Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 1 | /* |
| 2 | * PSA crypto layer on top of Mbed TLS crypto |
| 3 | */ |
Bence Szépkúti | 8697465 | 2020-06-15 11:59:37 +0200 | [diff] [blame] | 4 | /* |
Bence Szépkúti | 1e14827 | 2020-08-07 13:07:28 +0200 | [diff] [blame] | 5 | * Copyright The Mbed TLS Contributors |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 6 | * SPDX-License-Identifier: Apache-2.0 |
| 7 | * |
| 8 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 9 | * not use this file except in compliance with the License. |
| 10 | * You may obtain a copy of the License at |
| 11 | * |
| 12 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 13 | * |
| 14 | * Unless required by applicable law or agreed to in writing, software |
| 15 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 16 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 17 | * See the License for the specific language governing permissions and |
| 18 | * limitations under the License. |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 19 | */ |
| 20 | |
Gilles Peskine | db09ef6 | 2020-06-03 01:43:33 +0200 | [diff] [blame] | 21 | #include "common.h" |
Ronald Cron | afbc7ed | 2023-01-24 16:02:04 +0100 | [diff] [blame] | 22 | #include "psa_crypto_core_common.h" |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 23 | |
| 24 | #if defined(MBEDTLS_PSA_CRYPTO_C) |
mohammad1603 | 2701005 | 2018-07-03 13:16:15 +0300 | [diff] [blame] | 25 | |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 26 | #if defined(MBEDTLS_PSA_CRYPTO_CONFIG) |
| 27 | #include "check_crypto_config.h" |
| 28 | #endif |
| 29 | |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 30 | #include "psa/crypto.h" |
Przemyslaw Stekiel | 705fb0f | 2021-11-24 08:47:29 +0100 | [diff] [blame] | 31 | #include "psa/crypto_values.h" |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 32 | |
Ronald Cron | d6d2888 | 2020-12-14 14:56:02 +0100 | [diff] [blame] | 33 | #include "psa_crypto_cipher.h" |
Gilles Peskine | 039b90c | 2018-12-07 18:24:41 +0100 | [diff] [blame] | 34 | #include "psa_crypto_core.h" |
Gilles Peskine | 5e76952 | 2018-11-20 21:59:56 +0100 | [diff] [blame] | 35 | #include "psa_crypto_invasive.h" |
Steven Cooreman | cd84cb4 | 2020-07-16 20:28:36 +0200 | [diff] [blame] | 36 | #include "psa_crypto_driver_wrappers.h" |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 37 | #include "psa_crypto_ecp.h" |
Przemek Stekiel | 359f462 | 2022-12-05 14:11:55 +0100 | [diff] [blame] | 38 | #include "psa_crypto_ffdh.h" |
Steven Cooreman | 5f88e77 | 2021-03-15 11:07:12 +0100 | [diff] [blame] | 39 | #include "psa_crypto_hash.h" |
Steven Cooreman | 82c66b6 | 2021-03-19 17:39:17 +0100 | [diff] [blame] | 40 | #include "psa_crypto_mac.h" |
Ronald Cron | 00b7bfc | 2020-11-25 15:25:26 +0100 | [diff] [blame] | 41 | #include "psa_crypto_rsa.h" |
Ronald Cron | 7023db5 | 2020-11-20 18:17:42 +0100 | [diff] [blame] | 42 | #include "psa_crypto_ecp.h" |
Gilles Peskine | a8ade16 | 2019-06-26 11:24:49 +0200 | [diff] [blame] | 43 | #if defined(MBEDTLS_PSA_CRYPTO_SE_C) |
Gilles Peskine | d089021 | 2019-06-24 14:34:43 +0200 | [diff] [blame] | 44 | #include "psa_crypto_se.h" |
Gilles Peskine | a8ade16 | 2019-06-26 11:24:49 +0200 | [diff] [blame] | 45 | #endif |
Gilles Peskine | 961849f | 2018-11-30 18:54:54 +0100 | [diff] [blame] | 46 | #include "psa_crypto_slot_management.h" |
Darryl Green | d49a499 | 2018-06-18 17:27:26 +0100 | [diff] [blame] | 47 | /* Include internal declarations that are useful for implementing persistently |
| 48 | * stored keys. */ |
| 49 | #include "psa_crypto_storage.h" |
| 50 | |
Gilles Peskine | b2b64d3 | 2020-12-14 16:43:58 +0100 | [diff] [blame] | 51 | #include "psa_crypto_random_impl.h" |
Gilles Peskine | 90edc99 | 2020-11-13 15:39:19 +0100 | [diff] [blame] | 52 | |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 53 | #include <stdlib.h> |
| 54 | #include <string.h> |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 55 | #include "mbedtls/platform.h" |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 56 | |
Gilles Peskine | 1c49f1a | 2020-11-13 18:46:25 +0100 | [diff] [blame] | 57 | #include "mbedtls/aes.h" |
Gilles Peskine | 9a94480 | 2018-06-21 09:35:35 +0200 | [diff] [blame] | 58 | #include "mbedtls/asn1.h" |
Jaeden Amero | 25384a2 | 2019-01-10 10:23:21 +0000 | [diff] [blame] | 59 | #include "mbedtls/asn1write.h" |
Gilles Peskine | a81d85b | 2018-06-26 16:10:23 +0200 | [diff] [blame] | 60 | #include "mbedtls/bignum.h" |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 61 | #include "mbedtls/camellia.h" |
Gilles Peskine | 26869f2 | 2019-05-06 15:25:00 +0200 | [diff] [blame] | 62 | #include "mbedtls/chacha20.h" |
| 63 | #include "mbedtls/chachapoly.h" |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 64 | #include "mbedtls/cipher.h" |
| 65 | #include "mbedtls/ccm.h" |
| 66 | #include "mbedtls/cmac.h" |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 67 | #include "mbedtls/des.h" |
Gilles Peskine | b7ecdf0 | 2018-09-18 12:11:27 +0200 | [diff] [blame] | 68 | #include "mbedtls/ecdh.h" |
Gilles Peskine | 969ac72 | 2018-01-28 18:16:59 +0100 | [diff] [blame] | 69 | #include "mbedtls/ecp.h" |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 70 | #include "mbedtls/entropy.h" |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 71 | #include "mbedtls/error.h" |
| 72 | #include "mbedtls/gcm.h" |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 73 | #include "mbedtls/md5.h" |
Gilles Peskine | 20035e3 | 2018-02-03 22:44:14 +0100 | [diff] [blame] | 74 | #include "mbedtls/md.h" |
Chris Jones | daacb59 | 2021-03-09 17:03:29 +0000 | [diff] [blame] | 75 | #include "md_wrap.h" |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 76 | #include "mbedtls/pk.h" |
Chris Jones | daacb59 | 2021-03-09 17:03:29 +0000 | [diff] [blame] | 77 | #include "pk_wrap.h" |
Gilles Peskine | 3f10812 | 2018-12-07 18:14:53 +0100 | [diff] [blame] | 78 | #include "mbedtls/platform_util.h" |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 79 | #include "mbedtls/error.h" |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 80 | #include "mbedtls/ripemd160.h" |
Gilles Peskine | 969ac72 | 2018-01-28 18:16:59 +0100 | [diff] [blame] | 81 | #include "mbedtls/rsa.h" |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 82 | #include "mbedtls/sha1.h" |
| 83 | #include "mbedtls/sha256.h" |
| 84 | #include "mbedtls/sha512.h" |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 85 | #include "hash_info.h" |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 86 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 87 | #define ARRAY_LENGTH(array) (sizeof(array) / sizeof(*(array))) |
Gilles Peskine | 996deb1 | 2018-08-01 15:45:45 +0200 | [diff] [blame] | 88 | |
Przemek Stekiel | 75fe3fb | 2022-06-09 14:44:55 +0200 | [diff] [blame] | 89 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \ |
| 90 | defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \ |
| 91 | defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 92 | #define BUILTIN_ALG_ANY_HKDF 1 |
Przemek Stekiel | 75fe3fb | 2022-06-09 14:44:55 +0200 | [diff] [blame] | 93 | #endif |
| 94 | |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 95 | /****************************************************************/ |
| 96 | /* Global data, support functions and library management */ |
| 97 | /****************************************************************/ |
| 98 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 99 | static int key_type_is_raw_bytes(psa_key_type_t type) |
Gilles Peskine | 48c0ea1 | 2018-06-21 14:15:31 +0200 | [diff] [blame] | 100 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 101 | return PSA_KEY_TYPE_IS_UNSTRUCTURED(type); |
Gilles Peskine | 48c0ea1 | 2018-06-21 14:15:31 +0200 | [diff] [blame] | 102 | } |
| 103 | |
Gilles Peskine | 5a3c50e | 2018-12-04 12:27:09 +0100 | [diff] [blame] | 104 | /* Values for psa_global_data_t::rng_state */ |
| 105 | #define RNG_NOT_INITIALIZED 0 |
| 106 | #define RNG_INITIALIZED 1 |
| 107 | #define RNG_SEEDED 2 |
Gilles Peskine | c6b6907 | 2018-11-20 21:42:52 +0100 | [diff] [blame] | 108 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 109 | typedef struct { |
Gilles Peskine | c6b6907 | 2018-11-20 21:42:52 +0100 | [diff] [blame] | 110 | unsigned initialized : 1; |
Gilles Peskine | 5a3c50e | 2018-12-04 12:27:09 +0100 | [diff] [blame] | 111 | unsigned rng_state : 2; |
Manuel Pégourié-Gonnard | 7abdf7e | 2023-03-09 11:17:43 +0100 | [diff] [blame] | 112 | unsigned drivers_initialized : 1; |
Gilles Peskine | 2d8a182 | 2021-11-08 22:20:03 +0100 | [diff] [blame] | 113 | mbedtls_psa_random_context_t rng; |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 114 | } psa_global_data_t; |
| 115 | |
| 116 | static psa_global_data_t global_data; |
| 117 | |
Gilles Peskine | 5894e8e | 2020-12-14 14:54:06 +0100 | [diff] [blame] | 118 | #if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) |
| 119 | mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state = |
| 120 | &global_data.rng.drbg; |
| 121 | #endif |
| 122 | |
itayzafrir | 0adf0fc | 2018-09-06 16:24:41 +0300 | [diff] [blame] | 123 | #define GUARD_MODULE_INITIALIZED \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 124 | if (global_data.initialized == 0) \ |
| 125 | return PSA_ERROR_BAD_STATE; |
itayzafrir | 0adf0fc | 2018-09-06 16:24:41 +0300 | [diff] [blame] | 126 | |
Manuel Pégourié-Gonnard | 7abdf7e | 2023-03-09 11:17:43 +0100 | [diff] [blame] | 127 | int psa_can_do_hash(psa_algorithm_t hash_alg) |
| 128 | { |
| 129 | (void) hash_alg; |
| 130 | return global_data.drivers_initialized; |
| 131 | } |
Przemek Stekiel | 134cc2e | 2023-05-05 10:13:37 +0200 | [diff] [blame] | 132 | static int psa_is_dh_key_size_valid(size_t bits) |
| 133 | { |
Przemek Stekiel | d1cf1ba | 2023-04-27 12:04:21 +0200 | [diff] [blame] | 134 | if (bits != 2048 && bits != 3072 && bits != 4096 && |
| 135 | bits != 6144 && bits != 8192) { |
| 136 | return 0; |
| 137 | } |
| 138 | |
| 139 | return 1; |
| 140 | } |
Manuel Pégourié-Gonnard | 7abdf7e | 2023-03-09 11:17:43 +0100 | [diff] [blame] | 141 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 142 | psa_status_t mbedtls_to_psa_error(int ret) |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 143 | { |
Gilles Peskine | dbf6896 | 2021-01-06 20:04:23 +0100 | [diff] [blame] | 144 | /* Mbed TLS error codes can combine a high-level error code and a |
| 145 | * low-level error code. The low-level error usually reflects the |
| 146 | * root cause better, so dispatch on that preferably. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 147 | int low_level_ret = -(-ret & 0x007f); |
| 148 | switch (low_level_ret != 0 ? low_level_ret : ret) { |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 149 | case 0: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 150 | return PSA_SUCCESS; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 151 | |
| 152 | case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH: |
| 153 | case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 154 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | 9a94480 | 2018-06-21 09:35:35 +0200 | [diff] [blame] | 155 | case MBEDTLS_ERR_ASN1_OUT_OF_DATA: |
| 156 | case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG: |
| 157 | case MBEDTLS_ERR_ASN1_INVALID_LENGTH: |
| 158 | case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH: |
| 159 | case MBEDTLS_ERR_ASN1_INVALID_DATA: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 160 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | 9a94480 | 2018-06-21 09:35:35 +0200 | [diff] [blame] | 161 | case MBEDTLS_ERR_ASN1_ALLOC_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 162 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
Gilles Peskine | 9a94480 | 2018-06-21 09:35:35 +0200 | [diff] [blame] | 163 | case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 164 | return PSA_ERROR_BUFFER_TOO_SMALL; |
Gilles Peskine | 9a94480 | 2018-06-21 09:35:35 +0200 | [diff] [blame] | 165 | |
Jaeden Amero | 93e2111 | 2019-02-20 13:57:28 +0000 | [diff] [blame] | 166 | #if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA) |
Jaeden Amero | 892cd6d | 2019-02-11 12:21:12 +0000 | [diff] [blame] | 167 | case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA: |
Jaeden Amero | 93e2111 | 2019-02-20 13:57:28 +0000 | [diff] [blame] | 168 | #endif |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 169 | case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 170 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 171 | |
| 172 | case MBEDTLS_ERR_CCM_BAD_INPUT: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 173 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 174 | case MBEDTLS_ERR_CCM_AUTH_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 175 | return PSA_ERROR_INVALID_SIGNATURE; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 176 | |
Gilles Peskine | 26869f2 | 2019-05-06 15:25:00 +0200 | [diff] [blame] | 177 | case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 178 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | 26869f2 | 2019-05-06 15:25:00 +0200 | [diff] [blame] | 179 | |
| 180 | case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 181 | return PSA_ERROR_BAD_STATE; |
Gilles Peskine | 26869f2 | 2019-05-06 15:25:00 +0200 | [diff] [blame] | 182 | case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 183 | return PSA_ERROR_INVALID_SIGNATURE; |
Gilles Peskine | 26869f2 | 2019-05-06 15:25:00 +0200 | [diff] [blame] | 184 | |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 185 | case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 186 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 187 | case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 188 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 189 | case MBEDTLS_ERR_CIPHER_ALLOC_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 190 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 191 | case MBEDTLS_ERR_CIPHER_INVALID_PADDING: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 192 | return PSA_ERROR_INVALID_PADDING; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 193 | case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 194 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 195 | case MBEDTLS_ERR_CIPHER_AUTH_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 196 | return PSA_ERROR_INVALID_SIGNATURE; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 197 | case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 198 | return PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 199 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 200 | #if !(defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \ |
| 201 | defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)) |
Gilles Peskine | bee96c8 | 2020-11-23 21:00:09 +0100 | [diff] [blame] | 202 | /* Only check CTR_DRBG error codes if underlying mbedtls_xxx |
| 203 | * functions are passed a CTR_DRBG instance. */ |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 204 | case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 205 | return PSA_ERROR_INSUFFICIENT_ENTROPY; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 206 | case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG: |
| 207 | case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 208 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 209 | case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 210 | return PSA_ERROR_INSUFFICIENT_ENTROPY; |
Gilles Peskine | 82e57d1 | 2020-11-13 21:31:17 +0100 | [diff] [blame] | 211 | #endif |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 212 | |
| 213 | case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 214 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 215 | |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 216 | case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: |
| 217 | case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: |
| 218 | case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 219 | return PSA_ERROR_INSUFFICIENT_ENTROPY; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 220 | |
| 221 | case MBEDTLS_ERR_GCM_AUTH_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 222 | return PSA_ERROR_INVALID_SIGNATURE; |
Mateusz Starzyk | f28261f | 2021-09-30 16:39:07 +0200 | [diff] [blame] | 223 | case MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 224 | return PSA_ERROR_BUFFER_TOO_SMALL; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 225 | case MBEDTLS_ERR_GCM_BAD_INPUT: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 226 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 227 | |
Gilles Peskine | 82e57d1 | 2020-11-13 21:31:17 +0100 | [diff] [blame] | 228 | #if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 229 | defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE) |
Gilles Peskine | bee96c8 | 2020-11-23 21:00:09 +0100 | [diff] [blame] | 230 | /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx |
| 231 | * functions are passed a HMAC_DRBG instance. */ |
Gilles Peskine | 82e57d1 | 2020-11-13 21:31:17 +0100 | [diff] [blame] | 232 | case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 233 | return PSA_ERROR_INSUFFICIENT_ENTROPY; |
Gilles Peskine | 82e57d1 | 2020-11-13 21:31:17 +0100 | [diff] [blame] | 234 | case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG: |
| 235 | case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 236 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | 82e57d1 | 2020-11-13 21:31:17 +0100 | [diff] [blame] | 237 | case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 238 | return PSA_ERROR_INSUFFICIENT_ENTROPY; |
Gilles Peskine | 82e57d1 | 2020-11-13 21:31:17 +0100 | [diff] [blame] | 239 | #endif |
| 240 | |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 241 | case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 242 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 243 | case MBEDTLS_ERR_MD_BAD_INPUT_DATA: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 244 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 245 | case MBEDTLS_ERR_MD_ALLOC_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 246 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 247 | case MBEDTLS_ERR_MD_FILE_IO_ERROR: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 248 | return PSA_ERROR_STORAGE_FAILURE; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 249 | |
Gilles Peskine | f76aa77 | 2018-10-29 19:24:33 +0100 | [diff] [blame] | 250 | case MBEDTLS_ERR_MPI_FILE_IO_ERROR: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 251 | return PSA_ERROR_STORAGE_FAILURE; |
Gilles Peskine | f76aa77 | 2018-10-29 19:24:33 +0100 | [diff] [blame] | 252 | case MBEDTLS_ERR_MPI_BAD_INPUT_DATA: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 253 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | f76aa77 | 2018-10-29 19:24:33 +0100 | [diff] [blame] | 254 | case MBEDTLS_ERR_MPI_INVALID_CHARACTER: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 255 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | f76aa77 | 2018-10-29 19:24:33 +0100 | [diff] [blame] | 256 | case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 257 | return PSA_ERROR_BUFFER_TOO_SMALL; |
Gilles Peskine | f76aa77 | 2018-10-29 19:24:33 +0100 | [diff] [blame] | 258 | case MBEDTLS_ERR_MPI_NEGATIVE_VALUE: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 259 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | f76aa77 | 2018-10-29 19:24:33 +0100 | [diff] [blame] | 260 | case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 261 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | f76aa77 | 2018-10-29 19:24:33 +0100 | [diff] [blame] | 262 | case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 263 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | f76aa77 | 2018-10-29 19:24:33 +0100 | [diff] [blame] | 264 | case MBEDTLS_ERR_MPI_ALLOC_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 265 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
Gilles Peskine | f76aa77 | 2018-10-29 19:24:33 +0100 | [diff] [blame] | 266 | |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 267 | case MBEDTLS_ERR_PK_ALLOC_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 268 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 269 | case MBEDTLS_ERR_PK_TYPE_MISMATCH: |
| 270 | case MBEDTLS_ERR_PK_BAD_INPUT_DATA: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 271 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 272 | case MBEDTLS_ERR_PK_FILE_IO_ERROR: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 273 | return PSA_ERROR_STORAGE_FAILURE; |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 274 | case MBEDTLS_ERR_PK_KEY_INVALID_VERSION: |
| 275 | case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 276 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 277 | case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 278 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 279 | case MBEDTLS_ERR_PK_PASSWORD_REQUIRED: |
| 280 | case MBEDTLS_ERR_PK_PASSWORD_MISMATCH: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 281 | return PSA_ERROR_NOT_PERMITTED; |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 282 | case MBEDTLS_ERR_PK_INVALID_PUBKEY: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 283 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 284 | case MBEDTLS_ERR_PK_INVALID_ALG: |
| 285 | case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE: |
| 286 | case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 287 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 288 | case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 289 | return PSA_ERROR_INVALID_SIGNATURE; |
Gilles Peskine | f9f1bdf | 2021-06-23 20:32:27 +0200 | [diff] [blame] | 290 | case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 291 | return PSA_ERROR_BUFFER_TOO_SMALL; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 292 | |
Gilles Peskine | ff2d200 | 2019-05-06 15:26:23 +0200 | [diff] [blame] | 293 | case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 294 | return PSA_ERROR_HARDWARE_FAILURE; |
Gilles Peskine | ff2d200 | 2019-05-06 15:26:23 +0200 | [diff] [blame] | 295 | case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 296 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | ff2d200 | 2019-05-06 15:26:23 +0200 | [diff] [blame] | 297 | |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 298 | case MBEDTLS_ERR_RSA_BAD_INPUT_DATA: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 299 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 300 | case MBEDTLS_ERR_RSA_INVALID_PADDING: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 301 | return PSA_ERROR_INVALID_PADDING; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 302 | case MBEDTLS_ERR_RSA_KEY_GEN_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 303 | return PSA_ERROR_HARDWARE_FAILURE; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 304 | case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 305 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 306 | case MBEDTLS_ERR_RSA_PUBLIC_FAILED: |
| 307 | case MBEDTLS_ERR_RSA_PRIVATE_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 308 | return PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 309 | case MBEDTLS_ERR_RSA_VERIFY_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 310 | return PSA_ERROR_INVALID_SIGNATURE; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 311 | case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 312 | return PSA_ERROR_BUFFER_TOO_SMALL; |
Gilles Peskine | a590529 | 2018-02-07 20:59:33 +0100 | [diff] [blame] | 313 | case MBEDTLS_ERR_RSA_RNG_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 314 | return PSA_ERROR_INSUFFICIENT_ENTROPY; |
Manuel Pégourié-Gonnard | 93c0847 | 2021-04-15 12:23:55 +0200 | [diff] [blame] | 315 | |
itayzafrir | 5c75339 | 2018-05-08 11:18:38 +0300 | [diff] [blame] | 316 | case MBEDTLS_ERR_ECP_BAD_INPUT_DATA: |
itayzafrir | 7b30f8b | 2018-05-09 16:07:36 +0300 | [diff] [blame] | 317 | case MBEDTLS_ERR_ECP_INVALID_KEY: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 318 | return PSA_ERROR_INVALID_ARGUMENT; |
itayzafrir | 7b30f8b | 2018-05-09 16:07:36 +0300 | [diff] [blame] | 319 | case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 320 | return PSA_ERROR_BUFFER_TOO_SMALL; |
itayzafrir | 7b30f8b | 2018-05-09 16:07:36 +0300 | [diff] [blame] | 321 | case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 322 | return PSA_ERROR_NOT_SUPPORTED; |
itayzafrir | 7b30f8b | 2018-05-09 16:07:36 +0300 | [diff] [blame] | 323 | case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH: |
| 324 | case MBEDTLS_ERR_ECP_VERIFY_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 325 | return PSA_ERROR_INVALID_SIGNATURE; |
itayzafrir | 7b30f8b | 2018-05-09 16:07:36 +0300 | [diff] [blame] | 326 | case MBEDTLS_ERR_ECP_ALLOC_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 327 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
Gilles Peskine | 40d8160 | 2020-11-25 00:09:47 +0100 | [diff] [blame] | 328 | case MBEDTLS_ERR_ECP_RANDOM_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 329 | return PSA_ERROR_INSUFFICIENT_ENTROPY; |
Gilles Peskine | 40d8160 | 2020-11-25 00:09:47 +0100 | [diff] [blame] | 330 | |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 331 | case MBEDTLS_ERR_ECP_IN_PROGRESS: |
| 332 | return PSA_OPERATION_INCOMPLETE; |
| 333 | |
Janos Follath | a13b905 | 2019-11-22 12:48:59 +0000 | [diff] [blame] | 334 | case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 335 | return PSA_ERROR_CORRUPTION_DETECTED; |
itayzafrir | 5c75339 | 2018-05-08 11:18:38 +0300 | [diff] [blame] | 336 | |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 337 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 338 | return PSA_ERROR_GENERIC_ERROR; |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 339 | } |
| 340 | } |
| 341 | |
Paul Elliott | dc42ca8 | 2023-02-24 18:11:59 +0000 | [diff] [blame] | 342 | /** |
| 343 | * \brief For output buffers which contain "tags" |
| 344 | * (outputs that may be checked for validity like |
| 345 | * hashes, MACs and signatures), fill the unused |
| 346 | * part of the output buffer (the whole buffer on |
| 347 | * error, the trailing part on success) with |
| 348 | * something that isn't a valid tag (barring an |
| 349 | * attack on the tag and deliberately-crafted |
| 350 | * input), in case the caller doesn't check the |
| 351 | * return status properly. |
| 352 | * |
| 353 | * \param output_buffer Pointer to buffer to wipe. May not be NULL |
| 354 | * unless \p output_buffer_size is zero. |
| 355 | * \param status Status of function called to generate |
| 356 | * output_buffer originally |
| 357 | * \param output_buffer_size Size of output buffer. If zero, \p output_buffer |
| 358 | * could be NULL. |
| 359 | * \param output_buffer_length Length of data written to output_buffer, must be |
| 360 | * less than \p output_buffer_size |
| 361 | */ |
| 362 | static void psa_wipe_tag_output_buffer(uint8_t *output_buffer, psa_status_t status, |
Paul Elliott | 7118d17 | 2023-02-26 16:57:05 +0000 | [diff] [blame] | 363 | size_t output_buffer_size, size_t output_buffer_length) |
| 364 | { |
Paul Elliott | dc42ca8 | 2023-02-24 18:11:59 +0000 | [diff] [blame] | 365 | size_t offset = 0; |
| 366 | |
| 367 | if (output_buffer_size == 0) { |
| 368 | /* If output_buffer_size is 0 then we have nothing to do. We must not |
| 369 | call memset because output_buffer may be NULL in this case */ |
| 370 | return; |
| 371 | } |
| 372 | |
| 373 | if (status == PSA_SUCCESS) { |
| 374 | offset = output_buffer_length; |
| 375 | } |
| 376 | |
| 377 | memset(output_buffer + offset, '!', output_buffer_size - offset); |
| 378 | } |
| 379 | |
Gilles Peskine | b0b255c | 2018-07-06 17:01:38 +0200 | [diff] [blame] | 380 | |
Gilles Peskine | 7bcfc0a | 2018-06-18 21:49:39 +0200 | [diff] [blame] | 381 | |
| 382 | |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 383 | /****************************************************************/ |
| 384 | /* Key management */ |
| 385 | /****************************************************************/ |
| 386 | |
Valerio Setti | d4a5d46 | 2023-04-05 18:19:01 +0200 | [diff] [blame] | 387 | #if defined(MBEDTLS_ECP_LIGHT) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 388 | mbedtls_ecp_group_id mbedtls_ecc_group_of_psa(psa_ecc_family_t curve, |
| 389 | size_t bits, |
| 390 | int bits_is_sloppy) |
Gilles Peskine | 12313cd | 2018-06-20 00:20:32 +0200 | [diff] [blame] | 391 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 392 | switch (curve) { |
Paul Elliott | 8ff510a | 2020-06-02 17:19:28 +0100 | [diff] [blame] | 393 | case PSA_ECC_FAMILY_SECP_R1: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 394 | switch (bits) { |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 395 | #if defined(PSA_WANT_ECC_SECP_R1_192) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 396 | case 192: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 397 | return MBEDTLS_ECP_DP_SECP192R1; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 398 | #endif |
| 399 | #if defined(PSA_WANT_ECC_SECP_R1_224) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 400 | case 224: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 401 | return MBEDTLS_ECP_DP_SECP224R1; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 402 | #endif |
| 403 | #if defined(PSA_WANT_ECC_SECP_R1_256) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 404 | case 256: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 405 | return MBEDTLS_ECP_DP_SECP256R1; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 406 | #endif |
| 407 | #if defined(PSA_WANT_ECC_SECP_R1_384) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 408 | case 384: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 409 | return MBEDTLS_ECP_DP_SECP384R1; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 410 | #endif |
| 411 | #if defined(PSA_WANT_ECC_SECP_R1_521) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 412 | case 521: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 413 | return MBEDTLS_ECP_DP_SECP521R1; |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 414 | case 528: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 415 | if (bits_is_sloppy) { |
| 416 | return MBEDTLS_ECP_DP_SECP521R1; |
| 417 | } |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 418 | break; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 419 | #endif |
Gilles Peskine | 228abc5 | 2019-12-03 17:24:19 +0100 | [diff] [blame] | 420 | } |
| 421 | break; |
Gilles Peskine | 228abc5 | 2019-12-03 17:24:19 +0100 | [diff] [blame] | 422 | |
Paul Elliott | 8ff510a | 2020-06-02 17:19:28 +0100 | [diff] [blame] | 423 | case PSA_ECC_FAMILY_BRAINPOOL_P_R1: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 424 | switch (bits) { |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 425 | #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 426 | case 256: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 427 | return MBEDTLS_ECP_DP_BP256R1; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 428 | #endif |
| 429 | #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 430 | case 384: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 431 | return MBEDTLS_ECP_DP_BP384R1; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 432 | #endif |
| 433 | #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 434 | case 512: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 435 | return MBEDTLS_ECP_DP_BP512R1; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 436 | #endif |
Gilles Peskine | 228abc5 | 2019-12-03 17:24:19 +0100 | [diff] [blame] | 437 | } |
| 438 | break; |
Gilles Peskine | 228abc5 | 2019-12-03 17:24:19 +0100 | [diff] [blame] | 439 | |
Paul Elliott | 8ff510a | 2020-06-02 17:19:28 +0100 | [diff] [blame] | 440 | case PSA_ECC_FAMILY_MONTGOMERY: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 441 | switch (bits) { |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 442 | #if defined(PSA_WANT_ECC_MONTGOMERY_255) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 443 | case 255: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 444 | return MBEDTLS_ECP_DP_CURVE25519; |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 445 | case 256: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 446 | if (bits_is_sloppy) { |
| 447 | return MBEDTLS_ECP_DP_CURVE25519; |
| 448 | } |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 449 | break; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 450 | #endif |
| 451 | #if defined(PSA_WANT_ECC_MONTGOMERY_448) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 452 | case 448: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 453 | return MBEDTLS_ECP_DP_CURVE448; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 454 | #endif |
Gilles Peskine | 228abc5 | 2019-12-03 17:24:19 +0100 | [diff] [blame] | 455 | } |
| 456 | break; |
Gilles Peskine | 228abc5 | 2019-12-03 17:24:19 +0100 | [diff] [blame] | 457 | |
Paul Elliott | 8ff510a | 2020-06-02 17:19:28 +0100 | [diff] [blame] | 458 | case PSA_ECC_FAMILY_SECP_K1: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 459 | switch (bits) { |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 460 | #if defined(PSA_WANT_ECC_SECP_K1_192) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 461 | case 192: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 462 | return MBEDTLS_ECP_DP_SECP192K1; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 463 | #endif |
| 464 | #if defined(PSA_WANT_ECC_SECP_K1_224) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 465 | case 224: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 466 | return MBEDTLS_ECP_DP_SECP224K1; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 467 | #endif |
| 468 | #if defined(PSA_WANT_ECC_SECP_K1_256) |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 469 | case 256: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 470 | return MBEDTLS_ECP_DP_SECP256K1; |
Gilles Peskine | a1684f4 | 2021-03-23 13:12:34 +0100 | [diff] [blame] | 471 | #endif |
Gilles Peskine | 228abc5 | 2019-12-03 17:24:19 +0100 | [diff] [blame] | 472 | } |
| 473 | break; |
Gilles Peskine | 12313cd | 2018-06-20 00:20:32 +0200 | [diff] [blame] | 474 | } |
Gilles Peskine | 2fa6b5f | 2021-01-27 15:44:45 +0100 | [diff] [blame] | 475 | |
Gilles Peskine | 71f45ba | 2021-03-23 14:17:55 +0100 | [diff] [blame] | 476 | (void) bits_is_sloppy; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 477 | return MBEDTLS_ECP_DP_NONE; |
Gilles Peskine | 12313cd | 2018-06-20 00:20:32 +0200 | [diff] [blame] | 478 | } |
Valerio Setti | d4a5d46 | 2023-04-05 18:19:01 +0200 | [diff] [blame] | 479 | #endif /* MBEDTLS_ECP_LIGHT */ |
Gilles Peskine | 12313cd | 2018-06-20 00:20:32 +0200 | [diff] [blame] | 480 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 481 | psa_status_t psa_validate_unstructured_key_bit_size(psa_key_type_t type, |
| 482 | size_t bits) |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 483 | { |
| 484 | /* Check that the bit size is acceptable for the key type */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 485 | switch (type) { |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 486 | case PSA_KEY_TYPE_RAW_DATA: |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 487 | case PSA_KEY_TYPE_HMAC: |
Gilles Peskine | ea0fb49 | 2018-07-12 17:17:20 +0200 | [diff] [blame] | 488 | case PSA_KEY_TYPE_DERIVE: |
Neil Armstrong | 4b5710f | 2022-05-25 11:30:27 +0200 | [diff] [blame] | 489 | case PSA_KEY_TYPE_PASSWORD: |
| 490 | case PSA_KEY_TYPE_PASSWORD_HASH: |
Gilles Peskine | ea0fb49 | 2018-07-12 17:17:20 +0200 | [diff] [blame] | 491 | break; |
Ronald Cron | 1f0db80 | 2021-03-12 09:59:30 +0100 | [diff] [blame] | 492 | #if defined(PSA_WANT_KEY_TYPE_AES) |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 493 | case PSA_KEY_TYPE_AES: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 494 | if (bits != 128 && bits != 192 && bits != 256) { |
| 495 | return PSA_ERROR_INVALID_ARGUMENT; |
| 496 | } |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 497 | break; |
| 498 | #endif |
Gilles Peskine | 6c12a1e | 2021-09-21 11:59:39 +0200 | [diff] [blame] | 499 | #if defined(PSA_WANT_KEY_TYPE_ARIA) |
| 500 | case PSA_KEY_TYPE_ARIA: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 501 | if (bits != 128 && bits != 192 && bits != 256) { |
| 502 | return PSA_ERROR_INVALID_ARGUMENT; |
| 503 | } |
Gilles Peskine | 6c12a1e | 2021-09-21 11:59:39 +0200 | [diff] [blame] | 504 | break; |
| 505 | #endif |
Ronald Cron | 1f0db80 | 2021-03-12 09:59:30 +0100 | [diff] [blame] | 506 | #if defined(PSA_WANT_KEY_TYPE_CAMELLIA) |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 507 | case PSA_KEY_TYPE_CAMELLIA: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 508 | if (bits != 128 && bits != 192 && bits != 256) { |
| 509 | return PSA_ERROR_INVALID_ARGUMENT; |
| 510 | } |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 511 | break; |
| 512 | #endif |
Ronald Cron | 1f0db80 | 2021-03-12 09:59:30 +0100 | [diff] [blame] | 513 | #if defined(PSA_WANT_KEY_TYPE_DES) |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 514 | case PSA_KEY_TYPE_DES: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 515 | if (bits != 64 && bits != 128 && bits != 192) { |
| 516 | return PSA_ERROR_INVALID_ARGUMENT; |
| 517 | } |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 518 | break; |
| 519 | #endif |
Ronald Cron | 1f0db80 | 2021-03-12 09:59:30 +0100 | [diff] [blame] | 520 | #if defined(PSA_WANT_KEY_TYPE_CHACHA20) |
Gilles Peskine | 26869f2 | 2019-05-06 15:25:00 +0200 | [diff] [blame] | 521 | case PSA_KEY_TYPE_CHACHA20: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 522 | if (bits != 256) { |
| 523 | return PSA_ERROR_INVALID_ARGUMENT; |
| 524 | } |
Gilles Peskine | 26869f2 | 2019-05-06 15:25:00 +0200 | [diff] [blame] | 525 | break; |
| 526 | #endif |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 527 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 528 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 529 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 530 | if (bits % 8 != 0) { |
| 531 | return PSA_ERROR_INVALID_ARGUMENT; |
| 532 | } |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 533 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 534 | return PSA_SUCCESS; |
Gilles Peskine | 0ff4b0f | 2018-06-19 21:31:50 +0200 | [diff] [blame] | 535 | } |
| 536 | |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 537 | /** Check whether a given key type is valid for use with a given MAC algorithm |
Steven Cooreman | 5ad4bf7 | 2021-03-02 15:11:57 +0100 | [diff] [blame] | 538 | * |
Steven Cooreman | cd64093 | 2021-03-08 12:00:27 +0100 | [diff] [blame] | 539 | * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH |
| 540 | * when called with the validated \p algorithm and \p key_type is well-defined. |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 541 | * |
| 542 | * \param[in] algorithm The specific MAC algorithm (can be wildcard). |
Steven Cooreman | 5ad4bf7 | 2021-03-02 15:11:57 +0100 | [diff] [blame] | 543 | * \param[in] key_type The key type of the key to be used with the |
| 544 | * \p algorithm. |
Steven Cooreman | 5ad4bf7 | 2021-03-02 15:11:57 +0100 | [diff] [blame] | 545 | * |
| 546 | * \retval #PSA_SUCCESS |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 547 | * The \p key_type is valid for use with the \p algorithm |
Steven Cooreman | 5ad4bf7 | 2021-03-02 15:11:57 +0100 | [diff] [blame] | 548 | * \retval #PSA_ERROR_INVALID_ARGUMENT |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 549 | * The \p key_type is not valid for use with the \p algorithm |
Steven Cooreman | 5ad4bf7 | 2021-03-02 15:11:57 +0100 | [diff] [blame] | 550 | */ |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 551 | MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do( |
Steven Cooreman | 58c94d3 | 2021-03-02 21:31:17 +0100 | [diff] [blame] | 552 | psa_algorithm_t algorithm, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 553 | psa_key_type_t key_type) |
Steven Cooreman | 5ad4bf7 | 2021-03-02 15:11:57 +0100 | [diff] [blame] | 554 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 555 | if (PSA_ALG_IS_HMAC(algorithm)) { |
| 556 | if (key_type == PSA_KEY_TYPE_HMAC) { |
| 557 | return PSA_SUCCESS; |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 558 | } |
Steven Cooreman | 5ad4bf7 | 2021-03-02 15:11:57 +0100 | [diff] [blame] | 559 | } |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 560 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 561 | if (PSA_ALG_IS_BLOCK_CIPHER_MAC(algorithm)) { |
| 562 | /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher |
| 563 | * key. */ |
| 564 | if ((key_type & PSA_KEY_TYPE_CATEGORY_MASK) == |
| 565 | PSA_KEY_TYPE_CATEGORY_SYMMETRIC) { |
| 566 | /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and |
| 567 | * the block length (larger than 1) for block ciphers. */ |
| 568 | if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) > 1) { |
| 569 | return PSA_SUCCESS; |
| 570 | } |
| 571 | } |
| 572 | } |
| 573 | |
| 574 | return PSA_ERROR_INVALID_ARGUMENT; |
Steven Cooreman | 5ad4bf7 | 2021-03-02 15:11:57 +0100 | [diff] [blame] | 575 | } |
| 576 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 577 | psa_status_t psa_allocate_buffer_to_slot(psa_key_slot_t *slot, |
| 578 | size_t buffer_length) |
Steven Cooreman | 75b7436 | 2020-07-28 14:30:13 +0200 | [diff] [blame] | 579 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 580 | if (slot->key.data != NULL) { |
| 581 | return PSA_ERROR_ALREADY_EXISTS; |
| 582 | } |
Steven Cooreman | 75b7436 | 2020-07-28 14:30:13 +0200 | [diff] [blame] | 583 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 584 | slot->key.data = mbedtls_calloc(1, buffer_length); |
| 585 | if (slot->key.data == NULL) { |
| 586 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
| 587 | } |
Steven Cooreman | 75b7436 | 2020-07-28 14:30:13 +0200 | [diff] [blame] | 588 | |
Ronald Cron | ea0f8a6 | 2020-11-25 17:52:23 +0100 | [diff] [blame] | 589 | slot->key.bytes = buffer_length; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 590 | return PSA_SUCCESS; |
Steven Cooreman | 75b7436 | 2020-07-28 14:30:13 +0200 | [diff] [blame] | 591 | } |
| 592 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 593 | psa_status_t psa_copy_key_material_into_slot(psa_key_slot_t *slot, |
| 594 | const uint8_t *data, |
| 595 | size_t data_length) |
Steven Cooreman | f7cebd4 | 2020-10-13 20:27:40 +0200 | [diff] [blame] | 596 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 597 | psa_status_t status = psa_allocate_buffer_to_slot(slot, |
| 598 | data_length); |
| 599 | if (status != PSA_SUCCESS) { |
| 600 | return status; |
| 601 | } |
Steven Cooreman | f7cebd4 | 2020-10-13 20:27:40 +0200 | [diff] [blame] | 602 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 603 | memcpy(slot->key.data, data, data_length); |
| 604 | return PSA_SUCCESS; |
Steven Cooreman | f7cebd4 | 2020-10-13 20:27:40 +0200 | [diff] [blame] | 605 | } |
| 606 | |
Ronald Cron | a0fe59f | 2020-11-29 11:14:53 +0100 | [diff] [blame] | 607 | psa_status_t psa_import_key_into_slot( |
Ronald Cron | 2ebfdcc | 2020-11-28 15:54:54 +0100 | [diff] [blame] | 608 | const psa_key_attributes_t *attributes, |
| 609 | const uint8_t *data, size_t data_length, |
| 610 | uint8_t *key_buffer, size_t key_buffer_size, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 611 | size_t *key_buffer_length, size_t *bits) |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 612 | { |
Ronald Cron | 2ebfdcc | 2020-11-28 15:54:54 +0100 | [diff] [blame] | 613 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 614 | psa_key_type_t type = attributes->core.type; |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 615 | |
Steven Cooreman | 81be2fa | 2020-07-24 22:04:59 +0200 | [diff] [blame] | 616 | /* zero-length keys are never supported. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 617 | if (data_length == 0) { |
| 618 | return PSA_ERROR_NOT_SUPPORTED; |
| 619 | } |
Steven Cooreman | 81be2fa | 2020-07-24 22:04:59 +0200 | [diff] [blame] | 620 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 621 | if (key_type_is_raw_bytes(type)) { |
| 622 | *bits = PSA_BYTES_TO_BITS(data_length); |
Steven Cooreman | 81be2fa | 2020-07-24 22:04:59 +0200 | [diff] [blame] | 623 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 624 | status = psa_validate_unstructured_key_bit_size(attributes->core.type, |
| 625 | *bits); |
| 626 | if (status != PSA_SUCCESS) { |
| 627 | return status; |
| 628 | } |
Steven Cooreman | 81be2fa | 2020-07-24 22:04:59 +0200 | [diff] [blame] | 629 | |
Ronald Cron | dd04d42 | 2020-11-28 15:14:42 +0100 | [diff] [blame] | 630 | /* Copy the key material. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 631 | memcpy(key_buffer, data, data_length); |
Ronald Cron | dd04d42 | 2020-11-28 15:14:42 +0100 | [diff] [blame] | 632 | *key_buffer_length = data_length; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 633 | (void) key_buffer_size; |
Steven Cooreman | 81be2fa | 2020-07-24 22:04:59 +0200 | [diff] [blame] | 634 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 635 | return PSA_SUCCESS; |
| 636 | } else if (PSA_KEY_TYPE_IS_ASYMMETRIC(type)) { |
John Durkop | 9814fa2 | 2020-11-04 12:28:15 -0800 | [diff] [blame] | 637 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 638 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) |
| 639 | if (PSA_KEY_TYPE_IS_ECC(type)) { |
| 640 | return mbedtls_psa_ecp_import_key(attributes, |
| 641 | data, data_length, |
| 642 | key_buffer, key_buffer_size, |
| 643 | key_buffer_length, |
| 644 | bits); |
Steven Cooreman | 40120f6 | 2020-10-29 11:42:22 +0100 | [diff] [blame] | 645 | } |
John Durkop | 9814fa2 | 2020-11-04 12:28:15 -0800 | [diff] [blame] | 646 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || |
| 647 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */ |
John Durkop | 0e00519 | 2020-10-31 22:06:54 -0700 | [diff] [blame] | 648 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 649 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) |
| 650 | if (PSA_KEY_TYPE_IS_RSA(type)) { |
| 651 | return mbedtls_psa_rsa_import_key(attributes, |
| 652 | data, data_length, |
| 653 | key_buffer, key_buffer_size, |
| 654 | key_buffer_length, |
| 655 | bits); |
Steven Cooreman | 3ea0ce4 | 2020-10-23 11:37:05 +0200 | [diff] [blame] | 656 | } |
John Durkop | 9814fa2 | 2020-11-04 12:28:15 -0800 | [diff] [blame] | 657 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || |
| 658 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */ |
Ronald Cron | 2ebfdcc | 2020-11-28 15:54:54 +0100 | [diff] [blame] | 659 | } |
Steven Cooreman | 40120f6 | 2020-10-29 11:42:22 +0100 | [diff] [blame] | 660 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 661 | return PSA_ERROR_NOT_SUPPORTED; |
Darryl Green | 06fd18d | 2018-07-16 11:21:11 +0100 | [diff] [blame] | 662 | } |
| 663 | |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 664 | /** Calculate the intersection of two algorithm usage policies. |
| 665 | * |
| 666 | * Return 0 (which allows no operation) on incompatibility. |
| 667 | */ |
| 668 | static psa_algorithm_t psa_key_policy_algorithm_intersection( |
Steven Cooreman | 1ac5ce3 | 2021-03-02 16:34:49 +0100 | [diff] [blame] | 669 | psa_key_type_t key_type, |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 670 | psa_algorithm_t alg1, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 671 | psa_algorithm_t alg2) |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 672 | { |
Gilles Peskine | 549ea86 | 2019-05-22 11:45:59 +0200 | [diff] [blame] | 673 | /* Common case: both sides actually specify the same policy. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 674 | if (alg1 == alg2) { |
| 675 | return alg1; |
| 676 | } |
Steven Cooreman | 0348802 | 2021-02-18 12:07:20 +0100 | [diff] [blame] | 677 | /* If the policies are from the same hash-and-sign family, check |
| 678 | * if one is a wildcard. If so the other has the specific algorithm. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 679 | if (PSA_ALG_IS_SIGN_HASH(alg1) && |
| 680 | PSA_ALG_IS_SIGN_HASH(alg2) && |
| 681 | (alg1 & ~PSA_ALG_HASH_MASK) == (alg2 & ~PSA_ALG_HASH_MASK)) { |
| 682 | if (PSA_ALG_SIGN_GET_HASH(alg1) == PSA_ALG_ANY_HASH) { |
| 683 | return alg2; |
| 684 | } |
| 685 | if (PSA_ALG_SIGN_GET_HASH(alg2) == PSA_ALG_ANY_HASH) { |
| 686 | return alg1; |
| 687 | } |
Steven Cooreman | 0348802 | 2021-02-18 12:07:20 +0100 | [diff] [blame] | 688 | } |
| 689 | /* If the policies are from the same AEAD family, check whether |
Steven Cooreman | 7de9e2d | 2021-02-22 17:05:56 +0100 | [diff] [blame] | 690 | * one of them is a minimum-tag-length wildcard. Calculate the most |
Steven Cooreman | 0348802 | 2021-02-18 12:07:20 +0100 | [diff] [blame] | 691 | * restrictive tag length. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 692 | if (PSA_ALG_IS_AEAD(alg1) && PSA_ALG_IS_AEAD(alg2) && |
| 693 | (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg1, 0) == |
| 694 | PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg2, 0))) { |
| 695 | size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg1); |
| 696 | size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg2); |
Steven Cooreman | cd64093 | 2021-03-08 12:00:27 +0100 | [diff] [blame] | 697 | size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len; |
Steven Cooreman | b3ce815 | 2021-02-18 12:03:50 +0100 | [diff] [blame] | 698 | |
Steven Cooreman | 7de9e2d | 2021-02-22 17:05:56 +0100 | [diff] [blame] | 699 | /* If both are wildcards, return most restrictive wildcard */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 700 | if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) && |
| 701 | ((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) { |
| 702 | return PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG( |
| 703 | alg1, restricted_len); |
Steven Cooreman | 0348802 | 2021-02-18 12:07:20 +0100 | [diff] [blame] | 704 | } |
| 705 | /* If only one is a wildcard, return specific algorithm if compatible. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 706 | if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) && |
| 707 | (alg1_len <= alg2_len)) { |
| 708 | return alg2; |
Steven Cooreman | 0348802 | 2021-02-18 12:07:20 +0100 | [diff] [blame] | 709 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 710 | if (((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) && |
| 711 | (alg2_len <= alg1_len)) { |
| 712 | return alg1; |
Steven Cooreman | 0348802 | 2021-02-18 12:07:20 +0100 | [diff] [blame] | 713 | } |
| 714 | } |
| 715 | /* If the policies are from the same MAC family, check whether one |
| 716 | * of them is a minimum-MAC-length policy. Calculate the most |
| 717 | * restrictive tag length. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 718 | if (PSA_ALG_IS_MAC(alg1) && PSA_ALG_IS_MAC(alg2) && |
| 719 | (PSA_ALG_FULL_LENGTH_MAC(alg1) == |
| 720 | PSA_ALG_FULL_LENGTH_MAC(alg2))) { |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 721 | /* Validate the combination of key type and algorithm. Since the base |
| 722 | * algorithm of alg1 and alg2 are the same, we only need this once. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 723 | if (PSA_SUCCESS != psa_mac_key_can_do(alg1, key_type)) { |
| 724 | return 0; |
| 725 | } |
Steven Cooreman | 1ac5ce3 | 2021-03-02 16:34:49 +0100 | [diff] [blame] | 726 | |
Steven Cooreman | 31a876d | 2021-03-03 20:47:40 +0100 | [diff] [blame] | 727 | /* Get the (exact or at-least) output lengths for both sides of the |
| 728 | * requested intersection. None of the currently supported algorithms |
| 729 | * have an output length dependent on the actual key size, so setting it |
| 730 | * to a bogus value of 0 is currently OK. |
| 731 | * |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 732 | * Note that for at-least-this-length wildcard algorithms, the output |
| 733 | * length is set to the shortest allowed length, which allows us to |
| 734 | * calculate the most restrictive tag length for the intersection. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 735 | size_t alg1_len = PSA_MAC_LENGTH(key_type, 0, alg1); |
| 736 | size_t alg2_len = PSA_MAC_LENGTH(key_type, 0, alg2); |
Steven Cooreman | cd64093 | 2021-03-08 12:00:27 +0100 | [diff] [blame] | 737 | size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len; |
Steven Cooreman | b3ce815 | 2021-02-18 12:03:50 +0100 | [diff] [blame] | 738 | |
Steven Cooreman | a1d8322 | 2021-02-25 10:20:29 +0100 | [diff] [blame] | 739 | /* If both are wildcards, return most restrictive wildcard */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 740 | if (((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) && |
| 741 | ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0)) { |
| 742 | return PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(alg1, restricted_len); |
Steven Cooreman | 0348802 | 2021-02-18 12:07:20 +0100 | [diff] [blame] | 743 | } |
Steven Cooreman | 31a876d | 2021-03-03 20:47:40 +0100 | [diff] [blame] | 744 | |
| 745 | /* If only one is an at-least-this-length policy, the intersection would |
| 746 | * be the other (fixed-length) policy as long as said fixed length is |
| 747 | * equal to or larger than the shortest allowed length. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 748 | if ((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) { |
| 749 | return (alg1_len <= alg2_len) ? alg2 : 0; |
Steven Cooreman | 0348802 | 2021-02-18 12:07:20 +0100 | [diff] [blame] | 750 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 751 | if ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) { |
| 752 | return (alg2_len <= alg1_len) ? alg1 : 0; |
Steven Cooreman | b3ce815 | 2021-02-18 12:03:50 +0100 | [diff] [blame] | 753 | } |
Steven Cooreman | 31a876d | 2021-03-03 20:47:40 +0100 | [diff] [blame] | 754 | |
Steven Cooreman | cd64093 | 2021-03-08 12:00:27 +0100 | [diff] [blame] | 755 | /* If none of them are wildcards, check whether they define the same tag |
| 756 | * length. This is still possible here when one is default-length and |
| 757 | * the other specific-length. Ensure to always return the |
| 758 | * specific-length version for the intersection. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 759 | if (alg1_len == alg2_len) { |
| 760 | return PSA_ALG_TRUNCATED_MAC(alg1, alg1_len); |
| 761 | } |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 762 | } |
| 763 | /* If the policies are incompatible, allow nothing. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 764 | return 0; |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 765 | } |
| 766 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 767 | static int psa_key_algorithm_permits(psa_key_type_t key_type, |
| 768 | psa_algorithm_t policy_alg, |
| 769 | psa_algorithm_t requested_alg) |
Gilles Peskine | d6f371b | 2019-05-10 19:33:38 +0200 | [diff] [blame] | 770 | { |
Gilles Peskine | 549ea86 | 2019-05-22 11:45:59 +0200 | [diff] [blame] | 771 | /* Common case: the policy only allows requested_alg. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 772 | if (requested_alg == policy_alg) { |
| 773 | return 1; |
| 774 | } |
Steven Cooreman | 0348802 | 2021-02-18 12:07:20 +0100 | [diff] [blame] | 775 | /* If policy_alg is a hash-and-sign with a wildcard for the hash, |
| 776 | * and requested_alg is the same hash-and-sign family with any hash, |
| 777 | * then requested_alg is compliant with policy_alg. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 778 | if (PSA_ALG_IS_SIGN_HASH(requested_alg) && |
| 779 | PSA_ALG_SIGN_GET_HASH(policy_alg) == PSA_ALG_ANY_HASH) { |
| 780 | return (policy_alg & ~PSA_ALG_HASH_MASK) == |
| 781 | (requested_alg & ~PSA_ALG_HASH_MASK); |
Steven Cooreman | 0348802 | 2021-02-18 12:07:20 +0100 | [diff] [blame] | 782 | } |
| 783 | /* If policy_alg is a wildcard AEAD algorithm of the same base as |
| 784 | * the requested algorithm, check the requested tag length to be |
| 785 | * equal-length or longer than the wildcard-specified length. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 786 | if (PSA_ALG_IS_AEAD(policy_alg) && |
| 787 | PSA_ALG_IS_AEAD(requested_alg) && |
| 788 | (PSA_ALG_AEAD_WITH_SHORTENED_TAG(policy_alg, 0) == |
| 789 | PSA_ALG_AEAD_WITH_SHORTENED_TAG(requested_alg, 0)) && |
| 790 | ((policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) { |
| 791 | return PSA_ALG_AEAD_GET_TAG_LENGTH(policy_alg) <= |
| 792 | PSA_ALG_AEAD_GET_TAG_LENGTH(requested_alg); |
Steven Cooreman | 0348802 | 2021-02-18 12:07:20 +0100 | [diff] [blame] | 793 | } |
Steven Cooreman | cd64093 | 2021-03-08 12:00:27 +0100 | [diff] [blame] | 794 | /* If policy_alg is a MAC algorithm of the same base as the requested |
| 795 | * algorithm, check whether their MAC lengths are compatible. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 796 | if (PSA_ALG_IS_MAC(policy_alg) && |
| 797 | PSA_ALG_IS_MAC(requested_alg) && |
| 798 | (PSA_ALG_FULL_LENGTH_MAC(policy_alg) == |
| 799 | PSA_ALG_FULL_LENGTH_MAC(requested_alg))) { |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 800 | /* Validate the combination of key type and algorithm. Since the policy |
| 801 | * and requested algorithms are the same, we only need this once. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 802 | if (PSA_SUCCESS != psa_mac_key_can_do(policy_alg, key_type)) { |
| 803 | return 0; |
| 804 | } |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 805 | |
Steven Cooreman | 31a876d | 2021-03-03 20:47:40 +0100 | [diff] [blame] | 806 | /* Get both the requested output length for the algorithm which is to be |
| 807 | * verified, and the default output length for the base algorithm. |
| 808 | * Note that none of the currently supported algorithms have an output |
| 809 | * length dependent on actual key size, so setting it to a bogus value |
| 810 | * of 0 is currently OK. */ |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 811 | size_t requested_output_length = PSA_MAC_LENGTH( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 812 | key_type, 0, requested_alg); |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 813 | size_t default_output_length = PSA_MAC_LENGTH( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 814 | key_type, 0, |
| 815 | PSA_ALG_FULL_LENGTH_MAC(requested_alg)); |
Steven Cooreman | b3ce815 | 2021-02-18 12:03:50 +0100 | [diff] [blame] | 816 | |
Steven Cooreman | 5ad4bf7 | 2021-03-02 15:11:57 +0100 | [diff] [blame] | 817 | /* If the policy is default-length, only allow an algorithm with |
| 818 | * a declared exact-length matching the default. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 819 | if (PSA_MAC_TRUNCATED_LENGTH(policy_alg) == 0) { |
| 820 | return requested_output_length == default_output_length; |
| 821 | } |
Steven Cooreman | 5ad4bf7 | 2021-03-02 15:11:57 +0100 | [diff] [blame] | 822 | |
| 823 | /* If the requested algorithm is default-length, allow it if the policy |
Steven Cooreman | cd64093 | 2021-03-08 12:00:27 +0100 | [diff] [blame] | 824 | * length exactly matches the default length. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 825 | if (PSA_MAC_TRUNCATED_LENGTH(requested_alg) == 0 && |
| 826 | PSA_MAC_TRUNCATED_LENGTH(policy_alg) == default_output_length) { |
| 827 | return 1; |
Steven Cooreman | 5ad4bf7 | 2021-03-02 15:11:57 +0100 | [diff] [blame] | 828 | } |
| 829 | |
Steven Cooreman | cd64093 | 2021-03-08 12:00:27 +0100 | [diff] [blame] | 830 | /* If policy_alg is an at-least-this-length wildcard MAC algorithm, |
| 831 | * check for the requested MAC length to be equal to or longer than the |
| 832 | * minimum allowed length. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 833 | if ((policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) { |
| 834 | return PSA_MAC_TRUNCATED_LENGTH(policy_alg) <= |
| 835 | requested_output_length; |
Steven Cooreman | 5ad4bf7 | 2021-03-02 15:11:57 +0100 | [diff] [blame] | 836 | } |
Gilles Peskine | d6f371b | 2019-05-10 19:33:38 +0200 | [diff] [blame] | 837 | } |
Steven Cooreman | ce48e85 | 2020-10-05 16:02:45 +0200 | [diff] [blame] | 838 | /* If policy_alg is a generic key agreement operation, then using it for |
Steven Cooreman | fa5e631 | 2020-10-15 17:07:12 +0200 | [diff] [blame] | 839 | * a key derivation with that key agreement should also be allowed. This |
| 840 | * behaviour is expected to be defined in a future specification version. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 841 | if (PSA_ALG_IS_RAW_KEY_AGREEMENT(policy_alg) && |
| 842 | PSA_ALG_IS_KEY_AGREEMENT(requested_alg)) { |
| 843 | return PSA_ALG_KEY_AGREEMENT_GET_BASE(requested_alg) == |
| 844 | policy_alg; |
Steven Cooreman | ce48e85 | 2020-10-05 16:02:45 +0200 | [diff] [blame] | 845 | } |
Steven Cooreman | b3ce815 | 2021-02-18 12:03:50 +0100 | [diff] [blame] | 846 | /* If it isn't explicitly permitted, it's forbidden. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 847 | return 0; |
Gilles Peskine | d6f371b | 2019-05-10 19:33:38 +0200 | [diff] [blame] | 848 | } |
| 849 | |
Gilles Peskine | 30f77cd | 2019-01-14 16:06:39 +0100 | [diff] [blame] | 850 | /** Test whether a policy permits an algorithm. |
| 851 | * |
| 852 | * The caller must test usage flags separately. |
Steven Cooreman | 7e39f05 | 2021-02-23 14:18:32 +0100 | [diff] [blame] | 853 | * |
Steven Cooreman | 5a17267 | 2021-03-02 21:27:42 +0100 | [diff] [blame] | 854 | * \note This function requires providing the key type for which the policy is |
| 855 | * being validated, since some algorithm policy definitions (e.g. MAC) |
| 856 | * have different properties depending on what kind of cipher it is |
| 857 | * combined with. |
| 858 | * |
Steven Cooreman | 7e39f05 | 2021-02-23 14:18:32 +0100 | [diff] [blame] | 859 | * \retval PSA_SUCCESS When \p alg is a specific algorithm |
| 860 | * allowed by the \p policy. |
| 861 | * \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm |
| 862 | * \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but |
| 863 | * the \p policy does not allow it. |
Gilles Peskine | 30f77cd | 2019-01-14 16:06:39 +0100 | [diff] [blame] | 864 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 865 | static psa_status_t psa_key_policy_permits(const psa_key_policy_t *policy, |
| 866 | psa_key_type_t key_type, |
| 867 | psa_algorithm_t alg) |
Gilles Peskine | 30f77cd | 2019-01-14 16:06:39 +0100 | [diff] [blame] | 868 | { |
Steven Cooreman | d788fab | 2021-02-25 11:29:17 +0100 | [diff] [blame] | 869 | /* '0' is not a valid algorithm */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 870 | if (alg == 0) { |
| 871 | return PSA_ERROR_INVALID_ARGUMENT; |
| 872 | } |
Steven Cooreman | d788fab | 2021-02-25 11:29:17 +0100 | [diff] [blame] | 873 | |
Steven Cooreman | 7e39f05 | 2021-02-23 14:18:32 +0100 | [diff] [blame] | 874 | /* A requested algorithm cannot be a wildcard. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 875 | if (PSA_ALG_IS_WILDCARD(alg)) { |
| 876 | return PSA_ERROR_INVALID_ARGUMENT; |
| 877 | } |
Steven Cooreman | 7e39f05 | 2021-02-23 14:18:32 +0100 | [diff] [blame] | 878 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 879 | if (psa_key_algorithm_permits(key_type, policy->alg, alg) || |
| 880 | psa_key_algorithm_permits(key_type, policy->alg2, alg)) { |
| 881 | return PSA_SUCCESS; |
| 882 | } else { |
| 883 | return PSA_ERROR_NOT_PERMITTED; |
| 884 | } |
Gilles Peskine | 30f77cd | 2019-01-14 16:06:39 +0100 | [diff] [blame] | 885 | } |
| 886 | |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 887 | /** Restrict a key policy based on a constraint. |
| 888 | * |
Steven Cooreman | 5a17267 | 2021-03-02 21:27:42 +0100 | [diff] [blame] | 889 | * \note This function requires providing the key type for which the policy is |
| 890 | * being restricted, since some algorithm policy definitions (e.g. MAC) |
| 891 | * have different properties depending on what kind of cipher it is |
| 892 | * combined with. |
| 893 | * |
Steven Cooreman | 1ac5ce3 | 2021-03-02 16:34:49 +0100 | [diff] [blame] | 894 | * \param[in] key_type The key type for which to restrict the policy |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 895 | * \param[in,out] policy The policy to restrict. |
| 896 | * \param[in] constraint The policy constraint to apply. |
| 897 | * |
| 898 | * \retval #PSA_SUCCESS |
| 899 | * \c *policy contains the intersection of the original value of |
| 900 | * \c *policy and \c *constraint. |
| 901 | * \retval #PSA_ERROR_INVALID_ARGUMENT |
Steven Cooreman | 1ac5ce3 | 2021-03-02 16:34:49 +0100 | [diff] [blame] | 902 | * \c key_type, \c *policy and \c *constraint are incompatible. |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 903 | * \c *policy is unchanged. |
| 904 | */ |
| 905 | static psa_status_t psa_restrict_key_policy( |
Steven Cooreman | 1ac5ce3 | 2021-03-02 16:34:49 +0100 | [diff] [blame] | 906 | psa_key_type_t key_type, |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 907 | psa_key_policy_t *policy, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 908 | const psa_key_policy_t *constraint) |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 909 | { |
| 910 | psa_algorithm_t intersection_alg = |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 911 | psa_key_policy_algorithm_intersection(key_type, policy->alg, |
| 912 | constraint->alg); |
Gilles Peskine | d6f371b | 2019-05-10 19:33:38 +0200 | [diff] [blame] | 913 | psa_algorithm_t intersection_alg2 = |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 914 | psa_key_policy_algorithm_intersection(key_type, policy->alg2, |
| 915 | constraint->alg2); |
| 916 | if (intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0) { |
| 917 | return PSA_ERROR_INVALID_ARGUMENT; |
| 918 | } |
| 919 | if (intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0) { |
| 920 | return PSA_ERROR_INVALID_ARGUMENT; |
| 921 | } |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 922 | policy->usage &= constraint->usage; |
| 923 | policy->alg = intersection_alg; |
Gilles Peskine | d6f371b | 2019-05-10 19:33:38 +0200 | [diff] [blame] | 924 | policy->alg2 = intersection_alg2; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 925 | return PSA_SUCCESS; |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 926 | } |
| 927 | |
Przemek Stekiel | 061f694 | 2022-11-30 10:51:35 +0100 | [diff] [blame] | 928 | /** Get the description of a key given its identifier and policy constraints |
| 929 | * and lock it. |
| 930 | * |
| 931 | * The key must have allow all the usage flags set in \p usage. If \p alg is |
| 932 | * nonzero, the key must allow operations with this algorithm. If \p alg is |
| 933 | * zero, the algorithm is not checked. |
| 934 | * |
| 935 | * In case of a persistent key, the function loads the description of the key |
| 936 | * into a key slot if not already done. |
| 937 | * |
| 938 | * On success, the returned key slot is locked. It is the responsibility of |
| 939 | * the caller to unlock the key slot when it does not access it anymore. |
| 940 | */ |
| 941 | static psa_status_t psa_get_and_lock_key_slot_with_policy( |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 942 | mbedtls_svc_key_id_t key, |
| 943 | psa_key_slot_t **p_slot, |
| 944 | psa_key_usage_t usage, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 945 | psa_algorithm_t alg) |
Darryl Green | 06fd18d | 2018-07-16 11:21:11 +0100 | [diff] [blame] | 946 | { |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 947 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | 9a5b812 | 2022-12-22 13:34:47 +0100 | [diff] [blame] | 948 | psa_key_slot_t *slot = NULL; |
Darryl Green | 06fd18d | 2018-07-16 11:21:11 +0100 | [diff] [blame] | 949 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 950 | status = psa_get_and_lock_key_slot(key, p_slot); |
| 951 | if (status != PSA_SUCCESS) { |
| 952 | return status; |
| 953 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 954 | slot = *p_slot; |
Darryl Green | 06fd18d | 2018-07-16 11:21:11 +0100 | [diff] [blame] | 955 | |
| 956 | /* Enforce that usage policy for the key slot contains all the flags |
| 957 | * required by the usage parameter. There is one exception: public |
| 958 | * keys can always be exported, so we treat public key objects as |
| 959 | * if they had the export flag. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 960 | if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) { |
Darryl Green | 06fd18d | 2018-07-16 11:21:11 +0100 | [diff] [blame] | 961 | usage &= ~PSA_KEY_USAGE_EXPORT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 962 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 963 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 964 | if ((slot->attr.policy.usage & usage) != usage) { |
Steven Cooreman | 328f11c | 2021-03-02 11:44:51 +0100 | [diff] [blame] | 965 | status = PSA_ERROR_NOT_PERMITTED; |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 966 | goto error; |
Steven Cooreman | 328f11c | 2021-03-02 11:44:51 +0100 | [diff] [blame] | 967 | } |
Gilles Peskine | 30f77cd | 2019-01-14 16:06:39 +0100 | [diff] [blame] | 968 | |
Shaun Case | 8b0ecbc | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 969 | /* Enforce that the usage policy permits the requested algorithm. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 970 | if (alg != 0) { |
| 971 | status = psa_key_policy_permits(&slot->attr.policy, |
| 972 | slot->attr.type, |
| 973 | alg); |
| 974 | if (status != PSA_SUCCESS) { |
Steven Cooreman | 7e39f05 | 2021-02-23 14:18:32 +0100 | [diff] [blame] | 975 | goto error; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 976 | } |
Steven Cooreman | 7e39f05 | 2021-02-23 14:18:32 +0100 | [diff] [blame] | 977 | } |
Darryl Green | 06fd18d | 2018-07-16 11:21:11 +0100 | [diff] [blame] | 978 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 979 | return PSA_SUCCESS; |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 980 | |
| 981 | error: |
| 982 | *p_slot = NULL; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 983 | psa_unlock_key_slot(slot); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 984 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 985 | return status; |
Darryl Green | 06fd18d | 2018-07-16 11:21:11 +0100 | [diff] [blame] | 986 | } |
Darryl Green | 940d72c | 2018-07-13 13:18:51 +0100 | [diff] [blame] | 987 | |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 988 | /** Get a key slot containing a transparent key and lock it. |
Gilles Peskine | 28f8f30 | 2019-07-24 13:30:31 +0200 | [diff] [blame] | 989 | * |
| 990 | * A transparent key is a key for which the key material is directly |
Ronald Cron | ddae0f5 | 2021-08-24 15:39:44 +0200 | [diff] [blame] | 991 | * available, as opposed to a key in a secure element and/or to be used |
| 992 | * by a secure element. |
Gilles Peskine | 28f8f30 | 2019-07-24 13:30:31 +0200 | [diff] [blame] | 993 | * |
Ronald Cron | ddae0f5 | 2021-08-24 15:39:44 +0200 | [diff] [blame] | 994 | * This is a temporary function that may be used instead of |
| 995 | * psa_get_and_lock_key_slot_with_policy() when there is no opaque key support |
| 996 | * for a cryptographic operation. |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 997 | * |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 998 | * On success, the returned key slot is locked. It is the responsibility of the |
| 999 | * caller to unlock the key slot when it does not access it anymore. |
Gilles Peskine | 28f8f30 | 2019-07-24 13:30:31 +0200 | [diff] [blame] | 1000 | */ |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 1001 | static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy( |
| 1002 | mbedtls_svc_key_id_t key, |
| 1003 | psa_key_slot_t **p_slot, |
| 1004 | psa_key_usage_t usage, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1005 | psa_algorithm_t alg) |
Gilles Peskine | 28f8f30 | 2019-07-24 13:30:31 +0200 | [diff] [blame] | 1006 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1007 | psa_status_t status = psa_get_and_lock_key_slot_with_policy(key, p_slot, |
| 1008 | usage, alg); |
| 1009 | if (status != PSA_SUCCESS) { |
| 1010 | return status; |
Gilles Peskine | 28f8f30 | 2019-07-24 13:30:31 +0200 | [diff] [blame] | 1011 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 1012 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1013 | if (psa_key_lifetime_is_external((*p_slot)->attr.lifetime)) { |
| 1014 | psa_unlock_key_slot(*p_slot); |
| 1015 | *p_slot = NULL; |
| 1016 | return PSA_ERROR_NOT_SUPPORTED; |
| 1017 | } |
| 1018 | |
| 1019 | return PSA_SUCCESS; |
Gilles Peskine | 28f8f30 | 2019-07-24 13:30:31 +0200 | [diff] [blame] | 1020 | } |
Gilles Peskine | 28f8f30 | 2019-07-24 13:30:31 +0200 | [diff] [blame] | 1021 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1022 | psa_status_t psa_remove_key_data_from_memory(psa_key_slot_t *slot) |
Darryl Green | 40225ba | 2018-11-15 14:48:15 +0000 | [diff] [blame] | 1023 | { |
Ronald Cron | ea0f8a6 | 2020-11-25 17:52:23 +0100 | [diff] [blame] | 1024 | /* Data pointer will always be either a valid pointer or NULL in an |
| 1025 | * initialized slot, so we can just free it. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1026 | if (slot->key.data != NULL) { |
| 1027 | mbedtls_platform_zeroize(slot->key.data, slot->key.bytes); |
| 1028 | } |
Ronald Cron | ea0f8a6 | 2020-11-25 17:52:23 +0100 | [diff] [blame] | 1029 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1030 | mbedtls_free(slot->key.data); |
Ronald Cron | ea0f8a6 | 2020-11-25 17:52:23 +0100 | [diff] [blame] | 1031 | slot->key.data = NULL; |
| 1032 | slot->key.bytes = 0; |
Darryl Green | 40225ba | 2018-11-15 14:48:15 +0000 | [diff] [blame] | 1033 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1034 | return PSA_SUCCESS; |
Darryl Green | 40225ba | 2018-11-15 14:48:15 +0000 | [diff] [blame] | 1035 | } |
| 1036 | |
Gilles Peskine | f77ed1f | 2018-12-03 11:58:46 +0100 | [diff] [blame] | 1037 | /** Completely wipe a slot in memory, including its policy. |
| 1038 | * Persistent storage is not affected. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1039 | psa_status_t psa_wipe_key_slot(psa_key_slot_t *slot) |
Gilles Peskine | f77ed1f | 2018-12-03 11:58:46 +0100 | [diff] [blame] | 1040 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1041 | psa_status_t status = psa_remove_key_data_from_memory(slot); |
Ronald Cron | ddd3d05 | 2020-10-30 14:07:07 +0100 | [diff] [blame] | 1042 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1043 | /* |
| 1044 | * As the return error code may not be handled in case of multiple errors, |
| 1045 | * do our best to report an unexpected lock counter. Assert with |
| 1046 | * MBEDTLS_TEST_HOOK_TEST_ASSERT that the lock counter is equal to one: |
| 1047 | * if the MBEDTLS_TEST_HOOKS configuration option is enabled and the |
| 1048 | * function is called as part of the execution of a test suite, the |
| 1049 | * execution of the test suite is stopped in error if the assertion fails. |
| 1050 | */ |
| 1051 | if (slot->lock_count != 1) { |
| 1052 | MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->lock_count == 1); |
Ronald Cron | ddd3d05 | 2020-10-30 14:07:07 +0100 | [diff] [blame] | 1053 | status = PSA_ERROR_CORRUPTION_DETECTED; |
| 1054 | } |
| 1055 | |
Gilles Peskine | 3f7cd62 | 2019-08-13 15:01:08 +0200 | [diff] [blame] | 1056 | /* Multipart operations may still be using the key. This is safe |
| 1057 | * because all multipart operation objects are independent from |
| 1058 | * the key slot: if they need to access the key after the setup |
| 1059 | * phase, they have a copy of the key. Note that this means that |
| 1060 | * key material can linger until all operations are completed. */ |
Gilles Peskine | f77ed1f | 2018-12-03 11:58:46 +0100 | [diff] [blame] | 1061 | /* At this point, key material and other type-specific content has |
| 1062 | * been wiped. Clear remaining metadata. We can call memset and not |
| 1063 | * zeroize because the metadata is not particularly sensitive. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1064 | memset(slot, 0, sizeof(*slot)); |
| 1065 | return status; |
Gilles Peskine | f77ed1f | 2018-12-03 11:58:46 +0100 | [diff] [blame] | 1066 | } |
| 1067 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1068 | psa_status_t psa_destroy_key(mbedtls_svc_key_id_t key) |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 1069 | { |
Gilles Peskine | 2f060a8 | 2018-12-04 17:12:32 +0100 | [diff] [blame] | 1070 | psa_key_slot_t *slot; |
Gilles Peskine | 4b7f340 | 2019-08-13 15:58:36 +0200 | [diff] [blame] | 1071 | psa_status_t status; /* status of the last operation */ |
| 1072 | psa_status_t overall_status = PSA_SUCCESS; |
Gilles Peskine | 354f767 | 2019-07-12 23:46:38 +0200 | [diff] [blame] | 1073 | #if defined(MBEDTLS_PSA_CRYPTO_SE_C) |
| 1074 | psa_se_drv_table_entry_t *driver; |
| 1075 | #endif /* MBEDTLS_PSA_CRYPTO_SE_C */ |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 1076 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1077 | if (mbedtls_svc_key_id_is_null(key)) { |
| 1078 | return PSA_SUCCESS; |
| 1079 | } |
Gilles Peskine | 1841cf4 | 2019-10-08 15:48:25 +0200 | [diff] [blame] | 1080 | |
Ronald Cron | f291111 | 2020-10-29 17:51:10 +0100 | [diff] [blame] | 1081 | /* |
Ronald Cron | 19daca9 | 2020-11-10 18:08:03 +0100 | [diff] [blame] | 1082 | * Get the description of the key in a key slot. In case of a persistent |
Ronald Cron | f291111 | 2020-10-29 17:51:10 +0100 | [diff] [blame] | 1083 | * key, this will load the key description from persistent memory if not |
| 1084 | * done yet. We cannot avoid this loading as without it we don't know if |
| 1085 | * the key is operated by an SE or not and this information is needed by |
| 1086 | * the current implementation. |
| 1087 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1088 | status = psa_get_and_lock_key_slot(key, &slot); |
| 1089 | if (status != PSA_SUCCESS) { |
| 1090 | return status; |
| 1091 | } |
Gilles Peskine | 354f767 | 2019-07-12 23:46:38 +0200 | [diff] [blame] | 1092 | |
Ronald Cron | f291111 | 2020-10-29 17:51:10 +0100 | [diff] [blame] | 1093 | /* |
| 1094 | * If the key slot containing the key description is under access by the |
| 1095 | * library (apart from the present access), the key cannot be destroyed |
| 1096 | * yet. For the time being, just return in error. Eventually (to be |
| 1097 | * implemented), the key should be destroyed when all accesses have |
| 1098 | * stopped. |
| 1099 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1100 | if (slot->lock_count > 1) { |
| 1101 | psa_unlock_key_slot(slot); |
| 1102 | return PSA_ERROR_GENERIC_ERROR; |
Ronald Cron | f291111 | 2020-10-29 17:51:10 +0100 | [diff] [blame] | 1103 | } |
| 1104 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1105 | if (PSA_KEY_LIFETIME_IS_READ_ONLY(slot->attr.lifetime)) { |
Gilles Peskine | 6687cd0 | 2021-04-21 22:32:05 +0200 | [diff] [blame] | 1106 | /* Refuse the destruction of a read-only key (which may or may not work |
| 1107 | * if we attempt it, depending on whether the key is merely read-only |
| 1108 | * by policy or actually physically read-only). |
Gilles Peskine | f9a046e | 2021-06-07 23:27:54 +0200 | [diff] [blame] | 1109 | * Just do the best we can, which is to wipe the copy in memory |
| 1110 | * (done in this function's cleanup code). */ |
| 1111 | overall_status = PSA_ERROR_NOT_PERMITTED; |
| 1112 | goto exit; |
Gilles Peskine | 6687cd0 | 2021-04-21 22:32:05 +0200 | [diff] [blame] | 1113 | } |
| 1114 | |
Gilles Peskine | 354f767 | 2019-07-12 23:46:38 +0200 | [diff] [blame] | 1115 | #if defined(MBEDTLS_PSA_CRYPTO_SE_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1116 | driver = psa_get_se_driver_entry(slot->attr.lifetime); |
| 1117 | if (driver != NULL) { |
Gilles Peskine | 60450a4 | 2019-07-25 11:32:45 +0200 | [diff] [blame] | 1118 | /* For a key in a secure element, we need to do three things: |
| 1119 | * remove the key file in internal storage, destroy the |
| 1120 | * key inside the secure element, and update the driver's |
| 1121 | * persistent data. Start a transaction that will encompass these |
| 1122 | * three actions. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1123 | psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_DESTROY_KEY); |
Gilles Peskine | 8e33870 | 2019-07-30 20:06:31 +0200 | [diff] [blame] | 1124 | psa_crypto_transaction.key.lifetime = slot->attr.lifetime; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1125 | psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number(slot); |
Gilles Peskine | 8e33870 | 2019-07-30 20:06:31 +0200 | [diff] [blame] | 1126 | psa_crypto_transaction.key.id = slot->attr.id; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1127 | status = psa_crypto_save_transaction(); |
| 1128 | if (status != PSA_SUCCESS) { |
| 1129 | (void) psa_crypto_stop_transaction(); |
Gilles Peskine | 4b7f340 | 2019-08-13 15:58:36 +0200 | [diff] [blame] | 1130 | /* We should still try to destroy the key in the secure |
| 1131 | * element and the key metadata in storage. This is especially |
| 1132 | * important if the error is that the storage is full. |
| 1133 | * But how to do it exactly without risking an inconsistent |
| 1134 | * state after a reset? |
| 1135 | * https://github.com/ARMmbed/mbed-crypto/issues/215 |
| 1136 | */ |
| 1137 | overall_status = status; |
| 1138 | goto exit; |
Gilles Peskine | fc76265 | 2019-07-22 19:30:34 +0200 | [diff] [blame] | 1139 | } |
| 1140 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1141 | status = psa_destroy_se_key(driver, |
| 1142 | psa_key_slot_get_slot_number(slot)); |
| 1143 | if (overall_status == PSA_SUCCESS) { |
Gilles Peskine | 4b7f340 | 2019-08-13 15:58:36 +0200 | [diff] [blame] | 1144 | overall_status = status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1145 | } |
Gilles Peskine | fc76265 | 2019-07-22 19:30:34 +0200 | [diff] [blame] | 1146 | } |
Gilles Peskine | 354f767 | 2019-07-12 23:46:38 +0200 | [diff] [blame] | 1147 | #endif /* MBEDTLS_PSA_CRYPTO_SE_C */ |
| 1148 | |
Darryl Green | d49a499 | 2018-06-18 17:27:26 +0100 | [diff] [blame] | 1149 | #if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1150 | if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) { |
| 1151 | status = psa_destroy_persistent_key(slot->attr.id); |
| 1152 | if (overall_status == PSA_SUCCESS) { |
Gilles Peskine | 4b7f340 | 2019-08-13 15:58:36 +0200 | [diff] [blame] | 1153 | overall_status = status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1154 | } |
Gilles Peskine | 4b7f340 | 2019-08-13 15:58:36 +0200 | [diff] [blame] | 1155 | |
Gilles Peskine | 9ce31c4 | 2019-08-13 15:14:20 +0200 | [diff] [blame] | 1156 | /* TODO: other slots may have a copy of the same key. We should |
| 1157 | * invalidate them. |
| 1158 | * https://github.com/ARMmbed/mbed-crypto/issues/214 |
| 1159 | */ |
Darryl Green | d49a499 | 2018-06-18 17:27:26 +0100 | [diff] [blame] | 1160 | } |
| 1161 | #endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */ |
Gilles Peskine | 354f767 | 2019-07-12 23:46:38 +0200 | [diff] [blame] | 1162 | |
Gilles Peskine | fc76265 | 2019-07-22 19:30:34 +0200 | [diff] [blame] | 1163 | #if defined(MBEDTLS_PSA_CRYPTO_SE_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1164 | if (driver != NULL) { |
| 1165 | status = psa_save_se_persistent_data(driver); |
| 1166 | if (overall_status == PSA_SUCCESS) { |
Gilles Peskine | 4b7f340 | 2019-08-13 15:58:36 +0200 | [diff] [blame] | 1167 | overall_status = status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1168 | } |
| 1169 | status = psa_crypto_stop_transaction(); |
| 1170 | if (overall_status == PSA_SUCCESS) { |
Gilles Peskine | 4b7f340 | 2019-08-13 15:58:36 +0200 | [diff] [blame] | 1171 | overall_status = status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1172 | } |
Gilles Peskine | fc76265 | 2019-07-22 19:30:34 +0200 | [diff] [blame] | 1173 | } |
| 1174 | #endif /* MBEDTLS_PSA_CRYPTO_SE_C */ |
| 1175 | |
Gilles Peskine | 4b7f340 | 2019-08-13 15:58:36 +0200 | [diff] [blame] | 1176 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1177 | status = psa_wipe_key_slot(slot); |
Gilles Peskine | 4b7f340 | 2019-08-13 15:58:36 +0200 | [diff] [blame] | 1178 | /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1179 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 4b7f340 | 2019-08-13 15:58:36 +0200 | [diff] [blame] | 1180 | overall_status = status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1181 | } |
| 1182 | return overall_status; |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 1183 | } |
| 1184 | |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 1185 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \ |
John Durkop | 0e00519 | 2020-10-31 22:06:54 -0700 | [diff] [blame] | 1186 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1187 | static psa_status_t psa_get_rsa_public_exponent( |
| 1188 | const mbedtls_rsa_context *rsa, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1189 | psa_key_attributes_t *attributes) |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1190 | { |
| 1191 | mbedtls_mpi mpi; |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1192 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1193 | uint8_t *buffer = NULL; |
| 1194 | size_t buflen; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1195 | mbedtls_mpi_init(&mpi); |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1196 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1197 | ret = mbedtls_rsa_export(rsa, NULL, NULL, NULL, NULL, &mpi); |
| 1198 | if (ret != 0) { |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1199 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1200 | } |
| 1201 | if (mbedtls_mpi_cmp_int(&mpi, 65537) == 0) { |
Gilles Peskine | 772c8b1 | 2019-04-26 17:37:21 +0200 | [diff] [blame] | 1202 | /* It's the default value, which is reported as an empty string, |
| 1203 | * so there's nothing to do. */ |
| 1204 | goto exit; |
| 1205 | } |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1206 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1207 | buflen = mbedtls_mpi_size(&mpi); |
| 1208 | buffer = mbedtls_calloc(1, buflen); |
| 1209 | if (buffer == NULL) { |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1210 | ret = MBEDTLS_ERR_MPI_ALLOC_FAILED; |
| 1211 | goto exit; |
| 1212 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1213 | ret = mbedtls_mpi_write_binary(&mpi, buffer, buflen); |
| 1214 | if (ret != 0) { |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1215 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1216 | } |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1217 | attributes->domain_parameters = buffer; |
| 1218 | attributes->domain_parameters_size = buflen; |
| 1219 | |
| 1220 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1221 | mbedtls_mpi_free(&mpi); |
| 1222 | if (ret != 0) { |
| 1223 | mbedtls_free(buffer); |
| 1224 | } |
| 1225 | return mbedtls_to_psa_error(ret); |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1226 | } |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 1227 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || |
John Durkop | 9814fa2 | 2020-11-04 12:28:15 -0800 | [diff] [blame] | 1228 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */ |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1229 | |
Gilles Peskine | bfd322f | 2019-07-23 11:58:03 +0200 | [diff] [blame] | 1230 | /** Retrieve all the publicly-accessible attributes of a key. |
| 1231 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1232 | psa_status_t psa_get_key_attributes(mbedtls_svc_key_id_t key, |
| 1233 | psa_key_attributes_t *attributes) |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 1234 | { |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 1235 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 1236 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 2f060a8 | 2018-12-04 17:12:32 +0100 | [diff] [blame] | 1237 | psa_key_slot_t *slot; |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 1238 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1239 | psa_reset_key_attributes(attributes); |
Gilles Peskine | 8c8f2ab | 2019-04-18 21:44:46 +0200 | [diff] [blame] | 1240 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1241 | status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0); |
| 1242 | if (status != PSA_SUCCESS) { |
| 1243 | return status; |
| 1244 | } |
Gilles Peskine | b870b18 | 2018-07-06 16:02:09 +0200 | [diff] [blame] | 1245 | |
Gilles Peskine | 76aa09c | 2019-07-31 14:15:34 +0200 | [diff] [blame] | 1246 | attributes->core = slot->attr; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1247 | attributes->core.flags &= (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY | |
| 1248 | MBEDTLS_PSA_KA_MASK_DUAL_USE); |
Gilles Peskine | c8000c0 | 2019-08-02 20:15:51 +0200 | [diff] [blame] | 1249 | |
| 1250 | #if defined(MBEDTLS_PSA_CRYPTO_SE_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1251 | if (psa_get_se_driver_entry(slot->attr.lifetime) != NULL) { |
| 1252 | psa_set_key_slot_number(attributes, |
| 1253 | psa_key_slot_get_slot_number(slot)); |
| 1254 | } |
Gilles Peskine | c8000c0 | 2019-08-02 20:15:51 +0200 | [diff] [blame] | 1255 | #endif /* MBEDTLS_PSA_CRYPTO_SE_C */ |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1256 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1257 | switch (slot->attr.type) { |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 1258 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \ |
John Durkop | 0e00519 | 2020-10-31 22:06:54 -0700 | [diff] [blame] | 1259 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) |
Gilles Peskine | c93b80c | 2019-05-16 19:39:54 +0200 | [diff] [blame] | 1260 | case PSA_KEY_TYPE_RSA_KEY_PAIR: |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1261 | case PSA_KEY_TYPE_RSA_PUBLIC_KEY: |
Janos Follath | 1d57a20 | 2019-08-13 12:15:34 +0100 | [diff] [blame] | 1262 | /* TODO: reporting the public exponent for opaque keys |
Gilles Peskine | c9d7f94 | 2019-08-13 16:17:16 +0200 | [diff] [blame] | 1263 | * is not yet implemented. |
| 1264 | * https://github.com/ARMmbed/mbed-crypto/issues/216 |
| 1265 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1266 | if (!psa_key_lifetime_is_external(slot->attr.lifetime)) { |
Steven Cooreman | a2371e5 | 2020-07-28 14:30:39 +0200 | [diff] [blame] | 1267 | mbedtls_rsa_context *rsa = NULL; |
Steven Cooreman | a01795d | 2020-07-24 22:48:15 +0200 | [diff] [blame] | 1268 | |
Ronald Cron | 9085708 | 2020-11-25 14:58:33 +0100 | [diff] [blame] | 1269 | status = mbedtls_psa_rsa_load_representation( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1270 | slot->attr.type, |
| 1271 | slot->key.data, |
| 1272 | slot->key.bytes, |
| 1273 | &rsa); |
| 1274 | if (status != PSA_SUCCESS) { |
Steven Cooreman | a01795d | 2020-07-24 22:48:15 +0200 | [diff] [blame] | 1275 | break; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1276 | } |
Steven Cooreman | a01795d | 2020-07-24 22:48:15 +0200 | [diff] [blame] | 1277 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1278 | status = psa_get_rsa_public_exponent(rsa, |
| 1279 | attributes); |
| 1280 | mbedtls_rsa_free(rsa); |
| 1281 | mbedtls_free(rsa); |
Steven Cooreman | a01795d | 2020-07-24 22:48:15 +0200 | [diff] [blame] | 1282 | } |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1283 | break; |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 1284 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || |
John Durkop | 9814fa2 | 2020-11-04 12:28:15 -0800 | [diff] [blame] | 1285 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */ |
Gilles Peskine | b699f07 | 2019-04-26 16:06:02 +0200 | [diff] [blame] | 1286 | default: |
| 1287 | /* Nothing else to do. */ |
| 1288 | break; |
| 1289 | } |
| 1290 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1291 | if (status != PSA_SUCCESS) { |
| 1292 | psa_reset_key_attributes(attributes); |
| 1293 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 1294 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1295 | unlock_status = psa_unlock_key_slot(slot); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 1296 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1297 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 1298 | } |
| 1299 | |
Gilles Peskine | c8000c0 | 2019-08-02 20:15:51 +0200 | [diff] [blame] | 1300 | #if defined(MBEDTLS_PSA_CRYPTO_SE_C) |
| 1301 | psa_status_t psa_get_key_slot_number( |
| 1302 | const psa_key_attributes_t *attributes, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1303 | psa_key_slot_number_t *slot_number) |
Gilles Peskine | c8000c0 | 2019-08-02 20:15:51 +0200 | [diff] [blame] | 1304 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1305 | if (attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER) { |
Gilles Peskine | c8000c0 | 2019-08-02 20:15:51 +0200 | [diff] [blame] | 1306 | *slot_number = attributes->slot_number; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1307 | return PSA_SUCCESS; |
| 1308 | } else { |
| 1309 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | c8000c0 | 2019-08-02 20:15:51 +0200 | [diff] [blame] | 1310 | } |
Gilles Peskine | c8000c0 | 2019-08-02 20:15:51 +0200 | [diff] [blame] | 1311 | } |
| 1312 | #endif /* MBEDTLS_PSA_CRYPTO_SE_C */ |
| 1313 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1314 | static psa_status_t psa_export_key_buffer_internal(const uint8_t *key_buffer, |
| 1315 | size_t key_buffer_size, |
| 1316 | uint8_t *data, |
| 1317 | size_t data_size, |
| 1318 | size_t *data_length) |
Steven Cooreman | a01795d | 2020-07-24 22:48:15 +0200 | [diff] [blame] | 1319 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1320 | if (key_buffer_size > data_size) { |
| 1321 | return PSA_ERROR_BUFFER_TOO_SMALL; |
| 1322 | } |
| 1323 | memcpy(data, key_buffer, key_buffer_size); |
| 1324 | memset(data + key_buffer_size, 0, |
| 1325 | data_size - key_buffer_size); |
Ronald Cron | d18b5f8 | 2020-11-25 16:46:05 +0100 | [diff] [blame] | 1326 | *data_length = key_buffer_size; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1327 | return PSA_SUCCESS; |
Steven Cooreman | a01795d | 2020-07-24 22:48:15 +0200 | [diff] [blame] | 1328 | } |
| 1329 | |
Ronald Cron | 7285cda | 2020-11-26 14:46:37 +0100 | [diff] [blame] | 1330 | psa_status_t psa_export_key_internal( |
Ronald Cron | d18b5f8 | 2020-11-25 16:46:05 +0100 | [diff] [blame] | 1331 | const psa_key_attributes_t *attributes, |
| 1332 | const uint8_t *key_buffer, size_t key_buffer_size, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1333 | uint8_t *data, size_t data_size, size_t *data_length) |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 1334 | { |
Ronald Cron | d18b5f8 | 2020-11-25 16:46:05 +0100 | [diff] [blame] | 1335 | psa_key_type_t type = attributes->core.type; |
| 1336 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1337 | if (key_type_is_raw_bytes(type) || |
| 1338 | PSA_KEY_TYPE_IS_RSA(type) || |
Przemek Stekiel | 472b3f3 | 2022-12-01 14:38:49 +0100 | [diff] [blame] | 1339 | PSA_KEY_TYPE_IS_ECC(type) || |
| 1340 | PSA_KEY_TYPE_IS_DH(type)) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1341 | return psa_export_key_buffer_internal( |
| 1342 | key_buffer, key_buffer_size, |
| 1343 | data, data_size, data_length); |
| 1344 | } else { |
Ronald Cron | 9486f9d | 2020-11-26 13:36:23 +0100 | [diff] [blame] | 1345 | /* This shouldn't happen in the reference implementation, but |
| 1346 | it is valid for a special-purpose implementation to omit |
| 1347 | support for exporting certain key types. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1348 | return PSA_ERROR_NOT_SUPPORTED; |
Ronald Cron | 9486f9d | 2020-11-26 13:36:23 +0100 | [diff] [blame] | 1349 | } |
| 1350 | } |
| 1351 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1352 | psa_status_t psa_export_key(mbedtls_svc_key_id_t key, |
| 1353 | uint8_t *data, |
| 1354 | size_t data_size, |
| 1355 | size_t *data_length) |
Ronald Cron | 9486f9d | 2020-11-26 13:36:23 +0100 | [diff] [blame] | 1356 | { |
| 1357 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 1358 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
| 1359 | psa_key_slot_t *slot; |
| 1360 | |
Ronald Cron | e907e55 | 2021-01-18 13:22:38 +0100 | [diff] [blame] | 1361 | /* Reject a zero-length output buffer now, since this can never be a |
| 1362 | * valid key representation. This way we know that data must be a valid |
| 1363 | * pointer and we can do things like memset(data, ..., data_size). */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1364 | if (data_size == 0) { |
| 1365 | return PSA_ERROR_BUFFER_TOO_SMALL; |
| 1366 | } |
Ronald Cron | e907e55 | 2021-01-18 13:22:38 +0100 | [diff] [blame] | 1367 | |
Ronald Cron | 9486f9d | 2020-11-26 13:36:23 +0100 | [diff] [blame] | 1368 | /* Set the key to empty now, so that even when there are errors, we always |
| 1369 | * set data_length to a value between 0 and data_size. On error, setting |
| 1370 | * the key to empty is a good choice because an empty key representation is |
| 1371 | * unlikely to be accepted anywhere. */ |
Jaeden Amero | f24c7f8 | 2018-06-27 17:20:43 +0100 | [diff] [blame] | 1372 | *data_length = 0; |
| 1373 | |
Ronald Cron | 9486f9d | 2020-11-26 13:36:23 +0100 | [diff] [blame] | 1374 | /* Export requires the EXPORT flag. There is an exception for public keys, |
| 1375 | * which don't require any flag, but |
| 1376 | * psa_get_and_lock_key_slot_with_policy() takes care of this. |
| 1377 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1378 | status = psa_get_and_lock_key_slot_with_policy(key, &slot, |
| 1379 | PSA_KEY_USAGE_EXPORT, 0); |
| 1380 | if (status != PSA_SUCCESS) { |
| 1381 | return status; |
| 1382 | } |
mohammad1603 | 06e7920 | 2018-03-28 13:17:44 +0300 | [diff] [blame] | 1383 | |
Ronald Cron | d18b5f8 | 2020-11-25 16:46:05 +0100 | [diff] [blame] | 1384 | psa_key_attributes_t attributes = { |
| 1385 | .core = slot->attr |
| 1386 | }; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1387 | status = psa_driver_wrapper_export_key(&attributes, |
| 1388 | slot->key.data, slot->key.bytes, |
| 1389 | data, data_size, data_length); |
Ronald Cron | 9486f9d | 2020-11-26 13:36:23 +0100 | [diff] [blame] | 1390 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1391 | unlock_status = psa_unlock_key_slot(slot); |
Ronald Cron | 9486f9d | 2020-11-26 13:36:23 +0100 | [diff] [blame] | 1392 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1393 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Ronald Cron | 9486f9d | 2020-11-26 13:36:23 +0100 | [diff] [blame] | 1394 | } |
| 1395 | |
Ronald Cron | 7285cda | 2020-11-26 14:46:37 +0100 | [diff] [blame] | 1396 | psa_status_t psa_export_public_key_internal( |
Ronald Cron | d18b5f8 | 2020-11-25 16:46:05 +0100 | [diff] [blame] | 1397 | const psa_key_attributes_t *attributes, |
| 1398 | const uint8_t *key_buffer, |
| 1399 | size_t key_buffer_size, |
| 1400 | uint8_t *data, |
| 1401 | size_t data_size, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1402 | size_t *data_length) |
Ronald Cron | 9486f9d | 2020-11-26 13:36:23 +0100 | [diff] [blame] | 1403 | { |
Ronald Cron | d18b5f8 | 2020-11-25 16:46:05 +0100 | [diff] [blame] | 1404 | psa_key_type_t type = attributes->core.type; |
Ronald Cron | d18b5f8 | 2020-11-25 16:46:05 +0100 | [diff] [blame] | 1405 | |
Przemek Stekiel | c80e750 | 2023-05-11 11:14:25 +0200 | [diff] [blame] | 1406 | if (PSA_KEY_TYPE_IS_RSA(type)) { |
John Durkop | 0e00519 | 2020-10-31 22:06:54 -0700 | [diff] [blame] | 1407 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \ |
Przemek Stekiel | 134cc2e | 2023-05-05 10:13:37 +0200 | [diff] [blame] | 1408 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) |
| 1409 | return mbedtls_psa_rsa_export_public_key(attributes, |
| 1410 | key_buffer, |
| 1411 | key_buffer_size, |
| 1412 | data, |
| 1413 | data_size, |
| 1414 | data_length); |
Darryl Green | 9e2d7a0 | 2018-07-24 16:33:30 +0100 | [diff] [blame] | 1415 | #else |
Przemek Stekiel | 134cc2e | 2023-05-05 10:13:37 +0200 | [diff] [blame] | 1416 | /* We don't know how to convert a private RSA key to public. */ |
| 1417 | return PSA_ERROR_NOT_SUPPORTED; |
John Durkop | 9814fa2 | 2020-11-04 12:28:15 -0800 | [diff] [blame] | 1418 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || |
| 1419 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */ |
Przemek Stekiel | 6fd72b6 | 2023-04-27 10:20:56 +0200 | [diff] [blame] | 1420 | } else if (PSA_KEY_TYPE_IS_ECC(type)) { |
John Durkop | 6ba40d1 | 2020-11-10 08:50:04 -0800 | [diff] [blame] | 1421 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \ |
Przemek Stekiel | 134cc2e | 2023-05-05 10:13:37 +0200 | [diff] [blame] | 1422 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) |
| 1423 | return mbedtls_psa_ecp_export_public_key(attributes, |
| 1424 | key_buffer, |
| 1425 | key_buffer_size, |
| 1426 | data, |
| 1427 | data_size, |
| 1428 | data_length); |
Steven Cooreman | 560c28a | 2020-07-24 23:20:24 +0200 | [diff] [blame] | 1429 | #else |
Przemek Stekiel | 134cc2e | 2023-05-05 10:13:37 +0200 | [diff] [blame] | 1430 | /* We don't know how to convert a private ECC key to public */ |
| 1431 | return PSA_ERROR_NOT_SUPPORTED; |
John Durkop | 9814fa2 | 2020-11-04 12:28:15 -0800 | [diff] [blame] | 1432 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || |
| 1433 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */ |
Przemek Stekiel | 6fd72b6 | 2023-04-27 10:20:56 +0200 | [diff] [blame] | 1434 | } else if (PSA_KEY_TYPE_IS_DH(type)) { |
Przemek Stekiel | 6d85afa | 2023-04-28 11:42:17 +0200 | [diff] [blame] | 1435 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR) || \ |
| 1436 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) |
Przemek Stekiel | 134cc2e | 2023-05-05 10:13:37 +0200 | [diff] [blame] | 1437 | return mbedtls_psa_export_ffdh_public_key(attributes, |
| 1438 | key_buffer, |
| 1439 | key_buffer_size, |
| 1440 | data, data_size, |
| 1441 | data_length); |
Przemek Stekiel | 472b3f3 | 2022-12-01 14:38:49 +0100 | [diff] [blame] | 1442 | #else |
Przemek Stekiel | 472b3f3 | 2022-12-01 14:38:49 +0100 | [diff] [blame] | 1443 | return PSA_ERROR_NOT_SUPPORTED; |
Przemek Stekiel | 6d85afa | 2023-04-28 11:42:17 +0200 | [diff] [blame] | 1444 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR) || |
| 1445 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1446 | } else { |
Przemek Stekiel | 0b11ee0 | 2023-05-16 13:26:06 +0200 | [diff] [blame^] | 1447 | (void) key_buffer; |
| 1448 | (void) key_buffer_size; |
| 1449 | (void) data; |
| 1450 | (void) data_size; |
| 1451 | (void) data_length; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1452 | return PSA_ERROR_NOT_SUPPORTED; |
Steven Cooreman | 560c28a | 2020-07-24 23:20:24 +0200 | [diff] [blame] | 1453 | } |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 1454 | } |
Ronald Cron | d18b5f8 | 2020-11-25 16:46:05 +0100 | [diff] [blame] | 1455 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1456 | psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key, |
| 1457 | uint8_t *data, |
| 1458 | size_t data_size, |
| 1459 | size_t *data_length) |
Moran Peker | dd4ea38 | 2018-04-03 15:30:03 +0300 | [diff] [blame] | 1460 | { |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 1461 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 1462 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 2f060a8 | 2018-12-04 17:12:32 +0100 | [diff] [blame] | 1463 | psa_key_slot_t *slot; |
Darryl Green | dd8fb77 | 2018-11-07 16:00:44 +0000 | [diff] [blame] | 1464 | |
Ronald Cron | e907e55 | 2021-01-18 13:22:38 +0100 | [diff] [blame] | 1465 | /* Reject a zero-length output buffer now, since this can never be a |
| 1466 | * valid key representation. This way we know that data must be a valid |
| 1467 | * pointer and we can do things like memset(data, ..., data_size). */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1468 | if (data_size == 0) { |
| 1469 | return PSA_ERROR_BUFFER_TOO_SMALL; |
| 1470 | } |
Ronald Cron | e907e55 | 2021-01-18 13:22:38 +0100 | [diff] [blame] | 1471 | |
Darryl Green | dd8fb77 | 2018-11-07 16:00:44 +0000 | [diff] [blame] | 1472 | /* Set the key to empty now, so that even when there are errors, we always |
| 1473 | * set data_length to a value between 0 and data_size. On error, setting |
| 1474 | * the key to empty is a good choice because an empty key representation is |
| 1475 | * unlikely to be accepted anywhere. */ |
| 1476 | *data_length = 0; |
| 1477 | |
| 1478 | /* Exporting a public key doesn't require a usage flag. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1479 | status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0); |
| 1480 | if (status != PSA_SUCCESS) { |
| 1481 | return status; |
| 1482 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 1483 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1484 | if (!PSA_KEY_TYPE_IS_ASYMMETRIC(slot->attr.type)) { |
| 1485 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 1486 | goto exit; |
Ronald Cron | 9486f9d | 2020-11-26 13:36:23 +0100 | [diff] [blame] | 1487 | } |
| 1488 | |
Ronald Cron | d18b5f8 | 2020-11-25 16:46:05 +0100 | [diff] [blame] | 1489 | psa_key_attributes_t attributes = { |
| 1490 | .core = slot->attr |
| 1491 | }; |
Przemek Stekiel | c80e750 | 2023-05-11 11:14:25 +0200 | [diff] [blame] | 1492 | |
| 1493 | psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( |
| 1494 | psa_get_key_lifetime(&attributes)); |
| 1495 | |
| 1496 | if (location == PSA_KEY_LOCATION_LOCAL_STORAGE && |
| 1497 | PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type) && |
| 1498 | (PSA_KEY_TYPE_IS_RSA(slot->attr.type) || PSA_KEY_TYPE_IS_ECC(slot->attr.type) || |
| 1499 | PSA_KEY_TYPE_IS_DH(slot->attr.type))) { |
| 1500 | /* Exporting public -> public */ |
| 1501 | status = psa_export_key_buffer_internal( |
| 1502 | slot->key.data, slot->key.bytes, |
| 1503 | data, data_size, data_length); |
| 1504 | } else { |
| 1505 | status = psa_driver_wrapper_export_public_key( |
| 1506 | &attributes, slot->key.data, slot->key.bytes, |
| 1507 | data, data_size, data_length); |
| 1508 | } |
Ronald Cron | 9486f9d | 2020-11-26 13:36:23 +0100 | [diff] [blame] | 1509 | |
| 1510 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1511 | unlock_status = psa_unlock_key_slot(slot); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 1512 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1513 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Moran Peker | dd4ea38 | 2018-04-03 15:30:03 +0300 | [diff] [blame] | 1514 | } |
| 1515 | |
Tom Cosgrove | 6ef9bb3 | 2023-03-08 14:19:51 +0000 | [diff] [blame] | 1516 | MBEDTLS_STATIC_ASSERT( |
| 1517 | (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0, |
| 1518 | "One or more key attribute flag is listed as both external-only and dual-use") |
| 1519 | MBEDTLS_STATIC_ASSERT( |
| 1520 | (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0, |
| 1521 | "One or more key attribute flag is listed as both internal-only and dual-use") |
| 1522 | MBEDTLS_STATIC_ASSERT( |
| 1523 | (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY) == 0, |
| 1524 | "One or more key attribute flag is listed as both internal-only and external-only") |
Gilles Peskine | 91e8c33 | 2019-08-02 19:19:39 +0200 | [diff] [blame] | 1525 | |
Gilles Peskine | 1b8594a | 2019-07-31 17:21:46 +0200 | [diff] [blame] | 1526 | /** Validate that a key policy is internally well-formed. |
| 1527 | * |
| 1528 | * This function only rejects invalid policies. It does not validate the |
| 1529 | * consistency of the policy with respect to other attributes of the key |
| 1530 | * such as the key type. |
| 1531 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1532 | static psa_status_t psa_validate_key_policy(const psa_key_policy_t *policy) |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1533 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1534 | if ((policy->usage & ~(PSA_KEY_USAGE_EXPORT | |
| 1535 | PSA_KEY_USAGE_COPY | |
| 1536 | PSA_KEY_USAGE_ENCRYPT | |
| 1537 | PSA_KEY_USAGE_DECRYPT | |
| 1538 | PSA_KEY_USAGE_SIGN_MESSAGE | |
| 1539 | PSA_KEY_USAGE_VERIFY_MESSAGE | |
| 1540 | PSA_KEY_USAGE_SIGN_HASH | |
| 1541 | PSA_KEY_USAGE_VERIFY_HASH | |
| 1542 | PSA_KEY_USAGE_VERIFY_DERIVATION | |
| 1543 | PSA_KEY_USAGE_DERIVE)) != 0) { |
| 1544 | return PSA_ERROR_INVALID_ARGUMENT; |
| 1545 | } |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1546 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1547 | return PSA_SUCCESS; |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1548 | } |
| 1549 | |
Gilles Peskine | 1b8594a | 2019-07-31 17:21:46 +0200 | [diff] [blame] | 1550 | /** Validate the internal consistency of key attributes. |
| 1551 | * |
| 1552 | * This function only rejects invalid attribute values. If does not |
| 1553 | * validate the consistency of the attributes with any key data that may |
| 1554 | * be involved in the creation of the key. |
| 1555 | * |
| 1556 | * Call this function early in the key creation process. |
| 1557 | * |
| 1558 | * \param[in] attributes Key attributes for the new key. |
| 1559 | * \param[out] p_drv On any return, the driver for the key, if any. |
| 1560 | * NULL for a transparent key. |
| 1561 | * |
| 1562 | */ |
| 1563 | static psa_status_t psa_validate_key_attributes( |
| 1564 | const psa_key_attributes_t *attributes, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1565 | psa_se_drv_table_entry_t **p_drv) |
Darryl Green | 0c6575a | 2018-11-07 16:05:30 +0000 | [diff] [blame] | 1566 | { |
Steven Cooreman | 81fe7c3 | 2020-06-08 18:37:19 +0200 | [diff] [blame] | 1567 | psa_status_t status = PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1568 | psa_key_lifetime_t lifetime = psa_get_key_lifetime(attributes); |
| 1569 | mbedtls_svc_key_id_t key = psa_get_key_id(attributes); |
Gilles Peskine | 1b8594a | 2019-07-31 17:21:46 +0200 | [diff] [blame] | 1570 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1571 | status = psa_validate_key_location(lifetime, p_drv); |
| 1572 | if (status != PSA_SUCCESS) { |
| 1573 | return status; |
Ronald Cron | d2ed481 | 2020-07-17 16:11:30 +0200 | [diff] [blame] | 1574 | } |
| 1575 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1576 | status = psa_validate_key_persistence(lifetime); |
| 1577 | if (status != PSA_SUCCESS) { |
| 1578 | return status; |
| 1579 | } |
| 1580 | |
| 1581 | if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) { |
| 1582 | if (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key) != 0) { |
| 1583 | return PSA_ERROR_INVALID_ARGUMENT; |
| 1584 | } |
| 1585 | } else { |
| 1586 | if (!psa_is_valid_key_id(psa_get_key_id(attributes), 0)) { |
| 1587 | return PSA_ERROR_INVALID_ARGUMENT; |
| 1588 | } |
| 1589 | } |
| 1590 | |
| 1591 | status = psa_validate_key_policy(&attributes->core.policy); |
| 1592 | if (status != PSA_SUCCESS) { |
| 1593 | return status; |
| 1594 | } |
Gilles Peskine | 1b8594a | 2019-07-31 17:21:46 +0200 | [diff] [blame] | 1595 | |
| 1596 | /* Refuse to create overly large keys. |
| 1597 | * Note that this doesn't trigger on import if the attributes don't |
| 1598 | * explicitly specify a size (so psa_get_key_bits returns 0), so |
| 1599 | * psa_import_key() needs its own checks. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1600 | if (psa_get_key_bits(attributes) > PSA_MAX_KEY_BITS) { |
| 1601 | return PSA_ERROR_NOT_SUPPORTED; |
| 1602 | } |
Gilles Peskine | 1b8594a | 2019-07-31 17:21:46 +0200 | [diff] [blame] | 1603 | |
Gilles Peskine | 91e8c33 | 2019-08-02 19:19:39 +0200 | [diff] [blame] | 1604 | /* Reject invalid flags. These should not be reachable through the API. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1605 | if (attributes->core.flags & ~(MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY | |
| 1606 | MBEDTLS_PSA_KA_MASK_DUAL_USE)) { |
| 1607 | return PSA_ERROR_INVALID_ARGUMENT; |
| 1608 | } |
Gilles Peskine | 91e8c33 | 2019-08-02 19:19:39 +0200 | [diff] [blame] | 1609 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1610 | return PSA_SUCCESS; |
Gilles Peskine | 1b8594a | 2019-07-31 17:21:46 +0200 | [diff] [blame] | 1611 | } |
| 1612 | |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1613 | /** Prepare a key slot to receive key material. |
| 1614 | * |
| 1615 | * This function allocates a key slot and sets its metadata. |
| 1616 | * |
| 1617 | * If this function fails, call psa_fail_key_creation(). |
| 1618 | * |
Gilles Peskine | 9bc88c6 | 2019-04-28 11:37:03 +0200 | [diff] [blame] | 1619 | * This function is intended to be used as follows: |
| 1620 | * -# Call psa_start_key_creation() to allocate a key slot, prepare |
Ronald Cron | cf56a0a | 2020-08-04 09:51:30 +0200 | [diff] [blame] | 1621 | * it with the specified attributes, and in case of a volatile key assign it |
| 1622 | * a volatile key identifier. |
Gilles Peskine | 9bc88c6 | 2019-04-28 11:37:03 +0200 | [diff] [blame] | 1623 | * -# Populate the slot with the key material. |
| 1624 | * -# Call psa_finish_key_creation() to finalize the creation of the slot. |
| 1625 | * In case of failure at any step, stop the sequence and call |
| 1626 | * psa_fail_key_creation(). |
| 1627 | * |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 1628 | * On success, the key slot is locked. It is the responsibility of the caller |
| 1629 | * to unlock the key slot when it does not access it anymore. |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 1630 | * |
Gilles Peskine | df17914 | 2019-07-15 22:02:14 +0200 | [diff] [blame] | 1631 | * \param method An identification of the calling function. |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 1632 | * \param[in] attributes Key attributes for the new key. |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 1633 | * \param[out] p_slot On success, a pointer to the prepared slot. |
| 1634 | * \param[out] p_drv On any return, the driver for the key, if any. |
| 1635 | * NULL for a transparent key. |
Gilles Peskine | 9bc88c6 | 2019-04-28 11:37:03 +0200 | [diff] [blame] | 1636 | * |
| 1637 | * \retval #PSA_SUCCESS |
| 1638 | * The key slot is ready to receive key material. |
| 1639 | * \return If this function fails, the key slot is an invalid state. |
| 1640 | * You must call psa_fail_key_creation() to wipe and free the slot. |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1641 | */ |
| 1642 | static psa_status_t psa_start_key_creation( |
Gilles Peskine | df17914 | 2019-07-15 22:02:14 +0200 | [diff] [blame] | 1643 | psa_key_creation_method_t method, |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1644 | const psa_key_attributes_t *attributes, |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 1645 | psa_key_slot_t **p_slot, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1646 | psa_se_drv_table_entry_t **p_drv) |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1647 | { |
| 1648 | psa_status_t status; |
Ronald Cron | 2a99315 | 2020-07-17 14:13:26 +0200 | [diff] [blame] | 1649 | psa_key_id_t volatile_key_id; |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1650 | psa_key_slot_t *slot; |
| 1651 | |
Gilles Peskine | df17914 | 2019-07-15 22:02:14 +0200 | [diff] [blame] | 1652 | (void) method; |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 1653 | *p_drv = NULL; |
| 1654 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1655 | status = psa_validate_key_attributes(attributes, p_drv); |
| 1656 | if (status != PSA_SUCCESS) { |
| 1657 | return status; |
| 1658 | } |
Gilles Peskine | 1b8594a | 2019-07-31 17:21:46 +0200 | [diff] [blame] | 1659 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1660 | status = psa_get_empty_key_slot(&volatile_key_id, p_slot); |
| 1661 | if (status != PSA_SUCCESS) { |
| 1662 | return status; |
| 1663 | } |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1664 | slot = *p_slot; |
| 1665 | |
Gilles Peskine | 76aa09c | 2019-07-31 14:15:34 +0200 | [diff] [blame] | 1666 | /* We're storing the declared bit-size of the key. It's up to each |
| 1667 | * creation mechanism to verify that this information is correct. |
| 1668 | * It's automatically correct for mechanisms that use the bit-size as |
Gilles Peskine | b46bef2 | 2019-07-30 21:32:04 +0200 | [diff] [blame] | 1669 | * an input (generate, device) but not for those where the bit-size |
Ronald Cron | c4d1b51 | 2020-07-31 11:26:37 +0200 | [diff] [blame] | 1670 | * is optional (import, copy). In case of a volatile key, assign it the |
| 1671 | * volatile key identifier associated to the slot returned to contain its |
| 1672 | * definition. */ |
Gilles Peskine | 76aa09c | 2019-07-31 14:15:34 +0200 | [diff] [blame] | 1673 | |
| 1674 | slot->attr = attributes->core; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1675 | if (PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) { |
Ronald Cron | c4d1b51 | 2020-07-31 11:26:37 +0200 | [diff] [blame] | 1676 | #if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER) |
| 1677 | slot->attr.id = volatile_key_id; |
| 1678 | #else |
| 1679 | slot->attr.id.key_id = volatile_key_id; |
| 1680 | #endif |
| 1681 | } |
Gilles Peskine | c744d99 | 2019-07-30 17:26:54 +0200 | [diff] [blame] | 1682 | |
Gilles Peskine | 91e8c33 | 2019-08-02 19:19:39 +0200 | [diff] [blame] | 1683 | /* Erase external-only flags from the internal copy. To access |
Gilles Peskine | 013f547 | 2019-08-07 15:42:14 +0200 | [diff] [blame] | 1684 | * external-only flags, query `attributes`. Thanks to the check |
| 1685 | * in psa_validate_key_attributes(), this leaves the dual-use |
Gilles Peskine | edbed56 | 2019-08-07 18:19:59 +0200 | [diff] [blame] | 1686 | * flags and any internal flag that psa_get_empty_key_slot() |
Gilles Peskine | 013f547 | 2019-08-07 15:42:14 +0200 | [diff] [blame] | 1687 | * may have set. */ |
| 1688 | slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY; |
Gilles Peskine | 91e8c33 | 2019-08-02 19:19:39 +0200 | [diff] [blame] | 1689 | |
Gilles Peskine | cbaff46 | 2019-07-12 23:46:04 +0200 | [diff] [blame] | 1690 | #if defined(MBEDTLS_PSA_CRYPTO_SE_C) |
Gilles Peskine | d772958 | 2019-08-05 15:55:54 +0200 | [diff] [blame] | 1691 | /* For a key in a secure element, we need to do three things |
Steven Cooreman | bbeaf18 | 2020-06-08 18:29:44 +0200 | [diff] [blame] | 1692 | * when creating or registering a persistent key: |
Gilles Peskine | 60450a4 | 2019-07-25 11:32:45 +0200 | [diff] [blame] | 1693 | * create the key file in internal storage, create the |
| 1694 | * key inside the secure element, and update the driver's |
Steven Cooreman | bbeaf18 | 2020-06-08 18:29:44 +0200 | [diff] [blame] | 1695 | * persistent data. This is done by starting a transaction that will |
| 1696 | * encompass these three actions. |
| 1697 | * For registering a volatile key, we just need to find an appropriate |
| 1698 | * slot number inside the SE. Since the key is designated volatile, creating |
| 1699 | * a transaction is not required. */ |
Gilles Peskine | 60450a4 | 2019-07-25 11:32:45 +0200 | [diff] [blame] | 1700 | /* The first thing to do is to find a slot number for the new key. |
| 1701 | * We save the slot number in persistent storage as part of the |
| 1702 | * transaction data. It will be needed to recover if the power |
| 1703 | * fails during the key creation process, to clean up on the secure |
| 1704 | * element side after restarting. Obtaining a slot number from the |
| 1705 | * secure element driver updates its persistent state, but we do not yet |
| 1706 | * save the driver's persistent state, so that if the power fails, |
Gilles Peskine | fc76265 | 2019-07-22 19:30:34 +0200 | [diff] [blame] | 1707 | * we can roll back to a state where the key doesn't exist. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1708 | if (*p_drv != NULL) { |
Ronald Cron | ea0f8a6 | 2020-11-25 17:52:23 +0100 | [diff] [blame] | 1709 | psa_key_slot_number_t slot_number; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1710 | status = psa_find_se_slot_for_key(attributes, method, *p_drv, |
| 1711 | &slot_number); |
| 1712 | if (status != PSA_SUCCESS) { |
| 1713 | return status; |
| 1714 | } |
Steven Cooreman | bbeaf18 | 2020-06-08 18:29:44 +0200 | [diff] [blame] | 1715 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1716 | if (!PSA_KEY_LIFETIME_IS_VOLATILE(attributes->core.lifetime)) { |
| 1717 | psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_CREATE_KEY); |
Steven Cooreman | bbeaf18 | 2020-06-08 18:29:44 +0200 | [diff] [blame] | 1718 | psa_crypto_transaction.key.lifetime = slot->attr.lifetime; |
Ronald Cron | ea0f8a6 | 2020-11-25 17:52:23 +0100 | [diff] [blame] | 1719 | psa_crypto_transaction.key.slot = slot_number; |
Steven Cooreman | bbeaf18 | 2020-06-08 18:29:44 +0200 | [diff] [blame] | 1720 | psa_crypto_transaction.key.id = slot->attr.id; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1721 | status = psa_crypto_save_transaction(); |
| 1722 | if (status != PSA_SUCCESS) { |
| 1723 | (void) psa_crypto_stop_transaction(); |
| 1724 | return status; |
Steven Cooreman | bbeaf18 | 2020-06-08 18:29:44 +0200 | [diff] [blame] | 1725 | } |
Gilles Peskine | 66be51c | 2019-07-25 18:02:52 +0200 | [diff] [blame] | 1726 | } |
Ronald Cron | ea0f8a6 | 2020-11-25 17:52:23 +0100 | [diff] [blame] | 1727 | |
| 1728 | status = psa_copy_key_material_into_slot( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1729 | slot, (uint8_t *) (&slot_number), sizeof(slot_number)); |
Darryl Green | 0c6575a | 2018-11-07 16:05:30 +0000 | [diff] [blame] | 1730 | } |
Gilles Peskine | 3efcebb | 2019-10-01 14:18:35 +0200 | [diff] [blame] | 1731 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1732 | if (*p_drv == NULL && method == PSA_KEY_CREATION_REGISTER) { |
Gilles Peskine | 3efcebb | 2019-10-01 14:18:35 +0200 | [diff] [blame] | 1733 | /* Key registration only makes sense with a secure element. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1734 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | 3efcebb | 2019-10-01 14:18:35 +0200 | [diff] [blame] | 1735 | } |
Gilles Peskine | cbaff46 | 2019-07-12 23:46:04 +0200 | [diff] [blame] | 1736 | #endif /* MBEDTLS_PSA_CRYPTO_SE_C */ |
| 1737 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1738 | return PSA_SUCCESS; |
Darryl Green | 0c6575a | 2018-11-07 16:05:30 +0000 | [diff] [blame] | 1739 | } |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1740 | |
| 1741 | /** Finalize the creation of a key once its key material has been set. |
| 1742 | * |
| 1743 | * This entails writing the key to persistent storage. |
| 1744 | * |
| 1745 | * If this function fails, call psa_fail_key_creation(). |
Gilles Peskine | 9bc88c6 | 2019-04-28 11:37:03 +0200 | [diff] [blame] | 1746 | * See the documentation of psa_start_key_creation() for the intended use |
| 1747 | * of this function. |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1748 | * |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 1749 | * If the finalization succeeds, the function unlocks the key slot (it was |
| 1750 | * locked by psa_start_key_creation()) and the key slot cannot be accessed |
| 1751 | * anymore as part of the key creation process. |
Ronald Cron | 5097294 | 2020-11-14 11:28:25 +0100 | [diff] [blame] | 1752 | * |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 1753 | * \param[in,out] slot Pointer to the slot with key material. |
| 1754 | * \param[in] driver The secure element driver for the key, |
| 1755 | * or NULL for a transparent key. |
Ronald Cron | 81709fc | 2020-11-14 12:10:32 +0100 | [diff] [blame] | 1756 | * \param[out] key On success, identifier of the key. Note that the |
| 1757 | * key identifier is also stored in the key slot. |
Gilles Peskine | 9bc88c6 | 2019-04-28 11:37:03 +0200 | [diff] [blame] | 1758 | * |
| 1759 | * \retval #PSA_SUCCESS |
Ronald Cron | cf56a0a | 2020-08-04 09:51:30 +0200 | [diff] [blame] | 1760 | * The key was successfully created. |
Gilles Peskine | ed73355 | 2023-02-14 19:21:09 +0100 | [diff] [blame] | 1761 | * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription |
| 1762 | * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription |
| 1763 | * \retval #PSA_ERROR_ALREADY_EXISTS \emptydescription |
| 1764 | * \retval #PSA_ERROR_DATA_INVALID \emptydescription |
| 1765 | * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription |
| 1766 | * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription |
gabor-mezei-arm | 452b0a3 | 2020-11-09 17:42:55 +0100 | [diff] [blame] | 1767 | * |
Gilles Peskine | 9bc88c6 | 2019-04-28 11:37:03 +0200 | [diff] [blame] | 1768 | * \return If this function fails, the key slot is an invalid state. |
| 1769 | * You must call psa_fail_key_creation() to wipe and free the slot. |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1770 | */ |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 1771 | static psa_status_t psa_finish_key_creation( |
| 1772 | psa_key_slot_t *slot, |
Ronald Cron | 81709fc | 2020-11-14 12:10:32 +0100 | [diff] [blame] | 1773 | psa_se_drv_table_entry_t *driver, |
| 1774 | mbedtls_svc_key_id_t *key) |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1775 | { |
| 1776 | psa_status_t status = PSA_SUCCESS; |
Gilles Peskine | 30afafd | 2019-04-25 13:47:40 +0200 | [diff] [blame] | 1777 | (void) slot; |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 1778 | (void) driver; |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1779 | |
| 1780 | #if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1781 | if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) { |
Gilles Peskine | 1df83d4 | 2019-07-23 16:13:14 +0200 | [diff] [blame] | 1782 | #if defined(MBEDTLS_PSA_CRYPTO_SE_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1783 | if (driver != NULL) { |
Gilles Peskine | b46bef2 | 2019-07-30 21:32:04 +0200 | [diff] [blame] | 1784 | psa_se_key_data_storage_t data; |
Ronald Cron | ea0f8a6 | 2020-11-25 17:52:23 +0100 | [diff] [blame] | 1785 | psa_key_slot_number_t slot_number = |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1786 | psa_key_slot_get_slot_number(slot); |
Ronald Cron | ea0f8a6 | 2020-11-25 17:52:23 +0100 | [diff] [blame] | 1787 | |
Tom Cosgrove | 6ef9bb3 | 2023-03-08 14:19:51 +0000 | [diff] [blame] | 1788 | MBEDTLS_STATIC_ASSERT(sizeof(slot_number) == |
| 1789 | sizeof(data.slot_number), |
| 1790 | "Slot number size does not match psa_se_key_data_storage_t"); |
| 1791 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1792 | memcpy(&data.slot_number, &slot_number, sizeof(slot_number)); |
| 1793 | status = psa_save_persistent_key(&slot->attr, |
| 1794 | (uint8_t *) &data, |
| 1795 | sizeof(data)); |
| 1796 | } else |
Gilles Peskine | 1df83d4 | 2019-07-23 16:13:14 +0200 | [diff] [blame] | 1797 | #endif /* MBEDTLS_PSA_CRYPTO_SE_C */ |
| 1798 | { |
Steven Cooreman | 40120f6 | 2020-10-29 11:42:22 +0100 | [diff] [blame] | 1799 | /* Key material is saved in export representation in the slot, so |
| 1800 | * just pass the slot buffer for storage. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1801 | status = psa_save_persistent_key(&slot->attr, |
| 1802 | slot->key.data, |
| 1803 | slot->key.bytes); |
Gilles Peskine | 1df83d4 | 2019-07-23 16:13:14 +0200 | [diff] [blame] | 1804 | } |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1805 | } |
Darryl Green | 0c6575a | 2018-11-07 16:05:30 +0000 | [diff] [blame] | 1806 | #endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */ |
| 1807 | |
Gilles Peskine | cbaff46 | 2019-07-12 23:46:04 +0200 | [diff] [blame] | 1808 | #if defined(MBEDTLS_PSA_CRYPTO_SE_C) |
Gilles Peskine | d772958 | 2019-08-05 15:55:54 +0200 | [diff] [blame] | 1809 | /* Finish the transaction for a key creation. This does not |
| 1810 | * happen when registering an existing key. Detect this case |
| 1811 | * by checking whether a transaction is in progress (actual |
Steven Cooreman | bbeaf18 | 2020-06-08 18:29:44 +0200 | [diff] [blame] | 1812 | * creation of a persistent key in a secure element requires a transaction, |
| 1813 | * but registration or volatile key creation doesn't use one). */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1814 | if (driver != NULL && |
| 1815 | psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY) { |
| 1816 | status = psa_save_se_persistent_data(driver); |
| 1817 | if (status != PSA_SUCCESS) { |
| 1818 | psa_destroy_persistent_key(slot->attr.id); |
| 1819 | return status; |
Gilles Peskine | cbaff46 | 2019-07-12 23:46:04 +0200 | [diff] [blame] | 1820 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1821 | status = psa_crypto_stop_transaction(); |
Gilles Peskine | cbaff46 | 2019-07-12 23:46:04 +0200 | [diff] [blame] | 1822 | } |
| 1823 | #endif /* MBEDTLS_PSA_CRYPTO_SE_C */ |
| 1824 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1825 | if (status == PSA_SUCCESS) { |
Ronald Cron | 81709fc | 2020-11-14 12:10:32 +0100 | [diff] [blame] | 1826 | *key = slot->attr.id; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1827 | status = psa_unlock_key_slot(slot); |
| 1828 | if (status != PSA_SUCCESS) { |
Ronald Cron | 81709fc | 2020-11-14 12:10:32 +0100 | [diff] [blame] | 1829 | *key = MBEDTLS_SVC_KEY_ID_INIT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1830 | } |
Ronald Cron | 81709fc | 2020-11-14 12:10:32 +0100 | [diff] [blame] | 1831 | } |
Ronald Cron | 5097294 | 2020-11-14 11:28:25 +0100 | [diff] [blame] | 1832 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1833 | return status; |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1834 | } |
| 1835 | |
| 1836 | /** Abort the creation of a key. |
| 1837 | * |
| 1838 | * You may call this function after calling psa_start_key_creation(), |
| 1839 | * or after psa_finish_key_creation() fails. In other circumstances, this |
| 1840 | * function may not clean up persistent storage. |
Gilles Peskine | 9bc88c6 | 2019-04-28 11:37:03 +0200 | [diff] [blame] | 1841 | * See the documentation of psa_start_key_creation() for the intended use |
| 1842 | * of this function. |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1843 | * |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 1844 | * \param[in,out] slot Pointer to the slot with key material. |
| 1845 | * \param[in] driver The secure element driver for the key, |
| 1846 | * or NULL for a transparent key. |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1847 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1848 | static void psa_fail_key_creation(psa_key_slot_t *slot, |
| 1849 | psa_se_drv_table_entry_t *driver) |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1850 | { |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 1851 | (void) driver; |
| 1852 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1853 | if (slot == NULL) { |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1854 | return; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1855 | } |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 1856 | |
| 1857 | #if defined(MBEDTLS_PSA_CRYPTO_SE_C) |
Janos Follath | 1d57a20 | 2019-08-13 12:15:34 +0100 | [diff] [blame] | 1858 | /* TODO: If the key has already been created in the secure |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 1859 | * element, and the failure happened later (when saving metadata |
| 1860 | * to internal storage), we need to destroy the key in the secure |
Gilles Peskine | c9d7f94 | 2019-08-13 16:17:16 +0200 | [diff] [blame] | 1861 | * element. |
| 1862 | * https://github.com/ARMmbed/mbed-crypto/issues/217 |
| 1863 | */ |
Gilles Peskine | fc76265 | 2019-07-22 19:30:34 +0200 | [diff] [blame] | 1864 | |
Gilles Peskine | d772958 | 2019-08-05 15:55:54 +0200 | [diff] [blame] | 1865 | /* Abort the ongoing transaction if any (there may not be one if |
| 1866 | * the creation process failed before starting one, or if the |
| 1867 | * key creation is a registration of a key in a secure element). |
| 1868 | * Earlier functions must already have done what it takes to undo any |
| 1869 | * partial creation. All that's left is to update the transaction data |
| 1870 | * itself. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1871 | (void) psa_crypto_stop_transaction(); |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 1872 | #endif /* MBEDTLS_PSA_CRYPTO_SE_C */ |
| 1873 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1874 | psa_wipe_key_slot(slot); |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1875 | } |
| 1876 | |
Gilles Peskine | 1b8594a | 2019-07-31 17:21:46 +0200 | [diff] [blame] | 1877 | /** Validate optional attributes during key creation. |
| 1878 | * |
| 1879 | * Some key attributes are optional during key creation. If they are |
| 1880 | * specified in the attributes structure, check that they are consistent |
| 1881 | * with the data in the slot. |
| 1882 | * |
| 1883 | * This function should be called near the end of key creation, after |
| 1884 | * the slot in memory is fully populated but before saving persistent data. |
| 1885 | */ |
| 1886 | static psa_status_t psa_validate_optional_attributes( |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1887 | const psa_key_slot_t *slot, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1888 | const psa_key_attributes_t *attributes) |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1889 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1890 | if (attributes->core.type != 0) { |
| 1891 | if (attributes->core.type != slot->attr.type) { |
| 1892 | return PSA_ERROR_INVALID_ARGUMENT; |
| 1893 | } |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1894 | } |
| 1895 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1896 | if (attributes->domain_parameters_size != 0) { |
John Durkop | 0e00519 | 2020-10-31 22:06:54 -0700 | [diff] [blame] | 1897 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1898 | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) |
| 1899 | if (PSA_KEY_TYPE_IS_RSA(slot->attr.type)) { |
Steven Cooreman | a2371e5 | 2020-07-28 14:30:39 +0200 | [diff] [blame] | 1900 | mbedtls_rsa_context *rsa = NULL; |
Steven Cooreman | 75b7436 | 2020-07-28 14:30:13 +0200 | [diff] [blame] | 1901 | mbedtls_mpi actual, required; |
Steven Cooreman | 6d839f0 | 2020-07-30 11:36:45 +0200 | [diff] [blame] | 1902 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Steven Cooreman | a01795d | 2020-07-24 22:48:15 +0200 | [diff] [blame] | 1903 | |
Ronald Cron | 9085708 | 2020-11-25 14:58:33 +0100 | [diff] [blame] | 1904 | psa_status_t status = mbedtls_psa_rsa_load_representation( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1905 | slot->attr.type, |
| 1906 | slot->key.data, |
| 1907 | slot->key.bytes, |
| 1908 | &rsa); |
| 1909 | if (status != PSA_SUCCESS) { |
| 1910 | return status; |
| 1911 | } |
Steven Cooreman | 75b7436 | 2020-07-28 14:30:13 +0200 | [diff] [blame] | 1912 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1913 | mbedtls_mpi_init(&actual); |
| 1914 | mbedtls_mpi_init(&required); |
| 1915 | ret = mbedtls_rsa_export(rsa, |
| 1916 | NULL, NULL, NULL, NULL, &actual); |
| 1917 | mbedtls_rsa_free(rsa); |
| 1918 | mbedtls_free(rsa); |
| 1919 | if (ret != 0) { |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1920 | goto rsa_exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1921 | } |
| 1922 | ret = mbedtls_mpi_read_binary(&required, |
| 1923 | attributes->domain_parameters, |
| 1924 | attributes->domain_parameters_size); |
| 1925 | if (ret != 0) { |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1926 | goto rsa_exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1927 | } |
| 1928 | if (mbedtls_mpi_cmp_mpi(&actual, &required) != 0) { |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1929 | ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1930 | } |
| 1931 | rsa_exit: |
| 1932 | mbedtls_mpi_free(&actual); |
| 1933 | mbedtls_mpi_free(&required); |
| 1934 | if (ret != 0) { |
| 1935 | return mbedtls_to_psa_error(ret); |
| 1936 | } |
| 1937 | } else |
John Durkop | 9814fa2 | 2020-11-04 12:28:15 -0800 | [diff] [blame] | 1938 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || |
| 1939 | * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */ |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1940 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1941 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1942 | } |
| 1943 | } |
| 1944 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1945 | if (attributes->core.bits != 0) { |
| 1946 | if (attributes->core.bits != slot->attr.bits) { |
| 1947 | return PSA_ERROR_INVALID_ARGUMENT; |
| 1948 | } |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1949 | } |
| 1950 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1951 | return PSA_SUCCESS; |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1952 | } |
| 1953 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1954 | psa_status_t psa_import_key(const psa_key_attributes_t *attributes, |
| 1955 | const uint8_t *data, |
| 1956 | size_t data_length, |
| 1957 | mbedtls_svc_key_id_t *key) |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 1958 | { |
| 1959 | psa_status_t status; |
| 1960 | psa_key_slot_t *slot = NULL; |
Gilles Peskine | 8abe6a2 | 2019-07-12 23:40:35 +0200 | [diff] [blame] | 1961 | psa_se_drv_table_entry_t *driver = NULL; |
Ronald Cron | fb2ed5b | 2020-11-30 12:11:01 +0100 | [diff] [blame] | 1962 | size_t bits; |
Archana | d8a83dc | 2021-06-14 10:04:16 +0530 | [diff] [blame] | 1963 | size_t storage_size = data_length; |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1964 | |
Ronald Cron | 81709fc | 2020-11-14 12:10:32 +0100 | [diff] [blame] | 1965 | *key = MBEDTLS_SVC_KEY_ID_INIT; |
| 1966 | |
Gilles Peskine | 0f84d62 | 2019-09-12 19:03:13 +0200 | [diff] [blame] | 1967 | /* Reject zero-length symmetric keys (including raw data key objects). |
| 1968 | * This also rejects any key which might be encoded as an empty string, |
| 1969 | * which is never valid. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1970 | if (data_length == 0) { |
| 1971 | return PSA_ERROR_INVALID_ARGUMENT; |
| 1972 | } |
Gilles Peskine | 0f84d62 | 2019-09-12 19:03:13 +0200 | [diff] [blame] | 1973 | |
Archana | 449608b | 2021-09-08 15:36:05 +0530 | [diff] [blame] | 1974 | /* Ensure that the bytes-to-bits conversion cannot overflow. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1975 | if (data_length > SIZE_MAX / 8) { |
| 1976 | return PSA_ERROR_NOT_SUPPORTED; |
| 1977 | } |
Archana | 6ed4bda | 2021-08-04 10:47:15 +0530 | [diff] [blame] | 1978 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1979 | status = psa_start_key_creation(PSA_KEY_CREATION_IMPORT, attributes, |
| 1980 | &slot, &driver); |
| 1981 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1982 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1983 | } |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 1984 | |
Ronald Cron | fb2ed5b | 2020-11-30 12:11:01 +0100 | [diff] [blame] | 1985 | /* In the case of a transparent key or an opaque key stored in local |
Archana | 449608b | 2021-09-08 15:36:05 +0530 | [diff] [blame] | 1986 | * storage ( thus not in the case of importing a key in a secure element |
| 1987 | * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a |
| 1988 | * buffer to hold the imported key material. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1989 | if (slot->key.data == NULL) { |
| 1990 | if (psa_key_lifetime_is_external(attributes->core.lifetime)) { |
Archana | 449608b | 2021-09-08 15:36:05 +0530 | [diff] [blame] | 1991 | status = psa_driver_wrapper_get_key_buffer_size_from_key_data( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1992 | attributes, data, data_length, &storage_size); |
| 1993 | if (status != PSA_SUCCESS) { |
Archana | d8a83dc | 2021-06-14 10:04:16 +0530 | [diff] [blame] | 1994 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1995 | } |
Archana | d8a83dc | 2021-06-14 10:04:16 +0530 | [diff] [blame] | 1996 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1997 | status = psa_allocate_buffer_to_slot(slot, storage_size); |
| 1998 | if (status != PSA_SUCCESS) { |
Gilles Peskine | b46bef2 | 2019-07-30 21:32:04 +0200 | [diff] [blame] | 1999 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2000 | } |
Gilles Peskine | 5d30967 | 2019-07-12 23:47:28 +0200 | [diff] [blame] | 2001 | } |
Ronald Cron | fb2ed5b | 2020-11-30 12:11:01 +0100 | [diff] [blame] | 2002 | |
Przemek Stekiel | c80e750 | 2023-05-11 11:14:25 +0200 | [diff] [blame] | 2003 | if (PSA_KEY_TYPE_IS_ASYMMETRIC(attributes->core.type) && |
| 2004 | PSA_KEY_TYPE_IS_DH(attributes->core.type)) { |
| 2005 | if (psa_is_dh_key_size_valid(PSA_BYTES_TO_BITS(data_length)) == 0) { |
| 2006 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 2007 | goto exit; |
| 2008 | } |
| 2009 | |
| 2010 | /* Copy the key material. */ |
| 2011 | memcpy(slot->key.data, data, data_length); |
| 2012 | bits = PSA_BYTES_TO_BITS(data_length); |
| 2013 | |
| 2014 | status = PSA_SUCCESS; |
| 2015 | } else { |
| 2016 | bits = slot->attr.bits; |
| 2017 | status = psa_driver_wrapper_import_key(attributes, |
| 2018 | data, data_length, |
| 2019 | slot->key.data, |
| 2020 | slot->key.bytes, |
| 2021 | &slot->key.bytes, &bits); |
| 2022 | } |
| 2023 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2024 | if (status != PSA_SUCCESS) { |
Ronald Cron | fb2ed5b | 2020-11-30 12:11:01 +0100 | [diff] [blame] | 2025 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2026 | } |
Ronald Cron | fb2ed5b | 2020-11-30 12:11:01 +0100 | [diff] [blame] | 2027 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2028 | if (slot->attr.bits == 0) { |
Ronald Cron | fb2ed5b | 2020-11-30 12:11:01 +0100 | [diff] [blame] | 2029 | slot->attr.bits = (psa_key_bits_t) bits; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2030 | } else if (bits != slot->attr.bits) { |
Steven Cooreman | ac3434f | 2021-01-15 17:36:02 +0100 | [diff] [blame] | 2031 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 2032 | goto exit; |
Gilles Peskine | 5d30967 | 2019-07-12 23:47:28 +0200 | [diff] [blame] | 2033 | } |
Ronald Cron | 2ebfdcc | 2020-11-28 15:54:54 +0100 | [diff] [blame] | 2034 | |
Archana | 6ed4bda | 2021-08-04 10:47:15 +0530 | [diff] [blame] | 2035 | /* Enforce a size limit, and in particular ensure that the bit |
| 2036 | * size fits in its representation type.*/ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2037 | if (bits > PSA_MAX_KEY_BITS) { |
Archana | 6ed4bda | 2021-08-04 10:47:15 +0530 | [diff] [blame] | 2038 | status = PSA_ERROR_NOT_SUPPORTED; |
| 2039 | goto exit; |
| 2040 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2041 | status = psa_validate_optional_attributes(slot, attributes); |
| 2042 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 1801740 | 2019-07-24 20:25:59 +0200 | [diff] [blame] | 2043 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2044 | } |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 2045 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2046 | status = psa_finish_key_creation(slot, driver, key); |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 2047 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2048 | if (status != PSA_SUCCESS) { |
| 2049 | psa_fail_key_creation(slot, driver); |
| 2050 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 2051 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2052 | return status; |
Gilles Peskine | 4747d19 | 2019-04-17 15:05:45 +0200 | [diff] [blame] | 2053 | } |
| 2054 | |
Gilles Peskine | d772958 | 2019-08-05 15:55:54 +0200 | [diff] [blame] | 2055 | #if defined(MBEDTLS_PSA_CRYPTO_SE_C) |
| 2056 | psa_status_t mbedtls_psa_register_se_key( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2057 | const psa_key_attributes_t *attributes) |
Gilles Peskine | d772958 | 2019-08-05 15:55:54 +0200 | [diff] [blame] | 2058 | { |
| 2059 | psa_status_t status; |
| 2060 | psa_key_slot_t *slot = NULL; |
| 2061 | psa_se_drv_table_entry_t *driver = NULL; |
Ronald Cron | cf56a0a | 2020-08-04 09:51:30 +0200 | [diff] [blame] | 2062 | mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT; |
Gilles Peskine | d772958 | 2019-08-05 15:55:54 +0200 | [diff] [blame] | 2063 | |
| 2064 | /* Leaving attributes unspecified is not currently supported. |
| 2065 | * It could make sense to query the key type and size from the |
| 2066 | * secure element, but not all secure elements support this |
| 2067 | * and the driver HAL doesn't currently support it. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2068 | if (psa_get_key_type(attributes) == PSA_KEY_TYPE_NONE) { |
| 2069 | return PSA_ERROR_NOT_SUPPORTED; |
| 2070 | } |
| 2071 | if (psa_get_key_bits(attributes) == 0) { |
| 2072 | return PSA_ERROR_NOT_SUPPORTED; |
| 2073 | } |
Gilles Peskine | d772958 | 2019-08-05 15:55:54 +0200 | [diff] [blame] | 2074 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2075 | status = psa_start_key_creation(PSA_KEY_CREATION_REGISTER, attributes, |
| 2076 | &slot, &driver); |
| 2077 | if (status != PSA_SUCCESS) { |
Gilles Peskine | d772958 | 2019-08-05 15:55:54 +0200 | [diff] [blame] | 2078 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2079 | } |
Gilles Peskine | d772958 | 2019-08-05 15:55:54 +0200 | [diff] [blame] | 2080 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2081 | status = psa_finish_key_creation(slot, driver, &key); |
Gilles Peskine | d772958 | 2019-08-05 15:55:54 +0200 | [diff] [blame] | 2082 | |
| 2083 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2084 | if (status != PSA_SUCCESS) { |
| 2085 | psa_fail_key_creation(slot, driver); |
| 2086 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 2087 | |
Gilles Peskine | d772958 | 2019-08-05 15:55:54 +0200 | [diff] [blame] | 2088 | /* Registration doesn't keep the key in RAM. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2089 | psa_close_key(key); |
| 2090 | return status; |
Gilles Peskine | d772958 | 2019-08-05 15:55:54 +0200 | [diff] [blame] | 2091 | } |
| 2092 | #endif /* MBEDTLS_PSA_CRYPTO_SE_C */ |
| 2093 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2094 | psa_status_t psa_copy_key(mbedtls_svc_key_id_t source_key, |
| 2095 | const psa_key_attributes_t *specified_attributes, |
| 2096 | mbedtls_svc_key_id_t *target_key) |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 2097 | { |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 2098 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 2099 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 2100 | psa_key_slot_t *source_slot = NULL; |
| 2101 | psa_key_slot_t *target_slot = NULL; |
Gilles Peskine | 8c8f2ab | 2019-04-18 21:44:46 +0200 | [diff] [blame] | 2102 | psa_key_attributes_t actual_attributes = *specified_attributes; |
Gilles Peskine | 8abe6a2 | 2019-07-12 23:40:35 +0200 | [diff] [blame] | 2103 | psa_se_drv_table_entry_t *driver = NULL; |
Archana | 8a18036 | 2021-07-05 02:18:48 +0530 | [diff] [blame] | 2104 | size_t storage_size = 0; |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 2105 | |
Ronald Cron | 81709fc | 2020-11-14 12:10:32 +0100 | [diff] [blame] | 2106 | *target_key = MBEDTLS_SVC_KEY_ID_INIT; |
| 2107 | |
Archana | 8a18036 | 2021-07-05 02:18:48 +0530 | [diff] [blame] | 2108 | status = psa_get_and_lock_key_slot_with_policy( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2109 | source_key, &source_slot, PSA_KEY_USAGE_COPY, 0); |
| 2110 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 8c8f2ab | 2019-04-18 21:44:46 +0200 | [diff] [blame] | 2111 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2112 | } |
Gilles Peskine | 8c8f2ab | 2019-04-18 21:44:46 +0200 | [diff] [blame] | 2113 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2114 | status = psa_validate_optional_attributes(source_slot, |
| 2115 | specified_attributes); |
| 2116 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 2117 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2118 | } |
Gilles Peskine | 4ce2a9d | 2019-05-03 16:57:15 +0200 | [diff] [blame] | 2119 | |
Archana | 9d17bf4 | 2021-09-10 06:22:44 +0530 | [diff] [blame] | 2120 | /* The target key type and number of bits have been validated by |
| 2121 | * psa_validate_optional_attributes() to be either equal to zero or |
| 2122 | * equal to the ones of the source key. So it is safe to inherit |
| 2123 | * them from the source key now." |
Archana | 374fe5b | 2021-09-08 15:50:28 +0530 | [diff] [blame] | 2124 | * */ |
Archana | 9d17bf4 | 2021-09-10 06:22:44 +0530 | [diff] [blame] | 2125 | actual_attributes.core.bits = source_slot->attr.bits; |
| 2126 | actual_attributes.core.type = source_slot->attr.type; |
Archana | 374fe5b | 2021-09-08 15:50:28 +0530 | [diff] [blame] | 2127 | |
| 2128 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2129 | status = psa_restrict_key_policy(source_slot->attr.type, |
| 2130 | &actual_attributes.core.policy, |
| 2131 | &source_slot->attr.policy); |
| 2132 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 8c8f2ab | 2019-04-18 21:44:46 +0200 | [diff] [blame] | 2133 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2134 | } |
Gilles Peskine | 8c8f2ab | 2019-04-18 21:44:46 +0200 | [diff] [blame] | 2135 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2136 | status = psa_start_key_creation(PSA_KEY_CREATION_COPY, &actual_attributes, |
| 2137 | &target_slot, &driver); |
| 2138 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 8c8f2ab | 2019-04-18 21:44:46 +0200 | [diff] [blame] | 2139 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2140 | } |
| 2141 | if (PSA_KEY_LIFETIME_GET_LOCATION(target_slot->attr.lifetime) != |
| 2142 | PSA_KEY_LIFETIME_GET_LOCATION(source_slot->attr.lifetime)) { |
Archana | 8a18036 | 2021-07-05 02:18:48 +0530 | [diff] [blame] | 2143 | /* |
Archana | 9d17bf4 | 2021-09-10 06:22:44 +0530 | [diff] [blame] | 2144 | * If the source and target keys are stored in different locations, |
Archana | 8a18036 | 2021-07-05 02:18:48 +0530 | [diff] [blame] | 2145 | * the source key would need to be exported as plaintext and re-imported |
| 2146 | * in the other location. This has security implications which have not |
Archana | 449608b | 2021-09-08 15:36:05 +0530 | [diff] [blame] | 2147 | * been fully mapped. For now, this can be achieved through |
Archana | 8a18036 | 2021-07-05 02:18:48 +0530 | [diff] [blame] | 2148 | * appropriate API invocations from the application, if needed. |
| 2149 | * */ |
Gilles Peskine | f4ee662 | 2019-07-24 13:44:30 +0200 | [diff] [blame] | 2150 | status = PSA_ERROR_NOT_SUPPORTED; |
| 2151 | goto exit; |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 2152 | } |
Archana | 8a18036 | 2021-07-05 02:18:48 +0530 | [diff] [blame] | 2153 | /* |
| 2154 | * When the source and target keys are within the same location, |
Archana | 449608b | 2021-09-08 15:36:05 +0530 | [diff] [blame] | 2155 | * - For transparent keys it is a blind copy without any driver invocation, |
Archana | 8a18036 | 2021-07-05 02:18:48 +0530 | [diff] [blame] | 2156 | * - For opaque keys this translates to an invocation of the drivers' |
| 2157 | * copy_key entry point through the dispatch layer. |
| 2158 | * */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2159 | if (psa_key_lifetime_is_external(actual_attributes.core.lifetime)) { |
| 2160 | status = psa_driver_wrapper_get_key_buffer_size(&actual_attributes, |
| 2161 | &storage_size); |
| 2162 | if (status != PSA_SUCCESS) { |
Archana | 8a18036 | 2021-07-05 02:18:48 +0530 | [diff] [blame] | 2163 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2164 | } |
Archana | 374fe5b | 2021-09-08 15:50:28 +0530 | [diff] [blame] | 2165 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2166 | status = psa_allocate_buffer_to_slot(target_slot, storage_size); |
| 2167 | if (status != PSA_SUCCESS) { |
Archana | 8a18036 | 2021-07-05 02:18:48 +0530 | [diff] [blame] | 2168 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2169 | } |
Archana | 374fe5b | 2021-09-08 15:50:28 +0530 | [diff] [blame] | 2170 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2171 | status = psa_driver_wrapper_copy_key(&actual_attributes, |
| 2172 | source_slot->key.data, |
| 2173 | source_slot->key.bytes, |
| 2174 | target_slot->key.data, |
| 2175 | target_slot->key.bytes, |
| 2176 | &target_slot->key.bytes); |
| 2177 | if (status != PSA_SUCCESS) { |
Archana | 8a18036 | 2021-07-05 02:18:48 +0530 | [diff] [blame] | 2178 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2179 | } |
| 2180 | } else { |
| 2181 | status = psa_copy_key_material_into_slot(target_slot, |
Archana | 9d17bf4 | 2021-09-10 06:22:44 +0530 | [diff] [blame] | 2182 | source_slot->key.data, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2183 | source_slot->key.bytes); |
| 2184 | if (status != PSA_SUCCESS) { |
Archana | 8a18036 | 2021-07-05 02:18:48 +0530 | [diff] [blame] | 2185 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2186 | } |
Archana | 8a18036 | 2021-07-05 02:18:48 +0530 | [diff] [blame] | 2187 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2188 | status = psa_finish_key_creation(target_slot, driver, target_key); |
Gilles Peskine | 8c8f2ab | 2019-04-18 21:44:46 +0200 | [diff] [blame] | 2189 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2190 | if (status != PSA_SUCCESS) { |
| 2191 | psa_fail_key_creation(target_slot, driver); |
| 2192 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 2193 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2194 | unlock_status = psa_unlock_key_slot(source_slot); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 2195 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2196 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Gilles Peskine | f603c71 | 2019-01-19 13:40:11 +0100 | [diff] [blame] | 2197 | } |
| 2198 | |
Gilles Peskine | 7bcfc0a | 2018-06-18 21:49:39 +0200 | [diff] [blame] | 2199 | |
| 2200 | |
Gilles Peskine | 2f9c4dc | 2018-01-28 13:16:24 +0100 | [diff] [blame] | 2201 | /****************************************************************/ |
Gilles Peskine | 20035e3 | 2018-02-03 22:44:14 +0100 | [diff] [blame] | 2202 | /* Message digests */ |
| 2203 | /****************************************************************/ |
| 2204 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2205 | psa_status_t psa_hash_abort(psa_hash_operation_t *operation) |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2206 | { |
Steven Cooreman | dbf8ced | 2021-03-04 13:01:18 +0100 | [diff] [blame] | 2207 | /* Aborting a non-active operation is allowed */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2208 | if (operation->id == 0) { |
| 2209 | return PSA_SUCCESS; |
| 2210 | } |
Steven Cooreman | dbf8ced | 2021-03-04 13:01:18 +0100 | [diff] [blame] | 2211 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2212 | psa_status_t status = psa_driver_wrapper_hash_abort(operation); |
Steven Cooreman | dbf8ced | 2021-03-04 13:01:18 +0100 | [diff] [blame] | 2213 | operation->id = 0; |
| 2214 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2215 | return status; |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2216 | } |
| 2217 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2218 | psa_status_t psa_hash_setup(psa_hash_operation_t *operation, |
| 2219 | psa_algorithm_t alg) |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2220 | { |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2221 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Steven Cooreman | dbf8ced | 2021-03-04 13:01:18 +0100 | [diff] [blame] | 2222 | |
Steven Cooreman | dbf8ced | 2021-03-04 13:01:18 +0100 | [diff] [blame] | 2223 | /* A context must be freshly initialized before it can be set up. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2224 | if (operation->id != 0) { |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2225 | status = PSA_ERROR_BAD_STATE; |
| 2226 | goto exit; |
| 2227 | } |
Steven Cooreman | dbf8ced | 2021-03-04 13:01:18 +0100 | [diff] [blame] | 2228 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2229 | if (!PSA_ALG_IS_HASH(alg)) { |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2230 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 2231 | goto exit; |
| 2232 | } |
Jaeden Amero | 36ee5d0 | 2019-02-19 09:25:10 +0000 | [diff] [blame] | 2233 | |
Steven Cooreman | b6bf4bb | 2021-03-15 19:00:14 +0100 | [diff] [blame] | 2234 | /* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only |
| 2235 | * directly zeroes the int-sized dummy member of the context union. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2236 | memset(&operation->ctx, 0, sizeof(operation->ctx)); |
Steven Cooreman | 893232f | 2021-03-15 12:23:37 +0100 | [diff] [blame] | 2237 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2238 | status = psa_driver_wrapper_hash_setup(operation, alg); |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2239 | |
| 2240 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2241 | if (status != PSA_SUCCESS) { |
| 2242 | psa_hash_abort(operation); |
| 2243 | } |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2244 | |
| 2245 | return status; |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2246 | } |
| 2247 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2248 | psa_status_t psa_hash_update(psa_hash_operation_t *operation, |
| 2249 | const uint8_t *input, |
| 2250 | size_t input_length) |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2251 | { |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2252 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 2253 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2254 | if (operation->id == 0) { |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2255 | status = PSA_ERROR_BAD_STATE; |
| 2256 | goto exit; |
| 2257 | } |
Gilles Peskine | 94e4454 | 2018-07-12 16:58:43 +0200 | [diff] [blame] | 2258 | |
Steven Cooreman | c828835 | 2021-03-04 14:02:19 +0100 | [diff] [blame] | 2259 | /* Don't require hash implementations to behave correctly on a |
| 2260 | * zero-length input, which may have an invalid pointer. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2261 | if (input_length == 0) { |
| 2262 | return PSA_SUCCESS; |
| 2263 | } |
Steven Cooreman | c828835 | 2021-03-04 14:02:19 +0100 | [diff] [blame] | 2264 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2265 | status = psa_driver_wrapper_hash_update(operation, input, input_length); |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2266 | |
| 2267 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2268 | if (status != PSA_SUCCESS) { |
| 2269 | psa_hash_abort(operation); |
| 2270 | } |
Steven Cooreman | dbf8ced | 2021-03-04 13:01:18 +0100 | [diff] [blame] | 2271 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2272 | return status; |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2273 | } |
| 2274 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2275 | psa_status_t psa_hash_finish(psa_hash_operation_t *operation, |
| 2276 | uint8_t *hash, |
| 2277 | size_t hash_size, |
| 2278 | size_t *hash_length) |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2279 | { |
Steven Cooreman | fbe0928 | 2021-03-08 18:41:12 +0100 | [diff] [blame] | 2280 | *hash_length = 0; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2281 | if (operation->id == 0) { |
| 2282 | return PSA_ERROR_BAD_STATE; |
| 2283 | } |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2284 | |
Steven Cooreman | 1e58235 | 2021-02-18 17:24:37 +0100 | [diff] [blame] | 2285 | psa_status_t status = psa_driver_wrapper_hash_finish( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2286 | operation, hash, hash_size, hash_length); |
| 2287 | psa_hash_abort(operation); |
| 2288 | return status; |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2289 | } |
| 2290 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2291 | psa_status_t psa_hash_verify(psa_hash_operation_t *operation, |
| 2292 | const uint8_t *hash, |
| 2293 | size_t hash_length) |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2294 | { |
Ronald Cron | 69a6342 | 2021-10-18 09:47:58 +0200 | [diff] [blame] | 2295 | uint8_t actual_hash[PSA_HASH_MAX_SIZE]; |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2296 | size_t actual_hash_length; |
Steven Cooreman | dbf8ced | 2021-03-04 13:01:18 +0100 | [diff] [blame] | 2297 | psa_status_t status = psa_hash_finish( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2298 | operation, |
| 2299 | actual_hash, sizeof(actual_hash), |
| 2300 | &actual_hash_length); |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2301 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2302 | if (status != PSA_SUCCESS) { |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2303 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2304 | } |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2305 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2306 | if (actual_hash_length != hash_length) { |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2307 | status = PSA_ERROR_INVALID_SIGNATURE; |
| 2308 | goto exit; |
| 2309 | } |
| 2310 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2311 | if (mbedtls_psa_safer_memcmp(hash, actual_hash, actual_hash_length) != 0) { |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2312 | status = PSA_ERROR_INVALID_SIGNATURE; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2313 | } |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2314 | |
| 2315 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2316 | mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash)); |
| 2317 | if (status != PSA_SUCCESS) { |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2318 | psa_hash_abort(operation); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2319 | } |
Dave Rodgman | 685b6a7 | 2021-06-24 11:49:14 +0100 | [diff] [blame] | 2320 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2321 | return status; |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2322 | } |
| 2323 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2324 | psa_status_t psa_hash_compute(psa_algorithm_t alg, |
| 2325 | const uint8_t *input, size_t input_length, |
| 2326 | uint8_t *hash, size_t hash_size, |
| 2327 | size_t *hash_length) |
Gilles Peskine | 0a749c8 | 2019-11-28 19:33:58 +0100 | [diff] [blame] | 2328 | { |
Steven Cooreman | fbe0928 | 2021-03-08 18:41:12 +0100 | [diff] [blame] | 2329 | *hash_length = 0; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2330 | if (!PSA_ALG_IS_HASH(alg)) { |
| 2331 | return PSA_ERROR_INVALID_ARGUMENT; |
| 2332 | } |
Steven Cooreman | f66d5fd | 2021-03-08 18:40:40 +0100 | [diff] [blame] | 2333 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2334 | return psa_driver_wrapper_hash_compute(alg, input, input_length, |
| 2335 | hash, hash_size, hash_length); |
Gilles Peskine | 0a749c8 | 2019-11-28 19:33:58 +0100 | [diff] [blame] | 2336 | } |
| 2337 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2338 | psa_status_t psa_hash_compare(psa_algorithm_t alg, |
| 2339 | const uint8_t *input, size_t input_length, |
| 2340 | const uint8_t *hash, size_t hash_length) |
Gilles Peskine | 0a749c8 | 2019-11-28 19:33:58 +0100 | [diff] [blame] | 2341 | { |
Ronald Cron | 69a6342 | 2021-10-18 09:47:58 +0200 | [diff] [blame] | 2342 | uint8_t actual_hash[PSA_HASH_MAX_SIZE]; |
Steven Cooreman | 84d670d | 2021-02-18 16:22:53 +0100 | [diff] [blame] | 2343 | size_t actual_hash_length; |
Steven Cooreman | f66d5fd | 2021-03-08 18:40:40 +0100 | [diff] [blame] | 2344 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2345 | if (!PSA_ALG_IS_HASH(alg)) { |
| 2346 | return PSA_ERROR_INVALID_ARGUMENT; |
| 2347 | } |
Steven Cooreman | f66d5fd | 2021-03-08 18:40:40 +0100 | [diff] [blame] | 2348 | |
Steven Cooreman | 1e58235 | 2021-02-18 17:24:37 +0100 | [diff] [blame] | 2349 | psa_status_t status = psa_driver_wrapper_hash_compute( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2350 | alg, input, input_length, |
| 2351 | actual_hash, sizeof(actual_hash), |
| 2352 | &actual_hash_length); |
| 2353 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 60aebec | 2021-12-13 12:33:18 +0100 | [diff] [blame] | 2354 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2355 | } |
| 2356 | if (actual_hash_length != hash_length) { |
Gilles Peskine | 60aebec | 2021-12-13 12:33:18 +0100 | [diff] [blame] | 2357 | status = PSA_ERROR_INVALID_SIGNATURE; |
| 2358 | goto exit; |
| 2359 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2360 | if (mbedtls_psa_safer_memcmp(hash, actual_hash, actual_hash_length) != 0) { |
Gilles Peskine | 60aebec | 2021-12-13 12:33:18 +0100 | [diff] [blame] | 2361 | status = PSA_ERROR_INVALID_SIGNATURE; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2362 | } |
Gilles Peskine | 60aebec | 2021-12-13 12:33:18 +0100 | [diff] [blame] | 2363 | |
| 2364 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2365 | mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash)); |
| 2366 | return status; |
Gilles Peskine | 0a749c8 | 2019-11-28 19:33:58 +0100 | [diff] [blame] | 2367 | } |
| 2368 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2369 | psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation, |
| 2370 | psa_hash_operation_t *target_operation) |
Gilles Peskine | ebb2c3e | 2019-01-19 12:03:41 +0100 | [diff] [blame] | 2371 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2372 | if (source_operation->id == 0 || |
| 2373 | target_operation->id != 0) { |
| 2374 | return PSA_ERROR_BAD_STATE; |
Steven Cooreman | dbf8ced | 2021-03-04 13:01:18 +0100 | [diff] [blame] | 2375 | } |
Gilles Peskine | ebb2c3e | 2019-01-19 12:03:41 +0100 | [diff] [blame] | 2376 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2377 | psa_status_t status = psa_driver_wrapper_hash_clone(source_operation, |
| 2378 | target_operation); |
| 2379 | if (status != PSA_SUCCESS) { |
| 2380 | psa_hash_abort(target_operation); |
| 2381 | } |
Steven Cooreman | dbf8ced | 2021-03-04 13:01:18 +0100 | [diff] [blame] | 2382 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2383 | return status; |
Gilles Peskine | ebb2c3e | 2019-01-19 12:03:41 +0100 | [diff] [blame] | 2384 | } |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2385 | |
| 2386 | |
Gilles Peskine | 9ef733f | 2018-02-07 21:05:37 +0100 | [diff] [blame] | 2387 | /****************************************************************/ |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2388 | /* MAC */ |
| 2389 | /****************************************************************/ |
| 2390 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2391 | psa_status_t psa_mac_abort(psa_mac_operation_t *operation) |
Gilles Peskine | 16c0f4f | 2018-06-20 16:05:20 +0200 | [diff] [blame] | 2392 | { |
Steven Cooreman | e680419 | 2021-03-19 18:28:56 +0100 | [diff] [blame] | 2393 | /* Aborting a non-active operation is allowed */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2394 | if (operation->id == 0) { |
| 2395 | return PSA_SUCCESS; |
| 2396 | } |
Gilles Peskine | 16c0f4f | 2018-06-20 16:05:20 +0200 | [diff] [blame] | 2397 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2398 | psa_status_t status = psa_driver_wrapper_mac_abort(operation); |
Steven Cooreman | 72f736a | 2021-05-07 14:14:37 +0200 | [diff] [blame] | 2399 | operation->mac_size = 0; |
| 2400 | operation->is_sign = 0; |
Steven Cooreman | e680419 | 2021-03-19 18:28:56 +0100 | [diff] [blame] | 2401 | operation->id = 0; |
Gilles Peskine | 16c0f4f | 2018-06-20 16:05:20 +0200 | [diff] [blame] | 2402 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2403 | return status; |
Gilles Peskine | 16c0f4f | 2018-06-20 16:05:20 +0200 | [diff] [blame] | 2404 | } |
| 2405 | |
Ronald Cron | 2dff3b2 | 2021-06-17 16:33:22 +0200 | [diff] [blame] | 2406 | static psa_status_t psa_mac_finalize_alg_and_key_validation( |
| 2407 | psa_algorithm_t alg, |
Ronald Cron | 79bdd82 | 2021-06-17 16:46:44 +0200 | [diff] [blame] | 2408 | const psa_key_attributes_t *attributes, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2409 | uint8_t *mac_size) |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2410 | { |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 2411 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2412 | psa_key_type_t key_type = psa_get_key_type(attributes); |
| 2413 | size_t key_bits = psa_get_key_bits(attributes); |
Steven Cooreman | 77e2cc5 | 2021-03-19 17:05:52 +0100 | [diff] [blame] | 2414 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2415 | if (!PSA_ALG_IS_MAC(alg)) { |
| 2416 | return PSA_ERROR_INVALID_ARGUMENT; |
| 2417 | } |
Steven Cooreman | e680419 | 2021-03-19 18:28:56 +0100 | [diff] [blame] | 2418 | |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 2419 | /* Validate the combination of key type and algorithm */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2420 | status = psa_mac_key_can_do(alg, key_type); |
| 2421 | if (status != PSA_SUCCESS) { |
| 2422 | return status; |
| 2423 | } |
Steven Cooreman | 15472f8 | 2021-03-02 16:16:22 +0100 | [diff] [blame] | 2424 | |
Steven Cooreman | d1a68f1 | 2021-05-10 11:13:41 +0200 | [diff] [blame] | 2425 | /* Get the output length for the algorithm and key combination */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2426 | *mac_size = PSA_MAC_LENGTH(key_type, key_bits, alg); |
Steven Cooreman | 15472f8 | 2021-03-02 16:16:22 +0100 | [diff] [blame] | 2427 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2428 | if (*mac_size < 4) { |
Steven Cooreman | 15472f8 | 2021-03-02 16:16:22 +0100 | [diff] [blame] | 2429 | /* A very short MAC is too short for security since it can be |
| 2430 | * brute-forced. Ancient protocols with 32-bit MACs do exist, |
| 2431 | * so we make this our minimum, even though 32 bits is still |
| 2432 | * too small for security. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2433 | return PSA_ERROR_NOT_SUPPORTED; |
Steven Cooreman | 15472f8 | 2021-03-02 16:16:22 +0100 | [diff] [blame] | 2434 | } |
Gilles Peskine | ab1d7ab | 2018-07-06 16:07:47 +0200 | [diff] [blame] | 2435 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2436 | if (*mac_size > PSA_MAC_LENGTH(key_type, key_bits, |
| 2437 | PSA_ALG_FULL_LENGTH_MAC(alg))) { |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 2438 | /* It's impossible to "truncate" to a larger length than the full length |
| 2439 | * of the algorithm. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2440 | return PSA_ERROR_INVALID_ARGUMENT; |
Steven Cooreman | f9f7fdf | 2021-03-03 19:04:05 +0100 | [diff] [blame] | 2441 | } |
| 2442 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2443 | if (*mac_size > PSA_MAC_MAX_SIZE) { |
Gilles Peskine | a9b6c80 | 2022-03-16 13:54:49 +0100 | [diff] [blame] | 2444 | /* PSA_MAC_LENGTH returns the correct length even for a MAC algorithm |
| 2445 | * that is disabled in the compile-time configuration. The result can |
| 2446 | * therefore be larger than PSA_MAC_MAX_SIZE, which does take the |
| 2447 | * configuration into account. In this case, force a return of |
| 2448 | * PSA_ERROR_NOT_SUPPORTED here. Otherwise psa_mac_verify(), or |
| 2449 | * psa_mac_compute(mac_size=PSA_MAC_MAX_SIZE), would return |
| 2450 | * PSA_ERROR_BUFFER_TOO_SMALL for an unsupported algorithm whose MAC size |
| 2451 | * is larger than PSA_MAC_MAX_SIZE, which is misleading and which breaks |
| 2452 | * systematically generated tests. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2453 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | a9b6c80 | 2022-03-16 13:54:49 +0100 | [diff] [blame] | 2454 | } |
| 2455 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2456 | return PSA_SUCCESS; |
Ronald Cron | 2dff3b2 | 2021-06-17 16:33:22 +0200 | [diff] [blame] | 2457 | } |
| 2458 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2459 | static psa_status_t psa_mac_setup(psa_mac_operation_t *operation, |
| 2460 | mbedtls_svc_key_id_t key, |
| 2461 | psa_algorithm_t alg, |
| 2462 | int is_sign) |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 2463 | { |
| 2464 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 2465 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
Dave Rodgman | 5464824 | 2021-06-24 11:49:45 +0100 | [diff] [blame] | 2466 | psa_key_slot_t *slot = NULL; |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2467 | |
| 2468 | /* A context must be freshly initialized before it can be set up. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2469 | if (operation->id != 0) { |
Dave Rodgman | 5464824 | 2021-06-24 11:49:45 +0100 | [diff] [blame] | 2470 | status = PSA_ERROR_BAD_STATE; |
| 2471 | goto exit; |
| 2472 | } |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2473 | |
| 2474 | status = psa_get_and_lock_key_slot_with_policy( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2475 | key, |
| 2476 | &slot, |
| 2477 | is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE, |
| 2478 | alg); |
| 2479 | if (status != PSA_SUCCESS) { |
Dave Rodgman | 5464824 | 2021-06-24 11:49:45 +0100 | [diff] [blame] | 2480 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2481 | } |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2482 | |
| 2483 | psa_key_attributes_t attributes = { |
| 2484 | .core = slot->attr |
| 2485 | }; |
| 2486 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2487 | status = psa_mac_finalize_alg_and_key_validation(alg, &attributes, |
| 2488 | &operation->mac_size); |
| 2489 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2490 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2491 | } |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2492 | |
| 2493 | operation->is_sign = is_sign; |
Steven Cooreman | e680419 | 2021-03-19 18:28:56 +0100 | [diff] [blame] | 2494 | /* Dispatch the MAC setup call with validated input */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2495 | if (is_sign) { |
| 2496 | status = psa_driver_wrapper_mac_sign_setup(operation, |
| 2497 | &attributes, |
| 2498 | slot->key.data, |
| 2499 | slot->key.bytes, |
| 2500 | alg); |
| 2501 | } else { |
| 2502 | status = psa_driver_wrapper_mac_verify_setup(operation, |
| 2503 | &attributes, |
| 2504 | slot->key.data, |
| 2505 | slot->key.bytes, |
| 2506 | alg); |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2507 | } |
Gilles Peskine | 7e454bc | 2018-06-11 17:26:17 +0200 | [diff] [blame] | 2508 | |
Gilles Peskine | fbfac68 | 2018-07-08 20:51:54 +0200 | [diff] [blame] | 2509 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2510 | if (status != PSA_SUCCESS) { |
| 2511 | psa_mac_abort(operation); |
| 2512 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 2513 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2514 | unlock_status = psa_unlock_key_slot(slot); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 2515 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2516 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2517 | } |
| 2518 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2519 | psa_status_t psa_mac_sign_setup(psa_mac_operation_t *operation, |
| 2520 | mbedtls_svc_key_id_t key, |
| 2521 | psa_algorithm_t alg) |
Gilles Peskine | 89167cb | 2018-07-08 20:12:23 +0200 | [diff] [blame] | 2522 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2523 | return psa_mac_setup(operation, key, alg, 1); |
Gilles Peskine | 89167cb | 2018-07-08 20:12:23 +0200 | [diff] [blame] | 2524 | } |
| 2525 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2526 | psa_status_t psa_mac_verify_setup(psa_mac_operation_t *operation, |
| 2527 | mbedtls_svc_key_id_t key, |
| 2528 | psa_algorithm_t alg) |
Gilles Peskine | 89167cb | 2018-07-08 20:12:23 +0200 | [diff] [blame] | 2529 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2530 | return psa_mac_setup(operation, key, alg, 0); |
Gilles Peskine | 89167cb | 2018-07-08 20:12:23 +0200 | [diff] [blame] | 2531 | } |
| 2532 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2533 | psa_status_t psa_mac_update(psa_mac_operation_t *operation, |
| 2534 | const uint8_t *input, |
| 2535 | size_t input_length) |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2536 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2537 | if (operation->id == 0) { |
| 2538 | return PSA_ERROR_BAD_STATE; |
| 2539 | } |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2540 | |
Steven Cooreman | 6e7f291 | 2021-03-19 18:38:46 +0100 | [diff] [blame] | 2541 | /* Don't require hash implementations to behave correctly on a |
| 2542 | * zero-length input, which may have an invalid pointer. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2543 | if (input_length == 0) { |
| 2544 | return PSA_SUCCESS; |
| 2545 | } |
Nir Sonnenschein | dcd636a | 2018-06-04 16:03:32 +0300 | [diff] [blame] | 2546 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2547 | psa_status_t status = psa_driver_wrapper_mac_update(operation, |
| 2548 | input, input_length); |
| 2549 | if (status != PSA_SUCCESS) { |
| 2550 | psa_mac_abort(operation); |
| 2551 | } |
Steven Cooreman | 6e7f291 | 2021-03-19 18:38:46 +0100 | [diff] [blame] | 2552 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2553 | return status; |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2554 | } |
| 2555 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2556 | psa_status_t psa_mac_sign_finish(psa_mac_operation_t *operation, |
| 2557 | uint8_t *mac, |
| 2558 | size_t mac_size, |
| 2559 | size_t *mac_length) |
mohammad1603 | 6df908f | 2018-04-02 08:34:15 -0700 | [diff] [blame] | 2560 | { |
Steven Cooreman | a5b860a | 2021-03-19 19:04:39 +0100 | [diff] [blame] | 2561 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 2562 | psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED; |
Steven Cooreman | 77e2cc5 | 2021-03-19 17:05:52 +0100 | [diff] [blame] | 2563 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2564 | if (operation->id == 0) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 2565 | status = PSA_ERROR_BAD_STATE; |
Dave Rodgman | 90d1cb8 | 2021-06-25 09:09:02 +0100 | [diff] [blame] | 2566 | goto exit; |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 2567 | } |
Jaeden Amero | 252ef28 | 2019-02-15 14:05:35 +0000 | [diff] [blame] | 2568 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2569 | if (!operation->is_sign) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 2570 | status = PSA_ERROR_BAD_STATE; |
Dave Rodgman | 90d1cb8 | 2021-06-25 09:09:02 +0100 | [diff] [blame] | 2571 | goto exit; |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 2572 | } |
Steven Cooreman | 72f736a | 2021-05-07 14:14:37 +0200 | [diff] [blame] | 2573 | |
Steven Cooreman | 8af5c5c | 2021-05-11 11:09:13 +0200 | [diff] [blame] | 2574 | /* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL) |
| 2575 | * once all the error checks are done. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2576 | if (operation->mac_size == 0) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 2577 | status = PSA_ERROR_BAD_STATE; |
Dave Rodgman | 90d1cb8 | 2021-06-25 09:09:02 +0100 | [diff] [blame] | 2578 | goto exit; |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 2579 | } |
Steven Cooreman | 8af5c5c | 2021-05-11 11:09:13 +0200 | [diff] [blame] | 2580 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2581 | if (mac_size < operation->mac_size) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 2582 | status = PSA_ERROR_BUFFER_TOO_SMALL; |
Dave Rodgman | 90d1cb8 | 2021-06-25 09:09:02 +0100 | [diff] [blame] | 2583 | goto exit; |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 2584 | } |
Gilles Peskine | 5d0b864 | 2018-07-08 20:35:02 +0200 | [diff] [blame] | 2585 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2586 | status = psa_driver_wrapper_mac_sign_finish(operation, |
| 2587 | mac, operation->mac_size, |
| 2588 | mac_length); |
Steven Cooreman | 72f736a | 2021-05-07 14:14:37 +0200 | [diff] [blame] | 2589 | |
Dave Rodgman | 90d1cb8 | 2021-06-25 09:09:02 +0100 | [diff] [blame] | 2590 | exit: |
Ronald Cron | c3dd75f | 2021-06-18 13:05:48 +0200 | [diff] [blame] | 2591 | /* In case of success, set the potential excess room in the output buffer |
| 2592 | * to an invalid value, to avoid potentially leaking a longer MAC. |
| 2593 | * In case of error, set the output length and content to a safe default, |
| 2594 | * such that in case the caller misses an error check, the output would be |
| 2595 | * an unachievable MAC. |
| 2596 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2597 | if (status != PSA_SUCCESS) { |
Steven Cooreman | 72f736a | 2021-05-07 14:14:37 +0200 | [diff] [blame] | 2598 | *mac_length = mac_size; |
Ronald Cron | c3dd75f | 2021-06-18 13:05:48 +0200 | [diff] [blame] | 2599 | operation->mac_size = 0; |
Steven Cooreman | 72f736a | 2021-05-07 14:14:37 +0200 | [diff] [blame] | 2600 | } |
mohammad1603 | 6df908f | 2018-04-02 08:34:15 -0700 | [diff] [blame] | 2601 | |
Paul Elliott | dc42ca8 | 2023-02-24 18:11:59 +0000 | [diff] [blame] | 2602 | psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length); |
Ronald Cron | c3dd75f | 2021-06-18 13:05:48 +0200 | [diff] [blame] | 2603 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2604 | abort_status = psa_mac_abort(operation); |
Gilles Peskine | 5d0b864 | 2018-07-08 20:35:02 +0200 | [diff] [blame] | 2605 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2606 | return status == PSA_SUCCESS ? abort_status : status; |
mohammad1603 | 6df908f | 2018-04-02 08:34:15 -0700 | [diff] [blame] | 2607 | } |
| 2608 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2609 | psa_status_t psa_mac_verify_finish(psa_mac_operation_t *operation, |
| 2610 | const uint8_t *mac, |
| 2611 | size_t mac_length) |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2612 | { |
Steven Cooreman | a5b860a | 2021-03-19 19:04:39 +0100 | [diff] [blame] | 2613 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 2614 | psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED; |
Steven Cooreman | 77e2cc5 | 2021-03-19 17:05:52 +0100 | [diff] [blame] | 2615 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2616 | if (operation->id == 0) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 2617 | status = PSA_ERROR_BAD_STATE; |
Dave Rodgman | 90d1cb8 | 2021-06-25 09:09:02 +0100 | [diff] [blame] | 2618 | goto exit; |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 2619 | } |
Jaeden Amero | 252ef28 | 2019-02-15 14:05:35 +0000 | [diff] [blame] | 2620 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2621 | if (operation->is_sign) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 2622 | status = PSA_ERROR_BAD_STATE; |
Dave Rodgman | 90d1cb8 | 2021-06-25 09:09:02 +0100 | [diff] [blame] | 2623 | goto exit; |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 2624 | } |
Steven Cooreman | 72f736a | 2021-05-07 14:14:37 +0200 | [diff] [blame] | 2625 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2626 | if (operation->mac_size != mac_length) { |
Steven Cooreman | 72f736a | 2021-05-07 14:14:37 +0200 | [diff] [blame] | 2627 | status = PSA_ERROR_INVALID_SIGNATURE; |
Dave Rodgman | 90d1cb8 | 2021-06-25 09:09:02 +0100 | [diff] [blame] | 2628 | goto exit; |
Steven Cooreman | 72f736a | 2021-05-07 14:14:37 +0200 | [diff] [blame] | 2629 | } |
| 2630 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2631 | status = psa_driver_wrapper_mac_verify_finish(operation, |
| 2632 | mac, mac_length); |
Steven Cooreman | 72f736a | 2021-05-07 14:14:37 +0200 | [diff] [blame] | 2633 | |
Dave Rodgman | 90d1cb8 | 2021-06-25 09:09:02 +0100 | [diff] [blame] | 2634 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2635 | abort_status = psa_mac_abort(operation); |
mohammad1603 | 6df908f | 2018-04-02 08:34:15 -0700 | [diff] [blame] | 2636 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2637 | return status == PSA_SUCCESS ? abort_status : status; |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2638 | } |
| 2639 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2640 | static psa_status_t psa_mac_compute_internal(mbedtls_svc_key_id_t key, |
| 2641 | psa_algorithm_t alg, |
| 2642 | const uint8_t *input, |
| 2643 | size_t input_length, |
| 2644 | uint8_t *mac, |
| 2645 | size_t mac_size, |
| 2646 | size_t *mac_length, |
| 2647 | int is_sign) |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2648 | { |
| 2649 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 51131b5 | 2021-06-17 17:17:20 +0200 | [diff] [blame] | 2650 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
| 2651 | psa_key_slot_t *slot; |
| 2652 | uint8_t operation_mac_size = 0; |
Gilles Peskine | 8c9def3 | 2018-02-08 10:02:12 +0100 | [diff] [blame] | 2653 | |
Ronald Cron | 51131b5 | 2021-06-17 17:17:20 +0200 | [diff] [blame] | 2654 | status = psa_get_and_lock_key_slot_with_policy( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2655 | key, |
| 2656 | &slot, |
| 2657 | is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE, |
| 2658 | alg); |
| 2659 | if (status != PSA_SUCCESS) { |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2660 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2661 | } |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2662 | |
Ronald Cron | 51131b5 | 2021-06-17 17:17:20 +0200 | [diff] [blame] | 2663 | psa_key_attributes_t attributes = { |
| 2664 | .core = slot->attr |
| 2665 | }; |
| 2666 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2667 | status = psa_mac_finalize_alg_and_key_validation(alg, &attributes, |
| 2668 | &operation_mac_size); |
| 2669 | if (status != PSA_SUCCESS) { |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2670 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2671 | } |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2672 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2673 | if (mac_size < operation_mac_size) { |
Ronald Cron | 51131b5 | 2021-06-17 17:17:20 +0200 | [diff] [blame] | 2674 | status = PSA_ERROR_BUFFER_TOO_SMALL; |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2675 | goto exit; |
Ronald Cron | 51131b5 | 2021-06-17 17:17:20 +0200 | [diff] [blame] | 2676 | } |
| 2677 | |
| 2678 | status = psa_driver_wrapper_mac_compute( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2679 | &attributes, |
| 2680 | slot->key.data, slot->key.bytes, |
| 2681 | alg, |
| 2682 | input, input_length, |
| 2683 | mac, operation_mac_size, mac_length); |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2684 | |
| 2685 | exit: |
Ronald Cron | c3dd75f | 2021-06-18 13:05:48 +0200 | [diff] [blame] | 2686 | /* In case of success, set the potential excess room in the output buffer |
| 2687 | * to an invalid value, to avoid potentially leaking a longer MAC. |
| 2688 | * In case of error, set the output length and content to a safe default, |
| 2689 | * such that in case the caller misses an error check, the output would be |
| 2690 | * an unachievable MAC. |
| 2691 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2692 | if (status != PSA_SUCCESS) { |
Ronald Cron | 51131b5 | 2021-06-17 17:17:20 +0200 | [diff] [blame] | 2693 | *mac_length = mac_size; |
Ronald Cron | c3dd75f | 2021-06-18 13:05:48 +0200 | [diff] [blame] | 2694 | operation_mac_size = 0; |
Ronald Cron | 51131b5 | 2021-06-17 17:17:20 +0200 | [diff] [blame] | 2695 | } |
Paul Elliott | dc42ca8 | 2023-02-24 18:11:59 +0000 | [diff] [blame] | 2696 | |
| 2697 | psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length); |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2698 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2699 | unlock_status = psa_unlock_key_slot(slot); |
Ronald Cron | 51131b5 | 2021-06-17 17:17:20 +0200 | [diff] [blame] | 2700 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2701 | return (status == PSA_SUCCESS) ? unlock_status : status; |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2702 | } |
| 2703 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2704 | psa_status_t psa_mac_compute(mbedtls_svc_key_id_t key, |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2705 | psa_algorithm_t alg, |
| 2706 | const uint8_t *input, |
| 2707 | size_t input_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2708 | uint8_t *mac, |
| 2709 | size_t mac_size, |
| 2710 | size_t *mac_length) |
| 2711 | { |
| 2712 | return psa_mac_compute_internal(key, alg, |
| 2713 | input, input_length, |
| 2714 | mac, mac_size, mac_length, 1); |
| 2715 | } |
| 2716 | |
| 2717 | psa_status_t psa_mac_verify(mbedtls_svc_key_id_t key, |
| 2718 | psa_algorithm_t alg, |
| 2719 | const uint8_t *input, |
| 2720 | size_t input_length, |
| 2721 | const uint8_t *mac, |
| 2722 | size_t mac_length) |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2723 | { |
| 2724 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | a587cbc | 2021-06-18 14:51:29 +0200 | [diff] [blame] | 2725 | uint8_t actual_mac[PSA_MAC_MAX_SIZE]; |
| 2726 | size_t actual_mac_length; |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2727 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2728 | status = psa_mac_compute_internal(key, alg, |
| 2729 | input, input_length, |
| 2730 | actual_mac, sizeof(actual_mac), |
| 2731 | &actual_mac_length, 0); |
| 2732 | if (status != PSA_SUCCESS) { |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2733 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2734 | } |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2735 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2736 | if (mac_length != actual_mac_length) { |
Ronald Cron | a587cbc | 2021-06-18 14:51:29 +0200 | [diff] [blame] | 2737 | status = PSA_ERROR_INVALID_SIGNATURE; |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2738 | goto exit; |
Ronald Cron | a587cbc | 2021-06-18 14:51:29 +0200 | [diff] [blame] | 2739 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2740 | if (mbedtls_psa_safer_memcmp(mac, actual_mac, actual_mac_length) != 0) { |
Ronald Cron | a587cbc | 2021-06-18 14:51:29 +0200 | [diff] [blame] | 2741 | status = PSA_ERROR_INVALID_SIGNATURE; |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2742 | goto exit; |
Ronald Cron | a587cbc | 2021-06-18 14:51:29 +0200 | [diff] [blame] | 2743 | } |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2744 | |
| 2745 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2746 | mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac)); |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2747 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2748 | return status; |
gabor-mezei-arm | 4076d3e | 2021-03-01 15:34:18 +0100 | [diff] [blame] | 2749 | } |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 2750 | |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 2751 | /****************************************************************/ |
| 2752 | /* Asymmetric cryptography */ |
| 2753 | /****************************************************************/ |
| 2754 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2755 | static psa_status_t psa_sign_verify_check_alg(int input_is_message, |
| 2756 | psa_algorithm_t alg) |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2757 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2758 | if (input_is_message) { |
| 2759 | if (!PSA_ALG_IS_SIGN_MESSAGE(alg)) { |
| 2760 | return PSA_ERROR_INVALID_ARGUMENT; |
| 2761 | } |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2762 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2763 | if (PSA_ALG_IS_SIGN_HASH(alg)) { |
| 2764 | if (!PSA_ALG_IS_HASH(PSA_ALG_SIGN_GET_HASH(alg))) { |
| 2765 | return PSA_ERROR_INVALID_ARGUMENT; |
| 2766 | } |
| 2767 | } |
| 2768 | } else { |
| 2769 | if (!PSA_ALG_IS_SIGN_HASH(alg)) { |
| 2770 | return PSA_ERROR_INVALID_ARGUMENT; |
gabor-mezei-arm | 8b3e886 | 2021-05-05 13:56:27 +0200 | [diff] [blame] | 2771 | } |
| 2772 | } |
gabor-mezei-arm | 8b3e886 | 2021-05-05 13:56:27 +0200 | [diff] [blame] | 2773 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2774 | return PSA_SUCCESS; |
gabor-mezei-arm | 8b3e886 | 2021-05-05 13:56:27 +0200 | [diff] [blame] | 2775 | } |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2776 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2777 | static psa_status_t psa_sign_internal(mbedtls_svc_key_id_t key, |
| 2778 | int input_is_message, |
| 2779 | psa_algorithm_t alg, |
| 2780 | const uint8_t *input, |
| 2781 | size_t input_length, |
| 2782 | uint8_t *signature, |
| 2783 | size_t signature_size, |
| 2784 | size_t *signature_length) |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2785 | { |
| 2786 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 2787 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
| 2788 | psa_key_slot_t *slot; |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2789 | |
| 2790 | *signature_length = 0; |
| 2791 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2792 | status = psa_sign_verify_check_alg(input_is_message, alg); |
| 2793 | if (status != PSA_SUCCESS) { |
gabor-mezei-arm | 8b3e886 | 2021-05-05 13:56:27 +0200 | [diff] [blame] | 2794 | return status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2795 | } |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2796 | |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2797 | /* Immediately reject a zero-length signature buffer. This guarantees |
gabor-mezei-arm | 12b4f34 | 2021-05-05 13:54:55 +0200 | [diff] [blame] | 2798 | * that signature must be a valid pointer. (On the other hand, the input |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2799 | * buffer can in principle be empty since it doesn't actually have |
| 2800 | * to be a hash.) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2801 | if (signature_size == 0) { |
| 2802 | return PSA_ERROR_BUFFER_TOO_SMALL; |
| 2803 | } |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2804 | |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2805 | status = psa_get_and_lock_key_slot_with_policy( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2806 | key, &slot, |
| 2807 | input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE : |
| 2808 | PSA_KEY_USAGE_SIGN_HASH, |
| 2809 | alg); |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2810 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2811 | if (status != PSA_SUCCESS) { |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2812 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2813 | } |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2814 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2815 | if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) { |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2816 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 2817 | goto exit; |
| 2818 | } |
| 2819 | |
| 2820 | psa_key_attributes_t attributes = { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2821 | .core = slot->attr |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2822 | }; |
| 2823 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2824 | if (input_is_message) { |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2825 | status = psa_driver_wrapper_sign_message( |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2826 | &attributes, slot->key.data, slot->key.bytes, |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2827 | alg, input, input_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2828 | signature, signature_size, signature_length); |
| 2829 | } else { |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2830 | |
| 2831 | status = psa_driver_wrapper_sign_hash( |
| 2832 | &attributes, slot->key.data, slot->key.bytes, |
| 2833 | alg, input, input_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2834 | signature, signature_size, signature_length); |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2835 | } |
| 2836 | |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2837 | |
| 2838 | exit: |
Paul Elliott | 59200a2 | 2023-02-21 15:07:40 +0000 | [diff] [blame] | 2839 | psa_wipe_tag_output_buffer(signature, status, signature_size, |
| 2840 | *signature_length); |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2841 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2842 | unlock_status = psa_unlock_key_slot(slot); |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2843 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2844 | return (status == PSA_SUCCESS) ? unlock_status : status; |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2845 | } |
| 2846 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2847 | static psa_status_t psa_verify_internal(mbedtls_svc_key_id_t key, |
| 2848 | int input_is_message, |
| 2849 | psa_algorithm_t alg, |
| 2850 | const uint8_t *input, |
| 2851 | size_t input_length, |
| 2852 | const uint8_t *signature, |
| 2853 | size_t signature_length) |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2854 | { |
| 2855 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 2856 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
| 2857 | psa_key_slot_t *slot; |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2858 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2859 | status = psa_sign_verify_check_alg(input_is_message, alg); |
| 2860 | if (status != PSA_SUCCESS) { |
gabor-mezei-arm | 8b3e886 | 2021-05-05 13:56:27 +0200 | [diff] [blame] | 2861 | return status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2862 | } |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2863 | |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2864 | status = psa_get_and_lock_key_slot_with_policy( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2865 | key, &slot, |
| 2866 | input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE : |
| 2867 | PSA_KEY_USAGE_VERIFY_HASH, |
| 2868 | alg); |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2869 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2870 | if (status != PSA_SUCCESS) { |
| 2871 | return status; |
| 2872 | } |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2873 | |
| 2874 | psa_key_attributes_t attributes = { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2875 | .core = slot->attr |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2876 | }; |
| 2877 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2878 | if (input_is_message) { |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2879 | status = psa_driver_wrapper_verify_message( |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2880 | &attributes, slot->key.data, slot->key.bytes, |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2881 | alg, input, input_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2882 | signature, signature_length); |
| 2883 | } else { |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2884 | status = psa_driver_wrapper_verify_hash( |
| 2885 | &attributes, slot->key.data, slot->key.bytes, |
| 2886 | alg, input, input_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2887 | signature, signature_length); |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2888 | } |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2889 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2890 | unlock_status = psa_unlock_key_slot(slot); |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2891 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2892 | return (status == PSA_SUCCESS) ? unlock_status : status; |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2893 | |
| 2894 | } |
| 2895 | |
gabor-mezei-arm | 6883fd2 | 2021-05-05 14:18:36 +0200 | [diff] [blame] | 2896 | psa_status_t psa_sign_message_builtin( |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2897 | const psa_key_attributes_t *attributes, |
| 2898 | const uint8_t *key_buffer, |
| 2899 | size_t key_buffer_size, |
| 2900 | psa_algorithm_t alg, |
| 2901 | const uint8_t *input, |
| 2902 | size_t input_length, |
| 2903 | uint8_t *signature, |
| 2904 | size_t signature_size, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2905 | size_t *signature_length) |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2906 | { |
| 2907 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2908 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2909 | if (PSA_ALG_IS_SIGN_HASH(alg)) { |
gabor-mezei-arm | f9820f9 | 2021-05-03 16:26:20 +0200 | [diff] [blame] | 2910 | size_t hash_length; |
| 2911 | uint8_t hash[PSA_HASH_MAX_SIZE]; |
| 2912 | |
gabor-mezei-arm | 0f62240 | 2021-04-29 16:48:44 +0200 | [diff] [blame] | 2913 | status = psa_driver_wrapper_hash_compute( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2914 | PSA_ALG_SIGN_GET_HASH(alg), |
| 2915 | input, input_length, |
| 2916 | hash, sizeof(hash), &hash_length); |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2917 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2918 | if (status != PSA_SUCCESS) { |
gabor-mezei-arm | 0f62240 | 2021-04-29 16:48:44 +0200 | [diff] [blame] | 2919 | return status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2920 | } |
gabor-mezei-arm | f9820f9 | 2021-05-03 16:26:20 +0200 | [diff] [blame] | 2921 | |
| 2922 | return psa_driver_wrapper_sign_hash( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2923 | attributes, key_buffer, key_buffer_size, |
| 2924 | alg, hash, hash_length, |
| 2925 | signature, signature_size, signature_length); |
gabor-mezei-arm | 0f62240 | 2021-04-29 16:48:44 +0200 | [diff] [blame] | 2926 | } |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2927 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2928 | return PSA_ERROR_NOT_SUPPORTED; |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2929 | } |
| 2930 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2931 | psa_status_t psa_sign_message(mbedtls_svc_key_id_t key, |
| 2932 | psa_algorithm_t alg, |
| 2933 | const uint8_t *input, |
| 2934 | size_t input_length, |
| 2935 | uint8_t *signature, |
| 2936 | size_t signature_size, |
| 2937 | size_t *signature_length) |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2938 | { |
| 2939 | return psa_sign_internal( |
gabor-mezei-arm | 8b3e886 | 2021-05-05 13:56:27 +0200 | [diff] [blame] | 2940 | key, 1, alg, input, input_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2941 | signature, signature_size, signature_length); |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2942 | } |
| 2943 | |
gabor-mezei-arm | 6883fd2 | 2021-05-05 14:18:36 +0200 | [diff] [blame] | 2944 | psa_status_t psa_verify_message_builtin( |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2945 | const psa_key_attributes_t *attributes, |
| 2946 | const uint8_t *key_buffer, |
| 2947 | size_t key_buffer_size, |
| 2948 | psa_algorithm_t alg, |
| 2949 | const uint8_t *input, |
| 2950 | size_t input_length, |
| 2951 | const uint8_t *signature, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2952 | size_t signature_length) |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2953 | { |
| 2954 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2955 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2956 | if (PSA_ALG_IS_SIGN_HASH(alg)) { |
gabor-mezei-arm | f9820f9 | 2021-05-03 16:26:20 +0200 | [diff] [blame] | 2957 | size_t hash_length; |
| 2958 | uint8_t hash[PSA_HASH_MAX_SIZE]; |
| 2959 | |
gabor-mezei-arm | 0f62240 | 2021-04-29 16:48:44 +0200 | [diff] [blame] | 2960 | status = psa_driver_wrapper_hash_compute( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2961 | PSA_ALG_SIGN_GET_HASH(alg), |
| 2962 | input, input_length, |
| 2963 | hash, sizeof(hash), &hash_length); |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2964 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2965 | if (status != PSA_SUCCESS) { |
gabor-mezei-arm | 0f62240 | 2021-04-29 16:48:44 +0200 | [diff] [blame] | 2966 | return status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2967 | } |
gabor-mezei-arm | f9820f9 | 2021-05-03 16:26:20 +0200 | [diff] [blame] | 2968 | |
| 2969 | return psa_driver_wrapper_verify_hash( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2970 | attributes, key_buffer, key_buffer_size, |
| 2971 | alg, hash, hash_length, |
| 2972 | signature, signature_length); |
gabor-mezei-arm | 0f62240 | 2021-04-29 16:48:44 +0200 | [diff] [blame] | 2973 | } |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2974 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2975 | return PSA_ERROR_NOT_SUPPORTED; |
gabor-mezei-arm | 50eac35 | 2021-04-22 11:32:19 +0200 | [diff] [blame] | 2976 | } |
| 2977 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2978 | psa_status_t psa_verify_message(mbedtls_svc_key_id_t key, |
| 2979 | psa_algorithm_t alg, |
| 2980 | const uint8_t *input, |
| 2981 | size_t input_length, |
| 2982 | const uint8_t *signature, |
| 2983 | size_t signature_length) |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 2984 | { |
| 2985 | return psa_verify_internal( |
gabor-mezei-arm | 8b3e886 | 2021-05-05 13:56:27 +0200 | [diff] [blame] | 2986 | key, 1, alg, input, input_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2987 | signature, signature_length); |
gabor-mezei-arm | 4a21019 | 2021-04-14 21:14:28 +0200 | [diff] [blame] | 2988 | } |
| 2989 | |
gabor-mezei-arm | 6883fd2 | 2021-05-05 14:18:36 +0200 | [diff] [blame] | 2990 | psa_status_t psa_sign_hash_builtin( |
Ronald Cron | 1865993 | 2020-12-08 16:32:23 +0100 | [diff] [blame] | 2991 | const psa_key_attributes_t *attributes, |
| 2992 | const uint8_t *key_buffer, size_t key_buffer_size, |
| 2993 | psa_algorithm_t alg, const uint8_t *hash, size_t hash_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2994 | uint8_t *signature, size_t signature_size, size_t *signature_length) |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 2995 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2996 | if (attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR) { |
| 2997 | if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || |
| 2998 | PSA_ALG_IS_RSA_PSS(alg)) { |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 2999 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3000 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) |
| 3001 | return mbedtls_psa_rsa_sign_hash( |
| 3002 | attributes, |
| 3003 | key_buffer, key_buffer_size, |
| 3004 | alg, hash, hash_length, |
| 3005 | signature, signature_size, signature_length); |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 3006 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || |
| 3007 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3008 | } else { |
| 3009 | return PSA_ERROR_INVALID_ARGUMENT; |
Steven Cooreman | acda834 | 2020-07-24 23:09:52 +0200 | [diff] [blame] | 3010 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3011 | } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) { |
| 3012 | if (PSA_ALG_IS_ECDSA(alg)) { |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 3013 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3014 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) |
| 3015 | return mbedtls_psa_ecdsa_sign_hash( |
| 3016 | attributes, |
| 3017 | key_buffer, key_buffer_size, |
| 3018 | alg, hash, hash_length, |
| 3019 | signature, signature_size, signature_length); |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 3020 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 3021 | * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3022 | } else { |
| 3023 | return PSA_ERROR_INVALID_ARGUMENT; |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 3024 | } |
Ronald Cron | 8a494f3 | 2021-02-17 09:49:51 +0100 | [diff] [blame] | 3025 | } |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 3026 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3027 | (void) key_buffer; |
| 3028 | (void) key_buffer_size; |
| 3029 | (void) hash; |
| 3030 | (void) hash_length; |
| 3031 | (void) signature; |
| 3032 | (void) signature_size; |
| 3033 | (void) signature_length; |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 3034 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3035 | return PSA_ERROR_NOT_SUPPORTED; |
Ronald Cron | 1865993 | 2020-12-08 16:32:23 +0100 | [diff] [blame] | 3036 | } |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 3037 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3038 | psa_status_t psa_sign_hash(mbedtls_svc_key_id_t key, |
| 3039 | psa_algorithm_t alg, |
| 3040 | const uint8_t *hash, |
| 3041 | size_t hash_length, |
| 3042 | uint8_t *signature, |
| 3043 | size_t signature_size, |
| 3044 | size_t *signature_length) |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 3045 | { |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 3046 | return psa_sign_internal( |
gabor-mezei-arm | 8b3e886 | 2021-05-05 13:56:27 +0200 | [diff] [blame] | 3047 | key, 0, alg, hash, hash_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3048 | signature, signature_size, signature_length); |
itayzafrir | 5c75339 | 2018-05-08 11:18:38 +0300 | [diff] [blame] | 3049 | } |
| 3050 | |
gabor-mezei-arm | 6883fd2 | 2021-05-05 14:18:36 +0200 | [diff] [blame] | 3051 | psa_status_t psa_verify_hash_builtin( |
Ronald Cron | 1865993 | 2020-12-08 16:32:23 +0100 | [diff] [blame] | 3052 | const psa_key_attributes_t *attributes, |
| 3053 | const uint8_t *key_buffer, size_t key_buffer_size, |
| 3054 | psa_algorithm_t alg, const uint8_t *hash, size_t hash_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3055 | const uint8_t *signature, size_t signature_length) |
itayzafrir | 5c75339 | 2018-05-08 11:18:38 +0300 | [diff] [blame] | 3056 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3057 | if (PSA_KEY_TYPE_IS_RSA(attributes->core.type)) { |
| 3058 | if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || |
| 3059 | PSA_ALG_IS_RSA_PSS(alg)) { |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 3060 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3061 | defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) |
| 3062 | return mbedtls_psa_rsa_verify_hash( |
| 3063 | attributes, |
| 3064 | key_buffer, key_buffer_size, |
| 3065 | alg, hash, hash_length, |
| 3066 | signature, signature_length); |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 3067 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || |
| 3068 | * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3069 | } else { |
| 3070 | return PSA_ERROR_INVALID_ARGUMENT; |
Steven Cooreman | acda834 | 2020-07-24 23:09:52 +0200 | [diff] [blame] | 3071 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3072 | } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) { |
| 3073 | if (PSA_ALG_IS_ECDSA(alg)) { |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 3074 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3075 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) |
| 3076 | return mbedtls_psa_ecdsa_verify_hash( |
| 3077 | attributes, |
| 3078 | key_buffer, key_buffer_size, |
| 3079 | alg, hash, hash_length, |
| 3080 | signature, signature_length); |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 3081 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 3082 | * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3083 | } else { |
| 3084 | return PSA_ERROR_INVALID_ARGUMENT; |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 3085 | } |
Ronald Cron | 8a494f3 | 2021-02-17 09:49:51 +0100 | [diff] [blame] | 3086 | } |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 3087 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3088 | (void) key_buffer; |
| 3089 | (void) key_buffer_size; |
| 3090 | (void) hash; |
| 3091 | (void) hash_length; |
| 3092 | (void) signature; |
| 3093 | (void) signature_length; |
Ronald Cron | 4501c98 | 2021-03-19 20:09:32 +0100 | [diff] [blame] | 3094 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3095 | return PSA_ERROR_NOT_SUPPORTED; |
Ronald Cron | 1865993 | 2020-12-08 16:32:23 +0100 | [diff] [blame] | 3096 | } |
| 3097 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3098 | psa_status_t psa_verify_hash(mbedtls_svc_key_id_t key, |
| 3099 | psa_algorithm_t alg, |
| 3100 | const uint8_t *hash, |
| 3101 | size_t hash_length, |
| 3102 | const uint8_t *signature, |
| 3103 | size_t signature_length) |
itayzafrir | 5c75339 | 2018-05-08 11:18:38 +0300 | [diff] [blame] | 3104 | { |
gabor-mezei-arm | 5b44652 | 2021-04-20 12:11:35 +0200 | [diff] [blame] | 3105 | return psa_verify_internal( |
gabor-mezei-arm | 8b3e886 | 2021-05-05 13:56:27 +0200 | [diff] [blame] | 3106 | key, 0, alg, hash, hash_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3107 | signature, signature_length); |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 3108 | } |
| 3109 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3110 | psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key, |
| 3111 | psa_algorithm_t alg, |
| 3112 | const uint8_t *input, |
| 3113 | size_t input_length, |
| 3114 | const uint8_t *salt, |
| 3115 | size_t salt_length, |
| 3116 | uint8_t *output, |
| 3117 | size_t output_size, |
| 3118 | size_t *output_length) |
Nir Sonnenschein | 39e5914 | 2018-05-02 23:16:26 +0300 | [diff] [blame] | 3119 | { |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 3120 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 3121 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 2f060a8 | 2018-12-04 17:12:32 +0100 | [diff] [blame] | 3122 | psa_key_slot_t *slot; |
Gilles Peskine | b0b255c | 2018-07-06 17:01:38 +0200 | [diff] [blame] | 3123 | |
Darryl Green | 5cc689a | 2018-07-24 15:34:10 +0100 | [diff] [blame] | 3124 | (void) input; |
| 3125 | (void) input_length; |
| 3126 | (void) salt; |
| 3127 | (void) output; |
| 3128 | (void) output_size; |
| 3129 | |
Nir Sonnenschein | ca466c8 | 2018-06-04 16:43:12 +0300 | [diff] [blame] | 3130 | *output_length = 0; |
Nir Sonnenschein | 39e5914 | 2018-05-02 23:16:26 +0300 | [diff] [blame] | 3131 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3132 | if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) { |
| 3133 | return PSA_ERROR_INVALID_ARGUMENT; |
| 3134 | } |
Gilles Peskine | b3fc05d | 2018-06-30 19:04:35 +0200 | [diff] [blame] | 3135 | |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 3136 | status = psa_get_and_lock_transparent_key_slot_with_policy( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3137 | key, &slot, PSA_KEY_USAGE_ENCRYPT, alg); |
| 3138 | if (status != PSA_SUCCESS) { |
| 3139 | return status; |
| 3140 | } |
| 3141 | if (!(PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type) || |
| 3142 | PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type))) { |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 3143 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 3144 | goto exit; |
| 3145 | } |
Nir Sonnenschein | 39e5914 | 2018-05-02 23:16:26 +0300 | [diff] [blame] | 3146 | |
Przemyslaw Stekiel | 19e6142 | 2021-12-09 11:09:11 +0100 | [diff] [blame] | 3147 | psa_key_attributes_t attributes = { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3148 | .core = slot->attr |
Przemyslaw Stekiel | 19e6142 | 2021-12-09 11:09:11 +0100 | [diff] [blame] | 3149 | }; |
Steven Cooreman | a2371e5 | 2020-07-28 14:30:39 +0200 | [diff] [blame] | 3150 | |
Przemyslaw Stekiel | 19e6142 | 2021-12-09 11:09:11 +0100 | [diff] [blame] | 3151 | status = psa_driver_wrapper_asymmetric_encrypt( |
| 3152 | &attributes, slot->key.data, slot->key.bytes, |
| 3153 | alg, input, input_length, salt, salt_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3154 | output, output_size, output_length); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 3155 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3156 | unlock_status = psa_unlock_key_slot(slot); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 3157 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3158 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Gilles Peskine | 5b051bc | 2018-05-31 13:25:48 +0200 | [diff] [blame] | 3159 | } |
Nir Sonnenschein | 39e5914 | 2018-05-02 23:16:26 +0300 | [diff] [blame] | 3160 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3161 | psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key, |
| 3162 | psa_algorithm_t alg, |
| 3163 | const uint8_t *input, |
| 3164 | size_t input_length, |
| 3165 | const uint8_t *salt, |
| 3166 | size_t salt_length, |
| 3167 | uint8_t *output, |
| 3168 | size_t output_size, |
| 3169 | size_t *output_length) |
Nir Sonnenschein | 39e5914 | 2018-05-02 23:16:26 +0300 | [diff] [blame] | 3170 | { |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 3171 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 3172 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 2f060a8 | 2018-12-04 17:12:32 +0100 | [diff] [blame] | 3173 | psa_key_slot_t *slot; |
Gilles Peskine | b0b255c | 2018-07-06 17:01:38 +0200 | [diff] [blame] | 3174 | |
Darryl Green | 5cc689a | 2018-07-24 15:34:10 +0100 | [diff] [blame] | 3175 | (void) input; |
| 3176 | (void) input_length; |
| 3177 | (void) salt; |
| 3178 | (void) output; |
| 3179 | (void) output_size; |
| 3180 | |
Nir Sonnenschein | ca466c8 | 2018-06-04 16:43:12 +0300 | [diff] [blame] | 3181 | *output_length = 0; |
Nir Sonnenschein | 39e5914 | 2018-05-02 23:16:26 +0300 | [diff] [blame] | 3182 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3183 | if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) { |
| 3184 | return PSA_ERROR_INVALID_ARGUMENT; |
| 3185 | } |
Gilles Peskine | b3fc05d | 2018-06-30 19:04:35 +0200 | [diff] [blame] | 3186 | |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 3187 | status = psa_get_and_lock_transparent_key_slot_with_policy( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3188 | key, &slot, PSA_KEY_USAGE_DECRYPT, alg); |
| 3189 | if (status != PSA_SUCCESS) { |
| 3190 | return status; |
| 3191 | } |
| 3192 | if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) { |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 3193 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 3194 | goto exit; |
| 3195 | } |
Nir Sonnenschein | 39e5914 | 2018-05-02 23:16:26 +0300 | [diff] [blame] | 3196 | |
Przemyslaw Stekiel | 8d45c00 | 2021-12-13 08:58:19 +0100 | [diff] [blame] | 3197 | psa_key_attributes_t attributes = { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3198 | .core = slot->attr |
Przemyslaw Stekiel | 8d45c00 | 2021-12-13 08:58:19 +0100 | [diff] [blame] | 3199 | }; |
Nir Sonnenschein | 39e5914 | 2018-05-02 23:16:26 +0300 | [diff] [blame] | 3200 | |
Przemyslaw Stekiel | 8d45c00 | 2021-12-13 08:58:19 +0100 | [diff] [blame] | 3201 | status = psa_driver_wrapper_asymmetric_decrypt( |
| 3202 | &attributes, slot->key.data, slot->key.bytes, |
| 3203 | alg, input, input_length, salt, salt_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3204 | output, output_size, output_length); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 3205 | |
| 3206 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3207 | unlock_status = psa_unlock_key_slot(slot); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 3208 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3209 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Gilles Peskine | 5b051bc | 2018-05-31 13:25:48 +0200 | [diff] [blame] | 3210 | } |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 3211 | |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3212 | /****************************************************************/ |
| 3213 | /* Asymmetric interruptible cryptography */ |
| 3214 | /****************************************************************/ |
| 3215 | |
Paul Elliott | a16ce9f | 2023-02-21 14:19:23 +0000 | [diff] [blame] | 3216 | static uint32_t psa_interruptible_max_ops = PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED; |
| 3217 | |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3218 | void psa_interruptible_set_max_ops(uint32_t max_ops) |
| 3219 | { |
Paul Elliott | a16ce9f | 2023-02-21 14:19:23 +0000 | [diff] [blame] | 3220 | psa_interruptible_max_ops = max_ops; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3221 | } |
| 3222 | |
| 3223 | uint32_t psa_interruptible_get_max_ops(void) |
| 3224 | { |
Paul Elliott | a16ce9f | 2023-02-21 14:19:23 +0000 | [diff] [blame] | 3225 | return psa_interruptible_max_ops; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3226 | } |
| 3227 | |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3228 | uint32_t psa_sign_hash_get_num_ops( |
| 3229 | const psa_sign_hash_interruptible_operation_t *operation) |
| 3230 | { |
Paul Elliott | 296ede9 | 2022-12-15 17:00:30 +0000 | [diff] [blame] | 3231 | return operation->num_ops; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3232 | } |
| 3233 | |
| 3234 | uint32_t psa_verify_hash_get_num_ops( |
| 3235 | const psa_verify_hash_interruptible_operation_t *operation) |
| 3236 | { |
Paul Elliott | 296ede9 | 2022-12-15 17:00:30 +0000 | [diff] [blame] | 3237 | return operation->num_ops; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3238 | } |
| 3239 | |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3240 | static psa_status_t psa_sign_hash_abort_internal( |
| 3241 | psa_sign_hash_interruptible_operation_t *operation) |
| 3242 | { |
| 3243 | if (operation->id == 0) { |
| 3244 | /* The object has (apparently) been initialized but it is not (yet) |
| 3245 | * in use. It's ok to call abort on such an object, and there's |
| 3246 | * nothing to do. */ |
| 3247 | return PSA_SUCCESS; |
| 3248 | } |
| 3249 | |
| 3250 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 3251 | |
| 3252 | status = psa_driver_wrapper_sign_hash_abort(operation); |
| 3253 | |
| 3254 | operation->id = 0; |
| 3255 | |
Paul Elliott | e6145dc | 2023-02-07 12:51:21 +0000 | [diff] [blame] | 3256 | /* Do not clear either the error_occurred or num_ops elements here as they |
| 3257 | * only want to be cleared by the application calling abort, not by abort |
| 3258 | * being called at completion of an operation. */ |
| 3259 | |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3260 | return status; |
| 3261 | } |
| 3262 | |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3263 | psa_status_t psa_sign_hash_start( |
| 3264 | psa_sign_hash_interruptible_operation_t *operation, |
| 3265 | mbedtls_svc_key_id_t key, psa_algorithm_t alg, |
| 3266 | const uint8_t *hash, size_t hash_length) |
| 3267 | { |
| 3268 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 3269 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
| 3270 | psa_key_slot_t *slot; |
| 3271 | |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3272 | /* Check that start has not been previously called, or operation has not |
| 3273 | * previously errored. */ |
| 3274 | if (operation->id != 0 || operation->error_occurred) { |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3275 | return PSA_ERROR_BAD_STATE; |
| 3276 | } |
| 3277 | |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3278 | status = psa_sign_verify_check_alg(0, alg); |
| 3279 | if (status != PSA_SUCCESS) { |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3280 | operation->error_occurred = 1; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3281 | return status; |
| 3282 | } |
| 3283 | |
| 3284 | status = psa_get_and_lock_key_slot_with_policy(key, &slot, |
| 3285 | PSA_KEY_USAGE_SIGN_HASH, |
| 3286 | alg); |
| 3287 | |
| 3288 | if (status != PSA_SUCCESS) { |
| 3289 | goto exit; |
| 3290 | } |
| 3291 | |
| 3292 | if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) { |
| 3293 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 3294 | goto exit; |
| 3295 | } |
| 3296 | |
| 3297 | psa_key_attributes_t attributes = { |
| 3298 | .core = slot->attr |
| 3299 | }; |
| 3300 | |
Paul Elliott | 296ede9 | 2022-12-15 17:00:30 +0000 | [diff] [blame] | 3301 | /* Ensure ops count gets reset, in case of operation re-use. */ |
| 3302 | operation->num_ops = 0; |
| 3303 | |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3304 | status = psa_driver_wrapper_sign_hash_start(operation, &attributes, |
| 3305 | slot->key.data, |
| 3306 | slot->key.bytes, alg, |
| 3307 | hash, hash_length); |
| 3308 | exit: |
| 3309 | |
| 3310 | if (status != PSA_SUCCESS) { |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3311 | operation->error_occurred = 1; |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3312 | psa_sign_hash_abort_internal(operation); |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3313 | } |
| 3314 | |
| 3315 | unlock_status = psa_unlock_key_slot(slot); |
| 3316 | |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3317 | if (unlock_status != PSA_SUCCESS) { |
| 3318 | operation->error_occurred = 1; |
| 3319 | } |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3320 | |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3321 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3322 | } |
| 3323 | |
| 3324 | |
| 3325 | psa_status_t psa_sign_hash_complete( |
| 3326 | psa_sign_hash_interruptible_operation_t *operation, |
| 3327 | uint8_t *signature, size_t signature_size, |
| 3328 | size_t *signature_length) |
| 3329 | { |
| 3330 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 3331 | |
| 3332 | *signature_length = 0; |
| 3333 | |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3334 | /* Check that start has been called first, and that operation has not |
| 3335 | * previously errored. */ |
| 3336 | if (operation->id == 0 || operation->error_occurred) { |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3337 | status = PSA_ERROR_BAD_STATE; |
| 3338 | goto exit; |
| 3339 | } |
| 3340 | |
Paul Elliott | 096abc4 | 2023-02-03 18:33:23 +0000 | [diff] [blame] | 3341 | /* Immediately reject a zero-length signature buffer. This guarantees that |
| 3342 | * signature must be a valid pointer. */ |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3343 | if (signature_size == 0) { |
| 3344 | status = PSA_ERROR_BUFFER_TOO_SMALL; |
| 3345 | goto exit; |
| 3346 | } |
| 3347 | |
| 3348 | status = psa_driver_wrapper_sign_hash_complete(operation, signature, |
| 3349 | signature_size, |
| 3350 | signature_length); |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3351 | |
Paul Elliott | 296ede9 | 2022-12-15 17:00:30 +0000 | [diff] [blame] | 3352 | /* Update ops count with work done. */ |
Paul Elliott | de1114c | 2023-02-07 12:43:11 +0000 | [diff] [blame] | 3353 | operation->num_ops = psa_driver_wrapper_sign_hash_get_num_ops(operation); |
Paul Elliott | 296ede9 | 2022-12-15 17:00:30 +0000 | [diff] [blame] | 3354 | |
Paul Elliott | ebe225c | 2023-02-10 14:32:53 +0000 | [diff] [blame] | 3355 | exit: |
| 3356 | |
Paul Elliott | 59200a2 | 2023-02-21 15:07:40 +0000 | [diff] [blame] | 3357 | psa_wipe_tag_output_buffer(signature, status, signature_size, |
| 3358 | *signature_length); |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3359 | |
Paul Elliott | 53bb312 | 2023-02-10 14:22:22 +0000 | [diff] [blame] | 3360 | if (status != PSA_OPERATION_INCOMPLETE) { |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3361 | if (status != PSA_SUCCESS) { |
| 3362 | operation->error_occurred = 1; |
| 3363 | } |
| 3364 | |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3365 | psa_sign_hash_abort_internal(operation); |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3366 | } |
| 3367 | |
| 3368 | return status; |
| 3369 | } |
| 3370 | |
| 3371 | psa_status_t psa_sign_hash_abort( |
| 3372 | psa_sign_hash_interruptible_operation_t *operation) |
| 3373 | { |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3374 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 3375 | |
| 3376 | status = psa_sign_hash_abort_internal(operation); |
| 3377 | |
| 3378 | /* We clear the number of ops done here, so that it is not cleared when |
| 3379 | * the operation fails or succeeds, only on manual abort. */ |
| 3380 | operation->num_ops = 0; |
| 3381 | |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3382 | /* Likewise, failure state. */ |
| 3383 | operation->error_occurred = 0; |
| 3384 | |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3385 | return status; |
| 3386 | } |
| 3387 | |
| 3388 | static psa_status_t psa_verify_hash_abort_internal( |
| 3389 | psa_verify_hash_interruptible_operation_t *operation) |
| 3390 | { |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3391 | if (operation->id == 0) { |
| 3392 | /* The object has (apparently) been initialized but it is not (yet) |
| 3393 | * in use. It's ok to call abort on such an object, and there's |
| 3394 | * nothing to do. */ |
| 3395 | return PSA_SUCCESS; |
| 3396 | } |
| 3397 | |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3398 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 3399 | |
| 3400 | status = psa_driver_wrapper_verify_hash_abort(operation); |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3401 | |
| 3402 | operation->id = 0; |
| 3403 | |
Paul Elliott | e6145dc | 2023-02-07 12:51:21 +0000 | [diff] [blame] | 3404 | /* Do not clear either the error_occurred or num_ops elements here as they |
| 3405 | * only want to be cleared by the application calling abort, not by abort |
| 3406 | * being called at completion of an operation. */ |
| 3407 | |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3408 | return status; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3409 | } |
| 3410 | |
| 3411 | psa_status_t psa_verify_hash_start( |
| 3412 | psa_verify_hash_interruptible_operation_t *operation, |
| 3413 | mbedtls_svc_key_id_t key, psa_algorithm_t alg, |
| 3414 | const uint8_t *hash, size_t hash_length, |
| 3415 | const uint8_t *signature, size_t signature_length) |
| 3416 | { |
| 3417 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 3418 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
| 3419 | psa_key_slot_t *slot; |
| 3420 | |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3421 | /* Check that start has not been previously called, or operation has not |
| 3422 | * previously errored. */ |
| 3423 | if (operation->id != 0 || operation->error_occurred) { |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3424 | return PSA_ERROR_BAD_STATE; |
| 3425 | } |
| 3426 | |
| 3427 | status = psa_sign_verify_check_alg(0, alg); |
| 3428 | if (status != PSA_SUCCESS) { |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3429 | operation->error_occurred = 1; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3430 | return status; |
| 3431 | } |
| 3432 | |
| 3433 | status = psa_get_and_lock_key_slot_with_policy(key, &slot, |
| 3434 | PSA_KEY_USAGE_VERIFY_HASH, |
| 3435 | alg); |
| 3436 | |
| 3437 | if (status != PSA_SUCCESS) { |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3438 | operation->error_occurred = 1; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3439 | return status; |
| 3440 | } |
| 3441 | |
| 3442 | psa_key_attributes_t attributes = { |
| 3443 | .core = slot->attr |
| 3444 | }; |
| 3445 | |
Paul Elliott | 296ede9 | 2022-12-15 17:00:30 +0000 | [diff] [blame] | 3446 | /* Ensure ops count gets reset, in case of operation re-use. */ |
| 3447 | operation->num_ops = 0; |
| 3448 | |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3449 | status = psa_driver_wrapper_verify_hash_start(operation, &attributes, |
| 3450 | slot->key.data, |
| 3451 | slot->key.bytes, |
| 3452 | alg, hash, hash_length, |
| 3453 | signature, signature_length); |
| 3454 | |
| 3455 | if (status != PSA_SUCCESS) { |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3456 | operation->error_occurred = 1; |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3457 | psa_verify_hash_abort_internal(operation); |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3458 | } |
| 3459 | |
| 3460 | unlock_status = psa_unlock_key_slot(slot); |
| 3461 | |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3462 | if (unlock_status != PSA_SUCCESS) { |
| 3463 | operation->error_occurred = 1; |
| 3464 | } |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3465 | |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3466 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3467 | } |
| 3468 | |
| 3469 | psa_status_t psa_verify_hash_complete( |
| 3470 | psa_verify_hash_interruptible_operation_t *operation) |
| 3471 | { |
| 3472 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 3473 | |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3474 | /* Check that start has been called first, and that operation has not |
| 3475 | * previously errored. */ |
| 3476 | if (operation->id == 0 || operation->error_occurred) { |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3477 | status = PSA_ERROR_BAD_STATE; |
| 3478 | goto exit; |
| 3479 | } |
| 3480 | |
| 3481 | status = psa_driver_wrapper_verify_hash_complete(operation); |
| 3482 | |
Paul Elliott | 296ede9 | 2022-12-15 17:00:30 +0000 | [diff] [blame] | 3483 | /* Update ops count with work done. */ |
Paul Elliott | de1114c | 2023-02-07 12:43:11 +0000 | [diff] [blame] | 3484 | operation->num_ops = psa_driver_wrapper_verify_hash_get_num_ops( |
Paul Elliott | 296ede9 | 2022-12-15 17:00:30 +0000 | [diff] [blame] | 3485 | operation); |
| 3486 | |
Paul Elliott | ebe225c | 2023-02-10 14:32:53 +0000 | [diff] [blame] | 3487 | exit: |
| 3488 | |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3489 | if (status != PSA_OPERATION_INCOMPLETE) { |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3490 | if (status != PSA_SUCCESS) { |
| 3491 | operation->error_occurred = 1; |
| 3492 | } |
| 3493 | |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3494 | psa_verify_hash_abort_internal(operation); |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3495 | } |
| 3496 | |
| 3497 | return status; |
| 3498 | } |
| 3499 | |
| 3500 | psa_status_t psa_verify_hash_abort( |
| 3501 | psa_verify_hash_interruptible_operation_t *operation) |
| 3502 | { |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3503 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3504 | |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3505 | status = psa_verify_hash_abort_internal(operation); |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3506 | |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3507 | /* We clear the number of ops done here, so that it is not cleared when |
| 3508 | * the operation fails or succeeds, only on manual abort. */ |
| 3509 | operation->num_ops = 0; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3510 | |
Paul Elliott | c977441 | 2023-02-06 15:14:07 +0000 | [diff] [blame] | 3511 | /* Likewise, failure state. */ |
| 3512 | operation->error_occurred = 0; |
| 3513 | |
Paul Elliott | 59ad945 | 2022-12-18 15:09:02 +0000 | [diff] [blame] | 3514 | return status; |
Paul Elliott | 9fe12f6 | 2022-11-30 19:16:02 +0000 | [diff] [blame] | 3515 | } |
| 3516 | |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3517 | /****************************************************************/ |
| 3518 | /* Asymmetric interruptible cryptography internal */ |
| 3519 | /* implementations */ |
| 3520 | /****************************************************************/ |
Gilles Peskine | 7bcfc0a | 2018-06-18 21:49:39 +0200 | [diff] [blame] | 3521 | |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3522 | void mbedtls_psa_interruptible_set_max_ops(uint32_t max_ops) |
| 3523 | { |
Paul Elliott | 7cc4e81 | 2023-01-10 17:14:11 +0000 | [diff] [blame] | 3524 | |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3525 | #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
| 3526 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ |
| 3527 | defined(MBEDTLS_ECP_RESTARTABLE) |
| 3528 | |
| 3529 | /* Internal implementation uses zero to indicate infinite number max ops, |
| 3530 | * therefore avoid this value, and set to minimum possible. */ |
| 3531 | if (max_ops == 0) { |
| 3532 | max_ops = 1; |
| 3533 | } |
| 3534 | |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3535 | mbedtls_ecp_set_max_ops(max_ops); |
Paul Elliott | a16ce9f | 2023-02-21 14:19:23 +0000 | [diff] [blame] | 3536 | #else |
| 3537 | (void) max_ops; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3538 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 3539 | * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && |
| 3540 | * defined( MBEDTLS_ECP_RESTARTABLE ) */ |
| 3541 | } |
| 3542 | |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3543 | uint32_t mbedtls_psa_sign_hash_get_num_ops( |
Paul Elliott | f8e5b56 | 2023-02-19 18:43:45 +0000 | [diff] [blame] | 3544 | const mbedtls_psa_sign_hash_interruptible_operation_t *operation) |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3545 | { |
| 3546 | #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
| 3547 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ |
| 3548 | defined(MBEDTLS_ECP_RESTARTABLE) |
| 3549 | |
Paul Elliott | 93d9ca8 | 2023-02-15 18:14:21 +0000 | [diff] [blame] | 3550 | return operation->num_ops; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3551 | #else |
| 3552 | (void) operation; |
| 3553 | return 0; |
| 3554 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 3555 | * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && |
| 3556 | * defined( MBEDTLS_ECP_RESTARTABLE ) */ |
| 3557 | } |
| 3558 | |
| 3559 | uint32_t mbedtls_psa_verify_hash_get_num_ops( |
Paul Elliott | f8e5b56 | 2023-02-19 18:43:45 +0000 | [diff] [blame] | 3560 | const mbedtls_psa_verify_hash_interruptible_operation_t *operation) |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3561 | { |
| 3562 | #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
| 3563 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ |
| 3564 | defined(MBEDTLS_ECP_RESTARTABLE) |
| 3565 | |
Paul Elliott | 93d9ca8 | 2023-02-15 18:14:21 +0000 | [diff] [blame] | 3566 | return operation->num_ops; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3567 | #else |
| 3568 | (void) operation; |
| 3569 | return 0; |
| 3570 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 3571 | * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && |
| 3572 | * defined( MBEDTLS_ECP_RESTARTABLE ) */ |
| 3573 | } |
| 3574 | |
| 3575 | psa_status_t mbedtls_psa_sign_hash_start( |
| 3576 | mbedtls_psa_sign_hash_interruptible_operation_t *operation, |
| 3577 | const psa_key_attributes_t *attributes, const uint8_t *key_buffer, |
| 3578 | size_t key_buffer_size, psa_algorithm_t alg, |
| 3579 | const uint8_t *hash, size_t hash_length) |
| 3580 | { |
| 3581 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Paul Elliott | 0290a76 | 2023-02-09 14:30:24 +0000 | [diff] [blame] | 3582 | size_t required_hash_length; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3583 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3584 | if (!PSA_KEY_TYPE_IS_ECC(attributes->core.type)) { |
| 3585 | return PSA_ERROR_NOT_SUPPORTED; |
| 3586 | } |
| 3587 | |
| 3588 | if (!PSA_ALG_IS_ECDSA(alg)) { |
Paul Elliott | 813f9cd | 2023-02-05 15:28:46 +0000 | [diff] [blame] | 3589 | return PSA_ERROR_NOT_SUPPORTED; |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3590 | } |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3591 | |
| 3592 | #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3593 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ |
| 3594 | defined(MBEDTLS_ECP_RESTARTABLE) |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3595 | |
Paul Elliott | a1c9409 | 2023-02-15 16:38:04 +0000 | [diff] [blame] | 3596 | mbedtls_ecdsa_restart_init(&operation->restart_ctx); |
| 3597 | |
Paul Elliott | 93d9ca8 | 2023-02-15 18:14:21 +0000 | [diff] [blame] | 3598 | /* Ensure num_ops is zero'ed in case of context re-use. */ |
| 3599 | operation->num_ops = 0; |
| 3600 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3601 | status = mbedtls_psa_ecp_load_representation(attributes->core.type, |
| 3602 | attributes->core.bits, |
| 3603 | key_buffer, |
| 3604 | key_buffer_size, |
| 3605 | &operation->ctx); |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3606 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3607 | if (status != PSA_SUCCESS) { |
| 3608 | return status; |
| 3609 | } |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3610 | |
Paul Elliott | 1bc59df | 2023-02-05 13:41:57 +0000 | [diff] [blame] | 3611 | operation->coordinate_bytes = PSA_BITS_TO_BYTES( |
Paul Elliott | c569fc2 | 2023-02-10 13:02:54 +0000 | [diff] [blame] | 3612 | operation->ctx->grp.nbits); |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3613 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3614 | psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg); |
| 3615 | operation->md_alg = mbedtls_hash_info_md_from_psa(hash_alg); |
| 3616 | operation->alg = alg; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3617 | |
Paul Elliott | 0290a76 | 2023-02-09 14:30:24 +0000 | [diff] [blame] | 3618 | /* We only need to store the same length of hash as the private key size |
| 3619 | * here, it would be truncated by the internal implementation anyway. */ |
| 3620 | required_hash_length = (hash_length < operation->coordinate_bytes ? |
| 3621 | hash_length : operation->coordinate_bytes); |
| 3622 | |
Paul Elliott | ba70ad4 | 2023-02-15 18:23:53 +0000 | [diff] [blame] | 3623 | if (required_hash_length > sizeof(operation->hash)) { |
| 3624 | /* Shouldn't happen, but better safe than sorry. */ |
| 3625 | return PSA_ERROR_CORRUPTION_DETECTED; |
| 3626 | } |
| 3627 | |
Paul Elliott | 0290a76 | 2023-02-09 14:30:24 +0000 | [diff] [blame] | 3628 | memcpy(operation->hash, hash, required_hash_length); |
| 3629 | operation->hash_length = required_hash_length; |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3630 | |
| 3631 | return PSA_SUCCESS; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3632 | |
| 3633 | #else |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3634 | (void) operation; |
| 3635 | (void) key_buffer; |
| 3636 | (void) key_buffer_size; |
| 3637 | (void) alg; |
| 3638 | (void) hash; |
| 3639 | (void) hash_length; |
| 3640 | (void) status; |
Paul Elliott | 0290a76 | 2023-02-09 14:30:24 +0000 | [diff] [blame] | 3641 | (void) required_hash_length; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3642 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3643 | return PSA_ERROR_NOT_SUPPORTED; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3644 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 3645 | * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && |
| 3646 | * defined( MBEDTLS_ECP_RESTARTABLE ) */ |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3647 | } |
| 3648 | |
| 3649 | psa_status_t mbedtls_psa_sign_hash_complete( |
| 3650 | mbedtls_psa_sign_hash_interruptible_operation_t *operation, |
| 3651 | uint8_t *signature, size_t signature_size, |
| 3652 | size_t *signature_length) |
| 3653 | { |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3654 | #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
| 3655 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ |
| 3656 | defined(MBEDTLS_ECP_RESTARTABLE) |
| 3657 | |
Paul Elliott | a1c9409 | 2023-02-15 16:38:04 +0000 | [diff] [blame] | 3658 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Paul Elliott | 1243f93 | 2023-02-07 11:21:10 +0000 | [diff] [blame] | 3659 | mbedtls_mpi r; |
| 3660 | mbedtls_mpi s; |
| 3661 | |
Paul Elliott | 4684525 | 2023-02-03 14:59:11 +0000 | [diff] [blame] | 3662 | mbedtls_mpi_init(&r); |
| 3663 | mbedtls_mpi_init(&s); |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3664 | |
Paul Elliott | a16ce9f | 2023-02-21 14:19:23 +0000 | [diff] [blame] | 3665 | /* Ensure max_ops is set to the current value (or default). */ |
| 3666 | mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops()); |
| 3667 | |
Paul Elliott | a1c9409 | 2023-02-15 16:38:04 +0000 | [diff] [blame] | 3668 | if (signature_size < 2 * operation->coordinate_bytes) { |
| 3669 | status = PSA_ERROR_BUFFER_TOO_SMALL; |
| 3670 | goto exit; |
| 3671 | } |
| 3672 | |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3673 | if (PSA_ALG_ECDSA_IS_DETERMINISTIC(operation->alg)) { |
Paul Elliott | 4684525 | 2023-02-03 14:59:11 +0000 | [diff] [blame] | 3674 | |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3675 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) |
| 3676 | status = mbedtls_to_psa_error( |
| 3677 | mbedtls_ecdsa_sign_det_restartable(&operation->ctx->grp, |
Paul Elliott | 4684525 | 2023-02-03 14:59:11 +0000 | [diff] [blame] | 3678 | &r, |
| 3679 | &s, |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3680 | &operation->ctx->d, |
| 3681 | operation->hash, |
| 3682 | operation->hash_length, |
| 3683 | operation->md_alg, |
| 3684 | mbedtls_psa_get_random, |
| 3685 | MBEDTLS_PSA_RANDOM_STATE, |
| 3686 | &operation->restart_ctx)); |
| 3687 | #else /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */ |
Paul Elliott | 724bd25 | 2023-02-08 12:35:08 +0000 | [diff] [blame] | 3688 | status = PSA_ERROR_NOT_SUPPORTED; |
| 3689 | goto exit; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3690 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */ |
| 3691 | } else { |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3692 | status = mbedtls_to_psa_error( |
| 3693 | mbedtls_ecdsa_sign_restartable(&operation->ctx->grp, |
Paul Elliott | 4684525 | 2023-02-03 14:59:11 +0000 | [diff] [blame] | 3694 | &r, |
| 3695 | &s, |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3696 | &operation->ctx->d, |
| 3697 | operation->hash, |
| 3698 | operation->hash_length, |
| 3699 | mbedtls_psa_get_random, |
| 3700 | MBEDTLS_PSA_RANDOM_STATE, |
| 3701 | mbedtls_psa_get_random, |
| 3702 | MBEDTLS_PSA_RANDOM_STATE, |
| 3703 | &operation->restart_ctx)); |
| 3704 | } |
| 3705 | |
Paul Elliott | f8e5b56 | 2023-02-19 18:43:45 +0000 | [diff] [blame] | 3706 | /* Hide the fact that the restart context only holds a delta of number of |
| 3707 | * ops done during the last operation, not an absolute value. */ |
| 3708 | operation->num_ops += operation->restart_ctx.ecp.ops_done; |
| 3709 | |
Paul Elliott | 724bd25 | 2023-02-08 12:35:08 +0000 | [diff] [blame] | 3710 | if (status == PSA_SUCCESS) { |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3711 | status = mbedtls_to_psa_error( |
Paul Elliott | 4684525 | 2023-02-03 14:59:11 +0000 | [diff] [blame] | 3712 | mbedtls_mpi_write_binary(&r, |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3713 | signature, |
Paul Elliott | 1bc59df | 2023-02-05 13:41:57 +0000 | [diff] [blame] | 3714 | operation->coordinate_bytes) |
| 3715 | ); |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3716 | |
| 3717 | if (status != PSA_SUCCESS) { |
Paul Elliott | 724bd25 | 2023-02-08 12:35:08 +0000 | [diff] [blame] | 3718 | goto exit; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3719 | } |
| 3720 | |
| 3721 | status = mbedtls_to_psa_error( |
Paul Elliott | 4684525 | 2023-02-03 14:59:11 +0000 | [diff] [blame] | 3722 | mbedtls_mpi_write_binary(&s, |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3723 | signature + |
Paul Elliott | 1bc59df | 2023-02-05 13:41:57 +0000 | [diff] [blame] | 3724 | operation->coordinate_bytes, |
| 3725 | operation->coordinate_bytes) |
| 3726 | ); |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3727 | |
| 3728 | if (status != PSA_SUCCESS) { |
Paul Elliott | 724bd25 | 2023-02-08 12:35:08 +0000 | [diff] [blame] | 3729 | goto exit; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3730 | } |
| 3731 | |
Paul Elliott | 1bc59df | 2023-02-05 13:41:57 +0000 | [diff] [blame] | 3732 | *signature_length = operation->coordinate_bytes * 2; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3733 | |
Paul Elliott | 724bd25 | 2023-02-08 12:35:08 +0000 | [diff] [blame] | 3734 | status = PSA_SUCCESS; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3735 | } |
Paul Elliott | 724bd25 | 2023-02-08 12:35:08 +0000 | [diff] [blame] | 3736 | |
| 3737 | exit: |
| 3738 | |
| 3739 | mbedtls_mpi_free(&r); |
| 3740 | mbedtls_mpi_free(&s); |
| 3741 | return status; |
| 3742 | |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3743 | #else |
| 3744 | |
| 3745 | (void) operation; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3746 | (void) signature; |
| 3747 | (void) signature_size; |
| 3748 | (void) signature_length; |
| 3749 | |
| 3750 | return PSA_ERROR_NOT_SUPPORTED; |
| 3751 | |
| 3752 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 3753 | * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && |
| 3754 | * defined( MBEDTLS_ECP_RESTARTABLE ) */ |
| 3755 | } |
| 3756 | |
| 3757 | psa_status_t mbedtls_psa_sign_hash_abort( |
| 3758 | mbedtls_psa_sign_hash_interruptible_operation_t *operation) |
| 3759 | { |
| 3760 | |
| 3761 | #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
| 3762 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ |
| 3763 | defined(MBEDTLS_ECP_RESTARTABLE) |
| 3764 | |
| 3765 | if (operation->ctx) { |
| 3766 | mbedtls_ecdsa_free(operation->ctx); |
| 3767 | mbedtls_free(operation->ctx); |
Paul Elliott | f9c91a7 | 2023-02-05 18:06:38 +0000 | [diff] [blame] | 3768 | operation->ctx = NULL; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3769 | } |
| 3770 | |
| 3771 | mbedtls_ecdsa_restart_free(&operation->restart_ctx); |
| 3772 | |
Paul Elliott | 93d9ca8 | 2023-02-15 18:14:21 +0000 | [diff] [blame] | 3773 | operation->num_ops = 0; |
| 3774 | |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3775 | return PSA_SUCCESS; |
| 3776 | |
| 3777 | #else |
| 3778 | |
| 3779 | (void) operation; |
| 3780 | |
| 3781 | return PSA_ERROR_NOT_SUPPORTED; |
| 3782 | |
| 3783 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 3784 | * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && |
| 3785 | * defined( MBEDTLS_ECP_RESTARTABLE ) */ |
| 3786 | } |
| 3787 | |
| 3788 | psa_status_t mbedtls_psa_verify_hash_start( |
| 3789 | mbedtls_psa_verify_hash_interruptible_operation_t *operation, |
| 3790 | const psa_key_attributes_t *attributes, |
| 3791 | const uint8_t *key_buffer, size_t key_buffer_size, |
| 3792 | psa_algorithm_t alg, |
| 3793 | const uint8_t *hash, size_t hash_length, |
| 3794 | const uint8_t *signature, size_t signature_length) |
| 3795 | { |
| 3796 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Paul Elliott | 1bc59df | 2023-02-05 13:41:57 +0000 | [diff] [blame] | 3797 | size_t coordinate_bytes = 0; |
Paul Elliott | 0290a76 | 2023-02-09 14:30:24 +0000 | [diff] [blame] | 3798 | size_t required_hash_length = 0; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3799 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3800 | if (!PSA_KEY_TYPE_IS_ECC(attributes->core.type)) { |
| 3801 | return PSA_ERROR_NOT_SUPPORTED; |
| 3802 | } |
| 3803 | |
| 3804 | if (!PSA_ALG_IS_ECDSA(alg)) { |
Paul Elliott | 813f9cd | 2023-02-05 15:28:46 +0000 | [diff] [blame] | 3805 | return PSA_ERROR_NOT_SUPPORTED; |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3806 | } |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3807 | |
| 3808 | #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3809 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ |
| 3810 | defined(MBEDTLS_ECP_RESTARTABLE) |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3811 | |
Paul Elliott | a1c9409 | 2023-02-15 16:38:04 +0000 | [diff] [blame] | 3812 | mbedtls_ecdsa_restart_init(&operation->restart_ctx); |
| 3813 | mbedtls_mpi_init(&operation->r); |
| 3814 | mbedtls_mpi_init(&operation->s); |
| 3815 | |
Paul Elliott | 93d9ca8 | 2023-02-15 18:14:21 +0000 | [diff] [blame] | 3816 | /* Ensure num_ops is zero'ed in case of context re-use. */ |
| 3817 | operation->num_ops = 0; |
| 3818 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3819 | status = mbedtls_psa_ecp_load_representation(attributes->core.type, |
| 3820 | attributes->core.bits, |
| 3821 | key_buffer, |
| 3822 | key_buffer_size, |
| 3823 | &operation->ctx); |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3824 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3825 | if (status != PSA_SUCCESS) { |
| 3826 | return status; |
| 3827 | } |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3828 | |
Paul Elliott | c569fc2 | 2023-02-10 13:02:54 +0000 | [diff] [blame] | 3829 | coordinate_bytes = PSA_BITS_TO_BYTES(operation->ctx->grp.nbits); |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3830 | |
Paul Elliott | 1bc59df | 2023-02-05 13:41:57 +0000 | [diff] [blame] | 3831 | if (signature_length != 2 * coordinate_bytes) { |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3832 | return PSA_ERROR_INVALID_SIGNATURE; |
| 3833 | } |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3834 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3835 | status = mbedtls_to_psa_error( |
| 3836 | mbedtls_mpi_read_binary(&operation->r, |
| 3837 | signature, |
Paul Elliott | 1bc59df | 2023-02-05 13:41:57 +0000 | [diff] [blame] | 3838 | coordinate_bytes)); |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3839 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3840 | if (status != PSA_SUCCESS) { |
| 3841 | return status; |
| 3842 | } |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3843 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3844 | status = mbedtls_to_psa_error( |
| 3845 | mbedtls_mpi_read_binary(&operation->s, |
| 3846 | signature + |
Paul Elliott | 1bc59df | 2023-02-05 13:41:57 +0000 | [diff] [blame] | 3847 | coordinate_bytes, |
| 3848 | coordinate_bytes)); |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3849 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3850 | if (status != PSA_SUCCESS) { |
| 3851 | return status; |
| 3852 | } |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3853 | |
Paul Elliott | 2c9843f | 2023-02-15 17:32:42 +0000 | [diff] [blame] | 3854 | status = mbedtls_psa_ecp_load_public_part(operation->ctx); |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3855 | |
Paul Elliott | 2c9843f | 2023-02-15 17:32:42 +0000 | [diff] [blame] | 3856 | if (status != PSA_SUCCESS) { |
| 3857 | return status; |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3858 | } |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3859 | |
Paul Elliott | 0290a76 | 2023-02-09 14:30:24 +0000 | [diff] [blame] | 3860 | /* We only need to store the same length of hash as the private key size |
| 3861 | * here, it would be truncated by the internal implementation anyway. */ |
| 3862 | required_hash_length = (hash_length < coordinate_bytes ? hash_length : |
| 3863 | coordinate_bytes); |
| 3864 | |
Paul Elliott | ba70ad4 | 2023-02-15 18:23:53 +0000 | [diff] [blame] | 3865 | if (required_hash_length > sizeof(operation->hash)) { |
| 3866 | /* Shouldn't happen, but better safe than sorry. */ |
| 3867 | return PSA_ERROR_CORRUPTION_DETECTED; |
| 3868 | } |
| 3869 | |
Paul Elliott | 0290a76 | 2023-02-09 14:30:24 +0000 | [diff] [blame] | 3870 | memcpy(operation->hash, hash, required_hash_length); |
| 3871 | operation->hash_length = required_hash_length; |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3872 | |
| 3873 | return PSA_SUCCESS; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3874 | #else |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3875 | (void) operation; |
| 3876 | (void) key_buffer; |
| 3877 | (void) key_buffer_size; |
| 3878 | (void) alg; |
| 3879 | (void) hash; |
| 3880 | (void) hash_length; |
| 3881 | (void) signature; |
| 3882 | (void) signature_length; |
| 3883 | (void) status; |
Paul Elliott | 1243f93 | 2023-02-07 11:21:10 +0000 | [diff] [blame] | 3884 | (void) coordinate_bytes; |
Paul Elliott | 0290a76 | 2023-02-09 14:30:24 +0000 | [diff] [blame] | 3885 | (void) required_hash_length; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3886 | |
Paul Elliott | 068fe07 | 2023-01-16 13:59:15 +0000 | [diff] [blame] | 3887 | return PSA_ERROR_NOT_SUPPORTED; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3888 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 3889 | * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && |
| 3890 | * defined( MBEDTLS_ECP_RESTARTABLE ) */ |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3891 | } |
| 3892 | |
| 3893 | psa_status_t mbedtls_psa_verify_hash_complete( |
| 3894 | mbedtls_psa_verify_hash_interruptible_operation_t *operation) |
| 3895 | { |
| 3896 | |
| 3897 | #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
| 3898 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ |
| 3899 | defined(MBEDTLS_ECP_RESTARTABLE) |
| 3900 | |
Paul Elliott | f8e5b56 | 2023-02-19 18:43:45 +0000 | [diff] [blame] | 3901 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 3902 | |
Paul Elliott | a16ce9f | 2023-02-21 14:19:23 +0000 | [diff] [blame] | 3903 | /* Ensure max_ops is set to the current value (or default). */ |
| 3904 | mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops()); |
| 3905 | |
Paul Elliott | f8e5b56 | 2023-02-19 18:43:45 +0000 | [diff] [blame] | 3906 | status = mbedtls_to_psa_error( |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3907 | mbedtls_ecdsa_verify_restartable(&operation->ctx->grp, |
| 3908 | operation->hash, |
| 3909 | operation->hash_length, |
| 3910 | &operation->ctx->Q, |
| 3911 | &operation->r, |
| 3912 | &operation->s, |
| 3913 | &operation->restart_ctx)); |
| 3914 | |
Paul Elliott | f8e5b56 | 2023-02-19 18:43:45 +0000 | [diff] [blame] | 3915 | /* Hide the fact that the restart context only holds a delta of number of |
| 3916 | * ops done during the last operation, not an absolute value. */ |
| 3917 | operation->num_ops += operation->restart_ctx.ecp.ops_done; |
| 3918 | |
| 3919 | return status; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3920 | #else |
| 3921 | (void) operation; |
| 3922 | |
| 3923 | return PSA_ERROR_NOT_SUPPORTED; |
| 3924 | |
| 3925 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 3926 | * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && |
| 3927 | * defined( MBEDTLS_ECP_RESTARTABLE ) */ |
| 3928 | } |
| 3929 | |
| 3930 | psa_status_t mbedtls_psa_verify_hash_abort( |
| 3931 | mbedtls_psa_verify_hash_interruptible_operation_t *operation) |
| 3932 | { |
| 3933 | |
| 3934 | #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
| 3935 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ |
| 3936 | defined(MBEDTLS_ECP_RESTARTABLE) |
| 3937 | |
| 3938 | if (operation->ctx) { |
| 3939 | mbedtls_ecdsa_free(operation->ctx); |
| 3940 | mbedtls_free(operation->ctx); |
Paul Elliott | f9c91a7 | 2023-02-05 18:06:38 +0000 | [diff] [blame] | 3941 | operation->ctx = NULL; |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3942 | } |
| 3943 | |
| 3944 | mbedtls_ecdsa_restart_free(&operation->restart_ctx); |
| 3945 | |
Paul Elliott | 93d9ca8 | 2023-02-15 18:14:21 +0000 | [diff] [blame] | 3946 | operation->num_ops = 0; |
| 3947 | |
Paul Elliott | 588f8ed | 2022-12-02 18:10:26 +0000 | [diff] [blame] | 3948 | mbedtls_mpi_free(&operation->r); |
| 3949 | mbedtls_mpi_free(&operation->s); |
| 3950 | |
| 3951 | return PSA_SUCCESS; |
| 3952 | |
| 3953 | #else |
| 3954 | (void) operation; |
| 3955 | |
| 3956 | return PSA_ERROR_NOT_SUPPORTED; |
| 3957 | |
| 3958 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 3959 | * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && |
| 3960 | * defined( MBEDTLS_ECP_RESTARTABLE ) */ |
| 3961 | } |
Gilles Peskine | 7bcfc0a | 2018-06-18 21:49:39 +0200 | [diff] [blame] | 3962 | |
mohammad1603 | 503973b | 2018-03-12 15:59:30 +0200 | [diff] [blame] | 3963 | /****************************************************************/ |
| 3964 | /* Symmetric cryptography */ |
| 3965 | /****************************************************************/ |
| 3966 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3967 | static psa_status_t psa_cipher_setup(psa_cipher_operation_t *operation, |
| 3968 | mbedtls_svc_key_id_t key, |
| 3969 | psa_algorithm_t alg, |
| 3970 | mbedtls_operation_t cipher_operation) |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 3971 | { |
| 3972 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 3973 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
Dave Rodgman | 5464824 | 2021-06-24 11:49:45 +0100 | [diff] [blame] | 3974 | psa_key_slot_t *slot = NULL; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3975 | psa_key_usage_t usage = (cipher_operation == MBEDTLS_ENCRYPT ? |
| 3976 | PSA_KEY_USAGE_ENCRYPT : |
| 3977 | PSA_KEY_USAGE_DECRYPT); |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 3978 | |
| 3979 | /* A context must be freshly initialized before it can be set up. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3980 | if (operation->id != 0) { |
Dave Rodgman | 5464824 | 2021-06-24 11:49:45 +0100 | [diff] [blame] | 3981 | status = PSA_ERROR_BAD_STATE; |
| 3982 | goto exit; |
| 3983 | } |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 3984 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3985 | if (!PSA_ALG_IS_CIPHER(alg)) { |
Dave Rodgman | 5464824 | 2021-06-24 11:49:45 +0100 | [diff] [blame] | 3986 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 3987 | goto exit; |
| 3988 | } |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 3989 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3990 | status = psa_get_and_lock_key_slot_with_policy(key, &slot, usage, alg); |
| 3991 | if (status != PSA_SUCCESS) { |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 3992 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 3993 | } |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 3994 | |
Ronald Cron | 49fafa9 | 2021-03-10 08:34:23 +0100 | [diff] [blame] | 3995 | /* Initialize the operation struct members, except for id. The id member |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 3996 | * is used to indicate to psa_cipher_abort that there are resources to free, |
Ronald Cron | 49fafa9 | 2021-03-10 08:34:23 +0100 | [diff] [blame] | 3997 | * so we only set it (in the driver wrapper) after resources have been |
| 3998 | * allocated/initialized. */ |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 3999 | operation->iv_set = 0; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4000 | if (alg == PSA_ALG_ECB_NO_PADDING) { |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 4001 | operation->iv_required = 0; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4002 | } else { |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 4003 | operation->iv_required = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4004 | } |
| 4005 | operation->default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg); |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 4006 | |
Ronald Cron | a4af55f | 2020-12-14 14:36:06 +0100 | [diff] [blame] | 4007 | psa_key_attributes_t attributes = { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4008 | .core = slot->attr |
Ronald Cron | a4af55f | 2020-12-14 14:36:06 +0100 | [diff] [blame] | 4009 | }; |
| 4010 | |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 4011 | /* Try doing the operation through a driver before using software fallback. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4012 | if (cipher_operation == MBEDTLS_ENCRYPT) { |
| 4013 | status = psa_driver_wrapper_cipher_encrypt_setup(operation, |
| 4014 | &attributes, |
| 4015 | slot->key.data, |
| 4016 | slot->key.bytes, |
| 4017 | alg); |
| 4018 | } else { |
| 4019 | status = psa_driver_wrapper_cipher_decrypt_setup(operation, |
| 4020 | &attributes, |
| 4021 | slot->key.data, |
| 4022 | slot->key.bytes, |
| 4023 | alg); |
| 4024 | } |
Ronald Cron | ab99ac2 | 2020-10-01 16:38:28 +0200 | [diff] [blame] | 4025 | |
Gilles Peskine | 9ab61b6 | 2019-02-25 17:43:14 +0100 | [diff] [blame] | 4026 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4027 | if (status != PSA_SUCCESS) { |
| 4028 | psa_cipher_abort(operation); |
| 4029 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 4030 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4031 | unlock_status = psa_unlock_key_slot(slot); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 4032 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4033 | return (status == PSA_SUCCESS) ? unlock_status : status; |
mohammad1603 | 503973b | 2018-03-12 15:59:30 +0200 | [diff] [blame] | 4034 | } |
| 4035 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4036 | psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation, |
| 4037 | mbedtls_svc_key_id_t key, |
| 4038 | psa_algorithm_t alg) |
mohammad1603 | 8481e74 | 2018-03-18 13:57:31 +0200 | [diff] [blame] | 4039 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4040 | return psa_cipher_setup(operation, key, alg, MBEDTLS_ENCRYPT); |
mohammad1603 | 8481e74 | 2018-03-18 13:57:31 +0200 | [diff] [blame] | 4041 | } |
| 4042 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4043 | psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t *operation, |
| 4044 | mbedtls_svc_key_id_t key, |
| 4045 | psa_algorithm_t alg) |
mohammad1603 | 8481e74 | 2018-03-18 13:57:31 +0200 | [diff] [blame] | 4046 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4047 | return psa_cipher_setup(operation, key, alg, MBEDTLS_DECRYPT); |
mohammad1603 | 8481e74 | 2018-03-18 13:57:31 +0200 | [diff] [blame] | 4048 | } |
| 4049 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4050 | psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t *operation, |
| 4051 | uint8_t *iv, |
| 4052 | size_t iv_size, |
| 4053 | size_t *iv_length) |
mohammad1603 | 503973b | 2018-03-12 15:59:30 +0200 | [diff] [blame] | 4054 | { |
Ronald Cron | 6d05173 | 2020-10-01 14:10:20 +0200 | [diff] [blame] | 4055 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 2fb9052 | 2021-07-05 12:31:44 +0200 | [diff] [blame] | 4056 | uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE]; |
| 4057 | size_t default_iv_length; |
Ronald Cron | 5618a39 | 2021-03-26 09:52:26 +0100 | [diff] [blame] | 4058 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4059 | if (operation->id == 0) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4060 | status = PSA_ERROR_BAD_STATE; |
| 4061 | goto exit; |
Ronald Cron | c45b4af | 2020-09-29 16:18:05 +0200 | [diff] [blame] | 4062 | } |
| 4063 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4064 | if (operation->iv_set || !operation->iv_required) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4065 | status = PSA_ERROR_BAD_STATE; |
| 4066 | goto exit; |
Steven Cooreman | 7df0292 | 2020-09-09 15:28:49 +0200 | [diff] [blame] | 4067 | } |
Steven Cooreman | d3feccd | 2020-09-01 15:56:14 +0200 | [diff] [blame] | 4068 | |
Ronald Cron | 2fb9052 | 2021-07-05 12:31:44 +0200 | [diff] [blame] | 4069 | default_iv_length = operation->default_iv_length; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4070 | if (iv_size < default_iv_length) { |
Ronald Cron | 5618a39 | 2021-03-26 09:52:26 +0100 | [diff] [blame] | 4071 | status = PSA_ERROR_BUFFER_TOO_SMALL; |
| 4072 | goto exit; |
| 4073 | } |
Gilles Peskine | e553c65 | 2018-06-04 16:22:46 +0200 | [diff] [blame] | 4074 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4075 | if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) { |
Ronald Cron | 2fb9052 | 2021-07-05 12:31:44 +0200 | [diff] [blame] | 4076 | status = PSA_ERROR_GENERIC_ERROR; |
| 4077 | goto exit; |
| 4078 | } |
| 4079 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4080 | status = psa_generate_random(local_iv, default_iv_length); |
| 4081 | if (status != PSA_SUCCESS) { |
Ronald Cron | 5618a39 | 2021-03-26 09:52:26 +0100 | [diff] [blame] | 4082 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4083 | } |
Ronald Cron | 5618a39 | 2021-03-26 09:52:26 +0100 | [diff] [blame] | 4084 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4085 | status = psa_driver_wrapper_cipher_set_iv(operation, |
| 4086 | local_iv, default_iv_length); |
Ronald Cron | 5618a39 | 2021-03-26 09:52:26 +0100 | [diff] [blame] | 4087 | |
| 4088 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4089 | if (status == PSA_SUCCESS) { |
| 4090 | memcpy(iv, local_iv, default_iv_length); |
Ronald Cron | 2fb9052 | 2021-07-05 12:31:44 +0200 | [diff] [blame] | 4091 | *iv_length = default_iv_length; |
Steven Cooreman | 7df0292 | 2020-09-09 15:28:49 +0200 | [diff] [blame] | 4092 | operation->iv_set = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4093 | } else { |
Ronald Cron | 2fb9052 | 2021-07-05 12:31:44 +0200 | [diff] [blame] | 4094 | *iv_length = 0; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4095 | psa_cipher_abort(operation); |
Ronald Cron | 2fb9052 | 2021-07-05 12:31:44 +0200 | [diff] [blame] | 4096 | } |
Ronald Cron | 6d05173 | 2020-10-01 14:10:20 +0200 | [diff] [blame] | 4097 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4098 | return status; |
mohammad1603 | 503973b | 2018-03-12 15:59:30 +0200 | [diff] [blame] | 4099 | } |
| 4100 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4101 | psa_status_t psa_cipher_set_iv(psa_cipher_operation_t *operation, |
| 4102 | const uint8_t *iv, |
| 4103 | size_t iv_length) |
mohammad1603 | 503973b | 2018-03-12 15:59:30 +0200 | [diff] [blame] | 4104 | { |
Ronald Cron | 6d05173 | 2020-10-01 14:10:20 +0200 | [diff] [blame] | 4105 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | c45b4af | 2020-09-29 16:18:05 +0200 | [diff] [blame] | 4106 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4107 | if (operation->id == 0) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4108 | status = PSA_ERROR_BAD_STATE; |
| 4109 | goto exit; |
| 4110 | } |
Ronald Cron | c45b4af | 2020-09-29 16:18:05 +0200 | [diff] [blame] | 4111 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4112 | if (operation->iv_set || !operation->iv_required) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4113 | status = PSA_ERROR_BAD_STATE; |
| 4114 | goto exit; |
| 4115 | } |
Ronald Cron | a0d6817 | 2021-03-26 10:15:08 +0100 | [diff] [blame] | 4116 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4117 | if (iv_length > PSA_CIPHER_IV_MAX_SIZE) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4118 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 4119 | goto exit; |
| 4120 | } |
Steven Cooreman | d3feccd | 2020-09-01 15:56:14 +0200 | [diff] [blame] | 4121 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4122 | status = psa_driver_wrapper_cipher_set_iv(operation, |
| 4123 | iv, |
| 4124 | iv_length); |
Steven Cooreman | d3feccd | 2020-09-01 15:56:14 +0200 | [diff] [blame] | 4125 | |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4126 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4127 | if (status == PSA_SUCCESS) { |
itayzafrir | 534bd7c | 2018-08-02 13:56:32 +0300 | [diff] [blame] | 4128 | operation->iv_set = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4129 | } else { |
| 4130 | psa_cipher_abort(operation); |
| 4131 | } |
| 4132 | return status; |
mohammad1603 | 503973b | 2018-03-12 15:59:30 +0200 | [diff] [blame] | 4133 | } |
| 4134 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4135 | psa_status_t psa_cipher_update(psa_cipher_operation_t *operation, |
| 4136 | const uint8_t *input, |
| 4137 | size_t input_length, |
| 4138 | uint8_t *output, |
| 4139 | size_t output_size, |
| 4140 | size_t *output_length) |
mohammad1603 | 503973b | 2018-03-12 15:59:30 +0200 | [diff] [blame] | 4141 | { |
Steven Cooreman | ffecb7b | 2020-08-25 15:13:13 +0200 | [diff] [blame] | 4142 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 6d05173 | 2020-10-01 14:10:20 +0200 | [diff] [blame] | 4143 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4144 | if (operation->id == 0) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4145 | status = PSA_ERROR_BAD_STATE; |
| 4146 | goto exit; |
Steven Cooreman | 7df0292 | 2020-09-09 15:28:49 +0200 | [diff] [blame] | 4147 | } |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4148 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4149 | if (operation->iv_required && !operation->iv_set) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4150 | status = PSA_ERROR_BAD_STATE; |
| 4151 | goto exit; |
Steven Cooreman | 7df0292 | 2020-09-09 15:28:49 +0200 | [diff] [blame] | 4152 | } |
Jaeden Amero | ab43997 | 2019-02-15 14:12:05 +0000 | [diff] [blame] | 4153 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4154 | status = psa_driver_wrapper_cipher_update(operation, |
| 4155 | input, |
| 4156 | input_length, |
| 4157 | output, |
| 4158 | output_size, |
| 4159 | output_length); |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4160 | |
| 4161 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4162 | if (status != PSA_SUCCESS) { |
| 4163 | psa_cipher_abort(operation); |
| 4164 | } |
Ronald Cron | 6d05173 | 2020-10-01 14:10:20 +0200 | [diff] [blame] | 4165 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4166 | return status; |
mohammad1603 | 503973b | 2018-03-12 15:59:30 +0200 | [diff] [blame] | 4167 | } |
| 4168 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4169 | psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation, |
| 4170 | uint8_t *output, |
| 4171 | size_t output_size, |
| 4172 | size_t *output_length) |
mohammad1603 | 503973b | 2018-03-12 15:59:30 +0200 | [diff] [blame] | 4173 | { |
David Saada | b4ecc27 | 2019-02-14 13:48:10 +0200 | [diff] [blame] | 4174 | psa_status_t status = PSA_ERROR_GENERIC_ERROR; |
Ronald Cron | 6d05173 | 2020-10-01 14:10:20 +0200 | [diff] [blame] | 4175 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4176 | if (operation->id == 0) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4177 | status = PSA_ERROR_BAD_STATE; |
| 4178 | goto exit; |
Steven Cooreman | 7df0292 | 2020-09-09 15:28:49 +0200 | [diff] [blame] | 4179 | } |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4180 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4181 | if (operation->iv_required && !operation->iv_set) { |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4182 | status = PSA_ERROR_BAD_STATE; |
| 4183 | goto exit; |
Steven Cooreman | 7df0292 | 2020-09-09 15:28:49 +0200 | [diff] [blame] | 4184 | } |
Moran Peker | bed71a2 | 2018-04-22 20:19:20 +0300 | [diff] [blame] | 4185 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4186 | status = psa_driver_wrapper_cipher_finish(operation, |
| 4187 | output, |
| 4188 | output_size, |
| 4189 | output_length); |
Dave Rodgman | 38e62ae | 2021-06-23 11:38:39 +0100 | [diff] [blame] | 4190 | |
| 4191 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4192 | if (status == PSA_SUCCESS) { |
| 4193 | return psa_cipher_abort(operation); |
| 4194 | } else { |
Steven Cooreman | ef8575e | 2020-09-11 11:44:50 +0200 | [diff] [blame] | 4195 | *output_length = 0; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4196 | (void) psa_cipher_abort(operation); |
Janos Follath | 315b51c | 2018-07-09 16:04:51 +0100 | [diff] [blame] | 4197 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4198 | return status; |
Steven Cooreman | ef8575e | 2020-09-11 11:44:50 +0200 | [diff] [blame] | 4199 | } |
mohammad1603 | 503973b | 2018-03-12 15:59:30 +0200 | [diff] [blame] | 4200 | } |
| 4201 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4202 | psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation) |
Gilles Peskine | e553c65 | 2018-06-04 16:22:46 +0200 | [diff] [blame] | 4203 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4204 | if (operation->id == 0) { |
Steven Cooreman | a07b997 | 2020-09-10 14:54:14 +0200 | [diff] [blame] | 4205 | /* The object has (apparently) been initialized but it is not (yet) |
Gilles Peskine | 8173631 | 2018-06-26 15:04:31 +0200 | [diff] [blame] | 4206 | * in use. It's ok to call abort on such an object, and there's |
| 4207 | * nothing to do. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4208 | return PSA_SUCCESS; |
Gilles Peskine | 8173631 | 2018-06-26 15:04:31 +0200 | [diff] [blame] | 4209 | } |
Gilles Peskine | 16c0f4f | 2018-06-20 16:05:20 +0200 | [diff] [blame] | 4210 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4211 | psa_driver_wrapper_cipher_abort(operation); |
Gilles Peskine | e553c65 | 2018-06-04 16:22:46 +0200 | [diff] [blame] | 4212 | |
Ronald Cron | 49fafa9 | 2021-03-10 08:34:23 +0100 | [diff] [blame] | 4213 | operation->id = 0; |
Moran Peker | ad9d82c | 2018-04-30 12:31:04 +0300 | [diff] [blame] | 4214 | operation->iv_set = 0; |
Moran Peker | ad9d82c | 2018-04-30 12:31:04 +0300 | [diff] [blame] | 4215 | operation->iv_required = 0; |
Moran Peker | 41deec4 | 2018-04-04 15:43:05 +0300 | [diff] [blame] | 4216 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4217 | return PSA_SUCCESS; |
mohammad1603 | 503973b | 2018-03-12 15:59:30 +0200 | [diff] [blame] | 4218 | } |
| 4219 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4220 | psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key, |
| 4221 | psa_algorithm_t alg, |
| 4222 | const uint8_t *input, |
| 4223 | size_t input_length, |
| 4224 | uint8_t *output, |
| 4225 | size_t output_size, |
| 4226 | size_t *output_length) |
gabor-mezei-arm | ba0fa75 | 2021-03-01 15:04:24 +0100 | [diff] [blame] | 4227 | { |
| 4228 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
gabor-mezei-arm | a9449a0 | 2021-03-25 11:17:10 +0100 | [diff] [blame] | 4229 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 2391952 | 2021-07-08 19:00:07 +0200 | [diff] [blame] | 4230 | psa_key_slot_t *slot = NULL; |
Ronald Cron | c6e6f50 | 2021-07-09 18:44:58 +0200 | [diff] [blame] | 4231 | uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE]; |
| 4232 | size_t default_iv_length = 0; |
gabor-mezei-arm | 6f4e5bb | 2021-06-25 15:21:11 +0200 | [diff] [blame] | 4233 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4234 | if (!PSA_ALG_IS_CIPHER(alg)) { |
Ronald Cron | 2391952 | 2021-07-08 19:00:07 +0200 | [diff] [blame] | 4235 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 4236 | goto exit; |
| 4237 | } |
gabor-mezei-arm | a9449a0 | 2021-03-25 11:17:10 +0100 | [diff] [blame] | 4238 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4239 | status = psa_get_and_lock_key_slot_with_policy(key, &slot, |
| 4240 | PSA_KEY_USAGE_ENCRYPT, |
| 4241 | alg); |
| 4242 | if (status != PSA_SUCCESS) { |
Ronald Cron | 2391952 | 2021-07-08 19:00:07 +0200 | [diff] [blame] | 4243 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4244 | } |
gabor-mezei-arm | ba0fa75 | 2021-03-01 15:04:24 +0100 | [diff] [blame] | 4245 | |
gabor-mezei-arm | a9449a0 | 2021-03-25 11:17:10 +0100 | [diff] [blame] | 4246 | psa_key_attributes_t attributes = { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4247 | .core = slot->attr |
gabor-mezei-arm | a9449a0 | 2021-03-25 11:17:10 +0100 | [diff] [blame] | 4248 | }; |
| 4249 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4250 | default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg); |
| 4251 | if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) { |
Ronald Cron | c6e6f50 | 2021-07-09 18:44:58 +0200 | [diff] [blame] | 4252 | status = PSA_ERROR_GENERIC_ERROR; |
| 4253 | goto exit; |
| 4254 | } |
| 4255 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4256 | if (default_iv_length > 0) { |
| 4257 | if (output_size < default_iv_length) { |
gabor-mezei-arm | a9449a0 | 2021-03-25 11:17:10 +0100 | [diff] [blame] | 4258 | status = PSA_ERROR_BUFFER_TOO_SMALL; |
| 4259 | goto exit; |
| 4260 | } |
| 4261 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4262 | status = psa_generate_random(local_iv, default_iv_length); |
| 4263 | if (status != PSA_SUCCESS) { |
gabor-mezei-arm | ba0fa75 | 2021-03-01 15:04:24 +0100 | [diff] [blame] | 4264 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4265 | } |
gabor-mezei-arm | ba0fa75 | 2021-03-01 15:04:24 +0100 | [diff] [blame] | 4266 | } |
| 4267 | |
gabor-mezei-arm | a9449a0 | 2021-03-25 11:17:10 +0100 | [diff] [blame] | 4268 | status = psa_driver_wrapper_cipher_encrypt( |
| 4269 | &attributes, slot->key.data, slot->key.bytes, |
Ronald Cron | c6e6f50 | 2021-07-09 18:44:58 +0200 | [diff] [blame] | 4270 | alg, local_iv, default_iv_length, input, input_length, |
Ronald Cron | afbc7ed | 2023-01-24 16:02:04 +0100 | [diff] [blame] | 4271 | psa_crypto_buffer_offset(output, default_iv_length), |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4272 | output_size - default_iv_length, output_length); |
gabor-mezei-arm | ba0fa75 | 2021-03-01 15:04:24 +0100 | [diff] [blame] | 4273 | |
| 4274 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4275 | unlock_status = psa_unlock_key_slot(slot); |
| 4276 | if (status == PSA_SUCCESS) { |
Ronald Cron | 2391952 | 2021-07-08 19:00:07 +0200 | [diff] [blame] | 4277 | status = unlock_status; |
Ronald Cron | c6e6f50 | 2021-07-09 18:44:58 +0200 | [diff] [blame] | 4278 | } |
Ronald Cron | 2391952 | 2021-07-08 19:00:07 +0200 | [diff] [blame] | 4279 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4280 | if (status == PSA_SUCCESS) { |
| 4281 | if (default_iv_length > 0) { |
| 4282 | memcpy(output, local_iv, default_iv_length); |
| 4283 | } |
| 4284 | *output_length += default_iv_length; |
| 4285 | } else { |
| 4286 | *output_length = 0; |
| 4287 | } |
| 4288 | |
| 4289 | return status; |
gabor-mezei-arm | ba0fa75 | 2021-03-01 15:04:24 +0100 | [diff] [blame] | 4290 | } |
| 4291 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4292 | psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key, |
| 4293 | psa_algorithm_t alg, |
| 4294 | const uint8_t *input, |
| 4295 | size_t input_length, |
| 4296 | uint8_t *output, |
| 4297 | size_t output_size, |
| 4298 | size_t *output_length) |
gabor-mezei-arm | ba0fa75 | 2021-03-01 15:04:24 +0100 | [diff] [blame] | 4299 | { |
| 4300 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
gabor-mezei-arm | a9449a0 | 2021-03-25 11:17:10 +0100 | [diff] [blame] | 4301 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 2391952 | 2021-07-08 19:00:07 +0200 | [diff] [blame] | 4302 | psa_key_slot_t *slot = NULL; |
gabor-mezei-arm | 6f4e5bb | 2021-06-25 15:21:11 +0200 | [diff] [blame] | 4303 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4304 | if (!PSA_ALG_IS_CIPHER(alg)) { |
Ronald Cron | 2391952 | 2021-07-08 19:00:07 +0200 | [diff] [blame] | 4305 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 4306 | goto exit; |
| 4307 | } |
gabor-mezei-arm | a9449a0 | 2021-03-25 11:17:10 +0100 | [diff] [blame] | 4308 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4309 | status = psa_get_and_lock_key_slot_with_policy(key, &slot, |
| 4310 | PSA_KEY_USAGE_DECRYPT, |
| 4311 | alg); |
| 4312 | if (status != PSA_SUCCESS) { |
Ronald Cron | 2391952 | 2021-07-08 19:00:07 +0200 | [diff] [blame] | 4313 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4314 | } |
gabor-mezei-arm | ba0fa75 | 2021-03-01 15:04:24 +0100 | [diff] [blame] | 4315 | |
gabor-mezei-arm | a9449a0 | 2021-03-25 11:17:10 +0100 | [diff] [blame] | 4316 | psa_key_attributes_t attributes = { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4317 | .core = slot->attr |
gabor-mezei-arm | a9449a0 | 2021-03-25 11:17:10 +0100 | [diff] [blame] | 4318 | }; |
gabor-mezei-arm | ba0fa75 | 2021-03-01 15:04:24 +0100 | [diff] [blame] | 4319 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4320 | if (alg == PSA_ALG_CCM_STAR_NO_TAG && |
| 4321 | input_length < PSA_BLOCK_CIPHER_BLOCK_LENGTH(slot->attr.type)) { |
Mateusz Starzyk | 594215b | 2021-10-14 12:23:06 +0200 | [diff] [blame] | 4322 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 4323 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4324 | } else if (input_length < PSA_CIPHER_IV_LENGTH(slot->attr.type, alg)) { |
gabor-mezei-arm | 258ae07 | 2021-06-25 15:25:38 +0200 | [diff] [blame] | 4325 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 4326 | goto exit; |
| 4327 | } |
| 4328 | |
gabor-mezei-arm | a9449a0 | 2021-03-25 11:17:10 +0100 | [diff] [blame] | 4329 | status = psa_driver_wrapper_cipher_decrypt( |
| 4330 | &attributes, slot->key.data, slot->key.bytes, |
| 4331 | alg, input, input_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4332 | output, output_size, output_length); |
gabor-mezei-arm | ba0fa75 | 2021-03-01 15:04:24 +0100 | [diff] [blame] | 4333 | |
gabor-mezei-arm | 258ae07 | 2021-06-25 15:25:38 +0200 | [diff] [blame] | 4334 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4335 | unlock_status = psa_unlock_key_slot(slot); |
| 4336 | if (status == PSA_SUCCESS) { |
Ronald Cron | 2391952 | 2021-07-08 19:00:07 +0200 | [diff] [blame] | 4337 | status = unlock_status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4338 | } |
gabor-mezei-arm | ba0fa75 | 2021-03-01 15:04:24 +0100 | [diff] [blame] | 4339 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4340 | if (status != PSA_SUCCESS) { |
Ronald Cron | 2391952 | 2021-07-08 19:00:07 +0200 | [diff] [blame] | 4341 | *output_length = 0; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4342 | } |
Ronald Cron | 2391952 | 2021-07-08 19:00:07 +0200 | [diff] [blame] | 4343 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4344 | return status; |
gabor-mezei-arm | ba0fa75 | 2021-03-01 15:04:24 +0100 | [diff] [blame] | 4345 | } |
| 4346 | |
| 4347 | |
mohammad1603 | 5955c98 | 2018-04-26 00:53:03 +0300 | [diff] [blame] | 4348 | /****************************************************************/ |
| 4349 | /* AEAD */ |
| 4350 | /****************************************************************/ |
Gilles Peskine | 7bcfc0a | 2018-06-18 21:49:39 +0200 | [diff] [blame] | 4351 | |
Paul Elliott | baff51c | 2021-09-28 17:44:45 +0100 | [diff] [blame] | 4352 | /* Helper function to get the base algorithm from its variants. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4353 | static psa_algorithm_t psa_aead_get_base_algorithm(psa_algorithm_t alg) |
Paul Elliott | baff51c | 2021-09-28 17:44:45 +0100 | [diff] [blame] | 4354 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4355 | return PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(alg); |
Paul Elliott | baff51c | 2021-09-28 17:44:45 +0100 | [diff] [blame] | 4356 | } |
| 4357 | |
| 4358 | /* Helper function to perform common nonce length checks. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4359 | static psa_status_t psa_aead_check_nonce_length(psa_algorithm_t alg, |
| 4360 | size_t nonce_length) |
Paul Elliott | bb0f9e1 | 2021-09-28 11:14:27 +0100 | [diff] [blame] | 4361 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4362 | psa_algorithm_t base_alg = psa_aead_get_base_algorithm(alg); |
Paul Elliott | baff51c | 2021-09-28 17:44:45 +0100 | [diff] [blame] | 4363 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4364 | switch (base_alg) { |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4365 | #if defined(PSA_WANT_ALG_GCM) |
| 4366 | case PSA_ALG_GCM: |
| 4367 | /* Not checking max nonce size here as GCM spec allows almost |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4368 | * arbitrarily large nonces. Please note that we do not generally |
| 4369 | * recommend the usage of nonces of greater length than |
| 4370 | * PSA_AEAD_NONCE_MAX_SIZE, as large nonces are hashed to a shorter |
| 4371 | * size, which can then lead to collisions if you encrypt a very |
| 4372 | * large number of messages.*/ |
| 4373 | if (nonce_length != 0) { |
| 4374 | return PSA_SUCCESS; |
| 4375 | } |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4376 | break; |
Paul Elliott | e716e6c | 2021-09-29 14:10:20 +0100 | [diff] [blame] | 4377 | #endif /* PSA_WANT_ALG_GCM */ |
| 4378 | #if defined(PSA_WANT_ALG_CCM) |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4379 | case PSA_ALG_CCM: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4380 | if (nonce_length >= 7 && nonce_length <= 13) { |
| 4381 | return PSA_SUCCESS; |
| 4382 | } |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4383 | break; |
Paul Elliott | e716e6c | 2021-09-29 14:10:20 +0100 | [diff] [blame] | 4384 | #endif /* PSA_WANT_ALG_CCM */ |
| 4385 | #if defined(PSA_WANT_ALG_CHACHA20_POLY1305) |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4386 | case PSA_ALG_CHACHA20_POLY1305: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4387 | if (nonce_length == 12) { |
| 4388 | return PSA_SUCCESS; |
| 4389 | } else if (nonce_length == 8) { |
| 4390 | return PSA_ERROR_NOT_SUPPORTED; |
| 4391 | } |
Bence Szépkúti | 6d48e20 | 2021-11-15 20:04:15 +0100 | [diff] [blame] | 4392 | break; |
Paul Elliott | e716e6c | 2021-09-29 14:10:20 +0100 | [diff] [blame] | 4393 | #endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */ |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4394 | default: |
Przemek Stekiel | 4c49927 | 2022-09-27 13:55:37 +0200 | [diff] [blame] | 4395 | (void) nonce_length; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4396 | return PSA_ERROR_NOT_SUPPORTED; |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4397 | } |
Paul Elliott | bb0f9e1 | 2021-09-28 11:14:27 +0100 | [diff] [blame] | 4398 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4399 | return PSA_ERROR_INVALID_ARGUMENT; |
Paul Elliott | bb0f9e1 | 2021-09-28 11:14:27 +0100 | [diff] [blame] | 4400 | } |
| 4401 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4402 | static psa_status_t psa_aead_check_algorithm(psa_algorithm_t alg) |
Bence Szépkúti | aa3a6e4 | 2022-01-13 16:26:03 +0100 | [diff] [blame] | 4403 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4404 | if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg)) { |
| 4405 | return PSA_ERROR_INVALID_ARGUMENT; |
| 4406 | } |
Bence Szépkúti | 08f3465 | 2021-12-08 21:07:13 +0100 | [diff] [blame] | 4407 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4408 | return PSA_SUCCESS; |
Bence Szépkúti | 08f3465 | 2021-12-08 21:07:13 +0100 | [diff] [blame] | 4409 | } |
| 4410 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4411 | psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key, |
| 4412 | psa_algorithm_t alg, |
| 4413 | const uint8_t *nonce, |
| 4414 | size_t nonce_length, |
| 4415 | const uint8_t *additional_data, |
| 4416 | size_t additional_data_length, |
| 4417 | const uint8_t *plaintext, |
| 4418 | size_t plaintext_length, |
| 4419 | uint8_t *ciphertext, |
| 4420 | size_t ciphertext_size, |
| 4421 | size_t *ciphertext_length) |
mohammad1603 | 5955c98 | 2018-04-26 00:53:03 +0300 | [diff] [blame] | 4422 | { |
Ronald Cron | 215633c | 2021-03-16 17:15:37 +0100 | [diff] [blame] | 4423 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 4424 | psa_key_slot_t *slot; |
Gilles Peskine | 2d27786 | 2018-06-18 15:41:12 +0200 | [diff] [blame] | 4425 | |
mohammad1603 | f08a550 | 2018-06-03 15:05:47 +0300 | [diff] [blame] | 4426 | *ciphertext_length = 0; |
mohammad1603 | e58e684 | 2018-05-09 04:58:32 -0700 | [diff] [blame] | 4427 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4428 | status = psa_aead_check_algorithm(alg); |
| 4429 | if (status != PSA_SUCCESS) { |
| 4430 | return status; |
| 4431 | } |
Steven Cooreman | ea7ab13 | 2021-03-17 16:28:00 +0100 | [diff] [blame] | 4432 | |
Ronald Cron | 9a98616 | 2021-03-26 12:40:07 +0100 | [diff] [blame] | 4433 | status = psa_get_and_lock_key_slot_with_policy( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4434 | key, &slot, PSA_KEY_USAGE_ENCRYPT, alg); |
| 4435 | if (status != PSA_SUCCESS) { |
| 4436 | return status; |
| 4437 | } |
mohammad1603 | 5955c98 | 2018-04-26 00:53:03 +0300 | [diff] [blame] | 4438 | |
Ronald Cron | 215633c | 2021-03-16 17:15:37 +0100 | [diff] [blame] | 4439 | psa_key_attributes_t attributes = { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4440 | .core = slot->attr |
Ronald Cron | 215633c | 2021-03-16 17:15:37 +0100 | [diff] [blame] | 4441 | }; |
mohammad1603 | 5955c98 | 2018-04-26 00:53:03 +0300 | [diff] [blame] | 4442 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4443 | status = psa_aead_check_nonce_length(alg, nonce_length); |
| 4444 | if (status != PSA_SUCCESS) { |
Paul Elliott | bb0f9e1 | 2021-09-28 11:14:27 +0100 | [diff] [blame] | 4445 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4446 | } |
Paul Elliott | bb0f9e1 | 2021-09-28 11:14:27 +0100 | [diff] [blame] | 4447 | |
Ronald Cron | de82281 | 2021-03-17 16:08:20 +0100 | [diff] [blame] | 4448 | status = psa_driver_wrapper_aead_encrypt( |
Ronald Cron | 215633c | 2021-03-16 17:15:37 +0100 | [diff] [blame] | 4449 | &attributes, slot->key.data, slot->key.bytes, |
| 4450 | alg, |
| 4451 | nonce, nonce_length, |
| 4452 | additional_data, additional_data_length, |
| 4453 | plaintext, plaintext_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4454 | ciphertext, ciphertext_size, ciphertext_length); |
Gilles Peskine | 2d27786 | 2018-06-18 15:41:12 +0200 | [diff] [blame] | 4455 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4456 | if (status != PSA_SUCCESS && ciphertext_size != 0) { |
| 4457 | memset(ciphertext, 0, ciphertext_size); |
| 4458 | } |
Gilles Peskine | 2d27786 | 2018-06-18 15:41:12 +0200 | [diff] [blame] | 4459 | |
Paul Elliott | bb0f9e1 | 2021-09-28 11:14:27 +0100 | [diff] [blame] | 4460 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4461 | psa_unlock_key_slot(slot); |
mohammad1603 | 5955c98 | 2018-04-26 00:53:03 +0300 | [diff] [blame] | 4462 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4463 | return status; |
Gilles Peskine | ee652a3 | 2018-06-01 19:23:52 +0200 | [diff] [blame] | 4464 | } |
| 4465 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4466 | psa_status_t psa_aead_decrypt(mbedtls_svc_key_id_t key, |
| 4467 | psa_algorithm_t alg, |
| 4468 | const uint8_t *nonce, |
| 4469 | size_t nonce_length, |
| 4470 | const uint8_t *additional_data, |
| 4471 | size_t additional_data_length, |
| 4472 | const uint8_t *ciphertext, |
| 4473 | size_t ciphertext_length, |
| 4474 | uint8_t *plaintext, |
| 4475 | size_t plaintext_size, |
| 4476 | size_t *plaintext_length) |
mohammad1603 | 5955c98 | 2018-04-26 00:53:03 +0300 | [diff] [blame] | 4477 | { |
Ronald Cron | 215633c | 2021-03-16 17:15:37 +0100 | [diff] [blame] | 4478 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 4479 | psa_key_slot_t *slot; |
Gilles Peskine | 2d27786 | 2018-06-18 15:41:12 +0200 | [diff] [blame] | 4480 | |
Gilles Peskine | ee652a3 | 2018-06-01 19:23:52 +0200 | [diff] [blame] | 4481 | *plaintext_length = 0; |
mohammad1603 | 9e5a515 | 2018-04-26 12:07:35 +0300 | [diff] [blame] | 4482 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4483 | status = psa_aead_check_algorithm(alg); |
| 4484 | if (status != PSA_SUCCESS) { |
| 4485 | return status; |
| 4486 | } |
Steven Cooreman | ea7ab13 | 2021-03-17 16:28:00 +0100 | [diff] [blame] | 4487 | |
Ronald Cron | 9a98616 | 2021-03-26 12:40:07 +0100 | [diff] [blame] | 4488 | status = psa_get_and_lock_key_slot_with_policy( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4489 | key, &slot, PSA_KEY_USAGE_DECRYPT, alg); |
| 4490 | if (status != PSA_SUCCESS) { |
| 4491 | return status; |
| 4492 | } |
mohammad1603 | 5955c98 | 2018-04-26 00:53:03 +0300 | [diff] [blame] | 4493 | |
Ronald Cron | 215633c | 2021-03-16 17:15:37 +0100 | [diff] [blame] | 4494 | psa_key_attributes_t attributes = { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4495 | .core = slot->attr |
Ronald Cron | 215633c | 2021-03-16 17:15:37 +0100 | [diff] [blame] | 4496 | }; |
Gilles Peskine | f7e7b01 | 2019-05-06 15:27:16 +0200 | [diff] [blame] | 4497 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4498 | status = psa_aead_check_nonce_length(alg, nonce_length); |
| 4499 | if (status != PSA_SUCCESS) { |
Paul Elliott | bb0f9e1 | 2021-09-28 11:14:27 +0100 | [diff] [blame] | 4500 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4501 | } |
Paul Elliott | bb0f9e1 | 2021-09-28 11:14:27 +0100 | [diff] [blame] | 4502 | |
Ronald Cron | de82281 | 2021-03-17 16:08:20 +0100 | [diff] [blame] | 4503 | status = psa_driver_wrapper_aead_decrypt( |
Ronald Cron | 215633c | 2021-03-16 17:15:37 +0100 | [diff] [blame] | 4504 | &attributes, slot->key.data, slot->key.bytes, |
| 4505 | alg, |
| 4506 | nonce, nonce_length, |
| 4507 | additional_data, additional_data_length, |
| 4508 | ciphertext, ciphertext_length, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4509 | plaintext, plaintext_size, plaintext_length); |
Gilles Peskine | a40d774 | 2018-06-01 16:28:30 +0200 | [diff] [blame] | 4510 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4511 | if (status != PSA_SUCCESS && plaintext_size != 0) { |
| 4512 | memset(plaintext, 0, plaintext_size); |
| 4513 | } |
mohammad1603 | 60a64d0 | 2018-06-03 17:20:42 +0300 | [diff] [blame] | 4514 | |
Paul Elliott | bb0f9e1 | 2021-09-28 11:14:27 +0100 | [diff] [blame] | 4515 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4516 | psa_unlock_key_slot(slot); |
Ronald Cron | 215633c | 2021-03-16 17:15:37 +0100 | [diff] [blame] | 4517 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4518 | return status; |
mohammad1603 | 5955c98 | 2018-04-26 00:53:03 +0300 | [diff] [blame] | 4519 | } |
| 4520 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4521 | static psa_status_t psa_validate_tag_length(psa_algorithm_t alg) |
| 4522 | { |
| 4523 | const uint8_t tag_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg); |
Andrzej Kurek | f881601 | 2021-12-19 17:00:12 +0100 | [diff] [blame] | 4524 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4525 | switch (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg, 0)) { |
Przemek Stekiel | 86679c7 | 2022-10-06 17:06:56 +0200 | [diff] [blame] | 4526 | #if defined(PSA_WANT_ALG_CCM) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4527 | case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0): |
Andrzej Kurek | f881601 | 2021-12-19 17:00:12 +0100 | [diff] [blame] | 4528 | /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.*/ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4529 | if (tag_len < 4 || tag_len > 16 || tag_len % 2) { |
| 4530 | return PSA_ERROR_INVALID_ARGUMENT; |
| 4531 | } |
Andrzej Kurek | f881601 | 2021-12-19 17:00:12 +0100 | [diff] [blame] | 4532 | break; |
Przemek Stekiel | 86679c7 | 2022-10-06 17:06:56 +0200 | [diff] [blame] | 4533 | #endif /* PSA_WANT_ALG_CCM */ |
Andrzej Kurek | f881601 | 2021-12-19 17:00:12 +0100 | [diff] [blame] | 4534 | |
Przemek Stekiel | 86679c7 | 2022-10-06 17:06:56 +0200 | [diff] [blame] | 4535 | #if defined(PSA_WANT_ALG_GCM) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4536 | case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0): |
Andrzej Kurek | f881601 | 2021-12-19 17:00:12 +0100 | [diff] [blame] | 4537 | /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4538 | if (tag_len != 4 && tag_len != 8 && (tag_len < 12 || tag_len > 16)) { |
| 4539 | return PSA_ERROR_INVALID_ARGUMENT; |
| 4540 | } |
Andrzej Kurek | f881601 | 2021-12-19 17:00:12 +0100 | [diff] [blame] | 4541 | break; |
Przemek Stekiel | 86679c7 | 2022-10-06 17:06:56 +0200 | [diff] [blame] | 4542 | #endif /* PSA_WANT_ALG_GCM */ |
Andrzej Kurek | f881601 | 2021-12-19 17:00:12 +0100 | [diff] [blame] | 4543 | |
Przemek Stekiel | 86679c7 | 2022-10-06 17:06:56 +0200 | [diff] [blame] | 4544 | #if defined(PSA_WANT_ALG_CHACHA20_POLY1305) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4545 | case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0): |
Andrzej Kurek | f881601 | 2021-12-19 17:00:12 +0100 | [diff] [blame] | 4546 | /* We only support the default tag length. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4547 | if (tag_len != 16) { |
| 4548 | return PSA_ERROR_INVALID_ARGUMENT; |
| 4549 | } |
Andrzej Kurek | f881601 | 2021-12-19 17:00:12 +0100 | [diff] [blame] | 4550 | break; |
Przemek Stekiel | 86679c7 | 2022-10-06 17:06:56 +0200 | [diff] [blame] | 4551 | #endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */ |
Andrzej Kurek | f881601 | 2021-12-19 17:00:12 +0100 | [diff] [blame] | 4552 | |
| 4553 | default: |
| 4554 | (void) tag_len; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4555 | return PSA_ERROR_NOT_SUPPORTED; |
Andrzej Kurek | f881601 | 2021-12-19 17:00:12 +0100 | [diff] [blame] | 4556 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4557 | return PSA_SUCCESS; |
Andrzej Kurek | f881601 | 2021-12-19 17:00:12 +0100 | [diff] [blame] | 4558 | } |
| 4559 | |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4560 | /* Set the key for a multipart authenticated operation. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4561 | static psa_status_t psa_aead_setup(psa_aead_operation_t *operation, |
| 4562 | int is_encrypt, |
| 4563 | mbedtls_svc_key_id_t key, |
| 4564 | psa_algorithm_t alg) |
Paul Elliott | c2b7144 | 2021-06-24 18:17:52 +0100 | [diff] [blame] | 4565 | { |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4566 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 4567 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
| 4568 | psa_key_slot_t *slot = NULL; |
| 4569 | psa_key_usage_t key_usage = 0; |
| 4570 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4571 | status = psa_aead_check_algorithm(alg); |
| 4572 | if (status != PSA_SUCCESS) { |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4573 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4574 | } |
Paul Elliott | c2b7144 | 2021-06-24 18:17:52 +0100 | [diff] [blame] | 4575 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4576 | if (operation->id != 0) { |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4577 | status = PSA_ERROR_BAD_STATE; |
| 4578 | goto exit; |
Paul Elliott | c2b7144 | 2021-06-24 18:17:52 +0100 | [diff] [blame] | 4579 | } |
| 4580 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4581 | if (operation->nonce_set || operation->lengths_set || |
| 4582 | operation->ad_started || operation->body_started) { |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4583 | status = PSA_ERROR_BAD_STATE; |
| 4584 | goto exit; |
Paul Elliott | c2b7144 | 2021-06-24 18:17:52 +0100 | [diff] [blame] | 4585 | } |
| 4586 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4587 | if (is_encrypt) { |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4588 | key_usage = PSA_KEY_USAGE_ENCRYPT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4589 | } else { |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4590 | key_usage = PSA_KEY_USAGE_DECRYPT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4591 | } |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4592 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4593 | status = psa_get_and_lock_key_slot_with_policy(key, &slot, key_usage, |
| 4594 | alg); |
| 4595 | if (status != PSA_SUCCESS) { |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4596 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4597 | } |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4598 | |
| 4599 | psa_key_attributes_t attributes = { |
| 4600 | .core = slot->attr |
| 4601 | }; |
| 4602 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4603 | if ((status = psa_validate_tag_length(alg)) != PSA_SUCCESS) { |
Przemek Stekiel | 6ab5076 | 2022-10-08 17:54:30 +0200 | [diff] [blame] | 4604 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4605 | } |
Przemek Stekiel | 6ab5076 | 2022-10-08 17:54:30 +0200 | [diff] [blame] | 4606 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4607 | if (is_encrypt) { |
| 4608 | status = psa_driver_wrapper_aead_encrypt_setup(operation, |
| 4609 | &attributes, |
| 4610 | slot->key.data, |
| 4611 | slot->key.bytes, |
| 4612 | alg); |
| 4613 | } else { |
| 4614 | status = psa_driver_wrapper_aead_decrypt_setup(operation, |
| 4615 | &attributes, |
| 4616 | slot->key.data, |
| 4617 | slot->key.bytes, |
| 4618 | alg); |
| 4619 | } |
| 4620 | if (status != PSA_SUCCESS) { |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4621 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4622 | } |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4623 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4624 | operation->key_type = psa_get_key_type(&attributes); |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4625 | |
| 4626 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4627 | unlock_status = psa_unlock_key_slot(slot); |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4628 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4629 | if (status == PSA_SUCCESS) { |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4630 | status = unlock_status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4631 | operation->alg = psa_aead_get_base_algorithm(alg); |
Paul Elliott | d9343f2 | 2021-08-23 18:59:49 +0100 | [diff] [blame] | 4632 | operation->is_encrypt = is_encrypt; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4633 | } else { |
| 4634 | psa_aead_abort(operation); |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4635 | } |
Paul Elliott | e0a12bd | 2021-08-19 18:55:56 +0100 | [diff] [blame] | 4636 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4637 | return status; |
Paul Elliott | c2b7144 | 2021-06-24 18:17:52 +0100 | [diff] [blame] | 4638 | } |
| 4639 | |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4640 | /* Set the key for a multipart authenticated encryption operation. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4641 | psa_status_t psa_aead_encrypt_setup(psa_aead_operation_t *operation, |
| 4642 | mbedtls_svc_key_id_t key, |
| 4643 | psa_algorithm_t alg) |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4644 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4645 | return psa_aead_setup(operation, 1, key, alg); |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4646 | } |
| 4647 | |
| 4648 | /* Set the key for a multipart authenticated decryption operation. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4649 | psa_status_t psa_aead_decrypt_setup(psa_aead_operation_t *operation, |
| 4650 | mbedtls_svc_key_id_t key, |
| 4651 | psa_algorithm_t alg) |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4652 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4653 | return psa_aead_setup(operation, 0, key, alg); |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4654 | } |
| 4655 | |
| 4656 | /* Generate a random nonce / IV for multipart AEAD operation */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4657 | psa_status_t psa_aead_generate_nonce(psa_aead_operation_t *operation, |
| 4658 | uint8_t *nonce, |
| 4659 | size_t nonce_size, |
| 4660 | size_t *nonce_length) |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4661 | { |
| 4662 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | cae5909 | 2021-11-26 18:53:58 +0100 | [diff] [blame] | 4663 | uint8_t local_nonce[PSA_AEAD_NONCE_MAX_SIZE]; |
Paul Elliott | b91da71 | 2021-05-20 14:43:47 +0100 | [diff] [blame] | 4664 | size_t required_nonce_size; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4665 | |
Paul Elliott | 8eb9daf | 2021-06-04 16:42:21 +0100 | [diff] [blame] | 4666 | *nonce_length = 0; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4667 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4668 | if (operation->id == 0) { |
Paul Elliott | cee785c | 2021-05-20 14:29:20 +0100 | [diff] [blame] | 4669 | status = PSA_ERROR_BAD_STATE; |
| 4670 | goto exit; |
| 4671 | } |
| 4672 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4673 | if (operation->nonce_set || !operation->is_encrypt) { |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4674 | status = PSA_ERROR_BAD_STATE; |
| 4675 | goto exit; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4676 | } |
| 4677 | |
Paul Elliott | e193ea8 | 2021-10-01 13:00:16 +0100 | [diff] [blame] | 4678 | /* For CCM, this size may not be correct according to the PSA |
| 4679 | * specification. The PSA Crypto 1.0.1 specification states: |
| 4680 | * |
| 4681 | * CCM encodes the plaintext length pLen in L octets, with L the smallest |
| 4682 | * integer >= 2 where pLen < 2^(8L). The nonce length is then 15 - L bytes. |
| 4683 | * |
| 4684 | * However this restriction that L has to be the smallest integer is not |
| 4685 | * applied in practice, and it is not implementable here since the |
| 4686 | * plaintext length may or may not be known at this time. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4687 | required_nonce_size = PSA_AEAD_NONCE_LENGTH(operation->key_type, |
| 4688 | operation->alg); |
| 4689 | if (nonce_size < required_nonce_size) { |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4690 | status = PSA_ERROR_BUFFER_TOO_SMALL; |
| 4691 | goto exit; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4692 | } |
| 4693 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4694 | status = psa_generate_random(local_nonce, required_nonce_size); |
| 4695 | if (status != PSA_SUCCESS) { |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4696 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4697 | } |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4698 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4699 | status = psa_aead_set_nonce(operation, local_nonce, required_nonce_size); |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4700 | |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4701 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4702 | if (status == PSA_SUCCESS) { |
| 4703 | memcpy(nonce, local_nonce, required_nonce_size); |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4704 | *nonce_length = required_nonce_size; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4705 | } else { |
| 4706 | psa_aead_abort(operation); |
Ronald Cron | cae5909 | 2021-11-26 18:53:58 +0100 | [diff] [blame] | 4707 | } |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4708 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4709 | return status; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4710 | } |
| 4711 | |
| 4712 | /* Set the nonce for a multipart authenticated encryption or decryption |
| 4713 | operation.*/ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4714 | psa_status_t psa_aead_set_nonce(psa_aead_operation_t *operation, |
| 4715 | const uint8_t *nonce, |
| 4716 | size_t nonce_length) |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4717 | { |
Paul Elliott | cbbde5f | 2021-05-10 18:19:46 +0100 | [diff] [blame] | 4718 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 4719 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4720 | if (operation->id == 0) { |
Paul Elliott | cee785c | 2021-05-20 14:29:20 +0100 | [diff] [blame] | 4721 | status = PSA_ERROR_BAD_STATE; |
| 4722 | goto exit; |
| 4723 | } |
| 4724 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4725 | if (operation->nonce_set) { |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4726 | status = PSA_ERROR_BAD_STATE; |
| 4727 | goto exit; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4728 | } |
| 4729 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4730 | status = psa_aead_check_nonce_length(operation->alg, nonce_length); |
| 4731 | if (status != PSA_SUCCESS) { |
Paul Elliott | bb0f9e1 | 2021-09-28 11:14:27 +0100 | [diff] [blame] | 4732 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 4733 | goto exit; |
Paul Elliott | 4ed1ed1 | 2021-09-27 18:09:28 +0100 | [diff] [blame] | 4734 | } |
Paul Elliott | 1a98aca | 2021-05-20 18:24:07 +0100 | [diff] [blame] | 4735 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4736 | status = psa_driver_wrapper_aead_set_nonce(operation, nonce, |
| 4737 | nonce_length); |
Paul Elliott | cbbde5f | 2021-05-10 18:19:46 +0100 | [diff] [blame] | 4738 | |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4739 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4740 | if (status == PSA_SUCCESS) { |
Paul Elliott | cbbde5f | 2021-05-10 18:19:46 +0100 | [diff] [blame] | 4741 | operation->nonce_set = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4742 | } else { |
| 4743 | psa_aead_abort(operation); |
| 4744 | } |
Paul Elliott | cbbde5f | 2021-05-10 18:19:46 +0100 | [diff] [blame] | 4745 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4746 | return status; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4747 | } |
| 4748 | |
| 4749 | /* Declare the lengths of the message and additional data for multipart AEAD. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4750 | psa_status_t psa_aead_set_lengths(psa_aead_operation_t *operation, |
| 4751 | size_t ad_length, |
| 4752 | size_t plaintext_length) |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4753 | { |
Paul Elliott | cbbde5f | 2021-05-10 18:19:46 +0100 | [diff] [blame] | 4754 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 4755 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4756 | if (operation->id == 0) { |
Paul Elliott | cee785c | 2021-05-20 14:29:20 +0100 | [diff] [blame] | 4757 | status = PSA_ERROR_BAD_STATE; |
| 4758 | goto exit; |
| 4759 | } |
| 4760 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4761 | if (operation->lengths_set || operation->ad_started || |
| 4762 | operation->body_started) { |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4763 | status = PSA_ERROR_BAD_STATE; |
| 4764 | goto exit; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4765 | } |
| 4766 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4767 | switch (operation->alg) { |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4768 | #if defined(PSA_WANT_ALG_GCM) |
| 4769 | case PSA_ALG_GCM: |
| 4770 | /* Lengths can only be too large for GCM if size_t is bigger than 32 |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4771 | * bits. Without the guard this code will generate warnings on 32bit |
| 4772 | * builds. */ |
Paul Elliott | 325d374 | 2021-09-27 17:56:28 +0100 | [diff] [blame] | 4773 | #if SIZE_MAX > UINT32_MAX |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4774 | if (((uint64_t) ad_length) >> 61 != 0 || |
| 4775 | ((uint64_t) plaintext_length) > 0xFFFFFFFE0ull) { |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4776 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 4777 | goto exit; |
| 4778 | } |
Paul Elliott | 325d374 | 2021-09-27 17:56:28 +0100 | [diff] [blame] | 4779 | #endif |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4780 | break; |
Paul Elliott | e716e6c | 2021-09-29 14:10:20 +0100 | [diff] [blame] | 4781 | #endif /* PSA_WANT_ALG_GCM */ |
| 4782 | #if defined(PSA_WANT_ALG_CCM) |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4783 | case PSA_ALG_CCM: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4784 | if (ad_length > 0xFF00) { |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4785 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 4786 | goto exit; |
| 4787 | } |
| 4788 | break; |
Paul Elliott | e716e6c | 2021-09-29 14:10:20 +0100 | [diff] [blame] | 4789 | #endif /* PSA_WANT_ALG_CCM */ |
| 4790 | #if defined(PSA_WANT_ALG_CHACHA20_POLY1305) |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4791 | case PSA_ALG_CHACHA20_POLY1305: |
| 4792 | /* No length restrictions for ChaChaPoly. */ |
| 4793 | break; |
Paul Elliott | e716e6c | 2021-09-29 14:10:20 +0100 | [diff] [blame] | 4794 | #endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */ |
Przemyslaw Stekiel | 4cad4fc | 2021-10-13 11:12:08 +0200 | [diff] [blame] | 4795 | default: |
| 4796 | break; |
| 4797 | } |
Paul Elliott | 325d374 | 2021-09-27 17:56:28 +0100 | [diff] [blame] | 4798 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4799 | status = psa_driver_wrapper_aead_set_lengths(operation, ad_length, |
| 4800 | plaintext_length); |
Paul Elliott | cbbde5f | 2021-05-10 18:19:46 +0100 | [diff] [blame] | 4801 | |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4802 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4803 | if (status == PSA_SUCCESS) { |
Paul Elliott | ee4ffe0 | 2021-05-20 17:25:06 +0100 | [diff] [blame] | 4804 | operation->ad_remaining = ad_length; |
| 4805 | operation->body_remaining = plaintext_length; |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4806 | operation->lengths_set = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4807 | } else { |
| 4808 | psa_aead_abort(operation); |
Paul Elliott | ee4ffe0 | 2021-05-20 17:25:06 +0100 | [diff] [blame] | 4809 | } |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4810 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4811 | return status; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4812 | } |
Paul Elliott | 3d7d52c | 2021-09-01 10:33:14 +0100 | [diff] [blame] | 4813 | |
| 4814 | /* Pass additional data to an active multipart AEAD operation. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4815 | psa_status_t psa_aead_update_ad(psa_aead_operation_t *operation, |
| 4816 | const uint8_t *input, |
| 4817 | size_t input_length) |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4818 | { |
Paul Elliott | cbbde5f | 2021-05-10 18:19:46 +0100 | [diff] [blame] | 4819 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 4820 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4821 | if (operation->id == 0) { |
Paul Elliott | cee785c | 2021-05-20 14:29:20 +0100 | [diff] [blame] | 4822 | status = PSA_ERROR_BAD_STATE; |
| 4823 | goto exit; |
| 4824 | } |
| 4825 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4826 | if (!operation->nonce_set || operation->body_started) { |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4827 | status = PSA_ERROR_BAD_STATE; |
| 4828 | goto exit; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4829 | } |
| 4830 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4831 | if (operation->lengths_set) { |
| 4832 | if (operation->ad_remaining < input_length) { |
Paul Elliott | ee4ffe0 | 2021-05-20 17:25:06 +0100 | [diff] [blame] | 4833 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 4834 | goto exit; |
| 4835 | } |
| 4836 | |
| 4837 | operation->ad_remaining -= input_length; |
| 4838 | } |
Paul Elliott | e193ea8 | 2021-10-01 13:00:16 +0100 | [diff] [blame] | 4839 | #if defined(PSA_WANT_ALG_CCM) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4840 | else if (operation->alg == PSA_ALG_CCM) { |
Paul Elliott | e193ea8 | 2021-10-01 13:00:16 +0100 | [diff] [blame] | 4841 | status = PSA_ERROR_BAD_STATE; |
| 4842 | goto exit; |
| 4843 | } |
| 4844 | #endif /* PSA_WANT_ALG_CCM */ |
Paul Elliott | ee4ffe0 | 2021-05-20 17:25:06 +0100 | [diff] [blame] | 4845 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4846 | status = psa_driver_wrapper_aead_update_ad(operation, input, |
| 4847 | input_length); |
Paul Elliott | cbbde5f | 2021-05-10 18:19:46 +0100 | [diff] [blame] | 4848 | |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4849 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4850 | if (status == PSA_SUCCESS) { |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4851 | operation->ad_started = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4852 | } else { |
| 4853 | psa_aead_abort(operation); |
| 4854 | } |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4855 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4856 | return status; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4857 | } |
| 4858 | |
| 4859 | /* Encrypt or decrypt a message fragment in an active multipart AEAD |
| 4860 | operation.*/ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4861 | psa_status_t psa_aead_update(psa_aead_operation_t *operation, |
| 4862 | const uint8_t *input, |
| 4863 | size_t input_length, |
| 4864 | uint8_t *output, |
| 4865 | size_t output_size, |
| 4866 | size_t *output_length) |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4867 | { |
Paul Elliott | cbbde5f | 2021-05-10 18:19:46 +0100 | [diff] [blame] | 4868 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4869 | |
| 4870 | *output_length = 0; |
| 4871 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4872 | if (operation->id == 0) { |
Paul Elliott | cee785c | 2021-05-20 14:29:20 +0100 | [diff] [blame] | 4873 | status = PSA_ERROR_BAD_STATE; |
| 4874 | goto exit; |
| 4875 | } |
| 4876 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4877 | if (!operation->nonce_set) { |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4878 | status = PSA_ERROR_BAD_STATE; |
| 4879 | goto exit; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4880 | } |
| 4881 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4882 | if (operation->lengths_set) { |
Paul Elliott | ee4ffe0 | 2021-05-20 17:25:06 +0100 | [diff] [blame] | 4883 | /* Additional data length was supplied, but not all the additional |
| 4884 | data was supplied.*/ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4885 | if (operation->ad_remaining != 0) { |
Paul Elliott | ee4ffe0 | 2021-05-20 17:25:06 +0100 | [diff] [blame] | 4886 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 4887 | goto exit; |
| 4888 | } |
| 4889 | |
| 4890 | /* Too much data provided. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4891 | if (operation->body_remaining < input_length) { |
Paul Elliott | ee4ffe0 | 2021-05-20 17:25:06 +0100 | [diff] [blame] | 4892 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 4893 | goto exit; |
| 4894 | } |
| 4895 | |
| 4896 | operation->body_remaining -= input_length; |
| 4897 | } |
Paul Elliott | e193ea8 | 2021-10-01 13:00:16 +0100 | [diff] [blame] | 4898 | #if defined(PSA_WANT_ALG_CCM) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4899 | else if (operation->alg == PSA_ALG_CCM) { |
Paul Elliott | e193ea8 | 2021-10-01 13:00:16 +0100 | [diff] [blame] | 4900 | status = PSA_ERROR_BAD_STATE; |
| 4901 | goto exit; |
| 4902 | } |
| 4903 | #endif /* PSA_WANT_ALG_CCM */ |
Paul Elliott | ee4ffe0 | 2021-05-20 17:25:06 +0100 | [diff] [blame] | 4904 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4905 | status = psa_driver_wrapper_aead_update(operation, input, input_length, |
| 4906 | output, output_size, |
| 4907 | output_length); |
Paul Elliott | cbbde5f | 2021-05-10 18:19:46 +0100 | [diff] [blame] | 4908 | |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4909 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4910 | if (status == PSA_SUCCESS) { |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4911 | operation->body_started = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4912 | } else { |
| 4913 | psa_aead_abort(operation); |
| 4914 | } |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4915 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4916 | return status; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4917 | } |
| 4918 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4919 | static psa_status_t psa_aead_final_checks(const psa_aead_operation_t *operation) |
Paul Elliott | ad53dcc | 2021-06-23 08:50:14 +0100 | [diff] [blame] | 4920 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4921 | if (operation->id == 0 || !operation->nonce_set) { |
| 4922 | return PSA_ERROR_BAD_STATE; |
| 4923 | } |
Paul Elliott | ad53dcc | 2021-06-23 08:50:14 +0100 | [diff] [blame] | 4924 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4925 | if (operation->lengths_set && (operation->ad_remaining != 0 || |
| 4926 | operation->body_remaining != 0)) { |
| 4927 | return PSA_ERROR_INVALID_ARGUMENT; |
| 4928 | } |
Paul Elliott | ad53dcc | 2021-06-23 08:50:14 +0100 | [diff] [blame] | 4929 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4930 | return PSA_SUCCESS; |
Paul Elliott | ad53dcc | 2021-06-23 08:50:14 +0100 | [diff] [blame] | 4931 | } |
| 4932 | |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4933 | /* Finish encrypting a message in a multipart AEAD operation. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4934 | psa_status_t psa_aead_finish(psa_aead_operation_t *operation, |
| 4935 | uint8_t *ciphertext, |
| 4936 | size_t ciphertext_size, |
| 4937 | size_t *ciphertext_length, |
| 4938 | uint8_t *tag, |
| 4939 | size_t tag_size, |
| 4940 | size_t *tag_length) |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4941 | { |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4942 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 4943 | |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4944 | *ciphertext_length = 0; |
Paul Elliott | f88a565 | 2021-06-22 17:53:45 +0100 | [diff] [blame] | 4945 | *tag_length = tag_size; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4946 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4947 | status = psa_aead_final_checks(operation); |
| 4948 | if (status != PSA_SUCCESS) { |
Paul Elliott | ad53dcc | 2021-06-23 08:50:14 +0100 | [diff] [blame] | 4949 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4950 | } |
Paul Elliott | ad53dcc | 2021-06-23 08:50:14 +0100 | [diff] [blame] | 4951 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4952 | if (!operation->is_encrypt) { |
Paul Elliott | cee785c | 2021-05-20 14:29:20 +0100 | [diff] [blame] | 4953 | status = PSA_ERROR_BAD_STATE; |
| 4954 | goto exit; |
| 4955 | } |
| 4956 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4957 | status = psa_driver_wrapper_aead_finish(operation, ciphertext, |
| 4958 | ciphertext_size, |
| 4959 | ciphertext_length, |
| 4960 | tag, tag_size, tag_length); |
Paul Elliott | cbbde5f | 2021-05-10 18:19:46 +0100 | [diff] [blame] | 4961 | |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4962 | exit: |
Paul Elliott | dc42ca8 | 2023-02-24 18:11:59 +0000 | [diff] [blame] | 4963 | |
| 4964 | |
Paul Elliott | f47b095 | 2021-05-21 18:02:33 +0100 | [diff] [blame] | 4965 | /* In case the operation fails and the user fails to check for failure or |
Paul Elliott | 4c916e8 | 2021-09-19 18:34:50 +0100 | [diff] [blame] | 4966 | * the zero tag size, make sure the tag is set to something implausible. |
| 4967 | * Even if the operation succeeds, make sure we clear the rest of the |
| 4968 | * buffer to prevent potential leakage of anything previously placed in |
| 4969 | * the same buffer.*/ |
Paul Elliott | dc42ca8 | 2023-02-24 18:11:59 +0000 | [diff] [blame] | 4970 | psa_wipe_tag_output_buffer(tag, status, tag_size, *tag_length); |
Paul Elliott | f47b095 | 2021-05-21 18:02:33 +0100 | [diff] [blame] | 4971 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4972 | psa_aead_abort(operation); |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4973 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4974 | return status; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4975 | } |
| 4976 | |
| 4977 | /* Finish authenticating and decrypting a message in a multipart AEAD |
| 4978 | operation.*/ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4979 | psa_status_t psa_aead_verify(psa_aead_operation_t *operation, |
| 4980 | uint8_t *plaintext, |
| 4981 | size_t plaintext_size, |
| 4982 | size_t *plaintext_length, |
| 4983 | const uint8_t *tag, |
| 4984 | size_t tag_length) |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4985 | { |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 4986 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 4987 | |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 4988 | *plaintext_length = 0; |
| 4989 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4990 | status = psa_aead_final_checks(operation); |
| 4991 | if (status != PSA_SUCCESS) { |
Paul Elliott | ad53dcc | 2021-06-23 08:50:14 +0100 | [diff] [blame] | 4992 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4993 | } |
Paul Elliott | ad53dcc | 2021-06-23 08:50:14 +0100 | [diff] [blame] | 4994 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 4995 | if (operation->is_encrypt) { |
Paul Elliott | cee785c | 2021-05-20 14:29:20 +0100 | [diff] [blame] | 4996 | status = PSA_ERROR_BAD_STATE; |
| 4997 | goto exit; |
| 4998 | } |
| 4999 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5000 | status = psa_driver_wrapper_aead_verify(operation, plaintext, |
| 5001 | plaintext_size, |
| 5002 | plaintext_length, |
| 5003 | tag, tag_length); |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 5004 | |
| 5005 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5006 | psa_aead_abort(operation); |
Paul Elliott | 39dc6b8 | 2021-05-11 19:16:09 +0100 | [diff] [blame] | 5007 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5008 | return status; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 5009 | } |
| 5010 | |
| 5011 | /* Abort an AEAD operation. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5012 | psa_status_t psa_aead_abort(psa_aead_operation_t *operation) |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 5013 | { |
| 5014 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 5015 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5016 | if (operation->id == 0) { |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 5017 | /* The object has (apparently) been initialized but it is not (yet) |
| 5018 | * in use. It's ok to call abort on such an object, and there's |
| 5019 | * nothing to do. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5020 | return PSA_SUCCESS; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 5021 | } |
| 5022 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5023 | status = psa_driver_wrapper_aead_abort(operation); |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 5024 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5025 | memset(operation, 0, sizeof(*operation)); |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 5026 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5027 | return status; |
Paul Elliott | 302ff6b | 2021-04-20 18:10:30 +0100 | [diff] [blame] | 5028 | } |
| 5029 | |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 5030 | /****************************************************************/ |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5031 | /* Generators */ |
| 5032 | /****************************************************************/ |
| 5033 | |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 5034 | #if defined(BUILTIN_ALG_ANY_HKDF) || \ |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 5035 | defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5036 | defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) || \ |
| 5037 | defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 5038 | #define AT_LEAST_ONE_BUILTIN_KDF |
Steven Cooreman | 094a77e | 2021-05-06 17:58:36 +0200 | [diff] [blame] | 5039 | #endif /* At least one builtin KDF */ |
| 5040 | |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 5041 | #if defined(BUILTIN_ALG_ANY_HKDF) || \ |
Steven Cooreman | 094a77e | 2021-05-06 17:58:36 +0200 | [diff] [blame] | 5042 | defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ |
| 5043 | defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) |
| 5044 | static psa_status_t psa_key_derivation_start_hmac( |
| 5045 | psa_mac_operation_t *operation, |
| 5046 | psa_algorithm_t hash_alg, |
| 5047 | const uint8_t *hmac_key, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5048 | size_t hmac_key_length) |
Steven Cooreman | 094a77e | 2021-05-06 17:58:36 +0200 | [diff] [blame] | 5049 | { |
| 5050 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 5051 | psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5052 | psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC); |
| 5053 | psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(hmac_key_length)); |
| 5054 | psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH); |
Steven Cooreman | 094a77e | 2021-05-06 17:58:36 +0200 | [diff] [blame] | 5055 | |
Steven Cooreman | 72f736a | 2021-05-07 14:14:37 +0200 | [diff] [blame] | 5056 | operation->is_sign = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5057 | operation->mac_size = PSA_HASH_LENGTH(hash_alg); |
Steven Cooreman | 72f736a | 2021-05-07 14:14:37 +0200 | [diff] [blame] | 5058 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5059 | status = psa_driver_wrapper_mac_sign_setup(operation, |
| 5060 | &attributes, |
| 5061 | hmac_key, hmac_key_length, |
| 5062 | PSA_ALG_HMAC(hash_alg)); |
Steven Cooreman | 094a77e | 2021-05-06 17:58:36 +0200 | [diff] [blame] | 5063 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5064 | psa_reset_key_attributes(&attributes); |
| 5065 | return status; |
Steven Cooreman | 094a77e | 2021-05-06 17:58:36 +0200 | [diff] [blame] | 5066 | } |
| 5067 | #endif /* KDF algorithms reliant on HMAC */ |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 5068 | |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 5069 | #define HKDF_STATE_INIT 0 /* no input yet */ |
| 5070 | #define HKDF_STATE_STARTED 1 /* got salt */ |
| 5071 | #define HKDF_STATE_KEYED 2 /* got key */ |
| 5072 | #define HKDF_STATE_OUTPUT 3 /* output started */ |
| 5073 | |
Gilles Peskine | cbe6650 | 2019-05-16 16:59:18 +0200 | [diff] [blame] | 5074 | static psa_algorithm_t psa_key_derivation_get_kdf_alg( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5075 | const psa_key_derivation_operation_t *operation) |
Gilles Peskine | 969c5d6 | 2019-01-16 15:53:06 +0100 | [diff] [blame] | 5076 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5077 | if (PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) { |
| 5078 | return PSA_ALG_KEY_AGREEMENT_GET_KDF(operation->alg); |
| 5079 | } else { |
| 5080 | return operation->alg; |
| 5081 | } |
Gilles Peskine | 969c5d6 | 2019-01-16 15:53:06 +0100 | [diff] [blame] | 5082 | } |
| 5083 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5084 | psa_status_t psa_key_derivation_abort(psa_key_derivation_operation_t *operation) |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5085 | { |
| 5086 | psa_status_t status = PSA_SUCCESS; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5087 | psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation); |
| 5088 | if (kdf_alg == 0) { |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5089 | /* The object has (apparently) been initialized but it is not |
| 5090 | * in use. It's ok to call abort on such an object, and there's |
| 5091 | * nothing to do. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5092 | } else |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 5093 | #if defined(BUILTIN_ALG_ANY_HKDF) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5094 | if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) { |
| 5095 | mbedtls_free(operation->ctx.hkdf.info); |
| 5096 | status = psa_mac_abort(&operation->ctx.hkdf.hmac); |
| 5097 | } else |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 5098 | #endif /* BUILTIN_ALG_ANY_HKDF */ |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 5099 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ |
| 5100 | defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5101 | if (PSA_ALG_IS_TLS12_PRF(kdf_alg) || |
| 5102 | /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */ |
| 5103 | PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) { |
| 5104 | if (operation->ctx.tls12_prf.secret != NULL) { |
| 5105 | mbedtls_platform_zeroize(operation->ctx.tls12_prf.secret, |
| 5106 | operation->ctx.tls12_prf.secret_length); |
| 5107 | mbedtls_free(operation->ctx.tls12_prf.secret); |
Steven Cooreman | a6df604 | 2021-04-29 19:32:25 +0200 | [diff] [blame] | 5108 | } |
| 5109 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5110 | if (operation->ctx.tls12_prf.seed != NULL) { |
| 5111 | mbedtls_platform_zeroize(operation->ctx.tls12_prf.seed, |
| 5112 | operation->ctx.tls12_prf.seed_length); |
| 5113 | mbedtls_free(operation->ctx.tls12_prf.seed); |
Janos Follath | 6a1d262 | 2019-06-11 10:37:28 +0100 | [diff] [blame] | 5114 | } |
| 5115 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5116 | if (operation->ctx.tls12_prf.label != NULL) { |
| 5117 | mbedtls_platform_zeroize(operation->ctx.tls12_prf.label, |
| 5118 | operation->ctx.tls12_prf.label_length); |
| 5119 | mbedtls_free(operation->ctx.tls12_prf.label); |
Janos Follath | 6a1d262 | 2019-06-11 10:37:28 +0100 | [diff] [blame] | 5120 | } |
Przemek Stekiel | 6c76441 | 2022-11-22 14:05:12 +0100 | [diff] [blame] | 5121 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5122 | if (operation->ctx.tls12_prf.other_secret != NULL) { |
| 5123 | mbedtls_platform_zeroize(operation->ctx.tls12_prf.other_secret, |
| 5124 | operation->ctx.tls12_prf.other_secret_length); |
| 5125 | mbedtls_free(operation->ctx.tls12_prf.other_secret); |
Przemek Stekiel | e3ee221 | 2022-04-07 14:29:56 +0200 | [diff] [blame] | 5126 | } |
Przemek Stekiel | 6c76441 | 2022-11-22 14:05:12 +0100 | [diff] [blame] | 5127 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ |
Steven Cooreman | a6df604 | 2021-04-29 19:32:25 +0200 | [diff] [blame] | 5128 | status = PSA_SUCCESS; |
Janos Follath | 6a1d262 | 2019-06-11 10:37:28 +0100 | [diff] [blame] | 5129 | |
| 5130 | /* We leave the fields Ai and output_block to be erased safely by the |
| 5131 | * mbedtls_platform_zeroize() in the end of this function. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5132 | } else |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 5133 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || |
| 5134 | * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */ |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5135 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5136 | if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) { |
| 5137 | mbedtls_platform_zeroize(operation->ctx.tls12_ecjpake_to_pms.data, |
| 5138 | sizeof(operation->ctx.tls12_ecjpake_to_pms.data)); |
| 5139 | } else |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5140 | #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) */ |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5141 | { |
| 5142 | status = PSA_ERROR_BAD_STATE; |
| 5143 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5144 | mbedtls_platform_zeroize(operation, sizeof(*operation)); |
| 5145 | return status; |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5146 | } |
| 5147 | |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5148 | psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5149 | size_t *capacity) |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5150 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5151 | if (operation->alg == 0) { |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5152 | /* This is a blank key derivation operation. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5153 | return PSA_ERROR_BAD_STATE; |
Jaeden Amero | cf2010c | 2019-02-15 13:05:49 +0000 | [diff] [blame] | 5154 | } |
| 5155 | |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5156 | *capacity = operation->capacity; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5157 | return PSA_SUCCESS; |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5158 | } |
| 5159 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5160 | psa_status_t psa_key_derivation_set_capacity(psa_key_derivation_operation_t *operation, |
| 5161 | size_t capacity) |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 5162 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5163 | if (operation->alg == 0) { |
| 5164 | return PSA_ERROR_BAD_STATE; |
| 5165 | } |
| 5166 | if (capacity > operation->capacity) { |
| 5167 | return PSA_ERROR_INVALID_ARGUMENT; |
| 5168 | } |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5169 | operation->capacity = capacity; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5170 | return PSA_SUCCESS; |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5171 | } |
| 5172 | |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 5173 | #if defined(BUILTIN_ALG_ANY_HKDF) |
Przemek Stekiel | 03d948c | 2022-05-19 11:45:20 +0200 | [diff] [blame] | 5174 | /* Read some bytes from an HKDF-based operation. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5175 | static psa_status_t psa_key_derivation_hkdf_read(psa_hkdf_key_derivation_t *hkdf, |
| 5176 | psa_algorithm_t kdf_alg, |
| 5177 | uint8_t *output, |
| 5178 | size_t output_length) |
Gilles Peskine | bef7f14 | 2018-07-12 17:22:21 +0200 | [diff] [blame] | 5179 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5180 | psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg); |
| 5181 | uint8_t hash_length = PSA_HASH_LENGTH(hash_alg); |
Steven Cooreman | d1ed1d9 | 2021-04-29 19:11:25 +0200 | [diff] [blame] | 5182 | size_t hmac_output_length; |
Gilles Peskine | bef7f14 | 2018-07-12 17:22:21 +0200 | [diff] [blame] | 5183 | psa_status_t status; |
Przemek Stekiel | 3e8249c | 2022-06-03 14:05:07 +0200 | [diff] [blame] | 5184 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5185 | const uint8_t last_block = PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ? 0 : 0xff; |
Przemek Stekiel | 3e8249c | 2022-06-03 14:05:07 +0200 | [diff] [blame] | 5186 | #else |
| 5187 | const uint8_t last_block = 0xff; |
| 5188 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */ |
Gilles Peskine | bef7f14 | 2018-07-12 17:22:21 +0200 | [diff] [blame] | 5189 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5190 | if (hkdf->state < HKDF_STATE_KEYED || |
| 5191 | (!hkdf->info_set |
Przemek Stekiel | 3e8249c | 2022-06-03 14:05:07 +0200 | [diff] [blame] | 5192 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5193 | && !PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) |
Przemek Stekiel | 3e8249c | 2022-06-03 14:05:07 +0200 | [diff] [blame] | 5194 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5195 | )) { |
| 5196 | return PSA_ERROR_BAD_STATE; |
| 5197 | } |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 5198 | hkdf->state = HKDF_STATE_OUTPUT; |
| 5199 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5200 | while (output_length != 0) { |
Gilles Peskine | bef7f14 | 2018-07-12 17:22:21 +0200 | [diff] [blame] | 5201 | /* Copy what remains of the current block */ |
| 5202 | uint8_t n = hash_length - hkdf->offset_in_block; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5203 | if (n > output_length) { |
Gilles Peskine | bef7f14 | 2018-07-12 17:22:21 +0200 | [diff] [blame] | 5204 | n = (uint8_t) output_length; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5205 | } |
| 5206 | memcpy(output, hkdf->output_block + hkdf->offset_in_block, n); |
Gilles Peskine | bef7f14 | 2018-07-12 17:22:21 +0200 | [diff] [blame] | 5207 | output += n; |
| 5208 | output_length -= n; |
| 5209 | hkdf->offset_in_block += n; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5210 | if (output_length == 0) { |
Gilles Peskine | bef7f14 | 2018-07-12 17:22:21 +0200 | [diff] [blame] | 5211 | break; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5212 | } |
Przemek Stekiel | 03d948c | 2022-05-19 11:45:20 +0200 | [diff] [blame] | 5213 | /* We can't be wanting more output after the last block, otherwise |
Gilles Peskine | a99d3fb | 2019-05-16 15:28:51 +0200 | [diff] [blame] | 5214 | * the capacity check in psa_key_derivation_output_bytes() would have |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5215 | * prevented this call. It could happen only if the operation |
Gilles Peskine | d54931c | 2018-07-17 21:06:59 +0200 | [diff] [blame] | 5216 | * object was corrupted or if this function is called directly |
| 5217 | * inside the library. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5218 | if (hkdf->block_number == last_block) { |
| 5219 | return PSA_ERROR_BAD_STATE; |
| 5220 | } |
Gilles Peskine | bef7f14 | 2018-07-12 17:22:21 +0200 | [diff] [blame] | 5221 | |
| 5222 | /* We need a new block */ |
| 5223 | ++hkdf->block_number; |
| 5224 | hkdf->offset_in_block = 0; |
Steven Cooreman | d1ed1d9 | 2021-04-29 19:11:25 +0200 | [diff] [blame] | 5225 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5226 | status = psa_key_derivation_start_hmac(&hkdf->hmac, |
| 5227 | hash_alg, |
| 5228 | hkdf->prk, |
| 5229 | hash_length); |
| 5230 | if (status != PSA_SUCCESS) { |
| 5231 | return status; |
Gilles Peskine | bef7f14 | 2018-07-12 17:22:21 +0200 | [diff] [blame] | 5232 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5233 | |
| 5234 | if (hkdf->block_number != 1) { |
| 5235 | status = psa_mac_update(&hkdf->hmac, |
| 5236 | hkdf->output_block, |
| 5237 | hash_length); |
| 5238 | if (status != PSA_SUCCESS) { |
| 5239 | return status; |
| 5240 | } |
| 5241 | } |
| 5242 | status = psa_mac_update(&hkdf->hmac, |
| 5243 | hkdf->info, |
| 5244 | hkdf->info_length); |
| 5245 | if (status != PSA_SUCCESS) { |
| 5246 | return status; |
| 5247 | } |
| 5248 | status = psa_mac_update(&hkdf->hmac, |
| 5249 | &hkdf->block_number, 1); |
| 5250 | if (status != PSA_SUCCESS) { |
| 5251 | return status; |
| 5252 | } |
| 5253 | status = psa_mac_sign_finish(&hkdf->hmac, |
| 5254 | hkdf->output_block, |
| 5255 | sizeof(hkdf->output_block), |
| 5256 | &hmac_output_length); |
| 5257 | if (status != PSA_SUCCESS) { |
| 5258 | return status; |
| 5259 | } |
Gilles Peskine | bef7f14 | 2018-07-12 17:22:21 +0200 | [diff] [blame] | 5260 | } |
| 5261 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5262 | return PSA_SUCCESS; |
Gilles Peskine | bef7f14 | 2018-07-12 17:22:21 +0200 | [diff] [blame] | 5263 | } |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 5264 | #endif /* BUILTIN_ALG_ANY_HKDF */ |
Hanno Becker | c8a41d7 | 2018-10-09 17:33:01 +0100 | [diff] [blame] | 5265 | |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 5266 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ |
| 5267 | defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) |
Janos Follath | 7742fee | 2019-06-17 12:58:10 +0100 | [diff] [blame] | 5268 | static psa_status_t psa_key_derivation_tls12_prf_generate_next_block( |
| 5269 | psa_tls12_prf_key_derivation_t *tls12_prf, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5270 | psa_algorithm_t alg) |
Janos Follath | 7742fee | 2019-06-17 12:58:10 +0100 | [diff] [blame] | 5271 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5272 | psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(alg); |
| 5273 | uint8_t hash_length = PSA_HASH_LENGTH(hash_alg); |
Steven Cooreman | a6df604 | 2021-04-29 19:32:25 +0200 | [diff] [blame] | 5274 | psa_mac_operation_t hmac = PSA_MAC_OPERATION_INIT; |
| 5275 | size_t hmac_output_length; |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5276 | psa_status_t status, cleanup_status; |
Hanno Becker | c8a41d7 | 2018-10-09 17:33:01 +0100 | [diff] [blame] | 5277 | |
Janos Follath | 7742fee | 2019-06-17 12:58:10 +0100 | [diff] [blame] | 5278 | /* We can't be wanting more output after block 0xff, otherwise |
| 5279 | * the capacity check in psa_key_derivation_output_bytes() would have |
| 5280 | * prevented this call. It could happen only if the operation |
| 5281 | * object was corrupted or if this function is called directly |
| 5282 | * inside the library. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5283 | if (tls12_prf->block_number == 0xff) { |
| 5284 | return PSA_ERROR_CORRUPTION_DETECTED; |
| 5285 | } |
Janos Follath | 7742fee | 2019-06-17 12:58:10 +0100 | [diff] [blame] | 5286 | |
| 5287 | /* We need a new block */ |
| 5288 | ++tls12_prf->block_number; |
Janos Follath | 844eb0e | 2019-06-19 12:10:49 +0100 | [diff] [blame] | 5289 | tls12_prf->left_in_block = hash_length; |
Janos Follath | 7742fee | 2019-06-17 12:58:10 +0100 | [diff] [blame] | 5290 | |
| 5291 | /* Recall the definition of the TLS-1.2-PRF from RFC 5246: |
| 5292 | * |
| 5293 | * PRF(secret, label, seed) = P_<hash>(secret, label + seed) |
| 5294 | * |
| 5295 | * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) + |
| 5296 | * HMAC_hash(secret, A(2) + seed) + |
| 5297 | * HMAC_hash(secret, A(3) + seed) + ... |
| 5298 | * |
| 5299 | * A(0) = seed |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5300 | * A(i) = HMAC_hash(secret, A(i-1)) |
Janos Follath | 7742fee | 2019-06-17 12:58:10 +0100 | [diff] [blame] | 5301 | * |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5302 | * The `psa_tls12_prf_key_derivation` structure saves the block |
Janos Follath | 7742fee | 2019-06-17 12:58:10 +0100 | [diff] [blame] | 5303 | * `HMAC_hash(secret, A(i) + seed)` from which the output |
Janos Follath | 76c3984 | 2019-06-26 12:50:36 +0100 | [diff] [blame] | 5304 | * is currently extracted as `output_block` and where i is |
| 5305 | * `block_number`. |
Janos Follath | 7742fee | 2019-06-17 12:58:10 +0100 | [diff] [blame] | 5306 | */ |
| 5307 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5308 | status = psa_key_derivation_start_hmac(&hmac, |
| 5309 | hash_alg, |
| 5310 | tls12_prf->secret, |
| 5311 | tls12_prf->secret_length); |
| 5312 | if (status != PSA_SUCCESS) { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5313 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5314 | } |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5315 | |
| 5316 | /* Calculate A(i) where i = tls12_prf->block_number. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5317 | if (tls12_prf->block_number == 1) { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5318 | /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads |
| 5319 | * the variable seed and in this instance means it in the context of the |
| 5320 | * P_hash function, where seed = label + seed.) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5321 | status = psa_mac_update(&hmac, |
| 5322 | tls12_prf->label, |
| 5323 | tls12_prf->label_length); |
| 5324 | if (status != PSA_SUCCESS) { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5325 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5326 | } |
| 5327 | status = psa_mac_update(&hmac, |
| 5328 | tls12_prf->seed, |
| 5329 | tls12_prf->seed_length); |
| 5330 | if (status != PSA_SUCCESS) { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5331 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5332 | } |
| 5333 | } else { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5334 | /* A(i) = HMAC_hash(secret, A(i-1)) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5335 | status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length); |
| 5336 | if (status != PSA_SUCCESS) { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5337 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5338 | } |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5339 | } |
| 5340 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5341 | status = psa_mac_sign_finish(&hmac, |
| 5342 | tls12_prf->Ai, hash_length, |
| 5343 | &hmac_output_length); |
| 5344 | if (hmac_output_length != hash_length) { |
Steven Cooreman | a6df604 | 2021-04-29 19:32:25 +0200 | [diff] [blame] | 5345 | status = PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5346 | } |
| 5347 | if (status != PSA_SUCCESS) { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5348 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5349 | } |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5350 | |
| 5351 | /* Calculate HMAC_hash(secret, A(i) + label + seed). */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5352 | status = psa_key_derivation_start_hmac(&hmac, |
| 5353 | hash_alg, |
| 5354 | tls12_prf->secret, |
| 5355 | tls12_prf->secret_length); |
| 5356 | if (status != PSA_SUCCESS) { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5357 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5358 | } |
| 5359 | status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length); |
| 5360 | if (status != PSA_SUCCESS) { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5361 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5362 | } |
| 5363 | status = psa_mac_update(&hmac, tls12_prf->label, tls12_prf->label_length); |
| 5364 | if (status != PSA_SUCCESS) { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5365 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5366 | } |
| 5367 | status = psa_mac_update(&hmac, tls12_prf->seed, tls12_prf->seed_length); |
| 5368 | if (status != PSA_SUCCESS) { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5369 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5370 | } |
| 5371 | status = psa_mac_sign_finish(&hmac, |
| 5372 | tls12_prf->output_block, hash_length, |
| 5373 | &hmac_output_length); |
| 5374 | if (status != PSA_SUCCESS) { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5375 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5376 | } |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5377 | |
Janos Follath | 7742fee | 2019-06-17 12:58:10 +0100 | [diff] [blame] | 5378 | |
| 5379 | cleanup: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5380 | cleanup_status = psa_mac_abort(&hmac); |
| 5381 | if (status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS) { |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5382 | status = cleanup_status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5383 | } |
Janos Follath | ea29bfb | 2019-06-19 12:21:20 +0100 | [diff] [blame] | 5384 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5385 | return status; |
Janos Follath | 7742fee | 2019-06-17 12:58:10 +0100 | [diff] [blame] | 5386 | } |
Hanno Becker | c8a41d7 | 2018-10-09 17:33:01 +0100 | [diff] [blame] | 5387 | |
Janos Follath | 844eb0e | 2019-06-19 12:10:49 +0100 | [diff] [blame] | 5388 | static psa_status_t psa_key_derivation_tls12_prf_read( |
| 5389 | psa_tls12_prf_key_derivation_t *tls12_prf, |
| 5390 | psa_algorithm_t alg, |
| 5391 | uint8_t *output, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5392 | size_t output_length) |
Janos Follath | 844eb0e | 2019-06-19 12:10:49 +0100 | [diff] [blame] | 5393 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5394 | psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH(alg); |
| 5395 | uint8_t hash_length = PSA_HASH_LENGTH(hash_alg); |
Janos Follath | 844eb0e | 2019-06-19 12:10:49 +0100 | [diff] [blame] | 5396 | psa_status_t status; |
| 5397 | uint8_t offset, length; |
| 5398 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5399 | switch (tls12_prf->state) { |
Gilles Peskine | b1edaec | 2021-06-11 22:41:46 +0200 | [diff] [blame] | 5400 | case PSA_TLS12_PRF_STATE_LABEL_SET: |
| 5401 | tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT; |
| 5402 | break; |
| 5403 | case PSA_TLS12_PRF_STATE_OUTPUT: |
| 5404 | break; |
| 5405 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5406 | return PSA_ERROR_BAD_STATE; |
Gilles Peskine | b1edaec | 2021-06-11 22:41:46 +0200 | [diff] [blame] | 5407 | } |
| 5408 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5409 | while (output_length != 0) { |
Janos Follath | 844eb0e | 2019-06-19 12:10:49 +0100 | [diff] [blame] | 5410 | /* Check if we have fully processed the current block. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5411 | if (tls12_prf->left_in_block == 0) { |
| 5412 | status = psa_key_derivation_tls12_prf_generate_next_block(tls12_prf, |
| 5413 | alg); |
| 5414 | if (status != PSA_SUCCESS) { |
| 5415 | return status; |
| 5416 | } |
Janos Follath | 844eb0e | 2019-06-19 12:10:49 +0100 | [diff] [blame] | 5417 | |
| 5418 | continue; |
| 5419 | } |
| 5420 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5421 | if (tls12_prf->left_in_block > output_length) { |
Janos Follath | 844eb0e | 2019-06-19 12:10:49 +0100 | [diff] [blame] | 5422 | length = (uint8_t) output_length; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5423 | } else { |
Janos Follath | 844eb0e | 2019-06-19 12:10:49 +0100 | [diff] [blame] | 5424 | length = tls12_prf->left_in_block; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5425 | } |
Janos Follath | 844eb0e | 2019-06-19 12:10:49 +0100 | [diff] [blame] | 5426 | |
| 5427 | offset = hash_length - tls12_prf->left_in_block; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5428 | memcpy(output, tls12_prf->output_block + offset, length); |
Janos Follath | 844eb0e | 2019-06-19 12:10:49 +0100 | [diff] [blame] | 5429 | output += length; |
| 5430 | output_length -= length; |
| 5431 | tls12_prf->left_in_block -= length; |
| 5432 | } |
| 5433 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5434 | return PSA_SUCCESS; |
Janos Follath | 844eb0e | 2019-06-19 12:10:49 +0100 | [diff] [blame] | 5435 | } |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 5436 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF || |
| 5437 | * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ |
Gilles Peskine | bef7f14 | 2018-07-12 17:22:21 +0200 | [diff] [blame] | 5438 | |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5439 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) |
| 5440 | static psa_status_t psa_key_derivation_tls12_ecjpake_to_pms_read( |
| 5441 | psa_tls12_ecjpake_to_pms_t *ecjpake, |
| 5442 | uint8_t *output, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5443 | size_t output_length) |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5444 | { |
| 5445 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Andrzej Kurek | 5603efd | 2022-09-26 10:49:16 -0400 | [diff] [blame] | 5446 | size_t output_size = 0; |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5447 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5448 | if (output_length != 32) { |
| 5449 | return PSA_ERROR_INVALID_ARGUMENT; |
| 5450 | } |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5451 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5452 | status = psa_hash_compute(PSA_ALG_SHA_256, ecjpake->data, |
| 5453 | PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE, output, output_length, |
| 5454 | &output_size); |
| 5455 | if (status != PSA_SUCCESS) { |
| 5456 | return status; |
| 5457 | } |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5458 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5459 | if (output_size != output_length) { |
| 5460 | return PSA_ERROR_GENERIC_ERROR; |
| 5461 | } |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5462 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5463 | return PSA_SUCCESS; |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5464 | } |
| 5465 | #endif |
| 5466 | |
Janos Follath | 6c6c8fc | 2019-06-17 12:38:20 +0100 | [diff] [blame] | 5467 | psa_status_t psa_key_derivation_output_bytes( |
| 5468 | psa_key_derivation_operation_t *operation, |
| 5469 | uint8_t *output, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5470 | size_t output_length) |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5471 | { |
| 5472 | psa_status_t status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5473 | psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation); |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5474 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5475 | if (operation->alg == 0) { |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5476 | /* This is a blank operation. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5477 | return PSA_ERROR_BAD_STATE; |
Jaeden Amero | cf2010c | 2019-02-15 13:05:49 +0000 | [diff] [blame] | 5478 | } |
| 5479 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5480 | if (output_length > operation->capacity) { |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5481 | operation->capacity = 0; |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5482 | /* Go through the error path to wipe all confidential data now |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5483 | * that the operation object is useless. */ |
David Saada | b4ecc27 | 2019-02-14 13:48:10 +0200 | [diff] [blame] | 5484 | status = PSA_ERROR_INSUFFICIENT_DATA; |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5485 | goto exit; |
| 5486 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5487 | if (output_length == 0 && operation->capacity == 0) { |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5488 | /* Edge case: this is a finished operation, and 0 bytes |
Jaeden Amero | cf2010c | 2019-02-15 13:05:49 +0000 | [diff] [blame] | 5489 | * were requested. The right error in this case could |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5490 | * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return |
| 5491 | * INSUFFICIENT_CAPACITY, which is right for a finished |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5492 | * operation, for consistency with the case when |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5493 | * output_length > 0. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5494 | return PSA_ERROR_INSUFFICIENT_DATA; |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5495 | } |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5496 | operation->capacity -= output_length; |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5497 | |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 5498 | #if defined(BUILTIN_ALG_ANY_HKDF) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5499 | if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) { |
| 5500 | status = psa_key_derivation_hkdf_read(&operation->ctx.hkdf, kdf_alg, |
| 5501 | output, output_length); |
| 5502 | } else |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 5503 | #endif /* BUILTIN_ALG_ANY_HKDF */ |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 5504 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ |
| 5505 | defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5506 | if (PSA_ALG_IS_TLS12_PRF(kdf_alg) || |
| 5507 | PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) { |
| 5508 | status = psa_key_derivation_tls12_prf_read(&operation->ctx.tls12_prf, |
| 5509 | kdf_alg, output, |
| 5510 | output_length); |
| 5511 | } else |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 5512 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF || |
| 5513 | * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5514 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5515 | if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) { |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5516 | status = psa_key_derivation_tls12_ecjpake_to_pms_read( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5517 | &operation->ctx.tls12_ecjpake_to_pms, output, output_length); |
| 5518 | } else |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5519 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */ |
| 5520 | |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5521 | { |
Steven Cooreman | 74afe47 | 2021-02-10 17:19:22 +0100 | [diff] [blame] | 5522 | (void) kdf_alg; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5523 | return PSA_ERROR_BAD_STATE; |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5524 | } |
| 5525 | |
| 5526 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5527 | if (status != PSA_SUCCESS) { |
Jaeden Amero | cf2010c | 2019-02-15 13:05:49 +0000 | [diff] [blame] | 5528 | /* Preserve the algorithm upon errors, but clear all sensitive state. |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5529 | * This allows us to differentiate between exhausted operations and |
| 5530 | * blank operations, so we can return PSA_ERROR_BAD_STATE on blank |
| 5531 | * operations. */ |
| 5532 | psa_algorithm_t alg = operation->alg; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5533 | psa_key_derivation_abort(operation); |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5534 | operation->alg = alg; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5535 | memset(output, '!', output_length); |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5536 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5537 | return status; |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5538 | } |
| 5539 | |
David Brown | 7807bf7 | 2021-02-09 16:28:23 -0700 | [diff] [blame] | 5540 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5541 | static void psa_des_set_key_parity(uint8_t *data, size_t data_size) |
Gilles Peskine | 08542d8 | 2018-07-19 17:05:42 +0200 | [diff] [blame] | 5542 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5543 | if (data_size >= 8) { |
| 5544 | mbedtls_des_key_set_parity(data); |
| 5545 | } |
| 5546 | if (data_size >= 16) { |
| 5547 | mbedtls_des_key_set_parity(data + 8); |
| 5548 | } |
| 5549 | if (data_size >= 24) { |
| 5550 | mbedtls_des_key_set_parity(data + 16); |
| 5551 | } |
Gilles Peskine | 08542d8 | 2018-07-19 17:05:42 +0200 | [diff] [blame] | 5552 | } |
David Brown | 7807bf7 | 2021-02-09 16:28:23 -0700 | [diff] [blame] | 5553 | #endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */ |
Gilles Peskine | 08542d8 | 2018-07-19 17:05:42 +0200 | [diff] [blame] | 5554 | |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5555 | /* |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5556 | * ECC keys on a Weierstrass elliptic curve require the generation |
| 5557 | * of a private key which is an integer |
| 5558 | * in the range [1, N - 1], where N is the boundary of the private key domain: |
| 5559 | * N is the prime p for Diffie-Hellman, or the order of the |
| 5560 | * curve’s base point for ECC. |
| 5561 | * |
| 5562 | * Let m be the bit size of N, such that 2^m > N >= 2^(m-1). |
| 5563 | * This function generates the private key using the following process: |
| 5564 | * |
| 5565 | * 1. Draw a byte string of length ceiling(m/8) bytes. |
| 5566 | * 2. If m is not a multiple of 8, set the most significant |
| 5567 | * (8 * ceiling(m/8) - m) bits of the first byte in the string to zero. |
| 5568 | * 3. Convert the string to integer k by decoding it as a big-endian byte string. |
| 5569 | * 4. If k > N - 2, discard the result and return to step 1. |
| 5570 | * 5. Output k + 1 as the private key. |
| 5571 | * |
| 5572 | * This method allows compliance to NIST standards, specifically the methods titled |
| 5573 | * Key-Pair Generation by Testing Candidates in the following publications: |
| 5574 | * - NIST Special Publication 800-56A: Recommendation for Pair-Wise Key-Establishment |
| 5575 | * Schemes Using Discrete Logarithm Cryptography [SP800-56A] §5.6.1.1.4 for |
| 5576 | * Diffie-Hellman keys. |
| 5577 | * |
| 5578 | * - [SP800-56A] §5.6.1.2.2 or FIPS Publication 186-4: Digital Signature |
| 5579 | * Standard (DSS) [FIPS186-4] §B.4.2 for elliptic curve keys. |
| 5580 | * |
| 5581 | * Note: Function allocates memory for *data buffer, so given *data should be |
| 5582 | * always NULL. |
| 5583 | */ |
Joakim Andersson | bb576fe | 2023-03-01 11:23:02 +0100 | [diff] [blame] | 5584 | #if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) || \ |
| 5585 | defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) || \ |
Przemek Stekiel | 7fc0751 | 2022-03-04 14:41:11 +0100 | [diff] [blame] | 5586 | defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
| 5587 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \ |
| 5588 | defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) |
Przemyslaw Stekiel | 58ce8d8 | 2021-11-25 13:53:28 +0100 | [diff] [blame] | 5589 | static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper( |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5590 | psa_key_slot_t *slot, |
| 5591 | size_t bits, |
| 5592 | psa_key_derivation_operation_t *operation, |
Przemyslaw Stekiel | 6d3d18b | 2022-01-20 22:41:17 +0100 | [diff] [blame] | 5593 | uint8_t **data |
| 5594 | ) |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5595 | { |
Valerio Setti | 5278986 | 2023-04-07 12:13:11 +0200 | [diff] [blame] | 5596 | #if defined(MBEDTLS_ECP_LIGHT) |
Przemyslaw Stekiel | 6d3d18b | 2022-01-20 22:41:17 +0100 | [diff] [blame] | 5597 | unsigned key_out_of_range = 1; |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5598 | mbedtls_mpi k; |
| 5599 | mbedtls_mpi diff_N_2; |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5600 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | a81aed2 | 2022-03-01 15:13:30 +0100 | [diff] [blame] | 5601 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5602 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5603 | mbedtls_mpi_init(&k); |
| 5604 | mbedtls_mpi_init(&diff_N_2); |
Przemyslaw Stekiel | 1dfd122 | 2021-11-18 13:35:00 +0100 | [diff] [blame] | 5605 | |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5606 | psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5607 | slot->attr.type); |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5608 | mbedtls_ecp_group_id grp_id = |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5609 | mbedtls_ecc_group_of_psa(curve, bits, 0); |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5610 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5611 | if (grp_id == MBEDTLS_ECP_DP_NONE) { |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5612 | ret = MBEDTLS_ERR_ASN1_INVALID_DATA; |
Przemyslaw Stekiel | 871a336 | 2021-12-02 08:46:39 +0100 | [diff] [blame] | 5613 | goto cleanup; |
| 5614 | } |
| 5615 | |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5616 | mbedtls_ecp_group ecp_group; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5617 | mbedtls_ecp_group_init(&ecp_group); |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5618 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5619 | MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&ecp_group, grp_id)); |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5620 | |
Przemyslaw Stekiel | 6d3d18b | 2022-01-20 22:41:17 +0100 | [diff] [blame] | 5621 | /* N is the boundary of the private key domain (ecp_group.N). */ |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5622 | /* Let m be the bit size of N. */ |
| 5623 | size_t m = ecp_group.nbits; |
| 5624 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5625 | size_t m_bytes = PSA_BITS_TO_BYTES(m); |
Przemyslaw Stekiel | 6d3d18b | 2022-01-20 22:41:17 +0100 | [diff] [blame] | 5626 | |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5627 | /* Calculate N - 2 - it will be needed later. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5628 | MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&diff_N_2, &ecp_group.N, 2)); |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5629 | |
Przemyslaw Stekiel | 6d3d18b | 2022-01-20 22:41:17 +0100 | [diff] [blame] | 5630 | /* Note: This function is always called with *data == NULL and it |
| 5631 | * allocates memory for the data buffer. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5632 | *data = mbedtls_calloc(1, m_bytes); |
| 5633 | if (*data == NULL) { |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5634 | ret = MBEDTLS_ERR_ASN1_ALLOC_FAILED; |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5635 | goto cleanup; |
| 5636 | } |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5637 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5638 | while (key_out_of_range) { |
Przemyslaw Stekiel | 6d3d18b | 2022-01-20 22:41:17 +0100 | [diff] [blame] | 5639 | /* 1. Draw a byte string of length ceiling(m/8) bytes. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5640 | if ((status = psa_key_derivation_output_bytes(operation, *data, m_bytes)) != 0) { |
Przemyslaw Stekiel | 6d3d18b | 2022-01-20 22:41:17 +0100 | [diff] [blame] | 5641 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5642 | } |
Przemyslaw Stekiel | 6d3d18b | 2022-01-20 22:41:17 +0100 | [diff] [blame] | 5643 | |
| 5644 | /* 2. If m is not a multiple of 8 */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5645 | if (m % 8 != 0) { |
Przemyslaw Stekiel | 6d3d18b | 2022-01-20 22:41:17 +0100 | [diff] [blame] | 5646 | /* Set the most significant |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5647 | * (8 * ceiling(m/8) - m) bits of the first byte in |
| 5648 | * the string to zero. |
| 5649 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5650 | uint8_t clear_bit_mask = (1 << (m % 8)) - 1; |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5651 | (*data)[0] &= clear_bit_mask; |
Przemyslaw Stekiel | 6d3d18b | 2022-01-20 22:41:17 +0100 | [diff] [blame] | 5652 | } |
| 5653 | |
| 5654 | /* 3. Convert the string to integer k by decoding it as a |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5655 | * big-endian byte string. |
| 5656 | */ |
| 5657 | MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&k, *data, m_bytes)); |
Przemyslaw Stekiel | 6d3d18b | 2022-01-20 22:41:17 +0100 | [diff] [blame] | 5658 | |
| 5659 | /* 4. If k > N - 2, discard the result and return to step 1. |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5660 | * Result of comparison is returned. When it indicates error |
| 5661 | * then this function is called again. |
| 5662 | */ |
| 5663 | MBEDTLS_MPI_CHK(mbedtls_mpi_lt_mpi_ct(&diff_N_2, &k, &key_out_of_range)); |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5664 | } |
| 5665 | |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5666 | /* 5. Output k + 1 as the private key. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5667 | MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&k, &k, 1)); |
| 5668 | MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&k, *data, m_bytes)); |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5669 | cleanup: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5670 | if (ret != 0) { |
| 5671 | status = mbedtls_to_psa_error(ret); |
| 5672 | } |
| 5673 | if (status != PSA_SUCCESS) { |
| 5674 | mbedtls_free(*data); |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5675 | *data = NULL; |
| 5676 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5677 | mbedtls_mpi_free(&k); |
| 5678 | mbedtls_mpi_free(&diff_N_2); |
| 5679 | return status; |
Valerio Setti | 5278986 | 2023-04-07 12:13:11 +0200 | [diff] [blame] | 5680 | #else /* MBEDTLS_ECP_LIGHT */ |
Manuel Pégourié-Gonnard | 3831637 | 2023-03-17 12:18:32 +0100 | [diff] [blame] | 5681 | (void) slot; |
| 5682 | (void) bits; |
| 5683 | (void) operation; |
| 5684 | (void) data; |
| 5685 | return PSA_ERROR_NOT_SUPPORTED; |
Valerio Setti | 5278986 | 2023-04-07 12:13:11 +0200 | [diff] [blame] | 5686 | #endif /* MBEDTLS_ECP_LIGHT */ |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5687 | } |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5688 | |
| 5689 | /* ECC keys on a Montgomery elliptic curve draws a byte string whose length |
| 5690 | * is determined by the curve, and sets the mandatory bits accordingly. That is: |
| 5691 | * |
| 5692 | * - Curve25519 (PSA_ECC_FAMILY_MONTGOMERY, 255 bits): |
| 5693 | * draw a 32-byte string and process it as specified in |
| 5694 | * Elliptic Curves for Security [RFC7748] §5. |
| 5695 | * |
| 5696 | * - Curve448 (PSA_ECC_FAMILY_MONTGOMERY, 448 bits): |
| 5697 | * draw a 56-byte string and process it as specified in [RFC7748] §5. |
| 5698 | * |
| 5699 | * Note: Function allocates memory for *data buffer, so given *data should be |
| 5700 | * always NULL. |
| 5701 | */ |
| 5702 | |
| 5703 | static psa_status_t psa_generate_derived_ecc_key_montgomery_helper( |
| 5704 | size_t bits, |
| 5705 | psa_key_derivation_operation_t *operation, |
| 5706 | uint8_t **data |
| 5707 | ) |
| 5708 | { |
| 5709 | size_t output_length; |
Przemek Stekiel | a81aed2 | 2022-03-01 15:13:30 +0100 | [diff] [blame] | 5710 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5711 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5712 | switch (bits) { |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5713 | case 255: |
| 5714 | output_length = 32; |
| 5715 | break; |
| 5716 | case 448: |
| 5717 | output_length = 56; |
| 5718 | break; |
| 5719 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5720 | return PSA_ERROR_INVALID_ARGUMENT; |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5721 | break; |
| 5722 | } |
| 5723 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5724 | *data = mbedtls_calloc(1, output_length); |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5725 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5726 | if (*data == NULL) { |
| 5727 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
| 5728 | } |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5729 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5730 | status = psa_key_derivation_output_bytes(operation, *data, output_length); |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5731 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5732 | if (status != PSA_SUCCESS) { |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5733 | return status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5734 | } |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5735 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5736 | switch (bits) { |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5737 | case 255: |
| 5738 | (*data)[0] &= 248; |
| 5739 | (*data)[31] &= 127; |
| 5740 | (*data)[31] |= 64; |
| 5741 | break; |
| 5742 | case 448: |
| 5743 | (*data)[0] &= 252; |
| 5744 | (*data)[55] |= 128; |
| 5745 | break; |
| 5746 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5747 | return PSA_ERROR_CORRUPTION_DETECTED; |
Przemyslaw Stekiel | aeaa4f0 | 2022-02-21 08:17:43 +0100 | [diff] [blame] | 5748 | break; |
| 5749 | } |
| 5750 | |
| 5751 | return status; |
| 5752 | } |
Joakim Andersson | bb576fe | 2023-03-01 11:23:02 +0100 | [diff] [blame] | 5753 | #endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) || |
| 5754 | defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) || |
Przemek Stekiel | 7fc0751 | 2022-03-04 14:41:11 +0100 | [diff] [blame] | 5755 | defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 5756 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || |
| 5757 | defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */ |
Przemyslaw Stekiel | d8cdcba | 2021-11-15 12:38:53 +0100 | [diff] [blame] | 5758 | |
Adrian L. Shaw | 5a5a79a | 2019-05-03 15:44:28 +0100 | [diff] [blame] | 5759 | static psa_status_t psa_generate_derived_key_internal( |
Gilles Peskine | ff5f0e7 | 2019-04-18 12:53:30 +0200 | [diff] [blame] | 5760 | psa_key_slot_t *slot, |
| 5761 | size_t bits, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5762 | psa_key_derivation_operation_t *operation) |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5763 | { |
| 5764 | uint8_t *data = NULL; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5765 | size_t bytes = PSA_BITS_TO_BYTES(bits); |
Archana | d8a83dc | 2021-06-14 10:04:16 +0530 | [diff] [blame] | 5766 | size_t storage_size = bytes; |
Przemek Stekiel | a81aed2 | 2022-03-01 15:13:30 +0100 | [diff] [blame] | 5767 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5768 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5769 | if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) { |
| 5770 | return PSA_ERROR_INVALID_ARGUMENT; |
| 5771 | } |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5772 | |
Joakim Andersson | bb576fe | 2023-03-01 11:23:02 +0100 | [diff] [blame] | 5773 | #if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) || \ |
| 5774 | defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) || \ |
Przemek Stekiel | 7fc0751 | 2022-03-04 14:41:11 +0100 | [diff] [blame] | 5775 | defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ |
| 5776 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \ |
| 5777 | defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5778 | if (PSA_KEY_TYPE_IS_ECC(slot->attr.type)) { |
| 5779 | psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(slot->attr.type); |
| 5780 | if (PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) { |
Przemyslaw Stekiel | 58ce8d8 | 2021-11-25 13:53:28 +0100 | [diff] [blame] | 5781 | /* Weierstrass elliptic curve */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5782 | status = psa_generate_derived_ecc_key_weierstrass_helper(slot, bits, operation, &data); |
| 5783 | if (status != PSA_SUCCESS) { |
Przemyslaw Stekiel | 6d3d18b | 2022-01-20 22:41:17 +0100 | [diff] [blame] | 5784 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5785 | } |
| 5786 | } else { |
Przemyslaw Stekiel | 58ce8d8 | 2021-11-25 13:53:28 +0100 | [diff] [blame] | 5787 | /* Montgomery elliptic curve */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5788 | status = psa_generate_derived_ecc_key_montgomery_helper(bits, operation, &data); |
| 5789 | if (status != PSA_SUCCESS) { |
Przemyslaw Stekiel | 58ce8d8 | 2021-11-25 13:53:28 +0100 | [diff] [blame] | 5790 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5791 | } |
Przemyslaw Stekiel | 58ce8d8 | 2021-11-25 13:53:28 +0100 | [diff] [blame] | 5792 | } |
Przemyslaw Stekiel | 1dfd122 | 2021-11-18 13:35:00 +0100 | [diff] [blame] | 5793 | } else |
Joakim Andersson | bb576fe | 2023-03-01 11:23:02 +0100 | [diff] [blame] | 5794 | #endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) || |
| 5795 | defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) || |
Przemek Stekiel | 7fc0751 | 2022-03-04 14:41:11 +0100 | [diff] [blame] | 5796 | defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || |
| 5797 | defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || |
| 5798 | defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5799 | if (key_type_is_raw_bytes(slot->attr.type)) { |
| 5800 | if (bits % 8 != 0) { |
| 5801 | return PSA_ERROR_INVALID_ARGUMENT; |
| 5802 | } |
| 5803 | data = mbedtls_calloc(1, bytes); |
| 5804 | if (data == NULL) { |
| 5805 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
| 5806 | } |
Przemyslaw Stekiel | 1608e33 | 2021-11-09 10:46:40 +0100 | [diff] [blame] | 5807 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5808 | status = psa_key_derivation_output_bytes(operation, data, bytes); |
| 5809 | if (status != PSA_SUCCESS) { |
Przemyslaw Stekiel | 1608e33 | 2021-11-09 10:46:40 +0100 | [diff] [blame] | 5810 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5811 | } |
David Brown | 12ca503 | 2021-02-11 11:02:00 -0700 | [diff] [blame] | 5812 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5813 | if (slot->attr.type == PSA_KEY_TYPE_DES) { |
| 5814 | psa_des_set_key_parity(data, bytes); |
| 5815 | } |
Przemek Stekiel | f110dc0 | 2022-03-01 14:48:05 +0100 | [diff] [blame] | 5816 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5817 | } else { |
| 5818 | return PSA_ERROR_NOT_SUPPORTED; |
Przemyslaw Stekiel | 1608e33 | 2021-11-09 10:46:40 +0100 | [diff] [blame] | 5819 | } |
Ronald Cron | dd04d42 | 2020-11-28 15:14:42 +0100 | [diff] [blame] | 5820 | |
Ronald Cron | bf33c93 | 2020-11-28 18:06:53 +0100 | [diff] [blame] | 5821 | slot->attr.bits = (psa_key_bits_t) bits; |
Ronald Cron | 2ebfdcc | 2020-11-28 15:54:54 +0100 | [diff] [blame] | 5822 | psa_key_attributes_t attributes = { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5823 | .core = slot->attr |
Ronald Cron | 2ebfdcc | 2020-11-28 15:54:54 +0100 | [diff] [blame] | 5824 | }; |
| 5825 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5826 | if (psa_key_lifetime_is_external(attributes.core.lifetime)) { |
| 5827 | status = psa_driver_wrapper_get_key_buffer_size(&attributes, |
| 5828 | &storage_size); |
| 5829 | if (status != PSA_SUCCESS) { |
Archana | d8a83dc | 2021-06-14 10:04:16 +0530 | [diff] [blame] | 5830 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5831 | } |
Archana | d8a83dc | 2021-06-14 10:04:16 +0530 | [diff] [blame] | 5832 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5833 | status = psa_allocate_buffer_to_slot(slot, storage_size); |
| 5834 | if (status != PSA_SUCCESS) { |
Archana | d8a83dc | 2021-06-14 10:04:16 +0530 | [diff] [blame] | 5835 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5836 | } |
Archana | d8a83dc | 2021-06-14 10:04:16 +0530 | [diff] [blame] | 5837 | |
Przemek Stekiel | c80e750 | 2023-05-11 11:14:25 +0200 | [diff] [blame] | 5838 | if (PSA_KEY_TYPE_IS_ASYMMETRIC(attributes.core.type) && |
| 5839 | PSA_KEY_TYPE_IS_DH(attributes.core.type)) { |
| 5840 | if (psa_is_dh_key_size_valid(PSA_BYTES_TO_BITS(bytes)) == 0) { |
| 5841 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 5842 | goto exit; |
| 5843 | } |
| 5844 | |
| 5845 | /* Copy the key material. */ |
| 5846 | memcpy(slot->key.data, data, bytes); |
| 5847 | bits = PSA_BYTES_TO_BITS(bytes); |
| 5848 | |
| 5849 | status = PSA_SUCCESS; |
| 5850 | } else { |
| 5851 | status = psa_driver_wrapper_import_key(&attributes, |
| 5852 | data, bytes, |
| 5853 | slot->key.data, |
| 5854 | slot->key.bytes, |
| 5855 | &slot->key.bytes, &bits); |
| 5856 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5857 | if (bits != slot->attr.bits) { |
Ronald Cron | bf33c93 | 2020-11-28 18:06:53 +0100 | [diff] [blame] | 5858 | status = PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5859 | } |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5860 | |
| 5861 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5862 | mbedtls_free(data); |
| 5863 | return status; |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5864 | } |
| 5865 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5866 | psa_status_t psa_key_derivation_output_key(const psa_key_attributes_t *attributes, |
| 5867 | psa_key_derivation_operation_t *operation, |
| 5868 | mbedtls_svc_key_id_t *key) |
Gilles Peskine | ff5f0e7 | 2019-04-18 12:53:30 +0200 | [diff] [blame] | 5869 | { |
| 5870 | psa_status_t status; |
| 5871 | psa_key_slot_t *slot = NULL; |
Gilles Peskine | 8abe6a2 | 2019-07-12 23:40:35 +0200 | [diff] [blame] | 5872 | psa_se_drv_table_entry_t *driver = NULL; |
Gilles Peskine | 0f84d62 | 2019-09-12 19:03:13 +0200 | [diff] [blame] | 5873 | |
Ronald Cron | 81709fc | 2020-11-14 12:10:32 +0100 | [diff] [blame] | 5874 | *key = MBEDTLS_SVC_KEY_ID_INIT; |
| 5875 | |
Gilles Peskine | 0f84d62 | 2019-09-12 19:03:13 +0200 | [diff] [blame] | 5876 | /* Reject any attempt to create a zero-length key so that we don't |
| 5877 | * risk tripping up later, e.g. on a malloc(0) that returns NULL. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5878 | if (psa_get_key_bits(attributes) == 0) { |
| 5879 | return PSA_ERROR_INVALID_ARGUMENT; |
| 5880 | } |
Gilles Peskine | 0f84d62 | 2019-09-12 19:03:13 +0200 | [diff] [blame] | 5881 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5882 | if (operation->alg == PSA_ALG_NONE) { |
| 5883 | return PSA_ERROR_BAD_STATE; |
| 5884 | } |
Dave Rodgman | d69da6c | 2021-11-16 10:32:48 +0000 | [diff] [blame] | 5885 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5886 | if (!operation->can_output_key) { |
| 5887 | return PSA_ERROR_NOT_PERMITTED; |
| 5888 | } |
Gilles Peskine | 178c9aa | 2019-09-24 18:21:06 +0200 | [diff] [blame] | 5889 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5890 | status = psa_start_key_creation(PSA_KEY_CREATION_DERIVE, attributes, |
| 5891 | &slot, &driver); |
Gilles Peskine | f4ee662 | 2019-07-24 13:44:30 +0200 | [diff] [blame] | 5892 | #if defined(MBEDTLS_PSA_CRYPTO_SE_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5893 | if (driver != NULL) { |
Gilles Peskine | f4ee662 | 2019-07-24 13:44:30 +0200 | [diff] [blame] | 5894 | /* Deriving a key in a secure element is not implemented yet. */ |
| 5895 | status = PSA_ERROR_NOT_SUPPORTED; |
| 5896 | } |
| 5897 | #endif /* MBEDTLS_PSA_CRYPTO_SE_C */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5898 | if (status == PSA_SUCCESS) { |
| 5899 | status = psa_generate_derived_key_internal(slot, |
| 5900 | attributes->core.bits, |
| 5901 | operation); |
Gilles Peskine | ff5f0e7 | 2019-04-18 12:53:30 +0200 | [diff] [blame] | 5902 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5903 | if (status == PSA_SUCCESS) { |
| 5904 | status = psa_finish_key_creation(slot, driver, key); |
| 5905 | } |
| 5906 | if (status != PSA_SUCCESS) { |
| 5907 | psa_fail_key_creation(slot, driver); |
| 5908 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 5909 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5910 | return status; |
Gilles Peskine | ff5f0e7 | 2019-04-18 12:53:30 +0200 | [diff] [blame] | 5911 | } |
| 5912 | |
Gilles Peskine | eab56e4 | 2018-07-12 17:12:33 +0200 | [diff] [blame] | 5913 | |
| 5914 | |
| 5915 | /****************************************************************/ |
Gilles Peskine | ea0fb49 | 2018-07-12 17:17:20 +0200 | [diff] [blame] | 5916 | /* Key derivation */ |
| 5917 | /****************************************************************/ |
| 5918 | |
Steven Cooreman | 932ffb7 | 2021-02-15 12:14:32 +0100 | [diff] [blame] | 5919 | #if defined(AT_LEAST_ONE_BUILTIN_KDF) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5920 | static int is_kdf_alg_supported(psa_algorithm_t kdf_alg) |
Gilles Peskine | 9efde4f | 2021-04-29 21:10:00 +0200 | [diff] [blame] | 5921 | { |
| 5922 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5923 | if (PSA_ALG_IS_HKDF(kdf_alg)) { |
| 5924 | return 1; |
| 5925 | } |
Gilles Peskine | 9efde4f | 2021-04-29 21:10:00 +0200 | [diff] [blame] | 5926 | #endif |
Przemek Stekiel | b57a44b | 2022-06-06 08:33:45 +0200 | [diff] [blame] | 5927 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5928 | if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) { |
| 5929 | return 1; |
| 5930 | } |
Przemek Stekiel | b57a44b | 2022-06-06 08:33:45 +0200 | [diff] [blame] | 5931 | #endif |
| 5932 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5933 | if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) { |
| 5934 | return 1; |
| 5935 | } |
Gilles Peskine | 9efde4f | 2021-04-29 21:10:00 +0200 | [diff] [blame] | 5936 | #endif |
| 5937 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5938 | if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) { |
| 5939 | return 1; |
| 5940 | } |
Gilles Peskine | 9efde4f | 2021-04-29 21:10:00 +0200 | [diff] [blame] | 5941 | #endif |
| 5942 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5943 | if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) { |
| 5944 | return 1; |
| 5945 | } |
Gilles Peskine | 9efde4f | 2021-04-29 21:10:00 +0200 | [diff] [blame] | 5946 | #endif |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5947 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5948 | if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) { |
| 5949 | return 1; |
| 5950 | } |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5951 | #endif |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5952 | return 0; |
Gilles Peskine | 9efde4f | 2021-04-29 21:10:00 +0200 | [diff] [blame] | 5953 | } |
| 5954 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5955 | static psa_status_t psa_hash_try_support(psa_algorithm_t alg) |
Gilles Peskine | 0cc417d | 2021-04-29 21:18:14 +0200 | [diff] [blame] | 5956 | { |
| 5957 | psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5958 | psa_status_t status = psa_hash_setup(&operation, alg); |
| 5959 | psa_hash_abort(&operation); |
| 5960 | return status; |
Gilles Peskine | 0cc417d | 2021-04-29 21:18:14 +0200 | [diff] [blame] | 5961 | } |
| 5962 | |
Gilles Peskine | 969c5d6 | 2019-01-16 15:53:06 +0100 | [diff] [blame] | 5963 | static psa_status_t psa_key_derivation_setup_kdf( |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 5964 | psa_key_derivation_operation_t *operation, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5965 | psa_algorithm_t kdf_alg) |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 5966 | { |
Janos Follath | 5fe1973 | 2019-06-20 15:09:30 +0100 | [diff] [blame] | 5967 | /* Make sure that operation->ctx is properly zero-initialised. (Macro |
| 5968 | * initialisers for this union leave some bytes unspecified.) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5969 | memset(&operation->ctx, 0, sizeof(operation->ctx)); |
Janos Follath | 5fe1973 | 2019-06-20 15:09:30 +0100 | [diff] [blame] | 5970 | |
Gilles Peskine | 969c5d6 | 2019-01-16 15:53:06 +0100 | [diff] [blame] | 5971 | /* Make sure that kdf_alg is a supported key derivation algorithm. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5972 | if (!is_kdf_alg_supported(kdf_alg)) { |
| 5973 | return PSA_ERROR_NOT_SUPPORTED; |
| 5974 | } |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 5975 | |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5976 | /* All currently supported key derivation algorithms (apart from |
Andrzej Kurek | 702776f | 2022-09-16 06:22:44 -0400 | [diff] [blame] | 5977 | * ecjpake to pms) are based on a hash algorithm. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5978 | psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg); |
| 5979 | size_t hash_size = PSA_HASH_LENGTH(hash_alg); |
| 5980 | if (kdf_alg != PSA_ALG_TLS12_ECJPAKE_TO_PMS) { |
| 5981 | if (hash_size == 0) { |
| 5982 | return PSA_ERROR_NOT_SUPPORTED; |
| 5983 | } |
Gilles Peskine | 0cc417d | 2021-04-29 21:18:14 +0200 | [diff] [blame] | 5984 | |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5985 | /* Make sure that hash_alg is a supported hash algorithm. Otherwise |
| 5986 | * we might fail later, which is somewhat unfriendly and potentially |
| 5987 | * risk-prone. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5988 | psa_status_t status = psa_hash_try_support(hash_alg); |
| 5989 | if (status != PSA_SUCCESS) { |
| 5990 | return status; |
| 5991 | } |
| 5992 | } else { |
| 5993 | hash_size = PSA_HASH_LENGTH(PSA_ALG_SHA_256); |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 5994 | } |
Gilles Peskine | 0cc417d | 2021-04-29 21:18:14 +0200 | [diff] [blame] | 5995 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 5996 | if ((PSA_ALG_IS_TLS12_PRF(kdf_alg) || |
| 5997 | PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) && |
| 5998 | !(hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) { |
| 5999 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6000 | } |
Andrzej Kurek | 7763829 | 2022-09-16 12:24:52 -0400 | [diff] [blame] | 6001 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \ |
Andrzej Kurek | b510cd2 | 2022-09-26 10:50:22 -0400 | [diff] [blame] | 6002 | defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6003 | if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) || |
| 6004 | (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS)) { |
Przemek Stekiel | 17520fe | 2022-05-10 13:53:33 +0200 | [diff] [blame] | 6005 | operation->capacity = hash_size; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6006 | } else |
Andrzej Kurek | b510cd2 | 2022-09-26 10:50:22 -0400 | [diff] [blame] | 6007 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT || |
| 6008 | MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6009 | operation->capacity = 255 * hash_size; |
| 6010 | return PSA_SUCCESS; |
Gilles Peskine | 969c5d6 | 2019-01-16 15:53:06 +0100 | [diff] [blame] | 6011 | } |
Gilles Peskine | 0c3a071 | 2021-04-29 21:34:33 +0200 | [diff] [blame] | 6012 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6013 | static psa_status_t psa_key_agreement_try_support(psa_algorithm_t alg) |
Gilles Peskine | 0c3a071 | 2021-04-29 21:34:33 +0200 | [diff] [blame] | 6014 | { |
| 6015 | #if defined(PSA_WANT_ALG_ECDH) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6016 | if (alg == PSA_ALG_ECDH) { |
| 6017 | return PSA_SUCCESS; |
| 6018 | } |
Gilles Peskine | 0c3a071 | 2021-04-29 21:34:33 +0200 | [diff] [blame] | 6019 | #endif |
Przemek Stekiel | fb3dd54 | 2022-12-01 14:59:15 +0100 | [diff] [blame] | 6020 | #if defined(PSA_WANT_ALG_FFDH) |
| 6021 | if (alg == PSA_ALG_FFDH) { |
| 6022 | return PSA_SUCCESS; |
| 6023 | } |
| 6024 | #endif |
Gilles Peskine | 0c3a071 | 2021-04-29 21:34:33 +0200 | [diff] [blame] | 6025 | (void) alg; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6026 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | 0c3a071 | 2021-04-29 21:34:33 +0200 | [diff] [blame] | 6027 | } |
Gilles Peskine | bb3814c | 2022-12-16 01:12:12 +0100 | [diff] [blame] | 6028 | |
| 6029 | static int psa_key_derivation_allows_free_form_secret_input( |
| 6030 | psa_algorithm_t kdf_alg) |
| 6031 | { |
| 6032 | #if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS) |
| 6033 | if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) { |
| 6034 | return 0; |
| 6035 | } |
| 6036 | #endif |
| 6037 | (void) kdf_alg; |
| 6038 | return 1; |
| 6039 | } |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6040 | #endif /* AT_LEAST_ONE_BUILTIN_KDF */ |
Gilles Peskine | 969c5d6 | 2019-01-16 15:53:06 +0100 | [diff] [blame] | 6041 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6042 | psa_status_t psa_key_derivation_setup(psa_key_derivation_operation_t *operation, |
| 6043 | psa_algorithm_t alg) |
Gilles Peskine | 969c5d6 | 2019-01-16 15:53:06 +0100 | [diff] [blame] | 6044 | { |
| 6045 | psa_status_t status; |
| 6046 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6047 | if (operation->alg != 0) { |
| 6048 | return PSA_ERROR_BAD_STATE; |
Gilles Peskine | 969c5d6 | 2019-01-16 15:53:06 +0100 | [diff] [blame] | 6049 | } |
Gilles Peskine | 969c5d6 | 2019-01-16 15:53:06 +0100 | [diff] [blame] | 6050 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6051 | if (PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) { |
| 6052 | return PSA_ERROR_INVALID_ARGUMENT; |
| 6053 | } else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) { |
| 6054 | #if defined(AT_LEAST_ONE_BUILTIN_KDF) |
| 6055 | psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF(alg); |
| 6056 | psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(alg); |
| 6057 | status = psa_key_agreement_try_support(ka_alg); |
| 6058 | if (status != PSA_SUCCESS) { |
| 6059 | return status; |
| 6060 | } |
Gilles Peskine | bb3814c | 2022-12-16 01:12:12 +0100 | [diff] [blame] | 6061 | if (!psa_key_derivation_allows_free_form_secret_input(kdf_alg)) { |
| 6062 | return PSA_ERROR_INVALID_ARGUMENT; |
| 6063 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6064 | status = psa_key_derivation_setup_kdf(operation, kdf_alg); |
| 6065 | #else |
| 6066 | return PSA_ERROR_NOT_SUPPORTED; |
| 6067 | #endif /* AT_LEAST_ONE_BUILTIN_KDF */ |
| 6068 | } else if (PSA_ALG_IS_KEY_DERIVATION(alg)) { |
| 6069 | #if defined(AT_LEAST_ONE_BUILTIN_KDF) |
| 6070 | status = psa_key_derivation_setup_kdf(operation, alg); |
| 6071 | #else |
| 6072 | return PSA_ERROR_NOT_SUPPORTED; |
| 6073 | #endif /* AT_LEAST_ONE_BUILTIN_KDF */ |
| 6074 | } else { |
| 6075 | return PSA_ERROR_INVALID_ARGUMENT; |
| 6076 | } |
| 6077 | |
| 6078 | if (status == PSA_SUCCESS) { |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 6079 | operation->alg = alg; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6080 | } |
| 6081 | return status; |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6082 | } |
| 6083 | |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 6084 | #if defined(BUILTIN_ALG_ANY_HKDF) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6085 | static psa_status_t psa_hkdf_input(psa_hkdf_key_derivation_t *hkdf, |
| 6086 | psa_algorithm_t kdf_alg, |
| 6087 | psa_key_derivation_step_t step, |
| 6088 | const uint8_t *data, |
| 6089 | size_t data_length) |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6090 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6091 | psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg); |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6092 | psa_status_t status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6093 | switch (step) { |
Gilles Peskine | 03410b5 | 2019-05-16 16:05:19 +0200 | [diff] [blame] | 6094 | case PSA_KEY_DERIVATION_INPUT_SALT: |
Przemek Stekiel | 3e8249c | 2022-06-03 14:05:07 +0200 | [diff] [blame] | 6095 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6096 | if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) { |
| 6097 | return PSA_ERROR_INVALID_ARGUMENT; |
| 6098 | } |
Przemek Stekiel | 3e8249c | 2022-06-03 14:05:07 +0200 | [diff] [blame] | 6099 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6100 | if (hkdf->state != HKDF_STATE_INIT) { |
| 6101 | return PSA_ERROR_BAD_STATE; |
| 6102 | } else { |
| 6103 | status = psa_key_derivation_start_hmac(&hkdf->hmac, |
| 6104 | hash_alg, |
| 6105 | data, data_length); |
| 6106 | if (status != PSA_SUCCESS) { |
| 6107 | return status; |
| 6108 | } |
Steven Cooreman | d1ed1d9 | 2021-04-29 19:11:25 +0200 | [diff] [blame] | 6109 | hkdf->state = HKDF_STATE_STARTED; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6110 | return PSA_SUCCESS; |
Steven Cooreman | d1ed1d9 | 2021-04-29 19:11:25 +0200 | [diff] [blame] | 6111 | } |
Gilles Peskine | 03410b5 | 2019-05-16 16:05:19 +0200 | [diff] [blame] | 6112 | case PSA_KEY_DERIVATION_INPUT_SECRET: |
Przemek Stekiel | 3e8249c | 2022-06-03 14:05:07 +0200 | [diff] [blame] | 6113 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6114 | if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) { |
Przemek Stekiel | 2fb0dcd | 2022-05-19 10:34:37 +0200 | [diff] [blame] | 6115 | /* We shouldn't be in different state as HKDF_EXPAND only allows |
| 6116 | * two inputs: SECRET (this case) and INFO which does not modify |
| 6117 | * the state. It could happen only if the hkdf |
| 6118 | * object was corrupted. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6119 | if (hkdf->state != HKDF_STATE_INIT) { |
| 6120 | return PSA_ERROR_BAD_STATE; |
| 6121 | } |
Przemek Stekiel | 17520fe | 2022-05-10 13:53:33 +0200 | [diff] [blame] | 6122 | |
Przemek Stekiel | 2fb0dcd | 2022-05-19 10:34:37 +0200 | [diff] [blame] | 6123 | /* Allow only input that fits expected prk size */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6124 | if (data_length != PSA_HASH_LENGTH(hash_alg)) { |
| 6125 | return PSA_ERROR_INVALID_ARGUMENT; |
| 6126 | } |
Przemek Stekiel | 17520fe | 2022-05-10 13:53:33 +0200 | [diff] [blame] | 6127 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6128 | memcpy(hkdf->prk, data, data_length); |
| 6129 | } else |
Przemek Stekiel | 3e8249c | 2022-06-03 14:05:07 +0200 | [diff] [blame] | 6130 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */ |
Przemek Stekiel | 17520fe | 2022-05-10 13:53:33 +0200 | [diff] [blame] | 6131 | { |
Przemek Stekiel | 0586f4c | 2022-06-03 16:00:25 +0200 | [diff] [blame] | 6132 | /* HKDF: If no salt was provided, use an empty salt. |
| 6133 | * HKDF-EXTRACT: salt is mandatory. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6134 | if (hkdf->state == HKDF_STATE_INIT) { |
Przemek Stekiel | 0586f4c | 2022-06-03 16:00:25 +0200 | [diff] [blame] | 6135 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6136 | if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) { |
| 6137 | return PSA_ERROR_BAD_STATE; |
| 6138 | } |
Przemek Stekiel | 0586f4c | 2022-06-03 16:00:25 +0200 | [diff] [blame] | 6139 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6140 | status = psa_key_derivation_start_hmac(&hkdf->hmac, |
| 6141 | hash_alg, |
| 6142 | NULL, 0); |
| 6143 | if (status != PSA_SUCCESS) { |
| 6144 | return status; |
| 6145 | } |
Przemek Stekiel | 17520fe | 2022-05-10 13:53:33 +0200 | [diff] [blame] | 6146 | hkdf->state = HKDF_STATE_STARTED; |
| 6147 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6148 | if (hkdf->state != HKDF_STATE_STARTED) { |
| 6149 | return PSA_ERROR_BAD_STATE; |
| 6150 | } |
| 6151 | status = psa_mac_update(&hkdf->hmac, |
| 6152 | data, data_length); |
| 6153 | if (status != PSA_SUCCESS) { |
| 6154 | return status; |
| 6155 | } |
| 6156 | status = psa_mac_sign_finish(&hkdf->hmac, |
| 6157 | hkdf->prk, |
| 6158 | sizeof(hkdf->prk), |
| 6159 | &data_length); |
| 6160 | if (status != PSA_SUCCESS) { |
| 6161 | return status; |
| 6162 | } |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6163 | } |
Przemek Stekiel | 17520fe | 2022-05-10 13:53:33 +0200 | [diff] [blame] | 6164 | |
Gilles Peskine | 2b522db | 2019-04-12 15:11:49 +0200 | [diff] [blame] | 6165 | hkdf->state = HKDF_STATE_KEYED; |
Przemek Stekiel | 03d948c | 2022-05-19 11:45:20 +0200 | [diff] [blame] | 6166 | hkdf->block_number = 0; |
Przemek Stekiel | 3e8249c | 2022-06-03 14:05:07 +0200 | [diff] [blame] | 6167 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6168 | if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) { |
Przemek Stekiel | 03d948c | 2022-05-19 11:45:20 +0200 | [diff] [blame] | 6169 | /* The only block of output is the PRK. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6170 | memcpy(hkdf->output_block, hkdf->prk, PSA_HASH_LENGTH(hash_alg)); |
Przemek Stekiel | 03d948c | 2022-05-19 11:45:20 +0200 | [diff] [blame] | 6171 | hkdf->offset_in_block = 0; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6172 | } else |
Przemek Stekiel | 3e8249c | 2022-06-03 14:05:07 +0200 | [diff] [blame] | 6173 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */ |
Przemek Stekiel | 03d948c | 2022-05-19 11:45:20 +0200 | [diff] [blame] | 6174 | { |
| 6175 | /* Block 0 is empty, and the next block will be |
| 6176 | * generated by psa_key_derivation_hkdf_read(). */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6177 | hkdf->offset_in_block = PSA_HASH_LENGTH(hash_alg); |
Przemek Stekiel | 03d948c | 2022-05-19 11:45:20 +0200 | [diff] [blame] | 6178 | } |
| 6179 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6180 | return PSA_SUCCESS; |
Gilles Peskine | 03410b5 | 2019-05-16 16:05:19 +0200 | [diff] [blame] | 6181 | case PSA_KEY_DERIVATION_INPUT_INFO: |
Przemek Stekiel | 3e8249c | 2022-06-03 14:05:07 +0200 | [diff] [blame] | 6182 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6183 | if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) { |
| 6184 | return PSA_ERROR_INVALID_ARGUMENT; |
| 6185 | } |
Przemek Stekiel | 3e8249c | 2022-06-03 14:05:07 +0200 | [diff] [blame] | 6186 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */ |
Przemek Stekiel | cde3f78 | 2022-06-03 16:12:27 +0200 | [diff] [blame] | 6187 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6188 | if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg) && |
| 6189 | hkdf->state == HKDF_STATE_INIT) { |
| 6190 | return PSA_ERROR_BAD_STATE; |
| 6191 | } |
Przemek Stekiel | cde3f78 | 2022-06-03 16:12:27 +0200 | [diff] [blame] | 6192 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6193 | if (hkdf->state == HKDF_STATE_OUTPUT) { |
| 6194 | return PSA_ERROR_BAD_STATE; |
| 6195 | } |
| 6196 | if (hkdf->info_set) { |
| 6197 | return PSA_ERROR_BAD_STATE; |
| 6198 | } |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6199 | hkdf->info_length = data_length; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6200 | if (data_length != 0) { |
| 6201 | hkdf->info = mbedtls_calloc(1, data_length); |
| 6202 | if (hkdf->info == NULL) { |
| 6203 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
| 6204 | } |
| 6205 | memcpy(hkdf->info, data, data_length); |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6206 | } |
| 6207 | hkdf->info_set = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6208 | return PSA_SUCCESS; |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6209 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6210 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6211 | } |
| 6212 | } |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 6213 | #endif /* BUILTIN_ALG_ANY_HKDF */ |
Janos Follath | b03233e | 2019-06-11 15:30:30 +0100 | [diff] [blame] | 6214 | |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6215 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ |
| 6216 | defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6217 | static psa_status_t psa_tls12_prf_set_seed(psa_tls12_prf_key_derivation_t *prf, |
| 6218 | const uint8_t *data, |
| 6219 | size_t data_length) |
Janos Follath | f08e265 | 2019-06-13 09:05:41 +0100 | [diff] [blame] | 6220 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6221 | if (prf->state != PSA_TLS12_PRF_STATE_INIT) { |
| 6222 | return PSA_ERROR_BAD_STATE; |
| 6223 | } |
Janos Follath | f08e265 | 2019-06-13 09:05:41 +0100 | [diff] [blame] | 6224 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6225 | if (data_length != 0) { |
| 6226 | prf->seed = mbedtls_calloc(1, data_length); |
| 6227 | if (prf->seed == NULL) { |
| 6228 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
| 6229 | } |
Janos Follath | f08e265 | 2019-06-13 09:05:41 +0100 | [diff] [blame] | 6230 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6231 | memcpy(prf->seed, data, data_length); |
Janos Follath | d6dce9f | 2019-07-04 09:11:38 +0100 | [diff] [blame] | 6232 | prf->seed_length = data_length; |
| 6233 | } |
Janos Follath | f08e265 | 2019-06-13 09:05:41 +0100 | [diff] [blame] | 6234 | |
Gilles Peskine | 43f958b | 2020-12-13 14:55:14 +0100 | [diff] [blame] | 6235 | prf->state = PSA_TLS12_PRF_STATE_SEED_SET; |
Janos Follath | f08e265 | 2019-06-13 09:05:41 +0100 | [diff] [blame] | 6236 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6237 | return PSA_SUCCESS; |
Janos Follath | f08e265 | 2019-06-13 09:05:41 +0100 | [diff] [blame] | 6238 | } |
| 6239 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6240 | static psa_status_t psa_tls12_prf_set_key(psa_tls12_prf_key_derivation_t *prf, |
| 6241 | const uint8_t *data, |
| 6242 | size_t data_length) |
Janos Follath | 8155054 | 2019-06-13 14:26:34 +0100 | [diff] [blame] | 6243 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6244 | if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET && |
| 6245 | prf->state != PSA_TLS12_PRF_STATE_OTHER_KEY_SET) { |
| 6246 | return PSA_ERROR_BAD_STATE; |
| 6247 | } |
Janos Follath | 8155054 | 2019-06-13 14:26:34 +0100 | [diff] [blame] | 6248 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6249 | if (data_length != 0) { |
| 6250 | prf->secret = mbedtls_calloc(1, data_length); |
| 6251 | if (prf->secret == NULL) { |
| 6252 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
| 6253 | } |
Steven Cooreman | a6df604 | 2021-04-29 19:32:25 +0200 | [diff] [blame] | 6254 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6255 | memcpy(prf->secret, data, data_length); |
Steven Cooreman | a6df604 | 2021-04-29 19:32:25 +0200 | [diff] [blame] | 6256 | prf->secret_length = data_length; |
| 6257 | } |
Janos Follath | 8155054 | 2019-06-13 14:26:34 +0100 | [diff] [blame] | 6258 | |
Gilles Peskine | 43f958b | 2020-12-13 14:55:14 +0100 | [diff] [blame] | 6259 | prf->state = PSA_TLS12_PRF_STATE_KEY_SET; |
Janos Follath | 8155054 | 2019-06-13 14:26:34 +0100 | [diff] [blame] | 6260 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6261 | return PSA_SUCCESS; |
Janos Follath | 8155054 | 2019-06-13 14:26:34 +0100 | [diff] [blame] | 6262 | } |
| 6263 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6264 | static psa_status_t psa_tls12_prf_set_label(psa_tls12_prf_key_derivation_t *prf, |
| 6265 | const uint8_t *data, |
| 6266 | size_t data_length) |
Janos Follath | 63028dd | 2019-06-13 09:15:47 +0100 | [diff] [blame] | 6267 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6268 | if (prf->state != PSA_TLS12_PRF_STATE_KEY_SET) { |
| 6269 | return PSA_ERROR_BAD_STATE; |
| 6270 | } |
Janos Follath | 63028dd | 2019-06-13 09:15:47 +0100 | [diff] [blame] | 6271 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6272 | if (data_length != 0) { |
| 6273 | prf->label = mbedtls_calloc(1, data_length); |
| 6274 | if (prf->label == NULL) { |
| 6275 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
| 6276 | } |
Janos Follath | 63028dd | 2019-06-13 09:15:47 +0100 | [diff] [blame] | 6277 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6278 | memcpy(prf->label, data, data_length); |
Janos Follath | d6dce9f | 2019-07-04 09:11:38 +0100 | [diff] [blame] | 6279 | prf->label_length = data_length; |
| 6280 | } |
Janos Follath | 63028dd | 2019-06-13 09:15:47 +0100 | [diff] [blame] | 6281 | |
Gilles Peskine | 43f958b | 2020-12-13 14:55:14 +0100 | [diff] [blame] | 6282 | prf->state = PSA_TLS12_PRF_STATE_LABEL_SET; |
Janos Follath | 63028dd | 2019-06-13 09:15:47 +0100 | [diff] [blame] | 6283 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6284 | return PSA_SUCCESS; |
Janos Follath | 63028dd | 2019-06-13 09:15:47 +0100 | [diff] [blame] | 6285 | } |
| 6286 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6287 | static psa_status_t psa_tls12_prf_input(psa_tls12_prf_key_derivation_t *prf, |
| 6288 | psa_key_derivation_step_t step, |
| 6289 | const uint8_t *data, |
| 6290 | size_t data_length) |
Janos Follath | b03233e | 2019-06-11 15:30:30 +0100 | [diff] [blame] | 6291 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6292 | switch (step) { |
Janos Follath | f08e265 | 2019-06-13 09:05:41 +0100 | [diff] [blame] | 6293 | case PSA_KEY_DERIVATION_INPUT_SEED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6294 | return psa_tls12_prf_set_seed(prf, data, data_length); |
Janos Follath | 8155054 | 2019-06-13 14:26:34 +0100 | [diff] [blame] | 6295 | case PSA_KEY_DERIVATION_INPUT_SECRET: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6296 | return psa_tls12_prf_set_key(prf, data, data_length); |
Janos Follath | 63028dd | 2019-06-13 09:15:47 +0100 | [diff] [blame] | 6297 | case PSA_KEY_DERIVATION_INPUT_LABEL: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6298 | return psa_tls12_prf_set_label(prf, data, data_length); |
Janos Follath | b03233e | 2019-06-11 15:30:30 +0100 | [diff] [blame] | 6299 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6300 | return PSA_ERROR_INVALID_ARGUMENT; |
Janos Follath | b03233e | 2019-06-11 15:30:30 +0100 | [diff] [blame] | 6301 | } |
| 6302 | } |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6303 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || |
| 6304 | * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ |
| 6305 | |
| 6306 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) |
| 6307 | static psa_status_t psa_tls12_prf_psk_to_ms_set_key( |
| 6308 | psa_tls12_prf_key_derivation_t *prf, |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6309 | const uint8_t *data, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6310 | size_t data_length) |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6311 | { |
| 6312 | psa_status_t status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6313 | const size_t pms_len = (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET ? |
| 6314 | 4 + data_length + prf->other_secret_length : |
| 6315 | 4 + 2 * data_length); |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6316 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6317 | if (data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE) { |
| 6318 | return PSA_ERROR_INVALID_ARGUMENT; |
| 6319 | } |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6320 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6321 | uint8_t *pms = mbedtls_calloc(1, pms_len); |
| 6322 | if (pms == NULL) { |
| 6323 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
| 6324 | } |
Przemek Stekiel | c8fa5a1 | 2022-04-07 14:17:13 +0200 | [diff] [blame] | 6325 | uint8_t *cur = pms; |
| 6326 | |
| 6327 | /* pure-PSK: |
| 6328 | * Quoting RFC 4279, Section 2: |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6329 | * |
| 6330 | * The premaster secret is formed as follows: if the PSK is N octets |
| 6331 | * long, concatenate a uint16 with the value N, N zero octets, a second |
| 6332 | * uint16 with the value N, and the PSK itself. |
Przemek Stekiel | c8fa5a1 | 2022-04-07 14:17:13 +0200 | [diff] [blame] | 6333 | * |
| 6334 | * mixed-PSK: |
| 6335 | * In a DHE-PSK, RSA-PSK, ECDHE-PSK the premaster secret is formed as |
| 6336 | * follows: concatenate a uint16 with the length of the other secret, |
| 6337 | * the other secret itself, uint16 with the length of PSK, and the |
| 6338 | * PSK itself. |
| 6339 | * For details please check: |
| 6340 | * - RFC 4279, Section 4 for the definition of RSA-PSK, |
| 6341 | * - RFC 4279, Section 3 for the definition of DHE-PSK, |
| 6342 | * - RFC 5489 for the definition of ECDHE-PSK. |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6343 | */ |
| 6344 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6345 | if (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET) { |
| 6346 | *cur++ = MBEDTLS_BYTE_1(prf->other_secret_length); |
| 6347 | *cur++ = MBEDTLS_BYTE_0(prf->other_secret_length); |
| 6348 | if (prf->other_secret_length != 0) { |
| 6349 | memcpy(cur, prf->other_secret, prf->other_secret_length); |
| 6350 | mbedtls_platform_zeroize(prf->other_secret, prf->other_secret_length); |
Przemek Stekiel | 2503f7e | 2022-04-12 12:08:01 +0200 | [diff] [blame] | 6351 | cur += prf->other_secret_length; |
| 6352 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6353 | } else { |
| 6354 | *cur++ = MBEDTLS_BYTE_1(data_length); |
| 6355 | *cur++ = MBEDTLS_BYTE_0(data_length); |
| 6356 | memset(cur, 0, data_length); |
Przemek Stekiel | c8fa5a1 | 2022-04-07 14:17:13 +0200 | [diff] [blame] | 6357 | cur += data_length; |
| 6358 | } |
| 6359 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6360 | *cur++ = MBEDTLS_BYTE_1(data_length); |
| 6361 | *cur++ = MBEDTLS_BYTE_0(data_length); |
| 6362 | memcpy(cur, data, data_length); |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6363 | cur += data_length; |
| 6364 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6365 | status = psa_tls12_prf_set_key(prf, pms, cur - pms); |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6366 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6367 | mbedtls_platform_zeroize(pms, pms_len); |
| 6368 | mbedtls_free(pms); |
| 6369 | return status; |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6370 | } |
Janos Follath | 6660f0e | 2019-06-17 08:44:03 +0100 | [diff] [blame] | 6371 | |
Przemek Stekiel | e47201b | 2022-04-19 13:53:28 +0200 | [diff] [blame] | 6372 | static psa_status_t psa_tls12_prf_psk_to_ms_set_other_key( |
| 6373 | psa_tls12_prf_key_derivation_t *prf, |
| 6374 | const uint8_t *data, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6375 | size_t data_length) |
Przemek Stekiel | e47201b | 2022-04-19 13:53:28 +0200 | [diff] [blame] | 6376 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6377 | if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET) { |
| 6378 | return PSA_ERROR_BAD_STATE; |
Przemek Stekiel | e47201b | 2022-04-19 13:53:28 +0200 | [diff] [blame] | 6379 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6380 | |
| 6381 | if (data_length != 0) { |
| 6382 | prf->other_secret = mbedtls_calloc(1, data_length); |
| 6383 | if (prf->other_secret == NULL) { |
| 6384 | return PSA_ERROR_INSUFFICIENT_MEMORY; |
| 6385 | } |
| 6386 | |
| 6387 | memcpy(prf->other_secret, data, data_length); |
| 6388 | prf->other_secret_length = data_length; |
| 6389 | } else { |
Przemek Stekiel | e47201b | 2022-04-19 13:53:28 +0200 | [diff] [blame] | 6390 | prf->other_secret_length = 0; |
| 6391 | } |
| 6392 | |
| 6393 | prf->state = PSA_TLS12_PRF_STATE_OTHER_KEY_SET; |
| 6394 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6395 | return PSA_SUCCESS; |
Przemek Stekiel | e47201b | 2022-04-19 13:53:28 +0200 | [diff] [blame] | 6396 | } |
| 6397 | |
Janos Follath | 6660f0e | 2019-06-17 08:44:03 +0100 | [diff] [blame] | 6398 | static psa_status_t psa_tls12_prf_psk_to_ms_input( |
| 6399 | psa_tls12_prf_key_derivation_t *prf, |
Janos Follath | 6660f0e | 2019-06-17 08:44:03 +0100 | [diff] [blame] | 6400 | psa_key_derivation_step_t step, |
| 6401 | const uint8_t *data, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6402 | size_t data_length) |
Janos Follath | 6660f0e | 2019-06-17 08:44:03 +0100 | [diff] [blame] | 6403 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6404 | switch (step) { |
Przemek Stekiel | e47201b | 2022-04-19 13:53:28 +0200 | [diff] [blame] | 6405 | case PSA_KEY_DERIVATION_INPUT_SECRET: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6406 | return psa_tls12_prf_psk_to_ms_set_key(prf, |
| 6407 | data, data_length); |
Przemek Stekiel | e47201b | 2022-04-19 13:53:28 +0200 | [diff] [blame] | 6408 | break; |
| 6409 | case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6410 | return psa_tls12_prf_psk_to_ms_set_other_key(prf, |
| 6411 | data, |
| 6412 | data_length); |
Przemek Stekiel | e47201b | 2022-04-19 13:53:28 +0200 | [diff] [blame] | 6413 | break; |
| 6414 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6415 | return psa_tls12_prf_input(prf, step, data, data_length); |
Przemek Stekiel | e47201b | 2022-04-19 13:53:28 +0200 | [diff] [blame] | 6416 | break; |
Janos Follath | 6660f0e | 2019-06-17 08:44:03 +0100 | [diff] [blame] | 6417 | |
Przemek Stekiel | e47201b | 2022-04-19 13:53:28 +0200 | [diff] [blame] | 6418 | } |
Janos Follath | 6660f0e | 2019-06-17 08:44:03 +0100 | [diff] [blame] | 6419 | } |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6420 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6421 | |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 6422 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) |
| 6423 | static psa_status_t psa_tls12_ecjpake_to_pms_input( |
| 6424 | psa_tls12_ecjpake_to_pms_t *ecjpake, |
Andrzej Kurek | 702776f | 2022-09-16 06:22:44 -0400 | [diff] [blame] | 6425 | psa_key_derivation_step_t step, |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 6426 | const uint8_t *data, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6427 | size_t data_length) |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 6428 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6429 | if (data_length != PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE || |
| 6430 | step != PSA_KEY_DERIVATION_INPUT_SECRET) { |
| 6431 | return PSA_ERROR_INVALID_ARGUMENT; |
Andrzej Kurek | 5603efd | 2022-09-26 10:49:16 -0400 | [diff] [blame] | 6432 | } |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 6433 | |
| 6434 | /* Check if the passed point is in an uncompressed form */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6435 | if (data[0] != 0x04) { |
| 6436 | return PSA_ERROR_INVALID_ARGUMENT; |
| 6437 | } |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 6438 | |
| 6439 | /* Only K.X has to be extracted - bytes 1 to 32 inclusive. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6440 | memcpy(ecjpake->data, data + 1, PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE); |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 6441 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6442 | return PSA_SUCCESS; |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 6443 | } |
| 6444 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */ |
Gilles Peskine | b896519 | 2019-09-24 16:21:10 +0200 | [diff] [blame] | 6445 | /** Check whether the given key type is acceptable for the given |
| 6446 | * input step of a key derivation. |
| 6447 | * |
| 6448 | * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE. |
| 6449 | * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA. |
| 6450 | * Both secret and non-secret inputs can alternatively have the type |
| 6451 | * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning |
| 6452 | * that the input was passed as a buffer rather than via a key object. |
| 6453 | */ |
Gilles Peskine | 224b0d6 | 2019-09-23 18:13:17 +0200 | [diff] [blame] | 6454 | static int psa_key_derivation_check_input_type( |
| 6455 | psa_key_derivation_step_t step, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6456 | psa_key_type_t key_type) |
Gilles Peskine | 224b0d6 | 2019-09-23 18:13:17 +0200 | [diff] [blame] | 6457 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6458 | switch (step) { |
Gilles Peskine | 224b0d6 | 2019-09-23 18:13:17 +0200 | [diff] [blame] | 6459 | case PSA_KEY_DERIVATION_INPUT_SECRET: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6460 | if (key_type == PSA_KEY_TYPE_DERIVE) { |
| 6461 | return PSA_SUCCESS; |
| 6462 | } |
| 6463 | if (key_type == PSA_KEY_TYPE_NONE) { |
| 6464 | return PSA_SUCCESS; |
| 6465 | } |
Gilles Peskine | 224b0d6 | 2019-09-23 18:13:17 +0200 | [diff] [blame] | 6466 | break; |
Przemek Stekiel | a7695a2 | 2022-04-07 15:39:01 +0200 | [diff] [blame] | 6467 | case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6468 | if (key_type == PSA_KEY_TYPE_DERIVE) { |
| 6469 | return PSA_SUCCESS; |
| 6470 | } |
| 6471 | if (key_type == PSA_KEY_TYPE_NONE) { |
| 6472 | return PSA_SUCCESS; |
| 6473 | } |
Przemek Stekiel | a7695a2 | 2022-04-07 15:39:01 +0200 | [diff] [blame] | 6474 | break; |
Gilles Peskine | 224b0d6 | 2019-09-23 18:13:17 +0200 | [diff] [blame] | 6475 | case PSA_KEY_DERIVATION_INPUT_LABEL: |
| 6476 | case PSA_KEY_DERIVATION_INPUT_SALT: |
| 6477 | case PSA_KEY_DERIVATION_INPUT_INFO: |
| 6478 | case PSA_KEY_DERIVATION_INPUT_SEED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6479 | if (key_type == PSA_KEY_TYPE_RAW_DATA) { |
| 6480 | return PSA_SUCCESS; |
| 6481 | } |
| 6482 | if (key_type == PSA_KEY_TYPE_NONE) { |
| 6483 | return PSA_SUCCESS; |
| 6484 | } |
Gilles Peskine | 224b0d6 | 2019-09-23 18:13:17 +0200 | [diff] [blame] | 6485 | break; |
| 6486 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6487 | return PSA_ERROR_INVALID_ARGUMENT; |
Gilles Peskine | 224b0d6 | 2019-09-23 18:13:17 +0200 | [diff] [blame] | 6488 | } |
| 6489 | |
Janos Follath | b80a94e | 2019-06-12 15:54:46 +0100 | [diff] [blame] | 6490 | static psa_status_t psa_key_derivation_input_internal( |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 6491 | psa_key_derivation_operation_t *operation, |
Gilles Peskine | 6cdfdb7 | 2019-01-08 10:31:27 +0100 | [diff] [blame] | 6492 | psa_key_derivation_step_t step, |
Gilles Peskine | 224b0d6 | 2019-09-23 18:13:17 +0200 | [diff] [blame] | 6493 | psa_key_type_t key_type, |
Gilles Peskine | 6cdfdb7 | 2019-01-08 10:31:27 +0100 | [diff] [blame] | 6494 | const uint8_t *data, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6495 | size_t data_length) |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6496 | { |
Gilles Peskine | 46d7faf | 2019-09-23 19:22:55 +0200 | [diff] [blame] | 6497 | psa_status_t status; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6498 | psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation); |
Gilles Peskine | 46d7faf | 2019-09-23 19:22:55 +0200 | [diff] [blame] | 6499 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6500 | status = psa_key_derivation_check_input_type(step, key_type); |
| 6501 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 224b0d6 | 2019-09-23 18:13:17 +0200 | [diff] [blame] | 6502 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6503 | } |
Gilles Peskine | 224b0d6 | 2019-09-23 18:13:17 +0200 | [diff] [blame] | 6504 | |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 6505 | #if defined(BUILTIN_ALG_ANY_HKDF) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6506 | if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) { |
| 6507 | status = psa_hkdf_input(&operation->ctx.hkdf, kdf_alg, |
| 6508 | step, data, data_length); |
| 6509 | } else |
Przemek Stekiel | 69c4679 | 2022-06-10 12:59:51 +0200 | [diff] [blame] | 6510 | #endif /* BUILTIN_ALG_ANY_HKDF */ |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6511 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6512 | if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) { |
| 6513 | status = psa_tls12_prf_input(&operation->ctx.tls12_prf, |
| 6514 | step, data, data_length); |
| 6515 | } else |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6516 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */ |
| 6517 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6518 | if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) { |
| 6519 | status = psa_tls12_prf_psk_to_ms_input(&operation->ctx.tls12_prf, |
| 6520 | step, data, data_length); |
| 6521 | } else |
John Durkop | 07cc04a | 2020-11-16 22:08:34 -0800 | [diff] [blame] | 6522 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 6523 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6524 | if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) { |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 6525 | status = psa_tls12_ecjpake_to_pms_input( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6526 | &operation->ctx.tls12_ecjpake_to_pms, step, data, data_length); |
| 6527 | } else |
Andrzej Kurek | 08d34b8 | 2022-07-29 10:00:16 -0400 | [diff] [blame] | 6528 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */ |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6529 | { |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 6530 | /* This can't happen unless the operation object was not initialized */ |
Steven Cooreman | 74afe47 | 2021-02-10 17:19:22 +0100 | [diff] [blame] | 6531 | (void) data; |
| 6532 | (void) data_length; |
| 6533 | (void) kdf_alg; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6534 | return PSA_ERROR_BAD_STATE; |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6535 | } |
| 6536 | |
Gilles Peskine | 224b0d6 | 2019-09-23 18:13:17 +0200 | [diff] [blame] | 6537 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6538 | if (status != PSA_SUCCESS) { |
| 6539 | psa_key_derivation_abort(operation); |
| 6540 | } |
| 6541 | return status; |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6542 | } |
| 6543 | |
Kusumit Ghoderao | 50e0e11 | 2023-04-06 17:47:25 +0530 | [diff] [blame] | 6544 | static psa_status_t psa_key_derivation_input_integer_internal( |
| 6545 | psa_key_derivation_operation_t *operation, |
| 6546 | psa_key_derivation_step_t step, |
| 6547 | uint64_t value) |
| 6548 | { |
| 6549 | psa_status_t status; |
| 6550 | psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation); |
| 6551 | |
Kusumit Ghoderao | 50e0e11 | 2023-04-06 17:47:25 +0530 | [diff] [blame] | 6552 | { |
Kusumit Ghoderao | 3a18dee | 2023-04-07 16:16:27 +0530 | [diff] [blame] | 6553 | (void) step; |
Kusumit Ghoderao | 50e0e11 | 2023-04-06 17:47:25 +0530 | [diff] [blame] | 6554 | (void) value; |
| 6555 | (void) kdf_alg; |
Kusumit Ghoderao | a14ae5a | 2023-04-19 14:16:26 +0530 | [diff] [blame] | 6556 | status = PSA_ERROR_INVALID_ARGUMENT; |
Kusumit Ghoderao | 50e0e11 | 2023-04-06 17:47:25 +0530 | [diff] [blame] | 6557 | } |
| 6558 | |
| 6559 | if (status != PSA_SUCCESS) { |
| 6560 | psa_key_derivation_abort(operation); |
| 6561 | } |
| 6562 | return status; |
| 6563 | } |
| 6564 | |
Janos Follath | 51f4a0f | 2019-06-14 11:35:55 +0100 | [diff] [blame] | 6565 | psa_status_t psa_key_derivation_input_bytes( |
| 6566 | psa_key_derivation_operation_t *operation, |
| 6567 | psa_key_derivation_step_t step, |
| 6568 | const uint8_t *data, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6569 | size_t data_length) |
Gilles Peskine | 6cdfdb7 | 2019-01-08 10:31:27 +0100 | [diff] [blame] | 6570 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6571 | return psa_key_derivation_input_internal(operation, step, |
| 6572 | PSA_KEY_TYPE_NONE, |
| 6573 | data, data_length); |
Gilles Peskine | 6cdfdb7 | 2019-01-08 10:31:27 +0100 | [diff] [blame] | 6574 | } |
| 6575 | |
Kusumit Ghoderao | 50e0e11 | 2023-04-06 17:47:25 +0530 | [diff] [blame] | 6576 | psa_status_t psa_key_derivation_input_integer( |
| 6577 | psa_key_derivation_operation_t *operation, |
| 6578 | psa_key_derivation_step_t step, |
| 6579 | uint64_t value) |
| 6580 | { |
| 6581 | return psa_key_derivation_input_integer_internal(operation, step, value); |
| 6582 | } |
| 6583 | |
Janos Follath | 51f4a0f | 2019-06-14 11:35:55 +0100 | [diff] [blame] | 6584 | psa_status_t psa_key_derivation_input_key( |
| 6585 | psa_key_derivation_operation_t *operation, |
| 6586 | psa_key_derivation_step_t step, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6587 | mbedtls_svc_key_id_t key) |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6588 | { |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 6589 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 6590 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6591 | psa_key_slot_t *slot; |
Gilles Peskine | 178c9aa | 2019-09-24 18:21:06 +0200 | [diff] [blame] | 6592 | |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 6593 | status = psa_get_and_lock_transparent_key_slot_with_policy( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6594 | key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg); |
| 6595 | if (status != PSA_SUCCESS) { |
| 6596 | psa_key_derivation_abort(operation); |
| 6597 | return status; |
Gilles Peskine | 593773d | 2019-09-23 18:17:40 +0200 | [diff] [blame] | 6598 | } |
Gilles Peskine | 178c9aa | 2019-09-24 18:21:06 +0200 | [diff] [blame] | 6599 | |
| 6600 | /* Passing a key object as a SECRET input unlocks the permission |
| 6601 | * to output to a key object. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6602 | if (step == PSA_KEY_DERIVATION_INPUT_SECRET) { |
Gilles Peskine | 178c9aa | 2019-09-24 18:21:06 +0200 | [diff] [blame] | 6603 | operation->can_output_key = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6604 | } |
Gilles Peskine | 178c9aa | 2019-09-24 18:21:06 +0200 | [diff] [blame] | 6605 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6606 | status = psa_key_derivation_input_internal(operation, |
| 6607 | step, slot->attr.type, |
| 6608 | slot->key.data, |
| 6609 | slot->key.bytes); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 6610 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6611 | unlock_status = psa_unlock_key_slot(slot); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 6612 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6613 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Gilles Peskine | b70a0fd | 2019-01-07 22:59:38 +0100 | [diff] [blame] | 6614 | } |
Gilles Peskine | ea0fb49 | 2018-07-12 17:17:20 +0200 | [diff] [blame] | 6615 | |
| 6616 | |
| 6617 | |
| 6618 | /****************************************************************/ |
Gilles Peskine | 01d718c | 2018-09-18 12:01:02 +0200 | [diff] [blame] | 6619 | /* Key agreement */ |
| 6620 | /****************************************************************/ |
| 6621 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6622 | psa_status_t psa_key_agreement_raw_builtin(const psa_key_attributes_t *attributes, |
| 6623 | const uint8_t *key_buffer, |
| 6624 | size_t key_buffer_size, |
| 6625 | psa_algorithm_t alg, |
| 6626 | const uint8_t *peer_key, |
| 6627 | size_t peer_key_length, |
| 6628 | uint8_t *shared_secret, |
| 6629 | size_t shared_secret_size, |
| 6630 | size_t *shared_secret_length) |
Gilles Peskine | b7ecdf0 | 2018-09-18 12:11:27 +0200 | [diff] [blame] | 6631 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6632 | switch (alg) { |
John Durkop | 6ba40d1 | 2020-11-10 08:50:04 -0800 | [diff] [blame] | 6633 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6634 | case PSA_ALG_ECDH: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6635 | return mbedtls_psa_key_agreement_ecdh(attributes, key_buffer, |
| 6636 | key_buffer_size, alg, |
| 6637 | peer_key, peer_key_length, |
| 6638 | shared_secret, |
| 6639 | shared_secret_size, |
| 6640 | shared_secret_length); |
Gilles Peskine | 01d718c | 2018-09-18 12:01:02 +0200 | [diff] [blame] | 6641 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */ |
Przemek Stekiel | fb3dd54 | 2022-12-01 14:59:15 +0100 | [diff] [blame] | 6642 | |
| 6643 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH) |
| 6644 | case PSA_ALG_FFDH: |
Przemek Stekiel | 359f462 | 2022-12-05 14:11:55 +0100 | [diff] [blame] | 6645 | return mbedtls_psa_key_agreement_ffdh(attributes, |
| 6646 | peer_key, |
| 6647 | peer_key_length, |
| 6648 | key_buffer, |
| 6649 | key_buffer_size, |
| 6650 | shared_secret, |
| 6651 | shared_secret_size, |
| 6652 | shared_secret_length); |
Przemek Stekiel | fb3dd54 | 2022-12-01 14:59:15 +0100 | [diff] [blame] | 6653 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_FFDH */ |
| 6654 | |
Gilles Peskine | 01d718c | 2018-09-18 12:01:02 +0200 | [diff] [blame] | 6655 | default: |
Aditya Deshpande | 17845b8 | 2022-10-13 17:21:01 +0100 | [diff] [blame] | 6656 | (void) attributes; |
| 6657 | (void) key_buffer; |
| 6658 | (void) key_buffer_size; |
Gilles Peskine | 93f8500 | 2018-11-16 16:43:31 +0100 | [diff] [blame] | 6659 | (void) peer_key; |
| 6660 | (void) peer_key_length; |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6661 | (void) shared_secret; |
| 6662 | (void) shared_secret_size; |
| 6663 | (void) shared_secret_length; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6664 | return PSA_ERROR_NOT_SUPPORTED; |
Gilles Peskine | 01d718c | 2018-09-18 12:01:02 +0200 | [diff] [blame] | 6665 | } |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6666 | } |
Gilles Peskine | 01d718c | 2018-09-18 12:01:02 +0200 | [diff] [blame] | 6667 | |
Aditya Deshpande | 17845b8 | 2022-10-13 17:21:01 +0100 | [diff] [blame] | 6668 | /** Internal function for raw key agreement |
| 6669 | * Calls the driver wrapper which will hand off key agreement task |
Aditya Deshpande | 40c05cc | 2022-10-14 16:41:40 +0100 | [diff] [blame] | 6670 | * to the driver's implementation if a driver is present. |
| 6671 | * Fallback specified in the driver wrapper is built-in raw key agreement |
Aditya Deshpande | 17845b8 | 2022-10-13 17:21:01 +0100 | [diff] [blame] | 6672 | * (psa_key_agreement_raw_builtin). |
| 6673 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6674 | static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg, |
| 6675 | psa_key_slot_t *private_key, |
| 6676 | const uint8_t *peer_key, |
| 6677 | size_t peer_key_length, |
| 6678 | uint8_t *shared_secret, |
| 6679 | size_t shared_secret_size, |
| 6680 | size_t *shared_secret_length) |
Gilles Peskine | 51ae0e4 | 2019-05-16 17:31:03 +0200 | [diff] [blame] | 6681 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6682 | if (!PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) { |
| 6683 | return PSA_ERROR_NOT_SUPPORTED; |
| 6684 | } |
Aditya Deshpande | 17845b8 | 2022-10-13 17:21:01 +0100 | [diff] [blame] | 6685 | |
| 6686 | psa_key_attributes_t attributes = { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6687 | .core = private_key->attr |
Aditya Deshpande | 17845b8 | 2022-10-13 17:21:01 +0100 | [diff] [blame] | 6688 | }; |
| 6689 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6690 | return psa_driver_wrapper_key_agreement(&attributes, |
| 6691 | private_key->key.data, |
| 6692 | private_key->key.bytes, alg, |
| 6693 | peer_key, peer_key_length, |
| 6694 | shared_secret, |
| 6695 | shared_secret_size, |
| 6696 | shared_secret_length); |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6697 | } |
| 6698 | |
Gilles Peskine | a99d3fb | 2019-05-16 15:28:51 +0200 | [diff] [blame] | 6699 | /* Note that if this function fails, you must call psa_key_derivation_abort() |
Gilles Peskine | 01d718c | 2018-09-18 12:01:02 +0200 | [diff] [blame] | 6700 | * to potentially free embedded data structures and wipe confidential data. |
| 6701 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6702 | static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *operation, |
| 6703 | psa_key_derivation_step_t step, |
| 6704 | psa_key_slot_t *private_key, |
| 6705 | const uint8_t *peer_key, |
| 6706 | size_t peer_key_length) |
Gilles Peskine | 01d718c | 2018-09-18 12:01:02 +0200 | [diff] [blame] | 6707 | { |
| 6708 | psa_status_t status; |
Aditya Deshpande | 2f7fd76 | 2022-11-22 11:10:34 +0000 | [diff] [blame] | 6709 | uint8_t shared_secret[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE]; |
Gilles Peskine | 01d718c | 2018-09-18 12:01:02 +0200 | [diff] [blame] | 6710 | size_t shared_secret_length = 0; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6711 | psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(operation->alg); |
Gilles Peskine | 01d718c | 2018-09-18 12:01:02 +0200 | [diff] [blame] | 6712 | |
| 6713 | /* Step 1: run the secret agreement algorithm to generate the shared |
| 6714 | * secret. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6715 | status = psa_key_agreement_raw_internal(ka_alg, |
| 6716 | private_key, |
| 6717 | peer_key, peer_key_length, |
| 6718 | shared_secret, |
| 6719 | sizeof(shared_secret), |
| 6720 | &shared_secret_length); |
| 6721 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 12313cd | 2018-06-20 00:20:32 +0200 | [diff] [blame] | 6722 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6723 | } |
Gilles Peskine | 12313cd | 2018-06-20 00:20:32 +0200 | [diff] [blame] | 6724 | |
Gilles Peskine | b0b255c | 2018-07-06 17:01:38 +0200 | [diff] [blame] | 6725 | /* Step 2: set up the key derivation to generate key material from |
Gilles Peskine | 224b0d6 | 2019-09-23 18:13:17 +0200 | [diff] [blame] | 6726 | * the shared secret. A shared secret is permitted wherever a key |
| 6727 | * of type DERIVE is permitted. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6728 | status = psa_key_derivation_input_internal(operation, step, |
| 6729 | PSA_KEY_TYPE_DERIVE, |
| 6730 | shared_secret, |
| 6731 | shared_secret_length); |
Gilles Peskine | 12313cd | 2018-06-20 00:20:32 +0200 | [diff] [blame] | 6732 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6733 | mbedtls_platform_zeroize(shared_secret, shared_secret_length); |
| 6734 | return status; |
Gilles Peskine | 12313cd | 2018-06-20 00:20:32 +0200 | [diff] [blame] | 6735 | } |
| 6736 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6737 | psa_status_t psa_key_derivation_key_agreement(psa_key_derivation_operation_t *operation, |
| 6738 | psa_key_derivation_step_t step, |
| 6739 | mbedtls_svc_key_id_t private_key, |
| 6740 | const uint8_t *peer_key, |
| 6741 | size_t peer_key_length) |
Gilles Peskine | 12313cd | 2018-06-20 00:20:32 +0200 | [diff] [blame] | 6742 | { |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 6743 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 6744 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 2f060a8 | 2018-12-04 17:12:32 +0100 | [diff] [blame] | 6745 | psa_key_slot_t *slot; |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 6746 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6747 | if (!PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) { |
| 6748 | return PSA_ERROR_INVALID_ARGUMENT; |
| 6749 | } |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 6750 | status = psa_get_and_lock_transparent_key_slot_with_policy( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6751 | private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg); |
| 6752 | if (status != PSA_SUCCESS) { |
| 6753 | return status; |
| 6754 | } |
| 6755 | status = psa_key_agreement_internal(operation, step, |
| 6756 | slot, |
| 6757 | peer_key, peer_key_length); |
| 6758 | if (status != PSA_SUCCESS) { |
| 6759 | psa_key_derivation_abort(operation); |
| 6760 | } else { |
Steven Cooreman | fa5e631 | 2020-10-15 17:07:12 +0200 | [diff] [blame] | 6761 | /* If a private key has been added as SECRET, we allow the derived |
| 6762 | * key material to be used as a key in PSA Crypto. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6763 | if (step == PSA_KEY_DERIVATION_INPUT_SECRET) { |
Steven Cooreman | fa5e631 | 2020-10-15 17:07:12 +0200 | [diff] [blame] | 6764 | operation->can_output_key = 1; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6765 | } |
Steven Cooreman | fa5e631 | 2020-10-15 17:07:12 +0200 | [diff] [blame] | 6766 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 6767 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6768 | unlock_status = psa_unlock_key_slot(slot); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 6769 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6770 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Gilles Peskine | af3baab | 2018-06-27 22:55:52 +0200 | [diff] [blame] | 6771 | } |
| 6772 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6773 | psa_status_t psa_raw_key_agreement(psa_algorithm_t alg, |
| 6774 | mbedtls_svc_key_id_t private_key, |
| 6775 | const uint8_t *peer_key, |
| 6776 | size_t peer_key_length, |
| 6777 | uint8_t *output, |
| 6778 | size_t output_size, |
| 6779 | size_t *output_length) |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6780 | { |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 6781 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 6782 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 6783 | psa_key_slot_t *slot = NULL; |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6784 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6785 | if (!PSA_ALG_IS_KEY_AGREEMENT(alg)) { |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6786 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 6787 | goto exit; |
| 6788 | } |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 6789 | status = psa_get_and_lock_transparent_key_slot_with_policy( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6790 | private_key, &slot, PSA_KEY_USAGE_DERIVE, alg); |
| 6791 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6792 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6793 | } |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6794 | |
Gilles Peskine | 3e56130 | 2022-04-14 00:17:15 +0200 | [diff] [blame] | 6795 | /* PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is in general an upper bound |
| 6796 | * for the output size. The PSA specification only guarantees that this |
| 6797 | * function works if output_size >= PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(...), |
| 6798 | * but it might be nice to allow smaller buffers if the output fits. |
| 6799 | * At the time of writing this comment, with only ECDH implemented, |
| 6800 | * PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is exact so the point is moot. |
| 6801 | * If FFDH is implemented, PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() can easily |
| 6802 | * be exact for it as well. */ |
| 6803 | size_t expected_length = |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6804 | PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(slot->attr.type, slot->attr.bits); |
| 6805 | if (output_size < expected_length) { |
Gilles Peskine | 3e56130 | 2022-04-14 00:17:15 +0200 | [diff] [blame] | 6806 | status = PSA_ERROR_BUFFER_TOO_SMALL; |
| 6807 | goto exit; |
| 6808 | } |
| 6809 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6810 | status = psa_key_agreement_raw_internal(alg, slot, |
| 6811 | peer_key, peer_key_length, |
| 6812 | output, output_size, |
| 6813 | output_length); |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6814 | |
| 6815 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6816 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6817 | /* If an error happens and is not handled properly, the output |
| 6818 | * may be used as a key to protect sensitive data. Arrange for such |
| 6819 | * a key to be random, which is likely to result in decryption or |
| 6820 | * verification errors. This is better than filling the buffer with |
| 6821 | * some constant data such as zeros, which would result in the data |
| 6822 | * being protected with a reproducible, easily knowable key. |
| 6823 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6824 | psa_generate_random(output, output_size); |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6825 | *output_length = output_size; |
| 6826 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 6827 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6828 | unlock_status = psa_unlock_key_slot(slot); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 6829 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6830 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Gilles Peskine | 0216fe1 | 2019-04-11 21:23:21 +0200 | [diff] [blame] | 6831 | } |
Gilles Peskine | 86a440b | 2018-11-12 18:39:40 +0100 | [diff] [blame] | 6832 | |
| 6833 | |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6834 | |
Gilles Peskine | 86a440b | 2018-11-12 18:39:40 +0100 | [diff] [blame] | 6835 | /****************************************************************/ |
| 6836 | /* Random generation */ |
Gilles Peskine | 53d991e | 2018-07-12 01:14:59 +0200 | [diff] [blame] | 6837 | /****************************************************************/ |
Gilles Peskine | 12313cd | 2018-06-20 00:20:32 +0200 | [diff] [blame] | 6838 | |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6839 | /** Initialize the PSA random generator. |
| 6840 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6841 | static void mbedtls_psa_random_init(mbedtls_psa_random_context_t *rng) |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6842 | { |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6843 | #if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6844 | memset(rng, 0, sizeof(*rng)); |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6845 | #else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ |
| 6846 | |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6847 | /* Set default configuration if |
| 6848 | * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6849 | if (rng->entropy_init == NULL) { |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6850 | rng->entropy_init = mbedtls_entropy_init; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6851 | } |
| 6852 | if (rng->entropy_free == NULL) { |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6853 | rng->entropy_free = mbedtls_entropy_free; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6854 | } |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6855 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6856 | rng->entropy_init(&rng->entropy); |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6857 | #if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ |
| 6858 | defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) |
| 6859 | /* The PSA entropy injection feature depends on using NV seed as an entropy |
| 6860 | * source. Add NV seed as an entropy source for PSA entropy injection. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6861 | mbedtls_entropy_add_source(&rng->entropy, |
| 6862 | mbedtls_nv_seed_poll, NULL, |
| 6863 | MBEDTLS_ENTROPY_BLOCK_SIZE, |
| 6864 | MBEDTLS_ENTROPY_SOURCE_STRONG); |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6865 | #endif |
| 6866 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6867 | mbedtls_psa_drbg_init(MBEDTLS_PSA_RANDOM_STATE); |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6868 | #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6869 | } |
| 6870 | |
| 6871 | /** Deinitialize the PSA random generator. |
| 6872 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6873 | static void mbedtls_psa_random_free(mbedtls_psa_random_context_t *rng) |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6874 | { |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6875 | #if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6876 | memset(rng, 0, sizeof(*rng)); |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6877 | #else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6878 | mbedtls_psa_drbg_free(MBEDTLS_PSA_RANDOM_STATE); |
| 6879 | rng->entropy_free(&rng->entropy); |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6880 | #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6881 | } |
| 6882 | |
| 6883 | /** Seed the PSA random generator. |
| 6884 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6885 | static psa_status_t mbedtls_psa_random_seed(mbedtls_psa_random_context_t *rng) |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6886 | { |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6887 | #if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) |
| 6888 | /* Do nothing: the external RNG seeds itself. */ |
| 6889 | (void) rng; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6890 | return PSA_SUCCESS; |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6891 | #else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6892 | const unsigned char drbg_seed[] = "PSA"; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6893 | int ret = mbedtls_psa_drbg_seed(&rng->entropy, |
| 6894 | drbg_seed, sizeof(drbg_seed) - 1); |
| 6895 | return mbedtls_to_psa_error(ret); |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6896 | #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 6897 | } |
| 6898 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6899 | psa_status_t psa_generate_random(uint8_t *output, |
| 6900 | size_t output_size) |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 6901 | { |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 6902 | GUARD_MODULE_INITIALIZED; |
| 6903 | |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6904 | #if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) |
| 6905 | |
| 6906 | size_t output_length = 0; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6907 | psa_status_t status = mbedtls_psa_external_get_random(&global_data.rng, |
| 6908 | output, output_size, |
| 6909 | &output_length); |
| 6910 | if (status != PSA_SUCCESS) { |
| 6911 | return status; |
| 6912 | } |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6913 | /* Breaking up a request into smaller chunks is currently not supported |
Tom Cosgrove | 1797b05 | 2022-12-04 17:19:59 +0000 | [diff] [blame] | 6914 | * for the external RNG interface. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6915 | if (output_length != output_size) { |
| 6916 | return PSA_ERROR_INSUFFICIENT_ENTROPY; |
| 6917 | } |
| 6918 | return PSA_SUCCESS; |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6919 | |
| 6920 | #else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ |
| 6921 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6922 | while (output_size > 0) { |
Gilles Peskine | 71ddab9 | 2021-01-04 21:01:07 +0100 | [diff] [blame] | 6923 | size_t request_size = |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6924 | (output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ? |
| 6925 | MBEDTLS_PSA_RANDOM_MAX_REQUEST : |
| 6926 | output_size); |
| 6927 | int ret = mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, |
| 6928 | output, request_size); |
| 6929 | if (ret != 0) { |
| 6930 | return mbedtls_to_psa_error(ret); |
| 6931 | } |
Gilles Peskine | 71ddab9 | 2021-01-04 21:01:07 +0100 | [diff] [blame] | 6932 | output_size -= request_size; |
| 6933 | output += request_size; |
Gilles Peskine | f181eca | 2019-08-07 13:49:00 +0200 | [diff] [blame] | 6934 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6935 | return PSA_SUCCESS; |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 6936 | #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 6937 | } |
| 6938 | |
Gilles Peskine | 8814fc4 | 2020-12-14 15:33:44 +0100 | [diff] [blame] | 6939 | /* Wrapper function allowing the classic API to use the PSA RNG. |
Gilles Peskine | 9c3e060 | 2021-01-05 16:03:55 +0100 | [diff] [blame] | 6940 | * |
| 6941 | * `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls |
| 6942 | * `psa_generate_random(...)`. The state parameter is ignored since the |
| 6943 | * PSA API doesn't support passing an explicit state. |
| 6944 | * |
| 6945 | * In the non-external case, psa_generate_random() calls an |
| 6946 | * `mbedtls_xxx_drbg_random` function which has exactly the same signature |
| 6947 | * and semantics as mbedtls_psa_get_random(). As an optimization, |
| 6948 | * instead of doing this back-and-forth between the PSA API and the |
| 6949 | * classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random` |
| 6950 | * as a constant function pointer to `mbedtls_xxx_drbg_random`. |
Gilles Peskine | 8814fc4 | 2020-12-14 15:33:44 +0100 | [diff] [blame] | 6951 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6952 | #if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) |
| 6953 | int mbedtls_psa_get_random(void *p_rng, |
| 6954 | unsigned char *output, |
| 6955 | size_t output_size) |
Gilles Peskine | 8814fc4 | 2020-12-14 15:33:44 +0100 | [diff] [blame] | 6956 | { |
Gilles Peskine | 9c3e060 | 2021-01-05 16:03:55 +0100 | [diff] [blame] | 6957 | /* This function takes a pointer to the RNG state because that's what |
| 6958 | * classic mbedtls functions using an RNG expect. The PSA RNG manages |
| 6959 | * its own state internally and doesn't let the caller access that state. |
| 6960 | * So we just ignore the state parameter, and in practice we'll pass |
| 6961 | * NULL. */ |
Gilles Peskine | 8814fc4 | 2020-12-14 15:33:44 +0100 | [diff] [blame] | 6962 | (void) p_rng; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6963 | psa_status_t status = psa_generate_random(output, output_size); |
| 6964 | if (status == PSA_SUCCESS) { |
| 6965 | return 0; |
| 6966 | } else { |
| 6967 | return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED; |
| 6968 | } |
Gilles Peskine | 8814fc4 | 2020-12-14 15:33:44 +0100 | [diff] [blame] | 6969 | } |
| 6970 | #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ |
| 6971 | |
Gilles Peskine | e3dbdd8 | 2019-02-25 11:04:06 +0100 | [diff] [blame] | 6972 | #if defined(MBEDTLS_PSA_INJECT_ENTROPY) |
Chris Jones | ea0a865 | 2021-03-09 19:11:19 +0000 | [diff] [blame] | 6973 | #include "entropy_poll.h" |
Gilles Peskine | e3dbdd8 | 2019-02-25 11:04:06 +0100 | [diff] [blame] | 6974 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6975 | psa_status_t mbedtls_psa_inject_entropy(const uint8_t *seed, |
| 6976 | size_t seed_size) |
Netanel Gonen | 2bcd312 | 2018-11-19 11:53:02 +0200 | [diff] [blame] | 6977 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6978 | if (global_data.initialized) { |
| 6979 | return PSA_ERROR_NOT_PERMITTED; |
| 6980 | } |
Netanel Gonen | 21f37cb | 2018-11-19 11:53:55 +0200 | [diff] [blame] | 6981 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6982 | if (((seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM) || |
| 6983 | (seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE)) || |
| 6984 | (seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE)) { |
| 6985 | return PSA_ERROR_INVALID_ARGUMENT; |
| 6986 | } |
Netanel Gonen | 21f37cb | 2018-11-19 11:53:55 +0200 | [diff] [blame] | 6987 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 6988 | return mbedtls_psa_storage_inject_entropy(seed, seed_size); |
Netanel Gonen | 2bcd312 | 2018-11-19 11:53:02 +0200 | [diff] [blame] | 6989 | } |
Gilles Peskine | e3dbdd8 | 2019-02-25 11:04:06 +0100 | [diff] [blame] | 6990 | #endif /* MBEDTLS_PSA_INJECT_ENTROPY */ |
Netanel Gonen | 2bcd312 | 2018-11-19 11:53:02 +0200 | [diff] [blame] | 6991 | |
Ronald Cron | 3772afe | 2021-02-08 16:10:05 +0100 | [diff] [blame] | 6992 | /** Validate the key type and size for key generation |
Ronald Cron | 01b2aba | 2020-10-05 09:42:02 +0200 | [diff] [blame] | 6993 | * |
Ronald Cron | 3772afe | 2021-02-08 16:10:05 +0100 | [diff] [blame] | 6994 | * \param type The key type |
| 6995 | * \param bits The number of bits of the key |
Ronald Cron | 01b2aba | 2020-10-05 09:42:02 +0200 | [diff] [blame] | 6996 | * |
| 6997 | * \retval #PSA_SUCCESS |
Ronald Cron | 3772afe | 2021-02-08 16:10:05 +0100 | [diff] [blame] | 6998 | * The key type and size are valid. |
Ronald Cron | 01b2aba | 2020-10-05 09:42:02 +0200 | [diff] [blame] | 6999 | * \retval #PSA_ERROR_INVALID_ARGUMENT |
| 7000 | * The size in bits of the key is not valid. |
| 7001 | * \retval #PSA_ERROR_NOT_SUPPORTED |
| 7002 | * The type and/or the size in bits of the key or the combination of |
| 7003 | * the two is not supported. |
| 7004 | */ |
Ronald Cron | 3772afe | 2021-02-08 16:10:05 +0100 | [diff] [blame] | 7005 | static psa_status_t psa_validate_key_type_and_size_for_key_generation( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7006 | psa_key_type_t type, size_t bits) |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7007 | { |
Ronald Cron | f3bb761 | 2020-10-02 20:11:59 +0200 | [diff] [blame] | 7008 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7009 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7010 | if (key_type_is_raw_bytes(type)) { |
| 7011 | status = psa_validate_unstructured_key_bit_size(type, bits); |
| 7012 | if (status != PSA_SUCCESS) { |
| 7013 | return status; |
| 7014 | } |
| 7015 | } else |
Ronald Cron | 5c4d386 | 2020-12-07 11:07:24 +0100 | [diff] [blame] | 7016 | #if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7017 | if (PSA_KEY_TYPE_IS_RSA(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) { |
| 7018 | if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS) { |
| 7019 | return PSA_ERROR_NOT_SUPPORTED; |
| 7020 | } |
Steven Cooreman | 81be2fa | 2020-07-24 22:04:59 +0200 | [diff] [blame] | 7021 | |
Ronald Cron | 01b2aba | 2020-10-05 09:42:02 +0200 | [diff] [blame] | 7022 | /* Accept only byte-aligned keys, for the same reasons as |
| 7023 | * in psa_import_rsa_key(). */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7024 | if (bits % 8 != 0) { |
| 7025 | return PSA_ERROR_NOT_SUPPORTED; |
| 7026 | } |
| 7027 | } else |
Ronald Cron | 5c4d386 | 2020-12-07 11:07:24 +0100 | [diff] [blame] | 7028 | #endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) */ |
Ronald Cron | 01b2aba | 2020-10-05 09:42:02 +0200 | [diff] [blame] | 7029 | |
Ronald Cron | 5c4d386 | 2020-12-07 11:07:24 +0100 | [diff] [blame] | 7030 | #if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7031 | if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) { |
Ronald Cron | d81ab56 | 2021-02-16 09:01:16 +0100 | [diff] [blame] | 7032 | /* To avoid empty block, return successfully here. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7033 | return PSA_SUCCESS; |
| 7034 | } else |
Ronald Cron | 5c4d386 | 2020-12-07 11:07:24 +0100 | [diff] [blame] | 7035 | #endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) */ |
Przemek Stekiel | fedd134 | 2022-12-01 15:00:02 +0100 | [diff] [blame] | 7036 | |
Przemek Stekiel | 6d85afa | 2023-04-28 11:42:17 +0200 | [diff] [blame] | 7037 | #if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR) |
Przemek Stekiel | fedd134 | 2022-12-01 15:00:02 +0100 | [diff] [blame] | 7038 | if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) { |
Przemek Stekiel | d1cf1ba | 2023-04-27 12:04:21 +0200 | [diff] [blame] | 7039 | if (psa_is_dh_key_size_valid(bits) == 0) { |
Przemek Stekiel | fedd134 | 2022-12-01 15:00:02 +0100 | [diff] [blame] | 7040 | return PSA_ERROR_NOT_SUPPORTED; |
| 7041 | } |
| 7042 | } else |
Przemek Stekiel | 6d85afa | 2023-04-28 11:42:17 +0200 | [diff] [blame] | 7043 | #endif /* defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR) */ |
Ronald Cron | 01b2aba | 2020-10-05 09:42:02 +0200 | [diff] [blame] | 7044 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7045 | return PSA_ERROR_NOT_SUPPORTED; |
Ronald Cron | 01b2aba | 2020-10-05 09:42:02 +0200 | [diff] [blame] | 7046 | } |
| 7047 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7048 | return PSA_SUCCESS; |
Ronald Cron | 01b2aba | 2020-10-05 09:42:02 +0200 | [diff] [blame] | 7049 | } |
| 7050 | |
Ronald Cron | 55ed059 | 2020-10-05 10:30:40 +0200 | [diff] [blame] | 7051 | psa_status_t psa_generate_key_internal( |
Ronald Cron | 2a38a6b | 2020-10-02 20:02:04 +0200 | [diff] [blame] | 7052 | const psa_key_attributes_t *attributes, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7053 | uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length) |
Ronald Cron | 01b2aba | 2020-10-05 09:42:02 +0200 | [diff] [blame] | 7054 | { |
| 7055 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 2a38a6b | 2020-10-02 20:02:04 +0200 | [diff] [blame] | 7056 | psa_key_type_t type = attributes->core.type; |
Ronald Cron | 01b2aba | 2020-10-05 09:42:02 +0200 | [diff] [blame] | 7057 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7058 | if ((attributes->domain_parameters == NULL) && |
| 7059 | (attributes->domain_parameters_size != 0)) { |
| 7060 | return PSA_ERROR_INVALID_ARGUMENT; |
| 7061 | } |
Ronald Cron | 01b2aba | 2020-10-05 09:42:02 +0200 | [diff] [blame] | 7062 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7063 | if (key_type_is_raw_bytes(type)) { |
| 7064 | status = psa_generate_random(key_buffer, key_buffer_size); |
| 7065 | if (status != PSA_SUCCESS) { |
| 7066 | return status; |
| 7067 | } |
Steven Cooreman | 81be2fa | 2020-07-24 22:04:59 +0200 | [diff] [blame] | 7068 | |
David Brown | 12ca503 | 2021-02-11 11:02:00 -0700 | [diff] [blame] | 7069 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7070 | if (type == PSA_KEY_TYPE_DES) { |
| 7071 | psa_des_set_key_parity(key_buffer, key_buffer_size); |
| 7072 | } |
David Brown | 8107e31 | 2021-02-12 08:08:46 -0700 | [diff] [blame] | 7073 | #endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7074 | } else |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7075 | |
Jaeden Amero | 424fa93 | 2021-05-14 08:34:32 +0100 | [diff] [blame] | 7076 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) && \ |
| 7077 | defined(MBEDTLS_GENPRIME) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7078 | if (type == PSA_KEY_TYPE_RSA_KEY_PAIR) { |
| 7079 | return mbedtls_psa_rsa_generate_key(attributes, |
| 7080 | key_buffer, |
| 7081 | key_buffer_size, |
| 7082 | key_buffer_length); |
| 7083 | } else |
Jaeden Amero | 424fa93 | 2021-05-14 08:34:32 +0100 | [diff] [blame] | 7084 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) |
| 7085 | * defined(MBEDTLS_GENPRIME) */ |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7086 | |
John Durkop | 9814fa2 | 2020-11-04 12:28:15 -0800 | [diff] [blame] | 7087 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7088 | if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) { |
| 7089 | return mbedtls_psa_ecp_generate_key(attributes, |
| 7090 | key_buffer, |
| 7091 | key_buffer_size, |
| 7092 | key_buffer_length); |
| 7093 | } else |
John Durkop | 9814fa2 | 2020-11-04 12:28:15 -0800 | [diff] [blame] | 7094 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) */ |
Przemek Stekiel | fedd134 | 2022-12-01 15:00:02 +0100 | [diff] [blame] | 7095 | |
Przemek Stekiel | 6d85afa | 2023-04-28 11:42:17 +0200 | [diff] [blame] | 7096 | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR) |
Przemek Stekiel | fedd134 | 2022-12-01 15:00:02 +0100 | [diff] [blame] | 7097 | if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) { |
| 7098 | return mbedtls_psa_ffdh_generate_key(attributes, |
| 7099 | key_buffer, |
| 7100 | key_buffer_size, |
| 7101 | key_buffer_length); |
| 7102 | } else |
Przemek Stekiel | 6d85afa | 2023-04-28 11:42:17 +0200 | [diff] [blame] | 7103 | #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR) */ |
Steven Cooreman | 2914986 | 2020-08-05 15:43:42 +0200 | [diff] [blame] | 7104 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7105 | (void) key_buffer_length; |
| 7106 | return PSA_ERROR_NOT_SUPPORTED; |
Steven Cooreman | 2914986 | 2020-08-05 15:43:42 +0200 | [diff] [blame] | 7107 | } |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7108 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7109 | return PSA_SUCCESS; |
Gilles Peskine | ff5f0e7 | 2019-04-18 12:53:30 +0200 | [diff] [blame] | 7110 | } |
Darryl Green | 0c6575a | 2018-11-07 16:05:30 +0000 | [diff] [blame] | 7111 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7112 | psa_status_t psa_generate_key(const psa_key_attributes_t *attributes, |
| 7113 | mbedtls_svc_key_id_t *key) |
Gilles Peskine | ff5f0e7 | 2019-04-18 12:53:30 +0200 | [diff] [blame] | 7114 | { |
| 7115 | psa_status_t status; |
| 7116 | psa_key_slot_t *slot = NULL; |
Gilles Peskine | 8abe6a2 | 2019-07-12 23:40:35 +0200 | [diff] [blame] | 7117 | psa_se_drv_table_entry_t *driver = NULL; |
Ronald Cron | 2b56bc8 | 2020-10-05 10:02:26 +0200 | [diff] [blame] | 7118 | size_t key_buffer_size; |
Gilles Peskine | 1179208 | 2019-08-06 18:36:36 +0200 | [diff] [blame] | 7119 | |
Ronald Cron | 81709fc | 2020-11-14 12:10:32 +0100 | [diff] [blame] | 7120 | *key = MBEDTLS_SVC_KEY_ID_INIT; |
| 7121 | |
Gilles Peskine | 0f84d62 | 2019-09-12 19:03:13 +0200 | [diff] [blame] | 7122 | /* Reject any attempt to create a zero-length key so that we don't |
| 7123 | * risk tripping up later, e.g. on a malloc(0) that returns NULL. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7124 | if (psa_get_key_bits(attributes) == 0) { |
| 7125 | return PSA_ERROR_INVALID_ARGUMENT; |
| 7126 | } |
Gilles Peskine | 0f84d62 | 2019-09-12 19:03:13 +0200 | [diff] [blame] | 7127 | |
Przemyslaw Stekiel | c0fe820 | 2021-10-07 11:08:56 +0200 | [diff] [blame] | 7128 | /* Reject any attempt to create a public key. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7129 | if (PSA_KEY_TYPE_IS_PUBLIC_KEY(attributes->core.type)) { |
| 7130 | return PSA_ERROR_INVALID_ARGUMENT; |
| 7131 | } |
Przemyslaw Stekiel | c0fe820 | 2021-10-07 11:08:56 +0200 | [diff] [blame] | 7132 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7133 | status = psa_start_key_creation(PSA_KEY_CREATION_GENERATE, attributes, |
| 7134 | &slot, &driver); |
| 7135 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 1179208 | 2019-08-06 18:36:36 +0200 | [diff] [blame] | 7136 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7137 | } |
Gilles Peskine | 1179208 | 2019-08-06 18:36:36 +0200 | [diff] [blame] | 7138 | |
Ronald Cron | 977c247 | 2020-10-13 08:32:21 +0200 | [diff] [blame] | 7139 | /* In the case of a transparent key or an opaque key stored in local |
Archana | 449608b | 2021-09-08 15:36:05 +0530 | [diff] [blame] | 7140 | * storage ( thus not in the case of generating a key in a secure element |
| 7141 | * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a |
| 7142 | * buffer to hold the generated key material. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7143 | if (slot->key.data == NULL) { |
| 7144 | if (PSA_KEY_LIFETIME_GET_LOCATION(attributes->core.lifetime) == |
| 7145 | PSA_KEY_LOCATION_LOCAL_STORAGE) { |
Ronald Cron | 3772afe | 2021-02-08 16:10:05 +0100 | [diff] [blame] | 7146 | status = psa_validate_key_type_and_size_for_key_generation( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7147 | attributes->core.type, attributes->core.bits); |
| 7148 | if (status != PSA_SUCCESS) { |
Ronald Cron | 3772afe | 2021-02-08 16:10:05 +0100 | [diff] [blame] | 7149 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7150 | } |
Ronald Cron | 3772afe | 2021-02-08 16:10:05 +0100 | [diff] [blame] | 7151 | |
| 7152 | key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7153 | attributes->core.type, |
| 7154 | attributes->core.bits); |
| 7155 | } else { |
Ronald Cron | 977c247 | 2020-10-13 08:32:21 +0200 | [diff] [blame] | 7156 | status = psa_driver_wrapper_get_key_buffer_size( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7157 | attributes, &key_buffer_size); |
| 7158 | if (status != PSA_SUCCESS) { |
Ronald Cron | 3772afe | 2021-02-08 16:10:05 +0100 | [diff] [blame] | 7159 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7160 | } |
Ronald Cron | 977c247 | 2020-10-13 08:32:21 +0200 | [diff] [blame] | 7161 | } |
Ronald Cron | 977c247 | 2020-10-13 08:32:21 +0200 | [diff] [blame] | 7162 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7163 | status = psa_allocate_buffer_to_slot(slot, key_buffer_size); |
| 7164 | if (status != PSA_SUCCESS) { |
Ronald Cron | 977c247 | 2020-10-13 08:32:21 +0200 | [diff] [blame] | 7165 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7166 | } |
Ronald Cron | 977c247 | 2020-10-13 08:32:21 +0200 | [diff] [blame] | 7167 | } |
| 7168 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7169 | status = psa_driver_wrapper_generate_key(attributes, |
| 7170 | slot->key.data, slot->key.bytes, &slot->key.bytes); |
Gilles Peskine | 1179208 | 2019-08-06 18:36:36 +0200 | [diff] [blame] | 7171 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7172 | if (status != PSA_SUCCESS) { |
| 7173 | psa_remove_key_data_from_memory(slot); |
| 7174 | } |
Ronald Cron | 2b56bc8 | 2020-10-05 10:02:26 +0200 | [diff] [blame] | 7175 | |
Gilles Peskine | 1179208 | 2019-08-06 18:36:36 +0200 | [diff] [blame] | 7176 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7177 | if (status == PSA_SUCCESS) { |
| 7178 | status = psa_finish_key_creation(slot, driver, key); |
| 7179 | } |
| 7180 | if (status != PSA_SUCCESS) { |
| 7181 | psa_fail_key_creation(slot, driver); |
| 7182 | } |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 7183 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7184 | return status; |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7185 | } |
| 7186 | |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7187 | /****************************************************************/ |
| 7188 | /* Module setup */ |
| 7189 | /****************************************************************/ |
| 7190 | |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 7191 | #if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) |
Gilles Peskine | 5e76952 | 2018-11-20 21:59:56 +0100 | [diff] [blame] | 7192 | psa_status_t mbedtls_psa_crypto_configure_entropy_sources( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7193 | void (* entropy_init)(mbedtls_entropy_context *ctx), |
| 7194 | void (* entropy_free)(mbedtls_entropy_context *ctx)) |
Gilles Peskine | 5e76952 | 2018-11-20 21:59:56 +0100 | [diff] [blame] | 7195 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7196 | if (global_data.rng_state != RNG_NOT_INITIALIZED) { |
| 7197 | return PSA_ERROR_BAD_STATE; |
| 7198 | } |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 7199 | global_data.rng.entropy_init = entropy_init; |
| 7200 | global_data.rng.entropy_free = entropy_free; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7201 | return PSA_SUCCESS; |
Gilles Peskine | 5e76952 | 2018-11-20 21:59:56 +0100 | [diff] [blame] | 7202 | } |
Gilles Peskine | 4fc21fd | 2020-11-13 18:47:18 +0100 | [diff] [blame] | 7203 | #endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */ |
Gilles Peskine | 5e76952 | 2018-11-20 21:59:56 +0100 | [diff] [blame] | 7204 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7205 | void mbedtls_psa_crypto_free(void) |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7206 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7207 | psa_wipe_all_key_slots(); |
| 7208 | if (global_data.rng_state != RNG_NOT_INITIALIZED) { |
| 7209 | mbedtls_psa_random_free(&global_data.rng); |
Gilles Peskine | c6b6907 | 2018-11-20 21:42:52 +0100 | [diff] [blame] | 7210 | } |
| 7211 | /* Wipe all remaining data, including configuration. |
| 7212 | * In particular, this sets all state indicator to the value |
| 7213 | * indicating "uninitialized". */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7214 | mbedtls_platform_zeroize(&global_data, sizeof(global_data)); |
Ronald Cron | 9ba7691 | 2021-04-10 16:57:30 +0200 | [diff] [blame] | 7215 | |
| 7216 | /* Terminate drivers */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7217 | psa_driver_wrapper_free(); |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7218 | } |
| 7219 | |
Gilles Peskine | f9bb29e | 2019-07-25 17:52:59 +0200 | [diff] [blame] | 7220 | #if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS) |
| 7221 | /** Recover a transaction that was interrupted by a power failure. |
| 7222 | * |
| 7223 | * This function is called during initialization, before psa_crypto_init() |
| 7224 | * returns. If this function returns a failure status, the initialization |
| 7225 | * fails. |
| 7226 | */ |
| 7227 | static psa_status_t psa_crypto_recover_transaction( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7228 | const psa_crypto_transaction_t *transaction) |
Gilles Peskine | f9bb29e | 2019-07-25 17:52:59 +0200 | [diff] [blame] | 7229 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7230 | switch (transaction->unknown.type) { |
Gilles Peskine | f9bb29e | 2019-07-25 17:52:59 +0200 | [diff] [blame] | 7231 | case PSA_CRYPTO_TRANSACTION_CREATE_KEY: |
| 7232 | case PSA_CRYPTO_TRANSACTION_DESTROY_KEY: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7233 | /* TODO - fall through to the failure case until this |
| 7234 | * is implemented. |
| 7235 | * https://github.com/ARMmbed/mbed-crypto/issues/218 |
| 7236 | */ |
Gilles Peskine | f9bb29e | 2019-07-25 17:52:59 +0200 | [diff] [blame] | 7237 | default: |
| 7238 | /* We found an unsupported transaction in the storage. |
| 7239 | * We don't know what state the storage is in. Give up. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7240 | return PSA_ERROR_DATA_INVALID; |
Gilles Peskine | f9bb29e | 2019-07-25 17:52:59 +0200 | [diff] [blame] | 7241 | } |
| 7242 | } |
| 7243 | #endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */ |
| 7244 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7245 | psa_status_t psa_crypto_init(void) |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7246 | { |
Gilles Peskine | 66fb126 | 2018-12-10 16:29:04 +0100 | [diff] [blame] | 7247 | psa_status_t status; |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7248 | |
Gilles Peskine | c6b6907 | 2018-11-20 21:42:52 +0100 | [diff] [blame] | 7249 | /* Double initialization is explicitly allowed. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7250 | if (global_data.initialized != 0) { |
| 7251 | return PSA_SUCCESS; |
| 7252 | } |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7253 | |
Manuel Pégourié-Gonnard | 7abdf7e | 2023-03-09 11:17:43 +0100 | [diff] [blame] | 7254 | /* Init drivers */ |
| 7255 | status = psa_driver_wrapper_init(); |
| 7256 | if (status != PSA_SUCCESS) { |
| 7257 | goto exit; |
| 7258 | } |
| 7259 | global_data.drivers_initialized = 1; |
| 7260 | |
Gilles Peskine | 30524eb | 2020-11-13 17:02:26 +0100 | [diff] [blame] | 7261 | /* Initialize and seed the random generator. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7262 | mbedtls_psa_random_init(&global_data.rng); |
Gilles Peskine | c6b6907 | 2018-11-20 21:42:52 +0100 | [diff] [blame] | 7263 | global_data.rng_state = RNG_INITIALIZED; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7264 | status = mbedtls_psa_random_seed(&global_data.rng); |
| 7265 | if (status != PSA_SUCCESS) { |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7266 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7267 | } |
Gilles Peskine | c6b6907 | 2018-11-20 21:42:52 +0100 | [diff] [blame] | 7268 | global_data.rng_state = RNG_SEEDED; |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7269 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7270 | status = psa_initialize_key_slots(); |
| 7271 | if (status != PSA_SUCCESS) { |
Gilles Peskine | 66fb126 | 2018-12-10 16:29:04 +0100 | [diff] [blame] | 7272 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7273 | } |
Gilles Peskine | c6b6907 | 2018-11-20 21:42:52 +0100 | [diff] [blame] | 7274 | |
Gilles Peskine | 4b73422 | 2019-07-24 15:56:31 +0200 | [diff] [blame] | 7275 | #if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7276 | status = psa_crypto_load_transaction(); |
| 7277 | if (status == PSA_SUCCESS) { |
| 7278 | status = psa_crypto_recover_transaction(&psa_crypto_transaction); |
| 7279 | if (status != PSA_SUCCESS) { |
Gilles Peskine | f9bb29e | 2019-07-25 17:52:59 +0200 | [diff] [blame] | 7280 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7281 | } |
| 7282 | status = psa_crypto_stop_transaction(); |
| 7283 | } else if (status == PSA_ERROR_DOES_NOT_EXIST) { |
Gilles Peskine | fc76265 | 2019-07-22 19:30:34 +0200 | [diff] [blame] | 7284 | /* There's no transaction to complete. It's all good. */ |
| 7285 | status = PSA_SUCCESS; |
| 7286 | } |
Gilles Peskine | 4b73422 | 2019-07-24 15:56:31 +0200 | [diff] [blame] | 7287 | #endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */ |
Gilles Peskine | fc76265 | 2019-07-22 19:30:34 +0200 | [diff] [blame] | 7288 | |
Gilles Peskine | c6b6907 | 2018-11-20 21:42:52 +0100 | [diff] [blame] | 7289 | /* All done. */ |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7290 | global_data.initialized = 1; |
| 7291 | |
| 7292 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 7293 | if (status != PSA_SUCCESS) { |
| 7294 | mbedtls_psa_crypto_free(); |
| 7295 | } |
| 7296 | return status; |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 7297 | } |
| 7298 | |
Przemek Stekiel | ca8d2b2 | 2023-01-17 16:21:33 +0100 | [diff] [blame] | 7299 | psa_status_t psa_crypto_driver_pake_get_password_len( |
| 7300 | const psa_crypto_driver_pake_inputs_t *inputs, |
| 7301 | size_t *password_len) |
| 7302 | { |
| 7303 | if (inputs->password_len == 0) { |
| 7304 | return PSA_ERROR_BAD_STATE; |
| 7305 | } |
| 7306 | |
| 7307 | *password_len = inputs->password_len; |
| 7308 | |
| 7309 | return PSA_SUCCESS; |
| 7310 | } |
| 7311 | |
| 7312 | psa_status_t psa_crypto_driver_pake_get_password( |
| 7313 | const psa_crypto_driver_pake_inputs_t *inputs, |
| 7314 | uint8_t *buffer, size_t buffer_size, size_t *buffer_length) |
| 7315 | { |
| 7316 | if (inputs->password_len == 0) { |
| 7317 | return PSA_ERROR_BAD_STATE; |
| 7318 | } |
| 7319 | |
| 7320 | if (buffer_size < inputs->password_len) { |
| 7321 | return PSA_ERROR_BUFFER_TOO_SMALL; |
| 7322 | } |
| 7323 | |
| 7324 | memcpy(buffer, inputs->password, inputs->password_len); |
| 7325 | *buffer_length = inputs->password_len; |
| 7326 | |
| 7327 | return PSA_SUCCESS; |
| 7328 | } |
| 7329 | |
Przemek Stekiel | 1e7a927 | 2023-02-28 14:38:58 +0100 | [diff] [blame] | 7330 | psa_status_t psa_crypto_driver_pake_get_user_len( |
| 7331 | const psa_crypto_driver_pake_inputs_t *inputs, |
| 7332 | size_t *user_len) |
| 7333 | { |
| 7334 | if (inputs->user_len == 0) { |
| 7335 | return PSA_ERROR_BAD_STATE; |
| 7336 | } |
| 7337 | |
| 7338 | *user_len = inputs->user_len; |
| 7339 | |
| 7340 | return PSA_SUCCESS; |
| 7341 | } |
| 7342 | |
| 7343 | psa_status_t psa_crypto_driver_pake_get_user( |
| 7344 | const psa_crypto_driver_pake_inputs_t *inputs, |
Przemek Stekiel | c0e6250 | 2023-03-14 11:49:36 +0100 | [diff] [blame] | 7345 | uint8_t *user_id, size_t user_id_size, size_t *user_id_len) |
Przemek Stekiel | 1e7a927 | 2023-02-28 14:38:58 +0100 | [diff] [blame] | 7346 | { |
| 7347 | if (inputs->user_len == 0) { |
| 7348 | return PSA_ERROR_BAD_STATE; |
| 7349 | } |
| 7350 | |
Przemek Stekiel | c0e6250 | 2023-03-14 11:49:36 +0100 | [diff] [blame] | 7351 | if (user_id_size < inputs->user_len) { |
Przemek Stekiel | 1e7a927 | 2023-02-28 14:38:58 +0100 | [diff] [blame] | 7352 | return PSA_ERROR_BUFFER_TOO_SMALL; |
| 7353 | } |
| 7354 | |
Przemek Stekiel | c0e6250 | 2023-03-14 11:49:36 +0100 | [diff] [blame] | 7355 | memcpy(user_id, inputs->user, inputs->user_len); |
| 7356 | *user_id_len = inputs->user_len; |
Przemek Stekiel | 1e7a927 | 2023-02-28 14:38:58 +0100 | [diff] [blame] | 7357 | |
| 7358 | return PSA_SUCCESS; |
| 7359 | } |
| 7360 | |
| 7361 | psa_status_t psa_crypto_driver_pake_get_peer_len( |
| 7362 | const psa_crypto_driver_pake_inputs_t *inputs, |
| 7363 | size_t *peer_len) |
| 7364 | { |
| 7365 | if (inputs->peer_len == 0) { |
| 7366 | return PSA_ERROR_BAD_STATE; |
| 7367 | } |
| 7368 | |
| 7369 | *peer_len = inputs->peer_len; |
| 7370 | |
| 7371 | return PSA_SUCCESS; |
| 7372 | } |
| 7373 | |
| 7374 | psa_status_t psa_crypto_driver_pake_get_peer( |
| 7375 | const psa_crypto_driver_pake_inputs_t *inputs, |
Przemek Stekiel | c0e6250 | 2023-03-14 11:49:36 +0100 | [diff] [blame] | 7376 | uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length) |
Przemek Stekiel | 1e7a927 | 2023-02-28 14:38:58 +0100 | [diff] [blame] | 7377 | { |
| 7378 | if (inputs->peer_len == 0) { |
| 7379 | return PSA_ERROR_BAD_STATE; |
| 7380 | } |
| 7381 | |
Przemek Stekiel | c0e6250 | 2023-03-14 11:49:36 +0100 | [diff] [blame] | 7382 | if (peer_id_size < inputs->peer_len) { |
Przemek Stekiel | 1e7a927 | 2023-02-28 14:38:58 +0100 | [diff] [blame] | 7383 | return PSA_ERROR_BUFFER_TOO_SMALL; |
| 7384 | } |
| 7385 | |
Przemek Stekiel | c0e6250 | 2023-03-14 11:49:36 +0100 | [diff] [blame] | 7386 | memcpy(peer_id, inputs->peer, inputs->peer_len); |
| 7387 | *peer_id_length = inputs->peer_len; |
Przemek Stekiel | 1e7a927 | 2023-02-28 14:38:58 +0100 | [diff] [blame] | 7388 | |
| 7389 | return PSA_SUCCESS; |
| 7390 | } |
| 7391 | |
Przemek Stekiel | ca8d2b2 | 2023-01-17 16:21:33 +0100 | [diff] [blame] | 7392 | psa_status_t psa_crypto_driver_pake_get_cipher_suite( |
| 7393 | const psa_crypto_driver_pake_inputs_t *inputs, |
| 7394 | psa_pake_cipher_suite_t *cipher_suite) |
| 7395 | { |
| 7396 | if (inputs->cipher_suite.algorithm == PSA_ALG_NONE) { |
| 7397 | return PSA_ERROR_BAD_STATE; |
| 7398 | } |
| 7399 | |
| 7400 | *cipher_suite = inputs->cipher_suite; |
| 7401 | |
| 7402 | return PSA_SUCCESS; |
| 7403 | } |
| 7404 | |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 7405 | psa_status_t psa_pake_setup( |
| 7406 | psa_pake_operation_t *operation, |
| 7407 | const psa_pake_cipher_suite_t *cipher_suite) |
| 7408 | { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7409 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7410 | |
Przemek Stekiel | 1c3cfb4 | 2023-01-26 10:35:02 +0100 | [diff] [blame] | 7411 | if (operation->stage != PSA_PAKE_OPERATION_STAGE_SETUP) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7412 | status = PSA_ERROR_BAD_STATE; |
| 7413 | goto exit; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7414 | } |
| 7415 | |
Przemek Stekiel | f62b3bb | 2023-01-31 19:51:24 +0100 | [diff] [blame] | 7416 | if (PSA_ALG_IS_PAKE(cipher_suite->algorithm) == 0 || |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7417 | PSA_ALG_IS_HASH(cipher_suite->hash) == 0) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7418 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 7419 | goto exit; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7420 | } |
| 7421 | |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7422 | memset(&operation->data.inputs, 0, sizeof(operation->data.inputs)); |
| 7423 | |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7424 | operation->alg = cipher_suite->algorithm; |
Przemek Stekiel | 656b259 | 2023-03-22 13:15:33 +0100 | [diff] [blame] | 7425 | operation->primitive = PSA_PAKE_PRIMITIVE(cipher_suite->type, |
| 7426 | cipher_suite->family, cipher_suite->bits); |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7427 | operation->data.inputs.cipher_suite = *cipher_suite; |
| 7428 | |
Przemek Stekiel | 4aa9940 | 2023-02-27 13:00:57 +0100 | [diff] [blame] | 7429 | #if defined(PSA_WANT_ALG_JPAKE) |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7430 | if (operation->alg == PSA_ALG_JPAKE) { |
Przemek Stekiel | 9a5b812 | 2022-12-22 13:34:47 +0100 | [diff] [blame] | 7431 | psa_jpake_computation_stage_t *computation_stage = |
Przemek Stekiel | dde6a91 | 2023-01-26 08:46:37 +0100 | [diff] [blame] | 7432 | &operation->computation_stage.jpake; |
Przemek Stekiel | 9a5b812 | 2022-12-22 13:34:47 +0100 | [diff] [blame] | 7433 | |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7434 | computation_stage->state = PSA_PAKE_STATE_SETUP; |
| 7435 | computation_stage->sequence = PSA_PAKE_SEQ_INVALID; |
| 7436 | computation_stage->input_step = PSA_PAKE_STEP_X1_X2; |
| 7437 | computation_stage->output_step = PSA_PAKE_STEP_X1_X2; |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7438 | } else |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7439 | #endif /* PSA_WANT_ALG_JPAKE */ |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7440 | { |
| 7441 | status = PSA_ERROR_NOT_SUPPORTED; |
| 7442 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7443 | } |
| 7444 | |
Przemek Stekiel | 1c3cfb4 | 2023-01-26 10:35:02 +0100 | [diff] [blame] | 7445 | operation->stage = PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS; |
| 7446 | |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7447 | return PSA_SUCCESS; |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7448 | exit: |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7449 | psa_pake_abort(operation); |
| 7450 | return status; |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 7451 | } |
| 7452 | |
| 7453 | psa_status_t psa_pake_set_password_key( |
| 7454 | psa_pake_operation_t *operation, |
| 7455 | mbedtls_svc_key_id_t password) |
| 7456 | { |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7457 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | 6c76441 | 2022-11-22 14:05:12 +0100 | [diff] [blame] | 7458 | psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; |
| 7459 | psa_key_slot_t *slot = NULL; |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7460 | |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7461 | if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7462 | status = PSA_ERROR_BAD_STATE; |
| 7463 | goto exit; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7464 | } |
| 7465 | |
Przemek Stekiel | 6c76441 | 2022-11-22 14:05:12 +0100 | [diff] [blame] | 7466 | status = psa_get_and_lock_key_slot_with_policy(password, &slot, |
| 7467 | PSA_KEY_USAGE_DERIVE, |
Przemek Stekiel | d5d28a2 | 2023-01-26 10:46:05 +0100 | [diff] [blame] | 7468 | operation->alg); |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7469 | if (status != PSA_SUCCESS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7470 | goto exit; |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7471 | } |
| 7472 | |
Przemek Stekiel | 6c76441 | 2022-11-22 14:05:12 +0100 | [diff] [blame] | 7473 | psa_key_attributes_t attributes = { |
| 7474 | .core = slot->attr |
| 7475 | }; |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7476 | |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7477 | psa_key_type_t type = psa_get_key_type(&attributes); |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7478 | |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7479 | if (type != PSA_KEY_TYPE_PASSWORD && |
| 7480 | type != PSA_KEY_TYPE_PASSWORD_HASH) { |
| 7481 | status = PSA_ERROR_INVALID_ARGUMENT; |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7482 | goto exit; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7483 | } |
| 7484 | |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7485 | operation->data.inputs.password = mbedtls_calloc(1, slot->key.bytes); |
| 7486 | if (operation->data.inputs.password == NULL) { |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7487 | status = PSA_ERROR_INSUFFICIENT_MEMORY; |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7488 | goto exit; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7489 | } |
| 7490 | |
| 7491 | memcpy(operation->data.inputs.password, slot->key.data, slot->key.bytes); |
| 7492 | operation->data.inputs.password_len = slot->key.bytes; |
Przemek Stekiel | 9dd2440 | 2023-01-26 15:06:09 +0100 | [diff] [blame] | 7493 | operation->data.inputs.attributes = attributes; |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7494 | exit: |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7495 | if (status != PSA_SUCCESS) { |
| 7496 | psa_pake_abort(operation); |
| 7497 | } |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7498 | unlock_status = psa_unlock_key_slot(slot); |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7499 | return (status == PSA_SUCCESS) ? unlock_status : status; |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 7500 | } |
| 7501 | |
| 7502 | psa_status_t psa_pake_set_user( |
| 7503 | psa_pake_operation_t *operation, |
| 7504 | const uint8_t *user_id, |
| 7505 | size_t user_id_len) |
| 7506 | { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7507 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7508 | |
| 7509 | if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7510 | status = PSA_ERROR_BAD_STATE; |
| 7511 | goto exit; |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7512 | } |
| 7513 | |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7514 | if (user_id_len == 0) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7515 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 7516 | goto exit; |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7517 | } |
| 7518 | |
Przemek Stekiel | f309d6b | 2023-03-10 09:54:45 +0100 | [diff] [blame] | 7519 | if (operation->data.inputs.user_len != 0) { |
Przemek Stekiel | 26c909d | 2023-02-28 12:34:03 +0100 | [diff] [blame] | 7520 | status = PSA_ERROR_BAD_STATE; |
| 7521 | goto exit; |
| 7522 | } |
| 7523 | |
Przemek Stekiel | f309d6b | 2023-03-10 09:54:45 +0100 | [diff] [blame] | 7524 | operation->data.inputs.user = mbedtls_calloc(1, user_id_len); |
| 7525 | if (operation->data.inputs.user == NULL) { |
Przemek Stekiel | 26c909d | 2023-02-28 12:34:03 +0100 | [diff] [blame] | 7526 | status = PSA_ERROR_INSUFFICIENT_MEMORY; |
| 7527 | goto exit; |
| 7528 | } |
| 7529 | |
Przemek Stekiel | f309d6b | 2023-03-10 09:54:45 +0100 | [diff] [blame] | 7530 | memcpy(operation->data.inputs.user, user_id, user_id_len); |
| 7531 | operation->data.inputs.user_len = user_id_len; |
Przemek Stekiel | 26c909d | 2023-02-28 12:34:03 +0100 | [diff] [blame] | 7532 | |
| 7533 | return PSA_SUCCESS; |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7534 | exit: |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7535 | psa_pake_abort(operation); |
| 7536 | return status; |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 7537 | } |
| 7538 | |
| 7539 | psa_status_t psa_pake_set_peer( |
| 7540 | psa_pake_operation_t *operation, |
| 7541 | const uint8_t *peer_id, |
| 7542 | size_t peer_id_len) |
| 7543 | { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7544 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7545 | |
| 7546 | if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7547 | status = PSA_ERROR_BAD_STATE; |
| 7548 | goto exit; |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7549 | } |
| 7550 | |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7551 | if (peer_id_len == 0) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7552 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 7553 | goto exit; |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7554 | } |
| 7555 | |
Przemek Stekiel | f309d6b | 2023-03-10 09:54:45 +0100 | [diff] [blame] | 7556 | if (operation->data.inputs.peer_len != 0) { |
Przemek Stekiel | 26c909d | 2023-02-28 12:34:03 +0100 | [diff] [blame] | 7557 | status = PSA_ERROR_BAD_STATE; |
| 7558 | goto exit; |
| 7559 | } |
| 7560 | |
Przemek Stekiel | f309d6b | 2023-03-10 09:54:45 +0100 | [diff] [blame] | 7561 | operation->data.inputs.peer = mbedtls_calloc(1, peer_id_len); |
| 7562 | if (operation->data.inputs.peer == NULL) { |
Przemek Stekiel | 26c909d | 2023-02-28 12:34:03 +0100 | [diff] [blame] | 7563 | status = PSA_ERROR_INSUFFICIENT_MEMORY; |
| 7564 | goto exit; |
| 7565 | } |
| 7566 | |
Przemek Stekiel | f309d6b | 2023-03-10 09:54:45 +0100 | [diff] [blame] | 7567 | memcpy(operation->data.inputs.peer, peer_id, peer_id_len); |
| 7568 | operation->data.inputs.peer_len = peer_id_len; |
Przemek Stekiel | 26c909d | 2023-02-28 12:34:03 +0100 | [diff] [blame] | 7569 | |
| 7570 | return PSA_SUCCESS; |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7571 | exit: |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7572 | psa_pake_abort(operation); |
| 7573 | return status; |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 7574 | } |
| 7575 | |
| 7576 | psa_status_t psa_pake_set_role( |
| 7577 | psa_pake_operation_t *operation, |
| 7578 | psa_pake_role_t role) |
| 7579 | { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7580 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7581 | |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7582 | if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { |
Przemek Stekiel | 26c909d | 2023-02-28 12:34:03 +0100 | [diff] [blame] | 7583 | status = PSA_ERROR_BAD_STATE; |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7584 | goto exit; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7585 | } |
| 7586 | |
Przemek Stekiel | 09104b8 | 2023-03-06 14:11:51 +0100 | [diff] [blame] | 7587 | switch (operation->alg) { |
| 7588 | #if defined(PSA_WANT_ALG_JPAKE) |
| 7589 | case PSA_ALG_JPAKE: |
| 7590 | if (role == PSA_PAKE_ROLE_NONE) { |
| 7591 | return PSA_SUCCESS; |
| 7592 | } |
| 7593 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 7594 | break; |
| 7595 | #endif |
| 7596 | default: |
| 7597 | (void) role; |
| 7598 | status = PSA_ERROR_NOT_SUPPORTED; |
| 7599 | goto exit; |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7600 | } |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7601 | exit: |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7602 | psa_pake_abort(operation); |
| 7603 | return status; |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 7604 | } |
| 7605 | |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7606 | /* Auxiliary function to convert core computation stage(step, sequence, state) to single driver step. */ |
Przemek Stekiel | 4aa9940 | 2023-02-27 13:00:57 +0100 | [diff] [blame] | 7607 | #if defined(PSA_WANT_ALG_JPAKE) |
Przemek Stekiel | 251e86a | 2023-02-17 14:30:50 +0100 | [diff] [blame] | 7608 | static psa_crypto_driver_pake_step_t convert_jpake_computation_stage_to_driver_step( |
Przemek Stekiel | dde6a91 | 2023-01-26 08:46:37 +0100 | [diff] [blame] | 7609 | psa_jpake_computation_stage_t *stage) |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7610 | { |
Przemek Stekiel | dde6a91 | 2023-01-26 08:46:37 +0100 | [diff] [blame] | 7611 | switch (stage->state) { |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7612 | case PSA_PAKE_OUTPUT_X1_X2: |
| 7613 | case PSA_PAKE_INPUT_X1_X2: |
Przemek Stekiel | dde6a91 | 2023-01-26 08:46:37 +0100 | [diff] [blame] | 7614 | switch (stage->sequence) { |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7615 | case PSA_PAKE_X1_STEP_KEY_SHARE: |
| 7616 | return PSA_JPAKE_X1_STEP_KEY_SHARE; |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7617 | case PSA_PAKE_X1_STEP_ZK_PUBLIC: |
| 7618 | return PSA_JPAKE_X1_STEP_ZK_PUBLIC; |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7619 | case PSA_PAKE_X1_STEP_ZK_PROOF: |
| 7620 | return PSA_JPAKE_X1_STEP_ZK_PROOF; |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7621 | case PSA_PAKE_X2_STEP_KEY_SHARE: |
| 7622 | return PSA_JPAKE_X2_STEP_KEY_SHARE; |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7623 | case PSA_PAKE_X2_STEP_ZK_PUBLIC: |
| 7624 | return PSA_JPAKE_X2_STEP_ZK_PUBLIC; |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7625 | case PSA_PAKE_X2_STEP_ZK_PROOF: |
| 7626 | return PSA_JPAKE_X2_STEP_ZK_PROOF; |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7627 | default: |
| 7628 | return PSA_JPAKE_STEP_INVALID; |
| 7629 | } |
| 7630 | break; |
| 7631 | case PSA_PAKE_OUTPUT_X2S: |
Przemek Stekiel | dde6a91 | 2023-01-26 08:46:37 +0100 | [diff] [blame] | 7632 | switch (stage->sequence) { |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7633 | case PSA_PAKE_X1_STEP_KEY_SHARE: |
| 7634 | return PSA_JPAKE_X2S_STEP_KEY_SHARE; |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7635 | case PSA_PAKE_X1_STEP_ZK_PUBLIC: |
| 7636 | return PSA_JPAKE_X2S_STEP_ZK_PUBLIC; |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7637 | case PSA_PAKE_X1_STEP_ZK_PROOF: |
| 7638 | return PSA_JPAKE_X2S_STEP_ZK_PROOF; |
Przemek Stekiel | 57580f2 | 2023-03-01 12:21:26 +0100 | [diff] [blame] | 7639 | default: |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7640 | return PSA_JPAKE_STEP_INVALID; |
| 7641 | } |
| 7642 | break; |
| 7643 | case PSA_PAKE_INPUT_X4S: |
Przemek Stekiel | dde6a91 | 2023-01-26 08:46:37 +0100 | [diff] [blame] | 7644 | switch (stage->sequence) { |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7645 | case PSA_PAKE_X1_STEP_KEY_SHARE: |
| 7646 | return PSA_JPAKE_X4S_STEP_KEY_SHARE; |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7647 | case PSA_PAKE_X1_STEP_ZK_PUBLIC: |
| 7648 | return PSA_JPAKE_X4S_STEP_ZK_PUBLIC; |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7649 | case PSA_PAKE_X1_STEP_ZK_PROOF: |
| 7650 | return PSA_JPAKE_X4S_STEP_ZK_PROOF; |
Przemek Stekiel | 57580f2 | 2023-03-01 12:21:26 +0100 | [diff] [blame] | 7651 | default: |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7652 | return PSA_JPAKE_STEP_INVALID; |
| 7653 | } |
| 7654 | break; |
| 7655 | default: |
| 7656 | return PSA_JPAKE_STEP_INVALID; |
| 7657 | } |
| 7658 | return PSA_JPAKE_STEP_INVALID; |
| 7659 | } |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7660 | #endif /* PSA_WANT_ALG_JPAKE */ |
Przemek Stekiel | b09c487 | 2023-01-17 12:05:38 +0100 | [diff] [blame] | 7661 | |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7662 | static psa_status_t psa_pake_complete_inputs( |
| 7663 | psa_pake_operation_t *operation) |
| 7664 | { |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7665 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | 18620a3 | 2023-01-17 16:34:52 +0100 | [diff] [blame] | 7666 | /* Create copy of the inputs on stack as inputs share memory |
| 7667 | with the driver context which will be setup by the driver. */ |
| 7668 | psa_crypto_driver_pake_inputs_t inputs = operation->data.inputs; |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7669 | |
Przemek Stekiel | fde1128 | 2023-03-13 16:06:09 +0100 | [diff] [blame] | 7670 | if (inputs.password_len == 0) { |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7671 | return PSA_ERROR_BAD_STATE; |
| 7672 | } |
| 7673 | |
Przemek Stekiel | 26c909d | 2023-02-28 12:34:03 +0100 | [diff] [blame] | 7674 | if (operation->alg == PSA_ALG_JPAKE) { |
Przemek Stekiel | fde1128 | 2023-03-13 16:06:09 +0100 | [diff] [blame] | 7675 | if (inputs.user_len == 0 || inputs.peer_len == 0) { |
| 7676 | return PSA_ERROR_BAD_STATE; |
| 7677 | } |
Przemek Stekiel | dff21d3 | 2023-02-14 20:09:10 +0100 | [diff] [blame] | 7678 | } |
| 7679 | |
Przemek Stekiel | 18620a3 | 2023-01-17 16:34:52 +0100 | [diff] [blame] | 7680 | /* Clear driver context */ |
| 7681 | mbedtls_platform_zeroize(&operation->data, sizeof(operation->data)); |
| 7682 | |
| 7683 | status = psa_driver_wrapper_pake_setup(operation, &inputs); |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7684 | |
| 7685 | /* Driver is responsible for creating its own copy of the password. */ |
Przemek Stekiel | f62b3bb | 2023-01-31 19:51:24 +0100 | [diff] [blame] | 7686 | mbedtls_platform_zeroize(inputs.password, inputs.password_len); |
| 7687 | mbedtls_free(inputs.password); |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7688 | |
Przemek Stekiel | 26c909d | 2023-02-28 12:34:03 +0100 | [diff] [blame] | 7689 | /* User and peer are translated to role. */ |
| 7690 | mbedtls_free(inputs.user); |
| 7691 | mbedtls_free(inputs.peer); |
| 7692 | |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7693 | if (status == PSA_SUCCESS) { |
Przemek Stekiel | 4aa9940 | 2023-02-27 13:00:57 +0100 | [diff] [blame] | 7694 | #if defined(PSA_WANT_ALG_JPAKE) |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7695 | if (operation->alg == PSA_ALG_JPAKE) { |
Przemek Stekiel | d93de32 | 2023-02-24 08:39:04 +0100 | [diff] [blame] | 7696 | operation->stage = PSA_PAKE_OPERATION_STAGE_COMPUTATION; |
Przemek Stekiel | f62b3bb | 2023-01-31 19:51:24 +0100 | [diff] [blame] | 7697 | psa_jpake_computation_stage_t *computation_stage = |
| 7698 | &operation->computation_stage.jpake; |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7699 | computation_stage->state = PSA_PAKE_STATE_READY; |
| 7700 | computation_stage->sequence = PSA_PAKE_SEQ_INVALID; |
| 7701 | computation_stage->input_step = PSA_PAKE_STEP_X1_X2; |
| 7702 | computation_stage->output_step = PSA_PAKE_STEP_X1_X2; |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7703 | } else |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7704 | #endif /* PSA_WANT_ALG_JPAKE */ |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7705 | { |
| 7706 | status = PSA_ERROR_NOT_SUPPORTED; |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7707 | } |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7708 | } |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7709 | return status; |
| 7710 | } |
| 7711 | |
Przemek Stekiel | 4aa9940 | 2023-02-27 13:00:57 +0100 | [diff] [blame] | 7712 | #if defined(PSA_WANT_ALG_JPAKE) |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7713 | static psa_status_t psa_jpake_output_prologue( |
| 7714 | psa_pake_operation_t *operation, |
| 7715 | psa_pake_step_t step) |
| 7716 | { |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7717 | if (step != PSA_PAKE_STEP_KEY_SHARE && |
| 7718 | step != PSA_PAKE_STEP_ZK_PUBLIC && |
| 7719 | step != PSA_PAKE_STEP_ZK_PROOF) { |
| 7720 | return PSA_ERROR_INVALID_ARGUMENT; |
| 7721 | } |
| 7722 | |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7723 | psa_jpake_computation_stage_t *computation_stage = |
| 7724 | &operation->computation_stage.jpake; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7725 | |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7726 | if (computation_stage->state == PSA_PAKE_STATE_INVALID) { |
| 7727 | return PSA_ERROR_BAD_STATE; |
| 7728 | } |
| 7729 | |
| 7730 | if (computation_stage->state != PSA_PAKE_STATE_READY && |
| 7731 | computation_stage->state != PSA_PAKE_OUTPUT_X1_X2 && |
| 7732 | computation_stage->state != PSA_PAKE_OUTPUT_X2S) { |
| 7733 | return PSA_ERROR_BAD_STATE; |
| 7734 | } |
| 7735 | |
| 7736 | if (computation_stage->state == PSA_PAKE_STATE_READY) { |
| 7737 | if (step != PSA_PAKE_STEP_KEY_SHARE) { |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7738 | return PSA_ERROR_BAD_STATE; |
| 7739 | } |
| 7740 | |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7741 | switch (computation_stage->output_step) { |
| 7742 | case PSA_PAKE_STEP_X1_X2: |
| 7743 | computation_stage->state = PSA_PAKE_OUTPUT_X1_X2; |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7744 | break; |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7745 | case PSA_PAKE_STEP_X2S: |
| 7746 | computation_stage->state = PSA_PAKE_OUTPUT_X2S; |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7747 | break; |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7748 | default: |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7749 | return PSA_ERROR_BAD_STATE; |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7750 | } |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7751 | |
| 7752 | computation_stage->sequence = PSA_PAKE_X1_STEP_KEY_SHARE; |
| 7753 | } |
| 7754 | |
| 7755 | /* Check if step matches current sequence */ |
| 7756 | switch (computation_stage->sequence) { |
| 7757 | case PSA_PAKE_X1_STEP_KEY_SHARE: |
| 7758 | case PSA_PAKE_X2_STEP_KEY_SHARE: |
| 7759 | if (step != PSA_PAKE_STEP_KEY_SHARE) { |
| 7760 | return PSA_ERROR_BAD_STATE; |
| 7761 | } |
| 7762 | break; |
| 7763 | |
| 7764 | case PSA_PAKE_X1_STEP_ZK_PUBLIC: |
| 7765 | case PSA_PAKE_X2_STEP_ZK_PUBLIC: |
| 7766 | if (step != PSA_PAKE_STEP_ZK_PUBLIC) { |
| 7767 | return PSA_ERROR_BAD_STATE; |
| 7768 | } |
| 7769 | break; |
| 7770 | |
| 7771 | case PSA_PAKE_X1_STEP_ZK_PROOF: |
| 7772 | case PSA_PAKE_X2_STEP_ZK_PROOF: |
| 7773 | if (step != PSA_PAKE_STEP_ZK_PROOF) { |
| 7774 | return PSA_ERROR_BAD_STATE; |
| 7775 | } |
| 7776 | break; |
| 7777 | |
| 7778 | default: |
| 7779 | return PSA_ERROR_BAD_STATE; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7780 | } |
| 7781 | |
| 7782 | return PSA_SUCCESS; |
| 7783 | } |
| 7784 | |
| 7785 | static psa_status_t psa_jpake_output_epilogue( |
| 7786 | psa_pake_operation_t *operation) |
| 7787 | { |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7788 | psa_jpake_computation_stage_t *computation_stage = |
| 7789 | &operation->computation_stage.jpake; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7790 | |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7791 | if ((computation_stage->state == PSA_PAKE_OUTPUT_X1_X2 && |
Przemek Stekiel | 083745e | 2023-02-23 17:28:23 +0100 | [diff] [blame] | 7792 | computation_stage->sequence == PSA_PAKE_X2_STEP_ZK_PROOF) || |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7793 | (computation_stage->state == PSA_PAKE_OUTPUT_X2S && |
Przemek Stekiel | 083745e | 2023-02-23 17:28:23 +0100 | [diff] [blame] | 7794 | computation_stage->sequence == PSA_PAKE_X1_STEP_ZK_PROOF)) { |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7795 | computation_stage->state = PSA_PAKE_STATE_READY; |
| 7796 | computation_stage->output_step++; |
| 7797 | computation_stage->sequence = PSA_PAKE_SEQ_INVALID; |
| 7798 | } else { |
| 7799 | computation_stage->sequence++; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7800 | } |
| 7801 | |
| 7802 | return PSA_SUCCESS; |
| 7803 | } |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7804 | #endif /* PSA_WANT_ALG_JPAKE */ |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7805 | |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 7806 | psa_status_t psa_pake_output( |
| 7807 | psa_pake_operation_t *operation, |
| 7808 | psa_pake_step_t step, |
| 7809 | uint8_t *output, |
| 7810 | size_t output_size, |
| 7811 | size_t *output_length) |
| 7812 | { |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7813 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | 691e91a | 2023-03-07 16:26:37 +0100 | [diff] [blame] | 7814 | psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID; |
Przemek Stekiel | f62b3bb | 2023-01-31 19:51:24 +0100 | [diff] [blame] | 7815 | *output_length = 0; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7816 | |
| 7817 | if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7818 | status = psa_pake_complete_inputs(operation); |
| 7819 | if (status != PSA_SUCCESS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7820 | goto exit; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7821 | } |
| 7822 | } |
| 7823 | |
| 7824 | if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7825 | status = PSA_ERROR_BAD_STATE; |
| 7826 | goto exit; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7827 | } |
| 7828 | |
Przemek Stekiel | f62b3bb | 2023-01-31 19:51:24 +0100 | [diff] [blame] | 7829 | if (output_size == 0) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7830 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 7831 | goto exit; |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7832 | } |
| 7833 | |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7834 | switch (operation->alg) { |
Przemek Stekiel | 4aa9940 | 2023-02-27 13:00:57 +0100 | [diff] [blame] | 7835 | #if defined(PSA_WANT_ALG_JPAKE) |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7836 | case PSA_ALG_JPAKE: |
| 7837 | status = psa_jpake_output_prologue(operation, step); |
| 7838 | if (status != PSA_SUCCESS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7839 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7840 | } |
Przemek Stekiel | 691e91a | 2023-03-07 16:26:37 +0100 | [diff] [blame] | 7841 | driver_step = convert_jpake_computation_stage_to_driver_step( |
| 7842 | &operation->computation_stage.jpake); |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7843 | break; |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7844 | #endif /* PSA_WANT_ALG_JPAKE */ |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7845 | default: |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7846 | (void) step; |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7847 | status = PSA_ERROR_NOT_SUPPORTED; |
| 7848 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7849 | } |
| 7850 | |
Przemek Stekiel | 691e91a | 2023-03-07 16:26:37 +0100 | [diff] [blame] | 7851 | status = psa_driver_wrapper_pake_output(operation, driver_step, |
| 7852 | output, output_size, output_length); |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7853 | |
| 7854 | if (status != PSA_SUCCESS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7855 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7856 | } |
| 7857 | |
| 7858 | switch (operation->alg) { |
Przemek Stekiel | 4aa9940 | 2023-02-27 13:00:57 +0100 | [diff] [blame] | 7859 | #if defined(PSA_WANT_ALG_JPAKE) |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7860 | case PSA_ALG_JPAKE: |
| 7861 | status = psa_jpake_output_epilogue(operation); |
| 7862 | if (status != PSA_SUCCESS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7863 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7864 | } |
| 7865 | break; |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7866 | #endif /* PSA_WANT_ALG_JPAKE */ |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7867 | default: |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7868 | status = PSA_ERROR_NOT_SUPPORTED; |
| 7869 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7870 | } |
| 7871 | |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7872 | return PSA_SUCCESS; |
| 7873 | exit: |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7874 | psa_pake_abort(operation); |
| 7875 | return status; |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 7876 | } |
| 7877 | |
Przemek Stekiel | 4aa9940 | 2023-02-27 13:00:57 +0100 | [diff] [blame] | 7878 | #if defined(PSA_WANT_ALG_JPAKE) |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7879 | static psa_status_t psa_jpake_input_prologue( |
| 7880 | psa_pake_operation_t *operation, |
Przemek Stekiel | 691e91a | 2023-03-07 16:26:37 +0100 | [diff] [blame] | 7881 | psa_pake_step_t step) |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7882 | { |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7883 | if (step != PSA_PAKE_STEP_KEY_SHARE && |
| 7884 | step != PSA_PAKE_STEP_ZK_PUBLIC && |
| 7885 | step != PSA_PAKE_STEP_ZK_PROOF) { |
| 7886 | return PSA_ERROR_INVALID_ARGUMENT; |
| 7887 | } |
| 7888 | |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7889 | psa_jpake_computation_stage_t *computation_stage = |
| 7890 | &operation->computation_stage.jpake; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7891 | |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7892 | if (computation_stage->state == PSA_PAKE_STATE_INVALID) { |
| 7893 | return PSA_ERROR_BAD_STATE; |
| 7894 | } |
| 7895 | |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7896 | if (computation_stage->state != PSA_PAKE_STATE_READY && |
| 7897 | computation_stage->state != PSA_PAKE_INPUT_X1_X2 && |
| 7898 | computation_stage->state != PSA_PAKE_INPUT_X4S) { |
| 7899 | return PSA_ERROR_BAD_STATE; |
| 7900 | } |
| 7901 | |
| 7902 | if (computation_stage->state == PSA_PAKE_STATE_READY) { |
| 7903 | if (step != PSA_PAKE_STEP_KEY_SHARE) { |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7904 | return PSA_ERROR_BAD_STATE; |
| 7905 | } |
| 7906 | |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7907 | switch (computation_stage->input_step) { |
| 7908 | case PSA_PAKE_STEP_X1_X2: |
| 7909 | computation_stage->state = PSA_PAKE_INPUT_X1_X2; |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7910 | break; |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7911 | case PSA_PAKE_STEP_X2S: |
| 7912 | computation_stage->state = PSA_PAKE_INPUT_X4S; |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7913 | break; |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7914 | default: |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7915 | return PSA_ERROR_BAD_STATE; |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 7916 | } |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7917 | |
| 7918 | computation_stage->sequence = PSA_PAKE_X1_STEP_KEY_SHARE; |
| 7919 | } |
| 7920 | |
| 7921 | /* Check if step matches current sequence */ |
| 7922 | switch (computation_stage->sequence) { |
| 7923 | case PSA_PAKE_X1_STEP_KEY_SHARE: |
| 7924 | case PSA_PAKE_X2_STEP_KEY_SHARE: |
| 7925 | if (step != PSA_PAKE_STEP_KEY_SHARE) { |
| 7926 | return PSA_ERROR_BAD_STATE; |
| 7927 | } |
| 7928 | break; |
| 7929 | |
| 7930 | case PSA_PAKE_X1_STEP_ZK_PUBLIC: |
| 7931 | case PSA_PAKE_X2_STEP_ZK_PUBLIC: |
| 7932 | if (step != PSA_PAKE_STEP_ZK_PUBLIC) { |
| 7933 | return PSA_ERROR_BAD_STATE; |
| 7934 | } |
| 7935 | break; |
| 7936 | |
| 7937 | case PSA_PAKE_X1_STEP_ZK_PROOF: |
| 7938 | case PSA_PAKE_X2_STEP_ZK_PROOF: |
| 7939 | if (step != PSA_PAKE_STEP_ZK_PROOF) { |
| 7940 | return PSA_ERROR_BAD_STATE; |
| 7941 | } |
| 7942 | break; |
| 7943 | |
| 7944 | default: |
| 7945 | return PSA_ERROR_BAD_STATE; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7946 | } |
| 7947 | |
| 7948 | return PSA_SUCCESS; |
| 7949 | } |
| 7950 | |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7951 | static psa_status_t psa_jpake_input_epilogue( |
| 7952 | psa_pake_operation_t *operation) |
| 7953 | { |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7954 | psa_jpake_computation_stage_t *computation_stage = |
| 7955 | &operation->computation_stage.jpake; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7956 | |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7957 | if ((computation_stage->state == PSA_PAKE_INPUT_X1_X2 && |
Przemek Stekiel | 083745e | 2023-02-23 17:28:23 +0100 | [diff] [blame] | 7958 | computation_stage->sequence == PSA_PAKE_X2_STEP_ZK_PROOF) || |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7959 | (computation_stage->state == PSA_PAKE_INPUT_X4S && |
Przemek Stekiel | 083745e | 2023-02-23 17:28:23 +0100 | [diff] [blame] | 7960 | computation_stage->sequence == PSA_PAKE_X1_STEP_ZK_PROOF)) { |
Przemek Stekiel | 5eff103 | 2023-02-21 19:10:36 +0100 | [diff] [blame] | 7961 | computation_stage->state = PSA_PAKE_STATE_READY; |
| 7962 | computation_stage->input_step++; |
| 7963 | computation_stage->sequence = PSA_PAKE_SEQ_INVALID; |
| 7964 | } else { |
| 7965 | computation_stage->sequence++; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7966 | } |
| 7967 | |
| 7968 | return PSA_SUCCESS; |
| 7969 | } |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 7970 | #endif /* PSA_WANT_ALG_JPAKE */ |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 7971 | |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 7972 | psa_status_t psa_pake_input( |
| 7973 | psa_pake_operation_t *operation, |
| 7974 | psa_pake_step_t step, |
| 7975 | const uint8_t *input, |
| 7976 | size_t input_length) |
| 7977 | { |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7978 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | 691e91a | 2023-03-07 16:26:37 +0100 | [diff] [blame] | 7979 | psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID; |
Przemek Stekiel | 256c75d | 2023-03-23 14:09:34 +0100 | [diff] [blame] | 7980 | const size_t max_input_length = (size_t) PSA_PAKE_INPUT_SIZE(operation->alg, |
| 7981 | operation->primitive, |
| 7982 | step); |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7983 | |
| 7984 | if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { |
Przemek Stekiel | 2797d37 | 2022-12-22 11:19:22 +0100 | [diff] [blame] | 7985 | status = psa_pake_complete_inputs(operation); |
| 7986 | if (status != PSA_SUCCESS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7987 | goto exit; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7988 | } |
| 7989 | } |
| 7990 | |
| 7991 | if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7992 | status = PSA_ERROR_BAD_STATE; |
| 7993 | goto exit; |
Przemek Stekiel | 51eac53 | 2022-12-07 11:04:51 +0100 | [diff] [blame] | 7994 | } |
| 7995 | |
Przemek Stekiel | 256c75d | 2023-03-23 14:09:34 +0100 | [diff] [blame] | 7996 | if (input_length == 0 || input_length > max_input_length) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 7997 | status = PSA_ERROR_INVALID_ARGUMENT; |
| 7998 | goto exit; |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 7999 | } |
| 8000 | |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8001 | switch (operation->alg) { |
Przemek Stekiel | 4aa9940 | 2023-02-27 13:00:57 +0100 | [diff] [blame] | 8002 | #if defined(PSA_WANT_ALG_JPAKE) |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8003 | case PSA_ALG_JPAKE: |
Przemek Stekiel | 691e91a | 2023-03-07 16:26:37 +0100 | [diff] [blame] | 8004 | status = psa_jpake_input_prologue(operation, step); |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8005 | if (status != PSA_SUCCESS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 8006 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8007 | } |
Przemek Stekiel | 691e91a | 2023-03-07 16:26:37 +0100 | [diff] [blame] | 8008 | driver_step = convert_jpake_computation_stage_to_driver_step( |
| 8009 | &operation->computation_stage.jpake); |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8010 | break; |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 8011 | #endif /* PSA_WANT_ALG_JPAKE */ |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8012 | default: |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 8013 | (void) step; |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 8014 | status = PSA_ERROR_NOT_SUPPORTED; |
| 8015 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8016 | } |
| 8017 | |
Przemek Stekiel | 691e91a | 2023-03-07 16:26:37 +0100 | [diff] [blame] | 8018 | status = psa_driver_wrapper_pake_input(operation, driver_step, |
| 8019 | input, input_length); |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8020 | |
| 8021 | if (status != PSA_SUCCESS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 8022 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8023 | } |
| 8024 | |
| 8025 | switch (operation->alg) { |
Przemek Stekiel | 4aa9940 | 2023-02-27 13:00:57 +0100 | [diff] [blame] | 8026 | #if defined(PSA_WANT_ALG_JPAKE) |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8027 | case PSA_ALG_JPAKE: |
| 8028 | status = psa_jpake_input_epilogue(operation); |
| 8029 | if (status != PSA_SUCCESS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 8030 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8031 | } |
| 8032 | break; |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 8033 | #endif /* PSA_WANT_ALG_JPAKE */ |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8034 | default: |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 8035 | status = PSA_ERROR_NOT_SUPPORTED; |
| 8036 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8037 | } |
| 8038 | |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 8039 | return PSA_SUCCESS; |
| 8040 | exit: |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 8041 | psa_pake_abort(operation); |
| 8042 | return status; |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 8043 | } |
| 8044 | |
| 8045 | psa_status_t psa_pake_get_implicit_key( |
| 8046 | psa_pake_operation_t *operation, |
| 8047 | psa_key_derivation_operation_t *output) |
| 8048 | { |
Przemek Stekiel | f62b3bb | 2023-01-31 19:51:24 +0100 | [diff] [blame] | 8049 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 8050 | psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | 251e86a | 2023-02-17 14:30:50 +0100 | [diff] [blame] | 8051 | uint8_t shared_key[MBEDTLS_PSA_JPAKE_BUFFER_SIZE]; |
Przemek Stekiel | 0c78180 | 2022-11-29 14:53:13 +0100 | [diff] [blame] | 8052 | size_t shared_key_len = 0; |
| 8053 | |
Przemek Stekiel | f62b3bb | 2023-01-31 19:51:24 +0100 | [diff] [blame] | 8054 | if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 8055 | status = PSA_ERROR_BAD_STATE; |
| 8056 | goto exit; |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 8057 | } |
| 8058 | |
Przemek Stekiel | 4aa9940 | 2023-02-27 13:00:57 +0100 | [diff] [blame] | 8059 | #if defined(PSA_WANT_ALG_JPAKE) |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8060 | if (operation->alg == PSA_ALG_JPAKE) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 8061 | psa_jpake_computation_stage_t *computation_stage = |
Przemek Stekiel | 083745e | 2023-02-23 17:28:23 +0100 | [diff] [blame] | 8062 | &operation->computation_stage.jpake; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8063 | if (computation_stage->input_step != PSA_PAKE_STEP_DERIVE || |
| 8064 | computation_stage->output_step != PSA_PAKE_STEP_DERIVE) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 8065 | status = PSA_ERROR_BAD_STATE; |
| 8066 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8067 | } |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 8068 | } else |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 8069 | #endif /* PSA_WANT_ALG_JPAKE */ |
Przemek Stekiel | 80a8849 | 2023-02-20 13:32:22 +0100 | [diff] [blame] | 8070 | { |
| 8071 | status = PSA_ERROR_NOT_SUPPORTED; |
| 8072 | goto exit; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8073 | } |
| 8074 | |
Przemek Stekiel | 0c78180 | 2022-11-29 14:53:13 +0100 | [diff] [blame] | 8075 | status = psa_driver_wrapper_pake_get_implicit_key(operation, |
| 8076 | shared_key, |
Przemek Stekiel | 6b64862 | 2023-02-19 22:55:33 +0100 | [diff] [blame] | 8077 | sizeof(shared_key), |
Przemek Stekiel | 0c78180 | 2022-11-29 14:53:13 +0100 | [diff] [blame] | 8078 | &shared_key_len); |
| 8079 | |
| 8080 | if (status != PSA_SUCCESS) { |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 8081 | goto exit; |
Przemek Stekiel | 0c78180 | 2022-11-29 14:53:13 +0100 | [diff] [blame] | 8082 | } |
| 8083 | |
| 8084 | status = psa_key_derivation_input_bytes(output, |
| 8085 | PSA_KEY_DERIVATION_INPUT_SECRET, |
| 8086 | shared_key, |
| 8087 | shared_key_len); |
| 8088 | |
Przemek Stekiel | e3ef3a1 | 2023-02-27 10:20:06 +0100 | [diff] [blame] | 8089 | mbedtls_platform_zeroize(shared_key, sizeof(shared_key)); |
Przemek Stekiel | 3e784d8 | 2023-02-08 09:12:42 +0100 | [diff] [blame] | 8090 | exit: |
| 8091 | abort_status = psa_pake_abort(operation); |
| 8092 | return status == PSA_SUCCESS ? abort_status : status; |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 8093 | } |
| 8094 | |
| 8095 | psa_status_t psa_pake_abort( |
| 8096 | psa_pake_operation_t *operation) |
| 8097 | { |
Przemek Stekiel | d69dca9 | 2023-01-31 19:59:20 +0100 | [diff] [blame] | 8098 | psa_status_t status = PSA_SUCCESS; |
Przemek Stekiel | e12ed36 | 2022-12-21 12:54:46 +0100 | [diff] [blame] | 8099 | |
Przemek Stekiel | d69dca9 | 2023-01-31 19:59:20 +0100 | [diff] [blame] | 8100 | if (operation->stage == PSA_PAKE_OPERATION_STAGE_COMPUTATION) { |
Przemek Stekiel | 9a5b812 | 2022-12-22 13:34:47 +0100 | [diff] [blame] | 8101 | status = psa_driver_wrapper_pake_abort(operation); |
Neil Armstrong | 5ae6096 | 2022-09-15 11:29:46 +0200 | [diff] [blame] | 8102 | } |
Przemek Stekiel | 9a5b812 | 2022-12-22 13:34:47 +0100 | [diff] [blame] | 8103 | |
Przemek Stekiel | 26c909d | 2023-02-28 12:34:03 +0100 | [diff] [blame] | 8104 | if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { |
| 8105 | if (operation->data.inputs.password != NULL) { |
| 8106 | mbedtls_platform_zeroize(operation->data.inputs.password, |
Przemek Stekiel | aa18342 | 2023-03-06 14:21:44 +0100 | [diff] [blame] | 8107 | operation->data.inputs.password_len); |
Przemek Stekiel | 26c909d | 2023-02-28 12:34:03 +0100 | [diff] [blame] | 8108 | mbedtls_free(operation->data.inputs.password); |
| 8109 | } |
| 8110 | if (operation->data.inputs.user != NULL) { |
| 8111 | mbedtls_free(operation->data.inputs.user); |
| 8112 | } |
| 8113 | if (operation->data.inputs.peer != NULL) { |
| 8114 | mbedtls_free(operation->data.inputs.peer); |
| 8115 | } |
Przemek Stekiel | 9a5b812 | 2022-12-22 13:34:47 +0100 | [diff] [blame] | 8116 | } |
Przemek Stekiel | d69dca9 | 2023-01-31 19:59:20 +0100 | [diff] [blame] | 8117 | memset(operation, 0, sizeof(psa_pake_operation_t)); |
Przemek Stekiel | 9a5b812 | 2022-12-22 13:34:47 +0100 | [diff] [blame] | 8118 | |
Przemek Stekiel | d69dca9 | 2023-01-31 19:59:20 +0100 | [diff] [blame] | 8119 | return status; |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 8120 | } |
Neil Armstrong | a7d08c3 | 2022-06-01 18:21:20 +0200 | [diff] [blame] | 8121 | |
Gilles Peskine | e59236f | 2018-01-27 23:32:46 +0100 | [diff] [blame] | 8122 | #endif /* MBEDTLS_PSA_CRYPTO_C */ |