cr50: Change U2F key derivation to include user secrets.

Currently it is assumed that the user secret is passed to
cr50 in plaintext for each command. A future CL will change
this so that the user secret is sent once per 'session', but
this will not impact key derivation.

BUG=b:112603199
BRANCH=none
TEST=manual tests on local device

Change-Id: I25bc8986a25defbc60ac32311c8747db3071e469
Signed-off-by: Louis Collard <louiscollard@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1436975
Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com>
Reviewed-by: Andrey Pronin <apronin@chromium.org>
(cherry picked from commit 5dedcb076082293782b0d720886d709150dfef2d)
Reviewed-on: https://chromium-review.googlesource.com/c/1465085
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
(cherry picked from commit 54c7746b7118d0bceaa9e686ec6b594a95d97a24)
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1548177
(cherry picked from commit 47c6a1674059620380bce0b545fc67c52fb082e8)

2 files changed, 35 insertions, 0 deletions

diff --git a/include/u2f.h b/include/u2f.h
index e059f98e32..b2749c7eea 100644
--- a/include/u2f.h
+++ b/include/u2f.h
@@ -98,6 +98,7 @@ typedef struct {
 
 typedef struct {
     uint8_t appId[U2F_APPID_SIZE];      // Application id
+    uint8_t userSecret[U2F_P256_SIZE];
     uint8_t flags;
 } U2F_GENERATE_REQ;
 
@@ -108,6 +109,7 @@ typedef struct {
 
 typedef struct {
     uint8_t appId[U2F_APPID_SIZE];         // Application id
+    uint8_t userSecret[U2F_P256_SIZE];
     uint8_t keyHandle[U2F_FIXED_KH_SIZE];  // Key handle
     uint8_t hash[U2F_P256_SIZE];
     uint8_t flags;
diff --git a/include/u2f_impl.h b/include/u2f_impl.h
index f16d278172..41d4bf97bc 100644
--- a/include/u2f_impl.h
+++ b/include/u2f_impl.h
@@ -67,6 +67,39 @@ int u2f_origin_keypair(uint8_t *seed, p256_int *d,
  */
 int u2f_origin_key(const uint8_t *seed, p256_int *d);
 
+/**
+ * Pack the specified origin, user secret and origin-specific seed
+ * into a key handle.
+ *
+ * @param origin pointer to origin id
+ * @param user pointer to user secret
+ * @param pointer to origin-specific random seed
+ *
+ * @return EC_SUCCESS if a valid keypair was created.
+ */
+int u2f_origin_user_keyhandle(const uint8_t *origin,
+			      const uint8_t *user,
+			      const uint8_t *seed,
+			      uint8_t *key_handle);
+
+/**
+ * Generate an origin and user-specific ECDSA keypair from the specified
+ * key handle.
+ *
+ * If pk_x and pk_y are NULL, public key generation will be skipped.
+ *
+ * @param key_handle pointer to the 64 byte key handle
+ * @param d pointer to ECDSA private key
+ * @param pk_x pointer to public key point
+ * @param pk_y pointer to public key point
+ *
+ * @return EC_SUCCESS if a valid keypair was created.
+ */
+int u2f_origin_user_keypair(const uint8_t *key_handle,
+			    p256_int *d,
+			    p256_int *pk_x,
+			    p256_int *pk_y);
+
 /***
  * Generate a hardware derived 256b private key.
  *