aacs: relocate the AACS cert handshake into freemkv-unlock

Stage 2: the AACS host-certificate handshake (the AKE + bus-key derivation +
P-160/P-256 EC crypto, ~2050 lines) moves out of libfreemkv into the
self-contained src/aacs module, with its own error type (the Aacs* failure
points + structured ScsiError) and an aes_ecb_decrypt helper. AacsCert impls
crate::Unlocker — matches DiscKind::Aacs, runs run_cert_handshake against the
host certs the consumer passes via UnlockCtx, and returns Unlocked { vid,
bus_key }. collect_host_certs stays in libfreemkv (it reads keysources). The
SCSI contract gains ScsiSense + the AACS/REPORT-KEY opcodes. libfreemkv is
untouched (still green); it rewires onto this in stage 4.

72 tests pass (the handshake brought its full EC-crypto test suite).

This commit is contained in:

Matthew Jackson

2026-06-29 19:33:07 -07:00

parent 0e943c3792

commit 22130bfe12

6 changed files with 2280 additions and 6 deletions

									
										Cargo.toml
									
		+6
		
												View File
												
				@@ -12,3 +12,9 @@ serde = { version = "1", features = ["derive"] }

				serde_json = "1"

				base64 = "0.22.1"

				tracing = "0.1"

				num-bigint = "0.4"

				num-traits = "0.2"

				sha1 = "0.10"

				sha2 = "0.10"

				aes = "0.8"

				rand = "0.8"