Bug: wh_server_cert calls don't support local cache

[DrKatieL]

The issue:
This is issue is widespread throughout wh_server_cert.c. I'm going to walk through one function but search for "server->nvm,". for other instances.
wh_Server_CertReadTrusted() needs to get a root certificate out of NVM. If key wrapping is enabled, this is only available to the server via the cache. In these builds the server will/may have two caches, a global one (accessible via server->nvm->globalCache) and a local one (accessible by server->localCache. wh_Server_CertReadTrusted() calls wh_Nvm_GetMetadata and wh_Nvm_Read on server->nvm. If the key wrap is using a local cache (the safer and default option) these calls will obviously fail as the call has no access to a local cache.

The fix:
This suggestion should obviously be verified for architectural correctness and unintended security side effects before adoption. The certs can be accessed via wh_Server_KeystoreReadKey and other general keystore calls which correctly handle caches and reduces code duplication. Alternatively, wh_Server_CertReadTrusted and other calls in the certificate manager can be rewritten to use logic more similar to that in the general keystore and accept the entire server object as a parameter.

[bigbrett]

Hi @DrKatieL,

Thanks for the report. I’m not sure whether this is a bug report or a feature request, but allow me to clarify the situation:

The issues you’re encountering stem from the fact that certificates were never designed to be stored in the key cache, let alone supported as wrapped objects.

Certificates are strictly NVM objects. There is no client or server code path that places certificates into the key cache. The key cache is intended only for cryptographic keys, not certificates. Additionally, key wrapping applies exclusively to keys marked with WH_KEYTYPE_WRAPPED and does not affect standard NVM objects such as trusted certificates.

That said, given the constraints of your hardware platform, it makes sense why allowing for wrapped and cacheable certificates would be useful. We’ll consider this as an enhancement for future releases.