blob: bd6bf98b2df858eb7ecce8fcdc20c8d2496b42b3 [file] [log] [blame]
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +02001/*
2 * Public Key abstraction layer
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +020018 */
19
Gilles Peskinedb09ef62020-06-03 01:43:33 +020020#include "common.h"
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +020021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if defined(MBEDTLS_PK_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000023#include "mbedtls/pk.h"
Chris Jonesdaacb592021-03-09 17:03:29 +000024#include "pk_wrap.h"
Neil Armstrongca5b55f2022-03-15 15:00:55 +010025#include "pkwrite.h"
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +020026
Manuel Pégourié-Gonnard47728842022-07-18 13:00:40 +020027#include "hash_info.h"
Manuel Pégourié-Gonnarda370e062022-07-05 11:55:20 +020028
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050029#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000030#include "mbedtls/error.h"
Andres AG72849872017-01-19 11:24:33 +000031
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020032#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000033#include "mbedtls/rsa.h"
Manuel Pégourié-Gonnard81c313c2013-07-09 10:35:54 +020034#endif
Valerio Setti0d2980f2023-04-05 18:17:13 +020035#if defined(MBEDTLS_ECP_LIGHT)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000036#include "mbedtls/ecp.h"
Manuel Pégourié-Gonnard81c313c2013-07-09 10:35:54 +020037#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020038#if defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000039#include "mbedtls/ecdsa.h"
Manuel Pégourié-Gonnard7c5819e2013-07-10 12:29:57 +020040#endif
Manuel Pégourié-Gonnard81c313c2013-07-09 10:35:54 +020041
Jerry Yub02ee182022-03-16 10:30:41 +080042#if defined(MBEDTLS_PSA_CRYPTO_C)
Manuel Pégourié-Gonnard347a00e2018-11-19 12:25:37 +010043#include "mbedtls/psa_util.h"
Andrzej Kurek8a045ce2022-12-23 11:00:06 -050044#define PSA_PK_TO_MBEDTLS_ERR(status) psa_pk_status_to_mbedtls(status)
45#define PSA_PK_RSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \
46 psa_to_pk_rsa_errors, \
47 psa_pk_status_to_mbedtls)
48#define PSA_PK_ECDSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \
49 psa_to_pk_ecdsa_errors, \
50 psa_pk_status_to_mbedtls)
Manuel Pégourié-Gonnard347a00e2018-11-19 12:25:37 +010051#endif
52
Andres AG72849872017-01-19 11:24:33 +000053#include <limits.h>
Andres Amaya Garcia7c02c502017-08-04 13:32:15 +010054#include <stdint.h>
Paul Bakker34617722014-06-13 17:20:13 +020055
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +020056/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020057 * Initialise a mbedtls_pk_context
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +020058 */
Gilles Peskine449bd832023-01-11 14:50:10 +010059void mbedtls_pk_init(mbedtls_pk_context *ctx)
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +020060{
Manuel Pégourié-Gonnard3fb5c5e2013-08-14 18:26:41 +020061 ctx->pk_info = NULL;
62 ctx->pk_ctx = NULL;
Valerio Settie00954d2023-04-28 15:24:32 +020063#if defined(MBEDTLS_PSA_CRYPTO_C)
64 ctx->opaque_id = MBEDTLS_SVC_KEY_ID_INIT;
65#endif /* MBEDTLS_PSA_CRYPTO_C */
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +020066}
67
68/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020069 * Free (the components of) a mbedtls_pk_context
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +020070 */
Gilles Peskine449bd832023-01-11 14:50:10 +010071void mbedtls_pk_free(mbedtls_pk_context *ctx)
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +020072{
Gilles Peskine449bd832023-01-11 14:50:10 +010073 if (ctx == NULL) {
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +020074 return;
Gilles Peskine449bd832023-01-11 14:50:10 +010075 }
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +020076
Valerio Settie00954d2023-04-28 15:24:32 +020077 if ((ctx->pk_info != NULL) && (ctx->pk_info->ctx_free_func != NULL)) {
Gilles Peskine449bd832023-01-11 14:50:10 +010078 ctx->pk_info->ctx_free_func(ctx->pk_ctx);
79 }
Manuel Pégourié-Gonnard1f73a652013-07-09 10:26:41 +020080
Gilles Peskine449bd832023-01-11 14:50:10 +010081 mbedtls_platform_zeroize(ctx, sizeof(mbedtls_pk_context));
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +020082}
83
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +020084#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +020085/*
86 * Initialize a restart context
87 */
Gilles Peskine449bd832023-01-11 14:50:10 +010088void mbedtls_pk_restart_init(mbedtls_pk_restart_ctx *ctx)
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +020089{
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +020090 ctx->pk_info = NULL;
91 ctx->rs_ctx = NULL;
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +020092}
93
94/*
95 * Free the components of a restart context
96 */
Gilles Peskine449bd832023-01-11 14:50:10 +010097void mbedtls_pk_restart_free(mbedtls_pk_restart_ctx *ctx)
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +020098{
Gilles Peskine449bd832023-01-11 14:50:10 +010099 if (ctx == NULL || ctx->pk_info == NULL ||
100 ctx->pk_info->rs_free_func == NULL) {
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +0200101 return;
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200102 }
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +0200103
Gilles Peskine449bd832023-01-11 14:50:10 +0100104 ctx->pk_info->rs_free_func(ctx->rs_ctx);
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200105
106 ctx->pk_info = NULL;
107 ctx->rs_ctx = NULL;
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +0200108}
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200109#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +0200110
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200111/*
112 * Get pk_info structure from type
113 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100114const mbedtls_pk_info_t *mbedtls_pk_info_from_type(mbedtls_pk_type_t pk_type)
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200115{
Gilles Peskine449bd832023-01-11 14:50:10 +0100116 switch (pk_type) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200117#if defined(MBEDTLS_RSA_C)
118 case MBEDTLS_PK_RSA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100119 return &mbedtls_rsa_info;
Valerio Setti0d2980f2023-04-05 18:17:13 +0200120#endif /* MBEDTLS_RSA_C */
121#if defined(MBEDTLS_ECP_LIGHT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200122 case MBEDTLS_PK_ECKEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100123 return &mbedtls_eckey_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200124 case MBEDTLS_PK_ECKEY_DH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100125 return &mbedtls_eckeydh_info;
Valerio Setti0d2980f2023-04-05 18:17:13 +0200126#endif /* MBEDTLS_ECP_LIGHT */
Valerio Setti7ca13182023-01-27 13:22:42 +0100127#if defined(MBEDTLS_PK_CAN_ECDSA_SOME)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200128 case MBEDTLS_PK_ECDSA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100129 return &mbedtls_ecdsa_info;
Valerio Setti0d2980f2023-04-05 18:17:13 +0200130#endif /* MBEDTLS_PK_CAN_ECDSA_SOME */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200131 /* MBEDTLS_PK_RSA_ALT omitted on purpose */
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200132 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100133 return NULL;
Manuel Pégourié-Gonnard765db072013-08-14 15:00:27 +0200134 }
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +0200135}
136
137/*
Manuel Pégourié-Gonnardab466942013-08-15 11:30:27 +0200138 * Initialise context
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +0200139 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100140int mbedtls_pk_setup(mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info)
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +0200141{
Gilles Peskine449bd832023-01-11 14:50:10 +0100142 if (info == NULL || ctx->pk_info != NULL) {
143 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
144 }
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +0200145
Valerio Settie00954d2023-04-28 15:24:32 +0200146 if ((info->ctx_alloc_func == NULL) ||
147 ((ctx->pk_ctx = info->ctx_alloc_func()) == NULL)) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100148 return MBEDTLS_ERR_PK_ALLOC_FAILED;
149 }
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +0200150
Manuel Pégourié-Gonnard3fb5c5e2013-08-14 18:26:41 +0200151 ctx->pk_info = info;
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +0200152
Gilles Peskine449bd832023-01-11 14:50:10 +0100153 return 0;
Manuel Pégourié-Gonnard12e0ed92013-07-04 13:31:32 +0200154}
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200155
Manuel Pégourié-Gonnard20678b22018-10-22 12:11:15 +0200156#if defined(MBEDTLS_USE_PSA_CRYPTO)
157/*
158 * Initialise a PSA-wrapping context
159 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100160int mbedtls_pk_setup_opaque(mbedtls_pk_context *ctx,
161 const mbedtls_svc_key_id_t key)
Manuel Pégourié-Gonnard20678b22018-10-22 12:11:15 +0200162{
Neil Armstrongeabbf9d2022-03-15 12:01:26 +0100163 const mbedtls_pk_info_t *info = NULL;
Gilles Peskined2d45c12019-05-27 14:53:13 +0200164 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Manuel Pégourié-Gonnard920c0632018-10-31 10:57:29 +0100165 psa_key_type_t type;
Manuel Pégourié-Gonnard20678b22018-10-22 12:11:15 +0200166
Gilles Peskine449bd832023-01-11 14:50:10 +0100167 if (ctx == NULL || ctx->pk_info != NULL) {
168 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
169 }
Manuel Pégourié-Gonnard20678b22018-10-22 12:11:15 +0200170
Gilles Peskine449bd832023-01-11 14:50:10 +0100171 if (PSA_SUCCESS != psa_get_key_attributes(key, &attributes)) {
172 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
173 }
174 type = psa_get_key_type(&attributes);
175 psa_reset_key_attributes(&attributes);
Manuel Pégourié-Gonnard920c0632018-10-31 10:57:29 +0100176
Gilles Peskine449bd832023-01-11 14:50:10 +0100177 if (PSA_KEY_TYPE_IS_ECC_KEY_PAIR(type)) {
Neil Armstrongeabbf9d2022-03-15 12:01:26 +0100178 info = &mbedtls_pk_ecdsa_opaque_info;
Gilles Peskine449bd832023-01-11 14:50:10 +0100179 } else if (type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
Neil Armstrongeabbf9d2022-03-15 12:01:26 +0100180 info = &mbedtls_pk_rsa_opaque_info;
Gilles Peskine449bd832023-01-11 14:50:10 +0100181 } else {
182 return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
183 }
Manuel Pégourié-Gonnard920c0632018-10-31 10:57:29 +0100184
Manuel Pégourié-Gonnard20678b22018-10-22 12:11:15 +0200185 ctx->pk_info = info;
Valerio Settie00954d2023-04-28 15:24:32 +0200186 ctx->opaque_id = key;
Manuel Pégourié-Gonnard7b5fe042018-10-31 09:57:45 +0100187
Gilles Peskine449bd832023-01-11 14:50:10 +0100188 return 0;
Manuel Pégourié-Gonnard20678b22018-10-22 12:11:15 +0200189}
190#endif /* MBEDTLS_USE_PSA_CRYPTO */
191
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200192#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT)
Manuel Pégourié-Gonnardb4fae572014-01-20 11:22:25 +0100193/*
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200194 * Initialize an RSA-alt context
195 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100196int mbedtls_pk_setup_rsa_alt(mbedtls_pk_context *ctx, void *key,
197 mbedtls_pk_rsa_alt_decrypt_func decrypt_func,
198 mbedtls_pk_rsa_alt_sign_func sign_func,
199 mbedtls_pk_rsa_alt_key_len_func key_len_func)
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200200{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200201 mbedtls_rsa_alt_context *rsa_alt;
202 const mbedtls_pk_info_t *info = &mbedtls_rsa_alt_info;
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200203
Gilles Peskine449bd832023-01-11 14:50:10 +0100204 if (ctx->pk_info != NULL) {
205 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
206 }
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200207
Gilles Peskine449bd832023-01-11 14:50:10 +0100208 if ((ctx->pk_ctx = info->ctx_alloc_func()) == NULL) {
209 return MBEDTLS_ERR_PK_ALLOC_FAILED;
210 }
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200211
212 ctx->pk_info = info;
213
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200214 rsa_alt = (mbedtls_rsa_alt_context *) ctx->pk_ctx;
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200215
216 rsa_alt->key = key;
217 rsa_alt->decrypt_func = decrypt_func;
218 rsa_alt->sign_func = sign_func;
219 rsa_alt->key_len_func = key_len_func;
220
Gilles Peskine449bd832023-01-11 14:50:10 +0100221 return 0;
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200222}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200223#endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */
Manuel Pégourié-Gonnard12c1ff02013-08-21 12:28:31 +0200224
225/*
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200226 * Tell if a PK can do the operations of the given type
227 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100228int mbedtls_pk_can_do(const mbedtls_pk_context *ctx, mbedtls_pk_type_t type)
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200229{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500230 /* A context with null pk_info is not set up yet and can't do anything.
231 * For backward compatibility, also accept NULL instead of a context
232 * pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100233 if (ctx == NULL || ctx->pk_info == NULL) {
234 return 0;
235 }
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200236
Gilles Peskine449bd832023-01-11 14:50:10 +0100237 return ctx->pk_info->can_do(type);
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200238}
239
Neil Armstronga88b1582022-05-11 14:11:25 +0200240#if defined(MBEDTLS_USE_PSA_CRYPTO)
241/*
242 * Tell if a PK can do the operations of the given PSA algorithm
243 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100244int mbedtls_pk_can_do_ext(const mbedtls_pk_context *ctx, psa_algorithm_t alg,
245 psa_key_usage_t usage)
Neil Armstronga88b1582022-05-11 14:11:25 +0200246{
Neil Armstrong408f6a62022-05-17 14:23:20 +0200247 psa_key_usage_t key_usage;
248
Neil Armstronga88b1582022-05-11 14:11:25 +0200249 /* A context with null pk_info is not set up yet and can't do anything.
250 * For backward compatibility, also accept NULL instead of a context
251 * pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100252 if (ctx == NULL || ctx->pk_info == NULL) {
253 return 0;
254 }
Neil Armstronga88b1582022-05-11 14:11:25 +0200255
256 /* Filter out non allowed algorithms */
Gilles Peskine449bd832023-01-11 14:50:10 +0100257 if (PSA_ALG_IS_ECDSA(alg) == 0 &&
258 PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) == 0 &&
259 PSA_ALG_IS_RSA_PSS(alg) == 0 &&
Neil Armstronga88b1582022-05-11 14:11:25 +0200260 alg != PSA_ALG_RSA_PKCS1V15_CRYPT &&
Gilles Peskine449bd832023-01-11 14:50:10 +0100261 PSA_ALG_IS_ECDH(alg) == 0) {
262 return 0;
263 }
Neil Armstronga88b1582022-05-11 14:11:25 +0200264
Neil Armstrong408f6a62022-05-17 14:23:20 +0200265 /* Filter out non allowed usage flags */
Gilles Peskine449bd832023-01-11 14:50:10 +0100266 if (usage == 0 ||
267 (usage & ~(PSA_KEY_USAGE_SIGN_HASH |
268 PSA_KEY_USAGE_DECRYPT |
269 PSA_KEY_USAGE_DERIVE)) != 0) {
270 return 0;
271 }
Neil Armstrong408f6a62022-05-17 14:23:20 +0200272
Neil Armstronga88b1582022-05-11 14:11:25 +0200273 /* Wildcard hash is not allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +0100274 if (PSA_ALG_IS_SIGN_HASH(alg) &&
275 PSA_ALG_SIGN_GET_HASH(alg) == PSA_ALG_ANY_HASH) {
276 return 0;
277 }
Neil Armstronga88b1582022-05-11 14:11:25 +0200278
Gilles Peskine449bd832023-01-11 14:50:10 +0100279 if (mbedtls_pk_get_type(ctx) != MBEDTLS_PK_OPAQUE) {
Neil Armstronga88b1582022-05-11 14:11:25 +0200280 mbedtls_pk_type_t type;
281
Gilles Peskine449bd832023-01-11 14:50:10 +0100282 if (PSA_ALG_IS_ECDSA(alg) || PSA_ALG_IS_ECDH(alg)) {
Neil Armstronga88b1582022-05-11 14:11:25 +0200283 type = MBEDTLS_PK_ECKEY;
Gilles Peskine449bd832023-01-11 14:50:10 +0100284 } else if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
285 alg == PSA_ALG_RSA_PKCS1V15_CRYPT) {
Neil Armstronga88b1582022-05-11 14:11:25 +0200286 type = MBEDTLS_PK_RSA;
Gilles Peskine449bd832023-01-11 14:50:10 +0100287 } else if (PSA_ALG_IS_RSA_PSS(alg)) {
Neil Armstronga88b1582022-05-11 14:11:25 +0200288 type = MBEDTLS_PK_RSASSA_PSS;
Gilles Peskine449bd832023-01-11 14:50:10 +0100289 } else {
290 return 0;
291 }
Neil Armstronga88b1582022-05-11 14:11:25 +0200292
Gilles Peskine449bd832023-01-11 14:50:10 +0100293 if (ctx->pk_info->can_do(type) == 0) {
294 return 0;
295 }
Neil Armstrong408f6a62022-05-17 14:23:20 +0200296
Gilles Peskine449bd832023-01-11 14:50:10 +0100297 switch (type) {
Neil Armstrong084338d2022-05-19 16:22:40 +0200298 case MBEDTLS_PK_ECKEY:
299 key_usage = PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_DERIVE;
300 break;
301 case MBEDTLS_PK_RSA:
302 case MBEDTLS_PK_RSASSA_PSS:
303 key_usage = PSA_KEY_USAGE_SIGN_HASH |
304 PSA_KEY_USAGE_SIGN_MESSAGE |
305 PSA_KEY_USAGE_DECRYPT;
306 break;
307 default:
Neil Armstrongb80785f2022-05-20 09:25:55 +0200308 /* Should never happen */
Gilles Peskine449bd832023-01-11 14:50:10 +0100309 return 0;
Neil Armstrong084338d2022-05-19 16:22:40 +0200310 }
311
Gilles Peskine449bd832023-01-11 14:50:10 +0100312 return (key_usage & usage) == usage;
Neil Armstronga88b1582022-05-11 14:11:25 +0200313 }
314
Neil Armstronga88b1582022-05-11 14:11:25 +0200315 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
316 psa_algorithm_t key_alg, key_alg2;
317 psa_status_t status;
318
Valerio Setti048cd442023-04-28 15:26:11 +0200319 status = psa_get_key_attributes(ctx->opaque_id, &attributes);
Gilles Peskine449bd832023-01-11 14:50:10 +0100320 if (status != PSA_SUCCESS) {
321 return 0;
322 }
Neil Armstronga88b1582022-05-11 14:11:25 +0200323
Gilles Peskine449bd832023-01-11 14:50:10 +0100324 key_alg = psa_get_key_algorithm(&attributes);
325 key_alg2 = psa_get_key_enrollment_algorithm(&attributes);
326 key_usage = psa_get_key_usage_flags(&attributes);
327 psa_reset_key_attributes(&attributes);
Neil Armstronga88b1582022-05-11 14:11:25 +0200328
Gilles Peskine449bd832023-01-11 14:50:10 +0100329 if ((key_usage & usage) != usage) {
330 return 0;
331 }
Neil Armstrong408f6a62022-05-17 14:23:20 +0200332
Neil Armstronga88b1582022-05-11 14:11:25 +0200333 /*
Neil Armstrongdab56ba2022-05-17 11:56:55 +0200334 * Common case: the key alg or alg2 only allows alg.
Neil Armstronga88b1582022-05-11 14:11:25 +0200335 * This will match PSA_ALG_RSA_PKCS1V15_CRYPT & PSA_ALG_IS_ECDH
336 * directly.
337 * This would also match ECDSA/RSA_PKCS1V15_SIGN/RSA_PSS with
338 * a fixed hash on key_alg/key_alg2.
339 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100340 if (alg == key_alg || alg == key_alg2) {
341 return 1;
342 }
Neil Armstronga88b1582022-05-11 14:11:25 +0200343
344 /*
Neil Armstrongbbb8b752022-05-17 14:58:27 +0200345 * If key_alg or key_alg2 is a hash-and-sign with a wildcard for the hash,
346 * and alg is the same hash-and-sign family with any hash,
Neil Armstronga88b1582022-05-11 14:11:25 +0200347 * then alg is compliant with this key alg
348 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100349 if (PSA_ALG_IS_SIGN_HASH(alg)) {
Neil Armstronga88b1582022-05-11 14:11:25 +0200350
Gilles Peskine449bd832023-01-11 14:50:10 +0100351 if (PSA_ALG_IS_SIGN_HASH(key_alg) &&
352 PSA_ALG_SIGN_GET_HASH(key_alg) == PSA_ALG_ANY_HASH &&
353 (alg & ~PSA_ALG_HASH_MASK) == (key_alg & ~PSA_ALG_HASH_MASK)) {
354 return 1;
355 }
Neil Armstronga88b1582022-05-11 14:11:25 +0200356
Gilles Peskine449bd832023-01-11 14:50:10 +0100357 if (PSA_ALG_IS_SIGN_HASH(key_alg2) &&
358 PSA_ALG_SIGN_GET_HASH(key_alg2) == PSA_ALG_ANY_HASH &&
359 (alg & ~PSA_ALG_HASH_MASK) == (key_alg2 & ~PSA_ALG_HASH_MASK)) {
360 return 1;
361 }
Neil Armstronga88b1582022-05-11 14:11:25 +0200362 }
363
Gilles Peskine449bd832023-01-11 14:50:10 +0100364 return 0;
Neil Armstronga88b1582022-05-11 14:11:25 +0200365}
366#endif /* MBEDTLS_USE_PSA_CRYPTO */
367
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200368/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200369 * Helper for mbedtls_pk_sign and mbedtls_pk_verify
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +0200370 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100371static inline int pk_hashlen_helper(mbedtls_md_type_t md_alg, size_t *hash_len)
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +0200372{
Gilles Peskine449bd832023-01-11 14:50:10 +0100373 if (*hash_len != 0) {
374 return 0;
375 }
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +0200376
Gilles Peskine449bd832023-01-11 14:50:10 +0100377 *hash_len = mbedtls_hash_info_get_size(md_alg);
Manuel Pégourié-Gonnarda370e062022-07-05 11:55:20 +0200378
Gilles Peskine449bd832023-01-11 14:50:10 +0100379 if (*hash_len == 0) {
380 return -1;
381 }
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +0200382
Gilles Peskine449bd832023-01-11 14:50:10 +0100383 return 0;
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +0200384}
385
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200386#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200387/*
388 * Helper to set up a restart context if needed
389 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100390static int pk_restart_setup(mbedtls_pk_restart_ctx *ctx,
391 const mbedtls_pk_info_t *info)
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200392{
Manuel Pégourié-Gonnardc8c12b62018-07-02 13:09:39 +0200393 /* Don't do anything if already set up or invalid */
Gilles Peskine449bd832023-01-11 14:50:10 +0100394 if (ctx == NULL || ctx->pk_info != NULL) {
395 return 0;
396 }
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200397
398 /* Should never happen when we're called */
Gilles Peskine449bd832023-01-11 14:50:10 +0100399 if (info->rs_alloc_func == NULL || info->rs_free_func == NULL) {
400 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
401 }
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200402
Gilles Peskine449bd832023-01-11 14:50:10 +0100403 if ((ctx->rs_ctx = info->rs_alloc_func()) == NULL) {
404 return MBEDTLS_ERR_PK_ALLOC_FAILED;
405 }
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200406
407 ctx->pk_info = info;
408
Gilles Peskine449bd832023-01-11 14:50:10 +0100409 return 0;
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200410}
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200411#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200412
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +0200413/*
Manuel Pégourié-Gonnard82cb27b2017-05-03 10:59:45 +0200414 * Verify a signature (restartable)
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200415 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100416int mbedtls_pk_verify_restartable(mbedtls_pk_context *ctx,
417 mbedtls_md_type_t md_alg,
418 const unsigned char *hash, size_t hash_len,
419 const unsigned char *sig, size_t sig_len,
420 mbedtls_pk_restart_ctx *rs_ctx)
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200421{
Gilles Peskine449bd832023-01-11 14:50:10 +0100422 if ((md_alg != MBEDTLS_MD_NONE || hash_len != 0) && hash == NULL) {
Tuvshinzaya Erdenekhuu78c1d8c2022-07-29 14:51:50 +0100423 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
Gilles Peskine449bd832023-01-11 14:50:10 +0100424 }
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500425
Gilles Peskine449bd832023-01-11 14:50:10 +0100426 if (ctx->pk_info == NULL ||
427 pk_hashlen_helper(md_alg, &hash_len) != 0) {
428 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
429 }
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200430
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200431#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnardd55f7762017-08-18 17:40:15 +0200432 /* optimization: use non-restartable version if restart disabled */
Gilles Peskine449bd832023-01-11 14:50:10 +0100433 if (rs_ctx != NULL &&
Manuel Pégourié-Gonnardb843b152018-10-16 10:41:31 +0200434 mbedtls_ecp_restart_is_enabled() &&
Gilles Peskine449bd832023-01-11 14:50:10 +0100435 ctx->pk_info->verify_rs_func != NULL) {
Janos Follath24eed8d2019-11-22 13:21:35 +0000436 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200437
Gilles Peskine449bd832023-01-11 14:50:10 +0100438 if ((ret = pk_restart_setup(rs_ctx, ctx->pk_info)) != 0) {
439 return ret;
440 }
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200441
valerio38992cb2023-04-20 09:56:30 +0200442 ret = ctx->pk_info->verify_rs_func(ctx,
Gilles Peskine449bd832023-01-11 14:50:10 +0100443 md_alg, hash, hash_len, sig, sig_len, rs_ctx->rs_ctx);
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200444
Gilles Peskine449bd832023-01-11 14:50:10 +0100445 if (ret != MBEDTLS_ERR_ECP_IN_PROGRESS) {
446 mbedtls_pk_restart_free(rs_ctx);
447 }
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200448
Gilles Peskine449bd832023-01-11 14:50:10 +0100449 return ret;
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200450 }
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200451#else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200452 (void) rs_ctx;
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200453#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200454
Gilles Peskine449bd832023-01-11 14:50:10 +0100455 if (ctx->pk_info->verify_func == NULL) {
456 return MBEDTLS_ERR_PK_TYPE_MISMATCH;
457 }
Manuel Pégourié-Gonnardfff80f82013-08-17 15:20:06 +0200458
valerio38992cb2023-04-20 09:56:30 +0200459 return ctx->pk_info->verify_func(ctx, md_alg, hash, hash_len,
Gilles Peskine449bd832023-01-11 14:50:10 +0100460 sig, sig_len);
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200461}
462
463/*
Manuel Pégourié-Gonnard82cb27b2017-05-03 10:59:45 +0200464 * Verify a signature
465 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100466int mbedtls_pk_verify(mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg,
467 const unsigned char *hash, size_t hash_len,
468 const unsigned char *sig, size_t sig_len)
Manuel Pégourié-Gonnard82cb27b2017-05-03 10:59:45 +0200469{
Gilles Peskine449bd832023-01-11 14:50:10 +0100470 return mbedtls_pk_verify_restartable(ctx, md_alg, hash, hash_len,
471 sig, sig_len, NULL);
Manuel Pégourié-Gonnard82cb27b2017-05-03 10:59:45 +0200472}
473
474/*
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200475 * Verify a signature with options
476 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100477int mbedtls_pk_verify_ext(mbedtls_pk_type_t type, const void *options,
478 mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg,
479 const unsigned char *hash, size_t hash_len,
480 const unsigned char *sig, size_t sig_len)
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200481{
Gilles Peskine449bd832023-01-11 14:50:10 +0100482 if ((md_alg != MBEDTLS_MD_NONE || hash_len != 0) && hash == NULL) {
Tuvshinzaya Erdenekhuu78c1d8c2022-07-29 14:51:50 +0100483 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
Gilles Peskine449bd832023-01-11 14:50:10 +0100484 }
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500485
Gilles Peskine449bd832023-01-11 14:50:10 +0100486 if (ctx->pk_info == NULL) {
487 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
488 }
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200489
Gilles Peskine449bd832023-01-11 14:50:10 +0100490 if (!mbedtls_pk_can_do(ctx, type)) {
491 return MBEDTLS_ERR_PK_TYPE_MISMATCH;
492 }
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200493
Gilles Peskine449bd832023-01-11 14:50:10 +0100494 if (type != MBEDTLS_PK_RSASSA_PSS) {
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500495 /* General case: no options */
Gilles Peskine449bd832023-01-11 14:50:10 +0100496 if (options != NULL) {
497 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
498 }
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500499
Gilles Peskine449bd832023-01-11 14:50:10 +0100500 return mbedtls_pk_verify(ctx, md_alg, hash, hash_len, sig, sig_len);
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500501 }
502
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200503#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21)
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500504 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
505 const mbedtls_pk_rsassa_pss_options *pss_opts;
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200506
Gilles Peskine449bd832023-01-11 14:50:10 +0100507 if (md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len) {
508 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
509 }
Andres AG72849872017-01-19 11:24:33 +0000510
Gilles Peskine449bd832023-01-11 14:50:10 +0100511 if (options == NULL) {
512 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
513 }
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200514
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500515 pss_opts = (const mbedtls_pk_rsassa_pss_options *) options;
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200516
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500517#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100518 if (pss_opts->mgf1_hash_id == md_alg) {
Manuel Pégourié-Gonnard4dacf582022-06-10 12:50:00 +0200519 unsigned char buf[MBEDTLS_PK_RSA_PUB_DER_MAX_BYTES];
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500520 unsigned char *p;
Andrzej Kurek59550532022-02-16 07:46:42 -0500521 int key_len;
522 size_t signature_length;
Andrzej Kurekd70fa0e2022-02-17 10:51:15 -0500523 psa_status_t status = PSA_ERROR_DATA_CORRUPT;
524 psa_status_t destruction_status = PSA_ERROR_DATA_CORRUPT;
Andrzej Kurek59550532022-02-16 07:46:42 -0500525
Gilles Peskine449bd832023-01-11 14:50:10 +0100526 psa_algorithm_t psa_md_alg = mbedtls_hash_info_psa_from_md(md_alg);
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500527 mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
528 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +0100529 psa_algorithm_t psa_sig_alg = PSA_ALG_RSA_PSS_ANY_SALT(psa_md_alg);
530 p = buf + sizeof(buf);
531 key_len = mbedtls_pk_write_pubkey(&p, buf, ctx);
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500532
Gilles Peskine449bd832023-01-11 14:50:10 +0100533 if (key_len < 0) {
534 return key_len;
535 }
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500536
Gilles Peskine449bd832023-01-11 14:50:10 +0100537 psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_PUBLIC_KEY);
538 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_VERIFY_HASH);
539 psa_set_key_algorithm(&attributes, psa_sig_alg);
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500540
Gilles Peskine449bd832023-01-11 14:50:10 +0100541 status = psa_import_key(&attributes,
542 buf + sizeof(buf) - key_len, key_len,
543 &key_id);
544 if (status != PSA_SUCCESS) {
545 psa_destroy_key(key_id);
Andrzej Kurek8a045ce2022-12-23 11:00:06 -0500546 return PSA_PK_TO_MBEDTLS_ERR(status);
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500547 }
548
Andrzej Kurek4a953cd2022-02-16 06:13:35 -0500549 /* This function requires returning MBEDTLS_ERR_PK_SIG_LEN_MISMATCH
550 * on a valid signature with trailing data in a buffer, but
551 * mbedtls_psa_rsa_verify_hash requires the sig_len to be exact,
552 * so for this reason the passed sig_len is overwritten. Smaller
553 * signature lengths should not be accepted for verification. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100554 signature_length = sig_len > mbedtls_pk_get_len(ctx) ?
555 mbedtls_pk_get_len(ctx) : sig_len;
556 status = psa_verify_hash(key_id, psa_sig_alg, hash,
557 hash_len, sig, signature_length);
558 destruction_status = psa_destroy_key(key_id);
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500559
Gilles Peskine449bd832023-01-11 14:50:10 +0100560 if (status == PSA_SUCCESS && sig_len > mbedtls_pk_get_len(ctx)) {
561 return MBEDTLS_ERR_PK_SIG_LEN_MISMATCH;
562 }
Andrzej Kurek8666df62022-02-15 08:23:02 -0500563
Gilles Peskine449bd832023-01-11 14:50:10 +0100564 if (status == PSA_SUCCESS) {
Andrzej Kurekd70fa0e2022-02-17 10:51:15 -0500565 status = destruction_status;
Gilles Peskine449bd832023-01-11 14:50:10 +0100566 }
Andrzej Kurekd70fa0e2022-02-17 10:51:15 -0500567
Andrzej Kurek8a045ce2022-12-23 11:00:06 -0500568 return PSA_PK_RSA_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +0100569 } else
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500570#endif
571 {
Gilles Peskine449bd832023-01-11 14:50:10 +0100572 if (sig_len < mbedtls_pk_get_len(ctx)) {
573 return MBEDTLS_ERR_RSA_VERIFY_FAILED;
574 }
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200575
Gilles Peskine449bd832023-01-11 14:50:10 +0100576 ret = mbedtls_rsa_rsassa_pss_verify_ext(mbedtls_pk_rsa(*ctx),
577 md_alg, (unsigned int) hash_len, hash,
578 pss_opts->mgf1_hash_id,
579 pss_opts->expected_salt_len,
580 sig);
581 if (ret != 0) {
582 return ret;
583 }
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200584
Gilles Peskine449bd832023-01-11 14:50:10 +0100585 if (sig_len > mbedtls_pk_get_len(ctx)) {
586 return MBEDTLS_ERR_PK_SIG_LEN_MISMATCH;
587 }
Andrzej Kurek90ba2cb2022-02-15 08:18:44 -0500588
Gilles Peskine449bd832023-01-11 14:50:10 +0100589 return 0;
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200590 }
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500591#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100592 return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
Andrzej Kurek7db1b782022-02-09 14:13:44 -0500593#endif /* MBEDTLS_RSA_C && MBEDTLS_PKCS1_V21 */
Manuel Pégourié-Gonnard20422e92014-06-05 13:41:44 +0200594}
595
596/*
Manuel Pégourié-Gonnard82cb27b2017-05-03 10:59:45 +0200597 * Make a signature (restartable)
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200598 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100599int mbedtls_pk_sign_restartable(mbedtls_pk_context *ctx,
600 mbedtls_md_type_t md_alg,
601 const unsigned char *hash, size_t hash_len,
602 unsigned char *sig, size_t sig_size, size_t *sig_len,
603 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
604 mbedtls_pk_restart_ctx *rs_ctx)
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200605{
Gilles Peskine449bd832023-01-11 14:50:10 +0100606 if ((md_alg != MBEDTLS_MD_NONE || hash_len != 0) && hash == NULL) {
Tuvshinzaya Erdenekhuu78c1d8c2022-07-29 14:51:50 +0100607 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
Gilles Peskine449bd832023-01-11 14:50:10 +0100608 }
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500609
Gilles Peskine449bd832023-01-11 14:50:10 +0100610 if (ctx->pk_info == NULL || pk_hashlen_helper(md_alg, &hash_len) != 0) {
611 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
612 }
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200613
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200614#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnardd55f7762017-08-18 17:40:15 +0200615 /* optimization: use non-restartable version if restart disabled */
Gilles Peskine449bd832023-01-11 14:50:10 +0100616 if (rs_ctx != NULL &&
Manuel Pégourié-Gonnardb843b152018-10-16 10:41:31 +0200617 mbedtls_ecp_restart_is_enabled() &&
Gilles Peskine449bd832023-01-11 14:50:10 +0100618 ctx->pk_info->sign_rs_func != NULL) {
Janos Follath24eed8d2019-11-22 13:21:35 +0000619 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200620
Gilles Peskine449bd832023-01-11 14:50:10 +0100621 if ((ret = pk_restart_setup(rs_ctx, ctx->pk_info)) != 0) {
622 return ret;
623 }
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200624
valerio38992cb2023-04-20 09:56:30 +0200625 ret = ctx->pk_info->sign_rs_func(ctx, md_alg,
Gilles Peskine449bd832023-01-11 14:50:10 +0100626 hash, hash_len,
627 sig, sig_size, sig_len,
628 f_rng, p_rng, rs_ctx->rs_ctx);
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200629
Gilles Peskine449bd832023-01-11 14:50:10 +0100630 if (ret != MBEDTLS_ERR_ECP_IN_PROGRESS) {
631 mbedtls_pk_restart_free(rs_ctx);
632 }
Manuel Pégourié-Gonnard0bbc66c2017-08-18 16:22:06 +0200633
Gilles Peskine449bd832023-01-11 14:50:10 +0100634 return ret;
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200635 }
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200636#else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200637 (void) rs_ctx;
Manuel Pégourié-Gonnardaaa98142017-08-18 17:30:37 +0200638#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
Manuel Pégourié-Gonnard1f596062017-05-09 10:42:40 +0200639
Gilles Peskine449bd832023-01-11 14:50:10 +0100640 if (ctx->pk_info->sign_func == NULL) {
641 return MBEDTLS_ERR_PK_TYPE_MISMATCH;
642 }
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200643
valerio38992cb2023-04-20 09:56:30 +0200644 return ctx->pk_info->sign_func(ctx, md_alg,
Gilles Peskine449bd832023-01-11 14:50:10 +0100645 hash, hash_len,
646 sig, sig_size, sig_len,
647 f_rng, p_rng);
Manuel Pégourié-Gonnard8df27692013-08-21 10:34:38 +0200648}
649
650/*
Manuel Pégourié-Gonnard82cb27b2017-05-03 10:59:45 +0200651 * Make a signature
652 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100653int mbedtls_pk_sign(mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg,
654 const unsigned char *hash, size_t hash_len,
655 unsigned char *sig, size_t sig_size, size_t *sig_len,
656 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Manuel Pégourié-Gonnard82cb27b2017-05-03 10:59:45 +0200657{
Gilles Peskine449bd832023-01-11 14:50:10 +0100658 return mbedtls_pk_sign_restartable(ctx, md_alg, hash, hash_len,
659 sig, sig_size, sig_len,
660 f_rng, p_rng, NULL);
Manuel Pégourié-Gonnard82cb27b2017-05-03 10:59:45 +0200661}
662
Jerry Yu1d172a32022-03-12 19:12:05 +0800663#if defined(MBEDTLS_PSA_CRYPTO_C)
Manuel Pégourié-Gonnard82cb27b2017-05-03 10:59:45 +0200664/*
Jerry Yufb0621d2022-03-23 11:42:06 +0800665 * Make a signature given a signature type.
Jerry Yud69439a2022-02-24 15:52:15 +0800666 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100667int mbedtls_pk_sign_ext(mbedtls_pk_type_t pk_type,
668 mbedtls_pk_context *ctx,
669 mbedtls_md_type_t md_alg,
670 const unsigned char *hash, size_t hash_len,
671 unsigned char *sig, size_t sig_size, size_t *sig_len,
672 int (*f_rng)(void *, unsigned char *, size_t),
673 void *p_rng)
Jerry Yud69439a2022-02-24 15:52:15 +0800674{
Jerry Yufb0621d2022-03-23 11:42:06 +0800675#if defined(MBEDTLS_RSA_C)
676 psa_algorithm_t psa_md_alg;
677#endif /* MBEDTLS_RSA_C */
Jerry Yud69439a2022-02-24 15:52:15 +0800678 *sig_len = 0;
Jerry Yu1d172a32022-03-12 19:12:05 +0800679
Gilles Peskine449bd832023-01-11 14:50:10 +0100680 if (ctx->pk_info == NULL) {
681 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
682 }
Jerry Yud69439a2022-02-24 15:52:15 +0800683
Gilles Peskine449bd832023-01-11 14:50:10 +0100684 if (!mbedtls_pk_can_do(ctx, pk_type)) {
685 return MBEDTLS_ERR_PK_TYPE_MISMATCH;
686 }
Jerry Yud69439a2022-02-24 15:52:15 +0800687
Gilles Peskine449bd832023-01-11 14:50:10 +0100688 if (pk_type != MBEDTLS_PK_RSASSA_PSS) {
689 return mbedtls_pk_sign(ctx, md_alg, hash, hash_len,
690 sig, sig_size, sig_len, f_rng, p_rng);
Jerry Yud69439a2022-02-24 15:52:15 +0800691 }
Neil Armstrong13e76be2022-04-21 12:08:52 +0200692
Jerry Yu89107d12022-03-22 14:20:15 +0800693#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100694 psa_md_alg = mbedtls_hash_info_psa_from_md(md_alg);
695 if (psa_md_alg == 0) {
696 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
697 }
Neil Armstrong13e76be2022-04-21 12:08:52 +0200698
Gilles Peskine449bd832023-01-11 14:50:10 +0100699 if (mbedtls_pk_get_type(ctx) == MBEDTLS_PK_OPAQUE) {
Neil Armstrong13e76be2022-04-21 12:08:52 +0200700 psa_status_t status;
701
Valerio Setti048cd442023-04-28 15:26:11 +0200702 status = psa_sign_hash(ctx->opaque_id, PSA_ALG_RSA_PSS(psa_md_alg),
Gilles Peskine449bd832023-01-11 14:50:10 +0100703 hash, hash_len,
704 sig, sig_size, sig_len);
Andrzej Kurek8a045ce2022-12-23 11:00:06 -0500705 return PSA_PK_RSA_TO_MBEDTLS_ERR(status);
Neil Armstrong13e76be2022-04-21 12:08:52 +0200706 }
707
Gilles Peskine449bd832023-01-11 14:50:10 +0100708 return mbedtls_pk_psa_rsa_sign_ext(PSA_ALG_RSA_PSS(psa_md_alg),
709 ctx->pk_ctx, hash, hash_len,
710 sig, sig_size, sig_len);
Jerry Yu89107d12022-03-22 14:20:15 +0800711#else /* MBEDTLS_RSA_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100712 return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
Jerry Yu89107d12022-03-22 14:20:15 +0800713#endif /* !MBEDTLS_RSA_C */
Jerry Yud69439a2022-02-24 15:52:15 +0800714
715}
Jerry Yu1d172a32022-03-12 19:12:05 +0800716#endif /* MBEDTLS_PSA_CRYPTO_C */
Jerry Yud69439a2022-02-24 15:52:15 +0800717
718/*
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200719 * Decrypt message
720 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100721int mbedtls_pk_decrypt(mbedtls_pk_context *ctx,
722 const unsigned char *input, size_t ilen,
723 unsigned char *output, size_t *olen, size_t osize,
724 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200725{
Gilles Peskine449bd832023-01-11 14:50:10 +0100726 if (ctx->pk_info == NULL) {
727 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
728 }
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200729
Gilles Peskine449bd832023-01-11 14:50:10 +0100730 if (ctx->pk_info->decrypt_func == NULL) {
731 return MBEDTLS_ERR_PK_TYPE_MISMATCH;
732 }
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200733
valerio38992cb2023-04-20 09:56:30 +0200734 return ctx->pk_info->decrypt_func(ctx, input, ilen,
Gilles Peskine449bd832023-01-11 14:50:10 +0100735 output, olen, osize, f_rng, p_rng);
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200736}
737
738/*
739 * Encrypt message
740 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100741int mbedtls_pk_encrypt(mbedtls_pk_context *ctx,
742 const unsigned char *input, size_t ilen,
743 unsigned char *output, size_t *olen, size_t osize,
744 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200745{
Gilles Peskine449bd832023-01-11 14:50:10 +0100746 if (ctx->pk_info == NULL) {
747 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
748 }
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200749
Gilles Peskine449bd832023-01-11 14:50:10 +0100750 if (ctx->pk_info->encrypt_func == NULL) {
751 return MBEDTLS_ERR_PK_TYPE_MISMATCH;
752 }
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200753
valerio38992cb2023-04-20 09:56:30 +0200754 return ctx->pk_info->encrypt_func(ctx, input, ilen,
Gilles Peskine449bd832023-01-11 14:50:10 +0100755 output, olen, osize, f_rng, p_rng);
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +0200756}
757
758/*
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100759 * Check public-private key pair
760 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100761int mbedtls_pk_check_pair(const mbedtls_pk_context *pub,
762 const mbedtls_pk_context *prv,
763 int (*f_rng)(void *, unsigned char *, size_t),
764 void *p_rng)
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100765{
Gilles Peskine449bd832023-01-11 14:50:10 +0100766 if (pub->pk_info == NULL ||
767 prv->pk_info == NULL) {
768 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100769 }
770
Gilles Peskine449bd832023-01-11 14:50:10 +0100771 if (f_rng == NULL) {
772 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100773 }
774
Gilles Peskine449bd832023-01-11 14:50:10 +0100775 if (prv->pk_info->check_pair_func == NULL) {
776 return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
777 }
778
779 if (prv->pk_info->type == MBEDTLS_PK_RSA_ALT) {
780 if (pub->pk_info->type != MBEDTLS_PK_RSA) {
781 return MBEDTLS_ERR_PK_TYPE_MISMATCH;
782 }
783 } else {
784 if (pub->pk_info != prv->pk_info) {
785 return MBEDTLS_ERR_PK_TYPE_MISMATCH;
786 }
787 }
788
valerio38992cb2023-04-20 09:56:30 +0200789 return prv->pk_info->check_pair_func((mbedtls_pk_context *) pub,
790 (mbedtls_pk_context *) prv,
791 f_rng, p_rng);
Manuel Pégourié-Gonnard70bdadf2014-11-06 16:51:20 +0100792}
793
794/*
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200795 * Get key size in bits
796 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100797size_t mbedtls_pk_get_bitlen(const mbedtls_pk_context *ctx)
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200798{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500799 /* For backward compatibility, accept NULL or a context that
800 * isn't set up yet, and return a fake value that should be safe. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100801 if (ctx == NULL || ctx->pk_info == NULL) {
802 return 0;
803 }
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200804
valerio38992cb2023-04-20 09:56:30 +0200805 return ctx->pk_info->get_bitlen((mbedtls_pk_context *) ctx);
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +0200806}
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200807
808/*
809 * Export debug information
810 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100811int mbedtls_pk_debug(const mbedtls_pk_context *ctx, mbedtls_pk_debug_item *items)
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200812{
Gilles Peskine449bd832023-01-11 14:50:10 +0100813 if (ctx->pk_info == NULL) {
814 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
815 }
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200816
Gilles Peskine449bd832023-01-11 14:50:10 +0100817 if (ctx->pk_info->debug_func == NULL) {
818 return MBEDTLS_ERR_PK_TYPE_MISMATCH;
819 }
Manuel Pégourié-Gonnard01488752014-04-03 22:09:18 +0200820
valerio38992cb2023-04-20 09:56:30 +0200821 ctx->pk_info->debug_func((mbedtls_pk_context *) ctx, items);
Gilles Peskine449bd832023-01-11 14:50:10 +0100822 return 0;
Manuel Pégourié-Gonnardc6ac8872013-08-14 18:04:18 +0200823}
Manuel Pégourié-Gonnard3fb5c5e2013-08-14 18:26:41 +0200824
825/*
826 * Access the PK type name
827 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100828const char *mbedtls_pk_get_name(const mbedtls_pk_context *ctx)
Manuel Pégourié-Gonnard3fb5c5e2013-08-14 18:26:41 +0200829{
Gilles Peskine449bd832023-01-11 14:50:10 +0100830 if (ctx == NULL || ctx->pk_info == NULL) {
831 return "invalid PK";
832 }
Manuel Pégourié-Gonnard3fb5c5e2013-08-14 18:26:41 +0200833
Gilles Peskine449bd832023-01-11 14:50:10 +0100834 return ctx->pk_info->name;
Manuel Pégourié-Gonnard3fb5c5e2013-08-14 18:26:41 +0200835}
Manuel Pégourié-Gonnardc40b4c32013-08-22 13:29:31 +0200836
Manuel Pégourié-Gonnard8053da42013-09-11 22:28:30 +0200837/*
838 * Access the PK type
839 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100840mbedtls_pk_type_t mbedtls_pk_get_type(const mbedtls_pk_context *ctx)
Manuel Pégourié-Gonnard8053da42013-09-11 22:28:30 +0200841{
Gilles Peskine449bd832023-01-11 14:50:10 +0100842 if (ctx == NULL || ctx->pk_info == NULL) {
843 return MBEDTLS_PK_NONE;
844 }
Manuel Pégourié-Gonnard8053da42013-09-11 22:28:30 +0200845
Gilles Peskine449bd832023-01-11 14:50:10 +0100846 return ctx->pk_info->type;
Manuel Pégourié-Gonnard8053da42013-09-11 22:28:30 +0200847}
848
Manuel Pégourié-Gonnard347a00e2018-11-19 12:25:37 +0100849#if defined(MBEDTLS_USE_PSA_CRYPTO)
850/*
851 * Load the key to a PSA key slot,
852 * then turn the PK context into a wrapper for that key slot.
853 *
Neil Armstrong56e71d42022-04-08 15:12:42 +0200854 * Currently only works for EC & RSA private keys.
Manuel Pégourié-Gonnard347a00e2018-11-19 12:25:37 +0100855 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100856int mbedtls_pk_wrap_as_opaque(mbedtls_pk_context *pk,
857 mbedtls_svc_key_id_t *key,
858 psa_algorithm_t alg,
859 psa_key_usage_t usage,
860 psa_algorithm_t alg2)
Manuel Pégourié-Gonnard347a00e2018-11-19 12:25:37 +0100861{
Valerio Setti0d2980f2023-04-05 18:17:13 +0200862#if !defined(MBEDTLS_ECP_LIGHT) && !defined(MBEDTLS_RSA_C)
John Durkopf35069a2020-08-17 22:05:14 -0700863 ((void) pk);
Ronald Croncf56a0a2020-08-04 09:51:30 +0200864 ((void) key);
Neil Armstronga1fc18f2022-04-22 13:57:14 +0200865 ((void) alg);
866 ((void) usage);
867 ((void) alg2);
Valerio Setti0d2980f2023-04-05 18:17:13 +0200868#else /* !MBEDTLS_ECP_LIGHT && !MBEDTLS_RSA_C */
869#if defined(MBEDTLS_ECP_LIGHT)
Gilles Peskine449bd832023-01-11 14:50:10 +0100870 if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_ECKEY) {
Jethro Beekman33a3ccd2023-05-03 18:25:27 +0200871 mbedtls_ecp_keypair *ec;
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100872 unsigned char d[MBEDTLS_ECP_MAX_BYTES];
873 size_t d_len;
874 psa_ecc_family_t curve_id;
875 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
876 psa_key_type_t key_type;
877 size_t bits;
878 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Neil Armstrongc1152e42022-03-22 10:29:06 +0100879 psa_status_t status;
Manuel Pégourié-Gonnard347a00e2018-11-19 12:25:37 +0100880
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100881 /* export the private key material in the format PSA wants */
Gilles Peskine449bd832023-01-11 14:50:10 +0100882 ec = mbedtls_pk_ec(*pk);
883 d_len = PSA_BITS_TO_BYTES(ec->grp.nbits);
Jethro Beekman33a3ccd2023-05-03 18:25:27 +0200884 if ((ret = mbedtls_ecp_write_key(ec, d, d_len)) != 0) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100885 return ret;
886 }
Manuel Pégourié-Gonnard347a00e2018-11-19 12:25:37 +0100887
Gilles Peskine449bd832023-01-11 14:50:10 +0100888 curve_id = mbedtls_ecc_group_to_psa(ec->grp.id, &bits);
889 key_type = PSA_KEY_TYPE_ECC_KEY_PAIR(curve_id);
Manuel Pégourié-Gonnard347a00e2018-11-19 12:25:37 +0100890
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100891 /* prepare the key attributes */
Gilles Peskine449bd832023-01-11 14:50:10 +0100892 psa_set_key_type(&attributes, key_type);
893 psa_set_key_bits(&attributes, bits);
894 psa_set_key_usage_flags(&attributes, usage);
895 psa_set_key_algorithm(&attributes, alg);
896 if (alg2 != PSA_ALG_NONE) {
897 psa_set_key_enrollment_algorithm(&attributes, alg2);
898 }
Manuel Pégourié-Gonnard347a00e2018-11-19 12:25:37 +0100899
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100900 /* import private key into PSA */
Gilles Peskine449bd832023-01-11 14:50:10 +0100901 status = psa_import_key(&attributes, d, d_len, key);
Valerio Setti2d814992023-04-27 10:05:03 +0200902 mbedtls_platform_zeroize(d, sizeof(d));
Gilles Peskine449bd832023-01-11 14:50:10 +0100903 if (status != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -0500904 return PSA_PK_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +0100905 }
Manuel Pégourié-Gonnard347a00e2018-11-19 12:25:37 +0100906
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100907 /* make PK context wrap the key slot */
Gilles Peskine449bd832023-01-11 14:50:10 +0100908 mbedtls_pk_free(pk);
909 mbedtls_pk_init(pk);
Manuel Pégourié-Gonnard347a00e2018-11-19 12:25:37 +0100910
Gilles Peskine449bd832023-01-11 14:50:10 +0100911 return mbedtls_pk_setup_opaque(pk, *key);
912 } else
Valerio Setti0d2980f2023-04-05 18:17:13 +0200913#endif /* MBEDTLS_ECP_LIGHT */
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100914#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100915 if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_RSA) {
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100916 unsigned char buf[MBEDTLS_PK_RSA_PRV_DER_MAX_BYTES];
917 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
918 int key_len;
919 psa_status_t status;
920
921 /* export the private key material in the format PSA wants */
Gilles Peskine449bd832023-01-11 14:50:10 +0100922 key_len = mbedtls_pk_write_key_der(pk, buf, sizeof(buf));
923 if (key_len <= 0) {
924 return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
925 }
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100926
927 /* prepare the key attributes */
Gilles Peskine449bd832023-01-11 14:50:10 +0100928 psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR);
929 psa_set_key_bits(&attributes, mbedtls_pk_get_bitlen(pk));
930 psa_set_key_usage_flags(&attributes, usage);
931 psa_set_key_algorithm(&attributes, alg);
932 if (alg2 != PSA_ALG_NONE) {
933 psa_set_key_enrollment_algorithm(&attributes, alg2);
934 }
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100935
936 /* import private key into PSA */
Gilles Peskine449bd832023-01-11 14:50:10 +0100937 status = psa_import_key(&attributes,
938 buf + sizeof(buf) - key_len,
939 key_len, key);
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100940
Gilles Peskine449bd832023-01-11 14:50:10 +0100941 mbedtls_platform_zeroize(buf, sizeof(buf));
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100942
Gilles Peskine449bd832023-01-11 14:50:10 +0100943 if (status != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -0500944 return PSA_PK_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +0100945 }
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100946
947 /* make PK context wrap the key slot */
Gilles Peskine449bd832023-01-11 14:50:10 +0100948 mbedtls_pk_free(pk);
949 mbedtls_pk_init(pk);
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100950
Gilles Peskine449bd832023-01-11 14:50:10 +0100951 return mbedtls_pk_setup_opaque(pk, *key);
952 } else
Neil Armstrongca5b55f2022-03-15 15:00:55 +0100953#endif /* MBEDTLS_RSA_C */
Valerio Setti0d2980f2023-04-05 18:17:13 +0200954#endif /* !MBEDTLS_ECP_LIGHT && !MBEDTLS_RSA_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100955 return MBEDTLS_ERR_PK_TYPE_MISMATCH;
Manuel Pégourié-Gonnard347a00e2018-11-19 12:25:37 +0100956}
957#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200958#endif /* MBEDTLS_PK_C */