro
Library          OP-TEE PKCS11 Cryptoki library (ver 0.1)
Using slot 0 with a present token (0x0)
    \end{minted}
  \end{block}
\end{frame}

\begin{frame}[fragile]{Create a PKCS\#11 token}
  \begin{block}{}
    \begin{minted}[fontsize=\scriptsize]{console}
pkcs11-tool --module /usr/lib/libckteec.so.0 --init-token --label testtoken --so-pin 12341234
pkcs11-tool --module /usr/lib/libckteec.so.0 --label testtoken --login --so-pin 12341234 \
    --init-pin --pin 12341234
pkcs11-tool --module /usr/lib/libckteec.so.0 --label testtoken --login --pin \
    12341234 --keypairgen --label testkey --key-type rsa:2048
    \end{minted}
  \end{block}
\end{frame}

\begin{frame}[fragile]{Show PKCS\#11 information}
  \begin{block}{}
    \begin{minted}[fontsize=\scriptsize]{console}
pkcs11-tool --list-slots --module /usr/lib/libckteec.so.0
Available slots:
Slot 0 (0x0): OP-TEE PKCS11 TA - TEE UUID 2b9f2e53-bff5-5239-986c-52530dda62db
  token state:   uninitialized
Slot 1 (0x1): OP-TEE PKCS11 TA - TEE UUID 2b9f2e53-bff5-5239-986c-52530dda62db
  token state:   uninitialized
Slot 2 (0x2): OP-TEE PKCS11 TA - TEE UUID 2b9f2e53-bff5-5239-986c-52530dda62db
  token label        : PKCS11 TA test token
  token manufacturer : Linaro
  token model        : OP-TEE TA
  token flags        : login required, rng, token initialized, PIN initialized
  hardware version   : 0.0
  firmware version   : 0.1
  serial num         : 0000000000000002
  pin min/max        : 4/128
    \end{minted}
  \end{block}
\end{frame}

\begin{frame}[fragile]{Generate an OpenSSL key}
  \begin{block}{}
    \begin{minted}[fontsize=\scriptsize]{console}
openssl
OpenSSL> engine dynamic -pre SO_PATH:/usr/lib/engines-1.1/pkcs11.so -pre ID:pkcs11 \
    -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib/engines-1.1/libckteec.so.0.1.0
(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/usr/lib/engines-1.1/pkcs11.so
[Success]: ID:pkcs11
[Success]: LIST_ADD:1
[Success]: LOAD
[Success]: MODULE_PATH:/usr/lib/engines-1.1/libckteec.so.0.1.0
Loaded: (pkcs11) pkcs11 engine
OpenSSL> genrsa -engine pkcs11 -out priv_key.pem 2048
engine "pkcs11" set.
Generating RSA private key, 2048 bit long modulus (2 primes)
....................................................................+++++
.......................................+++++
e is 65537 (0x010001)
    \end{minted}
  \end{block}
\end{frame}

\questionslide

\end{document}
