commit ef277c969437372eceeea245d1f05124b5171897
author Andrew Scull <ascull@google.com> Mon Apr 12 17:46:13 2021 +0000
committer CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Apr 20 11:13:06 2021 +0000
tree 28769403a58381e14a8542089830e12349f41dad
parent 57940fb271deb83458b69a0393dbd28f07d48e69

Correct CDI private key size

The numerical size is unchanged but the CDI size constant was used
rather than the private key size.

Change-Id: I532334c60a598f02da75c7e5a209173a14ba9c75
Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/40740
Reviewed-by: Darren Krahn <dkrahn@google.com>
Commit-Queue: Andrew Scull <ascull@google.com>
Pigweed-Auto-Submit: Andrew Scull <ascull@google.com>

include/dice/dice.h

diff --git a/include/dice/dice.h b/include/dice/dice.h
index c56ce86..3565571 100644
--- a/include/dice/dice.h
+++ b/include/dice/dice.h
@@ -136,9 +136,9 @@
 // Derives a |cdi_private_key| from a |cdi_attest| value. On success populates
 // |cdi_private_key| and returns kDiceResultOk. Note: of the provided |ops|,
 // only 'kdf' is called.
-DiceResult DiceDeriveCdiPrivateKey(const DiceOps* ops,
-                                   const uint8_t cdi_attest[DICE_CDI_SIZE],
-                                   uint8_t cdi_private_key[DICE_CDI_SIZE]);
+DiceResult DiceDeriveCdiPrivateKey(
+    const DiceOps* ops, const uint8_t cdi_attest[DICE_CDI_SIZE],
+    uint8_t cdi_private_key[DICE_PRIVATE_KEY_SIZE]);
 
 // Derives an |id| from a |cdi_public_key| value. Because public keys can vary
 // in length depending on the algorithm, the |cdi_public_key_size| in bytes must

src/dice.c

diff --git a/src/dice.c b/src/dice.c
index 0b1ff64..2c7d8a6 100644
--- a/src/dice.c
+++ b/src/dice.c
@@ -34,9 +34,9 @@
     0x1D, 0xB9, 0x52, 0x0B, 0xA5, 0x1C, 0x7B, 0x29, 0xEA};
 static const size_t kIdSaltSize = 64;
 
-DiceResult DiceDeriveCdiPrivateKey(const DiceOps* ops,
-                                   const uint8_t cdi_attest[DICE_CDI_SIZE],
-                                   uint8_t cdi_private_key[DICE_CDI_SIZE]) {
+DiceResult DiceDeriveCdiPrivateKey(
+    const DiceOps* ops, const uint8_t cdi_attest[DICE_CDI_SIZE],
+    uint8_t cdi_private_key[DICE_PRIVATE_KEY_SIZE]) {
   // Use the CDI as input key material, with fixed salt and info.
   return ops->kdf(ops, /*length=*/DICE_PRIVATE_KEY_SIZE, cdi_attest,
                   /*ikm_size=*/DICE_CDI_SIZE, kAsymSalt, kAsymSaltSize,